hfs 0.49.2 → 0.50.0-alpha3

package/src/cross.js

@@ -17,8 +17,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isWindowsDrive = exports.isIP = exports.isPrimitive = exports.formatTimestamp = exports.repeat = exports.asyncGeneratorToArray = exports.filterMapGenerator = exports.throw_ = exports.hasProp = exports.typedEntries = exports.typedKeys = exports.objRenameKey = exports.randomId = exports.getOrSet = exports.waitFor = exports.newObj = exports.removeStarting = exports.findDefined = exports.isOrderedEqual = exports.swap = exports.tryJson = exports.basename = exports.pendingPromise = exports._dbg = exports._log = exports.wantArray = exports.formatPerc = exports.with_ = exports.try_ = exports.setHidden = exports.onlyTruthy = exports.truthy = exports.enforceFinal = exports.objSameKeys = exports.haveTimeout = exports.wait = exports.prefix = exports.formatBytes = exports.isWhoObject = exports.PERM_KEYS = exports.defaultPerms = exports.WHO_ANY_ACCOUNT = exports.WHO_NO_ONE = exports.WHO_ANYONE = exports.MAX_TILES_SIZE = exports.DAY = exports.HOUR = exports.MINUTE = exports.WIKI_URL = exports.REPO_URL = void 0;
-exports.runAt = exports.promiseBestEffort = exports.escapeHTML = exports.ipForUrl = exports.ipLocalHost = exports.xlate = exports.isEqualLax = void 0;
+exports.filterMapGenerator = exports.throw_ = exports.hasProp = exports.typedEntries = exports.typedKeys = exports.objRenameKey = exports.randomId = exports.getOrSet = exports.waitFor = exports.newObj = exports.removeStarting = exports.findDefined = exports.isOrderedEqual = exports.swap = exports.tryJson = exports.basename = exports.pendingPromise = exports._dbg = exports._log = exports.wantArray = exports.formatPerc = exports.with_ = exports.try_ = exports.setHidden = exports.onlyTruthy = exports.truthy = exports.splitAt = exports.enforceFinal = exports.objSameKeys = exports.haveTimeout = exports.wait = exports.prefix = exports.formatBytes = exports.isWhoObject = exports.PERM_KEYS = exports.defaultPerms = exports.WHO_ANY_ACCOUNT = exports.WHO_NO_ONE = exports.WHO_ANYONE = exports.LIST = exports.CFG = exports.THEME_OPTIONS = exports.SORT_BY_OPTIONS = exports.FRONTEND_OPTIONS = exports.MAX_TILE_SIZE = exports.DAY = exports.HOUR = exports.MINUTE = exports.WIKI_URL = exports.REPO_URL = void 0;
+exports.runAt = exports.promiseBestEffort = exports.escapeHTML = exports.ipForUrl = exports.ipLocalHost = exports.xlate = exports.isEqualLax = exports.isWindowsDrive = exports.isIP = exports.isPrimitive = exports.formatTimestamp = exports.repeat = exports.asyncGeneratorToArray = void 0;
 // This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
 // all content here is shared between client and server
 const lodash_1 = __importDefault(require("lodash"));
@@ -28,7 +28,20 @@ exports.WIKI_URL = exports.REPO_URL + 'wiki/';
 exports.MINUTE = 60000;
 exports.HOUR = 60 * exports.MINUTE;
 exports.DAY = 24 * exports.HOUR;
-exports.MAX_TILES_SIZE = 10;
+exports.MAX_TILE_SIZE = 10;
+exports.FRONTEND_OPTIONS = {
+    file_menu_on_link: true,
+    tile_size: 0,
+    sort_by: 'name',
+    invert_order: false,
+    folders_first: true,
+    sort_numerics: false,
+    theme: '',
+};
+exports.SORT_BY_OPTIONS = ['name', 'extension', 'size', 'time'];
+exports.THEME_OPTIONS = { auto: '', light: 'light', dark: 'dark' };
+exports.CFG = constMap(['geo_enable', 'geo_allow', 'geo_list', 'geo_allow_unknown']);
+exports.LIST = { add: '+', remove: '-', update: '=', props: 'props', ready: 'ready', error: 'e' };
 exports.WHO_ANYONE = true;
 exports.WHO_NO_ONE = false;
 exports.WHO_ANY_ACCOUNT = '*';
@@ -41,6 +54,9 @@ exports.defaultPerms = {
     can_archive: 'can_read'
 };
 exports.PERM_KEYS = typedKeys(exports.defaultPerms);
+function constMap(a) {
+    return Object.fromEntries(a.map(x => [x, x]));
+}
 function isWhoObject(v) {
     return v !== null && typeof v === 'object' && !Array.isArray(v);
 }
@@ -76,6 +92,13 @@ function enforceFinal(sub, s, evenEmpty = false) {
     return !evenEmpty && !s || s.endsWith(sub) ? s : s + sub;
 }
 exports.enforceFinal = enforceFinal;
+function splitAt(sub, all) {
+    if (typeof sub === 'number')
+        return [all.slice(0, sub), all.slice(sub + 1)];
+    const i = all.indexOf(sub);
+    return i < 0 ? [all, ''] : [all.slice(0, i), all.slice(i + sub.length)];
+}
+exports.splitAt = splitAt;
 function truthy(value) {
     return Boolean(value);
 }
@@ -312,6 +335,7 @@ async function promiseBestEffort(promises) {
     return res.filter(x => x.status === 'fulfilled').map((x) => x.value);
 }
 exports.promiseBestEffort = promiseBestEffort;
+// run at a specific point in time, also solving the limit of setTimeout, which doesn't work with +32bit delays
 function runAt(ts, cb) {
     let cancel = false;
     let t;

package/src/customHtml.js

@@ -8,7 +8,7 @@ const promises_1 = require("fs/promises");
 const plugins_1 = require("./plugins");
 const FILE = 'custom.html';
 exports.customHtmlSections = ['beforeHeader', 'afterHeader', 'afterMenuBar', 'afterList',
-    'top', 'bottom', 'afterEntryName', 'beforeLogin'];
+    'top', 'bottom', 'afterEntryName', 'beforeLogin', 'unauthorized'];
 exports.customHtmlState = (0, vanilla_1.proxy)({
     sections: watchLoadCustomHtml().state
 });

package/src/geo.js

@@ -0,0 +1,61 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.geoFilter = exports.ip2country = void 0;
+const config_1 = require("./config");
+const misc_1 = require("./misc");
+const promises_1 = require("node:fs/promises");
+const ip2location_nodejs_1 = require("ip2location-nodejs");
+const lodash_1 = __importDefault(require("lodash"));
+const connections_1 = require("./connections");
+const ip2location = new ip2location_nodejs_1.IP2Location();
+const enabled = (0, config_1.defineConfig)(misc_1.CFG.geo_enable, false);
+const allow = (0, config_1.defineConfig)(misc_1.CFG.geo_allow, null);
+const list = (0, config_1.defineConfig)(misc_1.CFG.geo_list, []);
+const allowUnknown = (0, config_1.defineConfig)(misc_1.CFG.geo_allow_unknown, false);
+enabled.sub(checkFiles);
+setInterval(checkFiles, misc_1.DAY); // keep updated at run-time
+exports.ip2country = lodash_1.default.memoize((ip) => ip2location.getCountryShortAsync(ip).then(v => v === '-' ? '' : v, () => ''));
+const geoFilter = async (ctx, next) => {
+    var _a;
+    if (allow.get() !== null && !(0, misc_1.isLocalHost)(ctx)) {
+        const { connection } = ctx.state;
+        const country = (_a = connection.country) !== null && _a !== void 0 ? _a : (connection.country = await (0, exports.ip2country)(ctx.ip));
+        (0, connections_1.updateConnection)(connection, { country });
+        if (country ? list.get().includes(country) !== allow.get() : !allowUnknown.get())
+            return ctx.socket.destroy();
+    }
+    return next();
+};
+exports.geoFilter = geoFilter;
+function isOpen() {
+    return Boolean(ip2location.getPackageVersion());
+}
+async function checkFiles() {
+    var _a, _b;
+    if (!enabled.get())
+        return;
+    const ZIP_FILE = 'IP2LOCATION-LITE-DB1.IPV6.BIN';
+    const URL = `https://download.ip2location.com/lite/${ZIP_FILE}.ZIP`;
+    const LOCAL_FILE = 'geo_ip.bin';
+    const TEMP = LOCAL_FILE + '.downloading';
+    const { mtime = 0 } = await (0, promises_1.stat)(LOCAL_FILE).catch(() => ({ mtime: 0 }));
+    const now = Date.now();
+    if (mtime < now - 31 * misc_1.DAY) { // month-old or non-existing
+        console.log('downloading geo-ip db');
+        await (0, misc_1.unzip)(await (0, misc_1.httpStream)(URL), path => path.toUpperCase().endsWith(ZIP_FILE) && TEMP);
+        if (await (0, promises_1.stat)(TEMP))
+            if (isOpen())
+                ip2location.close();
+        await (0, promises_1.unlink)(LOCAL_FILE).catch(() => { });
+        await (0, promises_1.rename)(TEMP, LOCAL_FILE);
+        (_b = (_a = exports.ip2country.cache).clear) === null || _b === void 0 ? void 0 : _b.call(_a);
+        console.log('download geo-ip db completed');
+    }
+    else if (isOpen())
+        return;
+    console.debug('loading geo-ip db');
+    ip2location.open(LOCAL_FILE); // using openAsync causes a DEP0137 error within 10 seconds
+}

package/src/index.js

@@ -27,16 +27,19 @@ const misc_1 = require("./misc");
 const koa_session_1 = __importDefault(require("koa-session"));
 const selfCheck_1 = require("./selfCheck");
 const acme_1 = require("./acme");
+require("./geo");
+const geo_1 = require("./geo");
 (0, assert_1.ok)(lodash_1.default.intersection(Object.keys(frontEndApis_1.frontEndApis), Object.keys(adminApis_1.adminApis)).length === 0); // they share same endpoints, don't clash
 process.title = 'HFS ' + const_1.VERSION;
 const keys = ((_a = process.env.COOKIE_SIGN_KEYS) === null || _a === void 0 ? void 0 : _a.split(','))
     || [(0, misc_1.randomId)(30)]; // randomness at start gives some extra security, btu also invalidates existing sessions
 exports.app = new koa_1.default({ keys });
 exports.app.use(middlewares_1.someSecurity)
-    .use(selfCheck_1.selfCheckMiddleware)
     .use(acme_1.acmeMiddleware)
     .use((0, koa_session_1.default)({ key: 'hfs_$id', signed: true, rolling: true, sameSite: 'lax' }, exports.app))
     .use(middlewares_1.prepareState)
+    .use(geo_1.geoFilter)
+    .use(selfCheck_1.selfCheckMiddleware)
     .use(middlewares_1.gzipper)
     .use(middlewares_1.paramsDecoder) // must be done before plugins, so they can manipulate params
     .use(plugins_1.pluginsMiddleware)

package/src/log.js

@@ -35,7 +35,7 @@ const util = __importStar(require("util"));
 const promises_1 = require("fs/promises");
 const lodash_1 = __importDefault(require("lodash"));
 const util_files_1 = require("./util-files");
-const perm_1 = require("./perm");
+const auth_1 = require("./auth");
 const misc_1 = require("./misc");
 const events_1 = __importDefault(require("./events"));
 class Logger {
@@ -122,7 +122,7 @@ const logMw = async (ctx, next) => {
         const format = '%s - %s [%s] "%s %s HTTP/%s" %d %s %s\n'; // Apache's Common Log Format
         const a = now.toString().split(' ');
         const date = a[2] + '/' + a[1] + '/' + a[3] + ':' + a[4] + ' ' + ((_b = a[5]) === null || _b === void 0 ? void 0 : _b.slice(3));
-        const user = (0, perm_1.getCurrentUsername)(ctx);
+        const user = (0, auth_1.getCurrentUsername)(ctx);
         const length = (_c = ctx.state.length) !== null && _c !== void 0 ? _c : ctx.length;
         const uri = ctx.originalUrl;
         const extra = ctx.state.includesLastByte && ctx.vfsNode && ctx.res.finished && { dl: 1 }

package/src/middlewares.js

@@ -19,8 +19,7 @@ const block_1 = require("./block");
 const perm_1 = require("./perm");
 const connections_1 = require("./connections");
 const basic_auth_1 = __importDefault(require("basic-auth"));
-const tssrp6a_1 = require("tssrp6a");
-const api_auth_1 = require("./api.auth");
+const auth_1 = require("./auth");
 const path_1 = require("path");
 const promises_1 = require("stream/promises");
 const formidable_1 = __importDefault(require("formidable"));
@@ -202,36 +201,40 @@ function getProxyDetected() {
 }
 exports.getProxyDetected = getProxyDetected;
 const prepareState = async (ctx, next) => {
-    var _a, _b;
-    if (ctx.session)
+    var _a;
+    if (ctx.session) {
+        if (auth_1.invalidSessions.delete(ctx.session.username))
+            delete ctx.session.username;
         ctx.session.maxAge = exports.sessionDuration.compiled();
+    }
     // calculate these once and for all
-    const a = ctx.state.account = (_a = await getHttpAccount(ctx)) !== null && _a !== void 0 ? _a : (0, perm_1.getAccount)((_b = ctx.session) === null || _b === void 0 ? void 0 : _b.username, false);
+    const a = ctx.state.account = await urlLogin() || await getHttpAccount() || (0, perm_1.getAccount)((_a = ctx.session) === null || _a === void 0 ? void 0 : _a.username, false);
     if (a && !(0, perm_1.accountCanLogin)(a))
         ctx.state.account = undefined;
     const conn = ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     ctx.state.revProxyPath = ctx.get('x-forwarded-prefix');
+    ctx.state.browsing = undefined;
     if (conn)
         (0, connections_1.updateConnection)(conn, { ctx, op: undefined });
     await next();
+    async function urlLogin() {
+        const { login } = ctx.query;
+        if (!login)
+            return;
+        const [u, p] = (0, misc_1.splitAt)(':', String(login));
+        const a = await (0, auth_1.srpCheck)(u, p);
+        if (a) {
+            ctx.session.username = a.username;
+            ctx.redirect(ctx.originalUrl.slice(0, -ctx.querystring.length - 1));
+        }
+        return a;
+    }
+    async function getHttpAccount() {
+        const credentials = (0, basic_auth_1.default)(ctx.req);
+        return (0, auth_1.srpCheck)((credentials === null || credentials === void 0 ? void 0 : credentials.name) || '', (credentials === null || credentials === void 0 ? void 0 : credentials.pass) || '');
+    }
 };
 exports.prepareState = prepareState;
-async function getHttpAccount(ctx) {
-    const credentials = (0, basic_auth_1.default)(ctx.req);
-    const account = (0, perm_1.getAccount)((credentials === null || credentials === void 0 ? void 0 : credentials.name) || '');
-    if (account && await srpCheck(account.username, credentials.pass))
-        return account;
-}
-async function srpCheck(username, password) {
-    const account = (0, perm_1.getAccount)(username);
-    if (!(account === null || account === void 0 ? void 0 : account.srp) || !password)
-        return false;
-    const { step1, salt, pubKey } = await (0, api_auth_1.srpStep1)(account);
-    const client = new tssrp6a_1.SRPClientSession(new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters()));
-    const clientRes1 = await client.step1(username, password);
-    const clientRes2 = await clientRes1.step2(BigInt(salt), BigInt(pubKey));
-    return await step1.step2(clientRes2.A, clientRes2.M1).then(() => true, () => false);
-}
 const paramsDecoder = async (ctx, next) => {
     ctx.params = ctx.method === 'POST' && ctx.originalUrl.startsWith(const_1.API_URI)
         && ((0, misc_1.tryJson)(await (0, misc_1.stream2string)(ctx.req)) || {});

package/src/perm.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accountCanLoginAdmin = exports.accountCanLogin = exports.accountHasPassword = exports.getFromAccount = exports.delAccount = exports.setAccount = exports.addAccount = exports.renameAccount = exports.normalizeUsername = exports.accountsConfig = exports.updateAccount = exports.createAdmin = exports.allowClearTextLogin = exports.saveSrpInfo = exports.getAccount = exports.expandUsername = exports.getCurrentUsername = void 0;
+exports.accountCanLoginAdmin = exports.accountCanLogin = exports.accountHasPassword = exports.getFromAccount = exports.delAccount = exports.setAccount = exports.addAccount = exports.renameAccount = exports.normalizeUsername = exports.accountsConfig = exports.updateAccount = exports.createAdmin = exports.allowClearTextLogin = exports.saveSrpInfo = exports.getAccount = exports.expandUsername = void 0;
 const lodash_1 = __importDefault(require("lodash"));
 const crypt_1 = require("./crypt");
 const misc_1 = require("./misc");
@@ -12,11 +12,6 @@ const config_1 = require("./config");
 const tssrp6a_1 = require("tssrp6a");
 const events_1 = __importDefault(require("./events"));
 let accounts = {};
-function getCurrentUsername(ctx) {
-    var _a;
-    return ((_a = ctx.state.account) === null || _a === void 0 ? void 0 : _a.username) || '';
-}
-exports.getCurrentUsername = getCurrentUsername;
 // provides the username and all other usernames it inherits based on the 'belongs' attribute. Useful to check permissions
 function expandUsername(who) {
     const ret = [];

package/src/plugins.js

@@ -35,7 +35,6 @@ const const_1 = require("./const");
 const Const = __importStar(require("./const"));
 const misc_1 = require("./misc");
 const config_1 = require("./config");
-const vfs_1 = require("./vfs");
 const serveFile_1 = require("./serveFile");
 const events_1 = __importDefault(require("./events"));
 const promises_1 = require("fs/promises");
@@ -120,7 +119,6 @@ exports.getPluginConfigFields = getPluginConfigFields;
 async function initPlugin(pl, more) {
     var _a;
     return Object.assign(pl, await ((_a = pl.init) === null || _a === void 0 ? void 0 : _a.call(pl, {
-        const: Const,
         Const,
         require,
         getConnections: connections_1.getConnections,
@@ -154,7 +152,7 @@ const pluginsMiddleware = async (ctx, next) => {
             const a = path.substring(const_1.PLUGINS_PUB_URI.length).split('/');
             const name = a.shift();
             if (plugins.hasOwnProperty(name)) // do it only if the plugin is loaded
-                await (0, serveFile_1.serveFile)(ctx, plugins[name].folder + '/public/' + a.join('/'), vfs_1.MIME_AUTO);
+                await (0, serveFile_1.serveFile)(ctx, plugins[name].folder + '/public/' + a.join('/'), const_1.MIME_AUTO);
             return;
         }
         await next();

package/src/serveFile.js

@@ -38,13 +38,13 @@ function serveFileNode(ctx, node) {
     }
 }
 exports.serveFileNode = serveFileNode;
-const mimeCfg = (0, config_1.defineConfig)('mime', { '*': vfs_1.MIME_AUTO });
+const mimeCfg = (0, config_1.defineConfig)('mime', { '*': const_1.MIME_AUTO });
 async function serveFile(ctx, source, mime, content) {
     if (!source)
         return;
     const fn = path_1.default.basename(source);
     mime = mime !== null && mime !== void 0 ? mime : lodash_1.default.find(mimeCfg.get(), (v, k) => (0, misc_1.matches)(fn, k));
-    if (mime === vfs_1.MIME_AUTO)
+    if (mime === const_1.MIME_AUTO)
         mime = mime_types_1.default.lookup(source) || '';
     if (mime)
         ctx.type = mime;

package/src/serveGuiFiles.js

@@ -42,8 +42,8 @@ const customHtml_1 = require("./customHtml");
 const lodash_1 = __importDefault(require("lodash"));
 const config_1 = require("./config");
 const lang_1 = require("./lang");
-const vfs_1 = require("./vfs");
 const logGui = (0, config_1.defineConfig)('log_gui', false);
+lodash_1.default.each(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.defineConfig)(k, v)); // define default values
 // in case of dev env we have our static files within the 'dist' folder'
 const DEV_STATIC = process.env.DEV ? 'dist/' : '';
 function serveStatic(uri) {
@@ -70,7 +70,7 @@ function serveStatic(uri) {
         if (content === null)
             return ctx.status = const_1.HTTP_NOT_FOUND;
         if (!serveApp)
-            return (0, serveFile_1.serveFile)(ctx, fullPath, vfs_1.MIME_AUTO, content);
+            return (0, serveFile_1.serveFile)(ctx, fullPath, const_1.MIME_AUTO, content);
         // we don't cache the index as it's small and may prevent plugins change to apply
         ctx.body = await treatIndex(ctx, uri, String(content));
     };
@@ -119,8 +119,7 @@ async function treatIndex(ctx, filesUri, body) {
         plugins,
         prefixUrl: ctx.state.revProxyPath,
         customHtml: lodash_1.default.omit(Object.fromEntries(customHtml_1.customHtmlState.sections), ['top', 'bottom']),
-        fileMenuOnLink: fileMenuOnLink.get(),
-        tilesSize: tilesSize.get(),
+        ...(0, misc_1.newObj)(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.getConfig)(k)),
         lang
     }, null, 4)
         .replace(/<(\/script)/g, '<"+"$1') /*avoid breaking our script container*/}
@@ -175,5 +174,3 @@ function serveGuiFiles(proxyPort, uri) {
     return serveProxied(proxyPort, uri) || serveStatic(uri);
 }
 exports.serveGuiFiles = serveGuiFiles;
-const fileMenuOnLink = (0, config_1.defineConfig)('file_menu_on_link', true);
-const tilesSize = (0, config_1.defineConfig)('tiles_size', 0);

package/src/srp.js

@@ -0,0 +1,22 @@
+"use strict";
+// This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.srpClientPart = exports.srpClientSequence = void 0;
+const tssrp6a_1 = require("tssrp6a");
+async function srpClientSequence(username, password, apiCall) {
+    const { pubKey, salt } = await apiCall('loginSrp1', { username });
+    if (!salt)
+        throw Error('salt');
+    const client = await srpClientPart(username, password, salt, pubKey);
+    const res = await apiCall('loginSrp2', { pubKey: String(client.A), proof: String(client.M1) }); // bigint-s must be cast to string to be json-ed
+    await client.step3(BigInt(res.proof)).catch(() => Promise.reject('trust'));
+    return res;
+}
+exports.srpClientSequence = srpClientSequence;
+async function srpClientPart(username, password, salt, pubKey) {
+    const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
+    const srp = new tssrp6a_1.SRPClientSession(srp6aNimbusRoutines);
+    const res = await srp.step1(username, password);
+    return await res.step2(BigInt(salt), BigInt(pubKey));
+}
+exports.srpClientPart = srpClientPart;

package/src/upload.js

@@ -14,7 +14,7 @@ const config_1 = require("./config");
 const util_os_1 = require("./util-os");
 const connections_1 = require("./connections");
 const throttler_1 = require("./throttler");
-const perm_1 = require("./perm");
+const auth_1 = require("./auth");
 const comments_1 = require("./comments");
 exports.deleteUnfinishedUploadsAfter = (0, config_1.defineConfig)('delete_unfinished_uploads_after', 86400);
 exports.minAvailableMb = (0, config_1.defineConfig)('min_available_mb', 100);
@@ -27,7 +27,7 @@ function getUploadMeta(path) {
 exports.getUploadMeta = getUploadMeta;
 function setUploadMeta(path, ctx) {
     return (0, misc_1.storeFileAttr)(path, ATTR_UPLOADER, {
-        username: (0, perm_1.getCurrentUsername)(ctx) || undefined,
+        username: (0, auth_1.getCurrentUsername)(ctx) || undefined,
         ip: ctx.ip,
     });
 }

package/src/vfs.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parentMaskApplier = exports.masksCouldGivePermission = exports.walkNode = exports.statusCodeForMissingPerm = exports.hasPermission = exports.nodeIsDirectory = exports.getNodeName = exports.saveVfs = exports.vfs = exports.urlToNode = exports.applyParentToChild = exports.isSameFilenameAs = exports.permsFromParent = exports.MIME_AUTO = void 0;
+exports.parentMaskApplier = exports.masksCouldGivePermission = exports.walkNode = exports.statusCodeForMissingPerm = exports.hasPermission = exports.nodeIsLink = exports.nodeIsDirectory = exports.getNodeName = exports.saveVfs = exports.vfs = exports.urlToNode = exports.applyParentToChild = exports.isSameFilenameAs = exports.permsFromParent = void 0;
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = require("path");
 const misc_1 = require("./misc");
@@ -13,7 +13,7 @@ const config_1 = require("./config");
 const const_1 = require("./const");
 const events_1 = __importDefault(require("./events"));
 const perm_1 = require("./perm");
-exports.MIME_AUTO = 'auto';
+const auth_1 = require("./auth");
 function permsFromParent(parent, child) {
     const ret = {};
     for (const k of misc_1.PERM_KEYS) {
@@ -100,7 +100,7 @@ async function urlToNode(url, ctx, parent = exports.vfs, getRest) {
     }
     ret.source = (0, misc_1.enforceFinal)('/', parent.source) + onDisk;
     if (parent.default)
-        inheritFromParent({ mime: { '*': exports.MIME_AUTO } }, ret);
+        inheritFromParent({ mime: { '*': const_1.MIME_AUTO } }, ret);
     if (rest)
         return urlToNode(rest, ctx, ret, getRest);
     if (ret.source)
@@ -119,12 +119,6 @@ async function urlToNode(url, ctx, parent = exports.vfs, getRest) {
 exports.urlToNode = urlToNode;
 exports.vfs = {};
 (0, config_1.defineConfig)('vfs', {}).sub(data => exports.vfs = (function recur(node) {
-    if (node.propagate) { // legacy pre-0.47
-        for (const [k, v] of (0, misc_1.typedEntries)(node.propagate))
-            if (v === false)
-                node[k] = { this: node[k] };
-        delete node.propagate;
-    }
     if (node.children)
         for (const c of node.children)
             recur(c);
@@ -154,14 +148,15 @@ async function nodeIsDirectory(node) {
     var _a;
     if (node.isFolder !== undefined)
         return node.isFolder;
-    const isFolder = Boolean(((_a = node.children) === null || _a === void 0 ? void 0 : _a.length) || !node.source || await (0, misc_1.isDirectory)(node.source));
-    if (node.isTemp)
-        node.isFolder = isFolder;
-    else
-        (0, misc_1.setHidden)(node, { isFolder }); // don't make it to the storage
+    const isFolder = Boolean(((_a = node.children) === null || _a === void 0 ? void 0 : _a.length) || !nodeIsLink(node) && (!node.source || await (0, misc_1.isDirectory)(node.source)));
+    (0, misc_1.setHidden)(node, { isFolder }); // don't make it to the storage (a node.isTemp doesn't need it to be hidden)
     return isFolder;
 }
 exports.nodeIsDirectory = nodeIsDirectory;
+function nodeIsLink(node) {
+    return node.url;
+}
+exports.nodeIsLink = nodeIsLink;
 function hasPermission(node, perm, ctx) {
     return !statusCodeForMissingPerm(node, perm, ctx, false);
 }
@@ -189,12 +184,12 @@ function statusCodeForMissingPerm(node, perm, ctx, assign = true) {
         if (Array.isArray(who)) {
             const arr = who; // shut up ts
             // check if I or any ancestor match `who`, but cache ancestors' usernames inside context state
-            const some = (0, misc_1.getOrSet)(ctx.state, 'usernames', () => (0, perm_1.expandUsername)((0, perm_1.getCurrentUsername)(ctx)))
+            const some = (0, misc_1.getOrSet)(ctx.state, 'usernames', () => (0, perm_1.expandUsername)((0, auth_1.getCurrentUsername)(ctx)))
                 .some((u) => arr.includes(u));
             return some ? 0 : const_1.HTTP_UNAUTHORIZED;
         }
         return typeof who === 'boolean' ? (who ? 0 : const_1.HTTP_FORBIDDEN)
-            : who === misc_1.WHO_ANY_ACCOUNT ? (ctx.state.account ? 0 : const_1.HTTP_UNAUTHORIZED)
+            : who === misc_1.WHO_ANY_ACCOUNT ? ((0, auth_1.getCurrentUsername)(ctx) ? 0 : const_1.HTTP_UNAUTHORIZED)
                 : (0, misc_1.throw_)(Error('invalid permission: ' + JSON.stringify(who)));
     }
 }

package/src/zip.js

@@ -43,6 +43,8 @@ async function zipStreamFromFolder(node, ctx) {
             }
         })();
     const mappedWalker = (0, misc_1.filterMapGenerator)(walker, async (el) => {
+        if ((0, vfs_1.nodeIsLink)(el))
+            return;
         if (!(0, vfs_1.hasPermission)(el, 'can_archive', ctx))
             return; // the fact you see it doesn't mean you can get it
         const { source } = el;