hfs 0.43.0 → 0.44.0

package/frontend/assets/index-fe0f3d77.css

@@ -0,0 +1 @@
+@charset "UTF-8";:root{height:100dvh;--bg: #fff;--text: #555;--ghost-contrast: #8882;--faint-contrast: #8884;--mild-contrast: #8886;--good-contrast: #000a;--button-bg: #68a;--button-text: #eaeaea;--focus-color: #468;--separator: " – "}:root .highlightedText,:root .file-menu a:hover{color:#0006;text-shadow:0 0 3px rgba(0,0,0,.4)}:root .theme-dark{--bg: #000;--text: #999;--good-contrast: #fffa;--button-bg: #345;--button-text: #999;color-scheme:dark}:root .theme-dark .highlightedText,:root .theme-dark .file-menu a:hover,:root .file-menu .theme-dark a:hover{color:#fff;text-shadow:0 0 3px #fff}:root .theme-dark a{color:#8ac}:root .theme-dark .dialog-closer{background:#633}:root .theme-dark .dialog-icon{color:#ccc}:root .theme-dark .dialog-icon .icon{color:#aaa;margin-left:-1px;font-size:95%}:root .theme-dark .dialog-backdrop{background:rgba(51,51,51,.7333333333)}:root .theme-dark .error-msg{color:#b88;background-color:#623}:root .theme-dark button.toggled{color:#eee}body{background-color:var(--bg);margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}body,button,select,input{font-size:12pt}#root{max-width:50em;margin:auto;min-height:100vh;display:flex;flex-direction:column}body,input{color:var(--text)}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}input:not([type=checkbox]),select{padding:.3em .4em;border-radius:.5em;background:var(--bg);border-color:var(--mild-contrast);color:var(--good-contrast);max-width:100%;box-sizing:border-box;width:100%}input[type=checkbox]{transform:scale(1.7);accent-color:var(--button-bg)}label input[type=checkbox]{margin-right:.8em}select{text-align:center}.hidden{display:none!important}.icon{font-size:1.2em}.emoji-icon,.file-icon{display:inline-block;width:1.4em;text-align:center}.file-icon{height:1em;background-size:contain;background-repeat:no-repeat;background-position:center;vertical-align:text-bottom}.icon.mirror:before{transform:scaleX(-1)}a{text-decoration:none;color:#57a}button{background-color:var(--button-bg);color:var(--button-text);padding:.5em 1em;border:transparent;text-decoration:none;border-radius:.3em;vertical-align:middle;cursor:pointer}button:hover{outline:1px solid var(--mild-contrast)}button.toggled{color:#fff;text-shadow:0 0 3px #fff}button:focus-visible,.breadcrumb:focus-visible{outline:3px solid var(--focus-color)}a>button{width:100%}input:focus-visible,select:focus-visible,ul a:focus-visible{border-radius:.3em;border-color:transparent;outline:2px solid var(--focus-color)}.icon-button,ul.dir li .entry-panel .file-menu-button{font-size:.7em;padding:.2em .4em;margin-left:.4em;vertical-align:bottom}.error-msg{background-color:#faa;color:#833;padding:.5em 1em}.hide-back,.upload-toolbar,header{background-color:var(--bg)}header{position:sticky;top:0;padding:.2em;z-index:1}.before-sliding{width:0!important;flex:0!important;margin:0!important;height:0!important;padding:0!important;overflow:hidden!important;transition:flex .5s}.show-sliding{transition:flex .5s;overflow:clip;flex:1;white-space:nowrap}.ani-working{animation:1s blink infinite}@keyframes blink{0%{opacity:1}50%{opacity:.2}}@keyframes spin{to{transform:rotate(360deg)}}@keyframes fade-in{0%{opacity:0}to{opacity:1}}.spinner,.icon.spinner:before{animation:1.5s spin infinite linear;display:inline-flex;justify-content:center;align-items:center;width:min-content}.icon.emoji.spinner{display:inline-block}.breadcrumb{padding:.1em .6em .2em;line-height:1.8em;border-radius:.7em;background-color:var(--button-bg);color:var(--button-text);border-top:1px solid #666;margin-right:-.1em}.breadcrumb:nth-child(-n+3) .icon{padding:0 .2em}#folder-stats,#filter-bar>span{font-size:90%}#folder-stats{margin:.5em 0 0 .5em;float:right}#folder-stats .icon{margin-right:.3em}#filter{flex:1;box-sizing:border-box}#filter-bar{display:flex;align-items:center;gap:.8em;margin:.2em 0 0;padding:2px 0 1px 11px;height:1.8em}#filter-bar input[type=checkbox]{margin-top:.5em}#filter-bar span:empty{display:none}ul.dir{flex:1;padding:0;margin:0;clear:both}ul.dir>p{text-align:center}ul.dir li{display:block;list-style-type:none;padding:.3em .3em .4em;border-bottom:1px solid var(--faint-contrast)}ul.dir li:nth-of-type(odd){background-color:var(--ghost-contrast)}ul.dir li input[type=checkbox]{margin:0 .8em}ul.dir li a:last-of-type{word-break:break-word;padding-right:.3em}ul.dir li a .icon{margin-right:.3em}ul.dir li a:hover{text-decoration:underline}ul.dir li .entry-panel{float:right;margin-top:.3em;display:flex;align-items:center}ul.dir li .entry-panel .file-menu-button{margin:-3px 0 -3px .4em}ul.dir li .entry-panel .entry-details{font-size:90%;margin-left:4px;font-variant-numeric:tabular-nums}ul.dir li .entry-panel .entry-details .entry-size-unit{margin-left:.3em}ul.dir li>div:last-of-type{clear:both}ul.dir li.page-separator{margin-top:1em;position:relative}ul.dir li.page-separator:before{content:attr(label);position:absolute;top:-1.8em;font-size:smaller;margin-left:calc(50% - 1em);opacity:.9}#menu-bar{display:flex;justify-content:space-evenly;flex-wrap:wrap}#menu-bar>*{flex:1;margin:.1em}#menu-bar button{padding-left:0;padding-right:0}#searched{margin:.2em}#user-panel{display:flex;flex-direction:column;gap:1em}#user-panel a>button{width:100%}button label{cursor:inherit;margin-left:.5em}.dialog-backdrop.working{font-size:5em;animation:1s fade-in}.dialog-content{padding:.2em}.dialog-alert .dialog-content{text-align:center}.dialog-alert .dialog-content p{text-align:left;display:inline-block}.dialog{min-width:11em;--color: var(--button-bg)}#paging{position:sticky;bottom:0;display:flex;gap:.1em;background-color:var(--bg);padding:0 .2em .2em}#paging>button{z-index:1}#paging button{box-shadow:0 0 .3em .3em #0003}#paging #paging-middle{padding:0 .5em;margin:0 -.3em;display:flex;gap:.5em;flex:1;overflow-x:auto}#paging #paging-middle>button{flex:1;padding-top:0;padding-bottom:0}#paging button{background:var(--button-bg);text-align:center;white-space:nowrap;padding:.5em}.upload-toolbar{position:sticky;top:-4px}.upload-progress:before{content:var(--separator)}.entry-size:after{content:var(--separator)}.upload-progress{min-width:4em;display:inline-block;margin-left:.5em}.upload-list td:nth-child(1){width:0}.upload-list td:nth-child(2){text-align:right;width:0;white-space:nowrap;padding-left:.5em}.upload-list td:nth-child(3){padding:.2em .5em;word-break:break-word}.dialog-login form{display:flex;flex-direction:column;gap:1.2em}.dialog-login label{display:block;margin-bottom:.5em;margin-left:.1em}.miss-perm{margin:.3em}.popup-menu-button{font-size:.8em;padding:.2em .3em;position:absolute;opacity:.8}.popup-menu-button:hover{opacity:1}.file-dialog .dialog-content{min-width:calc(100% - 1em)}.file-dialog .dialog{min-width:13em}.file-dialog-properties{word-break:break-word;line-height:1.5em}.file-dialog-properties dt{font-weight:700}.file-dialog-properties dd{margin-left:1.5em}.file-menu{margin-top:1em;display:flex;flex-direction:column}.file-menu a{padding:.5em 0}.file-menu a:first-child{padding-top:1em;border-top:1px solid var(--faint-contrast)}.file-menu a .icon{margin-right:.5em}@media (min-width: 42em){body{scrollbar-width:thin;scrollbar-color:var(--button-bg) var(--ghost-contrast)}body::-webkit-scrollbar{width:12px}body::-webkit-scrollbar-track{background:var(--ghost-contrast)}body::-webkit-scrollbar-thumb{background-color:var(--button-bg);border-radius:20px;border:1px solid var(--ghost-contrast)}}@media (max-width: 42em){:root{--ghost-contrast: #8883}body,button,select{font-size:14pt}#menu-bar button label,#filter-bar button label{display:none}#filter-bar{margin-top:.4em}#filter-bar button{width:17.6vw;height:2.3em}.breadcrumb{word-break:break-all}.breadcrumb .icon{font-size:24px}}.dialog-backdrop{position:fixed;inset:0;background:#8886;backdrop-filter:blur(2px);display:flex;justify-content:center;align-items:center;z-index:1000}.dialog{background:#fff;background:var(--bg);padding:max(.5em,1vw);border-radius:1em;position:relative;margin:0 3vw;overflow:hidden;max-height:calc(100vh - 2em);display:flex;flex-direction:column;justify-content:center}.dialog-icon{color:#fff;background-color:var(--color);position:absolute;top:0;width:2em;height:1.8em;text-align:center;border-radius:.8em 0}.dialog-title{font-size:120%;margin-top:-.4em;padding:0 .5em}.dialog-closer~.dialog-title{margin-right:2em}.dialog-type~.dialog-title{margin-left:2em}.dialog-icon~.dialog-title{text-align:center}.dialog-closer{border-radius:0 .8em;right:0;padding:0;background-color:#c88}.dialog-icon~.dialog-content{margin-top:2em}.dialog-type{left:0;top:0;overflow:hidden;line-height:1.8em;opacity:.8}.dialog-content{overflow:auto;max-height:calc(100vh - 4.5em)}.dialog-content p{white-space:pre-wrap;margin:.5em 0}.dialog-confirm .dialog-content button{margin-top:1em}.dialog-alert-info{--color: #282 }.dialog-alert-warning{--color: #c91 }.dialog-alert-error{--color: #822}@media (max-width: 42em){.dialog-icon{font-size:120%}.dialog-icon~.dialog-content{margin-top:2.5em}.dialog-title{margin-top:-.2em}}.dialog-prompt label{display:block;margin-bottom:.5em;margin-left:.1em}

package/{admin/assets/sha512-55ff2fa3.js → frontend/assets/sha512-96fd938f.js}

@@ -1,4 +1,4 @@
-import{c as SF}from"./index-5cd667a5.js";function OF(iF,hF){for(var eF=0;eF<hF.length;eF++){const tF=hF[eF];if(typeof tF!="string"&&!Array.isArray(tF)){for(const w in tF)if(w!=="default"&&!(w in iF)){const lF=Object.getOwnPropertyDescriptor(tF,w);lF&&Object.defineProperty(iF,w,lF.get?lF:{enumerable:!0,get:()=>tF[w]})}}}return Object.freeze(Object.defineProperty(iF,Symbol.toStringTag,{value:"Module"}))}var EF={},UF={get exports(){return EF},set exports(iF){EF=iF}};/*
+import{c as SF}from"./index-a3b0d6ac.js";function OF(iF,hF){for(var eF=0;eF<hF.length;eF++){const tF=hF[eF];if(typeof tF!="string"&&!Array.isArray(tF)){for(const w in tF)if(w!=="default"&&!(w in iF)){const lF=Object.getOwnPropertyDescriptor(tF,w);lF&&Object.defineProperty(iF,w,lF.get?lF:{enumerable:!0,get:()=>tF[w]})}}}return Object.freeze(Object.defineProperty(iF,Symbol.toStringTag,{value:"Module"}))}var EF={},UF={get exports(){return EF},set exports(iF){EF=iF}};/*
  * [js-sha512]{@link https://github.com/emn178/js-sha512}
  *
  * @version 0.8.0

package/frontend/index.html

@@ -5,8 +5,9 @@
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=0" />
     <link href="/fontello.css" rel="stylesheet" />
     
-    <script type="module" crossorigin src="/assets/index-27488fde.js"></script>
-    <link rel="stylesheet" href="/assets/index-54a5c76f.css">
+    <script>HFS={}</script>
+    <script type="module" crossorigin src="/assets/index-a3b0d6ac.js"></script>
+    <link rel="stylesheet" href="/assets/index-fe0f3d77.css">
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hfs",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "HTTP File Server",
   "keywords": [
     "file server",
@@ -20,7 +20,7 @@
     "build-frontend": "npm run build --workspace=frontend",
     "build-admin": "npm run build --workspace=admin",
     "server-for-test": "node dist/src --cwd . --config tests && rm custom.html",
-    "server-for-test-dev": "cross-env DEV=1 nodemon --ignore tests/ --watch src -e ts,tsx --exec ts-node src -- --cwd . --config tests",
+    "server-for-test-dev": "cross-env DEV=1 FRONTEND_PROXY=3005 ADMIN_PROXY=3006 nodemon --ignore tests/ --watch src -e ts,tsx --exec ts-node src -- --cwd . --config tests",
     "test": "mocha -r ts-node/register 'tests/**/*.ts'",
     "pub": "cd dist && npm publish",
     "dist": "npm run build-all && npm run dist-bin",

package/plugins/download-counter/plugin.js

@@ -3,7 +3,9 @@ exports.version = 4 // config.where
 exports.apiRequired = 8
 
 exports.config = {
-    where: { frontend: true, type: 'select', options: ['list', 'menu'] }
+    where: { frontend: true, type: 'select', defaultValue: 'menu',
+        options: ['list', { value: 'menu', label: "file menu" }],
+    }
 }
 exports.configDialog = {
     sx: { maxWidth: '20em' },
@@ -45,8 +47,8 @@ exports.init = async api => {
                 counters[path] = counters[path] + 1 || 1
                 save()
             },
-        onDirEntry: ({ entry, listPath }) => {
-            const path = listPath + entry.n
+        onDirEntry: ({ entry, listUri }) => {
+            const path = listUri + entry.n
             const n = counters[path]
             if (n)
                 entry.hits = n

package/plugins/download-counter/public/main.js

@@ -2,8 +2,8 @@
     const config = HFS.getPluginConfig()
 
     const inMenu = config.where === 'menu'
-    HFS.onEvent('additionalEntryProps', ({ entry: { hits } }, { t }) =>
-        hits && !inMenu && `<span class="download-counter" title="${t`download counter`}">${hits}</span>`)
+    HFS.onEvent('additionalEntryDetails', ({ entry: { hits } }) =>
+        hits && !inMenu && `<span class="download-counter" title="${HFS.t`download counter`}">${hits}</span>`)
 
     HFS.onEvent('fileMenu', ({ entry, props }) => {
         if (inMenu && !entry.isFolder)

package/plugins/vhosting/plugin.js

@@ -21,26 +21,32 @@ exports.init = api => {
     const { matches } = api.require('./misc')
     return {
         middleware(ctx) {
-            let toModify = ctx
+            let params // undefined if we are not going to work on api parameters
             if (ctx.path.startsWith(api.const.SPECIAL_URI)) { // special uris should be excluded...
                 // ...unless it's a frontend api with a path param
-                if (!ctx.path.startsWith(api.const.API_URI) || ctx.params.path === undefined) return
+                if (!ctx.path.startsWith(api.const.API_URI)) return
                 let { referer } = ctx.headers
                 referer &&= new URL(referer).pathname
-                if (referer?.startsWith(ctx.state.revProxyPath + api.const.ADMIN_URI)) return
-                toModify = ctx.params
+                if (referer?.startsWith(ctx.state.revProxyPath + api.const.ADMIN_URI)) return // exclude apis for admin-panel
+                params = ctx.params
             }
+
             const hosts = api.getConfig('hosts')
             if (!hosts?.length) return
-            for (const row of hosts)
-                if (matches(ctx.host, row.host)) {
-                    toModify.path = row.root + toModify.path
-                    return
+            const row = hosts?.find(x => matches(ctx.host, x.host))
+            if (!row) {
+                if (api.getConfig('mandatory')) {
+                    ctx.socket.destroy()
+                    return true
                 }
-            if (api.getConfig('mandatory')) {
-                ctx.socket.destroy()
-                return true
+                return
             }
+            if (!params)
+                ctx.path = row.root + ctx.path
+            else
+                for (const [k,v] of Object.entries(params))
+                    if (k.startsWith('uri'))
+                        params[k] = row.root + v
         }
     }
 }

package/src/adminApis.js

@@ -171,7 +171,7 @@ exports.adminNet = (0, config_1.defineConfig)('admin_net', '', v => (0, misc_1.m
 exports.favicon = (0, config_1.defineConfig)('favicon', '');
 exports.title = (0, config_1.defineConfig)('title', "File server");
 function ctxAdminAccess(ctx) {
-    return !ctx.state.proxiedFor // we consider localhost_admin only if no proxy is detected
+    return !ctx.ips.length // we consider localhost_admin only if no proxy is being usedø
         && exports.localhostAdmin.get() && (0, misc_1.isLocalHost)(ctx)
         || (0, perm_1.getFromAccount)(ctx.state.account, a => a.admin);
 }

package/src/api.auth.js

@@ -11,8 +11,10 @@ const misc_1 = require("./misc");
 const api_helpers_1 = require("./api.helpers");
 const adminApis_1 = require("./adminApis");
 const middlewares_1 = require("./middlewares");
+const config_1 = require("./config");
 const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
 const ongoingLogins = {}; // store data that doesn't fit session object
+const keepSessionAlive = (0, config_1.defineConfig)('keep_session_alive', true);
 // centralized log-in state
 async function loggedIn(ctx, username) {
     const s = ctx.session;
@@ -29,7 +31,8 @@ async function loggedIn(ctx, username) {
     ctx.cookies.set('csrf', (0, misc_1.randomId)(), { signed: false, httpOnly: false });
 }
 function makeExp() {
-    return { exp: new Date(Date.now() + const_1.SESSION_DURATION) };
+    return !keepSessionAlive.get() ? undefined
+        : { exp: new Date(Date.now() + const_1.SESSION_DURATION) };
 }
 const login = async ({ username, password }, ctx) => {
     if (!username || !password) // some validation

package/src/api.file_list.js

@@ -12,19 +12,18 @@ const plugins_1 = require("./plugins");
 const misc_1 = require("./misc");
 const lodash_1 = __importDefault(require("lodash"));
 const const_1 = require("./const");
-const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
-    let node = await (0, vfs_1.urlToNode)(path || '/', ctx);
+const file_list = async ({ uri, offset, limit, search, omit, sse }, ctx) => {
+    const node = await (0, vfs_1.urlToNode)(uri || '/', ctx);
     const list = new apiMiddleware_1.SendListReadable();
     if (!node)
         return fail(const_1.HTTP_NOT_FOUND);
-    const res = (0, vfs_1.statusCodeForMissingPerm)(node, 'can_list', ctx);
-    if (res)
-        return fail(res);
+    if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_list', ctx))
+        return fail();
     if ((0, misc_1.dirTraversal)(search))
         return fail(const_1.HTTP_FOOL);
     if (node.default)
         return (sse ? list.custom : lodash_1.default.identity)({
-            redirect: path // tell the browser to access the folder (instead of using this api), so it will get the default file
+            redirect: uri // tell the browser to access the folder (instead of using this api), so it will get the default file
         });
     if (!await (0, vfs_1.nodeIsDirectory)(node))
         return fail(const_1.HTTP_METHOD_NOT_ALLOWED);
@@ -46,7 +45,7 @@ const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
         list.close();
     });
     return list;
-    function fail(code) {
+    function fail(code = ctx.status) {
         if (!sse)
             return new apiMiddleware_1.ApiError(code);
         list.error(code, true);
@@ -61,7 +60,7 @@ const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
             const entry = await nodeToDirEntry(ctx, sub);
             if (!entry)
                 continue;
-            const cbParams = { entry, ctx, listPath: path, node: sub };
+            const cbParams = { entry, ctx, listUri: uri, node: sub };
             try {
                 if (onDirEntryHandlers.some(cb => cb(cbParams) === false))
                     continue;

package/src/api.lang.js

@@ -11,6 +11,7 @@ const promises_1 = require("fs/promises");
 const const_1 = require("./const");
 const misc_1 = require("./misc");
 const lang_1 = require("./lang");
+const embedded_1 = __importDefault(require("./langs/embedded"));
 const apis = {
     list_langs() {
         return new apiMiddleware_1.SendListReadable({
@@ -24,7 +25,7 @@ const apis = {
                     }
                     catch (_a) { }
                 }
-                for (const [code, data] of Object.entries(lang_1.EMBEDDED_TRANSLATIONS))
+                for (const [code, data] of Object.entries(embedded_1.default))
                     list.add({ code, embedded: true, ...lodash_1.default.omit(data, 'translate') });
                 list.close();
             }

package/src/api.vfs.js

@@ -20,37 +20,45 @@ async function urlToNodeOriginal(uri) {
 const apis = {
     async get_vfs() {
         return {
-            root: vfs_1.vfs && await recur(vfs_1.vfs),
+            root: await recur(),
             defaultPerms: vfs_1.defaultPerms,
         };
-        async function recur(node) {
+        async function recur(node = vfs_1.vfs) {
             var _a;
-            const stats = Boolean(node.source) && await (0, promises_1.stat)(node.source).catch(e => false);
-            const isDir = !node.source || stats && stats.isDirectory();
+            const { source } = node;
+            const stats = Boolean(source) && await (0, promises_1.stat)(source).catch(() => false);
+            const isDir = !source || stats && stats.isDirectory();
             const copyStats = stats ? lodash_1.default.pick(stats, ['size', 'ctime', 'mtime'])
-                : { size: node.source ? -1 : undefined };
+                : { size: source ? -1 : undefined };
             if (copyStats.mtime && Number(copyStats.mtime) === Number(copyStats.ctime))
                 delete copyStats.mtime;
-            const isRoot = node === vfs_1.vfs;
+            let byMasks = node.original && lodash_1.default.pickBy(node, (v, k) => v !== node.original[k] // something is changing me...
+                && v !== node.parent[k] // ...and it's not inheritance...
+                && vfs_1.PERM_KEYS.includes(k)); // ...must be masks. Please limit this to perms
+            if (lodash_1.default.isEmpty(byMasks))
+                byMasks = undefined;
             return {
                 ...copyStats,
-                ...node,
+                ...node.original || node,
+                byMasks,
                 website: Boolean((_a = node.children) === null || _a === void 0 ? void 0 : _a.find((0, vfs_1.isSameFilenameAs)('index.html')))
-                    || isDir && node.source && await (0, promises_1.stat)((0, path_1.join)(node.source, 'index.html')).then(() => true, () => undefined)
+                    || isDir && source && await (0, promises_1.stat)((0, path_1.join)(source, 'index.html')).then(() => true, () => undefined)
                     || undefined,
-                name: isRoot ? undefined : (0, vfs_1.getNodeName)(node),
+                name: node === vfs_1.vfs ? undefined : (0, vfs_1.getNodeName)(node),
                 type: isDir ? 'folder' : undefined,
-                children: node.children && await Promise.all(node.children.map(recur)),
+                children: node.children && await Promise.all(node.children.map(async (original) => recur((0, vfs_1.applyParentToChild)(original, node))))
             };
         }
     },
     async move_vfs({ from, parent }) {
         var _a;
-        if (from <= '/' || !parent)
+        if (!from || !parent)
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
         const fromNode = await urlToNodeOriginal(from);
         if (!fromNode)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'from not found');
+        if (fromNode === vfs_1.vfs)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'from is root');
         const parentNode = await urlToNodeOriginal(parent);
         if (!parentNode)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'parent not found');
@@ -70,39 +78,39 @@ const apis = {
         const n = await urlToNodeOriginal(uri);
         if (!n)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'path not found');
-        props = pickProps(props, ['name', 'source', 'masks', 'default', 'accept', ...Object.keys(vfs_1.defaultPerms)]);
+        props = pickProps(props, ['name', 'source', 'masks', 'default', 'accept', ...vfs_1.PERM_KEYS]); // sanitize
         if (props.name && props.name !== (0, vfs_1.getNodeName)(n)) {
             const parent = await urlToNodeOriginal((0, path_1.dirname)(uri));
             if ((_a = parent === null || parent === void 0 ? void 0 : parent.children) === null || _a === void 0 ? void 0 : _a.find(x => (0, vfs_1.getNodeName)(x) === props.name))
                 return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT, 'name already present');
         }
-        props = (0, misc_1.newObj)(props, v => v === null ? undefined : v); // null is a way to serialize undefined, that will restore default values
         if (props.masks && typeof props.masks !== 'object')
             delete props.masks;
         Object.assign(n, props);
-        if ((0, vfs_1.getNodeName)(lodash_1.default.omit(n, ['name'])) === n.name) // name only if necessary
-            n.name = undefined;
+        simplifyName(n);
         await (0, vfs_1.saveVfs)();
         return n;
     },
     async add_vfs({ parent, source, name }) {
         var _a;
-        const n = parent ? await urlToNodeOriginal(parent) : vfs_1.vfs;
-        if (!n)
-            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'invalid parent');
-        if (n.isTemp || !await (0, vfs_1.nodeIsDirectory)(n))
-            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE, 'invalid parent');
+        if (!source && !name)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'name or source required');
+        parent = parent ? await urlToNodeOriginal(parent) : vfs_1.vfs;
+        if (!parent)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'parent not found');
+        if (!await (0, vfs_1.nodeIsDirectory)(parent))
+            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE, 'parent not a folder');
         if ((0, misc_1.isWindowsDrive)(source))
             source += '\\'; // slash must be included, otherwise it will refer to the cwd of that drive
-        let tryName = (0, vfs_1.getNodeName)({ name, source });
-        const ext = (0, path_1.extname)(tryName);
-        const noExt = ext ? tryName.slice(0, -ext.length) : tryName;
+        const child = { source, name };
+        name = (0, vfs_1.getNodeName)(child); // could be not given as input
+        const ext = (0, path_1.extname)(name);
+        const noExt = ext ? name.slice(0, -ext.length) : name;
         let idx = 2;
-        while ((_a = n.children) === null || _a === void 0 ? void 0 : _a.find((0, vfs_1.isSameFilenameAs)(tryName)))
-            tryName = `${noExt} ${idx++}${ext}`;
-        name = tryName;
-        n.children || (n.children = []);
-        n.children.unshift({ source, name });
+        while ((_a = parent.children) === null || _a === void 0 ? void 0 : _a.find((0, vfs_1.isSameFilenameAs)(name)))
+            name = `${noExt} ${idx++}${ext}`;
+        child.name = name;
+        (parent.children || (parent.children = [])).unshift({ source, name });
         await (0, vfs_1.saveVfs)();
         return { name };
     },
@@ -192,3 +200,8 @@ function pickProps(o, keys) {
                 ret[k] = o[k] === null || o[k] === '' ? undefined : o[k];
     return ret;
 }
+function simplifyName(node) {
+    const { name, ...noName } = node;
+    if ((0, vfs_1.getNodeName)(noName) === name)
+        delete node.name;
+}

package/src/apiMiddleware.js

@@ -31,8 +31,9 @@ function apiMiddleware(apis) {
         // we don't rely on SameSite cookie option because it's https-only
         let res;
         try {
-            if (params.path)
-                params.path = (0, misc_1.removeStarting)(ctx.state.revProxyPath, params.path);
+            for (const [k, v] of Object.entries(params))
+                if (k.startsWith('uri') && typeof v === 'string')
+                    params[k] = (0, misc_1.removeStarting)(ctx.state.revProxyPath, v);
             res = csrf && csrf !== params.csrf ? new ApiError(const_1.HTTP_UNAUTHORIZED, 'csrf')
                 : await apiFun(params || {}, ctx);
         }

package/src/const.js

@@ -27,7 +27,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_PATH = exports.IS_BINARY = exports.IS_WINDOWS = exports.HTTP_SERVER_ERROR = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_OK = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = exports.COMPATIBLE_API_VERSION = exports.API_VERSION = exports.SESSION_DURATION = exports.DAY = exports.VERSION = exports.BUILD_TIMESTAMP = exports.HFS_STARTED = exports.ORIGINAL_CWD = exports.DEV = exports.argv = void 0;
+exports.APP_PATH = exports.IS_BINARY = exports.IS_WINDOWS = exports.HTTP_SERVER_ERROR = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_OK = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = exports.HFS_REPO = exports.COMPATIBLE_API_VERSION = exports.API_VERSION = exports.SESSION_DURATION = exports.DAY = exports.VERSION = exports.BUILD_TIMESTAMP = exports.HFS_STARTED = exports.ORIGINAL_CWD = exports.DEV = exports.argv = void 0;
 const minimist_1 = __importDefault(require("minimist"));
 const fs = __importStar(require("fs"));
 const os_1 = require("os");
@@ -38,13 +38,14 @@ exports.DEV = process.env.DEV || exports.argv.dev ? 'DEV' : '';
 exports.ORIGINAL_CWD = process.cwd();
 exports.HFS_STARTED = new Date();
 const PKG_PATH = (0, path_1.join)(__dirname, '..', 'package.json');
-exports.BUILD_TIMESTAMP = "2023-04-08T13:40:53.294Z";
+exports.BUILD_TIMESTAMP = "2023-04-23T13:31:04.738Z";
 const pkg = JSON.parse(fs.readFileSync(PKG_PATH, 'utf8'));
 exports.VERSION = pkg.version;
 exports.DAY = 86400000;
-exports.SESSION_DURATION = exports.DAY;
+exports.SESSION_DURATION = Number(process.env.SESSION_DURATION) * 1000 || exports.DAY;
 exports.API_VERSION = 8; // entry.uri + script.plugin
 exports.COMPATIBLE_API_VERSION = 1; // while changes in the api are not breaking, this number stays the same, otherwise is made equal to API_VERSION
+exports.HFS_REPO = 'rejetto/hfs';
 exports.SPECIAL_URI = '/~/';
 exports.FRONTEND_URI = exports.SPECIAL_URI + 'frontend/';
 exports.ADMIN_URI = exports.SPECIAL_URI + 'admin/';

package/src/customHtml.js

@@ -12,7 +12,7 @@ const watchLoad_1 = require("./watchLoad");
 const valtio_1 = require("valtio");
 const promises_1 = require("fs/promises");
 exports.customHtmlSections = ['top', 'bottom', 'beforeHeader', 'afterHeader',
-    'afterMenuBar', 'afterEntryName', 'afterList'];
+    'afterMenuBar', 'afterEntryName', 'afterList', 'beforeLogin'];
 exports.customHtmlState = (0, valtio_1.proxy)({
     sections: new Map()
 });

package/src/debounceAsync.js

@@ -18,7 +18,7 @@ function debounceAsync(callback, wait = 100, { leading = false, maxWait = Infini
     });
     async function debouncer(...args) {
         if (runningCallback)
-            return await runningCallback;
+            return runningCallback;
         whoIsWaiting = args;
         waitingSince || (waitingSince = Date.now());
         const waitingCap = maxWait - (Date.now() - (waitingSince || started));
@@ -29,7 +29,7 @@ function debounceAsync(callback, wait = 100, { leading = false, maxWait = Infini
             return void (waitingSince = 0);
         if (whoIsWaiting !== args) // another fresher call is waiting
             return runningDebouncer;
-        return await exec();
+        return exec();
     }
     async function exec() {
         if (!whoIsWaiting)
@@ -38,7 +38,7 @@ function debounceAsync(callback, wait = 100, { leading = false, maxWait = Infini
         started = Date.now();
         try {
             runningCallback = callback.apply(null, whoIsWaiting);
-            return await runningCallback;
+            return await runningCallback; // await necessary to go-finally at the right time and even on exceptions
         }
         finally {
             whoIsWaiting = undefined;

package/src/frontEndApis.js

@@ -52,11 +52,11 @@ exports.frontEndApis = {
             }
         });
     },
-    async create_folder({ path, name }, ctx) {
-        apiAssertTypes({ string: { path, name } });
+    async create_folder({ uri, name }, ctx) {
+        apiAssertTypes({ string: { uri, name } });
         if (!(0, util_files_1.isValidFileName)(name) || (0, util_files_1.dirTraversal)(name))
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad name');
-        const parentNode = await (0, vfs_1.urlToNode)(path, ctx);
+        const parentNode = await (0, vfs_1.urlToNode)(uri, ctx);
         if (!parentNode)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'parent not found');
         if (!(0, vfs_1.hasPermission)(parentNode, 'can_upload', ctx))
@@ -69,9 +69,9 @@ exports.frontEndApis = {
             return new apiMiddleware_1.ApiError(e.code === 'EEXIST' ? const_1.HTTP_CONFLICT : const_1.HTTP_BAD_REQUEST, e);
         }
     },
-    async del({ path }, ctx) {
-        apiAssertTypes({ string: { path } });
-        const node = await (0, vfs_1.urlToNode)(path, ctx);
+    async del({ uri }, ctx) {
+        apiAssertTypes({ string: { uri } });
+        const node = await (0, vfs_1.urlToNode)(uri, ctx);
         if (!node)
             throw new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
         if (!node.source)

package/src/github.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.searchPlugins = exports.getFolder2repo = exports.readOnlinePlugin = exports.getRepoInfo = exports.downloadPlugin = void 0;
+exports.getProjectInfo = exports.searchPlugins = exports.getFolder2repo = exports.readOnlinePlugin = exports.readGithubFile = exports.getRepoInfo = exports.downloadPlugin = void 0;
 const events_1 = __importDefault(require("./events"));
 const misc_1 = require("./misc");
 const plugins_1 = require("./plugins");
@@ -48,12 +48,14 @@ function getRepoInfo(id) {
     return apiGithub('repos/' + id);
 }
 exports.getRepoInfo = getRepoInfo;
+function readGithubFile(uri) {
+    return (0, misc_1.httpsString)('https://raw.githubusercontent.com/' + uri)
+        .then(res => res.body);
+}
+exports.readGithubFile = readGithubFile;
 async function readOnlinePlugin(repoInfo, branch = '') {
-    const url = `https://raw.githubusercontent.com/${repoInfo.full_name}/${branch || repoInfo.default_branch}/${DIST_ROOT}plugin.js`;
-    const res = await (0, misc_1.httpsString)(url);
-    if (!res.ok)
-        throw res.statusCode;
-    const pl = (0, plugins_1.parsePluginSource)(repoInfo.full_name, res.body); // use 'repo' as 'id' client-side
+    const res = await readGithubFile(`${repoInfo.full_name}/${branch || repoInfo.default_branch}/${DIST_ROOT}plugin.js`);
+    const pl = (0, plugins_1.parsePluginSource)(repoInfo.full_name, res); // use 'repo' as 'id' client-side
     pl.branch = branch || undefined;
     return pl;
 }
@@ -76,10 +78,13 @@ async function apiGithub(uri) {
     return JSON.parse(res.body);
 }
 async function* searchPlugins(text = '') {
-    var _a;
+    var _a, _b;
+    const projectInfo = await getProjectInfo();
     const res = await apiGithub('search/repositories?q=topic:hfs-plugin+' + encodeURI(text));
     for (const it of res.items) {
         const repo = it.full_name;
+        if ((_a = projectInfo === null || projectInfo === void 0 ? void 0 : projectInfo.plugins_blacklist) === null || _a === void 0 ? void 0 : _a.includes(repo))
+            continue;
         let pl = await readOnlinePlugin(it);
         if (!pl.apiRequired)
             continue; // mandatory field
@@ -100,9 +105,22 @@ async function* searchPlugins(text = '') {
             continue;
         Object.assign(pl, {
             downloading: downloading[repo],
-            license: (_a = it.license) === null || _a === void 0 ? void 0 : _a.spdx_id,
+            license: (_b = it.license) === null || _b === void 0 ? void 0 : _b.spdx_id,
         }, lodash_1.default.pick(it, ['pushed_at', 'stargazers_count']));
         yield pl;
     }
 }
 exports.searchPlugins = searchPlugins;
+// centralized hosted information, to be used as little as possible
+let cache;
+function getProjectInfo() {
+    return cache || (cache = readGithubFile(const_1.HFS_REPO + '/main/central.json').then(x => {
+        if (!x)
+            throw x; // go catch
+        setTimeout(() => cache = null, const_1.DAY); // invalidate cache
+        return JSON.parse(x);
+    }).catch(() => {
+        setTimeout(() => cache = null, 10000);
+    }));
+}
+exports.getProjectInfo = getProjectInfo;

package/src/index.js

@@ -23,11 +23,12 @@ const config_1 = require("./config");
 const assert_1 = require("assert");
 const lodash_1 = __importDefault(require("lodash"));
 const misc_1 = require("./misc");
+const koa_session_1 = __importDefault(require("koa-session"));
 (0, assert_1.ok)(lodash_1.default.intersection(Object.keys(frontEndApis_1.frontEndApis), Object.keys(adminApis_1.adminApis)).length === 0); // they share same endpoints
 const keys = ((_a = process.env.COOKIE_SIGN_KEYS) === null || _a === void 0 ? void 0 : _a.split(',')) || [(0, misc_1.randomId)(30)];
 exports.app = new koa_1.default({ keys });
 exports.app.use(middlewares_1.someSecurity)
-    .use((0, middlewares_1.sessions)(exports.app))
+    .use((0, koa_session_1.default)({ key: 'hfs_$id', signed: true, rolling: true, maxAge: const_1.SESSION_DURATION }, exports.app))
     .use(middlewares_1.prepareState)
     .use(middlewares_1.headRequests)
     .use((0, log_1.log)())

package/src/lang.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EMBEDDED_TRANSLATIONS = exports.getLangData = exports.file2code = exports.code2file = void 0;
+exports.getLangData = exports.file2code = exports.code2file = void 0;
 const misc_1 = require("./misc");
 const promises_1 = require("fs/promises");
 const config_1 = require("./config");
 const watchLoad_1 = require("./watchLoad");
+const embedded_1 = __importDefault(require("./langs/embedded"));
 const PREFIX = 'hfs-lang-';
 const SUFFIX = '.json';
 const EMBEDDED_LANGUAGE = 'en';
@@ -20,10 +21,11 @@ function file2code(fn) {
 }
 exports.file2code = file2code;
 async function getLangData(ctx) {
-    if (forceLangData)
+    const param = String(ctx.query.lang || '');
+    if (!param && forceLangData)
         return forceLangData;
     const ret = {};
-    const csv = String(ctx.query.lang || '') || ctx.get('Accept-Language') || '';
+    const csv = param || ctx.get('Accept-Language') || '';
     const langs = (0, misc_1.wantArray)(csv.split(',').map(x => x.toLowerCase()));
     let i = 0;
     while (i < langs.length) {
@@ -34,8 +36,8 @@ async function getLangData(ctx) {
             ret[k] = JSON.parse(await (0, promises_1.readFile)(`hfs-lang-${k}.json`, 'utf8'));
         }
         catch (_a) {
-            if (k in exports.EMBEDDED_TRANSLATIONS)
-                ret[k] = exports.EMBEDDED_TRANSLATIONS[k];
+            if ((0, misc_1.hasProp)(embedded_1.default, k))
+                ret[k] = embedded_1.default[k];
             else {
                 do {
                     k = k.substring(0, k.lastIndexOf('-'));
@@ -55,23 +57,11 @@ let forceLangData;
 let undo;
 (0, config_1.defineConfig)('force_lang', '', v => {
     undo === null || undo === void 0 ? void 0 : undo();
-    forceLangData = undefined;
     if (!v)
-        return;
+        return forceLangData = undefined;
+    forceLangData = {}; // necessary to make the embedded language work
     const res = (0, watchLoad_1.watchLoad)(code2file(v), data => {
         forceLangData = { [v]: JSON.parse(data) };
     });
     undo = res.unwatch;
 });
-const hfs_lang_it_json_1 = __importDefault(require("./langs/hfs-lang-it.json"));
-const hfs_lang_zh_json_1 = __importDefault(require("./langs/hfs-lang-zh.json"));
-const hfs_lang_ru_json_1 = __importDefault(require("./langs/hfs-lang-ru.json"));
-const hfs_lang_sr_json_1 = __importDefault(require("./langs/hfs-lang-sr.json"));
-const hfs_lang_ko_json_1 = __importDefault(require("./langs/hfs-lang-ko.json"));
-exports.EMBEDDED_TRANSLATIONS = {
-    it: hfs_lang_it_json_1.default,
-    zh: hfs_lang_zh_json_1.default,
-    ru: hfs_lang_ru_json_1.default,
-    sr: hfs_lang_sr_json_1.default,
-    ko: hfs_lang_ko_json_1.default,
-};

package/src/langs/embedded.js

@@ -0,0 +1,13 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const hfs_lang_it_json_1 = __importDefault(require("./hfs-lang-it.json"));
+const hfs_lang_zh_json_1 = __importDefault(require("./hfs-lang-zh.json"));
+const hfs_lang_ru_json_1 = __importDefault(require("./hfs-lang-ru.json"));
+const hfs_lang_sr_json_1 = __importDefault(require("./hfs-lang-sr.json"));
+const hfs_lang_ko_json_1 = __importDefault(require("./hfs-lang-ko.json"));
+const hfs_lang_ms_json_1 = __importDefault(require("./hfs-lang-ms.json"));
+const hfs_lang_zh_tw_json_1 = __importDefault(require("./hfs-lang-zh-tw.json"));
+exports.default = { it: hfs_lang_it_json_1.default, zh: hfs_lang_zh_json_1.default, ru: hfs_lang_ru_json_1.default, sr: hfs_lang_sr_json_1.default, ko: hfs_lang_ko_json_1.default, ms: hfs_lang_ms_json_1.default, 'zh-tw': hfs_lang_zh_tw_json_1.default };