hfs 0.42.3 → 0.44.0

package/frontend/assets/index-fe0f3d77.css

@@ -0,0 +1 @@
+@charset "UTF-8";:root{height:100dvh;--bg: #fff;--text: #555;--ghost-contrast: #8882;--faint-contrast: #8884;--mild-contrast: #8886;--good-contrast: #000a;--button-bg: #68a;--button-text: #eaeaea;--focus-color: #468;--separator: " – "}:root .highlightedText,:root .file-menu a:hover{color:#0006;text-shadow:0 0 3px rgba(0,0,0,.4)}:root .theme-dark{--bg: #000;--text: #999;--good-contrast: #fffa;--button-bg: #345;--button-text: #999;color-scheme:dark}:root .theme-dark .highlightedText,:root .theme-dark .file-menu a:hover,:root .file-menu .theme-dark a:hover{color:#fff;text-shadow:0 0 3px #fff}:root .theme-dark a{color:#8ac}:root .theme-dark .dialog-closer{background:#633}:root .theme-dark .dialog-icon{color:#ccc}:root .theme-dark .dialog-icon .icon{color:#aaa;margin-left:-1px;font-size:95%}:root .theme-dark .dialog-backdrop{background:rgba(51,51,51,.7333333333)}:root .theme-dark .error-msg{color:#b88;background-color:#623}:root .theme-dark button.toggled{color:#eee}body{background-color:var(--bg);margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}body,button,select,input{font-size:12pt}#root{max-width:50em;margin:auto;min-height:100vh;display:flex;flex-direction:column}body,input{color:var(--text)}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}input:not([type=checkbox]),select{padding:.3em .4em;border-radius:.5em;background:var(--bg);border-color:var(--mild-contrast);color:var(--good-contrast);max-width:100%;box-sizing:border-box;width:100%}input[type=checkbox]{transform:scale(1.7);accent-color:var(--button-bg)}label input[type=checkbox]{margin-right:.8em}select{text-align:center}.hidden{display:none!important}.icon{font-size:1.2em}.emoji-icon,.file-icon{display:inline-block;width:1.4em;text-align:center}.file-icon{height:1em;background-size:contain;background-repeat:no-repeat;background-position:center;vertical-align:text-bottom}.icon.mirror:before{transform:scaleX(-1)}a{text-decoration:none;color:#57a}button{background-color:var(--button-bg);color:var(--button-text);padding:.5em 1em;border:transparent;text-decoration:none;border-radius:.3em;vertical-align:middle;cursor:pointer}button:hover{outline:1px solid var(--mild-contrast)}button.toggled{color:#fff;text-shadow:0 0 3px #fff}button:focus-visible,.breadcrumb:focus-visible{outline:3px solid var(--focus-color)}a>button{width:100%}input:focus-visible,select:focus-visible,ul a:focus-visible{border-radius:.3em;border-color:transparent;outline:2px solid var(--focus-color)}.icon-button,ul.dir li .entry-panel .file-menu-button{font-size:.7em;padding:.2em .4em;margin-left:.4em;vertical-align:bottom}.error-msg{background-color:#faa;color:#833;padding:.5em 1em}.hide-back,.upload-toolbar,header{background-color:var(--bg)}header{position:sticky;top:0;padding:.2em;z-index:1}.before-sliding{width:0!important;flex:0!important;margin:0!important;height:0!important;padding:0!important;overflow:hidden!important;transition:flex .5s}.show-sliding{transition:flex .5s;overflow:clip;flex:1;white-space:nowrap}.ani-working{animation:1s blink infinite}@keyframes blink{0%{opacity:1}50%{opacity:.2}}@keyframes spin{to{transform:rotate(360deg)}}@keyframes fade-in{0%{opacity:0}to{opacity:1}}.spinner,.icon.spinner:before{animation:1.5s spin infinite linear;display:inline-flex;justify-content:center;align-items:center;width:min-content}.icon.emoji.spinner{display:inline-block}.breadcrumb{padding:.1em .6em .2em;line-height:1.8em;border-radius:.7em;background-color:var(--button-bg);color:var(--button-text);border-top:1px solid #666;margin-right:-.1em}.breadcrumb:nth-child(-n+3) .icon{padding:0 .2em}#folder-stats,#filter-bar>span{font-size:90%}#folder-stats{margin:.5em 0 0 .5em;float:right}#folder-stats .icon{margin-right:.3em}#filter{flex:1;box-sizing:border-box}#filter-bar{display:flex;align-items:center;gap:.8em;margin:.2em 0 0;padding:2px 0 1px 11px;height:1.8em}#filter-bar input[type=checkbox]{margin-top:.5em}#filter-bar span:empty{display:none}ul.dir{flex:1;padding:0;margin:0;clear:both}ul.dir>p{text-align:center}ul.dir li{display:block;list-style-type:none;padding:.3em .3em .4em;border-bottom:1px solid var(--faint-contrast)}ul.dir li:nth-of-type(odd){background-color:var(--ghost-contrast)}ul.dir li input[type=checkbox]{margin:0 .8em}ul.dir li a:last-of-type{word-break:break-word;padding-right:.3em}ul.dir li a .icon{margin-right:.3em}ul.dir li a:hover{text-decoration:underline}ul.dir li .entry-panel{float:right;margin-top:.3em;display:flex;align-items:center}ul.dir li .entry-panel .file-menu-button{margin:-3px 0 -3px .4em}ul.dir li .entry-panel .entry-details{font-size:90%;margin-left:4px;font-variant-numeric:tabular-nums}ul.dir li .entry-panel .entry-details .entry-size-unit{margin-left:.3em}ul.dir li>div:last-of-type{clear:both}ul.dir li.page-separator{margin-top:1em;position:relative}ul.dir li.page-separator:before{content:attr(label);position:absolute;top:-1.8em;font-size:smaller;margin-left:calc(50% - 1em);opacity:.9}#menu-bar{display:flex;justify-content:space-evenly;flex-wrap:wrap}#menu-bar>*{flex:1;margin:.1em}#menu-bar button{padding-left:0;padding-right:0}#searched{margin:.2em}#user-panel{display:flex;flex-direction:column;gap:1em}#user-panel a>button{width:100%}button label{cursor:inherit;margin-left:.5em}.dialog-backdrop.working{font-size:5em;animation:1s fade-in}.dialog-content{padding:.2em}.dialog-alert .dialog-content{text-align:center}.dialog-alert .dialog-content p{text-align:left;display:inline-block}.dialog{min-width:11em;--color: var(--button-bg)}#paging{position:sticky;bottom:0;display:flex;gap:.1em;background-color:var(--bg);padding:0 .2em .2em}#paging>button{z-index:1}#paging button{box-shadow:0 0 .3em .3em #0003}#paging #paging-middle{padding:0 .5em;margin:0 -.3em;display:flex;gap:.5em;flex:1;overflow-x:auto}#paging #paging-middle>button{flex:1;padding-top:0;padding-bottom:0}#paging button{background:var(--button-bg);text-align:center;white-space:nowrap;padding:.5em}.upload-toolbar{position:sticky;top:-4px}.upload-progress:before{content:var(--separator)}.entry-size:after{content:var(--separator)}.upload-progress{min-width:4em;display:inline-block;margin-left:.5em}.upload-list td:nth-child(1){width:0}.upload-list td:nth-child(2){text-align:right;width:0;white-space:nowrap;padding-left:.5em}.upload-list td:nth-child(3){padding:.2em .5em;word-break:break-word}.dialog-login form{display:flex;flex-direction:column;gap:1.2em}.dialog-login label{display:block;margin-bottom:.5em;margin-left:.1em}.miss-perm{margin:.3em}.popup-menu-button{font-size:.8em;padding:.2em .3em;position:absolute;opacity:.8}.popup-menu-button:hover{opacity:1}.file-dialog .dialog-content{min-width:calc(100% - 1em)}.file-dialog .dialog{min-width:13em}.file-dialog-properties{word-break:break-word;line-height:1.5em}.file-dialog-properties dt{font-weight:700}.file-dialog-properties dd{margin-left:1.5em}.file-menu{margin-top:1em;display:flex;flex-direction:column}.file-menu a{padding:.5em 0}.file-menu a:first-child{padding-top:1em;border-top:1px solid var(--faint-contrast)}.file-menu a .icon{margin-right:.5em}@media (min-width: 42em){body{scrollbar-width:thin;scrollbar-color:var(--button-bg) var(--ghost-contrast)}body::-webkit-scrollbar{width:12px}body::-webkit-scrollbar-track{background:var(--ghost-contrast)}body::-webkit-scrollbar-thumb{background-color:var(--button-bg);border-radius:20px;border:1px solid var(--ghost-contrast)}}@media (max-width: 42em){:root{--ghost-contrast: #8883}body,button,select{font-size:14pt}#menu-bar button label,#filter-bar button label{display:none}#filter-bar{margin-top:.4em}#filter-bar button{width:17.6vw;height:2.3em}.breadcrumb{word-break:break-all}.breadcrumb .icon{font-size:24px}}.dialog-backdrop{position:fixed;inset:0;background:#8886;backdrop-filter:blur(2px);display:flex;justify-content:center;align-items:center;z-index:1000}.dialog{background:#fff;background:var(--bg);padding:max(.5em,1vw);border-radius:1em;position:relative;margin:0 3vw;overflow:hidden;max-height:calc(100vh - 2em);display:flex;flex-direction:column;justify-content:center}.dialog-icon{color:#fff;background-color:var(--color);position:absolute;top:0;width:2em;height:1.8em;text-align:center;border-radius:.8em 0}.dialog-title{font-size:120%;margin-top:-.4em;padding:0 .5em}.dialog-closer~.dialog-title{margin-right:2em}.dialog-type~.dialog-title{margin-left:2em}.dialog-icon~.dialog-title{text-align:center}.dialog-closer{border-radius:0 .8em;right:0;padding:0;background-color:#c88}.dialog-icon~.dialog-content{margin-top:2em}.dialog-type{left:0;top:0;overflow:hidden;line-height:1.8em;opacity:.8}.dialog-content{overflow:auto;max-height:calc(100vh - 4.5em)}.dialog-content p{white-space:pre-wrap;margin:.5em 0}.dialog-confirm .dialog-content button{margin-top:1em}.dialog-alert-info{--color: #282 }.dialog-alert-warning{--color: #c91 }.dialog-alert-error{--color: #822}@media (max-width: 42em){.dialog-icon{font-size:120%}.dialog-icon~.dialog-content{margin-top:2.5em}.dialog-title{margin-top:-.2em}}.dialog-prompt label{display:block;margin-bottom:.5em;margin-left:.1em}

package/{admin/assets/sha512-69b26793.js → frontend/assets/sha512-96fd938f.js}

@@ -1,4 +1,4 @@
-import{c as SF}from"./index-08017e15.js";function OF(iF,hF){for(var eF=0;eF<hF.length;eF++){const tF=hF[eF];if(typeof tF!="string"&&!Array.isArray(tF)){for(const w in tF)if(w!=="default"&&!(w in iF)){const lF=Object.getOwnPropertyDescriptor(tF,w);lF&&Object.defineProperty(iF,w,lF.get?lF:{enumerable:!0,get:()=>tF[w]})}}}return Object.freeze(Object.defineProperty(iF,Symbol.toStringTag,{value:"Module"}))}var EF={},UF={get exports(){return EF},set exports(iF){EF=iF}};/*
+import{c as SF}from"./index-a3b0d6ac.js";function OF(iF,hF){for(var eF=0;eF<hF.length;eF++){const tF=hF[eF];if(typeof tF!="string"&&!Array.isArray(tF)){for(const w in tF)if(w!=="default"&&!(w in iF)){const lF=Object.getOwnPropertyDescriptor(tF,w);lF&&Object.defineProperty(iF,w,lF.get?lF:{enumerable:!0,get:()=>tF[w]})}}}return Object.freeze(Object.defineProperty(iF,Symbol.toStringTag,{value:"Module"}))}var EF={},UF={get exports(){return EF},set exports(iF){EF=iF}};/*
  * [js-sha512]{@link https://github.com/emn178/js-sha512}
  *
  * @version 0.8.0

package/frontend/fontello.css

@@ -1,6 +1,7 @@
 @font-face {
   font-family: 'fontello';
-  src: url('fontello.woff2?66723712') format('woff2');  font-weight: normal;
+  src: url('fontello.woff2?19258766') format('woff2');  font-weight: normal;
+  font-weight: normal;
   font-style: normal;
 }
 /* Chrome hack: SVG is rendered more smooth in Windozze. 100% magic, uncomment if you need it. */
@@ -9,7 +10,7 @@
 @media screen and (-webkit-min-device-pixel-ratio:0) {
   @font-face {
     font-family: 'fontello';
-    src: url('../font/fontello.svg?66723712#fontello') format('svg');
+    src: url('../font/fontello.svg?19258766#fontello') format('svg');
   }
 }
 */
@@ -49,9 +50,11 @@
 }
 
 .fa-cog:before { content: '\e800'; } /* '' */
+.fa-audio:before { content: '\e801'; } /* '' */
 .fa-doc:before { content: '\e802'; } /* '' */
 .fa-stop:before { content: '\e803'; } /* '' */
 .fa-play:before { content: '\e804'; } /* '' */
+.fa-music:before { content: '\e805'; } /* '' */
 .fa-cancel:before { content: '\e806'; } /* '' */
 .fa-edit:before { content: '\e807'; } /* '' */
 .fa-check:before { content: '\e808'; } /* '' */
@@ -63,8 +66,12 @@
 .fa-to_start:before { content: '\e80e'; } /* '' */
 .fa-retweet:before { content: '\e80f'; } /* '' */
 .fa-to_end:before { content: '\e810'; } /* '' */
+.fa-picture:before { content: '\e811'; } /* '' */
+.fa-camera:before { content: '\e812'; } /* '' */
 .fa-search:before { content: '\e813'; } /* '' */
 .fa-logout:before { content: '\e814'; } /* '' */
+.fa-video:before { content: '\e815'; } /* '' */
+.fa-left:before { content: '\e816'; } /* '' */
 .fa-spin6:before { content: '\e839'; } /* '' */
 .fa-crown:before { content: '\e844'; } /* '' */
 .fa-download:before { content: '\f02e'; } /* '' */
@@ -73,5 +80,4 @@
 .fa-menu:before { content: '\f0c9'; } /* '' */
 .fa-quote:before { content: '\f10d'; } /* '' */
 .fa-unlink:before { content: '\f127'; } /* '' */
-.fa-level-up:before { content: '\f148'; } /* '' */
 .fa-archive:before { content: '\f1c6'; } /* '' */

package/frontend/index.html

@@ -5,8 +5,9 @@
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=0" />
     <link href="/fontello.css" rel="stylesheet" />
     
-    <script type="module" crossorigin src="/assets/index-5f125477.js"></script>
-    <link rel="stylesheet" href="/assets/index-a09cacfd.css">
+    <script>HFS={}</script>
+    <script type="module" crossorigin src="/assets/index-a3b0d6ac.js"></script>
+    <link rel="stylesheet" href="/assets/index-fe0f3d77.css">
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hfs",
-  "version": "0.42.3",
+  "version": "0.44.0",
   "description": "HTTP File Server",
   "keywords": [
     "file server",
@@ -20,7 +20,7 @@
     "build-frontend": "npm run build --workspace=frontend",
     "build-admin": "npm run build --workspace=admin",
     "server-for-test": "node dist/src --cwd . --config tests && rm custom.html",
-    "server-for-test-dev": "cross-env DEV=1 nodemon --ignore tests/ --watch src -e ts,tsx --exec ts-node src -- --cwd . --config tests",
+    "server-for-test-dev": "cross-env DEV=1 FRONTEND_PROXY=3005 ADMIN_PROXY=3006 nodemon --ignore tests/ --watch src -e ts,tsx --exec ts-node src -- --cwd . --config tests",
     "test": "mocha -r ts-node/register 'tests/**/*.ts'",
     "pub": "cd dist && npm publish",
     "dist": "npm run build-all && npm run dist-bin",

package/plugins/antibrute/plugin.js

@@ -7,7 +7,7 @@ exports.config = {
     max: { type: 'number', min: 1, defaultValue: 60, helperText: "Max seconds to delay before next login is allowed" },
 }
 exports.configDialog = {
-    maxWidth: '25em',
+    maxWidth: 'xs',
 }
 
 const byIp = {}

package/plugins/download-counter/plugin.js

@@ -1,6 +1,15 @@
-exports.description = "Counts downloads for each file, and displays the total in the list"
-exports.version = 3.1 // removed "hits" word
-exports.apiRequired = 3
+exports.description = "Counts downloads for each file, and displays the total in the list or file menu"
+exports.version = 4 // config.where
+exports.apiRequired = 8
+
+exports.config = {
+    where: { frontend: true, type: 'select', defaultValue: 'menu',
+        options: ['list', { value: 'menu', label: "file menu" }],
+    }
+}
+exports.configDialog = {
+    sx: { maxWidth: '20em' },
+}
 
 exports.init = async api => {
     const _ = api.require('lodash')
@@ -38,8 +47,8 @@ exports.init = async api => {
                 counters[path] = counters[path] + 1 || 1
                 save()
             },
-        onDirEntry: ({ entry, listPath }) => {
-            const path = listPath + entry.n
+        onDirEntry: ({ entry, listUri }) => {
+            const path = listUri + entry.n
             const n = counters[path]
             if (n)
                 entry.hits = n

package/plugins/download-counter/public/main.js

@@ -1,2 +1,12 @@
-HFS.onEvent('additionalEntryProps', ({ entry: { hits } }, { t }) =>
-    hits && `<span class="download-counter" title="${t`download counter`}">${hits}</span>`)
+(() => { // this wrapper avoids name clashing of outer variables and functions
+    const config = HFS.getPluginConfig()
+
+    const inMenu = config.where === 'menu'
+    HFS.onEvent('additionalEntryDetails', ({ entry: { hits } }) =>
+        hits && !inMenu && `<span class="download-counter" title="${HFS.t`download counter`}">${hits}</span>`)
+
+    HFS.onEvent('fileMenu', ({ entry, props }) => {
+        if (inMenu && !entry.isFolder)
+            props.push(["Downloads", entry.hits || 0])
+    })
+})()

package/plugins/vhosting/plugin.js

@@ -21,26 +21,32 @@ exports.init = api => {
     const { matches } = api.require('./misc')
     return {
         middleware(ctx) {
-            let toModify = ctx
+            let params // undefined if we are not going to work on api parameters
             if (ctx.path.startsWith(api.const.SPECIAL_URI)) { // special uris should be excluded...
                 // ...unless it's a frontend api with a path param
-                if (!ctx.path.startsWith(api.const.API_URI) || ctx.params.path === undefined) return
+                if (!ctx.path.startsWith(api.const.API_URI)) return
                 let { referer } = ctx.headers
                 referer &&= new URL(referer).pathname
-                if (referer?.startsWith(ctx.state.revProxyPath + api.const.ADMIN_URI)) return
-                toModify = ctx.params
+                if (referer?.startsWith(ctx.state.revProxyPath + api.const.ADMIN_URI)) return // exclude apis for admin-panel
+                params = ctx.params
             }
+
             const hosts = api.getConfig('hosts')
             if (!hosts?.length) return
-            for (const row of hosts)
-                if (matches(ctx.host, row.host)) {
-                    toModify.path = row.root + toModify.path
-                    return
+            const row = hosts?.find(x => matches(ctx.host, x.host))
+            if (!row) {
+                if (api.getConfig('mandatory')) {
+                    ctx.socket.destroy()
+                    return true
                 }
-            if (api.getConfig('mandatory')) {
-                ctx.socket.destroy()
-                return true
+                return
             }
+            if (!params)
+                ctx.path = row.root + ctx.path
+            else
+                for (const [k,v] of Object.entries(params))
+                    if (k.startsWith('uri'))
+                        params[k] = row.root + v
         }
     }
 }

package/src/adminApis.js

@@ -167,11 +167,11 @@ for (const [k, was] of Object.entries(exports.adminApis))
             : new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, props);
     };
 exports.localhostAdmin = (0, config_1.defineConfig)('localhost_admin', true);
-exports.adminNet = (0, config_1.defineConfig)('admin_net', '');
-exports.favicon = (0, config_1.defineConfig)('favicon');
+exports.adminNet = (0, config_1.defineConfig)('admin_net', '', v => (0, misc_1.makeNetMatcher)(v, true));
+exports.favicon = (0, config_1.defineConfig)('favicon', '');
 exports.title = (0, config_1.defineConfig)('title', "File server");
 function ctxAdminAccess(ctx) {
-    return !ctx.state.proxiedFor // we consider localhost_admin only if no proxy is detected
+    return !ctx.ips.length // we consider localhost_admin only if no proxy is being usedø
         && exports.localhostAdmin.get() && (0, misc_1.isLocalHost)(ctx)
         || (0, perm_1.getFromAccount)(ctx.state.account, a => a.admin);
 }
@@ -187,6 +187,6 @@ function anyAccountCanLoginAdmin() {
 }
 exports.anyAccountCanLoginAdmin = anyAccountCanLoginAdmin;
 function allowAdmin(ctx) {
-    return (0, misc_1.matchesNet)(ctx, exports.adminNet.get(), true);
+    return exports.adminNet.compiled()(ctx.ip);
 }
 exports.allowAdmin = allowAdmin;

package/src/api.auth.js

@@ -11,8 +11,10 @@ const misc_1 = require("./misc");
 const api_helpers_1 = require("./api.helpers");
 const adminApis_1 = require("./adminApis");
 const middlewares_1 = require("./middlewares");
+const config_1 = require("./config");
 const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
 const ongoingLogins = {}; // store data that doesn't fit session object
+const keepSessionAlive = (0, config_1.defineConfig)('keep_session_alive', true);
 // centralized log-in state
 async function loggedIn(ctx, username) {
     const s = ctx.session;
@@ -29,7 +31,8 @@ async function loggedIn(ctx, username) {
     ctx.cookies.set('csrf', (0, misc_1.randomId)(), { signed: false, httpOnly: false });
 }
 function makeExp() {
-    return { exp: new Date(Date.now() + const_1.SESSION_DURATION) };
+    return !keepSessionAlive.get() ? undefined
+        : { exp: new Date(Date.now() + const_1.SESSION_DURATION) };
 }
 const login = async ({ username, password }, ctx) => {
     if (!username || !password) // some validation

package/src/api.file_list.js

@@ -12,19 +12,18 @@ const plugins_1 = require("./plugins");
 const misc_1 = require("./misc");
 const lodash_1 = __importDefault(require("lodash"));
 const const_1 = require("./const");
-const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
-    let node = await (0, vfs_1.urlToNode)(path || '/', ctx);
+const file_list = async ({ uri, offset, limit, search, omit, sse }, ctx) => {
+    const node = await (0, vfs_1.urlToNode)(uri || '/', ctx);
     const list = new apiMiddleware_1.SendListReadable();
     if (!node)
         return fail(const_1.HTTP_NOT_FOUND);
-    const res = (0, vfs_1.statusCodeForMissingPerm)(node, 'can_list', ctx);
-    if (res)
-        return fail(res);
+    if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_list', ctx))
+        return fail();
     if ((0, misc_1.dirTraversal)(search))
         return fail(const_1.HTTP_FOOL);
     if (node.default)
         return (sse ? list.custom : lodash_1.default.identity)({
-            redirect: path // tell the browser to access the folder (instead of using this api), so it will get the default file
+            redirect: uri // tell the browser to access the folder (instead of using this api), so it will get the default file
         });
     if (!await (0, vfs_1.nodeIsDirectory)(node))
         return fail(const_1.HTTP_METHOD_NOT_ALLOWED);
@@ -46,7 +45,7 @@ const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
         list.close();
     });
     return list;
-    function fail(code) {
+    function fail(code = ctx.status) {
         if (!sse)
             return new apiMiddleware_1.ApiError(code);
         list.error(code, true);
@@ -58,10 +57,10 @@ const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
                 break;
             if (!filter((0, vfs_1.getNodeName)(sub)))
                 continue;
-            const entry = await nodeToDirEntry(sub);
+            const entry = await nodeToDirEntry(ctx, sub);
             if (!entry)
                 continue;
-            const cbParams = { entry, ctx, listPath: path, node: sub };
+            const cbParams = { entry, ctx, listUri: uri, node: sub };
             try {
                 if (onDirEntryHandlers.some(cb => cb(cbParams) === false))
                     continue;
@@ -87,7 +86,7 @@ const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
     }
 };
 exports.file_list = file_list;
-async function nodeToDirEntry(node) {
+async function nodeToDirEntry(ctx, node) {
     let { source, default: def } = node;
     const name = (0, vfs_1.getNodeName)(node);
     if (!source)
@@ -98,14 +97,27 @@ async function nodeToDirEntry(node) {
         const st = await (0, promises_1.stat)(source);
         const folder = st.isDirectory();
         const { ctime, mtime } = st;
+        const pl = node.can_list === vfs_1.WHO_NO_ONE ? 'l'
+            : !(0, vfs_1.hasPermission)(node, 'can_list', ctx) ? 'L'
+                : '';
+        // no download here, but maybe inside?
+        const pr = node.can_read === vfs_1.WHO_NO_ONE && !(folder && filesInsideCould()) ? 'r'
+            : !(0, vfs_1.hasPermission)(node, 'can_read', ctx) ? 'R'
+                : '';
         return {
             n: name + (folder ? '/' : ''),
             c: ctime,
             m: Math.abs(+mtime - +ctime) < 1000 ? undefined : mtime,
             s: folder ? undefined : st.size,
+            p: (pr + pl) || undefined
         };
     }
     catch (_a) {
         return null;
     }
+    function filesInsideCould(n = node) {
+        var _a;
+        return (0, vfs_1.masksCouldGivePermission)(n.masks, 'can_read')
+            || ((_a = n.children) === null || _a === void 0 ? void 0 : _a.some(c => c.can_read || filesInsideCould(c))); // we count on the boolean-compliant nature of the permission type here
+    }
 }

package/src/api.lang.js

@@ -10,21 +10,23 @@ const fast_glob_1 = __importDefault(require("fast-glob"));
 const promises_1 = require("fs/promises");
 const const_1 = require("./const");
 const misc_1 = require("./misc");
-const PREFIX = 'hfs-lang-';
-const SUFFIX = '.json';
+const lang_1 = require("./lang");
+const embedded_1 = __importDefault(require("./langs/embedded"));
 const apis = {
     list_langs() {
         return new apiMiddleware_1.SendListReadable({
             doAtStart: async (list) => {
-                for await (let name of fast_glob_1.default.stream(code2file('*'))) {
+                for await (let name of fast_glob_1.default.stream((0, lang_1.code2file)('*'))) {
                     name = String(name);
-                    const code = name.slice(PREFIX.length, -SUFFIX.length);
+                    const code = (0, lang_1.file2code)(name);
                     try {
                         const data = JSON.parse(await (0, promises_1.readFile)(name, 'utf8'));
                         list.add({ code, ...lodash_1.default.omit(data, 'translate') });
                     }
                     catch (_a) { }
                 }
+                for (const [code, data] of Object.entries(embedded_1.default))
+                    list.add({ code, embedded: true, ...lodash_1.default.omit(data, 'translate') });
                 list.close();
             }
         });
@@ -32,7 +34,7 @@ const apis = {
     async del_lang({ code }) {
         validateCode(code);
         try {
-            await (0, promises_1.rm)(code2file(code));
+            await (0, promises_1.rm)((0, lang_1.code2file)(code));
             return {};
         }
         catch (e) {
@@ -41,10 +43,9 @@ const apis = {
     },
     async add_langs({ langs }) {
         for (let [code, content] of Object.entries(langs)) {
-            if (code.endsWith(SUFFIX)) // filename, actually
-                code = code.slice(PREFIX.length, -SUFFIX.length);
+            code = (0, lang_1.file2code)(code);
             validateCode(code);
-            const fn = code2file(code);
+            const fn = (0, lang_1.code2file)(code);
             const s = content = String(content);
             if (!(0, misc_1.tryJson)(s))
                 return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE, "bad content for file " + fn);
@@ -54,9 +55,6 @@ const apis = {
     }
 };
 exports.default = apis;
-function code2file(code) {
-    return PREFIX + code.toLowerCase() + SUFFIX;
-}
 function validateCode(code) {
     if (!/^(\w\w)(-\w\w)*$/.test(code))
         throw new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad code/filename');

package/src/api.vfs.js

@@ -20,37 +20,45 @@ async function urlToNodeOriginal(uri) {
 const apis = {
     async get_vfs() {
         return {
-            root: vfs_1.vfs && await recur(vfs_1.vfs),
+            root: await recur(),
             defaultPerms: vfs_1.defaultPerms,
         };
-        async function recur(node) {
+        async function recur(node = vfs_1.vfs) {
             var _a;
-            const stats = Boolean(node.source) && await (0, promises_1.stat)(node.source).catch(e => false);
-            const isDir = !node.source || stats && stats.isDirectory();
+            const { source } = node;
+            const stats = Boolean(source) && await (0, promises_1.stat)(source).catch(() => false);
+            const isDir = !source || stats && stats.isDirectory();
             const copyStats = stats ? lodash_1.default.pick(stats, ['size', 'ctime', 'mtime'])
-                : { size: node.source ? -1 : undefined };
+                : { size: source ? -1 : undefined };
             if (copyStats.mtime && Number(copyStats.mtime) === Number(copyStats.ctime))
                 delete copyStats.mtime;
-            const isRoot = node === vfs_1.vfs;
+            let byMasks = node.original && lodash_1.default.pickBy(node, (v, k) => v !== node.original[k] // something is changing me...
+                && v !== node.parent[k] // ...and it's not inheritance...
+                && vfs_1.PERM_KEYS.includes(k)); // ...must be masks. Please limit this to perms
+            if (lodash_1.default.isEmpty(byMasks))
+                byMasks = undefined;
             return {
                 ...copyStats,
-                ...node,
+                ...node.original || node,
+                byMasks,
                 website: Boolean((_a = node.children) === null || _a === void 0 ? void 0 : _a.find((0, vfs_1.isSameFilenameAs)('index.html')))
-                    || isDir && node.source && await (0, promises_1.stat)((0, path_1.join)(node.source, 'index.html')).then(() => true, () => undefined)
+                    || isDir && source && await (0, promises_1.stat)((0, path_1.join)(source, 'index.html')).then(() => true, () => undefined)
                     || undefined,
-                name: isRoot ? undefined : (0, vfs_1.getNodeName)(node),
+                name: node === vfs_1.vfs ? undefined : (0, vfs_1.getNodeName)(node),
                 type: isDir ? 'folder' : undefined,
-                children: node.children && await Promise.all(node.children.map(recur)),
+                children: node.children && await Promise.all(node.children.map(async (original) => recur((0, vfs_1.applyParentToChild)(original, node))))
             };
         }
     },
     async move_vfs({ from, parent }) {
         var _a;
-        if (from <= '/' || !parent)
+        if (!from || !parent)
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
         const fromNode = await urlToNodeOriginal(from);
         if (!fromNode)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'from not found');
+        if (fromNode === vfs_1.vfs)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'from is root');
         const parentNode = await urlToNodeOriginal(parent);
         if (!parentNode)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'parent not found');
@@ -70,39 +78,39 @@ const apis = {
         const n = await urlToNodeOriginal(uri);
         if (!n)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'path not found');
-        props = pickProps(props, ['name', 'source', 'masks', 'default', 'accept', ...Object.keys(vfs_1.defaultPerms)]);
+        props = pickProps(props, ['name', 'source', 'masks', 'default', 'accept', ...vfs_1.PERM_KEYS]); // sanitize
         if (props.name && props.name !== (0, vfs_1.getNodeName)(n)) {
             const parent = await urlToNodeOriginal((0, path_1.dirname)(uri));
             if ((_a = parent === null || parent === void 0 ? void 0 : parent.children) === null || _a === void 0 ? void 0 : _a.find(x => (0, vfs_1.getNodeName)(x) === props.name))
                 return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT, 'name already present');
         }
-        props = (0, misc_1.newObj)(props, v => v === null ? undefined : v); // null is a way to serialize undefined, that will restore default values
         if (props.masks && typeof props.masks !== 'object')
             delete props.masks;
         Object.assign(n, props);
-        if ((0, vfs_1.getNodeName)(lodash_1.default.omit(n, ['name'])) === n.name) // name only if necessary
-            n.name = undefined;
+        simplifyName(n);
         await (0, vfs_1.saveVfs)();
         return n;
     },
     async add_vfs({ parent, source, name }) {
         var _a;
-        const n = parent ? await urlToNodeOriginal(parent) : vfs_1.vfs;
-        if (!n)
-            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'invalid parent');
-        if (n.isTemp || !await (0, vfs_1.nodeIsDirectory)(n))
-            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE, 'invalid parent');
+        if (!source && !name)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'name or source required');
+        parent = parent ? await urlToNodeOriginal(parent) : vfs_1.vfs;
+        if (!parent)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'parent not found');
+        if (!await (0, vfs_1.nodeIsDirectory)(parent))
+            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE, 'parent not a folder');
         if ((0, misc_1.isWindowsDrive)(source))
             source += '\\'; // slash must be included, otherwise it will refer to the cwd of that drive
-        let tryName = (0, vfs_1.getNodeName)({ name, source });
-        const ext = (0, path_1.extname)(tryName);
-        const noExt = ext ? tryName.slice(0, -ext.length) : tryName;
+        const child = { source, name };
+        name = (0, vfs_1.getNodeName)(child); // could be not given as input
+        const ext = (0, path_1.extname)(name);
+        const noExt = ext ? name.slice(0, -ext.length) : name;
         let idx = 2;
-        while ((_a = n.children) === null || _a === void 0 ? void 0 : _a.find((0, vfs_1.isSameFilenameAs)(tryName)))
-            tryName = `${noExt} ${idx++}${ext}`;
-        name = tryName;
-        n.children || (n.children = []);
-        n.children.unshift({ source, name });
+        while ((_a = parent.children) === null || _a === void 0 ? void 0 : _a.find((0, vfs_1.isSameFilenameAs)(name)))
+            name = `${noExt} ${idx++}${ext}`;
+        child.name = name;
+        (parent.children || (parent.children = [])).unshift({ source, name });
         await (0, vfs_1.saveVfs)();
         return { name };
     },
@@ -154,13 +162,14 @@ const apis = {
             return;
         }
         try {
+            const matching = (0, misc_1.makeMatcher)(fileMask);
             path = (0, misc_1.isWindowsDrive)(path) ? path + '\\' : (0, path_1.resolve)(path || '/');
             for await (const [name, isDir] of (0, misc_1.dirStream)(path)) {
                 if (ctx.req.aborted)
                     return;
                 try {
                     if (!isDir)
-                        if (!files || fileMask && !(0, misc_1.matches)(name, fileMask))
+                        if (!files || fileMask && !matching(name))
                             continue;
                     const stats = await (0, promises_1.stat)((0, path_1.join)(path, name));
                     yield {
@@ -191,3 +200,8 @@ function pickProps(o, keys) {
                 ret[k] = o[k] === null || o[k] === '' ? undefined : o[k];
     return ret;
 }
+function simplifyName(node) {
+    const { name, ...noName } = node;
+    if ((0, vfs_1.getNodeName)(noName) === name)
+        delete node.name;
+}

package/src/apiMiddleware.js

@@ -31,8 +31,9 @@ function apiMiddleware(apis) {
         // we don't rely on SameSite cookie option because it's https-only
         let res;
         try {
-            if (params.path)
-                params.path = (0, misc_1.removeStarting)(ctx.state.revProxyPath, params.path);
+            for (const [k, v] of Object.entries(params))
+                if (k.startsWith('uri') && typeof v === 'string')
+                    params[k] = (0, misc_1.removeStarting)(ctx.state.revProxyPath, v);
             res = csrf && csrf !== params.csrf ? new ApiError(const_1.HTTP_UNAUTHORIZED, 'csrf')
                 : await apiFun(params || {}, ctx);
         }

package/src/block.js

@@ -1,34 +1,20 @@
 "use strict";
 // This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyBlock = void 0;
 const config_1 = require("./config");
 const connections_1 = require("./connections");
 const misc_1 = require("./misc");
-const cidr_tools_1 = __importDefault(require("cidr-tools"));
-const lodash_1 = __importDefault(require("lodash"));
-let blockFunctions = []; // "compiled" versions of the rules in config.block
-(0, config_1.defineConfig)('block', []).sub(rules => {
-    compileBlock(rules);
+const block = (0, config_1.defineConfig)('block', [], rules => {
+    const ret = !Array.isArray(rules) ? []
+        : (0, misc_1.onlyTruthy)(rules.map(rule => (0, misc_1.makeNetMatcher)(rule.ip, true)));
+    // reapply new block to existing connections
     for (const { socket, ip } of (0, connections_1.getConnections)())
         applyBlock(socket, ip);
+    return ret;
 });
-function compileBlock(rules) {
-    blockFunctions = !Array.isArray(rules) ? []
-        : (0, misc_1.onlyTruthy)(rules.map(rule => !rule ? null
-            : (0, misc_1.with_)(rule.ip, ip => typeof ip !== 'string' ? null
-                : ip.includes('/') ? x => cidr_tools_1.default.contains(ip, x)
-                    : ip.includes('*') ? (0, misc_1.with_)(ipMask2regExp(ip), re => x => re.test(x))
-                        : x => x === ip)));
-    function ipMask2regExp(ipMask) {
-        return new RegExp(lodash_1.default.escapeRegExp(ipMask).replace(/\\\*/g, '.*'));
-    }
-}
 function applyBlock(socket, ip = (0, connections_1.normalizeIp)(socket.remoteAddress || '')) {
-    if (ip && blockFunctions.find(rule => rule(ip)))
+    if (ip && block.compiled().find(rule => rule(ip)))
         return socket.destroy();
 }
 exports.applyBlock = applyBlock;

package/src/config.js

@@ -51,8 +51,11 @@ const { save } = (0, watchLoad_1.watchLoad)(path, values => setConfig(values ||
         setConfig({}, false);
     }
 });
-function defineConfig(k, defaultValue) {
+function defineConfig(k, defaultValue, compiler = lodash_1.default.identity) {
     configProps[k] = { defaultValue };
+    let compiled = compiler(defaultValue);
+    if (compiler)
+        subscribeConfig(k, (v) => compiled = compiler(v));
     return {
         key() {
             return k;
@@ -68,7 +71,8 @@ function defineConfig(k, defaultValue) {
                 this.set(v(this.get()));
             else
                 setConfig1(k, v);
-        }
+        },
+        compiled: () => compiled
     };
 }
 exports.defineConfig = defineConfig;