node-red-contrib-room-tools 1.8.4 → 1.8.8

package/panel-http.js

@@ -0,0 +1,69 @@
+function sameOrigin (req) {
+  if (!req.headers.origin) return false
+  try {
+    const origin = new URL(req.headers.origin)
+    return origin.host === req.headers.host &&
+      origin.protocol === (req.socket.encrypted ? 'https:' : 'http:')
+  } catch (_) { return false }
+}
+
+function replyJson (res, status, data, headers = {}) {
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+    ...headers
+  })
+  res.end(JSON.stringify(data))
+}
+
+async function readJsonBody (req, maxBytes) {
+  if (String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase() !== 'application/json') {
+    throw new Error('JSON body required')
+  }
+  let raw
+  if (req.body !== undefined) {
+    // MUSE's middleware can expose an empty placeholder object while the raw
+    // JSON bytes are still on the request stream. Keep the legacy fallback so
+    // login and Apply receive the actual payload on that runtime.
+    const hasParsedObject = req.body && typeof req.body === 'object' &&
+      !Buffer.isBuffer(req.body) && !Array.isArray(req.body) &&
+      Object.keys(req.body).length > 0
+    if (Buffer.isBuffer(req.body) || typeof req.body === 'string' || hasParsedObject) {
+      raw = Buffer.isBuffer(req.body) ? req.body
+        : typeof req.body === 'string' ? Buffer.from(req.body) : Buffer.from(JSON.stringify(req.body))
+    }
+  }
+  if (raw === undefined && typeof req[Symbol.asyncIterator] === 'function') {
+    const chunks = []
+    let size = 0
+    for await (const chunk of req) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      size += bytes.length
+      if (size > maxBytes) throw new Error('Request too large')
+      chunks.push(bytes)
+    }
+    raw = Buffer.concat(chunks)
+  }
+  if (raw === undefined) {
+    const value = req.body === undefined ? {} : req.body
+    raw = Buffer.from(JSON.stringify(value))
+  }
+  if (raw.length > maxBytes) throw new Error('Request too large')
+  const value = JSON.parse(raw.toString('utf8'))
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('JSON object required')
+  return value
+}
+
+// Serialized into the Vue component, so keep this function browser-only and self-contained.
+async function fetchWithTimeout (url, options = {}, timeoutMs = 12000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    return await fetch(url, { ...options, signal: controller.signal })
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+module.exports = { sameOrigin, replyJson, readJsonBody, fetchWithTimeout }

package/panel-visual-apply.js

@@ -4,7 +4,7 @@ const { validatedVisualBindings } = require('./panel-visual-bindings')
 const { listCatalogDevices, listCatalogTargets } = require('./control-catalog')
 const { configuredRoutes } = require('./control-bound-protocol')
 const { provisionManagedBridges } = require('./managed-native-bridge')
-const { backupFlow, flowLocation, localDirectory } = require('./managed-bridge-admin')
+const { backupFlow, flowLocation, runtimeDirectory } = require('./managed-bridge-admin')
 
 function conflict (message) {
   const error = new Error(message)
@@ -12,15 +12,20 @@ function conflict (message) {
   return error
 }
 
-function adminUrl (localPort) {
+function adminUrl (localPort, adminRoot = '/red') {
   if (!Number.isInteger(localPort) || localPort < 1 || localPort > 65535) {
-    throw new Error('Local Automator port unavailable')
+    throw new Error('Node-RED runtime port unavailable')
   }
-  return `http://127.0.0.1:${localPort}/red/flows`
+  if (typeof adminRoot !== 'string' || !adminRoot.startsWith('/') || /[?#]/.test(adminRoot)) {
+    throw new Error('Node-RED admin root unavailable')
+  }
+  const url = new URL(`http://127.0.0.1:${localPort}`)
+  url.pathname = adminRoot.replace(/\/$/, '') + '/flows'
+  return url.href
 }
 
-async function getSnapshot (localPort, fetcher = fetch) {
-  const response = await fetcher(adminUrl(localPort), {
+async function getSnapshot (localPort, fetcher = fetch, adminRoot = '/red') {
+  const response = await fetcher(adminUrl(localPort, adminRoot), {
     headers: { 'Node-RED-API-Version': 'v2' },
     signal: AbortSignal.timeout(10000)
   })
@@ -59,18 +64,19 @@ function editorConfig (snapshot, panelId) {
 }
 
 async function applyVisualBindings ({
-  panelId, rev, templateHash, entries, userDir, remoteAddress, localPort,
+  panelId, rev, templateHash, entries, userDir, localPort, adminRoot = '/red',
   catalogBase, fetcher = fetch
 }) {
-  localDirectory(userDir, remoteAddress)
+  // The editor authenticates the browser; Flow access stays on the runtime's loopback interface.
+  const directory = runtimeDirectory(userDir)
   if (!catalogBase) throw conflict('Device catalog is unavailable')
-  const snapshot = await getSnapshot(localPort, fetcher)
+  const snapshot = await getSnapshot(localPort, fetcher, adminRoot)
   if (snapshot.rev !== rev) throw conflict('Flow changed; refresh the visual editor')
   const panel = findPanel(snapshot, panelId)
   if (inspectTemplate(panel.format).templateHash !== templateHash) {
     throw conflict('Template changed; refresh the visual editor')
   }
-  const location = flowLocation(fs.realpathSync(userDir))
+  const location = flowLocation(directory)
   if (JSON.stringify(JSON.parse(fs.readFileSync(location.flowFile, 'utf8'))) !== JSON.stringify(snapshot.flows)) {
     throw conflict('Deployed Flow differs from the active project file')
   }
@@ -92,13 +98,13 @@ async function applyVisualBindings ({
   nextPanel.nativeBridge = configuredRoutes(nextPanel).size > 0
   const provisioned = provisionManagedBridges(next, { panelId })
 
-  const latest = await getSnapshot(localPort, fetcher)
+  const latest = await getSnapshot(localPort, fetcher, adminRoot)
   if (latest.rev !== snapshot.rev) throw conflict('Flow changed during validation; refresh and retry')
   if (JSON.stringify(JSON.parse(fs.readFileSync(location.flowFile, 'utf8'))) !== JSON.stringify(snapshot.flows)) {
     throw conflict('Active project changed during validation')
   }
   const backupDir = backupFlow(location, snapshot.rev, snapshot.flows)
-  const response = await fetcher(adminUrl(localPort), {
+  const response = await fetcher(adminUrl(localPort, adminRoot), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
@@ -112,7 +118,7 @@ async function applyVisualBindings ({
   const applied = await response.json().catch(() => ({}))
   let confirmed
   for (let attempt = 0; attempt < 5; attempt++) {
-    confirmed = await getSnapshot(localPort, fetcher)
+    confirmed = await getSnapshot(localPort, fetcher, adminRoot)
     const confirmedPanel = confirmed.flows.find(node => node.id === panelId)
     if (confirmedPanel?.visualBindings === nextPanel.visualBindings &&
       confirmedPanel.bridgeRevisionApplied === provisioned.flows.find(node => node.id === panelId)?.bridgeRevisionApplied) {