hfs 3.2.1 → 3.3.0-alpha1

package/src/adminApis.js

@@ -108,7 +108,7 @@ exports.adminApis = {
         });
         const res = await Promise.allSettled(ips.map(geo_1.ip2country));
         return {
-            codes: res.map(x => x.status === 'rejected' || x.value === '-' ? '' : x.value)
+            codes: res.map(x => x.status === 'rejected' ? '' : x.value)
         };
     },
     is_ip_blocked({ ips }) {
@@ -167,7 +167,7 @@ exports.adminApis = {
                 && await frpDebounced(),
         };
     },
-    async add_block({ merge, ip, expire, comment }) {
+    add_block({ merge, ip, expire, comment }) {
         (0, misc_1.apiAssertTypes)({
             string: { ip },
             string_undefined: { comment, expire },
@@ -186,6 +186,7 @@ exports.adminApis = {
         return { result: Boolean((0, misc_1.try_)(() => (0, misc_1.makeNetMatcher)(mask))) };
     },
 };
+// wrap every admin API so individual handlers cannot skip access control
 for (const [k, was] of (0, misc_1.typedEntries)(exports.adminApis))
     exports.adminApis[k] = ((params, ctx) => {
         if (ctxAdminAccess(ctx))
@@ -195,10 +196,10 @@ for (const [k, was] of (0, misc_1.typedEntries)(exports.adminApis))
             ? new SendList_1.SendListReadable({ doAtStart: x => x.error(const_1.HTTP_UNAUTHORIZED, true, props) })
             : new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, props);
     });
-exports.localhostAdmin = (0, config_1.defineConfig)('localhost_admin', true);
-exports.adminNet = (0, config_1.defineConfig)('admin_net', '', v => (0, misc_1.makeNetMatcher)(v, true));
-exports.favicon = (0, config_1.defineConfig)('favicon', '');
-exports.title = (0, config_1.defineConfig)('title', "File server");
+exports.localhostAdmin = (0, config_1.defineConfig)(misc_1.CFG.localhost_admin, true);
+exports.adminNet = (0, config_1.defineConfig)(misc_1.CFG.admin_net, '', v => (0, misc_1.makeNetMatcher)(v, true));
+exports.favicon = (0, config_1.defineConfig)(misc_1.CFG.favicon, '');
+exports.title = (0, config_1.defineConfig)(misc_1.CFG.title, "File server");
 function ctxAdminAccess(ctx) {
     if (preventAdminAccess(ctx))
         return false;

package/src/api.accounts.js

@@ -11,25 +11,29 @@ const const_1 = require("./const");
 const auth_1 = require("./auth");
 const misc_1 = require("./misc");
 const api_vfs_1 = require("./api.vfs");
-function prepareAccount(ac) {
-    return ac && {
+function serializeAccount(ac) {
+    if (!ac)
+        return;
+    const hasLogin = (0, perm_1.accountHasLoginMethod)(ac);
+    return {
         ...lodash_1.default.omit(ac, ['password', 'hashed_password', 'srp']),
         username: ac.username, // omit won't copy it because it's a hidden prop
         hasPassword: (0, perm_1.accountHasPassword)(ac),
-        isGroup: !(0, perm_1.accountHasLoginMethod)(ac),
+        isGroup: !hasLogin,
         adminActualAccess: (0, perm_1.accountCanLoginAdmin)(ac),
-        canLogin: (0, perm_1.accountHasLoginMethod)(ac) ? (0, perm_1.accountCanLogin)(ac) : undefined,
+        canLogin: hasLogin ? (0, perm_1.accountCanLogin)(ac) : undefined,
         canChangePassword: (0, perm_1.accountCanChangePassword)(ac),
         invalidated: auth_1.invalidateSessionBefore.get(ac.username),
         directMembers: Object.values(perm_1.accounts.get()).filter(a => a.belongs?.includes(ac.username)).map(x => x.username),
         members: (0, misc_1.with_)(Object.values(perm_1.accounts.get()), accounts => {
             const ret = [];
+            // breadth-first traversal follows indirect memberships and excludes already collected accounts
             let news = [ac.username];
             while (news.length) {
                 news = accounts.filter(a => !ret.includes(a.username) && a.belongs?.some(x => news.includes(x))).map(x => x.username);
                 ret.push(...news);
             }
-            return lodash_1.default.uniq(ret).sort();
+            return ret.sort();
         })
     };
 }
@@ -41,11 +45,11 @@ exports.default = {
     },
     get_account({ username }, ctx) {
         (0, misc_1.apiAssertTypes)({ string_undefined: { username } });
-        return prepareAccount((0, perm_1.getAccount)(username || (0, auth_1.getCurrentUsername)(ctx)))
+        return serializeAccount((0, perm_1.getAccount)(username || (0, auth_1.getCurrentUsername)(ctx)))
             || new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
     },
     get_accounts() {
-        return { list: (0, misc_1.onlyTruthy)(Object.values(perm_1.accounts.get()).map(prepareAccount)) };
+        return { list: (0, misc_1.onlyTruthy)(Object.values(perm_1.accounts.get()).map(serializeAccount)) };
     },
     get_admins() {
         return { list: lodash_1.default.filter(perm_1.accounts.get(), perm_1.accountCanLoginAdmin).map(ac => ac.username) };

package/src/api.auth.js

@@ -14,14 +14,18 @@ const auth_1 = require("./auth");
 const config_1 = require("./config");
 const events_1 = __importDefault(require("./events"));
 const misc_1 = require("./misc");
+const uploadOwners_1 = require("./uploadOwners");
 const node_crypto_1 = require("node:crypto");
 const ongoingLogins = {}; // store data that doesn't fit session object
-const keepSessionAlive = (0, config_1.defineConfig)('keep_session_alive', true);
+const keepSessionAlive = (0, config_1.defineConfig)(misc_1.CFG.keep_session_alive, true);
 const fakeSrpSecret = (0, node_crypto_1.randomBytes)(32);
 const refresh_session = async ({}, ctx) => {
+    if (!ctx.session)
+        return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
+    (0, uploadOwners_1.getSessionId)(ctx); // anonymous upload ownership must be bound before any abortible upload request
     const username = (0, auth_1.getCurrentUsername)(ctx);
     const isAdmin = (0, adminApis_1.ctxAdminAccess)(ctx) || undefined;
-    return !ctx.session ? new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR) : {
+    return {
         username,
         expandedUsername: Array.from((0, perm_1.expandUsername)(username)),
         isAdmin,
@@ -75,7 +79,7 @@ exports.authApis = {
             // keep the public handshake identifier independent of predictable application PRNG state
             const sid = (0, node_crypto_1.randomUUID)();
             ongoingLogins[sid] = srpServer;
-            setTimeout(() => delete ongoingLogins[sid], 60_000);
+            setTimeout(() => delete ongoingLogins[sid], 60_000); // client must complete api sequence (loginSrp2) within 1 minute or will be discarded to avoid memory leaks
             ctx.session.loggingIn = { username, sid }; // temporarily store until process is complete
             return rest;
         }
@@ -110,7 +114,7 @@ exports.authApis = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
         try {
             const M2 = await step1.step2(BigInt(pubKey), BigInt(proof))
-                .catch(() => { throw ''; });
+                .catch(() => { throw ''; }); // falsy value for later
             await (0, auth_1.setLoggedIn)(ctx, username);
             return {
                 proof: String(M2),
@@ -128,7 +132,6 @@ exports.authApis = {
             delete ongoingLogins[sid];
         }
     },
-    // this api is here for consistency, but frontend is actually using
     async logout({}, ctx) {
         if (!ctx.session)
             return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);

package/src/api.cert.js

@@ -17,7 +17,7 @@ exports.default = {
         cert.validity.notBefore = new Date();
         cert.validity.notAfter = new Date();
         cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
-        const attrs = Object.entries(attributes || {}).map(x => ({ name: x[0], value: x[1] }));
+        const attrs = Object.entries(attributes ?? {}).map(x => ({ name: x[0], value: x[1] }));
         cert.setSubject(attrs);
         cert.setIssuer(attrs);
         cert.sign(keys.privateKey);

package/src/api.get_file_list.js

@@ -75,7 +75,8 @@ const get_file_list = async ({ uri = '/', offset, limit, c, onlyFolders, onlyFil
         for await (const sub of walker) {
             let name = (0, vfs_1.getNodeName)(sub);
             name = (0, path_1.basename)(name) || name; // on Windows, basename('C:') === ''
-            if (filterName && !filterName(name) || fileMask && !(0, vfs_1.nodeIsFolder)(sub) && !fileMask(name)
+            if (filterName && !filterName(name)
+                || fileMask && !(0, vfs_1.nodeIsFolder)(sub) && !fileMask(name)
                 || filterComment && !filterComment(await (0, comments_1.getCommentFor)(sub.source) || ''))
                 continue;
             const entry = await nodeToDirEntry(ctx, sub);
@@ -83,7 +84,7 @@ const get_file_list = async ({ uri = '/', offset, limit, c, onlyFolders, onlyFil
                 continue;
             const cbParams = { entry, ctx, listUri: uri, node: sub };
             try {
-                const res = await Promise.all(onDirEntryHandlers.map(({ id, cb }) => Promise.resolve().then(() => cb(cbParams)).catch(error => { throw { id, error }; })));
+                const res = await Promise.all(onDirEntryHandlers.map(({ id, cb }) => (0, misc_1.callAsPromise)(() => cb(cbParams)).catch(error => { throw { id, error }; })));
                 if (res.some(x => x === false))
                     continue;
             }
@@ -146,7 +147,7 @@ const get_file_list = async ({ uri = '/', offset, limit, c, onlyFolders, onlyFil
             };
         }
         catch {
-            return null;
+            return null; // ignore files with problems
         }
         function filesInsideCould(n = node) {
             return (0, vfs_1.masksCouldGivePermission)(n.masks, 'can_read')

package/src/api.lang.js

@@ -48,8 +48,9 @@ const apis = {
             code = (0, lang_1.file2code)(code);
             validateCode(code);
             const fn = (0, lang_1.code2file)(code);
-            const s = content = String(content);
-            if (!(0, misc_1.tryJson)(s))
+            const s = String(content);
+            const o = (0, misc_1.tryJson)(s);
+            if (!o?.translate)
                 return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE, "bad content for file " + fn);
             await (0, promises_1.writeFile)(fn, s, 'utf8');
         }

package/src/api.monitor.js

@@ -47,7 +47,7 @@ exports.default = {
             connectionUpdated(conn, change) {
                 if (conn.socket.closed || lodash_1.default.isEmpty(change))
                     return;
-                if (change.ctx) {
+                if (change.ctx) { // serialize ctx once so all monitor subscribers reuse the resulting change
                     Object.assign(change, fromCtx(change.ctx));
                     change.ctx = undefined;
                 }

package/src/api.net.js

@@ -61,7 +61,7 @@ exports.default = {
         if (external)
             await (0, nat_1.getUpnpClient)().createMapping((0, nat_1.upnpMappingParam)(internal || internalPort, external))
                 .catch(res => {
-                throw new apiMiddleware_1.ApiError(res.errorCode || const_1.HTTP_SERVER_ERROR, res.errorCode === 718 ? "Port not available" : res.errorDescription || res.message || "unknown error");
+                throw new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, res.errorCode === 718 ? "Port not available" : res.errorDescription || res.message || "unknown error");
             });
         nat_1.mappedPort.set(external || 0); // remember only successful HFS mappings
         return {};
@@ -84,6 +84,8 @@ exports.default = {
     },
     async make_cert({ domain, email, altNames }) {
         (0, misc_1.apiAssertTypes)({ string: { domain }, string_undefined: { email }, array_undefined: { altNames } });
+        if (!domain)
+            return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad params');
         if (altNames?.some((name) => typeof name !== 'string'))
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad altNames');
         await (0, acme_1.makeCert)(domain, email, altNames).catch(e => {

package/src/api.plugins.js

@@ -169,6 +169,8 @@ const apis = {
     },
     async uninstall_plugin({ id, deleteConfig }) {
         assertPluginId(id);
+        if (!(0, plugins_1.getPluginInfo)(id))
+            return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
         await (0, plugins_1.stopPlugin)(id);
         await (0, promises_1.rm)(plugins_1.PATH + '/' + id, { recursive: true, force: true });
         if (deleteConfig)

package/src/api.vfs.js

@@ -26,7 +26,7 @@ async function urlToNodeOriginal(uri) {
 exports.default = {
     async get_vfs() {
         return { root: await recur() };
-        async function recur(node = vfs_1.vfs) {
+        async function recur(node = vfs_1.vfs.compiled()) {
             const { source } = node;
             const stats = await (0, vfs_1.nodeStats)(node);
             const isFolder = (0, vfs_1.nodeIsFolder)(node);
@@ -61,7 +61,7 @@ exports.default = {
                 return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad name');
             // check for siblings with the same name
             const parent = await urlToNodeOriginal((0, path_1.dirname)(uri));
-            if (parent?.children?.find(x => (0, vfs_1.getNodeName)(x) === props.name))
+            if (parent?.children?.find(x => x !== n && (0, vfs_1.isSameFilenameAs)(props.name)(x)))
                 return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT, 'name already present');
         }
         Object.assign(n, sanitizeVfsProps(props));
@@ -112,7 +112,7 @@ exports.default = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'name or source required');
         if (name && !(0, misc_1.isValidFileName)(name))
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad name');
-        const parentNode = parent ? await urlToNodeOriginal(parent) : vfs_1.vfs;
+        const parentNode = parent ? await urlToNodeOriginal(parent) : vfs_1.vfs.compiled();
         if (!parentNode)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'parent not found');
         if (!(0, vfs_1.nodeIsFolder)(parentNode))
@@ -190,9 +190,10 @@ exports.default = {
                             list.add({ n, k: 'd' });
                     }
                     catch (error) {
+                        list.error(String(error));
                         console.debug(error);
                     }
-                    return;
+                    return list.close();
                 }
                 const sendPropsAsap = (0, util_os_1.getDiskSpace)(path).then(x => x && list.props(x));
                 try {

package/src/apiMiddleware.js

@@ -12,6 +12,7 @@ const misc_1 = require("./misc");
 const const_1 = require("./const");
 const config_1 = require("./config");
 const plugins_1 = require("./plugins");
+const SendList_1 = require("./SendList");
 class ApiError extends Error {
     status;
     constructor(status, message) {
@@ -55,6 +56,9 @@ function apiMiddleware(apis) {
         }
         if (isAsyncGenerator(res))
             res = (0, misc_1.asyncGeneratorToReadable)(res);
+        // return the initial list as regular JSON when the caller did not request live updates
+        if (res instanceof SendList_1.SendListReadable && ctx.get('accept') !== 'text/event-stream')
+            res = await res.collectInitial();
         if (res instanceof stream_1.Readable) { // Readable, we'll go SSE-mode
             res.pipe((0, sse_1.default)(ctx));
             const resAsReadable = res; // satisfy ts
@@ -64,7 +68,7 @@ function apiMiddleware(apis) {
         }
         if (res instanceof ApiError)
             return send(res.status, res.message);
-        if (res instanceof Error) // generic error/exception
+        if (res instanceof Error) // generic error/exception. expose unexpected errors to help diagnose bugs reported by users
             return send(const_1.HTTP_BAD_REQUEST, res.stack || res.message || String(res));
         ctx.body = res;
         function send(status, body) {

package/src/auth.js

@@ -106,7 +106,10 @@ async function setLoggedIn(ctx, username) {
     if (!a)
         return;
     await events_1.default.emitAsync('finalizingLogin', { ctx, username, inputs: { ...ctx.state.params, ...ctx.query } });
-    s.username = (0, perm_1.normalizeUsername)(username);
+    const normalized = (0, perm_1.normalizeUsername)(username);
+    if (s.username !== normalized)
+        delete s.allowNet; // discard restrictions cached for another identity before replacing the session account
+    s.username = normalized;
     s.ts = Date.now();
     const k = cross_const_1.ALLOW_SESSION_IP_CHANGE;
     s[k] = k in ctx.query || Boolean(ctx.state.params?.[k]) || undefined; // login APIs will get ctx.state.params, others can rely on ctx.query

package/src/basicWeb.js

@@ -13,7 +13,7 @@ const misc_1 = require("./misc");
 const lodash_1 = __importDefault(require("lodash"));
 const adminApis_1 = require("./adminApis");
 const customHtml_1 = require("./customHtml");
-const autoBasic = (0, config_1.defineConfig)('auto_basic', true, v => lodash_1.default.isString(v) ? new RegExp(v, 'i') : null);
+const autoBasic = (0, config_1.defineConfig)(misc_1.CFG.auto_basic, true, v => lodash_1.default.isString(v) ? new RegExp(v, 'i') : null);
 function basicWeb(ctx, node) {
     const { get } = ctx.query;
     if (get === 'login') {

package/src/block.js

@@ -13,16 +13,17 @@ const connections_1 = require("./connections");
 const misc_1 = require("./misc");
 const net_1 = require("net");
 const lodash_1 = __importDefault(require("lodash"));
-exports.block = (0, config_1.defineConfig)('block', [], rules => {
+exports.block = (0, config_1.defineConfig)(misc_1.CFG.block, [], rules => {
     const now = new Date();
     const ret = !Array.isArray(rules) ? []
         : (0, misc_1.onlyTruthy)(rules.map(rule => {
             rule.expire &&= new Date(rule.expire);
             return !rule.disabled && (rule.expire || now) >= now && (0, misc_1.makeNetMatcher)(rule.ip);
         }));
-    // reapply new block to existing connections
-    for (const { socket, ip } of (0, connections_1.getConnections)())
-        applyBlock(socket, ip);
+    setTimeout(() => {
+        for (const { socket, ip } of (0, connections_1.getConnections)()) // reapply new block to existing connections
+            applyBlock(socket, ip);
+    });
     return ret;
 });
 function applyBlock(socket, ip = (0, connections_1.normalizeIp)(socket.remoteAddress || '')) {

package/src/commands.js

@@ -54,7 +54,8 @@ const api_monitor_1 = __importStar(require("./api.monitor"));
 const connections_1 = require("./connections");
 const argv_1 = require("./argv");
 const listen_2 = require("./listen");
-let debugEnabled = argv_1.argv.debug || process.env.HFS_DEBUG || const_1.DEV;
+const debug = (0, config_1.defineConfig)(cross_1.CFG.debug, Boolean(argv_1.argv.debug || process.env.HFS_DEBUG || const_1.DEV));
+debug.dontStore();
 if (!argv_1.argv.updating && !config_1.showHelp) {
     try {
         // Not sure if the try is necessary for when stdin is unavailable, but someone reported a problem using nohup https://github.com/rejetto/hfs/issues/74 and I've found this example try-catching https://github.com/DefinitelyTyped/DefinitelyTyped/blob/dda83a906914489e09ca28afea12948529015d4a/types/node/readline.d.ts#L489
@@ -80,7 +81,7 @@ if (!argv_1.argv.updating && !config_1.showHelp) {
         for (const k of ['log', 'warn', 'error', 'debug']) {
             const original = console[k];
             console[k] = (...args) => {
-                if (k === 'debug' && !debugEnabled)
+                if (k === 'debug' && !debug.get())
                     return;
                 if (!first_1.quitting && tty)
                     clean();
@@ -96,7 +97,7 @@ if (!argv_1.argv.updating && !config_1.showHelp) {
     catch {
         console.log("Console commands not available");
         const original = console.debug;
-        console.debug = (...args) => debugEnabled && original(...args);
+        console.debug = (...args) => debug.get() && original(...args);
     }
 }
 async function parseCommandLine(line) {
@@ -198,8 +199,8 @@ const commands = {
     debug: {
         params: '',
         cb() {
-            debugEnabled = !debugEnabled;
-            console.log(`Debug messages ${debugEnabled ? "on" : "off"}`);
+            debug.set(v => !v);
+            console.log(`Debug messages ${debug.get() ? "on" : "off"}`);
         }
     },
     'start-plugin': {

package/src/comments.js

@@ -16,15 +16,16 @@ const misc_1 = require("./misc");
 const lodash_1 = __importDefault(require("lodash"));
 const iconv_lite_1 = __importDefault(require("iconv-lite"));
 const promises_1 = require("node:fs/promises");
+const promises_2 = require("stream/promises");
 const expiringCache_1 = require("./expiringCache");
 exports.DESCRIPT_ION = 'descript.ion';
 exports.DESCRIPT_ION_ALT = 'DESCRIPT.ION';
 const commentsStorage = (0, config_1.defineConfig)(cross_1.CFG.comments_storage, '', v => ['', 'attr+ion'].includes(v)); // compiled tell us if we are using descript.ion
-(0, config_1.defineConfig)('descript_ion', true, (v, more) => {
+(0, config_1.defineConfig)(cross_1.CFG.descript_ion, true, (v, more) => {
     if (!v && more.version?.olderThan('0.57.0-alpha1'))
         commentsStorage.set('attr');
 });
-const descriptIonEncoding = (0, config_1.defineConfig)('descript_ion_encoding', 'utf8');
+const descriptIonEncoding = (0, config_1.defineConfig)(cross_1.CFG.descript_ion_encoding, 'utf8');
 function readFromDescriptIon(path) {
     return usingDescriptIon() && readDescriptIon((0, path_1.dirname)(path)).then(x => x.get((0, path_1.basename)(path)), () => undefined);
 }
@@ -39,16 +40,29 @@ async function getCommentFor(path) {
     ]).then(([fromAttr, fromIon]) => fromAttr || fromIon || undefined);
 }
 async function setCommentFor(path, comment) {
-    if (commentsStorage.get()) {
-        await (0, misc_1.storeFileAttr)(path, COMMENT_ATTR, comment || undefined);
-        return setCommentDescriptIon(path, '');
+    if (commentsStorage.get())
+        return prep((0, misc_1.storeFileAttr)(path, COMMENT_ATTR, comment || undefined)).then(v => {
+            if (v)
+                void setCommentDescriptIon(path, '').catch(() => { });
+            return v;
+        });
+    // should we also remove from file-attr, similarly as above we remove from descript.ion? not sure, but for the time we won't because #1 storeFileAttr is not really deleting, and we would store a lot of empty attributes, #2 more people will switch from descript.ion to attr (because introduced later) than the opposite
+    return prep(setCommentDescriptIon(path, comment));
+    function prep(p) {
+        return p.then(v => v !== false, (e) => {
+            console.error(`${comment ? "Error setting comment" : "Error removing comment"}: ${String(e)}`);
+            return false;
+        });
     }
-    return setCommentDescriptIon(path, comment); // should we also remove from file-attr? not sure, but for the time we won't because #1 storeFileAttr is not really deleting, and we would store a lot of empty attributes, #2 more people will switch from descript.ion to attr (because introduced later) than the opposite
 }
-const setCommentDescriptIon = (0, misc_1.singleWorkerFromBatchWorker)(async (jobs) => {
-    const byFolder = lodash_1.default.groupBy(jobs, job => (0, path_1.dirname)(job[0]));
-    return Promise.allSettled(lodash_1.default.map(byFolder, async (jobs, folder) => {
-        const comments = await readDescriptIon(folder).catch(() => new Map());
+const setCommentDescriptIon = (0, misc_1.singleWorkerFromBatchWorker)((jobs) => {
+    const byFolder = lodash_1.default.groupBy(jobs, job => (0, path_1.dirname)(job[0])); // jobs in the same folder share one write and its success or failure
+    const resultByFolder = lodash_1.default.mapValues(byFolder, async (jobs, folder) => {
+        const comments = await readDescriptIon(folder).catch(e => {
+            if (e?.code !== 'ENOENT')
+                throw e;
+            return new Map();
+        });
         for (const [path, comment] of jobs) {
             const file = path.slice(folder.length + 1);
             if (!comment)
@@ -58,7 +72,7 @@ const setCommentDescriptIon = (0, misc_1.singleWorkerFromBatchWorker)(async (job
         }
         const path = await filePathHelper(folder);
         if (!comments.size)
-            return (0, promises_1.unlink)(path);
+            return (0, promises_1.rm)(path, { force: true });
         // encode comments in descript.ion format
         const ws = await (0, util_files_1.createSafeWriteStream)(path);
         comments.forEach((comment, filename) => {
@@ -70,8 +84,10 @@ const setCommentDescriptIon = (0, misc_1.singleWorkerFromBatchWorker)(async (job
                 ws.write(MULTILINE_SUFFIX, 'binary');
             ws.write('\n');
         });
-        await new Promise(res => ws.end(res));
-    }));
+        ws.end();
+        await (0, promises_2.finished)(ws);
+    });
+    return jobs.map(([path]) => resultByFolder[(0, path_1.dirname)(path)]);
 });
 function areCommentsEnabled() {
     return true; // true since we introduced comments in file-attr

package/src/config.js

@@ -12,6 +12,7 @@ exports.getWholeConfig = getWholeConfig;
 exports.setConfig = setConfig;
 exports.subMultipleConfigs = subMultipleConfigs;
 const const_1 = require("./const");
+const cross_const_1 = require("./cross-const");
 const watchLoad_1 = require("./watchLoad");
 const yaml_1 = __importDefault(require("yaml"));
 const lodash_1 = __importDefault(require("lodash"));
@@ -25,6 +26,7 @@ const argv_1 = require("./argv");
 const util_files_1 = require("./util-files");
 // keep definition of config properties
 const configProps = {};
+const dontStore = [];
 let started = false; // this will tell the difference for subscribeConfig()s that are called before or after config is loaded
 let state = {}; // current state of config properties
 const filePath = (0, cross_1.with_)(argv_1.argv.config || process.env.HFS_CONFIG, p => {
@@ -62,7 +64,7 @@ class Version extends String {
 exports.Version = Version;
 const CONFIG_CHANGE_EVENT_PREFIX = 'config.';
 exports.currentVersion = new Version(const_1.VERSION);
-const configVersion = defineConfig('version', const_1.VERSION, v => new Version(v));
+const configVersion = defineConfig(cross_const_1.CFG.version, const_1.VERSION, v => new Version(v));
 function defineConfig(k, defaultValue, compiler) {
     configProps[k] = { defaultValue };
     const object = {
@@ -104,7 +106,8 @@ function defineConfig(k, defaultValue, compiler) {
             compiled = v;
             const was = getConfig(k);
             return events_1.default.emitAsync(CONFIG_CHANGE_EVENT_PREFIX + k, was, was, const_1.VERSION, true);
-        }
+        },
+        dontStore() { dontStore.push(k); },
     };
     let compiled = compiler?.(defaultValue, { k, version: exports.currentVersion, defaultValue, object });
     if (compiler)
@@ -185,11 +188,11 @@ const saveDebounced = (0, debounceAsync_1.debounceAsync)(async () => {
     const aWeekAgo = Date.now() - cross_1.DAY * 7;
     if (await (0, util_files_1.statWithTimeout)(bak).then(x => aWeekAgo > x.mtimeMs, () => true))
         await (0, promises_1.copyFile)(filePath, bak).catch(() => { }); // ignore errors
-    await exports.configFile.save(stringify({
+    await exports.configFile.save(stringify(lodash_1.default.omit({
         ...state,
         version: const_1.VERSION,
         platform: `${process.platform}-${process.arch}${(0, cross_1.prefix)('-', !const_1.IS_BINARY && (0, path_1.basename)(process.execPath))}`,
-    })).catch(err => console.error('Failed at saving config file, please ensure it is writable.', String(err)));
+    }, dontStore))).catch(err => console.error('Failed at saving config file, please ensure it is writable.', String(err)));
 });
 const saveConfigAsap = () => void saveDebounced();
 exports.saveConfigAsap = saveConfigAsap;

package/src/connections.js

@@ -95,8 +95,9 @@ function disconnect(what, logMessage = '') {
         console.debug("Disconnection:", logMessage, ip);
     (0, geo_1.ip2country)(ip).then(res => {
         const rec = { ip, country: res || undefined, ts: new Date, msg: logMessage || undefined };
-        exports.disconnectionsLog.unshift(rec);
-        exports.disconnectionsLog.length = Math.min(1000, exports.disconnectionsLog.length);
+        exports.disconnectionsLog.push(rec);
+        if (exports.disconnectionsLog.length > 1000)
+            exports.disconnectionsLog.shift();
         events_1.default.emit('disconnection', rec);
     });
     return what.destroy();

package/src/consoleLog.js

@@ -11,7 +11,11 @@ const fs_1 = require("fs");
 const argv_1 = require("./argv");
 exports.consoleLog = [];
 const originalConsoleLog = console.log;
-const f = argv_1.argv.consoleFile ? (0, fs_1.createWriteStream)(argv_1.argv.consoleFile, { flags: 'a', encoding: 'utf8' }) : null;
+let f = argv_1.argv.consoleFile ? (0, fs_1.createWriteStream)(argv_1.argv.consoleFile, { flags: 'a', encoding: 'utf8' }) : null;
+f?.on('error', err => {
+    f = null; // stop using a failed stream so later logs cannot repeat the same error
+    console.error("Cannot write console file", argv_1.argv.consoleFile, String(err));
+});
 let terminalOutputBroken = false;
 for (const stream of [process.stdout, process.stderr])
     stream.on('error', err => {

package/src/cross-const.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HTTP_MESSAGES = exports.HTTP_INSUFFICIENT_STORAGE = exports.HTTP_SERVICE_UNAVAILABLE = exports.HTTP_SERVER_ERROR = exports.HTTP_TOO_MANY_REQUESTS = exports.HTTP_FAILED_DEPENDENCY = exports.HTTP_LOCKED = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_PRECONDITION_FAILED = exports.HTTP_LENGTH_REQUIRED = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_MOVED_PERMANENTLY = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_CREATED = exports.HTTP_OK = exports.BASIC_AUTHENTICATE_HEADER = exports.EMBEDDED_LANGUAGE = exports.MASK_IN_TESTS = exports.HIDE_IN_TESTS = exports.ALLOW_SESSION_IP_CHANGE = exports.PREVIOUS_TAG = exports.MTIME_CHECK = exports.UPLOAD_TEMP_HASH = exports.HFS_REPO = exports.PLUGIN_CUSTOM_REST_PREFIX = exports.NBSP = exports.PORT_DISABLED = exports.ICONS_URI = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = void 0;
+exports.HTTP_MESSAGES = exports.HTTP_INSUFFICIENT_STORAGE = exports.HTTP_SERVICE_UNAVAILABLE = exports.HTTP_SERVER_ERROR = exports.HTTP_TOO_MANY_REQUESTS = exports.HTTP_FAILED_DEPENDENCY = exports.HTTP_LOCKED = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_PRECONDITION_FAILED = exports.HTTP_LENGTH_REQUIRED = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_MOVED_PERMANENTLY = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_CREATED = exports.HTTP_OK = exports.CFG = exports.BASIC_AUTHENTICATE_HEADER = exports.EMBEDDED_LANGUAGE = exports.MASK_IN_TESTS = exports.HIDE_IN_TESTS = exports.ALLOW_SESSION_IP_CHANGE = exports.PREVIOUS_TAG = exports.MTIME_CHECK = exports.UPLOAD_TEMP_HASH = exports.UPLOAD_TEMP_PREFIX = exports.HFS_REPO = exports.PLUGIN_CUSTOM_REST_PREFIX = exports.NBSP = exports.PORT_DISABLED = exports.ICONS_URI = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = void 0;
 exports.SPECIAL_URI = '/~/';
 exports.FRONTEND_URI = exports.SPECIAL_URI + 'frontend/';
 exports.ADMIN_URI = exports.SPECIAL_URI + 'admin/';
@@ -11,6 +11,7 @@ exports.PORT_DISABLED = -1;
 exports.NBSP = '\xA0';
 exports.PLUGIN_CUSTOM_REST_PREFIX = '_';
 exports.HFS_REPO = 'rejetto/hfs';
+exports.UPLOAD_TEMP_PREFIX = 'hfs$upload-';
 exports.UPLOAD_TEMP_HASH = 'upload-temp-hash';
 exports.MTIME_CHECK = 'x-mtime-check';
 exports.PREVIOUS_TAG = 'previous';
@@ -19,6 +20,31 @@ exports.HIDE_IN_TESTS = 'hideInTests'; // elements that have variable size, wher
 exports.MASK_IN_TESTS = 'maskInTests';
 exports.EMBEDDED_LANGUAGE = 'en'; // frontend includes this language in the code, and not need to import the translation-json
 exports.BASIC_AUTHENTICATE_HEADER = 'Basic realm="HFS"';
+exports.CFG = constMap([
+    'accounts', 'acme_domain', 'acme_renew', 'admin_net', 'allowed_referer',
+    'authorization_header', 'auto_basic', 'auto_check_update', 'auto_play_seconds',
+    'base_url', 'block', 'cache_control_disk_files', 'cert', 'comments_storage',
+    'create-admin', 'debug', 'delete_unfinished_uploads_after', 'descript_ion',
+    'descript_ion_encoding', 'disable_custom_html', 'disableTranslation', 'dont_log_net',
+    'dont_overwrite_uploading', 'dynamic_dns_url', 'enable_plugins', 'error_log',
+    'favicon', 'file_menu_on_link', 'file_timeout', 'folders_first', 'force_address',
+    'force_https', 'force_lang', 'force_webdav_login',
+    'geo_allow', 'geo_allow_unknown', 'geo_enable', 'geo_ignore_net', 'geo_list',
+    'ignore_proxies', 'invert_order', 'keep_session_alive', 'listen_interface',
+    'localhost_admin', 'log', 'log_api', 'log_gui', 'log_host', 'log_rotation', 'log_spam',
+    'log_ua', 'mapped_port', 'max_downloads', 'max_downloads_per_account',
+    'max_downloads_per_ip', 'max_kbps', 'max_kbps_per_ip', 'menu_at_top', 'mime',
+    'min_available_mb', 'open_browser_at_start', 'outbound_interface', 'outbound_proxy', 'own_upload_delete_hours',
+    'page_size', 'plugins_config', 'port', 'private_key', 'proxies', 'roots', 'server_code',
+    'session_duration', 'show_hidden_files', 'show_uploader', 'size_1024',
+    'smart_unc_folder_detection', 'sort_by', 'sort_numerics', 'split_uploads',
+    'suspend_plugins', 'theme', 'tile_size', 'title', 'title_with_path', 'track_ips',
+    'update_to_beta', 'upnp_enabled', 'version', 'vfs', 'webdav_initial_auth',
+    'zip_calculate_size_for_seconds', 'https_port'
+]);
+function constMap(a) {
+    return Object.fromEntries(a.map(x => [x, x]));
+}
 exports.HTTP_OK = 200;
 exports.HTTP_CREATED = 201;
 exports.HTTP_NO_CONTENT = 204;