hfs 3.3.3 → 3.3.4

package/src/api.auth.js

@@ -16,6 +16,7 @@ const events_1 = __importDefault(require("./events"));
 const misc_1 = require("./misc");
 const uploadOwners_1 = require("./uploadOwners");
 const node_crypto_1 = require("node:crypto");
+const sessionStamp_1 = require("./sessionStamp");
 const ongoingLogins = {}; // store data that doesn't fit session object
 const keepSessionAlive = (0, config_1.defineConfig)(misc_1.CFG.keep_session_alive, true);
 const fakeSrpSecret = (0, node_crypto_1.randomBytes)(32);
@@ -76,13 +77,14 @@ exports.authApis = {
         if (account && (0, middlewares_1.failAllowNet)(ctx, account))
             return unauthorized();
         try { // unknown users complete step 1 so only a full failed login can reveal and penalize the attempt
+            const stamp = account && (0, sessionStamp_1.getSessionStamp)(account.username);
             const { srpServer, ...rest } = await (0, auth_1.srpServerStep1)(account || fakeSrpAccount(username));
             // keep the public handshake identifier independent of predictable application PRNG state
             const sid = (0, node_crypto_1.randomUUID)();
             ongoingLogins[sid] = srpServer;
             setTimeout(() => delete ongoingLogins[sid], 60_000); // client must complete api sequence (loginSrp2) within 1 minute or will be discarded to avoid memory leaks
             // 60-second expiry bounded 5k challenges to ~37 MB in a local saturation test, so an additional cap isn't justified
-            ctx.session.loggingIn = { username, sid }; // temporarily store until process is complete
+            ctx.session.loggingIn = { username, sid, stamp }; // temporarily store until process is complete
             return rest;
         }
         catch (code) {
@@ -109,7 +111,7 @@ exports.authApis = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
         if (!ctx.session.loggingIn)
             return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT);
-        const { username, sid } = ctx.session.loggingIn;
+        const { username, sid, stamp } = ctx.session.loggingIn;
         delete ctx.session.loggingIn;
         const step1 = ongoingLogins[sid];
         if (!step1)
@@ -117,6 +119,10 @@ exports.authApis = {
         try {
             const M2 = await step1.step2(BigInt(pubKey), BigInt(proof))
                 .catch(() => { throw ''; }); // falsy value for later
+            // an old-password handshake must not mint a session after credentials have been revoked
+            const account = (0, perm_1.getAccount)(username);
+            if (!account || !stamp || stamp !== (0, sessionStamp_1.getSessionStamp)(account.username))
+                throw '';
             await (0, auth_1.setLoggedIn)(ctx, username, 'srp');
             return {
                 proof: String(M2),
@@ -150,6 +156,8 @@ exports.authApis = {
         if (!salt || !verifier)
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'missing parameters');
         await (0, perm_1.updateAccount)(a, a => (0, perm_1.saveSrpInfo)(a, salt, verifier));
+        if (ctx.session?.username === a.username)
+            ctx.session.stamp = (0, sessionStamp_1.getSessionStamp)(a.username);
         delete a.require_password_change;
         return {};
     }

package/src/auth.js

@@ -36,7 +36,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invalidateSessionBefore = void 0;
 exports.srpServerStep1 = srpServerStep1;
 exports.srpCheck = srpCheck;
 exports.getCurrentUsername = getCurrentUsername;
@@ -51,6 +50,7 @@ const cross_1 = require("./cross");
 const expiringCache_1 = require("./expiringCache");
 const node_crypto_1 = require("node:crypto");
 const events_1 = __importDefault(require("./events"));
+const sessionStamp_1 = require("./sessionStamp");
 const srp6aNimbusRoutines = new srp.SRPRoutines(new srp.SRPParameters());
 async function srpServerStep1(account) {
     if (!account.srp)
@@ -67,13 +67,17 @@ async function srpCheck(username, password) {
     const account = (0, perm_1.getAccount)(username);
     if (!account?.srp || !password)
         return;
-    const k = (0, node_crypto_1.createHash)('sha256').update(username + password + account.srp).digest("hex");
+    const verifier = account.srp;
+    const sessionStamp = (0, sessionStamp_1.getSessionStamp)(account.username);
+    const k = (0, node_crypto_1.createHash)('sha256').update(username + password + verifier).digest("hex");
     const good = await cache.try(k, async () => {
         const { srpServer, salt, pubKey } = await srpServerStep1(account);
         const client = await (0, srp_1.srpClientPart)(srp, username, password, salt, pubKey);
         return srpServer.step2(client.A, client.M1).then(() => true, () => false);
     });
-    return good ? account : undefined;
+    // verification can finish after a password change or account replacement
+    return good && (0, perm_1.getAccount)(username) === account && account.srp === verifier && (0, sessionStamp_1.getSessionStamp)(account.username) === sessionStamp
+        ? account : undefined;
 }
 function getCurrentUsername(ctx) {
     return ctx.state.account?.username || '';
@@ -106,8 +110,11 @@ async function setLoggedIn(ctx, username, via) {
     const a = ctx.state.account = (0, perm_1.getAccount)(username);
     if (!a)
         return;
+    const sessionStamp = (0, sessionStamp_1.getSessionStamp)(a.username);
     const result = await events_1.default.emitAsync('finalizingLogin', { ctx, username: a.username, via, inputs: { ...ctx.state.params, ...ctx.query } });
-    const error = result?.find(x => x && lodash_1.default.isString(x)) || result?.isDefaultPrevented() && "Login denied";
+    // async plugin checks must not let a revoked login acquire the new session stamp
+    const error = result?.find(x => x && lodash_1.default.isString(x)) || (result?.isDefaultPrevented()
+        || !sessionStamp || (0, perm_1.getAccount)(username) !== a || (0, sessionStamp_1.getSessionStamp)(a.username) !== sessionStamp) && "Login denied";
     if (error) {
         // restore the session identity: the candidate account was exposed only for plugin checks
         ctx.state.account = (0, perm_1.getAccount)(s.username, false);
@@ -118,13 +125,11 @@ async function setLoggedIn(ctx, username, via) {
     if (s.username !== normalized)
         delete s.allowNet; // discard restrictions cached for another identity before replacing the session account
     s.username = normalized;
-    s.ts = Date.now();
     s.ip = ctx.ip;
+    s.stamp = sessionStamp;
     const k = cross_const_1.ALLOW_SESSION_IP_CHANGE;
     s[k] = k in ctx.query || Boolean(ctx.state.params?.[k]) || undefined; // login APIs will get ctx.state.params, others can rely on ctx.query
     if (!a.expire && a.days_to_live)
         (0, perm_1.updateAccount)(a, { expire: new Date(Date.now() + a.days_to_live * cross_1.DAY) });
     await events_1.default.emitAsync('login', ctx);
 }
-// since session are currently stored in cookies, we need to store this information
-exports.invalidateSessionBefore = new Map();

package/src/deletePermission.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDeletePermission = checkDeletePermission;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = require("node:path");
+const cross_1 = require("./cross");
+const const_1 = require("./const");
+const events_1 = __importDefault(require("./events"));
+const uploadOwners_1 = require("./uploadOwners");
+const vfs_1 = require("./vfs");
+// unlike a listing, deletion affects hidden entries and must fail if any directory cannot be read
+async function checkDeletePermission(node, ctx) {
+    if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_delete', ctx))
+        return false;
+    if (!node.source || !(await promises_1.default.lstat(node.source)).isDirectory())
+        return true;
+    return recur(node, []);
+    async function recur(parent, scopes) {
+        // explicit VFS entries are not deletable, even when their source is several levels below this directory
+        for (const child of explicitNodes(parent)) {
+            if (!child.source)
+                continue;
+            const path = (0, node_path_1.relative)((0, node_path_1.resolve)(parent.source), (0, node_path_1.resolve)(child.source));
+            if (path === '..' || path.startsWith('..' + node_path_1.sep) || (0, node_path_1.isAbsolute)(path))
+                continue;
+            try {
+                await promises_1.default.lstat(child.source);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                throw error;
+            }
+            ctx.status = const_1.HTTP_FORBIDDEN;
+            await reportBlocked(child);
+            return false;
+        }
+        const inherited = (0, vfs_1.permsFromParent)(parent, {}) || {};
+        const keys = new Set(['can_delete']);
+        for (const key of keys) {
+            addReferences(parent[key] ?? cross_1.defaultPerms[key]);
+            addReferences(inherited[key] ?? cross_1.defaultPerms[key]);
+        }
+        // skip scanning descendants only when inherited permissions guarantee deletion and no deeper rule or plugin can override them
+        if (!scopes.some(scope => hasRules(scope.node, keys)) && !hasRules(parent, keys)
+            && !cross_1.PERM_KEYS.some(key => (0, cross_1.isWhoObject)(inherited[key]))
+            && !events_1.default.hasOtherListeners('checkVfsPermission', uploadOwners_1.grantUploadOwnerDelete)
+            && !(0, vfs_1.statusCodeForMissingPerm)(inherited, 'can_delete', ctx, false, false))
+            return true;
+        // only literal path prefixes can be exhausted by inheritMasks; other patterns may match again deeper down
+        const persistentMasks = Object.fromEntries(Object.entries(parent.masks || {}).filter(([mask, mods]) => mods && (cross_1.PERM_KEYS.some(key => mods[key] !== undefined) || hasRules(mods, new Set(cross_1.PERM_KEYS)))
+            && (!mask.includes('/') || /[!*?\[\]{}()|\\]/.test(mask.split('/')[0]))));
+        if (Object.keys(persistentMasks).length)
+            scopes = [...scopes, { node: { masks: persistentMasks }, path: '' }];
+        for await (const entry of await promises_1.default.opendir(parent.source)) {
+            if (ctx.isAborted())
+                throw Error("Deletion cancelled");
+            const source = (0, node_path_1.join)(parent.source, entry.name);
+            const name = (0, vfs_1.getVirtualName)(entry.name, parent, source);
+            const explicit = (0, vfs_1.getChildBySource)(parent, source);
+            // permission masks use the target type, but deletion must never recurse through the link
+            const isFolder = entry.isSymbolicLink()
+                ? await promises_1.default.stat(source).then(stats => stats.isDirectory(), error => {
+                    if (error.code === 'ENOENT')
+                        return false;
+                    throw error;
+                }) : entry.isDirectory();
+            const child = {
+                ...explicit, original: explicit, source, isFolder,
+                rename: explicit?.rename || (0, vfs_1.renameUnderPath)(parent.rename, entry.name),
+            };
+            const nextScopes = scopes.map(scope => ({ node: scope.node, path: scope.path + name }));
+            for (const scope of [...nextScopes].reverse()) {
+                (0, vfs_1.parentMaskApplier)(scope.node, true)(child, scope.path);
+                (0, vfs_1.parentMaskApplier)(scope.node)(child, name);
+            }
+            const evaluated = (0, vfs_1.applyParentToChild)(child, parent, name);
+            if ((0, vfs_1.statusCodeForMissingPerm)(evaluated, 'can_delete', ctx)) {
+                await reportBlocked(evaluated);
+                return false;
+            }
+            // dirents do not follow symlinks, including dangling links
+            if (entry.isDirectory() && !await recur(evaluated, nextScopes.map(scope => ({ ...scope, path: scope.path + '/' }))))
+                return false;
+        }
+        return true;
+        function addReferences(who) {
+            if ((0, cross_1.isWhoObject)(who)) {
+                if (who.this !== undefined)
+                    addReferences(who.this);
+                if (who.children !== undefined)
+                    addReferences(who.children);
+            }
+            else if (typeof who === 'string' && cross_1.PERM_KEYS.includes(who))
+                keys.add(who);
+        }
+    }
+    async function reportBlocked(blocked) {
+        // a deletion error must not disclose names hidden by access permissions
+        let visible = blocked;
+        for (let ancestor = blocked; ancestor && ancestor !== node; ancestor = ancestor.parent)
+            if (!(0, vfs_1.hasPermission)(ancestor, 'can_see', ctx) || !await (0, vfs_1.urlToNode)(ancestor.vfsPath, ctx)
+                || ancestor.parent && !(0, vfs_1.hasPermission)(ancestor.parent, 'can_list', ctx))
+                visible = ancestor.parent || node;
+        ctx.body = { uri: '/' + visible.vfsPath };
+    }
+    function* explicitNodes(parent) {
+        for (const child of parent.children || []) {
+            const evaluated = (0, vfs_1.applyParentToChild)(child, parent);
+            yield evaluated;
+            yield* explicitNodes(evaluated);
+        }
+    }
+}
+function hasRules(node, keys) {
+    return Boolean(node.children?.length || Object.values(node.masks || {}).some(mods => mods && (Array.from(keys).some(key => mods[key] !== undefined) || hasRules(mods, keys))));
+}

package/src/events.js

@@ -56,6 +56,12 @@ class BetterEventEmitter {
     anyListener(event) {
         return Boolean(this.listeners.get(event)?.size);
     }
+    hasOtherListeners(event, mine) {
+        for (const x of this.listeners.get(event) || [])
+            if (x !== mine)
+                return true;
+        return false;
+    }
     emit(event, ...args) {
         let cbs = this.listeners.get(event);
         if (!cbs?.size)

package/src/index.js

@@ -47,8 +47,10 @@ exports.app = new koa_1.default({ keys });
 exports.app.use(middlewares_1.sessionMiddleware)
     .use(selfCheck_1.selfCheckMiddleware)
     .use(acme_1.acmeMiddleware)
-    .use(middlewares_1.prepareState)
+    .use(middlewares_1.prepareConnection)
+    .use(middlewares_1.blockFilter) // denied clients must not reach credential verification or its session/account side effects
     .use(geo_1.geoFilter)
+    .use(middlewares_1.prepareState)
     .use(ips_1.trackIpsMw)
     .use(middlewares_1.gzipper)
     .use(middlewares_1.paramsDecoder) // must be done before plugins, so they can manipulate params

package/src/listen.js

@@ -70,6 +70,7 @@ const consoleLog_1 = require("./consoleLog");
 const first_1 = require("./first");
 const fileAttr_1 = require("./fileAttr");
 const uploadOwners_1 = require("./uploadOwners");
+const sessionStamp_1 = require("./sessionStamp");
 let httpSrv;
 let httpsSrv;
 // the update relaunch can keep a bridge process alive, so we proactively close listeners here to release ports before the next binary binds; do it before (5) the storage file is closed, because sockets write there
@@ -88,7 +89,7 @@ const commonServerOptions = {
 };
 // these are properties that can be assigned to the server object
 const commonServerAssign = { headersTimeout: 30_000, timeout: misc_1.MINUTE }; // 'headersTimeout' is not recognized by type lib, and 'timeout' is not effective when passed in parameters
-const readyToListen = Promise.all([persistence_1.storedMap.isOpening(), fileAttr_1.fileAttrDb.isOpening(), uploadOwners_1.uploadOwners.isOpening(), events_1.default.once('app')]);
+const readyToListen = Promise.all([persistence_1.storedMap.isOpening(), sessionStamp_1.sessionStampsReady, fileAttr_1.fileAttrDb.isOpening(), uploadOwners_1.uploadOwners.isOpening(), events_1.default.once('app')]);
 const considerHttp = (0, misc_1.debounceAsync)(async () => {
     await readyToListen;
     void stopServer(httpSrv);

package/src/middlewares.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.someSecurity = exports.cloudflareDetected = exports.headRequests = exports.gzipper = exports.sessionDuration = void 0;
+exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.blockFilter = exports.prepareConnection = exports.someSecurity = exports.cloudflareDetected = exports.headRequests = exports.gzipper = exports.sessionDuration = void 0;
 exports.getProxyDetected = getProxyDetected;
 exports.failAllowNet = failAllowNet;
 const koa_compress_1 = __importDefault(require("koa-compress"));
@@ -15,8 +15,11 @@ const block_1 = require("./block");
 const perm_1 = require("./perm");
 const connections_1 = require("./connections");
 const auth_1 = require("./auth");
+const sessionStamp_1 = require("./sessionStamp");
 const zlib_1 = require("zlib");
 const listen_1 = require("./listen");
+const roots_1 = require("./roots");
+const node_net_1 = require("node:net");
 const config_1 = require("./config");
 const koa_session_1 = __importDefault(require("koa-session"));
 const index_1 = require("./index");
@@ -53,8 +56,6 @@ exports.headRequests = headRequests;
 let proxyDetected;
 const someSecurity = (ctx, next) => {
     enforceSessionIp(ctx);
-    if (!ctx.state.skipFilters && (0, block_1.applyBlock)(ctx.socket, ctx.ip))
-        return;
     const decodedPath = (0, misc_1.try_)(() => decodeURI(ctx.path));
     if (!decodedPath || (0, misc_1.hasDirTraversal)(decodedPath))
         return;
@@ -70,6 +71,16 @@ const someSecurity = (ctx, next) => {
     return next();
 };
 exports.someSecurity = someSecurity;
+const prepareConnection = (ctx, next) => {
+    // normalize once so auth, filters and logging agree on the same client address
+    ctx.request.ip = (0, connections_1.normalizeIp)(ctx.ip);
+    ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
+    (0, connections_1.updateConnectionForCtx)(ctx);
+    return next();
+};
+exports.prepareConnection = prepareConnection;
+const blockFilter = (ctx, next) => !ctx.state.skipFilters && (0, block_1.applyBlock)(ctx.socket, ctx.ip) || next();
+exports.blockFilter = blockFilter;
 function enforceSessionIp(ctx) {
     const s = ctx.session;
     if (!s?.username || s[misc_1.ALLOW_SESSION_IP_CHANGE])
@@ -88,8 +99,6 @@ function getProxyDetected() {
     return proxyDetected && { from: proxyDetected.socket.remoteAddress, for: proxyDetected.get('X-Forwarded-For') };
 }
 const prepareState = async (ctx, next) => {
-    // normalize once so auth, filters and logging agree on the same client address
-    ctx.request.ip = (0, connections_1.normalizeIp)(ctx.ip);
     // invalidate before account resolution; someSecurity calls again to bind logins made below
     enforceSessionIp(ctx);
     // rootsMiddleware consults proxy-aware admin access before someSecurity runs
@@ -107,12 +116,13 @@ const prepareState = async (ctx, next) => {
     }
     const s = ctx.session;
     if (s?.username) {
-        if (s.ts < auth_1.invalidateSessionBefore.get(s?.username))
+        const account = (0, perm_1.getAccount)(s.username, false);
+        if (!account || !s.stamp || s.stamp !== (0, sessionStamp_1.getSessionStamp)(s.username)) {
             delete s.username;
+            delete s.stamp;
+        }
         s.maxAge = exports.sessionDuration.compiled();
     }
-    // calculate these once and for all
-    ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     // explicit credentials and existing sessions must take precedence, so a matching IP cannot override a chosen account
     let via;
     let a = await urlLogin() || await getHttpAccount() || !s?.username && autoLogin();
@@ -135,7 +145,7 @@ const prepareState = async (ctx, next) => {
             ctx.headers['x-username'] = a.username; // give an easier way to determine if the login was successful
         }
     ctx.state.revProxyPath = ctx.get('x-forwarded-prefix');
-    (0, connections_1.updateConnectionForCtx)(ctx);
+    (0, connections_1.updateConnectionForCtx)(ctx); // publish the resolved account after the initial pre-auth connection update
     await next();
     function urlLogin() {
         via = 'url';
@@ -160,6 +170,14 @@ const prepareState = async (ctx, next) => {
         catch { }
     }
     function autoLogin() {
+        const host = ctx.host.toLowerCase();
+        const hostname = (0, misc_1.normalizeHost)(host);
+        // a rebinding page uses the victim's real IP, but retains the attacker's hostname
+        if (hostname !== 'localhost' && !(0, node_net_1.isIP)(hostname)
+            // URL normalization matches browsers' default-port removal and internationalized domain names
+            && host !== (listen_1.baseUrl.get() && (0, misc_1.try_)(() => new URL(listen_1.baseUrl.get()).host.toLowerCase()))
+            && roots_1.roots.compiled()(host) === undefined)
+            return;
         via = 'net';
         // keep the mask direct so group inheritance cannot make identity depend on account order
         return Object.values(perm_1.accounts.get()).find(a => (0, perm_1.accountCanLogin)(a) && a.auto_login_net && (0, misc_1.netMatches)(ctx.ip, a.auto_login_net, true));

package/src/perm.js

@@ -12,6 +12,7 @@ exports.getAccount = getAccount;
 exports.saveSrpInfo = saveSrpInfo;
 exports.createAdmin = createAdmin;
 exports.updateAccount = updateAccount;
+exports.invalidateAccountSessions = invalidateAccountSessions;
 exports.normalizeUsername = normalizeUsername;
 exports.renameAccount = renameAccount;
 exports.addAccount = addAccount;
@@ -29,6 +30,7 @@ const config_1 = require("./config");
 const tssrp6a_1 = require("tssrp6a");
 const events_1 = __importDefault(require("./events"));
 const auth_1 = require("./auth");
+const sessionStamp_1 = require("./sessionStamp");
 // provides the username and all other usernames it inherits based on the 'belongs' attribute. Useful to check permissions
 function expandUsername(who) {
     const ret = new Set();
@@ -79,6 +81,7 @@ async function createAdmin(password, username = 'admin') {
 }
 const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
 async function updateAccount(account, change) {
+    await sessionStamp_1.sessionStampsReady;
     const jsonWas = JSON.stringify(account);
     const { username: usernameWas } = account;
     if (typeof change === 'function')
@@ -121,8 +124,27 @@ async function updateAccount(account, change) {
     if (jsonWas !== JSON.stringify(account)) // this test will miss the 'username' field, because hidden, but renameAccount is already calling saveAccountsASAP
         saveAccountsAsap();
 }
-const saveAccountsAsap = config_1.saveConfigAsap;
+function reconcileAccountSessions() {
+    (0, sessionStamp_1.syncSessionStamps)(lodash_1.default.mapKeys(exports.accounts.get(), (_account, username) => normalizeUsername(username)));
+}
+function saveAccountsAsap() {
+    // API callers need the updated stamp before preserving their own session in the response
+    reconcileAccountSessions();
+    (0, config_1.saveConfigAsap)();
+}
+function invalidateAccountSessions(account) {
+    const found = typeof account === 'string' ? getAccount(account) : account;
+    if (!found)
+        return false;
+    (0, sessionStamp_1.renewSessionStamp)(found.username);
+    return true;
+}
 exports.accounts = (0, config_1.defineConfig)(misc_1.CFG.accounts, {});
+exports.accounts.sub(async () => {
+    await sessionStamp_1.sessionStampsReady;
+    // do not debounce: removing and recreating a username must not be coalesced into one change
+    reconcileAccountSessions();
+});
 exports.accounts.sub(lodash_1.default.debounce(obj => {
     // consider some validation here, in case of manual edit of the config
     lodash_1.default.each(obj, (rec, k) => {
@@ -200,14 +222,14 @@ function addAccount(username, props, updateExisting = false) {
     if (account && !updateExisting)
         return;
     account = (0, misc_1.setHidden)(account || {}, { username }); // hidden so that stringification won't include it
-    Object.assign(account, lodash_1.default.pickBy(props, Boolean));
     exports.accounts.set(was => Object.assign(was, { [username]: account }));
-    return updateAccount(account, account).then(() => account);
+    return updateAccount(account, lodash_1.default.pickBy(props, Boolean)).then(() => account);
 }
 function delAccount(username) {
     if (!getAccount(username))
         return false;
-    exports.accounts.set(was => lodash_1.default.omit(was, normalizeUsername(username)));
+    username = normalizeUsername(username);
+    exports.accounts.set(was => lodash_1.default.omit(was, username));
     saveAccountsAsap();
     return true;
 }

package/src/serveGuiAndSharedFiles.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.serveSharedFiles = exports.guiFilesMiddleware = void 0;
+const deletePermission_1 = require("./deletePermission");
 const path_1 = require("path");
 const vfs_1 = require("./vfs");
 const errorPages_1 = require("./errorPages");
@@ -106,9 +107,9 @@ const serveSharedFiles = async (ctx, next) => {
         const { source } = node;
         if (!source)
             return ctx.status = cross_const_1.HTTP_METHOD_NOT_ALLOWED;
-        if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_delete', ctx))
-            return;
         try {
+            if (!await (0, deletePermission_1.checkDeletePermission)(node, ctx))
+                return;
             if ((await events_1.default.emitAsync('deleting', { node, ctx }))?.isDefaultPrevented())
                 return ctx.status = cross_const_1.HTTP_FAILED_DEPENDENCY;
             await (0, promises_2.rm)(source, { recursive: true });

package/src/sessionStamp.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionStampsReady = void 0;
+exports.getSessionStamp = getSessionStamp;
+exports.renewSessionStamp = renewSessionStamp;
+exports.syncSessionStamps = syncSessionStamps;
+const persistence_1 = require("./persistence");
+const node_crypto_1 = require("node:crypto");
+const stamps = new Map();
+const prefix = 'sessionStamp:';
+// random signing keys already invalidate all cookies on restart
+const persistent = process.env.COOKIE_SIGN_KEYS !== undefined;
+exports.sessionStampsReady = load();
+function getSessionStamp(username) {
+    return stamps.get(username)?.stamp;
+}
+function renewSessionStamp(username) {
+    const current = stamps.get(username);
+    if (current)
+        setStamp(username, current.credentials);
+}
+function syncSessionStamps(accounts) {
+    for (const username of stamps.keys())
+        if (!(username in accounts)) {
+            stamps.delete(username);
+            if (persistent)
+                void persistence_1.storedMap.del(prefix + username);
+        }
+    for (const [username, account] of Object.entries(accounts)) {
+        // compare values across reloads and restarts without duplicating credentials in data.kv
+        const credentials = (0, node_crypto_1.createHash)('sha256').update(JSON.stringify([
+            account?.srp, account?.password, account?.plugin,
+        ])).digest('hex');
+        if (stamps.get(username)?.credentials !== credentials)
+            setStamp(username, credentials);
+    }
+}
+function setStamp(username, credentials) {
+    const stamp = `${Date.now()}.${Math.floor(Math.random() * 1000).toString().padStart(3, '0')}`;
+    const record = { stamp, credentials };
+    stamps.set(username, record);
+    // accepted tradeoff: with fixed signing keys, a crash before this delayed write may lose a revocation
+    if (persistent)
+        void persistence_1.storedMap.put(prefix + username, record);
+}
+async function load() {
+    for await (const [key, record] of persistence_1.storedMap.iterator({ startsWith: prefix })) {
+        if (persistent)
+            stamps.set(key.slice(prefix.length), record);
+        else // re-enabling the same signing keys later must not revive cookies revoked during this run
+            void persistence_1.storedMap.del(key);
+    }
+}

package/src/uploadOwners.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.uploadOwners = exports.ownUploadDeleteHours = void 0;
+exports.grantUploadOwnerDelete = grantUploadOwnerDelete;
 exports.isUnfinishedUploadOwner = isUnfinishedUploadOwner;
 exports.setUploadOwner = setUploadOwner;
 exports.moveUploadOwner = moveUploadOwner;
@@ -33,7 +34,8 @@ setInterval(() => {
             void exports.uploadOwners.del(k);
     }
 }, misc_1.MINUTE);
-events_1.default.on('checkVfsPermission', ({ node, perm, ctx }) => {
+events_1.default.on('checkVfsPermission', grantUploadOwnerDelete);
+function grantUploadOwnerDelete({ node, perm, ctx }) {
     if (perm !== 'can_delete' || !node.source)
         return;
     const { vfsPath } = node;
@@ -49,7 +51,7 @@ events_1.default.on('checkVfsPermission', ({ node, perm, ctx }) => {
     }
     if (matchesOwner(owner, ctx))
         return 0;
-});
+}
 function matchesOwner(owner, ctx) {
     const username = (0, auth_1.getCurrentUsername)(ctx);
     const { sessionId } = owner;