hfs 3.3.2 → 3.4.0-alpha1

package/src/log.js

@@ -48,6 +48,7 @@ const lodash_1 = __importDefault(require("lodash"));
 const util_files_1 = require("./util-files");
 const auth_1 = require("./auth");
 const misc_1 = require("./misc");
+const vfs_1 = require("./vfs");
 const path_1 = require("path");
 const yazl_1 = __importDefault(require("yazl"));
 const promises_1 = require("stream/promises");
@@ -109,6 +110,7 @@ const logRotation = (0, config_1.defineConfig)(misc_1.CFG.log_rotation, 'weekly'
 const dontLogNet = (0, config_1.defineConfig)(misc_1.CFG.dont_log_net, '127.0.0.1|::1', v => (0, misc_1.makeNetMatcher)(v));
 const logUA = (0, config_1.defineConfig)(misc_1.CFG.log_ua, false);
 const logSpam = (0, config_1.defineConfig)(misc_1.CFG.log_spam, false);
+const logSpamRegex = (0, config_1.defineConfig)(misc_1.CFG.log_spam_regex, /wlwmanifest.xml$|\.(php|asp)$|cgi|robots.txt$/.source, v => v ? new RegExp(v) : null);
 const logHost = (0, config_1.defineConfig)(misc_1.CFG.log_host, false);
 const debounce = lodash_1.default.debounce(cb => cb(), 1000); // with this technique, i'll be able to debounce some code respecting the references in its closure
 const logMw = async (ctx, next) => {
@@ -122,7 +124,9 @@ const logMw = async (ctx, next) => {
     if (!logSpam.get()
         && (ctx.querystring.includes('{.exec|') // v2's bug
             // requests generated by security scanners, other bots, and macos' finder
-            || ctx.status === misc_1.HTTP_NOT_FOUND && /wlwmanifest.xml$|\.(php)$|cgi|robots.txt$/.test(ctx.path))) {
+            || logSpamRegex.compiled()?.test(ctx.path)
+                && (ctx.status === misc_1.HTTP_NOT_FOUND
+                    || ctx.status === misc_1.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD && !await (0, vfs_1.urlToNode)(ctx.path, ctx)))) {
         events_2.default.emit('spam', ctx);
         return;
     }
@@ -140,6 +144,8 @@ const logMw = async (ctx, next) => {
         let { stream, last, path } = logger;
         if (!stream)
             return;
+        if (events_2.default.emit('beforeLog', { ctx })?.isDefaultPrevented())
+            return;
         const rotate = logRotation.get()?.[0];
         const reqEnd = logger.last = new Date();
         if (rotate && last) { // rotation enabled and a file exists?

package/src/middlewares.js

@@ -10,6 +10,9 @@ exports.failAllowNet = failAllowNet;
 const koa_compress_1 = __importDefault(require("koa-compress"));
 const const_1 = require("./const");
 const misc_1 = require("./misc");
+const node_crypto_1 = require("node:crypto");
+const lang_1 = require("./lang");
+const i18n_1 = require("./i18n");
 const stream_1 = require("stream");
 const block_1 = require("./block");
 const perm_1 = require("./perm");
@@ -64,12 +67,50 @@ const someSecurity = (ctx, next) => {
         const { URL } = ctx;
         URL.protocol = 'https';
         URL.port = (0, listen_1.getHttpsWorkingPort)();
-        ctx.status = 307; // this ensures the client doesn't switch to a simpler GET request
+        ctx.status = const_1.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD; // this ensures the client doesn't switch to a simpler GET request
         return ctx.redirect(URL.href);
     }
+    const page = ctx.state.urlLoginPage;
+    if (page)
+        return sendUrlLoginPage(page.cleanUrl, page.username);
     return next();
+    function sendUrlLoginPage(cleanUrl, username) {
+        return sendPage(ctx, username === undefined ? 'login_bad_credentials' : 'Confirm', t => {
+            if (username === undefined)
+                return `<script>history.replaceState(null,'',location.pathname)</script>
+                    <p><a href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Continue'))}</a></p>`;
+            const token = (0, node_crypto_1.randomUUID)();
+            (ctx.session ??= {}).urlLoginConfirmation = {
+                token,
+                username,
+                expires: Date.now() + 5 * 60_000,
+            };
+            return `<p>${(0, misc_1.escapeHTML)(t('confirm_url_login', { username }))}</p>
+                <p><strong><a class="confirm" href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Continue'))}</a></strong>
+                <a href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Cancel'))}</a></p>
+                <script>
+                    const loginUrl=new URL(location.href);
+                    history.replaceState(null,'',loginUrl.pathname);
+                    document.querySelector('.confirm').onclick=ev=>{ev.preventDefault();loginUrl.searchParams.set('login_confirm','${token}');location.replace(loginUrl)}
+                </script>`;
+        });
+    }
 };
 exports.someSecurity = someSecurity;
+async function sendPage(ctx, titleKey, content) {
+    const { t } = (0, i18n_1.i18nFromTranslations)(await (0, lang_1.getLangData)(ctx));
+    const title = t(titleKey);
+    ctx.status = 200;
+    ctx.type = 'html';
+    ctx.set('cache-control', 'no-store');
+    ctx.set('referrer-policy', 'no-referrer');
+    ctx.set('content-security-policy', "frame-ancestors 'none'");
+    ctx.set('x-frame-options', 'DENY');
+    ctx.body = `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+        <title>${(0, misc_1.escapeHTML)(title)}</title><style>
+        body{margin-top:30vh;text-align:center;font-family:sans-serif}a{margin:1em}
+        </style></head><body><h1>${(0, misc_1.escapeHTML)(title)}</h1>${content(t)}</body></html>`;
+}
 function enforceSessionIp(ctx) {
     const s = ctx.session;
     if (!s?.username || s[misc_1.ALLOW_SESSION_IP_CHANGE])
@@ -89,7 +130,7 @@ function getProxyDetected() {
 }
 const prepareState = async (ctx, next) => {
     // normalize once so auth, filters and logging agree on the same client address
-    ctx.request.ip = (0, connections_1.normalizeIp)(ctx.ip);
+    ctx.request.ip = (0, misc_1.normalizeIp)(ctx.ip);
     // invalidate before account resolution; someSecurity calls again to bind logins made below
     enforceSessionIp(ctx);
     // rootsMiddleware consults proxy-aware admin access before someSecurity runs
@@ -115,7 +156,9 @@ const prepareState = async (ctx, next) => {
     ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     // explicit credentials and existing sessions must take precedence, so a matching IP cannot override a chosen account
     let via;
-    let a = await urlLogin() || await getHttpAccount() || !s?.username && autoLogin();
+    const urlAccount = await urlLogin();
+    let a = ctx.state.urlLoginPage ? undefined
+        : urlAccount || await getHttpAccount() || !s?.username && autoLogin();
     const loggedInNotBySession = a;
     ctx.state.account = a ||= (0, perm_1.getAccount)(s?.username, false); // with least precedence, we consider session
     if (a)
@@ -137,14 +180,43 @@ const prepareState = async (ctx, next) => {
     ctx.state.revProxyPath = ctx.get('x-forwarded-prefix');
     (0, connections_1.updateConnectionForCtx)(ctx);
     await next();
-    function urlLogin() {
+    async function urlLogin() {
         via = 'url';
         const { login } = ctx.query;
         if (!login)
             return;
         const [u, p] = (0, misc_1.splitAt)(':', String(login));
-        ctx.redirect(ctx.originalUrl.slice(0, -ctx.querystring.length - 1)); // redirect to hide credentials
-        return u && (0, auth_1.clearTextLogin)(ctx, u, p, 'url');
+        const cleanUrl = ctx.originalUrl.slice(0, -ctx.querystring.length - 1);
+        const token = String(ctx.query.login_confirm || '');
+        const pending = s?.urlLoginConfirmation;
+        const confirmed = Boolean(token && pending?.token === token && pending.username === u
+            && pending.expires > Date.now());
+        if (token && s)
+            delete s.urlLoginConfirmation; // confirmation tokens are single-use, including failed attempts
+        if (!confirmed && needsConfirmation(u)) {
+            ctx.state.urlLoginPage = { username: u, cleanUrl };
+            return;
+        }
+        if (s)
+            delete s.urlLoginConfirmation;
+        const account = u && await (0, auth_1.clearTextLogin)(ctx, u, p, 'url');
+        if (!account && confirmed)
+            ctx.state.urlLoginPage = { cleanUrl };
+        else
+            ctx.redirect(cleanUrl); // redirect to hide credentials
+        return account;
+        function needsConfirmation(username) {
+            if (ctx.get('sec-fetch-mode') !== 'navigate' && !/^Mozilla\//.test(ctx.get('user-agent')))
+                return false;
+            const current = s?.username;
+            if (current)
+                return (0, perm_1.getAccount)(username)?.username !== (0, perm_1.getAccount)(current)?.username;
+            const fetchSite = ctx.get('sec-fetch-site');
+            if (fetchSite)
+                return fetchSite === 'same-site' || fetchSite === 'cross-site';
+            const referer = ctx.get('referer');
+            return !referer || (0, misc_1.try_)(() => new URL(referer).host.toLowerCase() !== ctx.host.toLowerCase(), () => true);
+        }
     }
     function getHttpAccount() {
         via = 'header';
@@ -167,20 +239,19 @@ const prepareState = async (ctx, next) => {
 };
 exports.prepareState = prepareState;
 function failAllowNet(ctx, a) {
-    // a cached mask is valid only for the identity that stored it
-    const sameAccount = ctx.session?.username === (0, perm_1.normalizeUsername)(a?.username || '');
-    const cached = sameAccount ? ctx.session?.allowNet : undefined;
-    const mask = cached ?? (0, perm_1.getFromAccount)(a || '', a => a.allow_net);
-    if (sameAccount && !cached && mask)
-        ctx.session.allowNet = mask; // must be deleted on logout by setLoggedIn
+    const mask = (0, perm_1.getFromAccount)(a || '', a => a.allow_net);
     const ret = mask && !(0, misc_1.netMatches)(ctx.ip, mask, true);
     if (ret)
         console.debug("Login failed: allow_net");
     return ret;
 }
 const paramsDecoder = async (ctx, next) => {
-    ctx.state.params = ctx.method === 'POST' && ctx.originalUrl.startsWith(const_1.API_URI)
-        && ((0, misc_1.tryJson)(await (0, misc_1.stream2string)(ctx.req)) || {});
+    if (ctx.method !== 'POST' || !ctx.originalUrl.startsWith(const_1.API_URI))
+        return next();
+    const body = await (0, misc_1.readRequestBodyLimited)(ctx, 10 * 1024 * 1024);
+    if (!body)
+        return;
+    ctx.state.params = (0, misc_1.tryJson)(body.text) || {};
     await next();
 };
 exports.paramsDecoder = paramsDecoder;

package/src/multipartUpload.js

@@ -11,9 +11,15 @@ const upload_1 = require("./upload");
 const cross_const_1 = require("./cross-const");
 const first_1 = require("./first");
 const cross_1 = require("./cross");
+const config_1 = require("./config");
 async function handleMultipartUpload(ctx, node) {
     if (ctx.request.type !== 'multipart/form-data')
         return ctx.status = cross_const_1.HTTP_BAD_REQUEST;
+    if (isCrossOriginBrowserRequest()) {
+        ctx.set('Connection', 'close'); // the rejected multipart body is intentionally left unread
+        ctx.body = "Cross-origin multipart upload blocked";
+        return ctx.status = cross_const_1.HTTP_FOOL;
+    }
     ctx.state.uploads = [];
     const locks = [];
     const fileJobs = [];
@@ -73,6 +79,20 @@ async function handleMultipartUpload(ctx, node) {
         stream.resume();
         return new Promise(res => (0, first_1.onFirstEvent)(stream, ['end', 'close', 'error'], res));
     }
+    function isCrossOriginBrowserRequest() {
+        if (ctx.get('x-hfs-anti-csrf'))
+            return false;
+        const origin = ctx.get('origin');
+        if (origin && origin !== 'null' && allowedUploadOrigin.compiled()(origin))
+            return false;
+        const fetchSite = ctx.get('sec-fetch-site');
+        if (fetchSite)
+            return fetchSite !== 'same-origin' && fetchSite !== 'none';
+        if (!origin)
+            return false; // missing browser metadata preserves non-browser and legacy upload clients
+        // compare hosts because TLS termination can make the public and internal protocols differ
+        return (0, cross_1.try_)(() => new URL(origin).host.toLowerCase() !== ctx.host.toLowerCase(), () => true);
+    }
     async function subfolderBlocksUpload(fn) {
         const prefix = (0, path_1.dirname)(fn.replaceAll('\\', '/'));
         if (prefix === '.') // no subdir
@@ -81,3 +101,4 @@ async function handleMultipartUpload(ctx, node) {
         return subfolderNode && !(0, vfs_1.hasPermission)(subfolderNode, 'can_upload', ctx);
     }
 }
+const allowedUploadOrigin = (0, config_1.defineConfig)('allowed_upload_origin', '', mask => (0, cross_1.makeMatcher)(mask, false, false));

package/src/nat.js

@@ -82,24 +82,25 @@ exports.getPublicIps = (0, debounceAsync_1.debounceAsync)(async () => {
     return ret;
 }, { retain: 10 * cross_1.MINUTE });
 exports.getNatInfo = (0, debounceAsync_1.debounceAsync)(async () => {
+    const MAPPINGS_TIMEOUT = 15_000; // routers enumerate rules sequentially; a few dozen mappings can take over 5 seconds
     const upnp = await exports.upnpEnabled.getWhenReady() ? getUpnpClient() : null;
     const gatewayIpPromise = findGateway().catch(() => undefined);
     const gw = upnp && await (0, cross_1.haveTimeout)(10_000, upnp.getGateway()).catch(() => null);
-    const status = await (0, listen_1.getServerStatus)();
-    let mappings = gw && await (0, cross_1.haveTimeout)(5_000, upnp.getMappings())?.catch(() => null);
-    console.debug(gw ? "Mappings found:" : "Mappings not queried:", mappings?.map(x => x.description).join(', ') || (gw ? "none" : upnp ? "gateway not found" : "UPnP disabled"));
+    let mappings = gw && await (0, cross_1.haveTimeout)(MAPPINGS_TIMEOUT, upnp.getMappings())?.catch(() => null);
+    console.debug(gw ? "Mappings found:" : "Mappings not queried:", lodash_1.default.uniq(mappings?.map(x => x.description)).join(', ') || (gw ? "none" : upnp ? "gateway not found" : "UPnP disabled"));
     const localIps = await (0, listen_1.getIps)(false);
     const gatewayIp = await gatewayIpPromise;
     const localIp = gw?.address || (gatewayIp ? lodash_1.default.maxBy(localIps, x => (0, cross_1.inCommon)(x, gatewayIp)) : localIps[0]);
+    const status = await (0, listen_1.getServerStatus)();
     const internalPort = status?.https?.listening && status.https.port || status?.http?.listening && status.http.port || undefined;
     let mapped = lodash_1.default.find(mappings, x => x.private.host === localIp && x.private.port === internalPort);
     if (upnp && mappings && localIp && internalPort && !mapped && exports.mappedPort.get())
         // restore the HFS-created mapping after routers that forget UPnP state across reboots
         await (0, cross_1.haveTimeout)(5_000, upnp.createMapping(upnpMappingParam(internalPort, exports.mappedPort.get()))).then(async () => {
             // confirm router state after restore instead of trusting the AddPortMapping result
-            mappings = await (0, cross_1.haveTimeout)(5_000, upnp.getMappings());
+            mappings = await (0, cross_1.haveTimeout)(MAPPINGS_TIMEOUT, upnp.getMappings());
             mapped = lodash_1.default.find(mappings, x => x.private.host === localIp && x.private.port === internalPort);
-        }).catch(e => console.warn('UPnP mapping restore failed:', e?.message || String(e)));
+        }).catch(e => console.warn('UPnP mapping restore failed:', e?.message || e?.errorDescription || String(e)));
     const externalPort = mapped?.public.port;
     if (localIp)
         exports.defaultBaseUrl.localIp = localIp;
@@ -134,9 +135,11 @@ function getUpnpClient() {
         throw Error("UPnP disabled");
     if (!upnpClient) {
         upnpClient = new nat_upnp_1.Client({ timeout: 4_000 });
-        const originalMethod = upnpClient.getGateway;
         // other client methods call getGateway too, so this will ensure they reuse this same result
-        upnpClient.getGateway = (0, debounceAsync_1.debounceAsync)(() => originalMethod.apply(upnpClient), { retain: cross_1.HOUR, retainFailure: 30_000 });
+        (0, cross_1.patchKey)(upnpClient, 'getGateway', was => (0, debounceAsync_1.debounceAsync)(() => was.apply(upnpClient), { retain: cross_1.HOUR, retainFailure: 30_000 }));
+        const f = (0, cross_1.patchKey)(upnpClient, 'getMappings', was => (0, debounceAsync_1.debounceAsync)(() => was.apply(upnpClient), { retain: cross_1.MINUTE }));
+        for (const k of ['createMapping', 'removeMapping']) // these methods must invalidate the cache
+            (0, cross_1.patchKey)(upnpClient, k, (was) => (...args) => was.apply(upnpClient, args).finally(f.clearRetain));
     }
     return upnpClient;
 }

package/src/outboundProxy.js

@@ -44,7 +44,7 @@ config_1.configReady.then(async (startedWithoutConfig) => {
     // it can be like "IP:PORT" or "http=IP:PORT;https=IP:PORT;ftp=IP:PORT"
     const url = (0, cross_1.prefix)('https://', /https=([\d:.]+)/.exec(out)?.[1]) // prefer https
         || (0, cross_1.prefix)('http://', /http=([\d:.]+)/.exec(out)?.[1])
-        || !read.includes('=') && 'http://' + read; // simpler form
+        || !read.includes('=') && (read.includes('://') ? read : 'http://' + read); // simpler form
     if (!url)
         return;
     outboundProxy.set(url);

package/src/perm.js

@@ -31,17 +31,7 @@ const events_1 = __importDefault(require("./events"));
 const auth_1 = require("./auth");
 // provides the username and all other usernames it inherits based on the 'belongs' attribute. Useful to check permissions
 function expandUsername(who) {
-    const ret = new Set();
-    const q = [who];
-    for (const u of q) {
-        const a = getAccount(u);
-        if (!a || a.disabled)
-            continue;
-        ret.add(u);
-        if (a.belongs)
-            q.push(...a.belongs);
-    }
-    return ret;
+    return new Set(Array.from(walkActiveAccounts([who]), a => a.username));
 }
 // check if current username or any ancestor match the provided usernames
 function ctxBelongsTo(ctx, usernames) {
@@ -213,14 +203,29 @@ function delAccount(username) {
 }
 // get some property from account, searching in its groups if necessary. Search is breadth-first, and this determines priority of inheritance.
 function getFromAccount(account, getter) {
-    const search = [account];
+    const root = typeof account === 'string' ? getAccount(account) : account;
+    if (!root)
+        return;
+    let res = getter(root); // always consider direct properties; only inherited groups are filtered by active status
+    if (res !== undefined)
+        return res;
+    for (const a of walkActiveAccounts(root.belongs || [])) {
+        res = getter(a);
+        if (res !== undefined)
+            return res;
+    }
+}
+function* walkActiveAccounts(roots) {
+    const search = [...roots];
+    const visited = new Set();
     for (const accountOrUsername of search) {
         const a = typeof accountOrUsername === 'string' ? getAccount(accountOrUsername) : accountOrUsername;
-        if (!a)
+        if (!a || visited.has(a.username))
             continue;
-        const res = getter(a);
-        if (res !== undefined)
-            return res;
+        visited.add(a.username);
+        if (accountIsDisabled(a))
+            continue;
+        yield a;
         if (a.belongs)
             search.push(...a.belongs);
     }
@@ -235,10 +240,23 @@ function accountCanLogin(account) {
     return accountHasLoginMethod(account) && !accountIsDisabled(account);
 }
 function accountIsDisabled(account) {
-    return Boolean(account.disabled
-        || account.expire < Date.now()
-        || account.belongs?.length // don't every() on empty array, as it returns true
-            && account.belongs.map(u => getAccount(u, false)).every(a => a && accountIsDisabled(a)));
+    return check(account, new Set());
+    function check(account, visiting) {
+        if (account.disabled || account.expire < Date.now())
+            return true;
+        if (!account.belongs?.length)
+            return false;
+        // consider invalid membership cycles disabled so they cannot grant privileges
+        if (visiting.has(account.username))
+            return true;
+        visiting.add(account.username);
+        const ret = account.belongs.every(u => {
+            const a = getAccount(u, false);
+            return Boolean(a && check(a, visiting));
+        });
+        visiting.delete(account.username);
+        return ret;
+    }
 }
 function accountCanLoginAdmin(account) {
     return accountCanLogin(account) && getFromAccount(account, a => a.admin) || false;

package/src/pluginCatalog.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPluginCatalog = getPluginCatalog;
+exports.searchPluginCatalog = searchPluginCatalog;
+const github_1 = require("./github");
+const persistence_1 = require("./persistence");
+const const_1 = require("./const");
+const lodash_1 = __importDefault(require("lodash"));
+const CACHE_KEY = 'pluginCatalog';
+let refreshing;
+async function* getPluginCatalog() {
+    await persistence_1.storedMap.ready();
+    const saved = await persistence_1.storedMap.get(CACHE_KEY);
+    // compatibility is determined by this HFS version, including fallback api branches
+    const previous = saved?.version === const_1.VERSION ? saved : undefined;
+    const age = previous ? Date.now() - previous.updatedAt : Infinity;
+    if (previous && age < 24 * 60 * 60_000)
+        yield { ...previous, refreshing: age >= 5 * 60_000 };
+    if (age < 5 * 60_000)
+        return;
+    // all searches share the same refresh, even if the initiating client disconnects
+    refreshing ??= refresh().finally(() => { refreshing = undefined; });
+    yield { ...await refreshing, refreshing: false };
+    async function refresh() {
+        const repositories = [];
+        for await (const repo of (0, github_1.apiGithubPaginated)('search/repositories?q=topic:hfs-plugin', { requireComplete: true }))
+            repositories.push(lodash_1.default.pick(repo, ['full_name', 'description', 'pushed_at', 'default_branch', 'stargazers_count', 'license']));
+        const old = new Map(previous?.entries.map(entry => [entry.repository.full_name, entry]));
+        const entries = await Promise.all(repositories.map(async (repository) => {
+            const cached = old.get(repository.full_name);
+            let plugin = cached?.plugin;
+            if (!cached || cached.repository.pushed_at !== repository.pushed_at
+                || cached.repository.default_branch !== repository.default_branch) {
+                plugin = await (0, github_1.readOnlineCompatiblePlugin)(repository.full_name, repository.default_branch)
+                    .catch((error) => {
+                    // repositories can carry the topic without providing a plugin at the expected path
+                    if (error.message !== '404')
+                        throw error;
+                }) ?? null;
+            }
+            return { repository, plugin: plugin ?? null };
+        }));
+        const next = { version: const_1.VERSION, updatedAt: Date.now(), entries };
+        // never replace a complete catalog with the result of a failed refresh
+        await persistence_1.storedMap.put(CACHE_KEY, next);
+        return next;
+    }
+}
+async function searchPluginCatalog(catalog, text = '', skipRepos = []) {
+    const central = await (0, github_1.getProjectInfo)();
+    const terms = text.toLowerCase().split(/\s+/).filter(Boolean);
+    return catalog.entries.flatMap(({ repository, plugin }) => {
+        const repo = repository.full_name;
+        const searchable = `${repo} ${repository.description || ''} ${plugin?.description || ''}`.toLowerCase();
+        if (!plugin || skipRepos.includes(repo) || central?.repo_blacklist?.[repo]?.message
+            || !terms.every(term => searchable.includes(term)))
+            return [];
+        // API responses add live state and dependency errors; keep the persisted metadata untouched
+        return [{ ...plugin, id: repo, repo, pushed_at: repository.pushed_at,
+                stargazers_count: repository.stargazers_count, default_branch: repository.default_branch,
+                license: repository.license?.spdx_id }];
+    });
+}

package/src/pluginUsage.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = require("node:crypto");
+const misc_1 = require("./misc");
+const config_1 = require("./config");
+const plugins_1 = require("./plugins");
+const persistence_1 = require("./persistence");
+const util_http_1 = require("./util-http");
+const debounceAsync_1 = require("./debounceAsync");
+const shareUsageStats = (0, config_1.defineConfig)(misc_1.CFG.share_usage_stats, false);
+const installationId = persistence_1.storedMap.singleSync('pluginUsageId', '');
+const lastReport = persistence_1.storedMap.singleSync('lastPluginUsageReport', 0);
+const ready = Promise.all([config_1.configReady, plugins_1.pluginsScanned, installationId.ready(), lastReport.ready()]);
+const syncPluginUsage = (0, debounceAsync_1.debounceAsync)(async () => {
+    await ready;
+    let uuid = installationId.get();
+    if (!shareUsageStats.get()) {
+        if (!uuid)
+            return;
+        await send('DELETE', { uuid });
+        installationId.set('');
+        lastReport.set(0);
+        return;
+    }
+    if (Date.now() < lastReport.get() + misc_1.DAY)
+        return;
+    if (!uuid) {
+        uuid = (0, node_crypto_1.randomUUID)();
+        installationId.set(uuid);
+    }
+    const enabled = plugins_1.enablePlugins.get();
+    const plugins = selectReportedPlugins([
+        ...(0, plugins_1.mapPlugins)((plugin, id) => ({ ...plugin.getData(), id, enabled: enabled.includes(id) }), false),
+        ...(0, plugins_1.getInactivePlugins)().map(plugin => ({ ...plugin, enabled: enabled.includes(plugin.id) })),
+    ]);
+    await send('POST', { uuid, hfsVersion: String(config_1.currentVersion), plugins });
+    lastReport.set(Date.now());
+    function selectReportedPlugins(installed) {
+        const selected = new Map();
+        for (const plugin of installed) {
+            const repo = typeof plugin.repo === 'string' ? plugin.repo : plugin.repo?.main;
+            if (!repo)
+                continue;
+            const current = selected.get(repo);
+            if (!current || better(plugin, current))
+                selected.set(repo, plugin);
+        }
+        return Array.from(selected, ([repo, plugin]) => ({
+            repo,
+            version: plugin.version,
+            enabled: plugin.enabled,
+        })).sort((a, b) => a.repo.localeCompare(b.repo));
+        function better(a, b) {
+            return Number(a.enabled) > Number(b.enabled)
+                || a.enabled === b.enabled && (a.id.length < b.id.length
+                    || a.id.length === b.id.length && a.id.localeCompare(b.id) < 0);
+        }
+    }
+});
+shareUsageStats.sub(() => void syncPluginUsage().catch(() => { }));
+(0, misc_1.repeat)(misc_1.HOUR, syncPluginUsage);
+async function send(method, body) {
+    await (0, util_http_1.httpWithBody)(misc_1.PLUGIN_USAGE_URL + '/report', { method, body, timeout: 5000 });
+}

package/src/plugins.js

@@ -53,6 +53,7 @@ exports.getInactivePlugins = getInactivePlugins;
 exports.rescan = rescan;
 exports.parsePluginSource = parsePluginSource;
 exports.getMissingDependencies = getMissingDependencies;
+const acmeDns_1 = require("./acmeDns");
 const fast_glob_1 = __importDefault(require("fast-glob"));
 const watchLoad_1 = require("./watchLoad");
 const lodash_1 = __importDefault(require("lodash"));
@@ -232,6 +233,13 @@ async function initPlugin(pl, morePassedToInit, onInitError) {
                 return result;
             }
         },
+        registerAcmeDnsProvider(...args) {
+            if (unloading)
+                throw Error("Plugin is unloading");
+            const unregister = (0, acmeDns_1.registerAcmeDnsProvider)(...args);
+            cleanups.push(unregister);
+            return unregister;
+        },
         misc, _: lodash_1.default,
         customApiCall, notifyClient: frontEndApis_1.notifyClient, addBlock: block_1.addBlock, ctxBelongsTo: perm_1.ctxBelongsTo, getConnections: connections_1.getConnections, normalizeFilename: vfs_1.normalizeFilename,
         getCurrentUsername: auth_1.getCurrentUsername, getAccount: perm_1.getAccount, getUsernames: perm_1.getUsernames, addAccount: perm_1.addAccount, delAccount: perm_1.delAccount, updateAccount: perm_1.updateAccount, renameAccount: perm_1.renameAccount,
@@ -734,6 +742,10 @@ function parsePluginSource(id, source) {
     pl.depend = (0, misc_1.tryJson)(/exports.depend\s*=\s*(\[[\s\S]*?])/m.exec(source)?.[1])?.filter((x) => typeof x.repo === 'string' && x.version === undefined || typeof x.version === 'number'
         || console.warn("Plugin dependency discarded", x));
     pl.changelog = (0, misc_1.tryJson)(/exports.changelog\s*=\s*(\[[\s\S]*?])/m.exec(source)?.[1]);
+    if (!Array.isArray(pl.changelog))
+        delete pl.changelog;
+    else if (lodash_1.default.remove(pl.changelog, entry => !Number.isFinite(entry?.version) || typeof entry?.message !== 'string').length)
+        console.warn("Invalid plugin changelog entries discarded", id);
     if (Array.isArray(pl.apiRequired) && (pl.apiRequired.length !== 2 || !pl.apiRequired.every(lodash_1.default.isFinite))) // validate [from,to] form
         pl.apiRequired = undefined;
     calculateBadApi(pl);

package/src/roots.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rootsMiddleware = exports.roots = void 0;
+exports.rootsMiddleware = exports.rootsHostGuard = exports.roots = void 0;
 const config_1 = require("./config");
 const misc_1 = require("./misc");
 const connections_1 = require("./connections");
@@ -17,6 +17,26 @@ exports.roots = (0, config_1.defineConfig)(misc_1.CFG.roots, {}, map => {
     return (host) => values[matchers.findIndex(m => m(host))];
 });
 const forceAddress = (0, config_1.defineConfig)(misc_1.CFG.force_address, false);
+const rootsHostGuard = (ctx, next) => {
+    if (!ctx.path || lodash_1.default.isEmpty(exports.roots.get()))
+        return next();
+    if (ctx.path.startsWith(misc_1.SPECIAL_URI)) {
+        if (!ctx.path.startsWith(misc_1.API_URI))
+            return next();
+        const { referer } = ctx.headers;
+        const fromAdmin = referer && (0, misc_1.try_)(() => new URL(referer).pathname.startsWith(ctx.state.revProxyPath + misc_1.ADMIN_URI));
+        // authentication must remain reachable before ctxAdminAccess can succeed
+        if (fromAdmin && ((0, adminApis_1.ctxAdminAccess)(ctx)
+            || ['login', 'loginSrp1', 'loginSrp2'].some(x => ctx.path === misc_1.API_URI + x)))
+            return next();
+    }
+    const root = ctx.state.root = exports.roots.compiled()(ctx.host);
+    return !ctx.state.skipFilters && forceAddress.get()
+        && root === undefined && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled()
+        ? (0, connections_1.disconnect)(ctx, forceAddress.key())
+        : next();
+};
+exports.rootsHostGuard = rootsHostGuard;
 const rootsMiddleware = (ctx, next) => (() => {
     if (!ctx.path) // it was once reported "Cannot read properties of null (reading 'startsWith')" but I can't reproduce it, and it shouldn't happen anyway
         return (0, connections_1.disconnect)(ctx, 'no path'); // let's assume that such requests can't be served anyway. This will leave a trace with an ip, anyway
@@ -27,19 +47,8 @@ const rootsMiddleware = (ctx, next) => (() => {
             return; // ...unless it's an api
         params = ctx.state.params || ctx.query; // for api we'll translate params
         changeUriParams(v => (0, misc_1.removeStarting)(ctx.state.revProxyPath, v)); // this removal must be done before adding the root; this operation doesn't conceptually belong to "roots", and it may be placed in different middleware, but it's convenient to do it here
-        const { referer } = ctx.headers;
-        const fromAdmin = referer && (0, misc_1.try_)(() => new URL(referer).pathname.startsWith(ctx.state.revProxyPath + misc_1.ADMIN_URI));
-        // authentication must remain reachable before ctxAdminAccess can succeed
-        if (fromAdmin && ((0, adminApis_1.ctxAdminAccess)(ctx)
-            || ['login', 'loginSrp1', 'loginSrp2'].some(x => ctx.path === misc_1.API_URI + x)))
-            return;
     }
-    if (lodash_1.default.isEmpty(exports.roots.get()))
-        return;
-    const root = ctx.state.root = exports.roots.compiled()(ctx.host);
-    if (!ctx.state.skipFilters && forceAddress.get()
-        && root === undefined && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled())
-        return (0, connections_1.disconnect)(ctx, forceAddress.key()); // returning truthy will not call next
+    const { root } = ctx.state;
     if (!root || root === '/')
         return; // no transformation is required
     changeUriParams(v => (0, misc_1.join)(root, v));