pixivflow 2.31.0 → 2.32.0

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow",
-  "version": "2.31.0",
+  "version": "2.32.0",
   "private": true
 }

package/dist/version.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD = void 0;
 // GENERATED by scripts/write-version.js — do not edit manually.
-exports.BUILD = { version: '2.31.0', commit: '4642dce0724a' };
+exports.BUILD = { version: '2.32.0', commit: 'db267d3a1a13' };
 //# sourceMappingURL=version.js.map

package/dist/webui/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow-webui-backend",
-  "version": "2.31.0",
+  "version": "2.32.0",
   "description": "PixivFlow WebUI Backend - CommonJS module"
 }

package/dist/webui/server/server-static.d.ts

@@ -1,6 +1,13 @@
 import { Express } from 'express';
 /**
- * Setup static file serving for SPA frontend
+ * Inject a one-time dismissal security notice into the served SPA index.html
+ * when WebUI basic auth is NOT configured (WEBUI_USERNAME / WEBUI_PASSWORD).
+ * First local start needs no credentials; the banner only reminds operators
+ * to set them before exposing the server beyond localhost.
  */
-export declare function setupStaticFiles(app: Express, staticPath?: string): void;
+export declare function injectAuthBanner(indexHtml: string, basicAuthEnabled: boolean): string;
+/**
+ * Setup static file serving for SPA frontend (injects auth-disabled notice when basic auth is off).
+ */
+export declare function setupStaticFiles(app: Express, staticPath?: string, basicAuthEnabled?: boolean): void;
 //# sourceMappingURL=server-static.d.ts.map

package/dist/webui/server/server-static.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.injectAuthBanner = injectAuthBanner;
 exports.setupStaticFiles = setupStaticFiles;
 const express_1 = __importDefault(require("express"));
 const path_1 = __importDefault(require("path"));
@@ -70,9 +71,27 @@ function getPackageVersion() {
     return 'unknown';
 }
 /**
- * Setup static file serving for SPA frontend
+ * Inject a one-time dismissal security notice into the served SPA index.html
+ * when WebUI basic auth is NOT configured (WEBUI_USERNAME / WEBUI_PASSWORD).
+ * First local start needs no credentials; the banner only reminds operators
+ * to set them before exposing the server beyond localhost.
  */
-function setupStaticFiles(app, staticPath) {
+function injectAuthBanner(indexHtml, basicAuthEnabled) {
+    if (basicAuthEnabled || indexHtml.includes('pixivflow-auth-banner')) {
+        return indexHtml;
+    }
+    const banner = [
+        '<div id="pixivflow-auth-banner" style="position:sticky;top:0;z-index:9999;display:flex;align-items:center;gap:12px;padding:8px 16px;background:#fff7e0;border-bottom:1px solid #f0d99a;color:#6b5300;font:14px/1.5 -apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;">',
+        '  <span>⚠️ <strong>安全提醒 / Security:</strong> WebUI 认证未启用（WEBUI_USERNAME / WEBUI_PASSWORD 未设置）。首次本地使用无需设置；若需对外暴露，请先设置用户名密码并重启服务。</span>',
+        '  <button type="button" title="知道了 / Got it" style="margin-left:auto;border:0;background:transparent;color:#6b5300;cursor:pointer;font-size:18px;line-height:1;" onclick="this.parentElement.remove()">✕</button>',
+        '</div>',
+    ].join('\n');
+    return indexHtml.replace('</body>', banner + '\n</body>');
+}
+/**
+ * Setup static file serving for SPA frontend (injects auth-disabled notice when basic auth is off).
+ */
+function setupStaticFiles(app, staticPath, basicAuthEnabled = false) {
     if (!staticPath) {
         // Root path handler when static files are not configured
         app.get('/', (req, res) => {
@@ -95,6 +114,7 @@ function setupStaticFiles(app, staticPath) {
     }
     const resolvedStaticPath = path_1.default.resolve(staticPath);
     const indexPath = path_1.default.join(resolvedStaticPath, 'index.html');
+    let servedIndexHtml = null;
     // Verify static path and index.html exist
     if (!fs_1.default.existsSync(resolvedStaticPath)) {
         logger_1.logger.warn('Static path does not exist', { path: resolvedStaticPath });
@@ -107,6 +127,7 @@ function setupStaticFiles(app, staticPath) {
     }
     else {
         logger_1.logger.info('Serving static files', { path: resolvedStaticPath });
+        servedIndexHtml = injectAuthBanner(fs_1.default.readFileSync(indexPath, 'utf8'), basicAuthEnabled);
     }
     // Serve static files (CSS, JS, images, etc.)
     app.use(express_1.default.static(resolvedStaticPath, {
@@ -116,15 +137,7 @@ function setupStaticFiles(app, staticPath) {
     // Explicitly handle root path first
     app.get('/', (req, res, next) => {
         if (fs_1.default.existsSync(indexPath)) {
-            res.sendFile(indexPath, (err) => {
-                if (err) {
-                    logger_1.logger.error('Failed to send index.html for root path', {
-                        error: err.message,
-                        path: indexPath,
-                    });
-                    next(err);
-                }
-            });
+            res.type('html').send(servedIndexHtml);
         }
         else {
             logger_1.logger.warn('index.html not found, cannot serve frontend', {
@@ -145,16 +158,7 @@ function setupStaticFiles(app, staticPath) {
         }
         // Send index.html for all other routes (SPA routing)
         if (fs_1.default.existsSync(indexPath)) {
-            res.sendFile(indexPath, (err) => {
-                if (err) {
-                    logger_1.logger.error('Failed to send index.html for SPA route', {
-                        error: err.message,
-                        path: indexPath,
-                        requestedPath: req.path,
-                    });
-                    next(err);
-                }
-            });
+            res.type('html').send(servedIndexHtml);
         }
         else {
             next();

package/dist/webui/server/server.js

@@ -97,7 +97,7 @@ class WebUIServer {
         // Setup API routes
         (0, server_routes_1.setupRoutes)(this.app);
         // Setup static file serving
-        (0, server_static_1.setupStaticFiles)(this.app, options.staticPath);
+        (0, server_static_1.setupStaticFiles)(this.app, options.staticPath, this.basicAuthEnabled);
         // Error handler (must be last)
         this.app.use(server_middleware_1.errorHandler);
         // Create HTTP or HTTPS server (TLS opt-in via WEBUI_TLS_CERT/KEY)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pixivflow",
-  "version": "2.31.0",
+  "version": "2.32.0",
   "description": "🎨 Pixiv 下载、筛选与自动收集工具 - 批量下载插画和小说、按标签/热度/日期筛选、定时任务与可靠 HTTP 交付 | Pixiv downloader and automation toolkit with filtering, scheduling and reliable HTTP delivery",
   "repository": {
     "type": "git",