hfs 3.0.7 → 3.1.0-alpha2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hfs",
-  "version": "3.0.7",
+  "version": "3.1.0-alpha2",
   "description": "HTTP File Server",
   "keywords": ["file server", "http server"],
   "homepage": "https://rejetto.com/hfs",
@@ -13,8 +13,8 @@
     "watch-server-full": "npm run start --workspace=frontend & npm run start --workspace=admin & cross-env FRONTEND_PROXY=3005 ADMIN_PROXY=3006 npm run watch-server",
     "start-frontend": "npm run start --workspace=frontend",
     "start-admin": "npm run start --workspace=admin",
-    "build-all": "rm -rf dist && npm run build-server && npm run test-with-server && (npm run build-frontend & npm run build-admin) && echo COMPLETED",
-    "build-server": "rm -rf dist/src dist/plugins && npm i && tsc && touch package.json && cp -v -r package.json central.json README* LICENSE* hfs.ico plugins dist && find dist -name .DS_Store -o -name storage -exec rm -rf {} + && node afterbuild.js",
+    "build-all": "rm -rf dist && npm run build-server && (npm run build-frontend & npm run build-admin) && echo COMPLETED",
+    "build-server": "rm -rf dist/src dist/plugins && npm i && tsc && touch package.json && cp -v -r package.json central.json README* LICENSE* hfs.ico plugins dist && find dist -name .DS_Store -o -name storage -exec rm -rf {} + && node scripts/afterbuild.js",
     "build-frontend": "npm run build --workspace=frontend",
     "build-admin": "npm run build --workspace=admin",
     "server-for-test": "node dist/src --cwd tests/work --config tests --debug",
@@ -22,13 +22,13 @@
     "test": "node --import tsx --test tests/test.ts",
     "test-with-server": "sh -c 'npm run port-is-free && tsc && rm -rf tests/work tests/tmp && (node dist/src --cwd tests/work --config tests & echo $! > .server_pid) && sleep 2 && node --import tsx --test \"$@\" tests/test.ts; _exit=$?; if [ -f ./.server_pid ]; then SERVER_PID=$(cat ./.server_pid); kill \"$SERVER_PID\" 2>/dev/null || true; rm -f ./.server_pid; fi; exit $_exit' --",
     "port-is-free": "node -e \"const port=process.argv[1]||8081;process.exit(await fetch('http://localhost:'+port).then(() => console.log('BUSY')||1, () => 0))\" --",
-    "test-ui": "npx playwright test frontend && npx playwright test serial",
-    "test-with-ui": "sh -c 'npm run port-is-free -- 3005 && npm run start-frontend & npm run port-is-free -- 3006 && npm run start-admin & cross-env TEST_WITH_UI=1 npx playwright test --ui'",
+    "test-ui": "npx playwright test frontend && npx playwright test serial && npx playwright test admin-vfs",
+    "test-with-ui": "sh -c 'npm run port-is-free -- 3005 && npm run start-frontend & npm run port-is-free -- 3006 && npm run start-admin & cross-env TEST_WITH_UI=1 npx playwright test --ui \"$@\"' --",
     "pub": "cd dist && npm publish",
     "dist": "STASHED=; if ! git diff-index --quiet HEAD --; then git stash push -m 'dist' && STASHED=1; fi; CI=1 FORCE_COLOR=1 npm run dist-uncommitted || (EXIT_CODE=$?; [ -n \"$STASHED\" ] && git stash pop; exit $EXIT_CODE); [ -n \"$STASHED\" ] && git stash pop",
-    "dist-uncommitted": "npm audit --omit=dev --audit-level=moderate && npm run build-all && npm run test-ui && npm run dist-bin",
+    "dist-uncommitted": "npm audit --omit=dev --audit-level=moderate && rm -rf dist && npm run build-server && npm run test-with-server && (npm run build-frontend & npm run build-admin) && npm run test-ui && npm run dist-bin",
     "dist-bin": "npm run dist-modules && npm run dist-bin-win && npm run dist-bin-linux && npm run dist-bin-linux-arm && npm run dist-bin-mac && npm run dist-bin-mac-arm",
-    "dist-modules": "cp package*.json central.json README.md dist && cd dist && npm ci --omit=dev && cd .. && node prune_modules",
+    "dist-modules": "cp package*.json central.json README.md dist && cd dist && npm ci --omit=dev && npm shrinkwrap && cd .. && node scripts/prune_modules.js",
     "dist-bin-win": "cd dist && pkg . --public -C gzip -t node20-win-x64 && npx resedit-cli --in hfs.exe --icon 1,../hfs.ico --out hfs.exe && zip hfs-windows-x64-$(jq -r .version ../package.json).zip hfs.exe -r plugins && cd ..",
     "dist-bin-mac-arm": "cd dist && pkg . --public -C gzip -t node20-macos-arm64 && zip hfs-mac-arm64-$(jq -r .version ../package.json).zip hfs -r plugins && cd ..",
     "dist-bin-mac": "cd dist && pkg . --public -C gzip -t node20-macos-x64 && zip hfs-mac-x64-$(jq -r .version ../package.json).zip hfs -r plugins && cd ..",
@@ -45,6 +45,7 @@
   },
   "files": [
     "central.json",
+    "npm-shrinkwrap.json",
     "src/*",
     "admin/*",
     "frontend/*",
@@ -79,7 +80,7 @@
   },
   "dependencies": {
     "@gregoranders/csv": "^0.0.13",
-    "@rejetto/kvstorage": "^0.16.0",
+    "@rejetto/kvstorage": "^0.17.1",
     "acme-client": "^5.4.0",
     "busboy": "^1.6.0",
     "crc-32": "^1.2.2",
@@ -90,8 +91,8 @@
     "iconv-lite": "^0.7.0",
     "immer": "^10.1.3",
     "ip2location-nodejs": "^9.7.0",
-    "koa": "^3.1.1",
-    "koa-compress": "^5.1.1",
+    "koa": "^3.1.2",
+    "koa-compress": "^5.2.0",
     "koa-mount": "^4.2.0",
     "koa-session": "^7.0.2",
     "limiter": "^3.0.0",
@@ -122,7 +123,7 @@
     "@types/node": "^20.17.30",
     "@types/node-forge": "^1.3.14",
     "@types/picomatch": "^4.0.2",
-    "@yao-pkg/pkg": "6.13.1",
+    "@yao-pkg/pkg": "6.14.1",
     "cross-env": "^10.0.0",
     "koa-better-http-proxy": "^0.2.10",
     "nm-prune": "^5.0.0",

package/plugins/antibrute/plugin.js

@@ -1,4 +1,4 @@
-exports.version = 3
+exports.version = 3.1
 exports.description = "Introduce increasing delays between login attempts."
 exports.apiRequired = 9.6 // addBlock
 
@@ -7,6 +7,7 @@ exports.config = {
     max: { type: 'number', min: 1, defaultValue: 60, label: "Max delay", unit: "seconds", helperText: "Max seconds to delay before next login is allowed" },
     blockAfter: { type: 'number', xs: 6, min: 1, max: 9999, defaultValue: 100, label: "Block IP after", unit: "attempts", helperText: "localhost excluded" },
     blockForHours: { type: 'number', xs: 6, min: 0, defaultValue: 24, label: "Block for", unit: "hours" },
+    exclude: { type: 'string', defaultValue: '', label: "Exclude IPs", helperText: "Net mask syntax" },
 }
 exports.configDialog = {
     maxWidth: 'xs',
@@ -15,7 +16,7 @@ exports.configDialog = {
 const byIp = {}
 
 exports.init = api => {
-    const { isLocalHost, HOUR } = api.misc
+    const { isLocalHost, HOUR, netMatches } = api.misc
     api.events.multi({
         async attemptingLogin({ ctx }) {
             const { ip } = ctx
@@ -25,7 +26,7 @@ exports.init = api => {
             const delay = Math.min(max, 1000 * api.getConfig('increment') * ++rec.attempts)
             const wait = rec.next - now
             rec.next = new Date(+rec.next + delay)
-            if (rec.attempts > api.getConfig('blockAfter') && !isLocalHost(ctx)) {
+            if (rec.attempts > api.getConfig('blockAfter') && !isLocalHost(ctx) && !isExcluded(ip)) {
                 const hours = api.getConfig('blockForHours')
                 api.addBlock({ ip, comment: "From antibrute plugin", expire: hours ? new Date(now.getTime() + hours * HOUR) : undefined })
             }
@@ -42,4 +43,14 @@ exports.init = api => {
                 delete byIp[ctx.ip] // reset if login was successful
         }
     })
+
+    function isExcluded(ip) {
+        const mask = api.getConfig('exclude')
+        if (!mask) return false
+        try { return netMatches(ip, mask) }
+        catch (e) {
+            api.log("bad exclude mask:", String(e))
+            return false
+        }
+    }
 }

package/src/AsapStream.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AsapStream = void 0;
+const stream_1 = require("stream");
+const cross_1 = require("./cross");
+// produces as promises resolve, not sequentially
+class AsapStream extends stream_1.Readable {
+    promises;
+    finished = false;
+    constructor(promises) {
+        super({ objectMode: true });
+        this.promises = promises;
+    }
+    _read() {
+        if (this.finished)
+            return;
+        this.finished = true;
+        void (async () => {
+            const pending = [];
+            try {
+                if ((0, cross_1.isAsyncIterable)(this.promises)) {
+                    const iterator = this.promises[Symbol.asyncIterator]();
+                    while (true) {
+                        const { value, done } = await iterator.next();
+                        if (done)
+                            break;
+                        const promise = Promise.resolve(value);
+                        pending.push(promise);
+                        promise.then(x => x !== undefined && this.push(x), e => this.emit('error', e));
+                    }
+                }
+                else {
+                    for (const p of this.promises) {
+                        const promise = Promise.resolve(p);
+                        pending.push(promise);
+                        promise.then(x => x !== undefined && this.push(x), e => this.emit('error', e));
+                    }
+                }
+                await Promise.allSettled(pending);
+                this.push(null);
+            }
+            catch (e) {
+                this.emit('error', e);
+                this.push(null);
+            }
+        })();
+    }
+}
+exports.AsapStream = AsapStream;

package/src/ThrottledStream.js

@@ -72,7 +72,7 @@ class ThrottleGroup {
     }
     updateLimit(kBs) {
         if (kBs < 0)
-            throw new Error('invalid bytesPerSecond');
+            throw Error('invalid bytesPerSecond');
         kBs *= 1000;
         return this.bucket = new limiter_1.TokenBucket({
             bucketSize: kBs,

package/src/adminApis.js

@@ -71,10 +71,16 @@ exports.adminApis = {
             customHtml: customHtml_1.customHtml.getText(),
         };
     },
-    set_config_text: ({ text }) => config_1.configFile.save(text, { reparse: true }),
-    update: ({ tag }) => (0, update_1.update)(tag).catch(e => {
-        throw e.cause?.statusCode ? new apiMiddleware_1.ApiError(e.cause?.statusCode) : e;
-    }),
+    set_config_text: ({ text }) => {
+        (0, misc_1.apiAssertTypes)({ string: { text } });
+        return config_1.configFile.save(text, { reparse: true });
+    },
+    update: ({ tag }) => {
+        (0, misc_1.apiAssertTypes)({ string_undefined: { tag } });
+        return (0, update_1.update)(tag).catch(e => {
+            throw e.cause?.statusCode ? new apiMiddleware_1.ApiError(e.cause?.statusCode) : e;
+        });
+    },
     async check_update() {
         return { options: await (0, update_1.getUpdates)() };
     },
@@ -88,6 +94,10 @@ exports.adminApis = {
         return {};
     },
     async ip_country({ ips }) {
+        (0, misc_1.apiAssertTypes)({
+            array: { ips },
+            string: { ips0: ips[0] }
+        });
         const res = await Promise.allSettled(ips.map(geo_1.ip2country));
         return {
             codes: res.map(x => x.status === 'rejected' || x.value === '-' ? '' : x.value)
@@ -110,6 +120,7 @@ exports.adminApis = {
         };
     },
     async set_custom_html({ sections }) {
+        (0, misc_1.apiAssertTypes)({ object: { sections } });
         await (0, customHtml_1.saveCustomHtml)(sections);
         return {};
     },
@@ -196,7 +207,7 @@ const frpDebounced = (0, misc_1.debounceAsync)(async () => {
     }
 }, { retain: 10_000 });
 function anyAccountCanLoginAdmin() {
-    return Boolean(lodash_1.default.find(perm_1.accounts.get(), perm_1.accountCanLoginAdmin));
+    return lodash_1.default.some(perm_1.accounts.get(), perm_1.accountCanLoginAdmin);
 }
 function preventAdminAccess(ctx) {
     return !(0, misc_1.isLocalHost)(ctx) && !exports.adminNet.compiled()(ctx.ip);

package/src/api.accounts.js

@@ -40,6 +40,7 @@ exports.default = {
         return { list: Object.keys(perm_1.accounts.get()) };
     },
     get_account({ username }, ctx) {
+        (0, misc_1.apiAssertTypes)({ string: { username } });
         return prepareAccount((0, perm_1.getAccount)(username || (0, auth_1.getCurrentUsername)(ctx)))
             || new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
     },
@@ -85,10 +86,4 @@ exports.default = {
         auth_1.invalidateSessionBefore.set((0, perm_1.normalizeUsername)(username), Date.now());
         return {};
     },
-    async change_srp({ username, salt, verifier }) {
-        (0, misc_1.apiAssertTypes)({ string: { username, salt, verifier } });
-        const a = (0, perm_1.getAccount)(username);
-        return a ? (0, perm_1.changeSrpHelper)(a, salt, verifier)
-            : new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
-    }
 };

package/src/api.auth.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.change_my_srp = exports.refresh_session = exports.logout = exports.loginSrp2 = exports.loginSrp1 = exports.login = void 0;
+exports.authApis = void 0;
 const perm_1 = require("./perm");
 const apiMiddleware_1 = require("./apiMiddleware");
 const const_1 = require("./const");
@@ -13,103 +13,14 @@ const middlewares_1 = require("./middlewares");
 const auth_1 = require("./auth");
 const config_1 = require("./config");
 const events_1 = __importDefault(require("./events"));
+const misc_1 = require("./misc");
 const ongoingLogins = {}; // store data that doesn't fit session object
 const keepSessionAlive = (0, config_1.defineConfig)('keep_session_alive', true);
-const login = async ({ username, password }, ctx) => {
-    if (!username)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
-    try {
-        const account = await (0, auth_1.clearTextLogin)(ctx, username, password, 'api');
-        if (!account)
-            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
-        await (0, auth_1.setLoggedIn)(ctx, account.username);
-    }
-    catch (e) {
-        return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, String(e));
-    }
-    return {
-        redirect: ctx.state.account?.redirect,
-        ...await (0, exports.refresh_session)({}, ctx)
-    };
-};
-exports.login = login;
-const loginSrp1 = async ({ username }, ctx) => {
-    if (!username)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
-    const account = (0, perm_1.getAccount)(username);
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
-    if (account?.plugin?.auth) // tell client to do clear-text login, before firing attemptingLogin, before triggering anti-brute
-        return new apiMiddleware_1.ApiError(const_1.HTTP_METHOD_NOT_ALLOWED);
-    if ((await events_1.default.emitAsync('attemptingLogin', { ctx, username }))?.isDefaultPrevented())
-        return;
-    if (!account || !(0, perm_1.accountCanLogin)(account)) { // TODO simulate fake account to prevent knowing valid usernames
-        ctx.logExtra({ u: username });
-        ctx.state.dontLog = false; // log even if log_api is false
-        return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, account && (0, perm_1.accountIsDisabled)(account) ? 'Account disabled' : undefined);
-    }
-    if ((0, middlewares_1.failAllowNet)(ctx, account))
-        return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
-    try {
-        const { srpServer, ...rest } = await (0, auth_1.srpServerStep1)(account);
-        const sid = Math.random();
-        ongoingLogins[sid] = srpServer;
-        setTimeout(() => delete ongoingLogins[sid], 60_000);
-        ctx.session.loggingIn = { username, sid }; // temporarily store until process is complete
-        return rest;
-    }
-    catch (code) {
-        return new apiMiddleware_1.ApiError(code);
-    }
-};
-exports.loginSrp1 = loginSrp1;
-const loginSrp2 = async ({ pubKey, proof }, ctx) => {
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
-    if (!ctx.session.loggingIn)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT);
-    const { username, sid } = ctx.session.loggingIn;
-    delete ctx.session.loggingIn;
-    const step1 = ongoingLogins[sid];
-    if (!step1)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
-    try {
-        const M2 = await step1.step2(BigInt(pubKey), BigInt(proof))
-            .catch(() => { throw ''; });
-        await (0, auth_1.setLoggedIn)(ctx, username);
-        return {
-            proof: String(M2),
-            redirect: ctx.state.account?.redirect,
-            ...await (0, exports.refresh_session)({}, ctx)
-        };
-    }
-    catch (e) {
-        ctx.logExtra({ u: username });
-        ctx.state.dontLog = false; // log even if log_api is false
-        events_1.default.emit('failedLogin', { ctx, username });
-        return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, e ? String(e) : undefined);
-    }
-    finally {
-        delete ongoingLogins[sid];
-    }
-};
-exports.loginSrp2 = loginSrp2;
-// this api is here for consistency, but frontend is actually using
-const logout = async ({}, ctx) => {
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
-    await (0, auth_1.setLoggedIn)(ctx, false);
-    // 401 is a convenient code for OK: the browser clears a possible http authentication (hopefully), and Admin automatically triggers login dialog
-    return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
-};
-exports.logout = logout;
 const refresh_session = async ({}, ctx) => {
     const username = (0, auth_1.getCurrentUsername)(ctx);
     return !ctx.session ? new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR) : {
         username,
-        expandedUsername: (0, perm_1.expandUsername)(username),
+        expandedUsername: Array.from((0, perm_1.expandUsername)(username)),
         adminUrl: (0, adminApis_1.ctxAdminAccess)(ctx) ? ctx.state.revProxyPath + const_1.ADMIN_URI : undefined,
         canChangePassword: (0, perm_1.accountCanChangePassword)(ctx.state.account),
         requireChangePassword: ctx.state.account?.require_password_change,
@@ -117,12 +28,104 @@ const refresh_session = async ({}, ctx) => {
         accountExp: ctx.state.account?.expire,
     };
 };
-exports.refresh_session = refresh_session;
-const change_my_srp = async ({ salt, verifier }, ctx) => {
-    const a = ctx.state.account;
-    return !a || !(0, perm_1.accountCanChangePassword)(a) ? new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED)
-        : (0, perm_1.changeSrpHelper)(a, salt, verifier).then(() => {
-            delete a.require_password_change;
-        });
+exports.authApis = {
+    async login({ username, password }, ctx) {
+        if (!username)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
+        if (!ctx.session)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
+        try {
+            const account = await (0, auth_1.clearTextLogin)(ctx, username, password, 'api');
+            if (!account)
+                return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
+            await (0, auth_1.setLoggedIn)(ctx, account.username);
+        }
+        catch (e) {
+            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, String(e));
+        }
+        return {
+            redirect: ctx.state.account?.redirect,
+            ...await refresh_session({}, ctx)
+        };
+    },
+    async loginSrp1({ username }, ctx) {
+        (0, misc_1.apiAssertTypes)({ string: { username } });
+        if (!username)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
+        const account = (0, perm_1.getAccount)(username);
+        if (!ctx.session)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
+        if (account?.plugin?.auth) // tell client to do clear-text login, before firing attemptingLogin, before triggering anti-brute
+            return new apiMiddleware_1.ApiError(const_1.HTTP_METHOD_NOT_ALLOWED);
+        if ((await events_1.default.emitAsync('attemptingLogin', { ctx, username }))?.isDefaultPrevented())
+            return;
+        if (!account || !(0, perm_1.accountCanLogin)(account)) { // TODO simulate fake account to prevent knowing valid usernames
+            ctx.logExtra({ u: username });
+            ctx.state.dontLog = false; // log even if log_api is false
+            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, account && (0, perm_1.accountIsDisabled)(account) ? 'Account disabled' : undefined);
+        }
+        if ((0, middlewares_1.failAllowNet)(ctx, account))
+            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
+        try {
+            const { srpServer, ...rest } = await (0, auth_1.srpServerStep1)(account);
+            const sid = Math.random();
+            ongoingLogins[sid] = srpServer;
+            setTimeout(() => delete ongoingLogins[sid], 60_000);
+            ctx.session.loggingIn = { username, sid }; // temporarily store until process is complete
+            return rest;
+        }
+        catch (code) {
+            return new apiMiddleware_1.ApiError(code);
+        }
+    },
+    async loginSrp2({ pubKey, proof }, ctx) {
+        if (!ctx.session)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
+        if (!ctx.session.loggingIn)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT);
+        const { username, sid } = ctx.session.loggingIn;
+        delete ctx.session.loggingIn;
+        const step1 = ongoingLogins[sid];
+        if (!step1)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
+        try {
+            const M2 = await step1.step2(BigInt(pubKey), BigInt(proof))
+                .catch(() => { throw ''; });
+            await (0, auth_1.setLoggedIn)(ctx, username);
+            return {
+                proof: String(M2),
+                redirect: ctx.state.account?.redirect,
+                ...await refresh_session({}, ctx)
+            };
+        }
+        catch (e) {
+            ctx.logExtra({ u: username });
+            ctx.state.dontLog = false; // log even if log_api is false
+            events_1.default.emit('failedLogin', { ctx, username });
+            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, e ? String(e) : undefined);
+        }
+        finally {
+            delete ongoingLogins[sid];
+        }
+    },
+    // this api is here for consistency, but frontend is actually using
+    async logout({}, ctx) {
+        if (!ctx.session)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
+        await (0, auth_1.setLoggedIn)(ctx, false);
+        // 401 is a convenient code for OK: the browser clears a possible http authentication (hopefully), and Admin automatically triggers login dialog
+        return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
+    },
+    refresh_session,
+    async change_srp({ username, salt, verifier }, ctx) {
+        const a = username && (0, perm_1.getAccount)(username);
+        const can = a && ((0, adminApis_1.ctxAdminAccess)(ctx) || username === (0, auth_1.getCurrentUsername)(ctx) && (0, perm_1.accountCanChangePassword)(a));
+        if (!can)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
+        if (!salt || !verifier)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'missing parameters');
+        await (0, perm_1.updateAccount)(a, a => (0, perm_1.saveSrpInfo)(a, salt, verifier));
+        delete a.require_password_change;
+        return {};
+    }
 };
-exports.change_my_srp = change_my_srp;

package/src/api.get_file_list.js

@@ -1,5 +1,8 @@
 "use strict";
 // This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.get_file_list = void 0;
 exports.paramsToFilter = paramsToFilter;
@@ -14,6 +17,7 @@ const connections_1 = require("./connections");
 const adminApis_1 = require("./adminApis");
 const upload_1 = require("./upload");
 const SendList_1 = require("./SendList");
+const events_1 = __importDefault(require("./events"));
 function paramsToFilter({ search, wild, searchComment, fileMask }) {
     search = String(search || '').toLocaleLowerCase();
     searchComment = String(searchComment || '').toLocaleLowerCase();
@@ -25,6 +29,7 @@ function paramsToFilter({ search, wild, searchComment, fileMask }) {
     };
 }
 const get_file_list = async ({ uri = '/', offset, limit, c, onlyFolders, onlyFiles, admin, ...rest }, ctx) => {
+    (0, misc_1.apiAssertTypes)({ string: { uri } });
     const node = await (0, vfs_1.urlToNode)(uri, ctx);
     const list = ctx.get('accept') === 'text/event-stream' ? new SendList_1.SendListReadable() : undefined;
     if (!node)
@@ -81,6 +86,8 @@ const get_file_list = async ({ uri = '/', offset, limit, c, onlyFolders, onlyFil
                 const res = await Promise.all(onDirEntryHandlers.map(cb => cb(cbParams)));
                 if (res.some(x => x === false))
                     continue;
+                if ((await events_1.default.emitAsync('dirEntry', cbParams))?.isDefaultPrevented())
+                    continue;
             }
             catch (e) {
                 console.log("a plugin with onDirEntry is causing problems:", e);

package/src/api.lang.js

@@ -43,6 +43,7 @@ const apis = {
         }
     },
     async add_langs({ langs }) {
+        (0, misc_1.apiAssertTypes)({ object: { langs } });
         for (let [code, content] of Object.entries(langs)) {
             code = (0, lang_1.file2code)(code);
             validateCode(code);

package/src/api.log.js

@@ -19,6 +19,7 @@ exports.default = {
         return { current, rotated: await (0, log_1.getRotatedFiles)() };
     },
     async get_log_file({ file = 'log', range = '' }, ctx) {
+        (0, misc_1.apiAssertTypes)({ string: { file, range } });
         const log = lodash_1.default.find(log_1.loggers, { name: file });
         if (!log)
             throw cross_1.HTTP_NOT_FOUND;
@@ -33,7 +34,8 @@ exports.default = {
         return null;
     },
     get_log({ file = 'log' }, ctx) {
-        const files = file.split('|'); // potentially more then one
+        (0, misc_1.apiAssertTypes)({ string: { file } });
+        const files = file.split('|'); // potentially more than one
         return new SendList_1.SendListReadable({
             bufferTime: 10,
             async doAtStart(list) {
@@ -58,10 +60,10 @@ exports.default = {
                     return list.ready();
                 }
                 // for other logs we only provide updates. Use get_log_file to download past content
-                if (lodash_1.default.some(files, x => !lodash_1.default.find(log_1.loggers, { name: x })))
+                if (lodash_1.default.some(files, x => !lodash_1.default.some(log_1.loggers, { name: x })))
                     return list.error(cross_1.HTTP_NOT_FOUND, true);
                 list.ready();
-                // unsubscribe when connection is interrupted
+                // unsubscribe when the connection is interrupted
                 ctx.res.once('close', events_1.default.on(files, x => list.add(Object.assign(lodash_1.default.pick(x.ctx, ['ip', 'method', 'status']), x, { ctx: undefined }))));
             }
         });

package/src/api.monitor.js

@@ -13,6 +13,11 @@ const SendList_1 = require("./SendList");
 const persistence_1 = require("./persistence");
 exports.default = {
     async disconnect({ ip, port, allButLocalhost }) {
+        (0, misc_1.apiAssertTypes)({
+            string_undefined: { ip },
+            number_undefined: { port },
+            boolean_undefined: { allButLocalhost },
+        });
         const match = allButLocalhost ? ((x) => !(0, misc_1.isLocalHost)(x.ip))
             : lodash_1.default.matches({ ip, port });
         const found = (0, connections_1.getConnections)().filter(c => match(getConnAddress(c)));

package/src/api.net.js

@@ -44,6 +44,7 @@ exports.default = {
         return {};
     },
     async map_port({ external, internal }) {
+        (0, misc_1.apiAssertTypes)({ number_undefined: { external, internal } });
         const { upnp, externalPort, internalPort } = await (0, nat_1.getNatInfo)();
         if (!upnp)
             return new apiMiddleware_1.ApiError(const_1.HTTP_SERVICE_UNAVAILABLE, "upnp failed");
@@ -64,6 +65,7 @@ exports.default = {
         return {};
     },
     async self_check({ url }) {
+        (0, misc_1.apiAssertTypes)({ string_undefined: { url } });
         if (url)
             return await (0, selfCheck_1.selfCheck)(url)
                 || new apiMiddleware_1.ApiError(const_1.HTTP_SERVICE_UNAVAILABLE);
@@ -79,6 +81,9 @@ exports.default = {
         return results.length ? results : new apiMiddleware_1.ApiError(const_1.HTTP_SERVICE_UNAVAILABLE);
     },
     async make_cert({ domain, email, altNames }) {
+        (0, misc_1.apiAssertTypes)({ string: { domain }, string_undefined: { email }, array_undefined: { altNames } });
+        if (altNames?.some((name) => typeof name !== 'string'))
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad altNames');
         await (0, acme_1.makeCert)(domain, email, altNames).catch(e => {
             throw new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, e.message || String(e));
         });