hfs 0.48.3 → 0.49.0-alpha2

package/frontend/assets/index-db5f0e4b.css

@@ -0,0 +1 @@
+@charset "UTF-8";:root{height:100dvh;--bg: #fff;--text: #555;--ghost-contrast: #8882;--ghost-contrast-alt: #eee;--faint-contrast: #8884;--mild-contrast: #8886;--good-contrast: #000a;--button-bg: #6080aa;--button-text: #eaeaea;--focus-color: #468;--separator: " – "}:root .highlightedText,:root .file-menu a:hover{color:#0006;text-shadow:0 0 3px rgba(0,0,0,.4)}:root .theme-dark{--bg: #000;--text: #999;--ghost-contrast-alt: #181818;--good-contrast: #fffa;--button-bg: #345;--button-text: #999;color-scheme:dark}:root .theme-dark .highlightedText,:root .theme-dark .file-menu a:hover,:root .file-menu .theme-dark a:hover{color:#fff;text-shadow:0 0 3px #fff}:root .theme-dark a{color:#8ac}:root .theme-dark .dialog-closer{background:#633}:root .theme-dark .dialog-icon{color:#ccc}:root .theme-dark .dialog-icon .icon{color:#aaa}:root .theme-dark .dialog-backdrop{background:rgba(51,51,51,.7333333333)}:root .theme-dark .error-msg{color:#b88;background-color:#623}:root .theme-dark button.toggled{color:#eee}body{background-color:var(--bg);margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}body,button,select,input{font-size:12pt}#root>div{max-width:54em;margin:auto;min-height:100vh;display:flex;flex-direction:column}body,input{color:var(--text)}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}input:not([type=checkbox],[type=range]),select,textarea{padding:.3em .4em;border-radius:.5em;background:var(--bg);border-color:var(--mild-contrast);color:var(--good-contrast);max-width:100%;box-sizing:border-box;width:100%}input[type=range]{width:calc(100% - 1px)}input[type=checkbox]{transform:scale(1.7);accent-color:var(--button-bg)}textarea{font-size:14pt}label input[type=checkbox]{margin-right:.8em}select{text-align:center}.hidden{display:none!important}[class^=fa-]:before,[class*=" fa-"]:before{margin:0}.icon{font-size:1.2em;height:1.2em;width:1.4em;display:inline-block;text-align:center}img.file-icon{height:1em}.file-icon{background-size:contain;background-repeat:no-repeat;background-position:center;vertical-align:text-bottom}.icon.mirror:before{transform:scaleX(-1)}a{text-decoration:none;color:var(--button-bg)}button{background-color:var(--button-bg);color:var(--button-text);padding:.5em 1em;border:transparent;text-decoration:none;border-radius:.3em;vertical-align:middle;cursor:pointer;transition:background-color .5s}button:hover{outline:1px solid var(--mild-contrast)}button[disabled]{background-color:var(--faint-contrast)}button.toggled{color:#fff;text-shadow:0 0 3px #fff}button:focus-visible,.breadcrumb:focus-visible{outline:3px solid var(--focus-color)}a>button{width:100%}input:focus-visible,select:focus-visible,ul a:focus-visible{border-radius:.3em;border-color:transparent;outline:2px solid var(--focus-color)}.icon-button,ul.dir li .entry-panel .file-menu-button{font-size:.7em;padding:.2em .4em;margin-left:.4em;vertical-align:bottom}.error-msg{background-color:#faa;color:#833;padding:.5em 1em}.hide-back,.upload-toolbar,header{background-color:var(--bg)}header{position:sticky;top:0;padding:.2em .1em;z-index:3}kbd{background-color:#eee;border-radius:3px;border:1px solid #b4b4b4;box-shadow:0 1px 1px #0003,0 2px #ffffffb3 inset;color:#333;display:inline-block;font-size:.85em;font-weight:700;line-height:1;padding:2px 4px;white-space:nowrap;margin-right:.5em}.before-sliding{width:0!important;flex:0!important;margin:0!important;height:0!important;padding:0!important;overflow:hidden!important;transition:flex .5s}.show-sliding{transition:flex .5s;overflow:clip;flex:1;white-space:nowrap}.ani-working{animation:1s blink infinite}@keyframes blink{0%{opacity:1}50%{opacity:.2}}@keyframes spin{to{transform:rotate(360deg)}}@keyframes fade-in{0%{opacity:0}to{opacity:1}}.spinner,.icon.spinner:before{animation:1.5s spin infinite linear;display:inline-flex;justify-content:center;align-items:center;width:min-content}.breadcrumb{padding:.1em .6em .2em;line-height:1.8em;border-radius:.7em;background-color:var(--button-bg);color:var(--button-text);border-top:1px solid #666;margin-right:-.1em}.breadcrumb:nth-child(-n+3) .icon{padding:0 .2em}#folder-stats,#filter-bar>span{font-size:90%}#folder-stats{margin:.5em 0 0 .5em;float:right}#folder-stats .icon{margin-right:.3em}#filter{flex:1;box-sizing:border-box}#filter-bar{display:flex;align-items:center;gap:.8em;margin:.2em 0 0;padding:2px 0 1px 3px;height:1.8em}#filter-bar input[type=checkbox]{margin-top:.3em}#filter-bar span:empty{display:none}ul.dir{flex:1;padding:0;margin:0;clear:both}ul.dir>p{text-align:center}ul.dir li{display:block;list-style-type:none;padding:.3em .3em .4em;border-bottom:1px solid var(--faint-contrast)}ul.dir li:nth-of-type(odd){background-color:var(--ghost-contrast)}ul.dir li input[type=checkbox]{margin-right:1em}@media (hover: none){ul.dir li .link-wrapper .popup-menu-button{display:none}}@media (hover: hover){ul.dir li .link-wrapper:not(:hover) .popup-menu-button{display:none}ul.dir li .link-wrapper:hover{padding:1em;margin:-1em}}ul.dir li .link-wrapper a:last-of-type{word-break:break-word;padding-right:.3em}ul.dir li .link-wrapper a .icon{margin-right:.5em;vertical-align:text-bottom;display:inline-block;text-align:center}ul.dir li .link-wrapper a:hover{text-decoration:underline}ul.dir li .entry-panel{float:right;padding-top:.3em;display:flex;align-items:center}ul.dir li .entry-panel .file-menu-button{margin:-3px 0 -3px .4em}ul.dir li .entry-panel .entry-details{font-size:90%;margin-left:4px;font-variant-numeric:tabular-nums}ul.dir li .entry-panel .entry-details .entry-size-unit{margin-left:.3em}ul.dir li>div:last-of-type{clear:both}ul.dir li.page-separator{margin-top:1em;position:relative}ul.dir li.page-separator:before{content:attr(label);position:absolute;top:-1.8em;font-size:smaller;margin-left:calc(50% - 1em);opacity:.9}.entry-comment{display:inline;white-space:pre-wrap;word-break:break-word}.entry-comment:before,.entry-comment:after{font-size:1.5em;font-family:serif;line-height:1px;position:relative}.entry-comment:before{content:"“";margin-left:.5em;margin-right:.1em;top:.2em}.entry-comment:after{content:"„";top:-.1em;margin-left:.1em}#menu-bar{display:flex;justify-content:space-evenly;flex-wrap:wrap}#menu-bar>*{flex:1;margin:.1em}#menu-bar>*:first-child{margin-left:0}#menu-bar>*:last-child{margin-right:0}#menu-bar button{padding:min(1vh,.5em) 0}#searched{margin:.2em}#user-panel{display:flex;flex-direction:column;gap:1em}#user-panel a>button{width:100%}button label{cursor:inherit;margin-left:.4em}.dialog-backdrop.working{font-size:5em;animation:1s fade-in}.dialog-content{padding:.2em}.dialog-alert .dialog-content{text-align:center}.dialog-alert .dialog-content p{text-align:left;display:inline-block}.dialog{min-width:11em;--color: var(--button-bg)}.dialog-icon .icon{margin-left:-1px;font-size:95%;margin-top:.4em;border-radius:.6em 0}#paging{position:sticky;bottom:0;display:flex;gap:.1em;background-color:var(--bg);padding:0 .2em .2em}#paging>button{z-index:1}#paging button{box-shadow:0 0 .3em .3em #0003}#paging #paging-middle{padding:0 .5em;margin:0 -.3em;display:flex;gap:.5em;flex:1;overflow-x:auto}#paging #paging-middle>button{flex:1;padding-top:0;padding-bottom:0}#paging button{background:var(--button-bg);text-align:center;white-space:nowrap;padding:.5em}.upload-toolbar{position:sticky;top:-4px}.upload-progress:before{content:var(--separator)}.entry-size:after{content:var(--separator)}.upload-progress{min-width:4em;display:inline-block;margin-left:.5em}.upload-list{margin-top:1em}.upload-list td:nth-child(1){width:0}.upload-list td:nth-child(2){text-align:right;width:0;white-space:nowrap;padding-left:.5em}.upload-list td:nth-child(3){padding:.2em .5em;word-break:break-word}.nowrap{white-space:nowrap}.dialog-login form{display:flex;flex-direction:column;gap:1.2em}.dialog-login label{display:block;margin-bottom:.5em;margin-left:.1em}.miss-perm{margin:.3em}.popup-menu-button{font-size:.8em;padding:.2em .3em;position:absolute;opacity:.8;white-space:nowrap}.popup-menu-button:hover{opacity:1}.file-dialog .dialog{min-width:13em}.file-dialog-properties{word-break:break-word;line-height:1.5em;margin:0}.file-dialog-properties dt{font-weight:700}.file-dialog-properties dd{margin-left:1.5em}.file-menu{margin-top:1em;padding-top:1em;border-top:1px solid var(--faint-contrast);display:flex;flex-direction:column;gap:1em}.file-menu a{display:flex;align-items:flex-start}.file-menu a label{margin-top:.1em}.file-menu a label small{display:block}.file-menu a .icon{margin-right:.5em}#root>.tiles-mode{max-width:none;margin:0 1em;--tiles-size: 5;--name-lines: 3;--name-height: calc(4.7em + var(--tiles-size) * .4em + 1.2em * var(--name-lines));--tile-width: calc(5em + 1em * var(--tiles-size))}#root>.tiles-mode ul.dir{display:grid;grid-template-columns:repeat(auto-fill,minmax(var(--tile-width),1fr));grid-auto-rows:calc(var(--name-height) + 1.3em);gap:0 20px}#root>.tiles-mode ul.dir li{text-align:center;position:relative;display:flex;flex-direction:column;border-bottom:none;overflow-x:clip;padding:.5em 0 0}#root>.tiles-mode ul.dir li .link-wrapper:not(:hover){max-height:var(--name-height);display:block;display:-webkit-box;overflow:hidden;-webkit-line-clamp:calc(var(--name-lines) + 1);-webkit-box-orient:vertical}#root>.tiles-mode ul.dir li .link-wrapper a:last-of-type{padding:0}#root>.tiles-mode ul.dir li .link-wrapper a span{display:block}#root>.tiles-mode ul.dir li .link-wrapper a .icon.icon{font-size:calc(1.2rem + .6rem * var(--tiles-size))}#root>.tiles-mode ul.dir li .link-wrapper a img.icon{width:auto;height:1em;padding:.1em 0}#root>.tiles-mode ul.dir li .link-wrapper a .icon{font-size:4rem;display:block;margin:auto}#root>.tiles-mode ul.dir li .link-wrapper:hover{overflow:visible;display:block;z-index:1}#root>.tiles-mode ul.dir li .link-wrapper:hover .icon:before{text-decoration:none}#root>.tiles-mode ul.dir li .link-wrapper:hover{padding:0;margin:0}#root>.tiles-mode ul.dir li:nth-of-type(odd){background-color:var(--bg)}#root>.tiles-mode ul.dir li .entry-panel{justify-content:center;font-size:10pt}#root>.tiles-mode ul.dir li .entry-details{font-size:80%}#root>.tiles-mode ul.dir li.page-separator:before{content:""}#root>.tiles-mode ul.dir li input[type=checkbox]{margin:0;position:absolute;top:.3em;right:1em}#root>.tiles-mode ul.dir li .link-wrapper a{display:inline}#root>.tiles-mode ul.dir li:hover{--bg: var(--ghost-contrast-alt);background:var(--bg)}#root>.tiles-mode ul.dir li:hover .link-wrapper,#root>.tiles-mode ul.dir li:hover .entry-panel{z-index:1;background:var(--bg)}#root>.tiles-mode ul.dir li:hover input[type=checkbox]{z-index:2}#root>.tiles-mode ul.dir li:hover .entry-panel{padding-bottom:.3em}#root>.tiles-mode .entry-size:after{content:none}#root>.tiles-mode .entry-ts{display:none}#root>.tiles-mode .popup-menu-button{position:absolute;top:0;left:0}#root>.tiles-mode #filter-bar{margin-bottom:1em}#root>.tiles-mode #paging{z-index:1}#root .file-show{--nav-size: min(25vh, 25vw)}#root .file-show>div{height:100%;width:100%}#root .file-show .showing-container{width:100%;height:100%;display:flex;justify-content:center;align-items:center}#root .file-show .showing{max-width:calc(100% - var(--nav-size) * 2);max-height:100%}#root .file-show img.showing{max-width:100%}#root .file-show .main{flex:1;position:relative;max-height:100%;overflow:hidden}#root .file-show .freeY .main,#root .file-show .fullWidth .main{overflow-y:auto}#root .file-show .freeY .showing,#root .file-show .fullWidth .showing{max-height:initial;margin:auto}#root .file-show .freeY .showing-container,#root .file-show .fullWidth .showing-container{overflow:auto;align-items:flex-start}#root .file-show .fullWidth .showing-container,#root .file-show .fullWidth .showing{width:100%}#root .file-show .nav{position:absolute;margin:-.4em;font-size:var(--nav-size);cursor:pointer;opacity:.3;-webkit-text-stroke:2px black;user-select:none;transition:opacity .3s}#root .file-show .nav:hover{opacity:.7}#root .file-show .nav.nav-hidden{opacity:0}#root .file-show .bar{padding:.5em 1em;background:var(--bg);opacity:.8;display:flex;flex-wrap:wrap;align-items:center;justify-content:flex-end;gap:.5em 1.5em}#root .file-show .bar .entry-details{font-size:smaller}#root .file-show .bar .entry-ts{display:inherit}#root .file-show .bar .entry-size:after{display:none}.file-show-help kbd{margin:.5em}.file-show-help kbd:first-of-type{margin-top:1em}@media (min-width: 42em){body{scrollbar-width:thin;scrollbar-color:var(--button-bg) var(--ghost-contrast)}body::-webkit-scrollbar{width:12px}body::-webkit-scrollbar-track{background:var(--ghost-contrast)}body::-webkit-scrollbar-thumb{background-color:var(--button-bg);border-radius:20px;border:1px solid var(--ghost-contrast)}}@media (max-width: 42em){:root{--ghost-contrast: #8883}body,button,select{font-size:14pt}#menu-bar button label,#filter-bar button label{display:none}#filter-bar{margin-top:.4em}#filter-bar button{width:17.6vw;height:2.3em}.breadcrumb{word-break:break-all}.breadcrumb .icon{font-size:24px}#root>.tiles-mode{margin:0}}@media (max-height: 600px){.file-dialog .dialog-content{display:flex;gap:3em;margin:1em}.file-dialog .dialog-content .file-menu{margin-top:0;padding-top:0;border-top:none;margin-left:2em;padding-left:2em;border-left:1px solid var(--faint-contrast)}}@media (pointer: coarse){#root>.tiles-mode .file-menu-button{font-size:1em;margin-top:.3em}}.dialog-backdrop{position:fixed;inset:0;background:#8886;backdrop-filter:blur(2px);display:flex;justify-content:center;align-items:center;z-index:1000}.dialog{background:#fff;background:var(--bg);padding:max(.5em,1vw,2vh);padding-top:0;border-radius:1em;position:relative;margin:0 3vw;overflow:hidden;max-height:calc(100vh - 2em);display:flex;flex-direction:column;justify-content:center}.dialog-icon{color:#fff;background-color:var(--color);position:absolute;top:0;width:2em;height:1.8em;text-align:center;border-radius:.8em 0}.dialog-icon-text{display:flex;align-items:center;justify-content:center}.dialog-title{font-size:120%;margin:.3em 0;padding:0 .5em;min-height:1.2em}.dialog-closer~.dialog-title{margin-right:2em}.dialog-type~.dialog-title{margin-left:2em}.dialog-icon~.dialog-title{text-align:center}.dialog-closer{border-radius:0 .8em;right:0;padding:0;background-color:#c88}.dialog-icon~.dialog-content{margin-top:1em}.dialog-type{left:0;top:0;overflow:hidden;opacity:.7}.dialog-content{overflow:auto;max-height:calc(100vh - 4.5em)}.dialog-content p{white-space:pre-wrap;margin:.5em 0}.dialog-confirm .dialog-content button{margin-top:1em}.dialog-alert-info{--color: #282 }.dialog-alert-warning{--color: #c91 }.dialog-alert-error{--color: #822}@media (max-width: 42em){.dialog-icon{font-size:120%}.dialog-icon~.dialog-content{margin-top:1.5em}}.dialog-prompt label{display:block;margin:.5em .1em}

package/{admin/assets/sha512-2627feb7.js → frontend/assets/sha512-3392c31f.js}

@@ -1,4 +1,4 @@
-import{g as OF,c as UF}from"./index-4e55b514.js";function gF(sF,hF){for(var eF=0;eF<hF.length;eF++){const tF=hF[eF];if(typeof tF!="string"&&!Array.isArray(tF)){for(const w in tF)if(w!=="default"&&!(w in sF)){const lF=Object.getOwnPropertyDescriptor(tF,w);lF&&Object.defineProperty(sF,w,lF.get?lF:{enumerable:!0,get:()=>tF[w]})}}}return Object.freeze(Object.defineProperty(sF,Symbol.toStringTag,{value:"Module"}))}var dF={exports:{}};/*
+import{g as OF,c as UF}from"./index-3a379840.js";function gF(sF,hF){for(var eF=0;eF<hF.length;eF++){const tF=hF[eF];if(typeof tF!="string"&&!Array.isArray(tF)){for(const w in tF)if(w!=="default"&&!(w in sF)){const lF=Object.getOwnPropertyDescriptor(tF,w);lF&&Object.defineProperty(sF,w,lF.get?lF:{enumerable:!0,get:()=>tF[w]})}}}return Object.freeze(Object.defineProperty(sF,Symbol.toStringTag,{value:"Module"}))}var dF={exports:{}};/*
  * [js-sha512]{@link https://github.com/emn178/js-sha512}
  *
  * @version 0.8.0

package/frontend/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=0" />
     <link href="/fontello.css" rel="stylesheet" />
     
-    <script type="module" crossorigin src="/assets/index-e24651da.js"></script>
-    <link rel="stylesheet" href="/assets/index-cadcb0e9.css">
+    <script type="module" crossorigin src="/assets/index-3a379840.js"></script>
+    <link rel="stylesheet" href="/assets/index-db5f0e4b.css">
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hfs",
-  "version": "0.48.3",
+  "version": "0.49.0-alpha2",
   "description": "HTTP File Server",
   "keywords": [
     "file server",
@@ -79,7 +79,6 @@
     "lodash": "^4.17.21",
     "minimist": "^1.2.6",
     "nat-upnp-ts": "^2.0.1",
-    "node-html-parser": "^6.1.5",
     "open": "^8.4.0",
     "tssrp6a": "^3.0.0",
     "unzip-stream": "^0.3.1",

package/plugins/download-counter/plugin.js

@@ -44,21 +44,20 @@ exports.init = async api => {
         frontend_js: 'main.js',
         frontend_css: 'style.css',
         unload: () => save.flush(), // we may have pending savings
-        middleware: (ctx) =>
-            () => { // execute after other middlewares are done
-                if (ctx.status >= 300 || ctx.state.download_counter_ignore || ctx.state.includesLastByte === false) return
-                if (!(ctx.vfsNode || api.getConfig('archives') && ctx.state.archive)) return
-                ctx.state.completed.then(() => {
-                    const key = uri2key(ctx.path)
-                    const entries = ctx.vfsNode ? [key]
-                        : ctx.state.originalStream?.getArchiveEntries?.().filter(x => x.at(-1) !== '/').map(x => key + uri2key(x))
-                    if (!entries) return
-                    for (const k of entries)
-                        counters[k] = counters[k] + 1 || 1
-                    save()
-                })
-            },
-        onDirEntry: ({ entry, listUri }) => {
+        middleware: ctx => () => { // callback = execute after other middlewares are done
+            if (ctx.status >= 300 || ctx.state.download_counter_ignore || ctx.state.includesLastByte === false) return
+            if (!(ctx.vfsNode || api.getConfig('archives') && ctx.state.archive)) return
+            ctx.state.completed.then(() => {
+                const key = uri2key(ctx.path)
+                const entries = ctx.vfsNode ? [key]
+                    : ctx.state.originalStream?.getArchiveEntries?.().filter(x => x.at(-1) !== '/').map(x => key + uri2key(x))
+                if (!entries) return
+                for (const k of entries)
+                    counters[k] = counters[k] + 1 || 1
+                save()
+            })
+        },
+        onDirEntry({ entry, listUri })  {
             const k = uri2key(listUri + entry.n)
             const n = counters[k]
             if (n)

package/src/adminApis.js

@@ -107,6 +107,7 @@ exports.adminApis = {
             compatibleApiVersion: const_1.COMPATIBLE_API_VERSION,
             ...await (0, listen_1.getServerStatus)(),
             urls: await (0, listen_1.getUrls)(),
+            ips: await (0, listen_1.getIps)(false),
             baseUrl: middlewares_1.baseUrl.get(),
             updatePossible: !(0, update_1.updateSupported)() ? false : await (0, update_1.localUpdateAvailable)() ? 'local' : true,
             proxyDetected: (0, middlewares_1.getProxyDetected)(),

package/src/api.auth.js

@@ -33,17 +33,17 @@ function makeExp() {
 const login = async ({ username, password }, ctx) => {
     if (!username || !password) // some validation
         return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
-    const acc = (0, perm_1.getAccount)(username);
-    if (!acc)
+    const account = (0, perm_1.getAccount)(username);
+    if (!account || !(0, perm_1.accountCanLogin)(account))
         return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
-    if (!acc.hashed_password)
+    if (!account.hashed_password)
         return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE);
-    if (!await (0, crypt_1.verifyPassword)(acc.hashed_password, password))
+    if (!await (0, crypt_1.verifyPassword)(account.hashed_password, password))
         return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
     if (!ctx.session)
         return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
     await loggedIn(ctx, username);
-    return { ...makeExp(), redirect: acc.redirect };
+    return { ...makeExp(), redirect: account.redirect };
 };
 exports.login = login;
 const loginSrp1 = async ({ username }, ctx) => {
@@ -52,7 +52,7 @@ const loginSrp1 = async ({ username }, ctx) => {
     const account = (0, perm_1.getAccount)(username);
     if (!ctx.session)
         return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
-    if (!account) // TODO simulate fake account to prevent knowing valid usernames
+    if (!account || !(0, perm_1.accountCanLogin)(account)) // TODO simulate fake account to prevent knowing valid usernames
         return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
     try {
         const { step1, ...rest } = await srpStep1(account);

package/src/api.file_list.js

@@ -12,6 +12,8 @@ const plugins_1 = require("./plugins");
 const misc_1 = require("./misc");
 const lodash_1 = __importDefault(require("lodash"));
 const const_1 = require("./const");
+const comments_1 = require("./comments");
+const path_1 = require("path");
 const get_file_list = async ({ uri, offset, limit, search, c }, ctx) => {
     var _a;
     const node = await (0, vfs_1.urlToNode)(uri || '/', ctx);
@@ -36,12 +38,12 @@ const get_file_list = async ({ uri, offset, limit, search, c }, ctx) => {
     const can_upload = (0, vfs_1.hasPermission)(node, 'can_upload', ctx);
     const fakeChild = (0, vfs_1.applyParentToChild)({}, node); // we want to know if we want to delete children
     const can_delete = (0, vfs_1.hasPermission)(fakeChild, 'can_delete', ctx);
-    const props = { can_upload, can_delete, accept: node.accept };
+    const can_archive = (0, vfs_1.hasPermission)(fakeChild, 'can_archive', ctx);
+    const props = { can_archive, can_upload, can_delete, accept: node.accept };
     if (!list)
         return { ...props, list: await (0, misc_1.asyncGeneratorToArray)(produceEntries()) };
     setTimeout(async () => {
-        if (can_upload || can_delete)
-            list.props(props);
+        list.props(props);
         for await (const entry of produceEntries())
             list.add(entry);
         list.close();
@@ -57,14 +59,18 @@ const get_file_list = async ({ uri, offset, limit, search, c }, ctx) => {
         for await (const sub of walker) {
             if (ctx.aborted)
                 break;
-            if (!filter((0, vfs_1.getNodeName)(sub)))
+            const name = (0, path_1.basename)((0, vfs_1.getNodeName)(sub));
+            if (comments_1.descriptIon.get() && name === comments_1.DESCRIPT_ION)
+                continue;
+            if (!filter(name))
                 continue;
             const entry = await nodeToDirEntry(ctx, sub);
             if (!entry)
                 continue;
             const cbParams = { entry, ctx, listUri: uri, node: sub };
             try {
-                if (onDirEntryHandlers.some(cb => cb(cbParams) === false))
+                const res = await Promise.all(onDirEntryHandlers.map(cb => cb(cbParams)));
+                if (res.some(x => x === false))
                     continue;
             }
             catch (e) {
@@ -96,11 +102,11 @@ const get_file_list = async ({ uri, offset, limit, search, c }, ctx) => {
             const st = await (0, promises_1.stat)(source);
             const folder = st.isDirectory();
             const { ctime, mtime } = st;
-            const pl = node.can_list === vfs_1.WHO_NO_ONE ? 'l'
+            const pl = node.can_list === misc_1.WHO_NO_ONE ? 'l'
                 : !(0, vfs_1.hasPermission)(node, 'can_list', ctx) ? 'L'
                     : '';
             // no download here, but maybe inside?
-            const pr = node.can_read === vfs_1.WHO_NO_ONE && !(folder && filesInsideCould()) ? 'r'
+            const pr = node.can_read === misc_1.WHO_NO_ONE && !(folder && filesInsideCould()) ? 'r'
                 : !(0, vfs_1.hasPermission)(node, 'can_read', ctx) ? 'R'
                     : '';
             const pd = !can_delete && (0, vfs_1.hasPermission)(node, 'can_delete', ctx) ? 'd' : '';
@@ -109,7 +115,8 @@ const get_file_list = async ({ uri, offset, limit, search, c }, ctx) => {
                 c: ctime,
                 m: Math.abs(+mtime - +ctime) < 1000 ? undefined : mtime,
                 s: folder ? undefined : st.size,
-                p: (pr + pl + pd) || undefined
+                p: (pr + pl + pd) || undefined,
+                comment: await (0, comments_1.getCommentFor)(source),
             };
         }
         catch (_a) {

package/src/api.net.js

@@ -4,12 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.acmeMiddleware = exports.externalIp = void 0;
+exports.makeCert = exports.acme_email = exports.acme_domain = exports.acmeMiddleware = exports.externalIp = void 0;
 const apiMiddleware_1 = require("./apiMiddleware");
 const nat_upnp_ts_1 = require("nat-upnp-ts");
 const const_1 = require("./const");
-const axios_1 = __importDefault(require("axios"));
-const node_html_parser_1 = require("node-html-parser");
 const lodash_1 = __importDefault(require("lodash"));
 const listen_1 = require("./listen");
 const github_1 = require("./github");
@@ -20,53 +18,59 @@ const acme_client_1 = __importDefault(require("acme-client"));
 const promises_1 = __importDefault(require("fs/promises"));
 const http_1 = require("http");
 const promises_2 = require("dns/promises");
-const client = new nat_upnp_ts_1.Client({ timeout: 4000 });
-const originalMethod = client.getGateway;
+const config_1 = require("./config");
+const events_1 = __importDefault(require("./events"));
+const net_1 = require("net");
+const upnpClient = new nat_upnp_ts_1.Client({ timeout: 4000 });
+const originalMethod = upnpClient.getGateway;
 // other client methods call getGateway too, so this will ensure they reuse this same result
-client.getGateway = (0, misc_1.debounceAsync)(() => originalMethod.apply(client), 0, { retain: misc_1.HOUR, retainFailure: 30000 });
-client.getGateway().catch(() => { });
-exports.externalIp = Promise.resolve(''); // poll external ip
-(0, misc_1.repeat)(10 * misc_1.MINUTE, () => {
-    const was = exports.externalIp;
-    exports.externalIp = client.getPublicIp().catch(() => was); //fallback to previous value
-});
+upnpClient.getGateway = (0, misc_1.debounceAsync)(() => originalMethod.apply(upnpClient), 0, { retain: misc_1.HOUR, retainFailure: 30000 });
+upnpClient.getGateway().catch(() => { });
+exports.externalIp = ''; // poll external ip
+(0, misc_1.repeat)(10 * misc_1.MINUTE, () => upnpClient.getPublicIp().then(v => exports.externalIp = v));
 const getNatInfo = (0, misc_1.debounceAsync)(async () => {
     var _a, _b;
-    const gettingIp = getPublicIp(); // don't wait, do it in parallel
-    const res = await client.getGateway().catch(() => null);
+    const gettingIps = getPublicIps(); // don't wait, do it in parallel
+    const res = await upnpClient.getGateway().catch(() => null);
     const status = await (0, listen_1.getServerStatus)();
-    const mappings = res && await (0, misc_1.haveTimeout)(5000, client.getMappings()).catch(() => null);
-    console.debug('mappings found', mappings);
-    const gatewayIp = res ? new URL(res.gateway.description).hostname : await findGateway().catch(() => null);
+    const mappings = res && await (0, misc_1.haveTimeout)(5000, upnpClient.getMappings()).catch(() => null);
+    console.debug('mappings found', mappings === null || mappings === void 0 ? void 0 : mappings.map(x => x.description));
+    const gatewayIp = res ? new URL(res.gateway.description).hostname : await findGateway().catch(() => undefined);
     const localIp = (res === null || res === void 0 ? void 0 : res.address) || (await (0, listen_1.getIps)())[0];
-    const internalPort = ((_a = status === null || status === void 0 ? void 0 : status.https) === null || _a === void 0 ? void 0 : _a.listening) && status.https.port || ((_b = status === null || status === void 0 ? void 0 : status.http) === null || _b === void 0 ? void 0 : _b.listening) && status.http.port;
+    const internalPort = ((_a = status === null || status === void 0 ? void 0 : status.https) === null || _a === void 0 ? void 0 : _a.listening) && status.https.port || ((_b = status === null || status === void 0 ? void 0 : status.http) === null || _b === void 0 ? void 0 : _b.listening) && status.http.port || undefined;
     const mapped = lodash_1.default.find(mappings, x => x.private.host === localIp && x.private.port === internalPort);
     return {
         upnp: Boolean(res),
         localIp,
         gatewayIp,
-        publicIp: await gettingIp || await exports.externalIp,
-        externalIp: await exports.externalIp,
+        publicIps: await gettingIps,
+        externalIp: exports.externalIp,
         mapped,
         internalPort,
         externalPort: mapped === null || mapped === void 0 ? void 0 : mapped.public.port,
     };
 });
-async function getPublicIp() {
-    const prjInfo = await (0, github_1.getProjectInfo)();
-    for (const urls of lodash_1.default.chunk(lodash_1.default.shuffle(prjInfo.publicIpServices), 2)) // small parallelization
-        try {
-            return await Promise.any(urls.map(url => (0, util_http_1.httpString)(url).then(res => {
-                var _a;
-                const ip = (_a = res.body) === null || _a === void 0 ? void 0 : _a.trim();
-                if (!/[.:0-9a-fA-F]/.test(ip))
-                    throw Error("bad result: " + ip);
-                return ip;
-            })));
-        }
-        catch (e) {
-            console.debug(String(e));
-        }
+async function getPublicIps() {
+    const res = await (0, github_1.getProjectInfo)();
+    const groupedByVersion = Object.values(lodash_1.default.groupBy(res.publicIpServices, x => { var _a; return (_a = x.v) !== null && _a !== void 0 ? _a : 4; }));
+    const ips = await (0, misc_1.promiseBestEffort)(groupedByVersion.map(singleVersion => Promise.any(singleVersion.map(async (svc) => {
+        if (typeof svc === 'string')
+            svc = { type: 'http', url: svc };
+        console.debug("trying ip service", svc.url || svc.name);
+        if (svc.type === 'http')
+            return (0, util_http_1.httpString)(svc.url);
+        if (svc.type !== 'dns')
+            throw "unsupported";
+        const resolver = new promises_2.Resolver({ timeout: 2000 });
+        resolver.setServers(svc.ips);
+        return resolver.resolve(svc.name, svc.dnsRecord);
+    }).map(async (ret) => {
+        const validIps = (0, misc_1.wantArray)(await ret).map(x => x.trim()).filter(net_1.isIP);
+        if (!validIps.length)
+            throw "no good";
+        return validIps;
+    }))));
+    return lodash_1.default.uniq(ips.flat());
 }
 function findGateway() {
     return new Promise((resolve, reject) => (0, child_process_1.exec)(const_1.IS_WINDOWS || const_1.IS_MAC ? 'netstat -rn' : 'route -n', (err, out) => {
@@ -105,12 +109,16 @@ async function checkDomain(domain) {
         (0, promises_2.lookup)(domain).then(x => [x.address]),
     ]);
     // merge all results
-    const ips = lodash_1.default.uniq((0, misc_1.onlyTruthy)(settled.map(x => x.status === 'fulfilled' && x.value)).flat());
-    if (!ips.length)
+    const domainIps = lodash_1.default.uniq((0, misc_1.onlyTruthy)(settled.map(x => x.status === 'fulfilled' && x.value)).flat());
+    if (!domainIps.length)
         throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, "domain not working");
-    const { publicIp } = await getNatInfo(); // do this before stopping the server
-    if (!ips.includes(publicIp))
-        throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, `please configure your domain to point to ${publicIp} (currently on ${ips[0]}) --- a change can take hours to be effective`);
+    const { publicIps } = await getNatInfo(); // do this before stopping the server
+    for (const v6 of [false, true]) {
+        const domainIpsThisVersion = domainIps.filter(x => (0, net_1.isIPv6)(x) === v6);
+        const ipsThisVersion = publicIps.filter(x => (0, net_1.isIPv6)(x) === v6);
+        if (domainIpsThisVersion.length && ipsThisVersion.length && !lodash_1.default.intersection(domainIpsThisVersion, ipsThisVersion).length)
+            throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, `configure your domain to point to ${ipsThisVersion} (currently on ${domainIpsThisVersion[0]}) – a change can take hours to be effective`);
+    }
 }
 async function generateSSLCert(domain, email) {
     await checkDomain(domain);
@@ -129,19 +137,19 @@ async function generateSSLCert(domain, email) {
         let check = await checkPort(domain, 80); // some check services may not consider the domain, but we already verified that
         if (check && !check.success && upnp && externalPort !== 80) { // consider a short-lived mapping
             // @ts-ignore
-            await client.createMapping({ private: 80, public: { host: '', port: 80 }, description: 'hfs temporary', ttl: 30 }).catch(() => { });
+            await upnpClient.createMapping({ private: 80, public: { host: '', port: 80 }, description: 'hfs temporary', ttl: 30 }).catch(() => { });
             check = await checkPort(domain, 80); // repeat test
         }
         if (!check)
             throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, "couldn't test port 80");
         if (!check.success)
             throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, "port 80 is not working on the specified domain");
-        const client = new acme_client_1.default.Client({
+        const acmeClient = new acme_client_1.default.Client({
             accountKey: await acme_client_1.default.crypto.createPrivateKey(),
             directoryUrl: acme_client_1.default.directory.letsencrypt.production
         });
         const [key, csr] = await acme_client_1.default.crypto.createCsr({ commonName: domain });
-        const cert = await client.auto({
+        const cert = await acmeClient.auto({
             csr,
             email,
             challengePriority: ['http-01'],
@@ -166,28 +174,26 @@ async function generateSSLCert(domain, email) {
 }
 async function checkPort(ip, port) {
     const prjInfo = await (0, github_1.getProjectInfo)();
+    console.log(`checking server ${ip}:${port}`);
     for (const services of lodash_1.default.chunk(lodash_1.default.shuffle(prjInfo.checkServerServices), 2)) {
         try {
-            return Promise.any(services.map(async (svc) => {
-                var _a, _b;
-                const service = new URL(svc.url).hostname;
+            return Promise.any(services.map(async ({ url, body, selector, regexpSuccess, regexpFailure, ...rest }) => {
+                const service = new URL(url).hostname;
                 console.log('trying service', service);
-                const api = axios_1.default[svc.method];
-                const body = ((_a = svc.body) === null || _a === void 0 ? void 0 : _a.replace('$IP', ip).replace('$PORT', String(port))) || '';
-                const res = await api(svc.url, body, { headers: svc.headers });
-                const parsed = (_b = (0, node_html_parser_1.parse)(res.data).querySelector(svc.selector)) === null || _b === void 0 ? void 0 : _b.innerText;
-                if (!parsed)
-                    throw console.debug('empty:' + service);
-                const success = new RegExp(svc.regexpSuccess).test(parsed);
-                const failure = new RegExp(svc.regexpFailure).test(parsed);
+                const res = await (0, util_http_1.httpString)(applySymbols(url), { family: (0, net_1.isIPv6)(ip) ? 6 : 4, body: applySymbols(body), ...rest });
+                const success = new RegExp(regexpSuccess).test(res);
+                const failure = new RegExp(regexpFailure).test(res);
                 if (success === failure)
                     throw console.debug('inconsistent:' + service); // this result cannot be trusted
                 console.debug(service, 'responded', success);
-                return { success, service };
+                return { success, service, ip, port };
             }));
         }
         catch (_a) { }
     }
+    function applySymbols(s) {
+        return s === null || s === void 0 ? void 0 : s.replace('$IP', ip).replace('$PORT', String(port));
+    }
 }
 const apis = {
     get_nat: getNatInfo,
@@ -203,40 +209,59 @@ const apis = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, 'no internal port');
         if (externalPort)
             try {
-                await client.removeMapping({ public: { host: '', port: externalPort } });
+                await upnpClient.removeMapping({ public: { host: '', port: externalPort } });
             }
             catch (e) {
                 return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, 'removeMapping failed: ' + String(e));
             }
         if (external) // must use the object form of 'public' to work around a bug of the library
-            await client.createMapping({ private: internal || internalPort, public: { host: '', port: external }, description: 'hfs', ttl: 0 });
+            await upnpClient.createMapping({ private: internal || internalPort, public: { host: '', port: external }, description: 'hfs', ttl: 0 });
         return {};
     },
     async check_server({ port }) {
-        const { publicIp, internalPort, externalPort } = await getNatInfo();
-        if (!publicIp)
-            return new apiMiddleware_1.ApiError(const_1.HTTP_SERVICE_UNAVAILABLE, 'cannot detect public ip');
+        const { publicIps, internalPort, externalPort } = await getNatInfo();
+        if (!publicIps.length)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, 'cannot detect public ip');
         if (!internalPort)
             return new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, 'no internal port');
         port || (port = externalPort || internalPort);
-        console.log(`checking server ${publicIp}:${port}`);
-        return await checkPort(publicIp, port)
-            || new apiMiddleware_1.ApiError(const_1.HTTP_SERVICE_UNAVAILABLE);
+        const res = await (0, misc_1.promiseBestEffort)(publicIps.map(ip => checkPort(ip, port)));
+        return res.length ? res : new apiMiddleware_1.ApiError(const_1.HTTP_SERVICE_UNAVAILABLE);
     },
     async make_cert({ domain, email }) {
-        if (!domain)
-            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad params');
-        const res = await generateSSLCert(domain, email);
-        const CERT_FILE = 'acme.cert';
-        const KEY_FILE = 'acme.key';
-        await promises_1.default.writeFile(CERT_FILE, res.cert);
-        await promises_1.default.writeFile(KEY_FILE, res.key);
-        listen_1.cert.set(CERT_FILE); // update config
-        listen_1.privateKey.set(KEY_FILE);
+        await (0, exports.makeCert)(domain, email);
         return {};
     },
     get_cert() {
         return (0, misc_1.objSameKeys)(lodash_1.default.pick((0, listen_1.getCertObject)(), ['subject', 'issuer', 'validFrom', 'validTo']), v => v);
     }
 };
+exports.acme_domain = (0, config_1.defineConfig)('acme_domain', '');
+exports.acme_email = (0, config_1.defineConfig)('acme_email', '');
+exports.makeCert = (0, misc_1.debounceAsync)(async (domain, email) => {
+    if (!domain)
+        return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad params');
+    const res = await generateSSLCert(domain, email);
+    const CERT_FILE = 'acme.cert';
+    const KEY_FILE = 'acme.key';
+    await promises_1.default.writeFile(CERT_FILE, res.cert);
+    await promises_1.default.writeFile(KEY_FILE, res.key);
+    listen_1.cert.set(CERT_FILE); // update config
+    listen_1.privateKey.set(KEY_FILE);
+}, 0);
+(0, config_1.defineConfig)('acme_renew', false); // handle config changes
+events_1.default.once('https ready', () => (0, misc_1.repeat)(misc_1.HOUR, renewCert));
+// checks if the cert is near expiration date, and if so renews it
+const renewCert = (0, misc_1.debounceAsync)(async () => {
+    const cert = (0, listen_1.getCertObject)();
+    if (!cert)
+        return;
+    const now = new Date();
+    const validTo = new Date(cert.validTo);
+    // not expiring in a month
+    if (now > new Date(cert.validFrom) && now < validTo && validTo.getTime() - now.getTime() >= 30 * misc_1.DAY)
+        return console.log("certificate still good");
+    await (0, exports.makeCert)(exports.acme_domain.get(), exports.acme_email.get())
+        .catch(e => console.log("error renewing certificate: ", String(e)));
+}, 0, { retain: misc_1.DAY, retainFailure: misc_1.HOUR });
 exports.default = apis;

package/src/api.plugins.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDependencies = void 0;
 const plugins_1 = require("./plugins");
 const lodash_1 = __importDefault(require("lodash"));
 const assert_1 = __importDefault(require("assert"));
@@ -15,7 +16,7 @@ const github_1 = require("./github");
 const const_1 = require("./const");
 const apis = {
     get_plugins({}, ctx) {
-        const list = new apiMiddleware_1.SendListReadable({ addAtStart: [...(0, plugins_1.mapPlugins)(serialize), ...(0, plugins_1.getAvailablePlugins)().map(serialize)] });
+        const list = new apiMiddleware_1.SendListReadable({ addAtStart: [...(0, plugins_1.mapPlugins)(serialize, false), ...(0, plugins_1.getAvailablePlugins)().map(serialize)] });
         return list.events(ctx, {
             pluginInstalled: p => list.add(serialize(p)),
             'pluginStarted pluginStopped pluginUpdated': p => {
@@ -28,7 +29,8 @@ const apis = {
     async get_plugin_updates() {
         return new apiMiddleware_1.SendListReadable({
             async doAtStart(list) {
-                const errs = await Promise.all(lodash_1.default.map((0, github_1.getFolder2repo)(), async (repo, folder) => {
+                const errs = [];
+                await Promise.allSettled(lodash_1.default.map((0, github_1.getFolder2repo)(), async (repo, folder) => {
                     try {
                         if (!repo)
                             return;
@@ -46,12 +48,11 @@ const apis = {
                         }
                     }
                     catch (err) {
-                        if (err.message === '404') // the plugin is declaring a wrong repo
-                            return;
-                        return err.code || err.message;
+                        if (err.message !== '404') // the plugin is declaring a wrong repo
+                            errs.push(err.code || err.message);
                     }
                 }));
-                for (const x of lodash_1.default.uniq((0, misc_1.onlyTruthy)(errs)))
+                for (const x of lodash_1.default.uniq(errs))
                     list.error(x);
                 list.close();
             }
@@ -124,18 +125,16 @@ const apis = {
         });
     },
     async download_plugin({ id, branch }) {
-        await checkDependencies(id, branch);
-        const res = await (0, github_1.downloadPlugin)(id, { branch });
-        if (typeof res !== 'string')
-            return res;
-        return (await (0, misc_1.waitFor)(() => (0, plugins_1.getPluginInfo)(res), { timeout: 5000 }))
+        await checkDependencies(await (0, github_1.readOnlinePlugin)(id, branch));
+        const folder = await (0, github_1.downloadPlugin)(id, { branch });
+        return (await (0, misc_1.waitFor)(() => (0, plugins_1.getPluginInfo)(folder), { timeout: 5000 }))
             || new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
     },
     async update_plugin({ id }) {
         const found = (0, plugins_1.getPluginInfo)(id);
         if (!found)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
-        await checkDependencies(found.repo);
+        await checkDependencies(found);
         const enabled = (0, plugins_1.isPluginEnabled)(id);
         await (0, plugins_1.stopPlugin)(id);
         await (0, github_1.downloadPlugin)(found.repo, { overwrite: true });
@@ -157,19 +156,9 @@ function serialize(p) {
         o.repo = o.repo.web;
     return lodash_1.default.defaults(o, { started: null, badApi: null }); // nulls should be used to be sure to overwrite previous values,
 }
-async function checkDependencies(repo, branch) {
-    const rec = await (0, github_1.readOnlinePlugin)(repo, branch);
-    if (!rec)
-        return;
-    const miss = rec.depend && rec.depend.map((dep) => {
-        const res = (0, plugins_1.findPluginByRepo)(dep.repo);
-        const error = !res ? 'missing'
-            : (res.version || 0) < dep.version ? 'version'
-                : !(0, plugins_1.isPluginEnabled)(res.id) ? 'disabled'
-                    : !(0, plugins_1.isPluginRunning)(res.id) ? 'stopped'
-                        : '';
-        return error && { repo: dep.repo, error, id: res === null || res === void 0 ? void 0 : res.id };
-    }).filter(Boolean);
-    if (miss === null || miss === void 0 ? void 0 : miss.length)
+async function checkDependencies(plugin) {
+    const miss = await (0, plugins_1.getMissingDependencies)(plugin);
+    if (miss.length)
         throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY, miss);
 }
+exports.checkDependencies = checkDependencies;

package/src/api.vfs.js

@@ -19,10 +19,7 @@ async function urlToNodeOriginal(uri) {
 }
 const apis = {
     async get_vfs() {
-        return {
-            root: await recur(),
-            defaultPerms: vfs_1.defaultPerms,
-        };
+        return { root: await recur() };
         async function recur(node = vfs_1.vfs) {
             var _a;
             const { source } = node;
@@ -32,19 +29,19 @@ const apis = {
                 : { size: source ? -1 : undefined };
             if (copyStats.mtime && Number(copyStats.mtime) === Number(copyStats.ctime))
                 delete copyStats.mtime;
-            let byMasks = node.original && lodash_1.default.pickBy(node, (v, k) => v !== node.original[k] // something is changing me...
-                && v !== node.parent[k] // ...and it's not inheritance...
-                && vfs_1.PERM_KEYS.includes(k)); // ...must be masks. Please limit this to perms
-            if (lodash_1.default.isEmpty(byMasks))
-                byMasks = undefined;
+            const inherited = node.parent && (0, vfs_1.permsFromParent)(node.parent, node.original || node);
+            const byMasks = node.original && lodash_1.default.pickBy(node, (v, k) => v !== node.original[k] // something is changing me...
+                && !(inherited && k in inherited) // ...and it's not inheritance...
+                && misc_1.PERM_KEYS.includes(k)); // ...must be masks. Please limit this to perms
             return {
                 ...copyStats,
                 ...node.original || node,
-                byMasks,
+                inherited,
+                byMasks: lodash_1.default.isEmpty(byMasks) ? undefined : byMasks,
                 website: Boolean((_a = node.children) === null || _a === void 0 ? void 0 : _a.find((0, vfs_1.isSameFilenameAs)('index.html')))
                     || isDir && source && await (0, promises_1.stat)((0, path_1.join)(source, 'index.html')).then(() => true, () => undefined)
                     || undefined,
-                name: node === vfs_1.vfs ? undefined : (0, vfs_1.getNodeName)(node),
+                name: node === vfs_1.vfs ? '' : (0, vfs_1.getNodeName)(node),
                 type: isDir ? 'folder' : undefined,
                 children: node.children && await Promise.all(node.children.map(child => recur((0, vfs_1.applyParentToChild)(child, node))))
             };
@@ -78,7 +75,7 @@ const apis = {
         const n = await urlToNodeOriginal(uri);
         if (!n)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'path not found');
-        props = pickProps(props, ['name', 'source', 'masks', 'default', 'accept', ...vfs_1.PERM_KEYS]); // sanitize
+        props = pickProps(props, ['name', 'source', 'masks', 'default', 'accept', ...misc_1.PERM_KEYS]); // sanitize
         if (props.name && props.name !== (0, vfs_1.getNodeName)(n)) {
             const parent = await urlToNodeOriginal((0, path_1.dirname)(uri));
             if ((_a = parent === null || parent === void 0 ? void 0 : parent.children) === null || _a === void 0 ? void 0 : _a.find(x => (0, vfs_1.getNodeName)(x) === props.name))