hfs 0.48.3 → 0.49.0-alpha2

package/src/block.js

@@ -6,8 +6,12 @@ const config_1 = require("./config");
 const connections_1 = require("./connections");
 const misc_1 = require("./misc");
 const block = (0, config_1.defineConfig)('block', [], rules => {
+    const now = new Date();
     const ret = !Array.isArray(rules) ? []
-        : (0, misc_1.onlyTruthy)(rules.map(rule => (0, misc_1.makeNetMatcher)(rule.ip, true)));
+        : (0, misc_1.onlyTruthy)(rules.map(rule => {
+            rule.expire && (rule.expire = new Date(rule.expire));
+            return !(rule.expire > now) && (0, misc_1.makeNetMatcher)(rule.ip, true);
+        }));
     // reapply new block to existing connections
     for (const { socket, ip } of (0, connections_1.getConnections)())
         applyBlock(socket, ip);
@@ -18,3 +22,12 @@ function applyBlock(socket, ip = (0, connections_1.normalizeIp)(socket.remoteAdd
         return socket.destroy();
 }
 exports.applyBlock = applyBlock;
+setInterval(() => {
+    const now = new Date();
+    const next = block.get().filter(x => !x.expire || x.expire > now);
+    const n = block.get().length - next.length;
+    if (!n)
+        return;
+    console.log("blocking rules:", n, "expired");
+    block.set(next);
+}, misc_1.MINUTE / 2);

package/src/commands.js

@@ -106,7 +106,7 @@ const commands = {
     },
     update: {
         params: '',
-        cb: update_1.update
+        cb: () => (0, update_1.update)()
     },
     'check-update': {
         params: '',

package/src/comments.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setCommentFor = exports.getCommentFor = exports.descriptIon = exports.DESCRIPT_ION = void 0;
+const config_1 = require("./config");
+const path_1 = require("path");
+const cross_1 = require("./cross");
+const util_files_1 = require("./util-files");
+const promises_1 = require("fs/promises");
+const misc_1 = require("./misc");
+const lodash_1 = __importDefault(require("lodash"));
+exports.DESCRIPT_ION = 'descript.ion';
+exports.descriptIon = (0, config_1.defineConfig)('descript_ion', true);
+async function getCommentFor(path) {
+    return !path || !exports.descriptIon.get() ? undefined
+        : readDescription((0, path_1.dirname)(path)).then(x => x.get((0, cross_1.basename)(path)), () => undefined);
+}
+exports.getCommentFor = getCommentFor;
+exports.setCommentFor = (0, misc_1.singleFromBatch)(async (jobs) => {
+    const byFolder = lodash_1.default.groupBy(jobs, job => (0, path_1.dirname)(job[0]));
+    return Promise.allSettled(lodash_1.default.map(byFolder, async (jobs, folder) => {
+        const comments = await readDescription(folder).catch(() => new Map());
+        for (const [path, comment] of jobs) {
+            const file = path.slice(folder.length + 1);
+            if (!comment)
+                comments.delete(file);
+            else
+                comments.set(file, comment);
+        }
+        // encode comments in descript.ion format
+        let txt = '';
+        comments.forEach((c, f) => txt += (f.includes(' ') ? `"${f}"` : f) + ' ' + (c.includes('\n') ? c.replaceAll('\n', '\\n') + MULTILINE_SUFFIX : c) + '\n');
+        await (0, promises_1.writeFile)((0, path_1.join)(folder, exports.DESCRIPT_ION), txt);
+    }));
+});
+const MULTILINE_SUFFIX = '\x04\xc2';
+function readDescription(path) {
+    return (0, util_files_1.parseFile)((0, path_1.join)(path, exports.DESCRIPT_ION), txt => new Map(txt.split('\n').map(line => {
+        const quoted = line[0] === '"' ? 1 : 0;
+        const i = quoted ? line.indexOf('"', 2) + 1 : line.indexOf(' ');
+        const fn = line.slice(quoted, i - quoted);
+        let comment = line.slice(i + 1);
+        if (comment.endsWith(MULTILINE_SUFFIX))
+            comment = comment.slice(0, -2).replaceAll('\\n', '\n');
+        return [fn, comment];
+    })));
+}

package/src/config.js

@@ -89,11 +89,7 @@ function defineConfig(k, defaultValue, compiler) {
             else
                 setConfig1(k, v);
         },
-        compiled: () => {
-            if (!compiler)
-                throw "missing compiler";
-            return compiled;
-        }
+        compiled: () => compiled !== null && compiled !== void 0 ? compiled : (0, misc_1.throw_)("missing compiler"),
     };
     if (compiler)
         ret.sub((...args) => compiled = compiler(...args));

package/src/const.js

@@ -27,7 +27,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_PATH = exports.IS_BINARY = exports.IS_MAC = exports.IS_WINDOWS = exports.HTTP_SERVICE_UNAVAILABLE = exports.HTTP_SERVER_ERROR = exports.HTTP_FAILED_DEPENDENCY = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_OK = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = exports.HFS_REPO_BRANCH = exports.HFS_REPO = exports.COMPATIBLE_API_VERSION = exports.API_VERSION = exports.RUNNING_BETA = exports.VERSION = exports.BUILD_TIMESTAMP = exports.HFS_STARTED = exports.ORIGINAL_CWD = exports.DEV = exports.argv = void 0;
+exports.APP_PATH = exports.IS_BINARY = exports.IS_MAC = exports.IS_WINDOWS = exports.HTTP_SERVICE_UNAVAILABLE = exports.HTTP_SERVER_ERROR = exports.HTTP_FAILED_DEPENDENCY = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_MOVED_PERMANENTLY = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_OK = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = exports.HFS_REPO_BRANCH = exports.HFS_REPO = exports.COMPATIBLE_API_VERSION = exports.API_VERSION = exports.RUNNING_BETA = exports.VERSION = exports.BUILD_TIMESTAMP = exports.HFS_STARTED = exports.ORIGINAL_CWD = exports.DEV = exports.argv = void 0;
 const minimist_1 = __importDefault(require("minimist"));
 const fs = __importStar(require("fs"));
 const os_1 = require("os");
@@ -38,7 +38,7 @@ exports.DEV = process.env.DEV || exports.argv.dev ? 'DEV' : '';
 exports.ORIGINAL_CWD = process.cwd();
 exports.HFS_STARTED = new Date();
 const PKG_PATH = (0, path_1.join)(__dirname, '..', 'package.json');
-exports.BUILD_TIMESTAMP = "2023-09-21T14:29:22.907Z";
+exports.BUILD_TIMESTAMP = "2023-10-04T19:41:32.601Z";
 const pkg = JSON.parse(fs.readFileSync(PKG_PATH, 'utf8'));
 exports.VERSION = pkg.version;
 exports.RUNNING_BETA = exports.VERSION.includes('-');
@@ -54,6 +54,7 @@ exports.PLUGINS_PUB_URI = exports.SPECIAL_URI + 'plugins/';
 exports.HTTP_OK = 200;
 exports.HTTP_NO_CONTENT = 204;
 exports.HTTP_PARTIAL_CONTENT = 206;
+exports.HTTP_MOVED_PERMANENTLY = 301;
 exports.HTTP_TEMPORARY_REDIRECT = 302;
 exports.HTTP_NOT_MODIFIED = 304;
 exports.HTTP_BAD_REQUEST = 400;

package/src/cross.js

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.xlate = exports.isEqualLax = exports.isWindowsDrive = exports.isIP = exports.isPrimitive = exports.formatTimestamp = exports.repeat = exports.asyncGeneratorToArray = exports.filterMapGenerator = exports.throw_ = exports.hasProp = exports.typedEntries = exports.typedKeys = exports.objRenameKey = exports.randomId = exports.getOrSet = exports.waitFor = exports.newObj = exports.removeStarting = exports.findDefined = exports.isOrderedEqual = exports.swap = exports.tryJson = exports.basename = exports.pendingPromise = exports._log = exports.wantArray = exports.formatPerc = exports.with_ = exports.try_ = exports.setHidden = exports.onlyTruthy = exports.truthy = exports.enforceFinal = exports.objSameKeys = exports.haveTimeout = exports.wait = exports.prefix = exports.formatBytes = exports.MAX_TILES_SIZE = exports.DAY = exports.HOUR = exports.MINUTE = exports.WIKI_URL = exports.REPO_URL = void 0;
+exports.isWindowsDrive = exports.isIP = exports.isPrimitive = exports.formatTimestamp = exports.repeat = exports.asyncGeneratorToArray = exports.filterMapGenerator = exports.throw_ = exports.hasProp = exports.typedEntries = exports.typedKeys = exports.objRenameKey = exports.randomId = exports.getOrSet = exports.waitFor = exports.newObj = exports.removeStarting = exports.findDefined = exports.isOrderedEqual = exports.swap = exports.tryJson = exports.basename = exports.pendingPromise = exports._dbg = exports._log = exports.wantArray = exports.formatPerc = exports.with_ = exports.try_ = exports.setHidden = exports.onlyTruthy = exports.truthy = exports.enforceFinal = exports.objSameKeys = exports.haveTimeout = exports.wait = exports.prefix = exports.formatBytes = exports.isWhoObject = exports.PERM_KEYS = exports.defaultPerms = exports.WHO_ANY_ACCOUNT = exports.WHO_NO_ONE = exports.WHO_ANYONE = exports.MAX_TILES_SIZE = exports.DAY = exports.HOUR = exports.MINUTE = exports.WIKI_URL = exports.REPO_URL = void 0;
+exports.promiseBestEffort = exports.escapeHTML = exports.ipForUrl = exports.ipLocalHost = exports.xlate = exports.isEqualLax = void 0;
 // This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
 // all content here is shared between client and server
 const lodash_1 = __importDefault(require("lodash"));
@@ -13,6 +14,22 @@ exports.MINUTE = 60000;
 exports.HOUR = 60 * exports.MINUTE;
 exports.DAY = 24 * exports.HOUR;
 exports.MAX_TILES_SIZE = 10;
+exports.WHO_ANYONE = true;
+exports.WHO_NO_ONE = false;
+exports.WHO_ANY_ACCOUNT = '*';
+exports.defaultPerms = {
+    can_see: 'can_read',
+    can_read: exports.WHO_ANYONE,
+    can_list: 'can_read',
+    can_upload: exports.WHO_NO_ONE,
+    can_delete: exports.WHO_NO_ONE,
+    can_archive: 'can_read'
+};
+exports.PERM_KEYS = typedKeys(exports.defaultPerms);
+function isWhoObject(v) {
+    return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+exports.isWhoObject = isWhoObject;
 const MULTIPLIERS = ['', 'K', 'M', 'G', 'T'];
 function formatBytes(n, { post = 'B', k = 1024, digits = NaN } = {}) {
     if (isNaN(Number(n)) || n < 0)
@@ -86,6 +103,11 @@ function _log(...args) {
     return args[args.length - 1];
 }
 exports._log = _log;
+function _dbg(x) {
+    debugger;
+    return x;
+}
+exports._dbg = _dbg;
 function pendingPromise() {
     let takeOut;
     const ret = new Promise((resolve, reject) => takeOut = { resolve, reject });
@@ -158,6 +180,7 @@ function newObj(src, returnNewValue, recur = false) {
     return Object.fromEntries(onlyTruthy(pairs));
 }
 exports.newObj = newObj;
+// returns undefined if timeout is reached
 async function waitFor(cb, { interval = 200, timeout = Infinity } = {}) {
     const started = Date.now();
     while (1) {
@@ -225,7 +248,7 @@ async function asyncGeneratorToArray(generator) {
 }
 exports.asyncGeneratorToArray = asyncGeneratorToArray;
 function repeat(every, cb) {
-    Promise.allSettled([cb()]).then(() => setTimeout(() => repeat(every, cb), every));
+    return Promise.allSettled([cb()]).then(() => setTimeout(() => repeat(every, cb), every));
 }
 exports.repeat = repeat;
 function formatTimestamp(x) {
@@ -255,3 +278,21 @@ function xlate(input, table) {
     return (_a = table[input]) !== null && _a !== void 0 ? _a : input;
 }
 exports.xlate = xlate;
+function ipLocalHost(ip) {
+    return ip === '::1' || ip.endsWith('127.0.0.1');
+}
+exports.ipLocalHost = ipLocalHost;
+function ipForUrl(ip) {
+    return ip.includes(':') ? '[' + ip + ']' : ip;
+}
+exports.ipForUrl = ipForUrl;
+function escapeHTML(text) {
+    return text.replace(/[\u0000-\u002F\u003A-\u0040\u005B-\u0060\u007B-\u00FF]/g, c => '&#' + ('000' + c.charCodeAt(0)).slice(-4) + ';');
+}
+exports.escapeHTML = escapeHTML;
+// wait for all, but returns only those that resolved
+async function promiseBestEffort(promises) {
+    const res = await Promise.allSettled(promises);
+    return res.filter(x => x.status === 'fulfilled').map((x) => x.value);
+}
+exports.promiseBestEffort = promiseBestEffort;

package/src/customHtml.js

@@ -35,7 +35,7 @@ function watchLoadCustomHtml(folder = '') {
 exports.watchLoadCustomHtml = watchLoadCustomHtml;
 function getSection(name) {
     return (exports.customHtmlState.sections.get(name) || '')
-        + (0, plugins_1.mapPlugins)(pl => pl.getData().customHtml.get(name)).join('\n');
+        + (0, plugins_1.mapPlugins)(pl => { var _a; return (_a = pl.getData().customHtml) === null || _a === void 0 ? void 0 : _a.get(name); }).join('\n');
 }
 exports.getSection = getSection;
 async function saveCustomHtml(sections) {

package/src/debounceAsync.js

@@ -1,6 +1,7 @@
 "use strict";
 // This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.singleFromBatch = exports.debounceAsync = void 0;
 // like lodash.debounce, but also avoids async invocations to overlap
 function debounceAsync(callback, wait = 100, options = {}) {
     const { leading = false, maxWait = Infinity, cancelable = false, retain = 0, retainFailure } = options;
@@ -14,7 +15,9 @@ function debounceAsync(callback, wait = 100, options = {}) {
     let lastSince = 0;
     const interceptingWrapper = (...args) => runningDebouncer = debouncer(...args);
     return Object.assign(interceptingWrapper, {
+        clearRetain: () => last = undefined,
         flush: () => runningCallback !== null && runningCallback !== void 0 ? runningCallback : exec(),
+        isWorking: () => runningCallback,
         ...cancelable && {
             cancel() {
                 waitingSince = 0;
@@ -58,4 +61,18 @@ function debounceAsync(callback, wait = 100, options = {}) {
         }
     }
 }
-exports.default = debounceAsync;
+exports.debounceAsync = debounceAsync;
+// given a function that works on a batch of requests, returns the function that works on a single request
+function singleFromBatch(batchWorker) {
+    let batch = [];
+    const debounced = debounceAsync(async () => {
+        const ret = batchWorker(batch);
+        batch = [];
+        return ret;
+    });
+    return (...args) => {
+        batch.push(args);
+        return debounced();
+    };
+}
+exports.singleFromBatch = singleFromBatch;

package/src/frontEndApis.js

@@ -39,6 +39,7 @@ const promises_1 = require("fs/promises");
 const path_1 = require("path");
 const upload_1 = require("./upload");
 const misc_1 = require("./misc");
+const comments_1 = require("./comments");
 exports.frontEndApis = {
     get_file_list: api_file_list_1.get_file_list,
     ...api_auth,
@@ -95,6 +96,7 @@ exports.frontEndApis = {
             throw new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
         try {
             await (0, promises_1.rm)(node.source, { recursive: true });
+            (0, comments_1.setCommentFor)(node.source, '').then();
             return {};
         }
         catch (e) {
@@ -111,18 +113,38 @@ exports.frontEndApis = {
         if (!(0, vfs_1.hasPermission)(node, 'can_delete', ctx))
             throw new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
         try {
-            if (node.name)
+            if (node.name) // virtual name = virtual rename
                 node.name = dest;
-            else if (node.source)
-                await (0, promises_1.rename)(node.source, (0, path_1.join)((0, path_1.dirname)(node.source), dest));
-            else
-                throw new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
+            else {
+                if (!node.source)
+                    throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY);
+                const destSource = (0, path_1.join)((0, path_1.dirname)(node.source), dest);
+                await (0, promises_1.rename)(node.source, destSource);
+                (0, comments_1.getCommentFor)(node.source).then(c => {
+                    if (!c)
+                        return;
+                    (0, comments_1.setCommentFor)(node.source, '').then();
+                    (0, comments_1.setCommentFor)(destSource, c).then();
+                });
+            }
             return {};
         }
         catch (e) {
             throw new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, e);
         }
-    }
+    },
+    async comment({ uri, comment }, ctx) {
+        (0, misc_1.apiAssertTypes)({ string: { uri, comment } });
+        const node = await (0, vfs_1.urlToNode)(uri, ctx);
+        if (!node)
+            throw new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
+        if (!(0, vfs_1.hasPermission)(node, 'can_upload', ctx))
+            throw new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
+        if (!node.source)
+            throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY);
+        await (0, comments_1.setCommentFor)(node.source, comment);
+        return {};
+    },
 };
 function notifyClient(ctx, name, data) {
     const { notificationChannel } = ctx.query;

package/src/github.js

@@ -26,35 +26,37 @@ function downloadProgress(id, status) {
 // determine default branch, possibly without consuming api quota
 async function getGithubDefaultBranch(repo) {
     var _a;
-    const res = await (0, misc_1.httpString)(`https://github.com/${repo}/archive/refs/heads/main.zip`, { method: 'HEAD' });
-    return res.ok ? 'main'
-        : (_a = (await getRepoInfo(repo))) === null || _a === void 0 ? void 0 : _a.default_branch;
+    const test = await (0, misc_1.httpString)(`https://github.com/${repo}/archive/refs/heads/main.zip`, { method: 'HEAD' }).then(() => 1, () => 0);
+    return test ? 'main' : (_a = (await getRepoInfo(repo))) === null || _a === void 0 ? void 0 : _a.default_branch;
 }
 async function downloadPlugin(repo, { branch = '', overwrite = false } = {}) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     if (typeof repo !== 'string')
         repo = repo.main;
     if (downloading[repo])
-        return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT, "already downloading");
+        throw new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT, "already downloading");
+    const projectInfo = await (0, exports.getProjectInfo)();
+    if ((_a = projectInfo === null || projectInfo === void 0 ? void 0 : projectInfo.plugins_blacklist) === null || _a === void 0 ? void 0 : _a.includes(repo))
+        throw new apiMiddleware_1.ApiError(const_1.HTTP_FORBIDDEN, "blacklisted");
     console.log('downloading plugin', repo);
     downloadProgress(repo, true);
     try {
         if (repo.includes('//')) { // custom repo
             const pl = (0, plugins_1.findPluginByRepo)(repo);
             if (!pl)
-                return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, "bad repo");
-            const customRepo = (((_b = (_a = pl).getData) === null || _b === void 0 ? void 0 : _b.call(_a)) || pl).repo;
+                throw new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, "bad repo");
+            const customRepo = (((_c = (_b = pl).getData) === null || _c === void 0 ? void 0 : _c.call(_b)) || pl).repo;
             let url = customRepo === null || customRepo === void 0 ? void 0 : customRepo.zip;
             if (!url)
-                return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, "bad plugin");
+                throw new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, "bad plugin");
             if (!url.includes('//'))
                 url = customRepo.web + url;
-            return await go(url, pl === null || pl === void 0 ? void 0 : pl.id, (_c = customRepo.zipRoot) !== null && _c !== void 0 ? _c : DIST_ROOT);
+            return await go(url, pl === null || pl === void 0 ? void 0 : pl.id, (_d = customRepo.zipRoot) !== null && _d !== void 0 ? _d : DIST_ROOT);
         }
         branch || (branch = await getGithubDefaultBranch(repo));
         const short = repo.split('/')[1]; // second part, repo without the owner
         if (!short)
-            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, "bad repo");
+            throw new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, "bad repo");
         const folder = overwrite ? lodash_1.default.findKey(getFolder2repo(), x => x === repo) // use existing folder
             : getFolder2repo().hasOwnProperty(short) ? repo.replace('/', '-') // longer form only if another plugin is using short form, to avoid overwriting
                 : short;
@@ -96,8 +98,7 @@ function getRepoInfo(id) {
 }
 exports.getRepoInfo = getRepoInfo;
 function readGithubFile(uri) {
-    return (0, misc_1.httpString)('https://raw.githubusercontent.com/' + uri)
-        .then(res => res.body);
+    return (0, misc_1.httpString)('https://raw.githubusercontent.com/' + uri);
 }
 exports.readGithubFile = readGithubFile;
 async function readOnlinePlugin(repo, branch = '') {
@@ -111,10 +112,7 @@ async function readOnlinePlugin(repo, branch = '') {
             throw Error("missing repo.main");
         if (!main.includes('//'))
             main = pl.repo.web + main;
-        const res = await (0, misc_1.httpString)(main);
-        if (!res.ok)
-            throw Error("bad repo.main");
-        return (0, plugins_1.parsePluginSource)(main, res.body); // use 'repo' as 'id' client-side
+        return (0, plugins_1.parsePluginSource)(main, await (0, misc_1.httpString)(main)); // use 'repo' as 'id' client-side
     }
     branch || (branch = await getGithubDefaultBranch(repo));
     const res = await readGithubFile(`${repo}/${branch}/${DIST_ROOT}/plugin.js`);
@@ -132,22 +130,16 @@ function getFolder2repo() {
 }
 exports.getFolder2repo = getFolder2repo;
 async function apiGithub(uri) {
-    try {
-        const res = await (0, misc_1.httpString)('https://api.github.com/' + uri, {
-            headers: {
-                'User-Agent': 'HFS',
-                Accept: 'application/vnd.github.v3+json',
-            }
-        });
-        if (!res.ok)
-            throw res.statusCode;
-        return JSON.parse(res.body);
-    }
-    catch (e) {
+    return (0, misc_1.httpString)('https://api.github.com/' + uri, {
+        headers: {
+            'User-Agent': 'HFS',
+            Accept: 'application/vnd.github.v3+json',
+        }
+    }).then(JSON.parse, e => {
         // https://docs.github.com/en/rest/overview/resources-in-the-rest-api?apiVersion=2022-11-28#rate-limiting
         throw e.message === '403' ? Error('github_quota')
             : e;
-    }
+    });
 }
 async function searchPlugins(text = '') {
     const projectInfo = await (0, exports.getProjectInfo)();
@@ -188,5 +180,7 @@ exports.searchPlugins = searchPlugins;
 // centralized hosted information, to be used as little as possible
 const FN = 'central.json';
 let builtIn = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', FN), 'utf8'));
-exports.getProjectInfo = (0, misc_1.debounceAsync)(() => readGithubFile(`${const_1.HFS_REPO}/${const_1.HFS_REPO_BRANCH}/${FN}`).then(JSON.parse, () => builtIn), // fall back to latest
+exports.getProjectInfo = (0, misc_1.debounceAsync)(() => readGithubFile(`${const_1.HFS_REPO}/${const_1.HFS_REPO_BRANCH}/${FN}`)
+    .then(JSON.parse, () => null)
+    .then(x => Object.assign(Object.create(builtIn), const_1.DEV ? null : x)), // fall back to built-in
 0, { retain: misc_1.DAY, retainFailure: 60000 });

package/src/langs/hfs-lang-it.json

@@ -1,7 +1,7 @@
 {
     "author": "Massimo Melina",
     "version": 1.8,
-    "hfs_version": "0.47.1",
+    "hfs_version": "0.49.0",
     "translate": {
         "Select": "Seleziona",
         "n_files": "{n} file",
@@ -121,8 +121,10 @@
         "showHelp_F_body": "pieno schermo",
         "Destination": "Destinazione",
         "in_queue": "{n} in coda",
-        "": "PLUGINS SECTION",
-        "": "PLUGIN thumbnails",
+        "enter_comment": "Comment for this file",
+        "Comment": "Comment",
+        "_PLUGINS SECTION": "",
+        "_PLUGIN thumbnails": "",
         "Enable tiles mode": "Modalità griglia",
         "thumbnails_switchBack": "Puoi tornare alla lista com'era prima entrando in Opzioni"
     }

package/src/langs/hfs-lang-ru.json

@@ -1,7 +1,7 @@
 {
     "author": "Mefistofell, SanokKule",
-    "version": 2.1,
-    "hfs_version": "0.48.0",
+    "version": 2.2,
+    "hfs_version": "0.49.0",
     "translate": {
         "Select": "Выбор",
         "n_files": "{n,plural, one{1 файл} few{# файла} other{# файлов}}",
@@ -129,8 +129,10 @@
         "showHelp_F_body": "полноэкранный режим",
         "Destination": "Назначение",
         "in_queue": "{n} в очереди",
-        "": "PLUGINS SECTION",
-        "": "PLUGIN thumbnails",
+        "enter_comment": "Комментарий для файла",
+        "Comment": "Комментировать",
+        "_PLUGINS SECTION": "",
+        "_PLUGIN thumbnails": "",
         "Enable tiles mode": "Просмотр в режиме плиток",
         "thumbnails_switchBack": "Изменить вид можно в настройках"
     }

package/src/listen.js

@@ -43,6 +43,8 @@ const adminApis_1 = require("./adminApis");
 const lodash_1 = __importDefault(require("lodash"));
 const crypto_1 = require("crypto");
 const api_net_1 = require("./api.net");
+const events_1 = __importDefault(require("./events"));
+const net_1 = require("net");
 let httpSrv;
 let httpsSrv;
 const openBrowserAtStart = (0, config_1.defineConfig)('open_browser_at_start', !const_1.DEV);
@@ -52,13 +54,11 @@ function getHttpsWorkingPort() {
 }
 exports.getHttpsWorkingPort = getHttpsWorkingPort;
 const commonOptions = { requestTimeout: 0 };
-exports.portCfg = (0, config_1.defineConfig)('port', 80);
-exports.portCfg.sub(async (port) => {
-    while (!index_1.app)
-        await (0, misc_1.wait)(100);
+const considerHttp = (0, misc_1.debounceAsync)(async () => {
+    await (0, misc_1.waitFor)(() => index_1.app);
     stopServer(httpSrv).then();
     httpSrv = Object.assign(http.createServer(commonOptions, index_1.app.callback()), { name: 'http' });
-    port = await startServer(httpSrv, { port });
+    const port = await startServer(httpSrv, { port: exports.portCfg.get(), host: listenInterface.get() });
     if (!port)
         return;
     httpSrv.on('connection', connections_1.newConnection);
@@ -66,6 +66,10 @@ exports.portCfg.sub(async (port) => {
     if (openBrowserAtStart.get() && !const_1.argv.updated)
         openAdmin();
 });
+exports.portCfg = (0, config_1.defineConfig)('port', 80);
+const listenInterface = (0, config_1.defineConfig)('listen_interface', '');
+exports.portCfg.sub(considerHttp);
+listenInterface.sub(considerHttp);
 function openAdmin() {
     for (const srv of [httpSrv, httpsSrv]) {
         const a = srv === null || srv === void 0 ? void 0 : srv.address();
@@ -84,6 +88,8 @@ function openAdmin() {
 }
 exports.openAdmin = openAdmin;
 function getCertObject() {
+    if (!httpsOptions.cert)
+        return;
     const o = new crypto_1.X509Certificate(httpsOptions.cert);
     const some = lodash_1.default.pick(o, ['subject', 'issuer', 'validFrom', 'validTo']);
     return (0, misc_1.objSameKeys)(some, v => (v === null || v === void 0 ? void 0 : v.includes('=')) ? Object.fromEntries(v.split('\n').map(x => x.split('='))) : v);
@@ -99,6 +105,8 @@ const considerHttps = (0, misc_1.debounceAsync)(async () => {
         httpsSrv = Object.assign(https.createServer(port === PORT_DISABLED ? {} : { ...commonOptions, key: httpsOptions.private_key, cert: httpsOptions.cert }, index_1.app.callback()), { name: 'https' });
         if (port >= 0) {
             const cert = getCertObject();
+            if (!cert)
+                return;
             const cn = (_a = cert.subject) === null || _a === void 0 ? void 0 : _a.CN;
             if (cn)
                 console.log("certificate loaded for", cn);
@@ -120,11 +128,12 @@ const considerHttps = (0, misc_1.debounceAsync)(async () => {
         console.log("failed to create https server: check your private key and certificate", String(e));
         return;
     }
-    port = await startServer(httpsSrv, { port });
+    port = await startServer(httpsSrv, { port, host: listenInterface.get() });
     if (!port)
         return;
     httpsSrv.on('connection', connections_1.newConnection);
     printUrls(httpsSrv.name);
+    events_1.default.emit('https ready');
 });
 exports.cert = (0, config_1.defineConfig)('cert', '');
 exports.privateKey = (0, config_1.defineConfig)('private_key', '');
@@ -150,6 +159,7 @@ for (const cfg of httpsNeeds) {
 const PORT_DISABLED = -1;
 exports.httpsPortCfg = (0, config_1.defineConfig)('https_port', PORT_DISABLED);
 exports.httpsPortCfg.sub(considerHttps);
+listenInterface.sub(considerHttps);
 function startServer(srv, { port, host }) {
     return new Promise(async (resolve) => {
         if (!srv)
@@ -194,6 +204,8 @@ function startServer(srv, { port, host }) {
                 srv.error = String(e);
                 srv.busy = undefined;
                 const { code } = e;
+                if (code === 'EACCES' && port < 1024)
+                    srv.error = `lacking permission on port ${port}, try with permission (${const_1.IS_WINDOWS ? 'administrator' : 'sudo'}) or port > 1024`;
                 if (code === 'EADDRINUSE') {
                     srv.busy = (0, find_process_1.default)('port', port).then(res => { var _a; return ((_a = res === null || res === void 0 ? void 0 : res[0]) === null || _a === void 0 ? void 0 : _a.name) || ''; }, () => '');
                     srv.error = `port ${port} busy: ${await srv.busy || "unknown process"}`;
@@ -242,36 +254,34 @@ async function getServerStatus() {
 }
 exports.getServerStatus = getServerStatus;
 const ignore = /^(lo|.*loopback.*|virtualbox.*|.*\(wsl\).*|llw\d|awdl\d|utun\d|anpi\d)$/i; // avoid giving too much information
-async function getIps() {
+async function getIps(external = true) {
     const ips = (0, misc_1.onlyTruthy)(Object.entries((0, os_1.networkInterfaces)()).map(([name, nets]) => nets && !ignore.test(name)
         && v4first((0, misc_1.onlyTruthy)(nets.map(net => !net.internal && net.address)))[0] // for each interface we consider only 1 address
     )).flat();
-    const e = await api_net_1.externalIp;
+    const e = external && api_net_1.externalIp;
     if (e && !ips.includes(e))
         ips.unshift(e);
     return v4first(ips)
         .filter((x, i, a) => a.length > 1 || !x.startsWith('169.254')); // 169.254 = dhcp failure on the interface, but keep it if it's our only one
     function v4first(a) {
-        return lodash_1.default.sortBy(a, x => x.includes(':'));
+        return lodash_1.default.sortBy(a, net_1.isIPv6); // works because `false` comes first
     }
 }
 exports.getIps = getIps;
 async function getUrls() {
-    const ips = (await getIps()).map(ip => ip.includes(':') ? '[' + ip + ']' : ip);
+    const on = listenInterface.get();
+    const ips = on ? [on] : await getIps();
     return Object.fromEntries((0, misc_1.onlyTruthy)([httpSrv, httpsSrv].map(srv => {
         var _a;
         if (!(srv === null || srv === void 0 ? void 0 : srv.listening))
             return false;
         const port = (_a = srv === null || srv === void 0 ? void 0 : srv.address()) === null || _a === void 0 ? void 0 : _a.port;
         const appendPort = port === (srv.name === 'https' ? 443 : 80) ? '' : ':' + port;
-        const urls = ips.map(ip => `${srv.name}://${ip}${appendPort}`);
+        const urls = ips.map(ip => `${srv.name}://${(0, misc_1.ipForUrl)(ip)}${appendPort}`);
         return urls.length && [srv.name, urls];
     })));
 }
 exports.getUrls = getUrls;
 function printUrls(srvName) {
-    getUrls().then(urls => {
-        for (const url of urls[srvName])
-            console.log('serving on', url);
-    });
+    getUrls().then(urls => lodash_1.default.each(urls[srvName], url => console.log('serving on', url)));
 }

package/src/middlewares.js

@@ -224,7 +224,9 @@ const prepareState = async (ctx, next) => {
     if (ctx.session)
         ctx.session.maxAge = exports.sessionDuration.compiled();
     // calculate these once and for all
-    ctx.state.account = (_a = await getHttpAccount(ctx)) !== null && _a !== void 0 ? _a : (0, perm_1.getAccount)((_b = ctx.session) === null || _b === void 0 ? void 0 : _b.username, false);
+    const a = ctx.state.account = (_a = await getHttpAccount(ctx)) !== null && _a !== void 0 ? _a : (0, perm_1.getAccount)((_b = ctx.session) === null || _b === void 0 ? void 0 : _b.username, false);
+    if (a && !(0, perm_1.accountCanLogin)(a))
+        ctx.state.account = undefined;
     const conn = ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     ctx.state.revProxyPath = ctx.get('x-forwarded-prefix');
     if (conn)