hfs 3.3.0-beta2 → 3.3.0-beta3

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "hfs",
-  "version": "3.3.0-beta2",
+  "version": "3.3.0-beta3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hfs",
-      "version": "3.3.0-beta2",
+      "version": "3.3.0-beta3",
       "license": "GPL-3.0",
       "dependencies": {
         "@gregoranders/csv": "^0.0.13",
@@ -1710,9 +1710,9 @@
       }
     },
     "node_modules/pvutils": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.1.5.tgz",
-      "integrity": "sha512-KTqnxsgGiQ6ZAzZCVlJH5eOjSnvlyEgx1m8bkRJfOhmGRqfo5KLvmAlACQkrjEtOQ4B7wF9TdSLIs9O90MX9xA==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
+      "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hfs",
-  "version": "3.3.0-beta2",
+  "version": "3.3.0-beta3",
   "description": "HTTP File Server",
   "keywords": [
     "file server",

package/src/vfs.js

@@ -261,6 +261,8 @@ function nodeIsFolder(node) {
 }
 // we mark folder paths with a final slash – the UI already does so, but the config may be modified
 function persistFolderMarker(node) {
+    if ('original' in node && !node.original)
+        return; // disk-derived nodes are temporary and must not persist VFS changes
     const stored = node.original || node; // temporary VFS nodes must update their stored original for saveVfs to persist the marker
     if (!stored.source || (0, misc_1.hasFinalSlash)(stored.source))
         return;

package/src/watchLoad.js

@@ -19,6 +19,8 @@ function watchLoad(path, parser, { failedOnFirstAttempt, immediateFirst } = {})
     let last;
     const emitter = new events_1.BetterEventEmitter();
     const save = (0, debounceAsync_1.debounceAsync)(async (data, { reparse = false } = {}) => {
+        if (doing)
+            await debounced.isWorking();
         await promises_1.default.writeFile(path, data, 'utf8');
         last = data;
         if (reparse)
@@ -59,9 +61,10 @@ function watchLoad(path, parser, { failedOnFirstAttempt, immediateFirst } = {})
     async function load() {
         if (doing)
             return;
+        const saving = save.flush(); // saves started after this handoff wait for the read, while we wait only for the save captured here
         doing = true;
         try {
-            await save.flush(); // apply pending saves first
+            await saving; // apply pending saves first
             const text = await (0, util_files_1.readFileWithBusyRetry)(path).catch(e => {
                 if (e.code === 'EPERM')
                     console.error("Missing permissions on file", path); // warn user, who could be clueless about this problem

package/src/webdav.js

@@ -452,14 +452,18 @@ async function applyProppatchProp(prop, node, path, ctx) {
     const k = prop.name.toLowerCase();
     if (PROPPATCH_PROTECTED_LIVE_PROPS.has(k))
         return cross_1.HTTP_FORBIDDEN;
-    if (node.source && (PROPPATCH_UTIME_PROPS.has(k) || const_1.IS_WINDOWS && k === 'win32fileattributes')) {
-        // WebDAV clients patch metadata right after upload; outside that short same-username grace, metadata writes are file modifications
-        const missingWritePerm = canOverwrite.has(path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx))) ? 0
-            : (0, vfs_1.statusCodeForMissingPerm)(node, 'can_delete', ctx, false);
-        if (missingWritePerm)
-            return missingWritePerm;
-    }
-    if (node.source && PROPPATCH_UTIME_PROPS.has(k)) {
+    if (!PROPPATCH_UTIME_PROPS.has(k)
+        && !(const_1.IS_WINDOWS && k === 'win32fileattributes'))
+        return cross_1.HTTP_OK; // PROPPATCH is only persisted when HFS gets real dead-property storage; no-op success keeps Windows and macOS clients from aborting writes
+    const { source } = node;
+    if (!source)
+        return cross_1.HTTP_FORBIDDEN;
+    // WebDAV clients patch metadata right after upload; outside that short same-username grace, metadata writes are file modifications
+    const missingWritePerm = canOverwrite.has(path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx))) ? 0
+        : (0, vfs_1.statusCodeForMissingPerm)(node, 'can_delete', ctx, false);
+    if (missingWritePerm)
+        return missingWritePerm;
+    if (PROPPATCH_UTIME_PROPS.has(k)) {
         const date = new Date(String(prop.value));
         if (isNaN(Number(date)))
             return cross_1.HTTP_BAD_REQUEST;
@@ -467,18 +471,17 @@ async function applyProppatchProp(prop, node, path, ctx) {
         const atime = k === 'win32lastaccesstime' ? date : stats?.atime ?? new Date();
         const mtime = k === 'win32lastmodifiedtime' ? date : stats?.mtime ?? new Date();
         // WebDAV clients often use dead properties for file times; apply the portable subset instead of only pretending success
-        await (0, promises_1.utimes)(node.source, atime, mtime);
+        await (0, promises_1.utimes)(source, atime, mtime);
     }
-    if (node.source && const_1.IS_WINDOWS && k === 'win32fileattributes') {
+    else {
         const attributes = parseWindowsFileAttributes(prop.value);
         if (attributes === undefined)
             return cross_1.HTTP_BAD_REQUEST;
         // fswin is already our Windows attribute bridge; this keeps PROPPATCH metadata aligned with the actual filesystem
-        const ok = await new Promise(resolve => fswin_1.default.setAttributes(node.source, lodash_1.default.mapValues(WINDOWS_FILE_ATTRIBUTE_FLAGS, flag => Boolean(attributes & flag)), ok => resolve(Boolean(ok))));
+        const ok = await new Promise(resolve => fswin_1.default.setAttributes(source, lodash_1.default.mapValues(WINDOWS_FILE_ATTRIBUTE_FLAGS, flag => Boolean(attributes & flag)), ok => resolve(Boolean(ok))));
         if (!ok)
             return cross_1.HTTP_SERVER_ERROR;
     }
-    // PROPPATCH is only persisted when HFS gets real dead-property storage; no-op success keeps Windows and macOS clients from aborting writes
     return cross_1.HTTP_OK;
 }
 function parseWindowsFileAttributes(v) {