hfs 3.4.0-alpha1 → 3.4.0-alpha2

package/src/adminApis.js

@@ -38,6 +38,7 @@ const ddns_1 = require("./ddns");
 const block_1 = require("./block");
 const github_1 = require("./github");
 const acme_1 = require("./acme");
+const first_1 = require("./first");
 exports.adminApis = {
     ...api_vfs_1.default,
     ...api_accounts_1.default,
@@ -133,7 +134,7 @@ exports.adminApis = {
         return {};
     },
     quit() {
-        setTimeout(() => process.exit());
+        setTimeout(first_1.quit); // let the API response finish before starting ordered cleanup
         return {};
     },
     async get_status(_params, ctx) {

package/src/adminLang.js

@@ -22,7 +22,7 @@ async function getAdminLangs() {
     return lodash_1.default.uniq([...Object.keys(embedded_1.default), ...files.map(name => (0, lang_1.file2code)(name, true))
             .filter(code => (0, lang_1.normalizeLangCode)(code) === code)]);
 }
-exports.adminLang = (0, config_1.defineConfig)(misc_1.CFG.admin_lang, '', lang_1.normalizeLangCode);
+exports.adminLang = (0, config_1.defineConfig)(misc_1.CFG.admin_lang, '', v => (0, lang_1.langCodeForLookup)((0, lang_1.normalizeLangCode)(v)));
 const cache = (0, expiringCache_1.expiringCache)(3_000);
 function getAdminLangData(ctx, langs) {
     const configured = exports.adminLang.compiled();
@@ -39,12 +39,13 @@ function invalidateAdminLang(code) {
 function browserAdminLang(ctx, langs) {
     const accepted = ctx?.get('Accept-Language') || '';
     for (const raw of accepted.split(',')) {
-        const code = (0, lang_1.normalizeLangCode)(raw);
-        if (langs.includes(code))
-            return code;
-        const base = code.split('-')[0] || '';
-        if (langs.includes(base))
-            return base;
+        let code = (0, lang_1.normalizeLangCode)(raw);
+        while (code) {
+            const candidate = (0, lang_1.langCodeForLookup)(code);
+            if (langs.includes(candidate))
+                return candidate;
+            code = code.substring(0, code.lastIndexOf('-'));
+        }
     }
     return const_1.EMBEDDED_LANGUAGE;
 }

package/src/api.accounts.js

@@ -9,6 +9,7 @@ const perm_1 = require("./perm");
 const lodash_1 = __importDefault(require("lodash"));
 const const_1 = require("./const");
 const auth_1 = require("./auth");
+const sessionStamp_1 = require("./sessionStamp");
 const misc_1 = require("./misc");
 const api_vfs_1 = require("./api.vfs");
 function serializeAccount(ac) {
@@ -23,7 +24,7 @@ function serializeAccount(ac) {
         adminActualAccess: (0, perm_1.accountCanLoginAdmin)(ac),
         canLogin: hasLogin ? (0, perm_1.accountCanLogin)(ac) : undefined,
         canChangePassword: (0, perm_1.accountCanChangePassword)(ac),
-        invalidated: auth_1.invalidateSessionBefore.get(ac.username),
+        invalidated: Number((0, sessionStamp_1.getSessionStamp)(ac.username)?.split('.')[0]) || undefined,
         directMembers: Object.values(perm_1.accounts.get()).filter(a => a.belongs?.includes(ac.username)).map(x => x.username),
         members: (0, misc_1.with_)(Object.values(perm_1.accounts.get()), accounts => {
             const ret = [];
@@ -60,11 +61,13 @@ exports.default = {
         if (!acc)
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
         await (0, perm_1.updateAccount)(acc, (0, api_vfs_1.pickProps)(changes, ALLOWED_KEYS));
-        if (changes.username && ctx.session?.username === (0, perm_1.normalizeUsername)(username)) // update session if necessary
+        if (ctx.session?.username === (0, perm_1.normalizeUsername)(username)) { // preserve only the session making its own account change
             ctx.session.username = acc.username;
+            ctx.session.stamp = (0, sessionStamp_1.getSessionStamp)(acc.username);
+        }
         return lodash_1.default.pick(acc, 'username');
     },
-    async add_account({ overwrite, username, ...rest }) {
+    async add_account({ overwrite, username, ...rest }, ctx) {
         (0, misc_1.apiAssertTypes)({ string: { username } });
         const existing = (0, perm_1.getAccount)(username);
         rest = (0, api_vfs_1.pickProps)(rest, ALLOWED_KEYS);
@@ -72,6 +75,8 @@ exports.default = {
             if (!overwrite)
                 return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT);
             await (0, perm_1.updateAccount)(existing, rest);
+            if (ctx.session?.username === existing.username)
+                ctx.session.stamp = (0, sessionStamp_1.getSessionStamp)(existing.username);
             return lodash_1.default.pick(existing, 'username');
         }
         const acc = await (0, perm_1.addAccount)(username, rest);
@@ -87,7 +92,7 @@ exports.default = {
     },
     invalidate_sessions({ username }) {
         (0, misc_1.apiAssertTypes)({ string: { username } });
-        auth_1.invalidateSessionBefore.set((0, perm_1.normalizeUsername)(username), Date.now());
+        (0, perm_1.invalidateAccountSessions)(username);
         return {};
     },
 };

package/src/api.auth.js

@@ -16,6 +16,7 @@ const events_1 = __importDefault(require("./events"));
 const misc_1 = require("./misc");
 const uploadOwners_1 = require("./uploadOwners");
 const node_crypto_1 = require("node:crypto");
+const sessionStamp_1 = require("./sessionStamp");
 const ongoingLogins = {}; // store data that doesn't fit session object
 const keepSessionAlive = (0, config_1.defineConfig)(misc_1.CFG.keep_session_alive, true);
 const fakeSrpSecret = (0, node_crypto_1.randomBytes)(32);
@@ -66,7 +67,7 @@ exports.authApis = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
         if (account?.plugin?.auth) // tell client to do clear-text login, before firing attemptingLogin, before triggering anti-brute
             return new apiMiddleware_1.ApiError(const_1.HTTP_METHOD_NOT_ALLOWED);
-        if ((await events_1.default.emitAsync('attemptingLogin', { ctx, username }))?.isDefaultPrevented())
+        if ((await events_1.default.emitAsync('attemptingLogin', { ctx, username, via: 'srp' }))?.isDefaultPrevented())
             return;
         if (account && !(0, perm_1.accountCanLogin)(account)) {
             ctx.logExtra({ u: username });
@@ -76,13 +77,14 @@ exports.authApis = {
         if (account && (0, middlewares_1.failAllowNet)(ctx, account))
             return unauthorized();
         try { // unknown users complete step 1 so only a full failed login can reveal and penalize the attempt
+            const stamp = account && (0, sessionStamp_1.getSessionStamp)(account.username);
             const { srpServer, ...rest } = await (0, auth_1.srpServerStep1)(account || fakeSrpAccount(username));
             // keep the public handshake identifier independent of predictable application PRNG state
             const sid = (0, node_crypto_1.randomUUID)();
             ongoingLogins[sid] = srpServer;
             setTimeout(() => delete ongoingLogins[sid], 60_000); // client must complete api sequence (loginSrp2) within 1 minute or will be discarded to avoid memory leaks
             // 60-second expiry bounded 5k challenges to ~37 MB in a local saturation test, so an additional cap isn't justified
-            ctx.session.loggingIn = { username, sid }; // temporarily store until process is complete
+            ctx.session.loggingIn = { username, sid, stamp }; // temporarily store until process is complete
             return rest;
         }
         catch (code) {
@@ -109,7 +111,7 @@ exports.authApis = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_SERVER_ERROR);
         if (!ctx.session.loggingIn)
             return new apiMiddleware_1.ApiError(const_1.HTTP_CONFLICT);
-        const { username, sid } = ctx.session.loggingIn;
+        const { username, sid, stamp } = ctx.session.loggingIn;
         delete ctx.session.loggingIn;
         const step1 = ongoingLogins[sid];
         if (!step1)
@@ -117,6 +119,10 @@ exports.authApis = {
         try {
             const M2 = await step1.step2(BigInt(pubKey), BigInt(proof))
                 .catch(() => { throw ''; }); // falsy value for later
+            // an old-password handshake must not mint a session after credentials have been revoked
+            const account = (0, perm_1.getAccount)(username);
+            if (!account || !stamp || stamp !== (0, sessionStamp_1.getSessionStamp)(account.username))
+                throw '';
             await (0, auth_1.setLoggedIn)(ctx, username, 'srp');
             return {
                 proof: String(M2),
@@ -150,6 +156,8 @@ exports.authApis = {
         if (!salt || !verifier)
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'missing parameters');
         await (0, perm_1.updateAccount)(a, a => (0, perm_1.saveSrpInfo)(a, salt, verifier));
+        if (ctx.session?.username === a.username)
+            ctx.session.stamp = (0, sessionStamp_1.getSessionStamp)(a.username);
         delete a.require_password_change;
         return {};
     }

package/src/api.vfs.js

@@ -36,8 +36,9 @@ exports.default = {
                 delete copyStats.mtime;
             const inherited = node.parent && (0, vfs_1.permsFromParent)(node.parent, {});
             const byMasks = node.original && lodash_1.default.pickBy(node, (v, k) => v !== node.original[k] // something is changing me...
-                && !(inherited && k in inherited) // ...and it's not inheritance...
-                && misc_1.PERM_KEYS.includes(k)); // ...must be masks. Please limit this to perms
+                && (k === 'gui_asset'
+                    ? v !== node.parent?.gui_asset // gui_asset inherits outside the permission helpers
+                    : !(inherited && k in inherited) && misc_1.PERM_KEYS.includes(k))); // ...must be masks
             return {
                 ...copyStats,
                 ...node.original || node,

package/src/auth.js

@@ -36,7 +36,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invalidateSessionBefore = void 0;
 exports.srpServerStep1 = srpServerStep1;
 exports.srpCheck = srpCheck;
 exports.getCurrentUsername = getCurrentUsername;
@@ -51,6 +50,7 @@ const cross_1 = require("./cross");
 const expiringCache_1 = require("./expiringCache");
 const node_crypto_1 = require("node:crypto");
 const events_1 = __importDefault(require("./events"));
+const sessionStamp_1 = require("./sessionStamp");
 const srp6aNimbusRoutines = new srp.SRPRoutines(new srp.SRPParameters());
 async function srpServerStep1(account) {
     if (!account.srp)
@@ -67,13 +67,17 @@ async function srpCheck(username, password) {
     const account = (0, perm_1.getAccount)(username);
     if (!account?.srp || !password)
         return;
-    const k = (0, node_crypto_1.createHash)('sha256').update(username + password + account.srp).digest("hex");
+    const verifier = account.srp;
+    const sessionStamp = (0, sessionStamp_1.getSessionStamp)(account.username);
+    const k = (0, node_crypto_1.createHash)('sha256').update(username + password + verifier).digest("hex");
     const good = await cache.try(k, async () => {
         const { srpServer, salt, pubKey } = await srpServerStep1(account);
         const client = await (0, srp_1.srpClientPart)(srp, username, password, salt, pubKey);
         return srpServer.step2(client.A, client.M1).then(() => true, () => false);
     });
-    return good ? account : undefined;
+    // verification can finish after a password change or account replacement
+    return good && (0, perm_1.getAccount)(username) === account && account.srp === verifier && (0, sessionStamp_1.getSessionStamp)(account.username) === sessionStamp
+        ? account : undefined;
 }
 function getCurrentUsername(ctx) {
     return ctx.state.account?.username || '';
@@ -81,13 +85,19 @@ function getCurrentUsername(ctx) {
 async function clearTextLogin(ctx, u, p, via) {
     if (!p)
         return;
-    if ((await events_1.default.emitAsync('attemptingLogin', { ctx, username: u, via }))?.isDefaultPrevented())
-        return;
-    const plugins = await events_1.default.emitAsync('clearTextLogin', { ctx, username: u, password: p, via }); // provide clear password to plugins
-    const a = plugins?.some(x => x === true) ? (0, perm_1.getAccount)(u) : await srpCheck(u, p);
-    if (!a && u)
-        events_1.default.emit('failedLogin', { ctx, username: u, via });
-    return a;
+    let account;
+    try {
+        if ((await events_1.default.emitAsync('attemptingLogin', { ctx, username: u, via }))?.isDefaultPrevented())
+            return;
+        const plugins = await events_1.default.emitAsync('clearTextLogin', { ctx, username: u, password: p, via }); // provide clear password to plugins
+        account = plugins?.some(x => x === true) ? (0, perm_1.getAccount)(u) : await srpCheck(u, p);
+        if (!account && u)
+            events_1.default.emit('failedLogin', { ctx, username: u, via });
+        return account;
+    }
+    finally {
+        events_1.default.emit('loginAttemptFinished', { ctx, username: u, via, success: Boolean(account) });
+    }
 }
 // centralized log-in state
 async function setLoggedIn(ctx, username, via) {
@@ -106,8 +116,11 @@ async function setLoggedIn(ctx, username, via) {
     const a = ctx.state.account = (0, perm_1.getAccount)(username);
     if (!a)
         return;
+    const sessionStamp = (0, sessionStamp_1.getSessionStamp)(a.username);
     const result = await events_1.default.emitAsync('finalizingLogin', { ctx, username: a.username, via, inputs: { ...ctx.state.params, ...ctx.query } });
-    const error = result?.find(x => x && lodash_1.default.isString(x)) || result?.isDefaultPrevented() && "Login denied";
+    // async plugin checks must not let a revoked login acquire the new session stamp
+    const error = result?.find(x => x && lodash_1.default.isString(x)) || (result?.isDefaultPrevented()
+        || !sessionStamp || (0, perm_1.getAccount)(username) !== a || (0, sessionStamp_1.getSessionStamp)(a.username) !== sessionStamp) && "Login denied";
     if (error) {
         // restore the session identity: the candidate account was exposed only for plugin checks
         ctx.state.account = (0, perm_1.getAccount)(s.username, false);
@@ -116,13 +129,11 @@ async function setLoggedIn(ctx, username, via) {
     }
     const normalized = (0, perm_1.normalizeUsername)(username);
     s.username = normalized;
-    s.ts = Date.now();
     s.ip = ctx.ip;
+    s.stamp = sessionStamp;
     const k = cross_const_1.ALLOW_SESSION_IP_CHANGE;
     s[k] = k in ctx.query || Boolean(ctx.state.params?.[k]) || undefined; // login APIs will get ctx.state.params, others can rely on ctx.query
     if (!a.expire && a.days_to_live)
         (0, perm_1.updateAccount)(a, { expire: new Date(Date.now() + a.days_to_live * cross_1.DAY) });
     await events_1.default.emitAsync('login', ctx);
 }
-// since session are currently stored in cookies, we need to store this information
-exports.invalidateSessionBefore = new Map();

package/src/consoleLog.js

@@ -17,6 +17,7 @@ f?.on('error', err => {
     console.error("Cannot write console file", argv_1.argv.consoleFile, String(err));
 });
 let terminalOutputBroken = false;
+let lastTerminalDate = '';
 for (const stream of [process.stdout, process.stderr])
     stream.on('error', err => {
         if (!isBrokenTerminalOutput(err))
@@ -40,6 +41,9 @@ for (const k of ['log', 'warn', 'error', 'debug']) {
         events_1.default.emit('console', rec);
         f?.write(`${(0, cross_1.formatTimestamp)(ts)} [${k}] ${msg}\n`);
         if (!terminalOutputBroken) {
+            const date = (0, cross_1.formatDate)(ts);
+            if (date !== lastTerminalDate)
+                console.log.original(lastTerminalDate = date);
             try {
                 return original((0, cross_1.formatTime)(ts), ...args);
             } // bundled nodejs doesn't have locales (and apparently uses en-US)

package/src/const.js

@@ -49,7 +49,7 @@ const path_1 = require("path");
 const cross_1 = require("./cross");
 const argv_1 = require("./argv");
 __exportStar(require("./cross-const"), exports);
-exports.API_VERSION = 13.6;
+exports.API_VERSION = 13.71;
 exports.COMPATIBLE_API_VERSION = 1; // the day we break with the past, we'll update this
 // you can add arguments with this file, currently used for the update process on mac/linux.
 // we are using homedir because it's the only stable path both the old and new process can agree on (open() doesn't preserve cwd)

package/src/cross-const.js

@@ -43,7 +43,7 @@ exports.CFG = constMap([
     'smart_unc_folder_detection', 'sort_by', 'sort_numerics', 'split_uploads',
     'suspend_plugins', 'theme', 'tile_size', 'title', 'title_with_path', 'track_ips',
     'update_to_beta', 'upnp_enabled', 'version', 'vfs', 'webdav_initial_auth',
-    'zip_calculate_size_for_seconds', 'https_port'
+    'zip_calculate_size_for_seconds', 'https_port', 'require_upload_approval_for_active_content',
 ]);
 function constMap(a) {
     return Object.fromEntries(a.map(x => [x, x]));

package/src/cross.js

@@ -143,7 +143,7 @@ exports.defaultPerms = {
 };
 exports.PERM_KEYS = typedKeys(exports.defaultPerms);
 exports.VFS_STORED_KEYS = ['name', 'source', 'masks', 'default', 'accept', 'rename',
-    'mime', 'url', 'target', 'comment', 'icon', 'order', 'see_without_probing', 'children', ...exports.PERM_KEYS];
+    'mime', 'url', 'target', 'comment', 'icon', 'order', 'gui_asset', 'see_without_probing', 'children', ...exports.PERM_KEYS];
 function isWhoObject(v) {
     return v !== null && typeof v === 'object' && !Array.isArray(v);
 }

package/src/customHtml.js

@@ -14,8 +14,9 @@ const config_1 = require("./config");
 const plugins_1 = require("./plugins");
 const lodash_1 = __importDefault(require("lodash"));
 const FILE = 'custom.html';
-exports.customHtmlSections = ['style', 'script', 'beforeHeader', 'afterHeader', 'afterMenuBar', 'afterList',
-    'footer', 'top', 'bottom', 'afterEntryName', 'beforeLogin', 'unauthorized', 'htmlHead', 'userPanelAfterInfo'];
+exports.customHtmlSections = ['style', 'script', 'beforeHeader', 'afterHeader', 'afterMenuBar',
+    'footer', 'top', 'bottom', 'afterEntryName', 'beforeLogin', 'unauthorized', 'htmlHead', 'userPanelAfterInfo',
+    'afterList', 'beforeOptions', 'afterOptions'];
 exports.customHtml = watchLoadCustomHtml();
 exports.disableCustomHtml = (0, config_1.defineConfig)(misc_1.CFG.disable_custom_html, false);
 function watchLoadCustomHtml(folder = '') {

package/src/deletePermission.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDeletePermission = checkDeletePermission;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = require("node:path");
+const cross_1 = require("./cross");
+const const_1 = require("./const");
+const events_1 = __importDefault(require("./events"));
+const uploadOwners_1 = require("./uploadOwners");
+const vfs_1 = require("./vfs");
+// unlike a listing, deletion affects hidden entries and must fail if any directory cannot be read
+async function checkDeletePermission(node, ctx) {
+    if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_delete', ctx))
+        return false;
+    if (!node.source || !(await promises_1.default.lstat(node.source)).isDirectory())
+        return true;
+    return recur(node, []);
+    async function recur(parent, scopes) {
+        // explicit VFS entries are not deletable, even when their source is several levels below this directory
+        for (const child of explicitNodes(parent)) {
+            if (!child.source)
+                continue;
+            const path = (0, node_path_1.relative)((0, node_path_1.resolve)(parent.source), (0, node_path_1.resolve)(child.source));
+            if (path === '..' || path.startsWith('..' + node_path_1.sep) || (0, node_path_1.isAbsolute)(path))
+                continue;
+            try {
+                await promises_1.default.lstat(child.source);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                throw error;
+            }
+            ctx.status = const_1.HTTP_FORBIDDEN;
+            await reportBlocked(child);
+            return false;
+        }
+        const inherited = (0, vfs_1.permsFromParent)(parent, {}) || {};
+        const keys = new Set(['can_delete']);
+        for (const key of keys) {
+            addReferences(parent[key] ?? cross_1.defaultPerms[key]);
+            addReferences(inherited[key] ?? cross_1.defaultPerms[key]);
+        }
+        // skip scanning descendants only when inherited permissions guarantee deletion and no deeper rule or plugin can override them
+        if (!scopes.some(scope => hasRules(scope.node, keys)) && !hasRules(parent, keys)
+            && !cross_1.PERM_KEYS.some(key => (0, cross_1.isWhoObject)(inherited[key]))
+            && !events_1.default.hasOtherListeners('checkVfsPermission', uploadOwners_1.grantUploadOwnerDelete)
+            && !(0, vfs_1.statusCodeForMissingPerm)(inherited, 'can_delete', ctx, false, false))
+            return true;
+        // only literal path prefixes can be exhausted by inheritMasks; other patterns may match again deeper down
+        const persistentMasks = Object.fromEntries(Object.entries(parent.masks || {}).filter(([mask, mods]) => mods && (cross_1.PERM_KEYS.some(key => mods[key] !== undefined) || hasRules(mods, new Set(cross_1.PERM_KEYS)))
+            && (!mask.includes('/') || /[!*?\[\]{}()|\\]/.test(mask.split('/')[0]))));
+        if (Object.keys(persistentMasks).length)
+            scopes = [...scopes, { node: { masks: persistentMasks }, path: '' }];
+        for await (const entry of await promises_1.default.opendir(parent.source)) {
+            if (ctx.isAborted())
+                throw Error("Deletion cancelled");
+            const source = (0, node_path_1.join)(parent.source, entry.name);
+            const name = (0, vfs_1.getVirtualName)(entry.name, parent, source);
+            const explicit = (0, vfs_1.getChildBySource)(parent, source);
+            // permission masks use the target type, but deletion must never recurse through the link
+            const isFolder = entry.isSymbolicLink()
+                ? await promises_1.default.stat(source).then(stats => stats.isDirectory(), error => {
+                    if (error.code === 'ENOENT')
+                        return false;
+                    throw error;
+                }) : entry.isDirectory();
+            const child = {
+                ...explicit, original: explicit, source, isFolder,
+                rename: explicit?.rename || (0, vfs_1.renameUnderPath)(parent.rename, entry.name),
+            };
+            const nextScopes = scopes.map(scope => ({ node: scope.node, path: scope.path + name }));
+            for (const scope of [...nextScopes].reverse()) {
+                (0, vfs_1.parentMaskApplier)(scope.node, true)(child, scope.path);
+                (0, vfs_1.parentMaskApplier)(scope.node)(child, name);
+            }
+            const evaluated = (0, vfs_1.applyParentToChild)(child, parent, name);
+            if ((0, vfs_1.statusCodeForMissingPerm)(evaluated, 'can_delete', ctx)) {
+                await reportBlocked(evaluated);
+                return false;
+            }
+            // dirents do not follow symlinks, including dangling links
+            if (entry.isDirectory() && !await recur(evaluated, nextScopes.map(scope => ({ ...scope, path: scope.path + '/' }))))
+                return false;
+        }
+        return true;
+        function addReferences(who) {
+            if ((0, cross_1.isWhoObject)(who)) {
+                if (who.this !== undefined)
+                    addReferences(who.this);
+                if (who.children !== undefined)
+                    addReferences(who.children);
+            }
+            else if (typeof who === 'string' && cross_1.PERM_KEYS.includes(who))
+                keys.add(who);
+        }
+    }
+    async function reportBlocked(blocked) {
+        // a deletion error must not disclose names hidden by access permissions
+        let visible = blocked;
+        for (let ancestor = blocked; ancestor && ancestor !== node; ancestor = ancestor.parent)
+            if (!(0, vfs_1.hasPermission)(ancestor, 'can_see', ctx) || !await (0, vfs_1.urlToNode)(ancestor.vfsPath, ctx)
+                || ancestor.parent && !(0, vfs_1.hasPermission)(ancestor.parent, 'can_list', ctx))
+                visible = ancestor.parent || node;
+        ctx.body = { uri: '/' + visible.vfsPath };
+    }
+    function* explicitNodes(parent) {
+        for (const child of parent.children || []) {
+            const evaluated = (0, vfs_1.applyParentToChild)(child, parent);
+            yield evaluated;
+            yield* explicitNodes(evaluated);
+        }
+    }
+}
+function hasRules(node, keys) {
+    return Boolean(node.children?.length || Object.values(node.masks || {}).some(mods => mods && (Array.from(keys).some(key => mods[key] !== undefined) || hasRules(mods, keys))));
+}

package/src/events.js

@@ -56,6 +56,12 @@ class BetterEventEmitter {
     anyListener(event) {
         return Boolean(this.listeners.get(event)?.size);
     }
+    hasOtherListeners(event, mine) {
+        for (const x of this.listeners.get(event) || [])
+            if (x !== mine)
+                return true;
+        return false;
+    }
     emit(event, ...args) {
         let cbs = this.listeners.get(event);
         if (!cbs?.size)

package/src/index.js

@@ -48,15 +48,16 @@ exports.app = new koa_1.default({ keys });
 exports.app.use(middlewares_1.sessionMiddleware)
     .use(selfCheck_1.selfCheckMiddleware)
     .use(acme_1.acmeMiddleware)
-    .use(middlewares_1.prepareState)
+    .use(middlewares_1.prepareConnection)
+    .use(middlewares_1.blockFilter) // denied clients must not reach credential verification or its session/account side effects
     .use(geo_1.geoFilter)
+    .use(middlewares_1.prepareState)
     .use(ips_1.trackIpsMw)
     .use(middlewares_1.gzipper)
     .use(roots_1.rootsHostGuard)
     .use(log_1.logMw)
     .use(middlewares_1.someSecurity)
     .use(middlewares_1.paramsDecoder) // must be done before plugins, so they can manipulate params
-    .use(middlewares_1.headRequests)
     .use(roots_1.rootsMiddleware)
     .use(throttler_1.throttler)
     .use(plugins_1.pluginsMiddleware)

package/src/lang.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeLangCode = normalizeLangCode;
+exports.langCodeForLookup = langCodeForLookup;
 exports.code2file = code2file;
 exports.file2code = file2code;
 exports.getLangData = getLangData;
@@ -22,6 +23,9 @@ function normalizeLangCode(code) {
     code = code.toLowerCase().split(';', 1)[0].trim();
     return /^[a-z]{2,3}(-[a-z0-9]{2,8})*$/.test(code) ? code : '';
 }
+function langCodeForLookup(code) {
+    return ['zh-tw', 'zh-hk', 'zh-mo'].includes(code) ? 'zh-hant' : code;
+}
 function code2file(code, admin = false) {
     return (admin ? 'hfs-admin-lang-' : 'hfs-lang-') + code.toLowerCase() + SUFFIX;
 }
@@ -39,7 +43,7 @@ async function getLangData(ctxOrLangCsv) {
     }
     const csv = ctxOrLangCsv.toLowerCase();
     return cache.try(csv, async () => {
-        const langs = csv.split(',').map(normalizeLangCode).filter(Boolean);
+        const langs = csv.split(',').map(normalizeLangCode).map(langCodeForLookup).filter(Boolean);
         if (!langs.includes(const_1.EMBEDDED_LANGUAGE))
             langs.push(const_1.EMBEDDED_LANGUAGE);
         const ret = {};
@@ -76,6 +80,7 @@ async function getLangData(ctxOrLangCsv) {
 let forceLangData;
 let undo;
 (0, config_1.defineConfig)(misc_1.CFG.force_lang, '', v => {
+    v = langCodeForLookup(v);
     undo?.();
     if (!v)
         return forceLangData = undefined;

package/src/langs/embedded.js

@@ -12,7 +12,7 @@ const hfs_lang_sr_json_1 = __importDefault(require("./hfs-lang-sr.json"));
 const hfs_lang_sr_latn_json_1 = __importDefault(require("./hfs-lang-sr-latn.json"));
 const hfs_lang_ko_json_1 = __importDefault(require("./hfs-lang-ko.json"));
 const hfs_lang_ms_json_1 = __importDefault(require("./hfs-lang-ms.json"));
-const hfs_lang_zh_tw_json_1 = __importDefault(require("./hfs-lang-zh-tw.json"));
+const hfs_lang_zh_hant_json_1 = __importDefault(require("./hfs-lang-zh-hant.json"));
 const hfs_lang_fr_json_1 = __importDefault(require("./hfs-lang-fr.json"));
 const hfs_lang_pl_json_1 = __importDefault(require("./hfs-lang-pl.json"));
 const hfs_lang_pt_br_json_1 = __importDefault(require("./hfs-lang-pt-br.json"));
@@ -30,4 +30,4 @@ const hfs_lang_uk_json_1 = __importDefault(require("./hfs-lang-uk.json"));
 const hfs_lang_ar_json_1 = __importDefault(require("./hfs-lang-ar.json"));
 const hfs_lang_lt_json_1 = __importDefault(require("./hfs-lang-lt.json"));
 const hfs_lang_bg_json_1 = __importDefault(require("./hfs-lang-bg.json"));
-exports.default = { en: hfs_lang_en_json_1.default, it: hfs_lang_it_json_1.default, zh: hfs_lang_zh_json_1.default, ru: hfs_lang_ru_json_1.default, sr: hfs_lang_sr_json_1.default, 'sr-latn': hfs_lang_sr_latn_json_1.default, ko: hfs_lang_ko_json_1.default, ms: hfs_lang_ms_json_1.default, 'zh-tw': hfs_lang_zh_tw_json_1.default, fr: hfs_lang_fr_json_1.default, pl: hfs_lang_pl_json_1.default, 'pt-br': hfs_lang_pt_br_json_1.default, vi: hfs_lang_vi_json_1.default, es: hfs_lang_es_json_1.default, nl: hfs_lang_nl_json_1.default, el: hfs_lang_el_json_1.default, de: hfs_lang_de_json_1.default, fi: hfs_lang_fi_json_1.default, hu: hfs_lang_hu_json_1.default, ja: hfs_lang_ja_json_1.default, ro: hfs_lang_ro_json_1.default, tr: hfs_lang_tr_json_1.default, th: hfs_lang_th_json_1.default, uk: hfs_lang_uk_json_1.default, ar: hfs_lang_ar_json_1.default, lt: hfs_lang_lt_json_1.default, bg: hfs_lang_bg_json_1.default };
+exports.default = { en: hfs_lang_en_json_1.default, it: hfs_lang_it_json_1.default, zh: hfs_lang_zh_json_1.default, ru: hfs_lang_ru_json_1.default, sr: hfs_lang_sr_json_1.default, 'sr-latn': hfs_lang_sr_latn_json_1.default, ko: hfs_lang_ko_json_1.default, ms: hfs_lang_ms_json_1.default, 'zh-hant': hfs_lang_zh_hant_json_1.default, fr: hfs_lang_fr_json_1.default, pl: hfs_lang_pl_json_1.default, 'pt-br': hfs_lang_pt_br_json_1.default, vi: hfs_lang_vi_json_1.default, es: hfs_lang_es_json_1.default, nl: hfs_lang_nl_json_1.default, el: hfs_lang_el_json_1.default, de: hfs_lang_de_json_1.default, fi: hfs_lang_fi_json_1.default, hu: hfs_lang_hu_json_1.default, ja: hfs_lang_ja_json_1.default, ro: hfs_lang_ro_json_1.default, tr: hfs_lang_tr_json_1.default, th: hfs_lang_th_json_1.default, uk: hfs_lang_uk_json_1.default, ar: hfs_lang_ar_json_1.default, lt: hfs_lang_lt_json_1.default, bg: hfs_lang_bg_json_1.default };

package/src/langs/hfs-lang-ar.json

@@ -1,7 +1,6 @@
 {
     "author": "Hussein M. Alghazal (hmg3099)",
     "version": 1.0,
-    "hfs_version": "0.57.5",
     "translate": {
         "Select": "اختر",
         "n_files": "{n,plural,one{# file} other{# files}}",
@@ -111,6 +110,8 @@
         "Timestamp": "الطابع الزمني",
         "Show": "عرض",
         "Loading failed": "فشل التحميل",
+        "Download limit reached": "تم بلوغ حد التنزيلات",
+        "Retry": "إعادة المحاولة",
         "Rename": "إعادة تسمية",
         "Tiles mode:": "وضع الشبكة:",
         "off": "إيقاف",

package/src/langs/hfs-lang-bg.json

@@ -1,7 +1,6 @@
 {
     "author": "Ангел Трънгалов",
     "version": 1.0,
-    "hfs_version": "0.57.5",
     "translate": {
         "Select": "Избери",
         "n_files": "{n,plural,one{# файл} other{# файлове}}",
@@ -109,6 +108,8 @@
         "Timestamp": "Печат на време",
         "Show": "Покажи",
         "Loading failed": "Зареждането неуспешно",
+        "Download limit reached": "Достигнат е лимитът за изтегляния",
+        "Retry": "Опитай отново",
         "Rename": "Преименувай",
         "Tiles mode:": "Режим плочки:",
         "off": "изкл.",

package/src/langs/hfs-lang-de.json

@@ -1,7 +1,6 @@
 {
     "author": "Uwe Wennmann",
     "version": 0.1,
-    "hfs_version": "0.57.5",
     "translate": {
         "Select": "Auswählen",
         "n_files": "{n,plural,one{# Datei} other{# Dateien}}",
@@ -111,6 +110,8 @@
         "Timestamp": "Zeitstempel",
         "Show": "Anzeigen",
         "Loading failed": "Laden fehlgeschlagen",
+        "Download limit reached": "Download-Limit erreicht",
+        "Retry": "Erneut versuchen",
         "Rename": "Umbenennen",
         "Tiles mode:": "Kachel-Modus:",
         "off": "aus",

package/src/langs/hfs-lang-el.json

@@ -1,7 +1,6 @@
 {
     "author": "Konstantinos (konmaz)",
     "version": 1.0,
-    "hfs_version": "0.57.5",
     "translate": {
         "Select": "Επιλογή",
         "n_files": "{n,plural,one{# αρχείο} other{# αρχεία}}",
@@ -111,6 +110,8 @@
         "Timestamp": "Χρονική σήμανση",
         "Show": "Εμφάνιση",
         "Loading failed": "Η φόρτωση απέτυχε",
+        "Download limit reached": "Συμπληρώθηκε το όριο λήψεων",
+        "Retry": "Δοκιμή ξανά",
         "Rename": "Μετονομασία",
         "Tiles mode:": "Λειτουργία πλακιδίων:",
         "off": "ανενεργό",

package/src/langs/hfs-lang-en.json

@@ -1,7 +1,6 @@
 {
     "author": "NAME OF THE AUTHOR(S) OF THIS TRANSLATION",
     "version": 1.0,
-    "hfs_version": "0.57.5",
     "translate": {
         "Select": "Select",
         "n_files": "{n,plural,one{# file} other{# files}}",
@@ -112,6 +111,8 @@
         "Timestamp": "Timestamp",
         "Show": "Show",
         "Loading failed": "Loading failed",
+        "Download limit reached": "Download limit reached",
+        "Retry": "Retry",
         "Rename": "Rename",
         "Tiles mode:": "Tiles mode:",
         "off": "off",

package/src/langs/hfs-lang-es.json

@@ -1,7 +1,6 @@
 {
     "author": "Eidy Estupiñan Varona, Arturo Fernández Rivas",
     "version": 1.3,
-    "hfs_version": "0.57.5",
     "translate": {
         "Select": "Seleccionar",
         "n_files": "{n,plural,one{# archivo} other {# archivos}}",
@@ -111,6 +110,8 @@
         "Timestamp": "Fecha - Hora",
         "Show": "Visualizar",
         "Loading failed": "Carga fallida",
+        "Download limit reached": "Límite de descargas alcanzado",
+        "Retry": "Reintentar",
         "Rename": "Renombrar",
         "Tiles mode:": "Cantidad elementos",
         "off": "Apagado",