hfs 0.53.0 → 0.54.0-alpha3

package/src/middlewares.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.getProxyDetected = exports.someSecurity = exports.headRequests = exports.gzipper = exports.sessionDuration = void 0;
+exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.getProxyDetected = exports.someSecurity = exports.cloudflareDetected = exports.headRequests = exports.gzipper = exports.sessionDuration = void 0;
 const koa_compress_1 = __importDefault(require("koa-compress"));
 const const_1 = require("./const");
 const misc_1 = require("./misc");
@@ -19,8 +19,10 @@ const config_1 = require("./config");
 const koa_session_1 = __importDefault(require("koa-session"));
 const index_1 = require("./index");
 const events_1 = __importDefault(require("./events"));
+const allowSessionIpChange = (0, config_1.defineConfig)('allow_session_ip_change', false);
 const forceHttps = (0, config_1.defineConfig)('force_https', true);
 const ignoreProxies = (0, config_1.defineConfig)('ignore_proxies', false);
+const allowAuthorizationHeader = (0, config_1.defineConfig)('authorization_header', true);
 exports.sessionDuration = (0, config_1.defineConfig)('session_duration', Number(process.env.SESSION_DURATION) || misc_1.DAY / 1000, v => v * 1000);
 exports.gzipper = (0, koa_compress_1.default)({
     threshold: 2048,
@@ -49,9 +51,8 @@ exports.headRequests = headRequests;
 let proxyDetected;
 const someSecurity = (ctx, next) => {
     ctx.request.ip = (0, connections_1.normalizeIp)(ctx.ip);
-    // don't allow sessions to change ip
     const ss = ctx.session;
-    if (ss === null || ss === void 0 ? void 0 : ss.username)
+    if ((ss === null || ss === void 0 ? void 0 : ss.username) && (!allowSessionIpChange.get() || !ctx.secure && allowSessionIpChange.get() === 'https'))
         if (!ss.ip)
             ss.ip = ctx.ip;
         else if (ss.ip !== ctx.ip) {
@@ -69,6 +70,8 @@ const someSecurity = (ctx, next) => {
             proxyDetected = ctx;
             ctx.state.whenProxyDetected = new Date();
         }
+        if (ctx.get('cf-ray'))
+            exports.cloudflareDetected = new Date();
     }
     catch (_a) {
         return ctx.status = const_1.HTTP_FOOL;
@@ -112,24 +115,24 @@ const prepareState = async (ctx, next) => {
             return;
         const [u, p] = (0, misc_1.splitAt)(':', String(login));
         ctx.redirect(ctx.originalUrl.slice(0, -ctx.querystring.length - 1)); // redirect to hide credentials
-        return doLogin(u, p);
+        return doLogin(u, p, 'url');
     }
     function getHttpAccount() {
         var _a;
-        const b64 = (_a = ctx.get('authorization')) === null || _a === void 0 ? void 0 : _a.split(' ')[1];
+        const b64 = allowAuthorizationHeader.get() && ((_a = ctx.get('authorization')) === null || _a === void 0 ? void 0 : _a.split(' ')[1]);
         if (!b64)
             return;
         try {
             const [u, p] = atob(b64).split(':');
-            return doLogin(u, p || '');
+            return doLogin(u, p || '', 'header');
         }
         catch (_b) { }
     }
-    async function doLogin(u, p) {
+    async function doLogin(u, p, via) {
         var _a;
         if (!u || u === ((_a = ctx.session) === null || _a === void 0 ? void 0 : _a.username))
             return; // providing credentials, but not needed
-        await events_1.default.emitAsync('attemptingLogin', ctx);
+        await events_1.default.emitAsync('attemptingLogin', { ctx, username: u, via });
         const a = await (0, auth_1.srpCheck)(u, p);
         if (a) {
             await (0, auth_1.setLoggedIn)(ctx, a.username);

package/src/misc.js

@@ -168,13 +168,14 @@ function createStreamLimiter(limit) {
 }
 exports.createStreamLimiter = createStreamLimiter;
 async function deleteNode(ctx, node, uri) {
+    var _a;
     const { source } = node;
     if (!source)
         return const_1.HTTP_METHOD_NOT_ALLOWED;
     if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_delete', ctx))
         return ctx.status;
     try {
-        if (await events_1.default.emitAsync('deleting', { node, ctx }).isDefaultPrevented())
+        if ((_a = (await events_1.default.emitAsync('deleting', { node, ctx }))) === null || _a === void 0 ? void 0 : _a.isDefaultPrevented())
             return null; // stop
         ctx.logExtra(null, { target: decodeURI(uri) });
         await (0, promises_1.rm)(source, { recursive: true });

package/src/nat.js

@@ -32,7 +32,7 @@ exports.defaultBaseUrl = (0, valtio_1.proxy)({
 exports.upnpClient = new nat_upnp_rejetto_1.Client({ timeout: 4000 });
 const originalMethod = exports.upnpClient.getGateway;
 // other client methods call getGateway too, so this will ensure they reuse this same result
-exports.upnpClient.getGateway = (0, debounceAsync_1.debounceAsync)(() => originalMethod.apply(exports.upnpClient), 0, { retain: cross_1.HOUR, retainFailure: 30000 });
+exports.upnpClient.getGateway = (0, debounceAsync_1.debounceAsync)(() => originalMethod.apply(exports.upnpClient), { retain: cross_1.HOUR, retainFailure: 30000 });
 exports.upnpClient.getGateway().then(res => {
     console.debug('upnp', res.gateway.description);
 }, e => console.debug('upnp failed:', e.message || String(e)));
@@ -64,16 +64,16 @@ exports.getPublicIps = (0, debounceAsync_1.debounceAsync)(async () => {
         return validIps;
     }))));
     return exports.defaultBaseUrl.publicIps = lodash_1.default.uniq(ips.flat());
-}, 0, { retain: 10 * cross_1.MINUTE });
+}, { retain: 10 * cross_1.MINUTE });
 exports.getNatInfo = (0, debounceAsync_1.debounceAsync)(async () => {
     var _a, _b, _c, _d;
+    const gatewayIpPromise = findGateway().catch(() => undefined);
     const res = await (0, cross_1.haveTimeout)(10000, exports.upnpClient.getGateway()).catch(() => null);
     const status = await (0, listen_1.getServerStatus)();
     const mappings = res && await (0, cross_1.haveTimeout)(5000, exports.upnpClient.getMappings()).catch(() => null);
     console.debug('mappings found', mappings === null || mappings === void 0 ? void 0 : mappings.map(x => x.description));
-    const gatewayIp = res && (0, cross_1.try_)(() => new URL(res.gateway.description).hostname, () => { var _a; return console.debug('unexpected upnp gw', (_a = res.gateway) === null || _a === void 0 ? void 0 : _a.description); })
-        || await findGateway().catch(() => undefined);
     const localIps = await (0, listen_1.getIps)(false);
+    const gatewayIp = await gatewayIpPromise;
     const localIp = (res === null || res === void 0 ? void 0 : res.address) || gatewayIp ? lodash_1.default.maxBy(localIps, x => (0, cross_1.inCommon)(x, gatewayIp)) : localIps[0];
     const internalPort = ((_a = status === null || status === void 0 ? void 0 : status.https) === null || _a === void 0 ? void 0 : _a.listening) && status.https.port || ((_b = status === null || status === void 0 ? void 0 : status.http) === null || _b === void 0 ? void 0 : _b.listening) && status.http.port || undefined;
     const mapped = lodash_1.default.find(mappings, x => x.private.host === localIp && x.private.port === internalPort);

package/src/perm.js

@@ -47,7 +47,7 @@ createAdminConfig.sub(v => {
 });
 async function createAdmin(password, username = 'admin') {
     const acc = await addAccount(username, { admin: true, password }, true);
-    console.log(acc ? "account admin created" : "something went wrong");
+    console.log(acc ? "account admin set" : "something went wrong");
 }
 exports.createAdmin = createAdmin;
 const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());

package/src/persistence.js

@@ -8,7 +8,8 @@ exports.storedMap = new kvstorage_1.KvStorage({
     defaultPutDelay: 5000,
     maxPutDelay: misc_1.MINUTE,
     maxPutDelayCreate: 1000,
-    rewriteLater: true
+    rewriteLater: true,
+    bucketThreshold: 10000,
 });
 exports.storedMap.open('data.kv');
 (0, first_1.onProcessExit)(() => exports.storedMap.flush());

package/src/plugins.js

@@ -27,13 +27,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getMissingDependencies = exports.parsePluginSource = exports.rescan = exports.pluginsConfig = exports.enablePlugins = exports.pluginsWatcher = exports.getAvailablePlugins = exports.mapPlugins = exports.SERVER_CODE_ID = exports.Plugin = exports.pluginsMiddleware = exports.getPluginConfigFields = exports.findPluginByRepo = exports.getPluginInfo = exports.setPluginConfig = exports.startPlugin = exports.stopPlugin = exports.enablePlugin = exports.isPluginEnabled = exports.isPluginRunning = exports.STORAGE_FOLDER = exports.DISABLING_SUFFIX = exports.PATH = void 0;
+exports.getMissingDependencies = exports.parsePluginSource = exports.rescan = exports.pluginsConfig = exports.enablePlugins = exports.pluginsWatcher = exports.getAvailablePlugins = exports.firstPlugin = exports.mapPlugins = exports.SERVER_CODE_ID = exports.Plugin = exports.pluginsMiddleware = exports.getPluginConfigFields = exports.findPluginByRepo = exports.getPluginInfo = exports.setPluginConfig = exports.startPlugin = exports.stopPlugin = exports.enablePlugin = exports.isPluginEnabled = exports.isPluginRunning = exports.STORAGE_FOLDER = exports.DISABLING_SUFFIX = exports.PATH = void 0;
 const fast_glob_1 = __importDefault(require("fast-glob"));
 const watchLoad_1 = require("./watchLoad");
 const lodash_1 = __importDefault(require("lodash"));
 const const_1 = require("./const");
 const Const = __importStar(require("./const"));
 const misc_1 = require("./misc");
+const misc = __importStar(require("./misc"));
 const config_1 = require("./config");
 const serveFile_1 = require("./serveFile");
 const events_1 = __importDefault(require("./events"));
@@ -46,6 +47,7 @@ const kvstorage_1 = require("@rejetto/kvstorage");
 const first_1 = require("./first");
 const frontEndApis_1 = require("./frontEndApis");
 const index_1 = require("./index");
+const block_1 = require("./block");
 exports.PATH = 'plugins';
 exports.DISABLING_SUFFIX = '-disabled';
 exports.STORAGE_FOLDER = 'storage';
@@ -134,6 +136,8 @@ async function initPlugin(pl, morePassedToInit) {
         getHfsConfig: config_1.getConfig,
         customApiCall,
         notifyClient: frontEndApis_1.notifyClient,
+        addBlock: block_1.addBlock,
+        misc,
         ...morePassedToInit
     })));
 }
@@ -159,7 +163,7 @@ const pluginsMiddleware = async (ctx, next) => {
                 lastStatus = ctx.status;
                 lastBody = ctx.body;
             }
-            if (res === true && !ctx.isStopped) { // legacy pre-0.53
+            if (res === true && !ctx.isStopped) { //legacy pre-0.53
                 ctx.stop();
                 warnOnce(`plugin ${id} is using deprecated API (return true on middleware) and may not work with future versions (check for an update to "${id}")`);
             }
@@ -306,12 +310,27 @@ function mapPlugins(cb, includeServerCode = true) {
     }).filter(x => x !== undefined);
 }
 exports.mapPlugins = mapPlugins;
+function firstPlugin(cb, includeServerCode = true) {
+    for (const [plName, pl] of Object.entries(plugins)) {
+        if (!includeServerCode && plName === exports.SERVER_CODE_ID)
+            continue;
+        try {
+            const ret = cb(pl, plName);
+            if (ret !== undefined)
+                return ret;
+        }
+        catch (e) {
+            console.log('plugin error', plName, String(e));
+        }
+    }
+}
+exports.firstPlugin = firstPlugin;
 let availablePlugins = {};
 function getAvailablePlugins() {
     return Object.values(availablePlugins);
 }
 exports.getAvailablePlugins = getAvailablePlugins;
-const rescanAsap = (0, misc_1.debounceAsync)(rescan, 1000);
+const rescanAsap = (0, misc_1.debounceAsync)(rescan, { wait: 1000 });
 if (!(0, fs_1.existsSync)(exports.PATH))
     try {
         (0, fs_1.mkdirSync)(exports.PATH);

package/src/serveFile.js

@@ -19,9 +19,9 @@ const auth_1 = require("./auth");
 const errorPages_1 = require("./errorPages");
 const stream_1 = require("stream");
 const allowedReferer = (0, config_1.defineConfig)('allowed_referer', '');
-const limitDownloads = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads, 0), () => true);
-const limitDownloadsPerIp = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_ip, 0), ctx => ctx.ip);
-const limitDownloadsPerAccount = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_account, 0), ctx => (0, auth_1.getCurrentUsername)(ctx) || undefined);
+const maxDownloads = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads, 0), () => true);
+const maxDownloadsPerIp = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_ip, 0), ctx => ctx.ip);
+const maxDownloadsPerAccount = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_account, 0), ctx => (0, auth_1.getCurrentUsername)(ctx) || undefined);
 async function serveFileNode(ctx, node) {
     var _a, _b;
     const { source, mime } = node;
@@ -30,7 +30,7 @@ async function serveFileNode(ctx, node) {
         : lodash_1.default.find(mime, (val, mask) => (0, misc_1.matches)(name, mask));
     if (allowedReferer.get()) {
         const ref = (_a = /\/\/([^:/]+)/.exec(ctx.get('referer'))) === null || _a === void 0 ? void 0 : _a[1]; // extract host from url
-        if (ref && ref !== host() // automatic accept if referer is basically the hosting domain
+        if (ref && ref !== host() // automatically accept if referer is basically the hosting domain
             && !(0, misc_1.matches)(ref, allowedReferer.get()))
             return ctx.status = const_1.HTTP_FORBIDDEN;
     }
@@ -41,10 +41,10 @@ async function serveFileNode(ctx, node) {
     else if (((_b = ctx.get('referer')) === null || _b === void 0 ? void 0 : _b.endsWith('/')) && (0, misc_1.with_)(ctx.get('accept'), x => x && !x.includes('text')))
         ctx.state.considerAsGui = true;
     await serveFile(ctx, source || '', mimeString);
-    if (await limitDownloadsPerAccount(ctx) === undefined) // returning false will not execute other limits
-        await limitDownloads(ctx) || await limitDownloadsPerIp(ctx);
+    if (await maxDownloadsPerAccount(ctx) === undefined) // returning false will not execute other limits
+        await maxDownloads(ctx) || await maxDownloadsPerIp(ctx);
     function host() {
-        const s = ctx.get('host');
+        const s = ctx.host;
         return s[0] === '[' ? s.slice(1, s.indexOf(']')) : s === null || s === void 0 ? void 0 : s.split(':')[0];
     }
 }
@@ -54,6 +54,8 @@ const mimeCfg = (0, config_1.defineConfig)('mime', { '*': const_1.MIME_AUTO }, o
     const values = Object.values(obj);
     return (name) => values[matchers.findIndex(matcher => matcher(name))];
 });
+// after this number of seconds, the browser should check the server to see if there's a newer version of the file
+const cacheControlDiskFiles = (0, config_1.defineConfig)('cache_control_disk_files', 5);
 async function serveFile(ctx, source, mime, content) {
     if (!source)
         return;
@@ -75,19 +77,20 @@ async function serveFile(ctx, source, mime, content) {
         if (!stats.isFile())
             return ctx.status = const_1.HTTP_METHOD_NOT_ALLOWED;
         ctx.set('Last-Modified', stats.mtime.toUTCString());
-        ctx.fileSource = // legacy pre-0.51
-            ctx.state.fileSource = source;
-        ctx.fileStats = // legacy pre-0.51
-            ctx.state.fileStats = stats;
+        ctx.state.fileSource = source;
+        ctx.state.fileStats = stats;
         ctx.status = const_1.HTTP_OK;
         if (ctx.fresh)
             return ctx.status = const_1.HTTP_NOT_MODIFIED;
         if (content !== undefined)
             return ctx.body = content;
+        const cc = cacheControlDiskFiles.get();
+        if (lodash_1.default.isNumber(cc))
+            ctx.set('Cache-Control', `max-age=${cc}`);
         const { size } = stats;
         const range = applyRange(ctx, size);
         ctx.body = (0, fs_1.createReadStream)(source, range);
-        if (ctx.vfsNode)
+        if (ctx.state.vfsNode)
             monitorAsDownload(ctx, size, range === null || range === void 0 ? void 0 : range.start);
     }
     catch (e) {
@@ -101,7 +104,6 @@ function monitorAsDownload(ctx, size, offset) {
     const conn = (0, connections_1.getConnection)(ctx);
     ctx.body.on('end', () => (0, connections_1.updateConnection)(conn, {}, { opProgress: 1 }));
     (0, connections_1.updateConnection)(conn, {}, {
-        op: 'download',
         opProgress: 0,
         opTotal: size,
         opOffset: size && offset && (offset / size),
@@ -145,7 +147,7 @@ function downloadLimiter(configMax, cbKey) {
     const map = new Map();
     return (ctx) => {
         if (!ctx.body || ctx.state.considerAsGui)
-            return; // no file sent, cache hit
+            return; // !body = no file sent, cache hit
         const k = cbKey(ctx);
         if (k === undefined)
             return; // undefined = skip limit

package/src/serveGuiAndSharedFiles.js

@@ -26,7 +26,6 @@ const serveFrontendPrefixed = (0, koa_mount_1.default)(cross_const_1.FRONTEND_UR
 const serveAdminFiles = (0, serveGuiFiles_1.serveGuiFiles)(process.env.ADMIN_PROXY, cross_const_1.ADMIN_URI);
 const serveAdminPrefixed = (0, koa_mount_1.default)(cross_const_1.ADMIN_URI.slice(0, -1), serveAdminFiles);
 const serveGuiAndSharedFiles = async (ctx, next) => {
-    var _a;
     const { path } = ctx;
     // dynamic import on frontend|admin (used for non-https login) while developing (vite4) is not producing a relative path
     if (const_1.DEV && path.startsWith('/node_modules/')) {
@@ -100,15 +99,21 @@ const serveGuiAndSharedFiles = async (ctx, next) => {
         return;
     }
     const { get } = ctx.query;
-    if (node.default && path.endsWith('/') && !get) // final/ needed on browser to make resource urls correctly with html pages
-        node = (_a = await (0, vfs_1.urlToNode)(node.default, ctx, node)) !== null && _a !== void 0 ? _a : node;
+    if (node.default && path.endsWith('/') && !get) { // final/ needed on browser to make resource urls correctly with html pages
+        const found = await (0, vfs_1.urlToNode)(node.default, ctx, node);
+        if (found && /\.html?/i.test(node.default))
+            ctx.state.considerAsGui = true;
+        node = found !== null && found !== void 0 ? found : node;
+    }
+    if (get === 'icon')
+        return (0, serveFile_1.serveFile)(ctx, node.icon || '|'); // pipe to cause not-found
     if (!await (0, vfs_1.nodeIsDirectory)(node))
         return node.url ? ctx.redirect(node.url)
             : !node.source ? (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_METHOD_NOT_ALLOWED) // !dir && !source is not supported at this moment
                 : !(0, vfs_1.statusCodeForMissingPerm)(node, 'can_read', ctx) ? (0, serveFile_1.serveFileNode)(ctx, node) // all good
                     : ctx.status !== cross_const_1.HTTP_UNAUTHORIZED ? null // all errors don't need extra handling, except unauthorized
                         : (0, basicWeb_1.detectBasicAgent)(ctx) ? (ctx.set('WWW-Authenticate', 'Basic'), (0, errorPages_1.sendErrorPage)(ctx))
-                            : (ctx.state.serveApp = true) && serveFrontendFiles(ctx, next); // this is necessary to support standard urls with credentials, as chrome125 will send provided credentials only after attempt a GET without them, and after this error
+                            : ctx.query.dl === undefined && (ctx.state.serveApp = true) && serveFrontendFiles(ctx, next);
     if (!path.endsWith('/'))
         return ctx.redirect(ctx.state.revProxyPath + ctx.originalUrl.replace(/(\?|$)/, '/$1')); // keep query-string, if any
     if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_list', ctx)) {

package/src/serveGuiFiles.js

@@ -43,6 +43,7 @@ const lodash_1 = __importDefault(require("lodash"));
 const config_1 = require("./config");
 const lang_1 = require("./lang");
 const upload_1 = require("./upload");
+const splitUploads = (0, config_1.defineConfig)(misc_1.CFG.split_uploads, 0);
 exports.logGui = (0, config_1.defineConfig)(misc_1.CFG.log_gui, false);
 lodash_1.default.each(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.defineConfig)(k, v)); // define default values
 // in case of dev env we have our static files within the 'dist' folder'
@@ -85,7 +86,7 @@ function adjustBundlerLinks(ctx, uri, data) {
 const getFaviconTimestamp = (0, misc_1.debounceAsync)(async () => {
     const f = adminApis_1.favicon.get();
     return !f ? 0 : promises_1.default.stat(f).then(x => (x === null || x === void 0 ? void 0 : x.mtimeMs) || 0, () => 0);
-}, 0, { retain: 5000 });
+}, { retain: 5000 });
 async function treatIndex(ctx, filesUri, body) {
     const session = await (0, api_auth_1.refresh_session)({}, ctx);
     ctx.set('etag', '');
@@ -114,10 +115,6 @@ async function treatIndex(ctx, filesUri, body) {
         const isOpen = !isClose;
         if (isHead && isOpen)
             return all + `
-                    ${isFrontend && `
-                        <title>${adminApis_1.title.get()}</title>
-                        <link rel="shortcut icon" href="/favicon.ico?${timestamp}" />
-                    ` + (0, customHtml_1.getSection)('htmlHead')}
                     <script>
                     HFS = ${JSON.stringify({
                 VERSION: const_1.VERSION,
@@ -128,13 +125,18 @@ async function treatIndex(ctx, filesUri, body) {
                 loadScripts: Object.fromEntries((0, plugins_1.mapPlugins)((p, id) => { var _a; return [id, (_a = p.frontend_js) === null || _a === void 0 ? void 0 : _a.map(f => f.includes('//') ? f : pub + id + '/' + f)]; })),
                 prefixUrl: ctx.state.revProxyPath,
                 dontOverwriteUploading: upload_1.dontOverwriteUploading.get(),
+                splitUploads: splitUploads.get(),
                 forceTheme: (0, plugins_1.mapPlugins)(p => lodash_1.default.isString(p.isTheme) ? p.isTheme : undefined).find(Boolean),
                 customHtml: lodash_1.default.omit((0, customHtml_1.getAllSections)(), ['top', 'bottom', 'htmlHead', 'style']),
                 ...(0, misc_1.newObj)(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.getConfig)(k)),
                 lang
             }, null, 4).replace(/<(\/script)/g, '<"+"$1') /*avoid breaking our script container*/}
-                    document.documentElement.setAttribute('ver', '${const_1.VERSION.split('-')[0] /*for style selectors*/}')
+                    document.documentElement.setAttribute('ver', HFS.VERSION.split('-')[0])
                     </script>
+                    ${isFrontend && `
+                        <title>${adminApis_1.title.get()}</title>
+                        <link rel="shortcut icon" href="/favicon.ico?${timestamp}" />
+                    ${(0, customHtml_1.getSection)('htmlHead')}`}
                 `;
         if (isBody && isOpen)
             return `${all}

package/src/srp.js

@@ -15,8 +15,8 @@ async function srpClientSequence(username, password, apiCall) {
 exports.srpClientSequence = srpClientSequence;
 async function srpClientPart(username, password, salt, pubKey) {
     const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
-    const srp = new tssrp6a_1.SRPClientSession(srp6aNimbusRoutines);
-    const res = await srp.step1(username, password);
+    const srpClient = new tssrp6a_1.SRPClientSession(srp6aNimbusRoutines);
+    const res = await srpClient.step1(username, password);
     return await res.step2(BigInt(salt), BigInt(pubKey));
 }
 exports.srpClientPart = srpClientPart;

package/src/update.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.update = exports.updateSupported = exports.localUpdateAvailable = exports.getUpdates = void 0;
+exports.update = exports.updateSupported = exports.localUpdateAvailable = exports.getUpdates = exports.autoCheckUpdateResult = void 0;
 const github_1 = require("./github");
 const const_1 = require("./const");
 const path_1 = require("path");
@@ -17,15 +17,48 @@ const open_1 = __importDefault(require("open"));
 const config_1 = require("./config");
 const util_os_1 = require("./util-os");
 const first_1 = require("./first");
+const persistence_1 = require("./persistence");
+const lodash_1 = __importDefault(require("lodash"));
 const updateToBeta = (0, config_1.defineConfig)('update_to_beta', false);
+const autoCheckUpdate = (0, config_1.defineConfig)('auto_check_update', true);
+const lastCheckUpdate = persistence_1.storedMap.singleSync('lastCheckUpdate', 0);
+const AUTO_CHECK_EVERY = misc_1.DAY;
+exports.autoCheckUpdateResult = persistence_1.storedMap.singleSync('autoCheckUpdateResult', undefined);
+exports.autoCheckUpdateResult.ready().then(() => {
+    exports.autoCheckUpdateResult.set(v => {
+        if (!v)
+            return; // refresh isNewer, as currentVersion may have changed
+        v.isNewer = config_1.currentVersion.olderThan(v.tag_name);
+        return v;
+    });
+});
+setInterval((0, misc_1.debounceAsync)(async () => {
+    if (!autoCheckUpdate.get())
+        return;
+    if (Date.now() < lastCheckUpdate.get() + AUTO_CHECK_EVERY)
+        return;
+    console.log("checking for updates");
+    try {
+        const u = (await getUpdates(true))[0];
+        if (u)
+            console.log("new version available", u.name);
+        exports.autoCheckUpdateResult.set(u);
+        lastCheckUpdate.set(Date.now());
+    }
+    catch (_a) { }
+}), misc_1.HOUR);
+const ReleaseKeys = ['prerelease', 'tag_name', 'name', 'body', 'assets', 'isNewer'];
+const ReleaseAssetKeys = ['name', 'browser_download_url'];
 async function getUpdates(strict = false) {
+    (0, github_1.getProjectInfo)(); // check for alerts
     const stable = await (0, github_1.getRepoInfo)(const_1.HFS_REPO + '/releases/latest');
     const verStable = ver(stable);
     const ret = await getBetas();
     stable.isNewer = config_1.currentVersion.olderThan(stable.tag_name);
     if (stable.isNewer || const_1.RUNNING_BETA)
         ret.push(stable);
-    return ret.filter(x => !strict || x.isNewer);
+    // prune a bit, as it will be serialized, but it has a lot of unused data
+    return ret.filter(x => !strict || x.isNewer).map(x => Object.assign(lodash_1.default.pick(x, ReleaseKeys), { assets: x.assets.map(a => lodash_1.default.pick(a, ReleaseAssetKeys)) }));
     function ver(x) {
         return (0, config_1.versionToScalar)(x.name);
     }
@@ -41,10 +74,10 @@ async function getUpdates(strict = false) {
                 break;
             const curV = config_1.currentVersion.getScalar();
             for (const x of res) {
-                if (!x.prerelease)
-                    continue; // prerelease are all the end
+                if (!x.prerelease || x.name.endsWith('-ignore'))
+                    continue;
                 const v = ver(x);
-                if (v <= verStable) // prerelease-s are locally ordered, so as soon as we reach verStable we are done
+                if (v < verStable) // we don't consider betas before stable
                     return ret;
                 if (v === curV)
                     continue; // skip current
@@ -68,8 +101,9 @@ exports.updateSupported = updateSupported;
 async function update(tagOrUrl = '') {
     if (!await updateSupported())
         throw "only binary versions supports automatic update for now";
+    let doingLocal = '';
     let updateSource = tagOrUrl.includes('://') ? await (0, misc_1.httpStream)(tagOrUrl)
-        : await localUpdateAvailable() && (0, fs_1.createReadStream)(LOCAL_UPDATE);
+        : await localUpdateAvailable() && (0, fs_1.createReadStream)(doingLocal = LOCAL_UPDATE);
     if (!updateSource) {
         if (/^\d/.test(tagOrUrl)) // work even if the tag is passed without the initial 'v' (useful for console commands)
             tagOrUrl = 'v' + tagOrUrl;
@@ -115,7 +149,14 @@ async function update(tagOrUrl = '') {
             catch (_a) { }
             (0, fs_1.renameSync)(bin, oldBin);
             console.log("launching new version in background", newBinFile);
-            launch(newBin, ['--updating', binFile], { sync: true }); // sync necessary to work on mac by double-click
+            if (doingLocal)
+                try {
+                    (0, fs_1.renameSync)(doingLocal, 'old-' + doingLocal);
+                }
+                catch (e) {
+                    console.warn(e);
+                }
+            launch(newBin, ['--updating', binFile], { sync: true }); // sync necessary to work on Mac by double-click
         });
         console.log("quitting");
         setTimeout(() => process.exit()); // give time to return (and caller to complete, eg: rest api to reply)

package/src/upload.js

@@ -61,9 +61,9 @@ function uploadWriter(base, path, ctx) {
     else
         try {
             // refer to the source of the closest node that actually belongs to the vfs, so that cache is more effective
-            let closestVfsNode = base;
-            while (closestVfsNode && !closestVfsNode.original)
-                closestVfsNode = closestVfsNode.parent;
+            let closestVfsNode = base; // if base=root, there's no parent and no original
+            while ((closestVfsNode === null || closestVfsNode === void 0 ? void 0 : closestVfsNode.parent) && !closestVfsNode.original)
+                closestVfsNode = closestVfsNode.parent; // if it's not original, it surely has a parent
             const statDir = closestVfsNode.source;
             if (!Object.hasOwn(diskSpaceCache, statDir)) {
                 const c = diskSpaceCache[statDir] = (0, util_os_1.getDiskSpaceSync)(statDir);
@@ -86,14 +86,15 @@ function uploadWriter(base, path, ctx) {
     if (ctx.query.existing === 'skip' && fs_1.default.existsSync(fullPath))
         return fail(const_1.HTTP_CONFLICT, 'exists');
     openFiles.add(fullPath);
+    let overwriteRequestedButForbidden = false;
     try {
         // if upload creates a folder, then add meta to it too
-        if (fs_1.default.mkdirSync(dir, { recursive: true }))
+        if (!dir.endsWith(':\\') && fs_1.default.mkdirSync(dir, { recursive: true }))
             setUploadMeta(dir, ctx);
         // use temporary name while uploading
         const keepName = (0, path_1.basename)(fullPath).slice(-200);
         let tempName = (0, path_1.join)(dir, 'hfs$upload-' + keepName);
-        const resumable = fs_1.default.existsSync(tempName) && !openFiles.has(tempName) && tempName;
+        const resumable = fs_1.default.existsSync(tempName) && !openFiles.has(tempName) && tempName; // resumable is temp-file-1
         if (resumable)
             tempName = (0, path_1.join)(dir, 'hfs$upload2-' + keepName);
         // checks for resume feature
@@ -101,15 +102,19 @@ function uploadWriter(base, path, ctx) {
         const size = resumable && (0, misc_1.try_)(() => fs_1.default.statSync(resumable).size);
         if (size === undefined) // stat failed
             return fail(const_1.HTTP_SERVER_ERROR);
-        if (resume > size)
+        if (lodash_1.default.isNumber(size) && resume > size)
             return fail(const_1.HTTP_RANGE_NOT_SATISFIABLE);
         // warn frontend about resume possibility
+        let resumableLost = false;
         if (!resume && resumable) {
             const timeout = 30;
             (0, frontEndApis_1.notifyClient)(ctx, 'upload.resumable', { [path]: size, expires: Date.now() + timeout * 1000 });
-            delayedDelete(resumable, timeout, () => fs_1.default.rename(tempName, resumable, err => {
-                if (!err)
-                    tempName = resumable;
+            delayedDelete(resumable, timeout, () => // if user resumes, this upload is interrupted, and next upload will cancel this delayedDelete
+             fs_1.default.rename(tempName, resumable, err => {
+                if (err)
+                    return;
+                tempName = resumable;
+                resumableLost = true;
             }));
         }
         // append if resuming
@@ -136,14 +141,21 @@ function uploadWriter(base, path, ctx) {
         const lockMiddleware = (0, misc_1.pendingPromise)(); // outside we need to know when all operations stopped
         writeStream.once('close', async () => {
             try {
+                await new Promise(res => fileStream.close(res)); // this only seem to be necessary on Windows
                 if (ctx.req.aborted) {
-                    if (resumable) // we don't want to be left with 2 temp files
-                        return delayedDelete(tempName, 0);
+                    if (resumable && !resumableLost && !resuming) // we don't want to be left with 2 temp files
+                        return (0, promises_1.rm)(tempName);
                     const sec = exports.deleteUnfinishedUploadsAfter.get();
                     return lodash_1.default.isNumber(sec) && delayedDelete(tempName, sec);
                 }
+                if (ctx.query.partial)
+                    return; // this upload is partial, and we are supposed to leave the upload as unfinished, with the temp name
                 let dest = fullPath;
                 if (exports.dontOverwriteUploading.get() && !await overwriteAnyway() && fs_1.default.existsSync(dest)) {
+                    if (overwriteRequestedButForbidden) {
+                        await (0, promises_1.rm)(tempName);
+                        return fail();
+                    }
                     const ext = (0, path_1.extname)(dest);
                     const base = dest.slice(0, -ext.length || Infinity);
                     let i = 1;
@@ -153,12 +165,13 @@ function uploadWriter(base, path, ctx) {
                 }
                 try {
                     await (0, promises_1.rename)(tempName, dest);
+                    cancelDeletion(tempName); // not necessary, as deletion's failure is silent, but still
                     ctx.state.uploadDestinationPath = dest;
                     setUploadMeta(dest, ctx);
                     if (ctx.query.comment)
                         void (0, comments_1.setCommentFor)(dest, String(ctx.query.comment));
-                    if (resumable)
-                        delayedDelete(resumable, 0);
+                    if (resumable && !resuming) // this happens if user decided to not resume and the new upload finished before delayedDelete
+                        (0, promises_1.rm)(resumable).catch(console.warn);
                     events_1.default.emit('uploadFinished', obj);
                     if (resEvent)
                         for (const cb of resEvent)
@@ -182,7 +195,7 @@ function uploadWriter(base, path, ctx) {
             let lastGot = 0;
             let lastGotTime = 0;
             const opTotal = reqSize + resume;
-            Object.assign(ctx.state, { op: 'upload', opTotal, opOffset: resume / opTotal, opProgress: 0 });
+            Object.assign(ctx.state, { opTotal, opOffset: resume / opTotal, opProgress: 0 });
             const conn = (0, connections_1.updateConnectionForCtx)(ctx);
             if (!conn)
                 return;
@@ -202,11 +215,13 @@ function uploadWriter(base, path, ctx) {
         throw e;
     }
     async function overwriteAnyway() {
-        if (ctx.query.overwrite === undefined // legacy pre-0.52
-            && ctx.query.existing !== 'overwrite')
-            return;
+        if (ctx.query.existing !== 'overwrite')
+            return false;
         const n = await (0, vfs_1.getNodeByName)(path, base);
-        return n && (0, vfs_1.hasPermission)(n, 'can_delete', ctx);
+        if (n && !(0, vfs_1.statusCodeForMissingPerm)(n, 'can_delete', ctx))
+            return true;
+        overwriteRequestedButForbidden = true;
+        return false;
     }
     function delayedDelete(path, secs, cb) {
         clearTimeout(waitingToBeDeleted[path]);