hfs 3.3.3 → 3.4.0-alpha1

package/src/adminApis.js

@@ -149,11 +149,11 @@ exports.adminApis = {
             configFile: config_1.configFile.getPath(),
             urls: await (0, listen_1.getUrls)(),
             ips: await (0, listen_1.getIps)(false),
-            connectionAddress: (0, connections_1.normalizeIp)(ctx.socket.localAddress || ''),
+            connectionAddress: (0, misc_1.normalizeIp)(ctx.socket.localAddress || ''),
             baseUrl: await (0, listen_1.getBaseUrlOrDefault)(),
             roots: roots_1.roots.get(),
             anyAccountCanLoginAdmin: anyAccountCanLoginAdmin(),
-            updatePossible: !await (0, update_1.updateSupported)() ? false : (await (0, update_1.localUpdateAvailable)()) ? 'local' : true,
+            updatePossible: !await (0, update_1.updateNotSupported)() && (await (0, update_1.localUpdateAvailable)() ? 'local' : true),
             previousVersionAvailable: await (0, update_1.previousAvailable)(),
             autoCheckUpdateResult: update_1.autoCheckUpdateResult.get(), // in this form, we get the same type of the serialized json
             alerts: // in this form, we get the same type of the serialized json

package/src/adminLang.js

@@ -0,0 +1,50 @@
+"use strict";
+// This file is part of HFS - Copyright 2026, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adminLang = void 0;
+exports.getAdminLangs = getAdminLangs;
+exports.getAdminLangData = getAdminLangData;
+exports.invalidateAdminLang = invalidateAdminLang;
+const promises_1 = require("fs/promises");
+const misc_1 = require("./misc");
+const config_1 = require("./config");
+const expiringCache_1 = require("./expiringCache");
+const embedded_1 = __importDefault(require("./admin-langs/embedded"));
+const const_1 = require("./const");
+const lang_1 = require("./lang");
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const lodash_1 = __importDefault(require("lodash"));
+async function getAdminLangs() {
+    const files = await (0, fast_glob_1.default)((0, lang_1.code2file)('*', true));
+    return lodash_1.default.uniq([...Object.keys(embedded_1.default), ...files.map(name => (0, lang_1.file2code)(name, true))
+            .filter(code => (0, lang_1.normalizeLangCode)(code) === code)]);
+}
+exports.adminLang = (0, config_1.defineConfig)(misc_1.CFG.admin_lang, '', lang_1.normalizeLangCode);
+const cache = (0, expiringCache_1.expiringCache)(3_000);
+function getAdminLangData(ctx, langs) {
+    const configured = exports.adminLang.compiled();
+    const code = langs.includes(configured) ? configured : browserAdminLang(ctx, langs);
+    return cache.try(code, async () => ({
+        [code]: (0, misc_1.tryJson)(await (0, promises_1.readFile)((0, lang_1.code2file)(code, true), 'utf8').catch(() => ''))
+            || embedded_1.default[code] || embedded_1.default.en,
+        ...code === const_1.EMBEDDED_LANGUAGE ? {} : { [const_1.EMBEDDED_LANGUAGE]: embedded_1.default.en },
+    }));
+}
+function invalidateAdminLang(code) {
+    cache.delete(code); // uploads and deletions must be visible immediately after the Admin reloads
+}
+function browserAdminLang(ctx, langs) {
+    const accepted = ctx?.get('Accept-Language') || '';
+    for (const raw of accepted.split(',')) {
+        const code = (0, lang_1.normalizeLangCode)(raw);
+        if (langs.includes(code))
+            return code;
+        const base = code.split('-')[0] || '';
+        if (langs.includes(base))
+            return base;
+    }
+    return const_1.EMBEDDED_LANGUAGE;
+}

package/src/api.lang.js

@@ -12,30 +12,36 @@ const const_1 = require("./const");
 const misc_1 = require("./misc");
 const lang_1 = require("./lang");
 const embedded_1 = __importDefault(require("./langs/embedded"));
+const embedded_2 = __importDefault(require("./admin-langs/embedded"));
+const adminLang_1 = require("./adminLang");
 const SendList_1 = require("./SendList");
 const apis = {
     get_langs() {
         return new SendList_1.SendListReadable({
             doAtStart: async (list) => {
-                for await (let name of fast_glob_1.default.stream((0, lang_1.code2file)('*'))) {
-                    name = String(name);
-                    const code = (0, lang_1.file2code)(name);
-                    try {
-                        const data = JSON.parse(await (0, promises_1.readFile)(name, 'utf8'));
-                        list.add({ code, ...lodash_1.default.omit(data, 'translate') });
+                for (const admin of [false, true]) {
+                    for await (const name of fast_glob_1.default.stream((0, lang_1.code2file)('*', admin))) {
+                        const code = (0, lang_1.file2code)(String(name), admin);
+                        try {
+                            const data = JSON.parse(await (0, promises_1.readFile)(String(name), 'utf8'));
+                            list.add({ ...lodash_1.default.omit(data, 'translate'), code, admin, embedded: false });
+                        }
+                        catch { }
                     }
-                    catch { }
+                    for (const [code, data] of Object.entries(admin ? embedded_2.default : embedded_1.default))
+                        list.add({ ...lodash_1.default.omit(data, 'translate'), code, admin, embedded: true });
                 }
-                for (const [code, data] of Object.entries(embedded_1.default))
-                    list.add({ code, embedded: true, ...lodash_1.default.omit(data, 'translate') });
                 list.close();
             }
         });
     },
-    async del_lang({ code }) {
+    async del_lang({ code, admin = false }) {
+        (0, misc_1.apiAssertTypes)({ string: { code }, boolean: { admin } });
         validateCode(code);
         try {
-            await (0, promises_1.rm)((0, lang_1.code2file)(code));
+            await (0, promises_1.rm)((0, lang_1.code2file)(code, admin));
+            if (admin)
+                (0, adminLang_1.invalidateAdminLang)(code.toLowerCase());
             return {};
         }
         catch (e) {
@@ -45,14 +51,17 @@ const apis = {
     async add_langs({ langs }) {
         (0, misc_1.apiAssertTypes)({ object: { langs } });
         for (let [code, content] of Object.entries(langs)) {
-            code = (0, lang_1.file2code)(code);
+            const admin = code.startsWith('hfs-admin-lang-');
+            code = (0, lang_1.file2code)(code, admin);
             validateCode(code);
-            const fn = (0, lang_1.code2file)(code);
+            const fn = (0, lang_1.code2file)(code, admin);
             const s = String(content);
             const o = (0, misc_1.tryJson)(s);
             if (!o?.translate)
                 return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_ACCEPTABLE, "bad content for file " + fn);
             await (0, promises_1.writeFile)(fn, s, 'utf8');
+            if (admin)
+                (0, adminLang_1.invalidateAdminLang)(code.toLowerCase());
         }
         return {};
     }

package/src/api.log.js

@@ -33,25 +33,27 @@ exports.default = {
         await (0, serveFile_1.serveFile)(ctx, log.path);
         return null;
     },
-    get_log({ file = 'log' }, ctx) {
+    get_log({ file = 'log', skipInitial }, ctx) {
         (0, misc_1.apiAssertTypes)({ string: { file } });
         const files = file.split('|'); // potentially more than one
         return new SendList_1.SendListReadable({
             bufferTime: 10,
             async doAtStart(list) {
                 if (file === 'disconnections') {
-                    for (const x of connections_1.disconnectionsLog)
+                    for (const x of skipInitial ? [] : connections_1.disconnectionsLog)
                         list.add(x);
                     ctx.res.once('close', events_1.default.on('disconnection', x => list.add(x)));
                     return list.ready();
                 }
                 if (file === 'ips') {
+                    if (skipInitial)
+                        return list.ready();
                     for await (const [k, v] of ips_1.ips.iterator())
                         list.add({ ip: k, ...v });
                     return list.ready();
                 }
                 if (file === 'console') {
-                    for (const chunk of lodash_1.default.chunk(consoleLog_1.consoleLog, 1000)) { // avoid occupying the thread too long
+                    for (const chunk of lodash_1.default.chunk(skipInitial ? [] : consoleLog_1.consoleLog, 1000)) { // avoid occupying the thread too long
                         for (const x of chunk)
                             list.add(x);
                         await (0, cross_1.wait)(0);

package/src/api.net.js

@@ -14,6 +14,7 @@ const promises_1 = require("dns/promises");
 const net_1 = require("net");
 const nat_1 = require("./nat");
 const acme_1 = require("./acme");
+const acmeConfig_1 = require("./acmeConfig");
 const selfCheck_1 = require("./selfCheck");
 exports.default = {
     get_nat: nat_1.getNatInfo,
@@ -83,13 +84,29 @@ exports.default = {
         const results = (0, misc_1.onlyTruthy)(await (0, misc_1.promiseBestEffort)(publicIps.map(ip => (0, selfCheck_1.selfCheck)(`${proto}://${(0, misc_1.ipForUrl)(ip)}${finalPort === defPort ? '' : ':' + finalPort}`))));
         return results.length ? results : new apiMiddleware_1.ApiError(const_1.HTTP_SERVICE_UNAVAILABLE);
     },
-    async make_cert({ domain, email, altNames }) {
-        (0, misc_1.apiAssertTypes)({ string: { domain }, string_undefined: { email }, array_undefined: { altNames } });
+    get_acme: acmeConfig_1.getAcmeSettings,
+    get_acme_status: acme_1.getAcmeStatusEvents,
+    async set_acme({ settings }) {
+        if ((0, acme_1.getAcmeStatus)().state === 'running')
+            throw new apiMiddleware_1.ApiError(409, "Certificate request already running");
+        if (!settings || typeof settings !== 'object')
+            throw new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
+        return (0, acmeConfig_1.setAcmeSettings)(settings).catch(error => { throw new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, error.message); });
+    },
+    async make_cert({ domain, email, altNames, background }) {
+        (0, misc_1.apiAssertTypes)({ string: { domain }, string_undefined: { email }, array_undefined: { altNames }, boolean_undefined: { background } });
         if (!domain)
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad params');
         if (altNames?.some((name) => typeof name !== 'string'))
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad altNames');
-        await (0, acme_1.makeCert)(domain, email, altNames).catch(e => {
+        if ((0, acme_1.getAcmeStatus)().state === 'running')
+            throw new apiMiddleware_1.ApiError(409, "Certificate request already running");
+        const pending = (0, acme_1.makeCert)(domain, email, altNames);
+        if (background) {
+            void pending.catch(() => { }); // the status stream carries the error even after the browser disconnects
+            return { id: (0, acme_1.getAcmeStatus)().id };
+        }
+        await pending.catch(e => {
             throw new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, e.message || String(e));
         });
         return {};

package/src/api.plugins.js

@@ -13,9 +13,10 @@ const promises_1 = require("fs/promises");
 const github_1 = require("./github");
 const const_1 = require("./const");
 const SendList_1 = require("./SendList");
+const pluginCatalog_1 = require("./pluginCatalog");
 const apis = {
-    get_plugins({}, ctx) {
-        const list = new SendList_1.SendListReadable({ addAtStart: [...(0, plugins_1.mapPlugins)(serialize, false), ...(0, plugins_1.getInactivePlugins)().map(serialize)] });
+    get_plugins({ skipInitial }, ctx) {
+        const list = new SendList_1.SendListReadable({ addAtStart: skipInitial ? [] : [...(0, plugins_1.mapPlugins)(serialize, false), ...(0, plugins_1.getInactivePlugins)().map(serialize)] });
         return list.events(ctx, {
             pluginInstalled: p => list.add(serialize(p)),
             'pluginStarted pluginStopped pluginUpdated': p => {
@@ -26,7 +27,7 @@ const apis = {
             pluginLog: id => list.update({ id }, { log: true }) // SendList is already capping frequency
         });
     },
-    async get_plugin_updates({}, ctx) {
+    async get_plugin_updates({ skipInitial }, ctx) {
         return new SendList_1.SendListReadable({
             async doAtStart(list) {
                 const errs = {};
@@ -38,6 +39,8 @@ const apis = {
                         list.update({ id }, { updated: true });
                     }
                 });
+                if (skipInitial)
+                    return list.ready();
                 await plugins_1.pluginsScanned;
                 await Promise.allSettled(lodash_1.default.map((0, github_1.getFolder2repo)(), async (repo, folder) => {
                     try {
@@ -73,11 +76,17 @@ const apis = {
     async start_plugin({ id }) {
         assertPluginId(id);
         if ((0, plugins_1.isPluginRunning)(id))
-            return { msg: 'already running' };
+            return serializeRunningPlugin(id);
         if (plugins_1.suspendPlugins.get())
             return new apiMiddleware_1.ApiError(misc_1.HTTP_PRECONDITION_FAILED, 'all plugins suspended');
         await (0, plugins_1.stopPlugin)(id);
-        return (0, plugins_1.startPlugin)(id).then(() => ({}), e => new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, e.message));
+        try {
+            await (0, plugins_1.startPlugin)(id);
+        }
+        catch (e) {
+            return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR, e.message);
+        }
+        return serializeRunningPlugin(id);
     },
     async stop_plugin({ id }) {
         assertPluginId(id);
@@ -104,42 +113,63 @@ const apis = {
             }
         };
     },
-    get_online_plugins({ text }, ctx) {
+    get_online_plugins({ text, skipInitial }, ctx) {
         if (text !== undefined && !lodash_1.default.isString(text))
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad text');
         return new SendList_1.SendListReadable({
             async doAtStart(list) {
+                // resumed clients retain their own rows; updates for other repos are ignored by useApiList
                 const repos = [];
                 list.events(ctx, {
                     pluginInstalled: p => {
-                        if (repos.includes(p.repo))
+                        if (skipInitial || repos.includes(p.repo))
                             list.update({ id: p.repo }, { installed: true });
                     },
                     pluginUninstalled: (_folder, repo) => {
                         if (typeof repo !== 'string')
                             return; // custom repo
-                        if (repos.includes(repo))
+                        if (skipInitial || repos.includes(repo))
                             list.update({ id: repo }, { installed: false });
                     },
                     pluginDownload({ repo, status }) {
-                        if (repos.includes(repo))
+                        if (skipInitial || repos.includes(repo))
                             list.update({ id: repo }, { downloading: status ?? null });
                     }
                 });
+                if (skipInitial)
+                    return list.ready();
+                let updatedAt;
+                let previous = new Map();
                 try {
-                    const already = Object.values((0, github_1.getFolder2repo)()).filter(Boolean).map(String);
-                    for await (const pl of await (0, github_1.searchPlugins)(text, { skipRepos: already })) {
+                    for await (const snapshot of (0, pluginCatalog_1.getPluginCatalog)()) {
+                        const already = Object.values((0, github_1.getFolder2repo)()).filter(Boolean).map(String);
+                        const plugins = await (0, pluginCatalog_1.searchPluginCatalog)(snapshot, text, already);
                         if (ctx.isAborted())
                             return;
-                        const repo = pl.repo || pl.id; // .repo property can be more trustworthy in case github user renamed and left the previous link in 'repo'
-                        const missing = (0, plugins_1.getMissingDependencies)(pl);
-                        if (missing.length)
-                            pl.missing = missing;
-                        list.add(pl);
-                        repos.push(repo);
+                        const rows = plugins.map(pl => {
+                            const missing = (0, plugins_1.getMissingDependencies)(pl);
+                            return { ...pl, missing: missing.length ? missing : null, downloading: github_1.downloading[pl.repo] ?? null };
+                        });
+                        // reconcile snapshots without dropping selection or retaining obsolete optional metadata
+                        for (const id of previous.keys())
+                            if (!rows.some(row => row.id === id))
+                                list.remove({ id });
+                        for (const row of rows) {
+                            const old = previous.get(row.id);
+                            if (old)
+                                list.update({ id: row.id }, { ...lodash_1.default.mapValues(old, () => null), ...lodash_1.default.mapValues(row, value => value ?? null) });
+                            else
+                                list.add(row);
+                        }
+                        previous = new Map(rows.map(row => [row.id, row]));
+                        repos.splice(0, repos.length, ...rows.map(row => row.repo));
+                        updatedAt = snapshot.updatedAt;
+                        list.props({ updatedAt, refreshing: snapshot.refreshing });
+                        list.ready();
                     }
                 }
                 catch (err) {
+                    list.props({ updatedAt, refreshing: false });
                     list.error(err.code || err.message);
                 }
                 list.ready();
@@ -177,12 +207,12 @@ const apis = {
             (0, plugins_1.setPluginConfig)(id, null);
         return {};
     },
-    get_plugin_log({ id }, ctx) {
+    get_plugin_log({ id, skipInitial }, ctx) {
         assertPluginId(id);
         const p = (0, plugins_1.getPluginInfo)(id);
         if (!p)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
-        const list = new SendList_1.SendListReadable({ addAtStart: p.log });
+        const list = new SendList_1.SendListReadable({ addAtStart: skipInitial ? [] : p.log });
         return list.events(ctx, {
             ['pluginLog:' + id]: x => list.add(x)
         });
@@ -202,6 +232,10 @@ function serialize(p) {
         : JSON.stringify(o.config, (_k, v) => lodash_1.default.isFunction(v) ? String(v) : v); // allow simple functions
     return lodash_1.default.defaults(o, { started: null, badApi: null }); // nulls should be used to be sure to overwrite previous values,
 }
+function serializeRunningPlugin(id) {
+    const plugin = (0, plugins_1.firstPlugin)((plugin, pluginId) => pluginId === id ? plugin : undefined);
+    return plugin ? serialize(plugin) : new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
+}
 async function checkDependencies(plugin) {
     const miss = await (0, plugins_1.getMissingDependencies)(plugin);
     if (miss.length)

package/src/argv.js

@@ -6,3 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.argv = void 0;
 const minimist_1 = __importDefault(require("minimist"));
 exports.argv = (0, minimist_1.default)(process.argv.slice(2));
+// Node's internal flag is read-only when enabled via its CLI, but remains configurable
+Object.defineProperty(process, 'traceProcessWarnings', {
+    value: exports.argv['trace-warnings'] !== false, writable: true, configurable: true,
+});

package/src/auth.js

@@ -115,8 +115,6 @@ async function setLoggedIn(ctx, username, via) {
         ctx.throw(cross_const_1.HTTP_UNAUTHORIZED, error);
     }
     const normalized = (0, perm_1.normalizeUsername)(username);
-    if (s.username !== normalized)
-        delete s.allowNet; // discard restrictions cached for another identity before replacing the session account
     s.username = normalized;
     s.ts = Date.now();
     s.ip = ctx.ip;

package/src/basicWeb.js

@@ -17,8 +17,12 @@ const autoBasic = (0, config_1.defineConfig)(misc_1.CFG.auto_basic, true, v => l
 function basicWeb(ctx, node) {
     const { get } = ctx.query;
     if (get === 'login') {
-        if ((0, auth_1.getCurrentUsername)(ctx))
-            ctx.redirect(ctx.get('referer'));
+        if ((0, auth_1.getCurrentUsername)(ctx)) {
+            const referer = ctx.get('referer');
+            const url = referer && (0, misc_1.try_)(() => new URL(referer, ctx.URL));
+            // keep the origin in Location because a same-origin path starting with // would redirect externally
+            ctx.redirect(url && url.origin === ctx.URL.origin ? url.origin + url.pathname + url.search + url.hash : '/');
+        }
         else {
             ctx.set('WWW-Authenticate', cross_const_1.BASIC_AUTHENTICATE_HEADER);
             ctx.status = cross_const_1.HTTP_UNAUTHORIZED;

package/src/block.js

@@ -26,7 +26,7 @@ exports.block = (0, config_1.defineConfig)(misc_1.CFG.block, [], rules => {
     });
     return ret;
 });
-function applyBlock(socket, ip = (0, connections_1.normalizeIp)(socket.remoteAddress || '')) {
+function applyBlock(socket, ip = (0, misc_1.normalizeIp)(socket.remoteAddress || '')) {
     if (ip && isBlocked(ip))
         return (0, connections_1.disconnect)(socket, 'block-ip');
 }

package/src/config.js

@@ -244,6 +244,7 @@ Most common configurations:
 For a description of each configuration, please refer to https://rejetto.com/hfs-config
 Other options:
     --debug will print extra information
+    --no-trace-warnings will disable stack traces for Node.js warnings (enabled by default)
     `);
     process.exit(0);
 });

package/src/connections.js

@@ -5,7 +5,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.disconnectionsLog = exports.Connection = void 0;
-exports.normalizeIp = normalizeIp;
 exports.newConnection = newConnection;
 exports.getConnections = getConnections;
 exports.socket2connection = socket2connection;
@@ -16,6 +15,7 @@ exports.disconnect = disconnect;
 const events_1 = __importDefault(require("./events"));
 const geo_1 = require("./geo");
 const lodash_1 = __importDefault(require("lodash"));
+const cross_1 = require("./cross");
 class Connection {
     socket;
     started = new Date();
@@ -41,19 +41,16 @@ class Connection {
             events_1.default.emit('connectionNewIp', this, this._cachedIp, this.ctx.ip);
             this._cachedIp = undefined;
         }
-        return this.ctx?.ip || (this._cachedIp ??= normalizeIp(this.socket.remoteAddress || ''));
+        return this.ctx?.ip || (this._cachedIp ??= (0, cross_1.normalizeIp)(this.socket.remoteAddress || ''));
     }
     get secure() {
         return this.socket.server.cert > '';
     }
 }
 exports.Connection = Connection;
-function normalizeIp(ip) {
-    return ip.replace(/^::ffff:/, ''); // simplify ipv6-mapped addresses
-}
 const all = [];
 function newConnection(socket) {
-    const ip = normalizeIp(socket.remoteAddress || '');
+    const ip = (0, cross_1.normalizeIp)(socket.remoteAddress || '');
     const res = events_1.default.emit('newSocket', { socket, ip });
     const msg = res?.isDefaultPrevented() ? 'plugin (newSocket)' : res?.find(lodash_1.default.isString);
     if (!msg)
@@ -90,7 +87,7 @@ exports.disconnectionsLog = [];
 function disconnect(what, logMessage = '') {
     if ('socket' in what)
         what = what.socket;
-    const ip = normalizeIp(what.remoteAddress || '');
+    const ip = (0, cross_1.normalizeIp)(what.remoteAddress || '');
     if (logMessage)
         console.debug("Disconnection:", logMessage, ip);
     (0, geo_1.ip2country)(ip).then(res => {

package/src/const.js

@@ -49,7 +49,7 @@ const path_1 = require("path");
 const cross_1 = require("./cross");
 const argv_1 = require("./argv");
 __exportStar(require("./cross-const"), exports);
-exports.API_VERSION = 13.5;
+exports.API_VERSION = 13.6;
 exports.COMPATIBLE_API_VERSION = 1; // the day we break with the past, we'll update this
 // you can add arguments with this file, currently used for the update process on mac/linux.
 // we are using homedir because it's the only stable path both the old and new process can agree on (open() doesn't preserve cwd)

package/src/cross-const.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HTTP_MESSAGES = exports.HTTP_INSUFFICIENT_STORAGE = exports.HTTP_SERVICE_UNAVAILABLE = exports.HTTP_SERVER_ERROR = exports.HTTP_TOO_MANY_REQUESTS = exports.HTTP_FAILED_DEPENDENCY = exports.HTTP_LOCKED = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_PRECONDITION_FAILED = exports.HTTP_LENGTH_REQUIRED = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_MOVED_PERMANENTLY = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_CREATED = exports.HTTP_OK = exports.CFG = exports.MB = exports.KB = exports.BASIC_AUTHENTICATE_HEADER = exports.EMBEDDED_LANGUAGE = exports.MASK_IN_TESTS = exports.HIDE_IN_TESTS = exports.ALLOW_SESSION_IP_CHANGE = exports.PREVIOUS_TAG = exports.MTIME_CHECK = exports.UPLOAD_TEMP_HASH = exports.UPLOAD_TEMP_PREFIX = exports.HFS_REPO = exports.PLUGIN_CUSTOM_REST_PREFIX = exports.NBSP = exports.PORT_DISABLED = exports.ICONS_URI = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = void 0;
+exports.HTTP_MESSAGES = exports.HTTP_INSUFFICIENT_STORAGE = exports.HTTP_SERVICE_UNAVAILABLE = exports.HTTP_SERVER_ERROR = exports.HTTP_TOO_MANY_REQUESTS = exports.HTTP_FAILED_DEPENDENCY = exports.HTTP_LOCKED = exports.HTTP_FOOL = exports.HTTP_RANGE_NOT_SATISFIABLE = exports.HTTP_PAYLOAD_TOO_LARGE = exports.HTTP_PRECONDITION_FAILED = exports.HTTP_LENGTH_REQUIRED = exports.HTTP_CONFLICT = exports.HTTP_NOT_ACCEPTABLE = exports.HTTP_METHOD_NOT_ALLOWED = exports.HTTP_NOT_FOUND = exports.HTTP_FORBIDDEN = exports.HTTP_UNAUTHORIZED = exports.HTTP_BAD_REQUEST = exports.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD = exports.HTTP_NOT_MODIFIED = exports.HTTP_TEMPORARY_REDIRECT = exports.HTTP_MOVED_PERMANENTLY = exports.HTTP_PARTIAL_CONTENT = exports.HTTP_NO_CONTENT = exports.HTTP_CREATED = exports.HTTP_OK = exports.CFG = exports.MB = exports.KB = exports.BASIC_AUTHENTICATE_HEADER = exports.EMBEDDED_LANGUAGE = exports.MASK_IN_TESTS = exports.HIDE_IN_TESTS = exports.ALLOW_SESSION_IP_CHANGE = exports.PREVIOUS_TAG = exports.MTIME_CHECK = exports.UPLOAD_TEMP_HASH = exports.UPLOAD_TEMP_PREFIX = exports.PLUGIN_USAGE_URL = exports.HFS_REPO = exports.PLUGIN_CUSTOM_REST_PREFIX = exports.NBSP = exports.PORT_DISABLED = exports.ICONS_URI = exports.PLUGINS_PUB_URI = exports.API_URI = exports.ADMIN_URI = exports.FRONTEND_URI = exports.SPECIAL_URI = void 0;
 exports.SPECIAL_URI = '/~/';
 exports.FRONTEND_URI = exports.SPECIAL_URI + 'frontend/';
 exports.ADMIN_URI = exports.SPECIAL_URI + 'admin/';
@@ -11,6 +11,7 @@ exports.PORT_DISABLED = -1;
 exports.NBSP = '\xA0';
 exports.PLUGIN_CUSTOM_REST_PREFIX = '_';
 exports.HFS_REPO = 'rejetto/hfs';
+exports.PLUGIN_USAGE_URL = 'https://hfs-api.rejetto.com/plugin-usage';
 exports.UPLOAD_TEMP_PREFIX = 'hfs$upload-';
 exports.UPLOAD_TEMP_HASH = 'upload-temp-hash';
 exports.MTIME_CHECK = 'x-mtime-check';
@@ -18,12 +19,12 @@ exports.PREVIOUS_TAG = 'previous';
 exports.ALLOW_SESSION_IP_CHANGE = 'allow_session_ip_change';
 exports.HIDE_IN_TESTS = 'hideInTests'; // elements that have variable size, where masking would produce changes, must be hidden
 exports.MASK_IN_TESTS = 'maskInTests';
-exports.EMBEDDED_LANGUAGE = 'en'; // frontend includes this language in the code, and not need to import the translation-json
+exports.EMBEDDED_LANGUAGE = 'en';
 exports.BASIC_AUTHENTICATE_HEADER = 'Basic realm="HFS"';
 exports.KB = 1024;
 exports.MB = exports.KB * exports.KB;
 exports.CFG = constMap([
-    'accounts', 'acme_domain', 'acme_renew', 'admin_net', 'allowed_referer',
+    'accounts', 'acme_domain', 'acme_renew', 'acme_challenge', 'acme_dns', 'admin_lang', 'admin_net', 'allowed_referer',
     'authorization_header', 'auto_basic', 'auto_check_update', 'auto_play_seconds',
     'base_url', 'block', 'cache_control_disk_files', 'cert', 'comments_storage',
     'create-admin', 'debug', 'delete_unfinished_uploads_after',
@@ -33,12 +34,12 @@ exports.CFG = constMap([
     'force_https', 'force_lang', 'force_webdav_login',
     'geo_allow', 'geo_allow_unknown', 'geo_enable', 'geo_ignore_net', 'geo_list',
     'ignore_proxies', 'invert_order', 'keep_session_alive', 'listen_interface',
-    'localhost_admin', 'log', 'log_api', 'log_gui', 'log_host', 'log_rotation', 'log_spam',
+    'localhost_admin', 'log', 'log_api', 'log_gui', 'log_host', 'log_rotation', 'log_spam', 'log_spam_regex',
     'log_ua', 'mapped_port', 'max_downloads', 'max_downloads_per_account',
     'max_downloads_per_ip', 'max_kbps', 'max_kbps_per_ip', 'menu_at_top', 'mime',
     'min_available_mb', 'open_browser_at_start', 'outbound_interface', 'outbound_proxy', 'own_upload_delete_hours',
     'page_size', 'plugins_config', 'port', 'private_key', 'proxies', 'roots', 'server_code',
-    'session_duration', 'show_hidden_files', 'show_uploader', 'size_1024',
+    'session_duration', 'share_usage_stats', 'show_hidden_files', 'show_uploader', 'size_1024',
     'smart_unc_folder_detection', 'sort_by', 'sort_numerics', 'split_uploads',
     'suspend_plugins', 'theme', 'tile_size', 'title', 'title_with_path', 'track_ips',
     'update_to_beta', 'upnp_enabled', 'version', 'vfs', 'webdav_initial_auth',
@@ -54,6 +55,7 @@ exports.HTTP_PARTIAL_CONTENT = 206;
 exports.HTTP_MOVED_PERMANENTLY = 301;
 exports.HTTP_TEMPORARY_REDIRECT = 302;
 exports.HTTP_NOT_MODIFIED = 304;
+exports.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD = 307;
 exports.HTTP_BAD_REQUEST = 400;
 exports.HTTP_UNAUTHORIZED = 401;
 exports.HTTP_FORBIDDEN = 403;

package/src/cross.js

@@ -77,6 +77,7 @@ exports.xlate = xlate;
 exports.normalizeHost = normalizeHost;
 exports.isIpLocalHost = isIpLocalHost;
 exports.isIpLan = isIpLan;
+exports.normalizeIp = normalizeIp;
 exports.ipForUrl = ipForUrl;
 exports.escapeHTML = escapeHTML;
 exports.promiseBestEffort = promiseBestEffort;
@@ -460,7 +461,20 @@ function isIpLocalHost(ip) {
     return ip === '::1' || /^(?:::ffff:)?127\.0\.0\.1$/i.test(ip);
 }
 function isIpLan(ip) {
-    return /^(?:10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|fe80::)/.test(ip);
+    return /^(?:10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|f[cd][\da-f]{2}:|fe[89ab][\da-f]:)/i.test(normalizeIp(ip));
+}
+function normalizeIp(ip) {
+    // proxy headers may contain invalid addresses; do not interpret URL paths or credentials as an IP
+    if (!/^[\da-f:.\[\]]+$/i.test(ip))
+        return ip;
+    // URL canonicalizes IPv6 and alternate IPv4 spellings before matching
+    const host = try_(() => new URL(`http://${ip.includes(':') && !ip.startsWith('[') ? `[${ip}]` : ip}`).hostname) || ip;
+    const bare = host.startsWith('[') ? host.slice(1, -1) : host;
+    if (bare.startsWith('::ffff:')) {
+        const words = bare.slice(7).split(':').map(x => parseInt(x, 16));
+        return words.flatMap(x => [x >> 8, x & 255]).join('.');
+    }
+    return bare;
 }
 function ipForUrl(ip) {
     if (ip.startsWith('['))