instbyte 1.12.0 → 1.12.2

package/README.md

@@ -5,10 +5,14 @@
 <h1 align="center">Instbyte</h1>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/instbyte"><img src="https://img.shields.io/npm/v/instbyte" alt="npm version"></a>
-  <a href="https://github.com/mohitgauniyal/instbyte/blob/main/LICENSE">
-  <img src="https://img.shields.io/github/license/mohitgauniyal/instbyte" alt="license">
-</a>
+  <a href="https://www.npmjs.com/package/instbyte"><img src="https://img.shields.io/npm/v/instbyte?style=flat-square" alt="npm version"></a>
+  <a href="https://github.com/mohitgauniyal/instbyte/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/mohitgauniyal/instbyte/ci.yml?branch=main&style=flat-square&label=build" alt="build status"></a>
+  <a href="https://www.npmjs.com/package/instbyte"><img src="https://img.shields.io/node/v/instbyte?style=flat-square" alt="node version"></a>
+  <a href="https://www.npmjs.com/package/instbyte"><img src="https://img.shields.io/npm/dm/instbyte?style=flat-square" alt="npm downloads"></a>
+  <a href="https://github.com/mohitgauniyal/instbyte"><img src="https://img.shields.io/github/languages/code-size/mohitgauniyal/instbyte?style=flat-square" alt="code size"></a>
+  <a href="https://github.com/mohitgauniyal/instbyte/commits/main"><img src="https://img.shields.io/github/last-commit/mohitgauniyal/instbyte?style=flat-square" alt="last commit"></a>
+  <a href="https://github.com/mohitgauniyal/instbyte/blob/main/LICENSE"><img src="https://img.shields.io/github/license/mohitgauniyal/instbyte?style=flat-square" alt="license"></a>
+  <a href="https://github.com/mohitgauniyal/instbyte/issues"><img src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square" alt="PRs Welcome"></a>
 </p>
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instbyte",
-  "version": "1.12.0",
+  "version": "1.12.2",
   "description": "A self-hosted LAN sharing utility for fast, frictionless file, link, and snippet exchange across devices — no cloud required.",
   "main": "bin/instbyte.js",
   "bin": {

package/server/cleanup.js

@@ -2,26 +2,39 @@ const db = require("./db");
 const fs = require("fs");
 const path = require("path");
 const config = require("./config");
+const seenBy = require("./seen");
 
-setInterval(() => {
-  if (config.storage.retention === null) return;
-  const cutoff = Date.now() - config.storage.retention;
+// One retention pass: delete expired, unpinned items along with their files
+// and any stale in-memory seenBy entries. Returns a promise so tests can await
+// a single pass; the interval below just fires it and ignores the result.
+function purgeExpired() {
+  return new Promise((resolve) => {
+    if (config.storage.retention === null) return resolve();
+    const cutoff = Date.now() - config.storage.retention;
 
-  db.all(
-    `SELECT * FROM items WHERE created_at < ? AND pinned = 0`,
-    [cutoff],
-    (err, rows) => {
-      if (err || !rows) return;
-      rows.forEach((item) => {
-        if (item.filename) {
-          const uploadsDir = process.env.INSTBYTE_UPLOADS
-            || path.join(__dirname, "../uploads");
-          const filePath = path.join(uploadsDir, item.filename);
-          if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
-        }
+    db.all(
+      `SELECT * FROM items WHERE created_at < ? AND pinned = 0`,
+      [cutoff],
+      (err, rows) => {
+        if (err || !rows) return resolve();
+        rows.forEach((item) => {
+          if (item.filename) {
+            const uploadsDir = process.env.INSTBYTE_UPLOADS
+              || path.join(__dirname, "../uploads");
+            const filePath = path.join(uploadsDir, item.filename);
+            if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+          }
 
-        db.run(`DELETE FROM items WHERE id=?`, [item.id]);
-      });
-    }
-  );
-}, 10 * 60 * 1000);
+          db.run(`DELETE FROM items WHERE id=?`, [item.id]);
+          seenBy.delete(item.id); // drop stale in-memory seen tracking
+        });
+        resolve();
+      }
+    );
+  });
+}
+
+const interval = setInterval(purgeExpired, 10 * 60 * 1000);
+interval.unref(); // don't keep the process alive just for cleanup
+
+module.exports = { purgeExpired };

package/server/seen.js

@@ -0,0 +1,5 @@
+// Shared in-memory "seen by" tracking — item id → Set of viewer names.
+// Kept in its own module so both the request handlers (server.js) and the
+// retention job (cleanup.js) mutate the same Map without a circular require.
+// Resets on server restart, no DB needed.
+module.exports = new Map();

package/server/server.js

@@ -121,7 +121,8 @@ const MAGIC_NUMBERS = {
   webp: [Buffer.from([0x52, 0x49, 0x46, 0x46])],
   pdf: [Buffer.from([0x25, 0x50, 0x44, 0x46])],
   zip: [Buffer.from([0x50, 0x4B, 0x03, 0x04]), Buffer.from([0x50, 0x4B, 0x05, 0x06])],
-  mp4: [Buffer.from([0x00, 0x00, 0x00, 0x18]), Buffer.from([0x00, 0x00, 0x00, 0x20])],
+  // mp4 is handled separately in checkMagicNumber — its signature is the
+  // "ftyp" marker at bytes 4-7, not a fixed sequence at the start.
 };
 
 // Extension → magic group mapping
@@ -147,18 +148,25 @@ function checkMagicNumber(filePath, ext) {
   const group = EXT_TO_MAGIC[ext.toLowerCase()];
   if (!group) return true; // no check defined for this type — allow through
 
-  const signatures = MAGIC_NUMBERS[group];
-  if (!signatures) return true;
-
+  let buf;
   try {
     const fd = fs.openSync(filePath, 'r');
-    const buf = Buffer.alloc(8);
+    buf = Buffer.alloc(8);
     fs.readSync(fd, buf, 0, 8, 0);
     fs.closeSync(fd);
-    return signatures.some(sig => buf.slice(0, sig.length).equals(sig));
   } catch (e) {
     return false; // can't read → reject
   }
+
+  // MP4: bytes 0-3 are the atom size (which varies between files), so the real
+  // file-type signature is the "ftyp" marker at bytes 4-7. Check that instead.
+  if (group === 'mp4') {
+    return buf.slice(4, 8).toString('latin1') === 'ftyp';
+  }
+
+  const signatures = MAGIC_NUMBERS[group];
+  if (!signatures) return true;
+  return signatures.some(sig => buf.slice(0, sig.length).equals(sig));
 }
 
 function hexToHsl(hex) {
@@ -684,7 +692,7 @@ app.delete("/channels/:name", (req, res) => {
       db.all("SELECT * FROM items WHERE channel=?", [name], (err, rows) => {
         rows.forEach(item => {
           if (item.filename) {
-            const filePath = path.join(__dirname, "../uploads", item.filename);
+            const filePath = path.join(UPLOADS_DIR, item.filename);
             if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
           }
         });
@@ -967,9 +975,9 @@ app.get("/logo-dynamic.png", (req, res) => {
 /* ============================
    SOCKET CONNECTION LOGGING
 ============================ */
-// in-memory seen tracking — item id → Set of socket ids
-// resets on server restart, no DB needed
-const seenBy = new Map();
+// in-memory seen tracking — item id → Set of viewer names.
+// Shared with cleanup.js so expired items get purged from it too.
+const seenBy = require("./seen");
 
 // Broadcast state — null when IDLE, populated when LIVE
 let currentBroadcast = null;
@@ -1072,7 +1080,7 @@ function getLocalIP() {
   const preferred =
     candidates.find(c => c.address.startsWith("192.168.")) ||
     candidates.find(c => c.address.startsWith("10.")) ||
-    candidates.find(c => c.address.startsWith("172.16.")) ||
+    candidates.find(c => c.address.startsWith("172.")) ||
     candidates[0];
 
   return preferred ? preferred.address : "localhost";