hfs 0.52.5 → 0.53.0-alpha2

package/src/ddns.js

@@ -12,42 +12,43 @@ const node_net_1 = require("node:net");
 const net_1 = require("net");
 const const_1 = require("./const");
 const events_1 = __importDefault(require("./events"));
-const stream_1 = require("stream");
 const nat_1 = require("./nat");
 // optionally you can append '>' and a regular expression to determine what body is considered successful
 const dynamicDnsUrl = (0, config_1.defineConfig)(cross_1.CFG.dynamic_dns_url, '');
 let stop;
-let last;
 dynamicDnsUrl.sub(v => {
     stop === null || stop === void 0 ? void 0 : stop();
     if (!v)
         return;
     let lastIps;
-    const [templateUrl, re] = (0, cross_1.splitAt)('>', v);
     stop = (0, cross_1.repeat)(cross_1.HOUR, async () => {
         const ips = await (0, nat_1.getPublicIps)();
         if (lodash_1.default.isEqual(lastIps, ips))
             return;
         lastIps = ips;
-        const url = (0, cross_1.replace)(templateUrl, {
-            IPX: ips[0] || '',
-            IP4: lodash_1.default.find(ips, node_net_1.isIPv4) || '',
-            IP6: lodash_1.default.find(ips, net_1.isIPv6) || '',
-        }, '$');
-        const error = await (0, util_http_1.httpWithBody)(url, { httpThrow: false, headers: { 'User-Agent': "HFS/" + const_1.VERSION } }) // UA specified as requested by no-ip guidelines
-            .then(async (res) => {
-            const str = String(res.body).trim();
-            return (re ? str.match(re) : res.ok) ? '' : (str || res.statusMessage);
-        }, (err) => err.code || err.message || String(err));
-        last = { ts: new Date().toJSON(), error, url };
-        events_1.default.emit('dynamicDnsError', last);
-        console.log('dynamic dns update', error || 'ok');
+        const all = await Promise.all(v.split('\n').map(async (line) => {
+            const [templateUrl, re] = (0, cross_1.splitAt)('>', line);
+            const url = (0, cross_1.replace)(templateUrl, {
+                IPX: ips[0] || '',
+                IP4: lodash_1.default.find(ips, node_net_1.isIPv4) || '',
+                IP6: lodash_1.default.find(ips, net_1.isIPv6) || '',
+            }, '$');
+            const error = await (0, util_http_1.httpWithBody)(url, { httpThrow: false, headers: { 'User-Agent': "HFS/" + const_1.VERSION } }) // UA specified as requested by no-ip guidelines
+                .then(async (res) => {
+                const str = String(res.body).trim();
+                return (re ? str.match(re) : res.ok) ? '' : (str || res.statusMessage);
+            }, (err) => err.code || err.message || String(err));
+            return { ts: new Date().toJSON(), error, url };
+        }));
+        const best = lodash_1.default.find(all, 'error') || all[0]; // the system is designed for just one result, and we give precedence to errors
+        events_1.default.emit('dynamicDnsError', best);
+        console.log('dynamic dns update', (best === null || best === void 0 ? void 0 : best.error) || 'ok');
     });
 });
 async function* get_dynamic_dns_error() {
     while (1) {
-        yield last;
-        await (0, stream_1.once)(events_1.default, 'dynamicDnsError');
+        const res = await events_1.default.once('dynamicDnsError');
+        yield res[0];
     }
 }
 exports.get_dynamic_dns_error = get_dynamic_dns_error;

package/src/events.js

@@ -1,9 +1,60 @@
 "use strict";
 // This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const events_1 = __importDefault(require("events"));
+exports.BetterEventEmitter = void 0;
+class BetterEventEmitter {
+    constructor() {
+        this.listeners = new Map();
+    }
+    on(event, listener, { warnAfter = 10 } = {}) {
+        if (typeof event === 'string')
+            event = [event];
+        for (const e of event) {
+            let cbs = this.listeners.get(e);
+            if (!cbs)
+                this.listeners.set(e, cbs = new Set());
+            cbs.add(listener);
+            if (cbs.size > warnAfter)
+                console.warn("Warning: many events listeners for ", e);
+        }
+        return () => {
+            var _a;
+            for (const e of event)
+                (_a = this.listeners.get(e)) === null || _a === void 0 ? void 0 : _a.delete(listener);
+        };
+    }
+    once(event, listener) {
+        return new Promise(resolve => {
+            const off = this.on(event, function (...args) {
+                off();
+                resolve(args);
+                return listener === null || listener === void 0 ? void 0 : listener(...arguments);
+            });
+        });
+    }
+    multi(map) {
+        const cbs = Object.entries(map).map(([name, cb]) => this.on(name.split(' '), cb));
+        return () => {
+            for (const cb of cbs)
+                cb();
+        };
+    }
+    emit(event, ...args) {
+        let cbs = this.listeners.get(event);
+        if (!(cbs === null || cbs === void 0 ? void 0 : cbs.size))
+            return;
+        const ret = [];
+        for (const cb of cbs) {
+            const res = cb(...args);
+            if (res !== undefined)
+                ret.push(res);
+        }
+        return ret;
+    }
+    emitAsync(event, ...args) {
+        return Promise.all(this.emit(event, ...args) || []);
+    }
+}
+exports.BetterEventEmitter = BetterEventEmitter;
 // app-wide events
-exports.default = new events_1.default().setMaxListeners(100);
+exports.default = new BetterEventEmitter;

package/src/geo.js

@@ -45,7 +45,7 @@ async function checkFiles() {
     const TEMP = LOCAL_FILE + '.downloading';
     const { mtime = 0 } = await (0, promises_1.stat)(LOCAL_FILE).catch(() => ({ mtime: 0 }));
     const now = Date.now();
-    if (mtime < now - 31 * misc_1.DAY) { // month-old or non-existing
+    if (+mtime < now - 31 * misc_1.DAY) { // month-old or non-existing
         console.log('downloading geo-ip db');
         await (0, misc_1.unzip)(await (0, misc_1.httpStream)(URL), path => path.toUpperCase().endsWith(ZIP_FILE) && TEMP);
         if (await (0, promises_1.stat)(TEMP))

package/src/github.js

@@ -21,7 +21,7 @@ function downloadProgress(id, status) {
         delete downloading[id];
     else
         downloading[id] = status;
-    events_1.default.emit('pluginDownload_' + id, status);
+    events_1.default.emit('pluginDownload', { id, status });
 }
 // determine default branch, possibly without consuming api quota
 async function getGithubDefaultBranch(repo) {
@@ -161,13 +161,29 @@ async function apiGithub(uri) {
             : e;
     });
 }
-async function searchPlugins(text = '') {
+async function* apiGithubPaginated(uri) {
+    const PAGE_SIZE = 100;
+    let page = 1;
+    let n = 0;
+    while (1) {
+        const res = await apiGithub(uri + `&page=${page++}&per_page=${PAGE_SIZE}`);
+        for (const x of res.items)
+            yield x;
+        const now = res.items.length;
+        n += now;
+        if (!now || n >= res.total_count)
+            break;
+    }
+}
+async function searchPlugins(text = '', { skipRepos = [''] } = {}) {
     const projectInfo = await (0, exports.getProjectInfo)();
-    const list = await apiGithub('search/repositories?q=topic:hfs-plugin+' + encodeURI(text));
-    return new misc_1.AsapStream(list.items.map(async (it) => {
+    const list = await Promise.all(['', 'user:'].map(specifier => // search text with multiple specifiers
+     (0, misc_1.asyncGeneratorToArray)(apiGithubPaginated(`search/repositories?q=topic:hfs-plugin+${specifier}${encodeURI(text)}`))))
+        .then(all => all.flat()); // make it a single array
+    return new misc_1.AsapStream(list.map(async (it) => {
         var _a, _b;
         const repo = it.full_name;
-        if ((_a = projectInfo === null || projectInfo === void 0 ? void 0 : projectInfo.plugins_blacklist) === null || _a === void 0 ? void 0 : _a.includes(repo))
+        if (((_a = projectInfo === null || projectInfo === void 0 ? void 0 : projectInfo.plugins_blacklist) === null || _a === void 0 ? void 0 : _a.includes(repo)) || skipRepos.includes(repo))
             return;
         const pl = await readOnlineCompatiblePlugin(repo, it.default_branch).catch(() => undefined);
         if (!pl)

package/src/index.js

@@ -45,9 +45,9 @@ exports.app.use(middlewares_1.sessionMiddleware)
     .use(middlewares_1.gzipper)
     .use(middlewares_1.paramsDecoder) // must be done before plugins, so they can manipulate params
     .use(middlewares_1.headRequests)
+    .use(roots_1.rootsMiddleware)
     .use(log_1.logMw)
     .use(throttler_1.throttler)
-    .use(roots_1.rootsMiddleware)
     .use(plugins_1.pluginsMiddleware)
     .use((0, koa_mount_1.default)(const_1.API_URI, (0, apiMiddleware_1.apiMiddleware)({ ...frontEndApis_1.frontEndApis, ...adminApis_1.adminApis })))
     .use(serveGuiAndSharedFiles_1.serveGuiAndSharedFiles)

package/src/langs/hfs-lang-it.json

@@ -1,7 +1,7 @@
 {
     "author": "Massimo Melina",
-    "version": 1.9,
-    "hfs_version": "0.52.0",
+    "version": 2.53,
+    "hfs_version": "0.53.0",
     "translate": {
         "Select": "Seleziona",
         "n_files": "{n} file",
@@ -145,6 +145,10 @@
         "upload_skipped": "{n,plural, one{# saltato} other{# saltati}}",
         "Overwrite policy": "Per i file esistenti",
         "Rename to avoid overwriting": "Rinomina per non sovrascrivere",
-        "Overwrite existing files": "Sovrascrivi i file esistenti"
+        "Overwrite existing files": "Sovrascrivi i file esistenti",
+        "Menu": "Menu",
+        "clipboard": "Appunti ({content})",
+        "to_clipboard_source_tooltip": "Vai alla cartella d'origine dei file negli appunti",
+        "more_items": "{rest,plural,one{Un altro elemento} other{# altri elementi}}"
     }
 }

package/src/listen.js

@@ -280,7 +280,7 @@ exports.getServerStatus = getServerStatus;
 const ignore = /^(lo|.*loopback.*|virtualbox.*|.*\(wsl\).*|llw\d|awdl\d|utun\d|anpi\d)$/i; // avoid giving too much information
 const isLinkLocal = (0, misc_1.makeNetMatcher)('169.254.0.0/16|FE80::/16');
 async function getIps(external = true) {
-    const ips = (0, misc_1.onlyTruthy)(Object.entries((0, os_1.networkInterfaces)()).map(([name, nets]) => nets && !ignore.test(name) && nets.map(net => !net.internal && net.address)).flat());
+    const ips = (0, misc_1.onlyTruthy)(Object.entries((0, os_1.networkInterfaces)()).flatMap(([name, nets]) => nets && !ignore.test(name) && nets.map(net => !net.internal && net.address)));
     const e = external && nat_1.defaultBaseUrl.externalIp;
     if (e && !ips.includes(e))
         ips.unshift(e);

package/src/log.js

@@ -85,6 +85,7 @@ errorLogFile.sub(path => {
 const logRotation = (0, config_1.defineConfig)(misc_1.CFG.log_rotation, 'weekly');
 const dontLogNet = (0, config_1.defineConfig)(misc_1.CFG.dont_log_net, '127.0.0.1|::1', v => (0, misc_1.makeNetMatcher)(v));
 const logUA = (0, config_1.defineConfig)(misc_1.CFG.log_ua, false);
+const logSpam = (0, config_1.defineConfig)(misc_1.CFG.log_spam, false);
 const debounce = lodash_1.default.debounce(cb => cb(), 1000);
 const logMw = async (ctx, next) => {
     const now = new Date();
@@ -92,6 +93,9 @@ const logMw = async (ctx, next) => {
     ctx.state.completed = Promise.race([(0, stream_1.once)(ctx.res, 'finish'), (0, stream_1.once)(ctx.res, 'close')]);
     await next();
     console.debug(ctx.status, ctx.method, ctx.originalUrl);
+    if (ctx.status === misc_1.HTTP_NOT_FOUND && !logSpam.get()
+        && /wlwmanifest.xml$|robots.txt$|\.(php)$|cgi/.test(ctx.path))
+        return;
     const conn = (0, connections_1.getConnection)(ctx); // collect reference before close
     // don't await, as we don't want to hold the middlewares chain
     ctx.state.completed.then(() => {

package/src/middlewares.js

@@ -22,7 +22,6 @@ const index_1 = require("./index");
 const events_1 = __importDefault(require("./events"));
 const forceHttps = (0, config_1.defineConfig)('force_https', true);
 const ignoreProxies = (0, config_1.defineConfig)('ignore_proxies', false);
-const forceBaseUrl = (0, config_1.defineConfig)('force_base_url', false);
 exports.sessionDuration = (0, config_1.defineConfig)('session_duration', Number(process.env.SESSION_DURATION) || misc_1.DAY / 1000, v => v * 1000);
 exports.gzipper = (0, koa_compress_1.default)({
     threshold: 2048,
@@ -75,8 +74,6 @@ const someSecurity = async (ctx, next) => {
     catch (_a) {
         return ctx.status = const_1.HTTP_FOOL;
     }
-    if (!ctx.state.skipFilters && forceBaseUrl.get() && listen_1.baseUrl.compiled() && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled())
-        return (0, connections_1.disconnect)(ctx, 'force-domain');
     if (!ctx.secure && forceHttps.get() && (0, listen_1.getHttpsWorkingPort)() && !(0, misc_1.isLocalHost)(ctx)) {
         const { URL } = ctx;
         URL.protocol = 'https';
@@ -98,7 +95,7 @@ exports.getProxyDetected = getProxyDetected;
 const prepareState = async (ctx, next) => {
     var _a, _b;
     if ((_a = ctx.session) === null || _a === void 0 ? void 0 : _a.username) {
-        if (auth_1.invalidSessions.delete(ctx.session.username))
+        if (ctx.session.ts < auth_1.invalidateSessionBefore.get(ctx.session.username))
             delete ctx.session.username;
         ctx.session.maxAge = exports.sessionDuration.compiled();
     }
@@ -123,11 +120,17 @@ const prepareState = async (ctx, next) => {
         return doLogin((credentials === null || credentials === void 0 ? void 0 : credentials.name) || '', (credentials === null || credentials === void 0 ? void 0 : credentials.pass) || '');
     }
     async function doLogin(u, p) {
+        var _a;
+        if (!u || u === ((_a = ctx.session) === null || _a === void 0 ? void 0 : _a.username))
+            return; // providing credentials, but not needed
+        await events_1.default.emitAsync('attemptingLogin', ctx);
         const a = await (0, auth_1.srpCheck)(u, p);
         if (a) {
-            (0, auth_1.setLoggedIn)(ctx, a.username);
+            await (0, auth_1.setLoggedIn)(ctx, a.username);
             ctx.headers['x-username'] = a.username; // give an easier way to determine if the login was successful
         }
+        else if (u)
+            events_1.default.emit('failedLogin', ctx, { username: u });
         return a;
     }
 };

package/src/misc.js

@@ -18,7 +18,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiAssertTypes = exports.AsapStream = exports.asyncGeneratorToReadable = exports.same = exports.makeNetMatcher = exports.isLocalHost = exports.onOff = exports.pattern2filter = exports.onFirstEvent = exports.onProcessExit = void 0;
+exports.apiAssertTypes = exports.AsapStream = exports.asyncGeneratorToReadable = exports.same = exports.makeNetMatcher = exports.isLocalHost = exports.pattern2filter = exports.onFirstEvent = exports.onProcessExit = void 0;
 const path_1 = require("path");
 const assert_1 = __importDefault(require("assert"));
 __exportStar(require("./util-http"), exports);
@@ -55,19 +55,6 @@ function pattern2filter(pattern) {
     return (s) => !s || !pattern || matcher((0, path_1.basename)(s));
 }
 exports.pattern2filter = pattern2filter;
-// install multiple handlers and returns a handy 'uninstall' function which requires no parameter. Pass a map {event:handler}
-function onOff(em, events) {
-    events = { ...events }; // avoid later modifications, as we need this later for uninstallation
-    for (const [k, cb] of Object.entries(events))
-        for (const e of k.split(' '))
-            em.on(e, cb);
-    return () => {
-        for (const [k, cb] of Object.entries(events))
-            for (const e of k.split(' '))
-                em.off(e, cb);
-    };
-}
-exports.onOff = onOff;
 function isLocalHost(c) {
     const ip = typeof c === 'string' ? c : c.socket.remoteAddress; // don't use Context.ip as it is subject to proxied ips, and that's no use for localhost detection
     return ip && (0, cross_1.isIpLocalHost)(ip);
@@ -120,7 +107,7 @@ function asyncGeneratorToReadable(generator) {
         objectMode: true,
         destroy() {
             var _a;
-            (_a = iterator.return) === null || _a === void 0 ? void 0 : _a.call(iterator);
+            void ((_a = iterator.return) === null || _a === void 0 ? void 0 : _a.call(iterator));
         },
         read() {
             iterator.next().then(it => this.push(it.done ? null : it.value));

package/src/perm.js

@@ -46,10 +46,8 @@ createAdminConfig.sub(v => {
     setTimeout(() => createAdmin(v));
 });
 async function createAdmin(password, username = 'admin') {
-    const acc = await addAccount(username, { admin: true, password });
-    if (!acc)
-        return console.log("cannot create, already exists");
-    console.log("account admin created");
+    const acc = await addAccount(username, { admin: true, password }, true);
+    console.log(acc ? "account admin created" : "something went wrong");
 }
 exports.createAdmin = createAdmin;
 const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
@@ -60,6 +58,9 @@ async function updateAccount(account, change) {
         await (change === null || change === void 0 ? void 0 : change(account));
     else
         Object.assign(account, (0, misc_1.objSameKeys)(change, x => x || undefined));
+    for (const [k, v] of (0, misc_1.typedEntries)(account))
+        if (!v)
+            delete account[k]; // we consider all account fields, when falsy, as equivalent to be missing (so, default value applies)
     const { username, password } = account;
     if (password) {
         console.debug('hashing password for', username);
@@ -126,14 +127,18 @@ function renameAccount(from, to) {
     }
 }
 exports.renameAccount = renameAccount;
-async function addAccount(username, props) {
+async function addAccount(username, props, updateExisting = false) {
     username = normalizeUsername(username);
-    if (!username || getAccount(username, false))
+    if (!username)
         return;
-    const copy = (0, misc_1.setHidden)(lodash_1.default.pickBy(props, Boolean), { username }); // have the field in the object but hidden so that stringification won't include it
-    exports.accountsConfig.set(accounts => Object.assign(accounts, { [username]: copy }));
-    await updateAccount(copy, copy);
-    return copy;
+    let account = getAccount(username, false);
+    if (account && !updateExisting)
+        return;
+    account = (0, misc_1.setHidden)(account || {}, { username }); // hidden so that stringification won't include it
+    Object.assign(account, lodash_1.default.pickBy(props, Boolean));
+    exports.accountsConfig.set(accounts => Object.assign(accounts, { [username]: account }));
+    await updateAccount(account, account);
+    return account;
 }
 exports.addAccount = addAccount;
 function delAccount(username) {

package/src/plugins.js

@@ -27,7 +27,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getMissingDependencies = exports.parsePluginSource = exports.rescan = exports.pluginsConfig = exports.enablePlugins = exports.pluginsWatcher = exports.getAvailablePlugins = exports.mapPlugins = exports.Plugin = exports.pluginsMiddleware = exports.getPluginConfigFields = exports.findPluginByRepo = exports.getPluginInfo = exports.setPluginConfig = exports.startPlugin = exports.stopPlugin = exports.enablePlugin = exports.isPluginEnabled = exports.isPluginRunning = exports.STORAGE_FOLDER = exports.DISABLING_SUFFIX = exports.PATH = void 0;
+exports.getMissingDependencies = exports.parsePluginSource = exports.rescan = exports.pluginsConfig = exports.enablePlugins = exports.pluginsWatcher = exports.getAvailablePlugins = exports.mapPlugins = exports.SERVER_CODE_ID = exports.Plugin = exports.pluginsMiddleware = exports.getPluginConfigFields = exports.findPluginByRepo = exports.getPluginInfo = exports.setPluginConfig = exports.startPlugin = exports.stopPlugin = exports.enablePlugin = exports.isPluginEnabled = exports.isPluginRunning = exports.STORAGE_FOLDER = exports.DISABLING_SUFFIX = exports.PATH = void 0;
 const fast_glob_1 = __importDefault(require("fast-glob"));
 const watchLoad_1 = require("./watchLoad");
 const lodash_1 = __importDefault(require("lodash"));
@@ -232,7 +232,7 @@ class Plugin {
         const { id } = this;
         try {
             await ((_b = (_a = this.data) === null || _a === void 0 ? void 0 : _a.unload) === null || _b === void 0 ? void 0 : _b.call(_a));
-            if (!reloading && id !== SERVER_CODE_ID) // we already printed 'reloading'
+            if (!reloading && id !== exports.SERVER_CODE_ID) // we already printed 'reloading'
                 console.log('unloaded plugin', id);
         }
         catch (e) {
@@ -244,12 +244,12 @@ class Plugin {
     }
 }
 exports.Plugin = Plugin;
-const SERVER_CODE_ID = '.';
+exports.SERVER_CODE_ID = '.'; // a name that will surely be not found among plugin folders
 const serverCode = (0, config_1.defineConfig)('server_code', '', async (script, { k }) => {
     const res = {};
     try {
         new Function('exports', script)(res); // parse
-        return new Plugin(SERVER_CODE_ID, '', await initPlugin(res), lodash_1.default.noop); // '.' is a name that will surely be not found among plugin folders
+        return new Plugin(exports.SERVER_CODE_ID, '', await initPlugin(res), lodash_1.default.noop);
     }
     catch (e) {
         return console.error(k + ':', e.message || String(e));
@@ -260,7 +260,7 @@ serverCode.sub(() => { var _a; return (_a = serverCode.compiled()) === null || _
 function mapPlugins(cb, includeServerCode = true) {
     const entries = Object.entries(plugins);
     return entries.map(([plName, pl]) => {
-        if (!includeServerCode && plName === SERVER_CODE_ID)
+        if (!includeServerCode && plName === exports.SERVER_CODE_ID)
             return;
         try {
             return cb(pl, plName);

package/src/roots.js

@@ -1,25 +1,31 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rootsMiddleware = exports.roots = void 0;
 const config_1 = require("./config");
 const misc_1 = require("./misc");
 const connections_1 = require("./connections");
-const lodash_1 = __importDefault(require("lodash"));
+const listen_1 = require("./listen");
 exports.roots = (0, config_1.defineConfig)(misc_1.CFG.roots, {}, map => {
-    if (lodash_1.default.isArray(map)) { // legacy pre 0.51.0-alpha5, remove in 0.52
-        exports.roots.set(Object.fromEntries(map.map(x => [x.host, x.root])));
-        return;
-    }
     const list = Object.keys(map);
     const matchers = list.map(hostMask => (0, misc_1.makeMatcher)(hostMask));
     const values = Object.values(map);
     return (host) => values[matchers.findIndex(m => m(host))];
 });
-const rootsMandatory = (0, config_1.defineConfig)(misc_1.CFG.roots_mandatory, false);
+const forceAddress = (0, config_1.defineConfig)(misc_1.CFG.force_address, false);
+forceAddress.sub((v, { version }) => {
+    if (version === null || version === void 0 ? void 0 : version.olderThan('0.53.0'))
+        forceAddress.set((0, config_1.getConfig)('force_base_url') || (0, config_1.getConfig)('roots_mandatory') || false);
+});
 const rootsMiddleware = (ctx, next) => (() => {
+    var _a;
+    const root = (_a = exports.roots.compiled()) === null || _a === void 0 ? void 0 : _a(ctx.host);
+    if (!ctx.state.skipFilters && forceAddress.get())
+        if (root === undefined && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled()) {
+            (0, connections_1.disconnect)(ctx, forceAddress.key());
+            return true; // true will avoid calling next
+        }
+    if (!root || root === '/')
+        return; // not transformation is required
     let params; // undefined if we are not going to work on api parameters
     if (ctx.path.startsWith(misc_1.SPECIAL_URI)) { // special uris should be excluded...
         if (!ctx.path.startsWith(misc_1.API_URI))
@@ -30,20 +36,6 @@ const rootsMiddleware = (ctx, next) => (() => {
             return; // exclude apis for admin-panel
         params = ctx.state.params || ctx.query; // for api we'll translate params
     }
-    if (lodash_1.default.isEmpty(exports.roots.get()))
-        return;
-    const host2root = exports.roots.compiled();
-    if (!host2root)
-        return;
-    const root = host2root(ctx.host);
-    if (root === '' || root === '/')
-        return;
-    if (root === undefined) {
-        if (ctx.state.skipFilters || !rootsMandatory.get() || (0, misc_1.isLocalHost)(ctx))
-            return;
-        (0, connections_1.disconnect)(ctx, 'bad-domain');
-        return true; // true will avoid calling next
-    }
     if (!params) {
         ctx.path = join(root, ctx.path);
         return;

package/src/serveGuiAndSharedFiles.js

@@ -86,19 +86,22 @@ const serveGuiAndSharedFiles = async (ctx, next) => {
     if (node.default && path.endsWith('/') && !get) // final/ needed on browser to make resource urls correctly with html pages
         node = (_a = await (0, vfs_1.urlToNode)(node.default, ctx, node)) !== null && _a !== void 0 ? _a : node;
     if (!await (0, vfs_1.nodeIsDirectory)(node))
-        return !node.source ? (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_METHOD_NOT_ALLOWED) // !dir && !source is not supported at this moment
-            : !(0, vfs_1.statusCodeForMissingPerm)(node, 'can_read', ctx) ? (0, serveFile_1.serveFileNode)(ctx, node) // all good
-                : ctx.status !== cross_const_1.HTTP_UNAUTHORIZED ? null // all errors don't need extra handling, except unauthorized
-                    : path.endsWith('/') ? (ctx.state.serveApp = true) && serveFrontendFiles(ctx, next) // since this is no dir, final / means we are dealing with default file, for which we still provide fancy login
-                        : (ctx.set('WWW-Authenticate', 'Basic'), (0, errorPages_1.sendErrorPage)(ctx)); // this is necessary to support standard urls with credentials
+        return node.url ? ctx.redirect(node.url)
+            : !node.source ? (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_METHOD_NOT_ALLOWED) // !dir && !source is not supported at this moment
+                : !(0, vfs_1.statusCodeForMissingPerm)(node, 'can_read', ctx) ? (0, serveFile_1.serveFileNode)(ctx, node) // all good
+                    : ctx.status !== cross_const_1.HTTP_UNAUTHORIZED ? null // all errors don't need extra handling, except unauthorized
+                        : path.endsWith('/') ? (ctx.state.serveApp = true) && serveFrontendFiles(ctx, next) // since this is no dir, final / means we are dealing with default file, for which we still provide fancy login
+                            : (ctx.set('WWW-Authenticate', 'Basic'), (0, errorPages_1.sendErrorPage)(ctx)); // this is necessary to support standard urls with credentials
     if (!path.endsWith('/'))
         return ctx.redirect(ctx.state.revProxyPath + ctx.originalUrl.replace(/(\?|$)/, '/$1')); // keep query-string, if any
     if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_list', ctx)) {
         if (ctx.status === cross_const_1.HTTP_FORBIDDEN)
             return (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_FORBIDDEN);
-        const browserDetected = ctx.get('Upgrade-Insecure-Requests') || ctx.get('Sec-Fetch-Mode'); // ugh, heuristics
-        if (!browserDetected) // we don't want to trigger basic authentication on browsers, it's meant for download managers only
-            return ctx.set('WWW-Authenticate', 'Basic'); // we support basic authentication
+        // detect if we are dealing with a download-manager, as it may need basic authentication, while we don't want it on browsers
+        const { authenticate } = ctx.query;
+        const downloadManagerDetected = /DAP|FDM|[Mm]anager/.test(ctx.get('user-agent'));
+        if (downloadManagerDetected || authenticate)
+            return ctx.set('WWW-Authenticate', authenticate || 'Basic'); // we support basic authentication
         ctx.state.serveApp = true;
         return serveFrontendFiles(ctx, next);
     }

package/src/serveGuiFiles.js

@@ -63,11 +63,8 @@ function serveStatic(uri) {
             return ctx.status = const_1.HTTP_METHOD_NOT_ALLOWED;
         const serveApp = shouldServeApp(ctx);
         const fullPath = (0, path_1.join)(__dirname, '..', DEV_STATIC, folder, serveApp ? '/index.html' : ctx.path);
-        const content = await (0, misc_1.getOrSet)(cache, ctx.path, async () => {
-            const data = await promises_1.default.readFile(fullPath).catch(() => null);
-            return serveApp || !data ? data
-                : adjustBundlerLinks(ctx, uri, data);
-        });
+        const content = await (0, misc_1.parseFile)(fullPath, raw => serveApp || !raw.length ? raw : adjustBundlerLinks(ctx, uri, raw))
+            .catch(() => null);
         if (content === null)
             return ctx.status = const_1.HTTP_NOT_FOUND;
         if (!serveApp)
@@ -94,7 +91,7 @@ async function treatIndex(ctx, filesUri, body) {
     ctx.set('etag', '');
     ctx.set('Cache-Control', 'no-store, no-cache, must-revalidate');
     ctx.type = 'html';
-    const isFrontend = filesUri === const_1.FRONTEND_URI;
+    const isFrontend = filesUri === const_1.FRONTEND_URI ? ' ' : ''; // as a string will allow neater code later
     const pub = ctx.state.revProxyPath + const_1.PLUGINS_PUB_URI;
     // expose plugins' configs that are declared with 'frontend' attribute
     const plugins = Object.fromEntries((0, misc_1.onlyTruthy)((0, plugins_1.mapPlugins)((pl, name) => {
@@ -117,7 +114,7 @@ async function treatIndex(ctx, filesUri, body) {
         const isOpen = !isClose;
         if (isHead && isOpen)
             return all + `
-                    ${!isFrontend ? '' : `
+                    ${isFrontend && `
                         <title>${adminApis_1.title.get()}</title>
                         <link rel="shortcut icon" href="/favicon.ico?${timestamp}" />
                     ` + (0, customHtml_1.getSection)('htmlHead')}
@@ -128,6 +125,7 @@ async function treatIndex(ctx, filesUri, body) {
                 SPECIAL_URI: const_1.SPECIAL_URI, PLUGINS_PUB_URI: const_1.PLUGINS_PUB_URI, FRONTEND_URI: const_1.FRONTEND_URI,
                 session: session instanceof apiMiddleware_1.ApiError ? null : session,
                 plugins,
+                loadScripts: Object.fromEntries((0, plugins_1.mapPlugins)((p, id) => { var _a; return [id, (_a = p.frontend_js) === null || _a === void 0 ? void 0 : _a.map(f => f.includes('//') ? f : pub + id + '/' + f)]; })),
                 prefixUrl: ctx.state.revProxyPath,
                 dontOverwriteUploading: upload_1.dontOverwriteUploading.get(),
                 customHtml: lodash_1.default.omit(Object.fromEntries(customHtml_1.customHtmlState.sections), ['top', 'bottom']),
@@ -139,20 +137,16 @@ async function treatIndex(ctx, filesUri, body) {
                 `;
         if (isBody && isOpen)
             return all + `
-                    ${!isFrontend ? '' : (0, customHtml_1.getSection)('top')}
+                    ${isFrontend && (0, customHtml_1.getSection)('top')}
                     <style>
                     :root {
-                        ${lodash_1.default.map(plugins, (configs, pluginName) => lodash_1.default.map(configs, (v, k) => `--${pluginName}-${k}: ${serializeCss(v)};`).join('\n')).join('')}
+                        ${lodash_1.default.map(plugins, (configs, pluginName) => // make plugin configs accessible via css
+             lodash_1.default.map(configs, (v, k) => `--${pluginName}-${k}: ${serializeCss(v)};`).join('\n')).join('')}
                     }
                     </style>
-                    ${!isFrontend ? '' : (0, plugins_1.mapPlugins)((plug, id) => {
+                    ${isFrontend && (0, plugins_1.mapPlugins)((plug, id) => {
                 var _a;
                 return (_a = plug.frontend_css) === null || _a === void 0 ? void 0 : _a.map(f => `<link rel='stylesheet' type='text/css' href='${f.includes('//') ? f : pub + id + '/' + f}' plugin=${JSON.stringify(id)}/>`);
-            })
-                .flat().filter(Boolean).join('\n')}
-                    ${!isFrontend ? '' : (0, plugins_1.mapPlugins)((plug, id) => {
-                var _a;
-                return (_a = plug.frontend_js) === null || _a === void 0 ? void 0 : _a.map(f => `<script defer plugin=${JSON.stringify(id)} src='${f.includes('//') ? f : pub + id + '/' + f}'></script>`);
             })
                 .flat().filter(Boolean).join('\n')}
                 `;

package/src/throttler.js

@@ -18,7 +18,13 @@ const ip2group = {};
 const SymThrStr = Symbol('stream');
 const SymTimeout = Symbol('timeout');
 const maxKbpsPerIp = (0, config_1.defineConfig)('max_kbps_per_ip', Infinity);
+maxKbpsPerIp.sub(v => {
+    for (const [ip, { group }] of Object.entries(ip2group))
+        if (ip) // empty-string = unlimited group
+            group.updateLimit(v);
+});
 const throttler = async (ctx, next) => {
+    var _a;
     await next();
     let { body } = ctx;
     const downloadTotal = ctx.response.length;
@@ -27,13 +33,11 @@ const throttler = async (ctx, next) => {
     if (!body || !(body instanceof stream_1.Readable))
         return;
     // we wrap the stream also for unlimited connections to get speed and other features
-    const ipGroup = (0, misc_1.getOrSet)(ip2group, ctx.ip, () => {
-        var _a;
-        const doLimit = ((_a = ctx.state.account) === null || _a === void 0 ? void 0 : _a.ignore_limits) || (0, misc_1.isLocalHost)(ctx) ? undefined : true;
-        const group = new ThrottledStream_1.ThrottleGroup(Infinity, doLimit && mainThrottleGroup);
-        const unsub = doLimit && maxKbpsPerIp.sub(v => group.updateLimit(v));
-        return { group, count: 0, destroy: unsub };
-    });
+    const noLimit = ((_a = ctx.state.account) === null || _a === void 0 ? void 0 : _a.ignore_limits) || (0, misc_1.isLocalHost)(ctx);
+    const ipGroup = (0, misc_1.getOrSet)(ip2group, noLimit ? '' : ctx.ip, () => ({
+        count: 0,
+        group: new ThrottledStream_1.ThrottleGroup(noLimit ? Infinity : maxKbpsPerIp.get(), noLimit ? undefined : mainThrottleGroup),
+    }));
     const conn = (0, connections_1.getConnection)(ctx);
     if (!conn)
         throw 'assert throttler connection';
@@ -58,12 +62,10 @@ const throttler = async (ctx, next) => {
     });
     ++ipGroup.count;
     ts.on('close', () => {
-        var _a;
         update.flush();
         closed = true;
         if (--ipGroup.count)
             return; // any left?
-        (_a = ipGroup.destroy) === null || _a === void 0 ? void 0 : _a.call(ipGroup);
         delete ip2group[ctx.ip];
     });
     ctx.state.originalStream = body;