hfs 0.52.4 → 0.53.0-alpha1

package/src/cross.js

@@ -43,8 +43,8 @@ exports.FRONTEND_OPTIONS = {
 exports.SORT_BY_OPTIONS = ['name', 'extension', 'size', 'time'];
 exports.THEME_OPTIONS = { auto: '', light: 'light', dark: 'dark' };
 exports.CFG = constMap(['geo_enable', 'geo_allow', 'geo_list', 'geo_allow_unknown', 'dynamic_dns_url',
-    'log', 'error_log', 'log_rotation', 'dont_log_net', 'log_gui', 'log_api', 'log_ua',
-    'max_downloads', 'max_downloads_per_ip', 'max_downloads_per_account', 'roots', 'roots_mandatory']);
+    'log', 'error_log', 'log_rotation', 'dont_log_net', 'log_gui', 'log_api', 'log_ua', 'log_spam',
+    'max_downloads', 'max_downloads_per_ip', 'max_downloads_per_account', 'roots', 'force_address']);
 exports.LIST = { add: '+', remove: '-', update: '=', props: 'props', ready: 'ready', error: 'e' };
 exports.WHO_ANYONE = true;
 exports.WHO_NO_ONE = false;
@@ -216,9 +216,7 @@ function findDefined(a, cb) {
 }
 exports.findDefined = findDefined;
 function newObj(src, returnNewValue, recur = false) {
-    if (!src)
-        return {};
-    const pairs = Object.entries(src).map(([k, v]) => {
+    const pairs = Object.entries(src || {}).map(([k, v]) => {
         if (typeof k === 'symbol')
             return;
         let _k = k;
@@ -315,7 +313,7 @@ function repeat(everyMs, cb) {
 }
 exports.repeat = repeat;
 function formatTimestamp(x) {
-    return !x ? '-' : (x instanceof Date ? x : new Date(x)).toLocaleString();
+    return !x ? '' : (x instanceof Date ? x : new Date(x)).toLocaleString();
 }
 exports.formatTimestamp = formatTimestamp;
 function isPrimitive(x) {
@@ -407,8 +405,8 @@ function matches(s, mask, emptyMaskReturns = false) {
 exports.matches = matches;
 function replace(s, symbols, delimiter = '') {
     const [open, close] = splitAt(' ', delimiter);
-    for (const [k, v] of typedEntries(symbols))
-        s = s.replace(open + k + close, lodash_1.default.isFunction(v) ? v() : v);
+    for (const [k, v] of Object.entries(symbols))
+        s = s.replaceAll(open + k + close, v); // typescript doesn't handle overloaded functions (like replaceAll) with union types https://stackoverflow.com/a/66510061/646132
     return s;
 }
 exports.replace = replace;

package/src/ddns.js

@@ -12,42 +12,43 @@ const node_net_1 = require("node:net");
 const net_1 = require("net");
 const const_1 = require("./const");
 const events_1 = __importDefault(require("./events"));
-const stream_1 = require("stream");
 const nat_1 = require("./nat");
 // optionally you can append '>' and a regular expression to determine what body is considered successful
 const dynamicDnsUrl = (0, config_1.defineConfig)(cross_1.CFG.dynamic_dns_url, '');
 let stop;
-let last;
 dynamicDnsUrl.sub(v => {
     stop === null || stop === void 0 ? void 0 : stop();
     if (!v)
         return;
     let lastIps;
-    const [templateUrl, re] = (0, cross_1.splitAt)('>', v);
     stop = (0, cross_1.repeat)(cross_1.HOUR, async () => {
         const ips = await (0, nat_1.getPublicIps)();
         if (lodash_1.default.isEqual(lastIps, ips))
             return;
         lastIps = ips;
-        const url = (0, cross_1.replace)(templateUrl, {
-            IPX: ips[0] || '',
-            IP4: lodash_1.default.find(ips, node_net_1.isIPv4) || '',
-            IP6: lodash_1.default.find(ips, net_1.isIPv6) || '',
-        }, '$');
-        const error = await (0, util_http_1.httpWithBody)(url, { httpThrow: false, headers: { 'User-Agent': "HFS/" + const_1.VERSION } }) // UA specified as requested by no-ip guidelines
-            .then(async (res) => {
-            const str = String(res.body).trim();
-            return (re ? str.match(re) : res.ok) ? '' : (str || res.statusMessage);
-        }, (err) => err.code || err.message || String(err));
-        last = { ts: new Date().toJSON(), error, url };
-        events_1.default.emit('dynamicDnsError', last);
-        console.log('dynamic dns update', error || 'ok');
+        const all = await Promise.all(v.split('\n').map(async (line) => {
+            const [templateUrl, re] = (0, cross_1.splitAt)('>', line);
+            const url = (0, cross_1.replace)(templateUrl, {
+                IPX: ips[0] || '',
+                IP4: lodash_1.default.find(ips, node_net_1.isIPv4) || '',
+                IP6: lodash_1.default.find(ips, net_1.isIPv6) || '',
+            }, '$');
+            const error = await (0, util_http_1.httpWithBody)(url, { httpThrow: false, headers: { 'User-Agent': "HFS/" + const_1.VERSION } }) // UA specified as requested by no-ip guidelines
+                .then(async (res) => {
+                const str = String(res.body).trim();
+                return (re ? str.match(re) : res.ok) ? '' : (str || res.statusMessage);
+            }, (err) => err.code || err.message || String(err));
+            return { ts: new Date().toJSON(), error, url };
+        }));
+        const best = lodash_1.default.find(all, 'error') || all[0]; // the system is designed for just one result, and we give precedence to errors
+        events_1.default.emit('dynamicDnsError', best);
+        console.log('dynamic dns update', (best === null || best === void 0 ? void 0 : best.error) || 'ok');
     });
 });
 async function* get_dynamic_dns_error() {
     while (1) {
-        yield last;
-        await (0, stream_1.once)(events_1.default, 'dynamicDnsError');
+        const res = await events_1.default.once('dynamicDnsError');
+        yield res[0];
     }
 }
 exports.get_dynamic_dns_error = get_dynamic_dns_error;

package/src/events.js

@@ -1,9 +1,60 @@
 "use strict";
 // This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const events_1 = __importDefault(require("events"));
+exports.BetterEventEmitter = void 0;
+class BetterEventEmitter {
+    constructor() {
+        this.listeners = new Map();
+    }
+    on(event, listener, { warnAfter = 10 } = {}) {
+        if (typeof event === 'string')
+            event = [event];
+        for (const e of event) {
+            let cbs = this.listeners.get(e);
+            if (!cbs)
+                this.listeners.set(e, cbs = new Set());
+            cbs.add(listener);
+            if (cbs.size > warnAfter)
+                console.warn("Warning: many events listeners for ", e);
+        }
+        return () => {
+            var _a;
+            for (const e of event)
+                (_a = this.listeners.get(e)) === null || _a === void 0 ? void 0 : _a.delete(listener);
+        };
+    }
+    once(event, listener) {
+        return new Promise(resolve => {
+            const off = this.on(event, function (...args) {
+                off();
+                resolve(args);
+                return listener === null || listener === void 0 ? void 0 : listener(...arguments);
+            });
+        });
+    }
+    multi(map) {
+        const cbs = Object.entries(map).map(([name, cb]) => this.on(name.split(' '), cb));
+        return () => {
+            for (const cb of cbs)
+                cb();
+        };
+    }
+    emit(event, ...args) {
+        let cbs = this.listeners.get(event);
+        if (!(cbs === null || cbs === void 0 ? void 0 : cbs.size))
+            return;
+        const ret = [];
+        for (const cb of cbs) {
+            const res = cb(...args);
+            if (res !== undefined)
+                ret.push(res);
+        }
+        return ret;
+    }
+    emitAsync(event, ...args) {
+        return Promise.all(this.emit(event, ...args) || []);
+    }
+}
+exports.BetterEventEmitter = BetterEventEmitter;
 // app-wide events
-exports.default = new events_1.default().setMaxListeners(100);
+exports.default = new BetterEventEmitter;

package/src/geo.js

@@ -45,7 +45,7 @@ async function checkFiles() {
     const TEMP = LOCAL_FILE + '.downloading';
     const { mtime = 0 } = await (0, promises_1.stat)(LOCAL_FILE).catch(() => ({ mtime: 0 }));
     const now = Date.now();
-    if (mtime < now - 31 * misc_1.DAY) { // month-old or non-existing
+    if (+mtime < now - 31 * misc_1.DAY) { // month-old or non-existing
         console.log('downloading geo-ip db');
         await (0, misc_1.unzip)(await (0, misc_1.httpStream)(URL), path => path.toUpperCase().endsWith(ZIP_FILE) && TEMP);
         if (await (0, promises_1.stat)(TEMP))

package/src/index.js

@@ -45,9 +45,9 @@ exports.app.use(middlewares_1.sessionMiddleware)
     .use(middlewares_1.gzipper)
     .use(middlewares_1.paramsDecoder) // must be done before plugins, so they can manipulate params
     .use(middlewares_1.headRequests)
+    .use(roots_1.rootsMiddleware)
     .use(log_1.logMw)
     .use(throttler_1.throttler)
-    .use(roots_1.rootsMiddleware)
     .use(plugins_1.pluginsMiddleware)
     .use((0, koa_mount_1.default)(const_1.API_URI, (0, apiMiddleware_1.apiMiddleware)({ ...frontEndApis_1.frontEndApis, ...adminApis_1.adminApis })))
     .use(serveGuiAndSharedFiles_1.serveGuiAndSharedFiles)

package/src/langs/hfs-lang-it.json

@@ -1,7 +1,7 @@
 {
     "author": "Massimo Melina",
-    "version": 1.9,
-    "hfs_version": "0.52.0",
+    "version": 2.53,
+    "hfs_version": "0.53.0",
     "translate": {
         "Select": "Seleziona",
         "n_files": "{n} file",
@@ -145,6 +145,10 @@
         "upload_skipped": "{n,plural, one{# saltato} other{# saltati}}",
         "Overwrite policy": "Per i file esistenti",
         "Rename to avoid overwriting": "Rinomina per non sovrascrivere",
-        "Overwrite existing files": "Sovrascrivi i file esistenti"
+        "Overwrite existing files": "Sovrascrivi i file esistenti",
+        "Menu": "Menu",
+        "clipboard": "Appunti ({content})",
+        "to_clipboard_source_tooltip": "Vai alla cartella d'origine dei file negli appunti",
+        "more_items": "{rest,plural,one{Un altro elemento} other{# altri elementi}}"
     }
 }

package/src/listen.js

@@ -49,8 +49,8 @@ let httpSrv;
 let httpsSrv;
 const openBrowserAtStart = (0, config_1.defineConfig)('open_browser_at_start', !const_1.DEV);
 exports.baseUrl = (0, config_1.defineConfig)('base_url', '', x => { var _a; return (_a = /(?<=\/\/)[^\/]+/.exec(x)) === null || _a === void 0 ? void 0 : _a[0]; }); // compiled is host only
-function getBaseUrlOrDefault() {
-    return exports.baseUrl.get() || nat_1.defaultBaseUrl.get();
+async function getBaseUrlOrDefault() {
+    return exports.baseUrl.get() || await nat_1.defaultBaseUrl.get();
 }
 exports.getBaseUrlOrDefault = getBaseUrlOrDefault;
 function getHttpsWorkingPort() {
@@ -280,7 +280,7 @@ exports.getServerStatus = getServerStatus;
 const ignore = /^(lo|.*loopback.*|virtualbox.*|.*\(wsl\).*|llw\d|awdl\d|utun\d|anpi\d)$/i; // avoid giving too much information
 const isLinkLocal = (0, misc_1.makeNetMatcher)('169.254.0.0/16|FE80::/16');
 async function getIps(external = true) {
-    const ips = (0, misc_1.onlyTruthy)(Object.entries((0, os_1.networkInterfaces)()).map(([name, nets]) => nets && !ignore.test(name) && nets.map(net => !net.internal && net.address)).flat());
+    const ips = (0, misc_1.onlyTruthy)(Object.entries((0, os_1.networkInterfaces)()).flatMap(([name, nets]) => nets && !ignore.test(name) && nets.map(net => !net.internal && net.address)));
     const e = external && nat_1.defaultBaseUrl.externalIp;
     if (e && !ips.includes(e))
         ips.unshift(e);

package/src/log.js

@@ -85,6 +85,7 @@ errorLogFile.sub(path => {
 const logRotation = (0, config_1.defineConfig)(misc_1.CFG.log_rotation, 'weekly');
 const dontLogNet = (0, config_1.defineConfig)(misc_1.CFG.dont_log_net, '127.0.0.1|::1', v => (0, misc_1.makeNetMatcher)(v));
 const logUA = (0, config_1.defineConfig)(misc_1.CFG.log_ua, false);
+const logSpam = (0, config_1.defineConfig)(misc_1.CFG.log_spam, false);
 const debounce = lodash_1.default.debounce(cb => cb(), 1000);
 const logMw = async (ctx, next) => {
     const now = new Date();
@@ -92,6 +93,9 @@ const logMw = async (ctx, next) => {
     ctx.state.completed = Promise.race([(0, stream_1.once)(ctx.res, 'finish'), (0, stream_1.once)(ctx.res, 'close')]);
     await next();
     console.debug(ctx.status, ctx.method, ctx.originalUrl);
+    if (ctx.status === misc_1.HTTP_NOT_FOUND && !logSpam.get()
+        && /wlwmanifest.xml$|robots.txt$|\.(php)$|cgi/.test(ctx.path))
+        return;
     const conn = (0, connections_1.getConnection)(ctx); // collect reference before close
     // don't await, as we don't want to hold the middlewares chain
     ctx.state.completed.then(() => {

package/src/middlewares.js

@@ -22,7 +22,6 @@ const index_1 = require("./index");
 const events_1 = __importDefault(require("./events"));
 const forceHttps = (0, config_1.defineConfig)('force_https', true);
 const ignoreProxies = (0, config_1.defineConfig)('ignore_proxies', false);
-const forceBaseUrl = (0, config_1.defineConfig)('force_base_url', false);
 exports.sessionDuration = (0, config_1.defineConfig)('session_duration', Number(process.env.SESSION_DURATION) || misc_1.DAY / 1000, v => v * 1000);
 exports.gzipper = (0, koa_compress_1.default)({
     threshold: 2048,
@@ -75,8 +74,6 @@ const someSecurity = async (ctx, next) => {
     catch (_a) {
         return ctx.status = const_1.HTTP_FOOL;
     }
-    if (!ctx.state.skipFilters && forceBaseUrl.get() && listen_1.baseUrl.compiled() && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled())
-        return (0, connections_1.disconnect)(ctx, 'force-domain');
     if (!ctx.secure && forceHttps.get() && (0, listen_1.getHttpsWorkingPort)() && !(0, misc_1.isLocalHost)(ctx)) {
         const { URL } = ctx;
         URL.protocol = 'https';
@@ -98,7 +95,7 @@ exports.getProxyDetected = getProxyDetected;
 const prepareState = async (ctx, next) => {
     var _a, _b;
     if ((_a = ctx.session) === null || _a === void 0 ? void 0 : _a.username) {
-        if (auth_1.invalidSessions.delete(ctx.session.username))
+        if (ctx.session.ts < auth_1.invalidateSessionBefore.get(ctx.session.username))
             delete ctx.session.username;
         ctx.session.maxAge = exports.sessionDuration.compiled();
     }
@@ -123,11 +120,17 @@ const prepareState = async (ctx, next) => {
         return doLogin((credentials === null || credentials === void 0 ? void 0 : credentials.name) || '', (credentials === null || credentials === void 0 ? void 0 : credentials.pass) || '');
     }
     async function doLogin(u, p) {
+        var _a;
+        if (!u || u === ((_a = ctx.session) === null || _a === void 0 ? void 0 : _a.username))
+            return; // providing credentials, but not needed
+        await events_1.default.emitAsync('attemptingLogin', ctx);
         const a = await (0, auth_1.srpCheck)(u, p);
         if (a) {
-            (0, auth_1.setLoggedIn)(ctx, a.username);
+            await (0, auth_1.setLoggedIn)(ctx, a.username);
             ctx.headers['x-username'] = a.username; // give an easier way to determine if the login was successful
         }
+        else if (u)
+            events_1.default.emit('failedLogin', ctx, { username: u });
         return a;
     }
 };

package/src/misc.js

@@ -18,7 +18,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiAssertTypes = exports.AsapStream = exports.asyncGeneratorToReadable = exports.same = exports.makeNetMatcher = exports.isLocalHost = exports.onOff = exports.pattern2filter = exports.onFirstEvent = exports.onProcessExit = void 0;
+exports.apiAssertTypes = exports.AsapStream = exports.asyncGeneratorToReadable = exports.same = exports.makeNetMatcher = exports.isLocalHost = exports.pattern2filter = exports.onFirstEvent = exports.onProcessExit = void 0;
 const path_1 = require("path");
 const assert_1 = __importDefault(require("assert"));
 __exportStar(require("./util-http"), exports);
@@ -55,19 +55,6 @@ function pattern2filter(pattern) {
     return (s) => !s || !pattern || matcher((0, path_1.basename)(s));
 }
 exports.pattern2filter = pattern2filter;
-// install multiple handlers and returns a handy 'uninstall' function which requires no parameter. Pass a map {event:handler}
-function onOff(em, events) {
-    events = { ...events }; // avoid later modifications, as we need this later for uninstallation
-    for (const [k, cb] of Object.entries(events))
-        for (const e of k.split(' '))
-            em.on(e, cb);
-    return () => {
-        for (const [k, cb] of Object.entries(events))
-            for (const e of k.split(' '))
-                em.off(e, cb);
-    };
-}
-exports.onOff = onOff;
 function isLocalHost(c) {
     const ip = typeof c === 'string' ? c : c.socket.remoteAddress; // don't use Context.ip as it is subject to proxied ips, and that's no use for localhost detection
     return ip && (0, cross_1.isIpLocalHost)(ip);
@@ -120,7 +107,7 @@ function asyncGeneratorToReadable(generator) {
         objectMode: true,
         destroy() {
             var _a;
-            (_a = iterator.return) === null || _a === void 0 ? void 0 : _a.call(iterator);
+            void ((_a = iterator.return) === null || _a === void 0 ? void 0 : _a.call(iterator));
         },
         read() {
             iterator.next().then(it => this.push(it.done ? null : it.value));

package/src/nat.js

@@ -22,9 +22,11 @@ exports.defaultBaseUrl = (0, valtio_1.proxy)({
     externalIp: '',
     localIp: '',
     port: 0,
-    get() {
+    async get() {
         const defPort = this.proto === 'https' ? 443 : 80;
-        return `${this.proto}://${this.publicIps[0] || this.externalIp || this.localIp}${!this.port || this.port === defPort ? '' : ':' + this.port}`;
+        const status = await (0, listen_1.getServerStatus)();
+        const port = this.port || (this.proto === 'https' ? status.https.port : status.http.port);
+        return `${this.proto}://${this.publicIps[0] || this.externalIp || this.localIp}${!port || port === defPort ? '' : ':' + port}`;
     }
 });
 exports.upnpClient = new nat_upnp_rejetto_1.Client({ timeout: 4000 });

package/src/perm.js

@@ -41,14 +41,13 @@ const createAdminConfig = (0, config_1.defineConfig)('create-admin', '');
 createAdminConfig.sub(v => {
     if (!v)
         return;
-    createAdmin(v);
     createAdminConfig.set('');
+    // we can't createAdmin right away, as its changes will be lost after return, when our caller (setConfig) applies undefined properties. setTimeout is good enough, as the process is sync.
+    setTimeout(() => createAdmin(v));
 });
 async function createAdmin(password, username = 'admin') {
-    const acc = await addAccount(username, { admin: true, password });
-    if (!acc)
-        return console.log("cannot create, already exists");
-    console.log("account admin created");
+    const acc = await addAccount(username, { admin: true, password }, true);
+    console.log(acc ? "account admin created" : "something went wrong");
 }
 exports.createAdmin = createAdmin;
 const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
@@ -59,6 +58,9 @@ async function updateAccount(account, change) {
         await (change === null || change === void 0 ? void 0 : change(account));
     else
         Object.assign(account, (0, misc_1.objSameKeys)(change, x => x || undefined));
+    for (const [k, v] of (0, misc_1.typedEntries)(account))
+        if (!v)
+            delete account[k]; // we consider all account fields, when falsy, as equivalent to be missing (so, default value applies)
     const { username, password } = account;
     if (password) {
         console.debug('hashing password for', username);
@@ -125,14 +127,18 @@ function renameAccount(from, to) {
     }
 }
 exports.renameAccount = renameAccount;
-async function addAccount(username, props) {
+async function addAccount(username, props, updateExisting = false) {
     username = normalizeUsername(username);
-    if (!username || getAccount(username, false))
+    if (!username)
         return;
-    const copy = (0, misc_1.setHidden)(lodash_1.default.pickBy(props, Boolean), { username }); // have the field in the object but hidden so that stringification won't include it
-    exports.accountsConfig.set(accounts => Object.assign(accounts, { [username]: copy }));
-    await updateAccount(copy, copy);
-    return copy;
+    let account = getAccount(username, false);
+    if (account && !updateExisting)
+        return;
+    account = (0, misc_1.setHidden)(account || {}, { username }); // hidden so that stringification won't include it
+    Object.assign(account, lodash_1.default.pickBy(props, Boolean));
+    exports.accountsConfig.set(accounts => Object.assign(accounts, { [username]: account }));
+    await updateAccount(account, account);
+    return account;
 }
 exports.addAccount = addAccount;
 function delAccount(username) {

package/src/roots.js

@@ -1,25 +1,31 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rootsMiddleware = exports.roots = void 0;
 const config_1 = require("./config");
 const misc_1 = require("./misc");
 const connections_1 = require("./connections");
-const lodash_1 = __importDefault(require("lodash"));
+const listen_1 = require("./listen");
 exports.roots = (0, config_1.defineConfig)(misc_1.CFG.roots, {}, map => {
-    if (lodash_1.default.isArray(map)) { // legacy pre 0.51.0-alpha5, remove in 0.52
-        exports.roots.set(Object.fromEntries(map.map(x => [x.host, x.root])));
-        return;
-    }
     const list = Object.keys(map);
     const matchers = list.map(hostMask => (0, misc_1.makeMatcher)(hostMask));
     const values = Object.values(map);
     return (host) => values[matchers.findIndex(m => m(host))];
 });
-const rootsMandatory = (0, config_1.defineConfig)(misc_1.CFG.roots_mandatory, false);
+const forceAddress = (0, config_1.defineConfig)(misc_1.CFG.force_address, false);
+forceAddress.sub((v, { version }) => {
+    if (version === null || version === void 0 ? void 0 : version.olderThan('0.53.0'))
+        forceAddress.set((0, config_1.getConfig)('force_base_url') || (0, config_1.getConfig)('roots_mandatory') || false);
+});
 const rootsMiddleware = (ctx, next) => (() => {
+    var _a;
+    const root = (_a = exports.roots.compiled()) === null || _a === void 0 ? void 0 : _a(ctx.host);
+    if (!ctx.state.skipFilters && forceAddress.get())
+        if (root === undefined && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled()) {
+            (0, connections_1.disconnect)(ctx, forceAddress.key());
+            return true; // true will avoid calling next
+        }
+    if (!root || root === '/')
+        return; // not transformation is required
     let params; // undefined if we are not going to work on api parameters
     if (ctx.path.startsWith(misc_1.SPECIAL_URI)) { // special uris should be excluded...
         if (!ctx.path.startsWith(misc_1.API_URI))
@@ -30,20 +36,6 @@ const rootsMiddleware = (ctx, next) => (() => {
             return; // exclude apis for admin-panel
         params = ctx.state.params || ctx.query; // for api we'll translate params
     }
-    if (lodash_1.default.isEmpty(exports.roots.get()))
-        return;
-    const host2root = exports.roots.compiled();
-    if (!host2root)
-        return;
-    const root = host2root(ctx.host);
-    if (root === '' || root === '/')
-        return;
-    if (root === undefined) {
-        if (ctx.state.skipFilters || !rootsMandatory.get() || (0, misc_1.isLocalHost)(ctx))
-            return;
-        (0, connections_1.disconnect)(ctx, 'bad-domain');
-        return true; // true will avoid calling next
-    }
     if (!params) {
         ctx.path = join(root, ctx.path);
         return;

package/src/serveGuiAndSharedFiles.js

@@ -86,19 +86,22 @@ const serveGuiAndSharedFiles = async (ctx, next) => {
     if (node.default && path.endsWith('/') && !get) // final/ needed on browser to make resource urls correctly with html pages
         node = (_a = await (0, vfs_1.urlToNode)(node.default, ctx, node)) !== null && _a !== void 0 ? _a : node;
     if (!await (0, vfs_1.nodeIsDirectory)(node))
-        return !node.source ? (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_METHOD_NOT_ALLOWED) // !dir && !source is not supported at this moment
-            : !(0, vfs_1.statusCodeForMissingPerm)(node, 'can_read', ctx) ? (0, serveFile_1.serveFileNode)(ctx, node) // all good
-                : ctx.status !== cross_const_1.HTTP_UNAUTHORIZED ? null // all errors don't need extra handling, except unauthorized
-                    : path.endsWith('/') ? (ctx.state.serveApp = true) && serveFrontendFiles(ctx, next) // since this is no dir, final / means we are dealing with default file, for which we still provide fancy login
-                        : (ctx.set('WWW-Authenticate', 'Basic'), (0, errorPages_1.sendErrorPage)(ctx)); // this is necessary to support standard urls with credentials
+        return node.url ? ctx.redirect(node.url)
+            : !node.source ? (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_METHOD_NOT_ALLOWED) // !dir && !source is not supported at this moment
+                : !(0, vfs_1.statusCodeForMissingPerm)(node, 'can_read', ctx) ? (0, serveFile_1.serveFileNode)(ctx, node) // all good
+                    : ctx.status !== cross_const_1.HTTP_UNAUTHORIZED ? null // all errors don't need extra handling, except unauthorized
+                        : path.endsWith('/') ? (ctx.state.serveApp = true) && serveFrontendFiles(ctx, next) // since this is no dir, final / means we are dealing with default file, for which we still provide fancy login
+                            : (ctx.set('WWW-Authenticate', 'Basic'), (0, errorPages_1.sendErrorPage)(ctx)); // this is necessary to support standard urls with credentials
     if (!path.endsWith('/'))
         return ctx.redirect(ctx.state.revProxyPath + ctx.originalUrl.replace(/(\?|$)/, '/$1')); // keep query-string, if any
     if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_list', ctx)) {
         if (ctx.status === cross_const_1.HTTP_FORBIDDEN)
             return (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_FORBIDDEN);
-        const browserDetected = ctx.get('Upgrade-Insecure-Requests') || ctx.get('Sec-Fetch-Mode'); // ugh, heuristics
-        if (!browserDetected) // we don't want to trigger basic authentication on browsers, it's meant for download managers only
-            return ctx.set('WWW-Authenticate', 'Basic'); // we support basic authentication
+        // detect if we are dealing with a download-manager, as it may need basic authentication, while we don't want it on browsers
+        const { authenticate } = ctx.query;
+        const downloadManagerDetected = /DAP|FDM|[Mm]anager/.test(ctx.get('user-agent'));
+        if (downloadManagerDetected || authenticate)
+            return ctx.set('WWW-Authenticate', authenticate || 'Basic'); // we support basic authentication
         ctx.state.serveApp = true;
         return serveFrontendFiles(ctx, next);
     }

package/src/serveGuiFiles.js

@@ -63,11 +63,8 @@ function serveStatic(uri) {
             return ctx.status = const_1.HTTP_METHOD_NOT_ALLOWED;
         const serveApp = shouldServeApp(ctx);
         const fullPath = (0, path_1.join)(__dirname, '..', DEV_STATIC, folder, serveApp ? '/index.html' : ctx.path);
-        const content = await (0, misc_1.getOrSet)(cache, ctx.path, async () => {
-            const data = await promises_1.default.readFile(fullPath).catch(() => null);
-            return serveApp || !data ? data
-                : adjustBundlerLinks(ctx, uri, data);
-        });
+        const content = await (0, misc_1.parseFile)(fullPath, raw => serveApp || !raw.length ? raw : adjustBundlerLinks(ctx, uri, raw))
+            .catch(() => null);
         if (content === null)
             return ctx.status = const_1.HTTP_NOT_FOUND;
         if (!serveApp)

package/src/throttler.js

@@ -18,21 +18,26 @@ const ip2group = {};
 const SymThrStr = Symbol('stream');
 const SymTimeout = Symbol('timeout');
 const maxKbpsPerIp = (0, config_1.defineConfig)('max_kbps_per_ip', Infinity);
+maxKbpsPerIp.sub(v => {
+    for (const [ip, { group }] of Object.entries(ip2group))
+        if (ip) // empty-string = unlimited group
+            group.updateLimit(v);
+});
 const throttler = async (ctx, next) => {
+    var _a;
     await next();
     let { body } = ctx;
+    const downloadTotal = ctx.response.length;
     if (typeof body === 'string' || body && body instanceof Buffer)
         ctx.body = body = stream_1.Readable.from(body);
     if (!body || !(body instanceof stream_1.Readable))
         return;
     // we wrap the stream also for unlimited connections to get speed and other features
-    const ipGroup = (0, misc_1.getOrSet)(ip2group, ctx.ip, () => {
-        var _a;
-        const doLimit = ((_a = ctx.state.account) === null || _a === void 0 ? void 0 : _a.ignore_limits) || (0, misc_1.isLocalHost)(ctx) ? undefined : true;
-        const group = new ThrottledStream_1.ThrottleGroup(Infinity, doLimit && mainThrottleGroup);
-        const unsub = doLimit && maxKbpsPerIp.sub(v => group.updateLimit(v));
-        return { group, count: 0, destroy: unsub };
-    });
+    const noLimit = ((_a = ctx.state.account) === null || _a === void 0 ? void 0 : _a.ignore_limits) || (0, misc_1.isLocalHost)(ctx);
+    const ipGroup = (0, misc_1.getOrSet)(ip2group, noLimit ? '' : ctx.ip, () => ({
+        count: 0,
+        group: new ThrottledStream_1.ThrottleGroup(noLimit ? Infinity : maxKbpsPerIp.get(), noLimit ? undefined : mainThrottleGroup),
+    }));
     const conn = (0, connections_1.getConnection)(ctx);
     if (!conn)
         throw 'assert throttler connection';
@@ -57,19 +62,16 @@ const throttler = async (ctx, next) => {
     });
     ++ipGroup.count;
     ts.on('close', () => {
-        var _a;
         update.flush();
         closed = true;
         if (--ipGroup.count)
             return; // any left?
-        (_a = ipGroup.destroy) === null || _a === void 0 ? void 0 : _a.call(ipGroup);
         delete ip2group[ctx.ip];
     });
-    const downloadTotal = ctx.response.length;
     ctx.state.originalStream = body;
     ctx.body = body.pipe(ts);
-    if (downloadTotal) // preserve this info
-        ctx.response.length = downloadTotal;
+    if (downloadTotal !== undefined) // undefined will break SSE
+        ctx.response.length = downloadTotal; // preserve this info
     ts.once('close', () => // in case of compressed response, we offer calculation of real size
      ctx.state.length = ts.getBytesSent() - offset);
 };

package/src/upload.js

@@ -36,8 +36,14 @@ const cache = {};
 function uploadWriter(base, path, ctx) {
     if ((0, misc_1.dirTraversal)(path))
         return fail(const_1.HTTP_FOOL);
-    if ((0, vfs_1.statusCodeForMissingPerm)(base, 'can_upload', ctx))
+    if ((0, vfs_1.statusCodeForMissingPerm)(base, 'can_upload', ctx)) {
+        if (!ctx.get('x-hfs-wait')) { // you can disable the following behavior
+            // avoid waiting hours for just an error
+            const t = setTimeout(() => (0, connections_1.disconnect)(ctx), 30000);
+            ctx.res.on('finish', () => clearTimeout(t));
+        }
         return fail();
+    }
     const fullPath = (0, path_1.join)(base.source, path);
     const dir = (0, path_1.dirname)(fullPath);
     const min = exports.minAvailableMb.get() * (1 << 20);