sliftutils 1.7.4 → 1.7.6

package/storage/remoteStorage/storageController.ts

@@ -0,0 +1,398 @@
+module.allowclient = true;
+
+import { SocketFunction } from "socket-function/SocketFunction";
+import { getNodeIdIP } from "socket-function/src/nodeCache";
+import { setHTTPResultHeaders } from "socket-function/src/callHTTPHandler";
+import { timeInMinute } from "socket-function/src/misc";
+import { getCommonName, getPublicIdentifier, getOwnMachineId, verify, verifyMachineIdForPublicKey } from "../../misc/https/certs";
+import { ArchiveFileInfo } from "../IArchives";
+import type { BlobStore, WriteConfig } from "./blobStore";
+import type { IStorage } from "../IStorage";
+
+// The remote storage server's API. Authentication uses certs.ts machine identities: a client
+// proves it owns its machine key by signing a timestamped token (bound to this server, so tokens
+// can't be replayed elsewhere), and the server then trusts that connection as that machineId.
+// Access to an account is granted to specific machineIds, via a command line command run on the
+// storage machine (see storageServer.ts).
+
+export const REMOTE_STORAGE_CLASS_GUID = "RemoteStorageController-b7e42a91";
+export const STORAGE_AUTH_PURPOSE = "remoteStorage-auth-1";
+// Error markers, so clients can identify these failures inside error messages
+export const STORAGE_NOT_AUTHENTICATED = "REMOTE_STORAGE_NOT_AUTHENTICATED_cf2f7b1e";
+export const STORAGE_ACCESS_DENIED = "REMOTE_STORAGE_ACCESS_DENIED_9d81a4c0";
+
+const AUTH_TIME_WINDOW = timeInMinute * 10;
+const MAX_SESSIONS = 100 * 1000;
+const MAX_REQUESTS_PER_IP = 50;
+
+export type AuthToken = {
+    certPem: string;
+    time: number;
+    signature: string;
+};
+export type AccessRequest = {
+    requestId: string;
+    account: string;
+    machineId: string;
+    ip: string;
+    time: number;
+};
+export type TrustRecord = {
+    account: string;
+    machineId: string;
+    ip: string;
+    time: number;
+};
+export type BucketConfig = {
+    public?: boolean;
+    fast?: boolean;
+    writeDelay?: number;
+};
+export type AccessState = {
+    machineId: string;
+    ip: string;
+    hasAccess: boolean;
+    // Single ssh commands, runnable from anywhere, that run the admin CLI on the storage machine
+    // (shown when the caller has no access). grantAccessCommand grants the caller's own request.
+    listAccessCommand: string;
+    grantAccessCommand?: string;
+    // Only provided when the caller has access
+    machines?: (AccessRequest & { trusted: boolean })[];
+};
+
+export type StorageServerState = {
+    domain: string;
+    port: number;
+    rootDomain: string;
+    // user@externalIp of the storage machine, for generated ssh commands
+    sshTarget: string;
+    // Absolute command that runs storageServer.ts on the storage machine (admin args appended)
+    serverCommand: string;
+    blobStore: BlobStore;
+    trust: IStorage<TrustRecord>;
+    requests: IStorage<AccessRequest[]>;
+    buckets: IStorage<BucketConfig>;
+};
+
+let serverState: StorageServerState | undefined;
+export function setStorageServerState(state: StorageServerState) {
+    serverState = state;
+}
+function getState(): StorageServerState {
+    let state = serverState;
+    if (!state) throw new Error(`Storage server is not initialized (this API only works on the storage server)`);
+    return state;
+}
+
+// callerNodeId -> authenticated machineId. Connections are long-lived websockets, so a session
+// lasts until the connection drops (clients re-authenticate on reconnect).
+const sessions = new Map<string, string>();
+
+const CONTENT_TYPES: { [ext: string]: string } = {
+    html: "text/html", js: "text/javascript", css: "text/css", json: "application/json",
+    txt: "text/plain", png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
+    svg: "image/svg+xml", webp: "image/webp", mp4: "video/mp4", webm: "video/webm",
+    mp3: "audio/mpeg", wav: "audio/wav", pdf: "application/pdf",
+};
+
+function assertValidName(value: string, kind: string) {
+    if (!/^[\w-]{1,64}$/.test(value)) {
+        throw new Error(`Invalid ${kind} ${JSON.stringify(value)}, expected 1-64 characters of letters/numbers/underscore/dash`);
+    }
+}
+function assertValidPath(path: string) {
+    if (Buffer.from(path, "utf8").length > 1000) {
+        throw new Error(`Path too long: ${path.length} characters > 1000. Path: ${path.slice(0, 200)}`);
+    }
+    if (!path || path.startsWith("/") || path.endsWith("/") || path.includes("//") || path.includes("\\") || path.includes("\x00")) {
+        throw new Error(`Invalid path ${JSON.stringify(path.slice(0, 200))}, paths cannot be empty, start or end with /, or contain //, backslashes, or null characters`);
+    }
+}
+
+function getCallerMachineId(): string {
+    let caller = SocketFunction.getCaller();
+    let machineId = sessions.get(caller.nodeId);
+    if (!machineId) {
+        throw new Error(`${STORAGE_NOT_AUTHENTICATED} Call authenticate first (connection ${caller.nodeId})`);
+    }
+    return machineId;
+}
+function getCallerIP(): string {
+    return getNodeIdIP(SocketFunction.getCaller().nodeId);
+}
+function isAdmin(machineId: string): boolean {
+    let state = getState();
+    return machineId === getOwnMachineId(state.rootDomain);
+}
+function requireAdmin(): string {
+    let machineId = getCallerMachineId();
+    if (!isAdmin(machineId)) {
+        throw new Error(`${STORAGE_ACCESS_DENIED} Admin commands must be run from the storage machine itself (caller machine ${machineId})`);
+    }
+    return machineId;
+}
+async function requireAccess(account: string): Promise<string> {
+    assertValidName(account, "account");
+    let state = getState();
+    let machineId = getCallerMachineId();
+    if (isAdmin(machineId)) return machineId;
+    let trusted = await state.trust.get(`${account}|${machineId}`);
+    if (!trusted) {
+        throw new Error(`${STORAGE_ACCESS_DENIED} Machine ${machineId} has no access to account ${JSON.stringify(account)}. Visit https://${state.domain}:${state.port}/${account} for access instructions.`);
+    }
+    return machineId;
+}
+
+// A single command, runnable from anywhere, that sshes into the storage machine and runs the
+// admin CLI there
+function getAdminCommand(args: string): string {
+    let state = getState();
+    return `ssh ${state.sshTarget} '${state.serverCommand} ${args}'`;
+}
+function getListAccessCommand(ip: string): string {
+    return getAdminCommand(`--listAccess ${ip}`);
+}
+function getGrantAccessCommand(requestId: string): string {
+    return getAdminCommand(`--grantAccess ${requestId}`);
+}
+
+async function getBucketWriteConfig(account: string, bucketName: string): Promise<WriteConfig> {
+    let state = getState();
+    let config = await state.buckets.get(`${account}/${bucketName}`);
+    return { fast: config?.fast, writeDelay: config?.writeDelay };
+}
+function fileKey(account: string, bucketName: string, path: string): string {
+    assertValidName(account, "account");
+    assertValidName(bucketName, "bucket name");
+    assertValidPath(path);
+    return `${account}/${bucketName}/${path}`;
+}
+
+class RemoteStorageControllerBase {
+    // Proves the caller owns the machine key for the machineId in its certificate. The signature
+    // must be fresh and bound to this server, so it cannot be replayed to (or from) other servers.
+    async authenticate(token: AuthToken): Promise<{ machineId: string; ip: string }> {
+        let state = getState();
+        let caller = SocketFunction.getCaller();
+        if (Math.abs(Date.now() - token.time) > AUTH_TIME_WINDOW) {
+            throw new Error(`Auth token time is too far from the server time (token ${token.time}, server ${Date.now()}, allowed drift ${AUTH_TIME_WINDOW}ms)`);
+        }
+        verify(token.certPem, token.signature, {
+            purpose: STORAGE_AUTH_PURPOSE,
+            time: token.time,
+            server: `${state.domain}:${state.port}`,
+        });
+        let machineId = getCommonName(token.certPem).split(".")[0];
+        if (!verifyMachineIdForPublicKey({ machineId, publicKey: getPublicIdentifier(token.certPem) })) {
+            throw new Error(`Certificate common name ${JSON.stringify(getCommonName(token.certPem))} does not match its public key`);
+        }
+        sessions.set(caller.nodeId, machineId);
+        while (sessions.size > MAX_SESSIONS) {
+            let oldest = sessions.keys().next().value;
+            if (oldest === undefined) break;
+            sessions.delete(oldest);
+        }
+        return { machineId, ip: getCallerIP() };
+    }
+
+    // Records that the calling machine wants access to an account. Requests are kept per requesting
+    // IP, so the storage machine's admin can list them with --listAccess <ip> and grant one.
+    async requestAccess(account: string): Promise<{ machineId: string; ip: string; requestId: string; grantAccessCommand: string }> {
+        assertValidName(account, "account");
+        let state = getState();
+        let machineId = getCallerMachineId();
+        let ip = getCallerIP();
+        let requests = await state.requests.get(ip) || [];
+        let existing = requests.find(x => x.account === account && x.machineId === machineId);
+        if (existing) {
+            existing.time = Date.now();
+        } else {
+            existing = {
+                requestId: Math.random().toString(36).slice(2, 10),
+                account,
+                machineId,
+                ip,
+                time: Date.now(),
+            };
+            requests.push(existing);
+        }
+        while (requests.length > MAX_REQUESTS_PER_IP) requests.shift();
+        await state.requests.set(ip, requests);
+        return { machineId, ip, requestId: existing.requestId, grantAccessCommand: getGrantAccessCommand(existing.requestId) };
+    }
+
+    async getAccessState(account: string): Promise<AccessState> {
+        assertValidName(account, "account");
+        let state = getState();
+        let machineId = getCallerMachineId();
+        let ip = getCallerIP();
+        let hasAccess = isAdmin(machineId) || !!await state.trust.get(`${account}|${machineId}`);
+        let result: AccessState = { machineId, ip, hasAccess, listAccessCommand: getListAccessCommand(ip) };
+        if (!hasAccess) {
+            let ownRequest = (await state.requests.get(ip) || []).find(x => x.account === account && x.machineId === machineId);
+            if (ownRequest) {
+                result.grantAccessCommand = getGrantAccessCommand(ownRequest.requestId);
+            }
+            return result;
+        }
+
+        let machines = new Map<string, AccessRequest & { trusted: boolean }>();
+        for (let requestIp of await state.requests.getKeys()) {
+            for (let request of await state.requests.get(requestIp) || []) {
+                if (request.account !== account) continue;
+                machines.set(request.machineId, { ...request, trusted: false });
+            }
+        }
+        for (let key of await state.trust.getKeys()) {
+            if (!key.startsWith(`${account}|`)) continue;
+            let record = await state.trust.get(key);
+            if (!record) continue;
+            let existing = machines.get(record.machineId);
+            machines.set(record.machineId, {
+                requestId: existing?.requestId || "",
+                account,
+                machineId: record.machineId,
+                ip: record.ip,
+                time: record.time,
+                trusted: true,
+            });
+        }
+        result.machines = Array.from(machines.values());
+        return result;
+    }
+
+    // Admin (must be run from the storage machine itself, which shares the server's machineId).
+    // Only returns requests for the given IP, so you cannot accidentally grant a request from an
+    // IP you didn't explicitly type in.
+    async adminListRequests(ip: string): Promise<AccessRequest[]> {
+        requireAdmin();
+        let state = getState();
+        return await state.requests.get(ip) || [];
+    }
+    async adminGrantAccess(requestId: string): Promise<TrustRecord> {
+        requireAdmin();
+        let state = getState();
+        for (let ip of await state.requests.getKeys()) {
+            for (let request of await state.requests.get(ip) || []) {
+                if (request.requestId !== requestId) continue;
+                let record: TrustRecord = {
+                    account: request.account,
+                    machineId: request.machineId,
+                    ip: request.ip,
+                    time: Date.now(),
+                };
+                await state.trust.set(`${request.account}|${request.machineId}`, record);
+                return record;
+            }
+        }
+        throw new Error(`No access request found with id ${JSON.stringify(requestId)}. Run --listAccess <ip> to see request ids.`);
+    }
+
+    async ensureBucket(account: string, bucketName: string, config: BucketConfig): Promise<void> {
+        await requireAccess(account);
+        assertValidName(bucketName, "bucket name");
+        let state = getState();
+        let key = `${account}/${bucketName}`;
+        let existing = await state.buckets.get(key);
+        if (existing && JSON.stringify(existing) === JSON.stringify(config)) return;
+        await state.buckets.set(key, config);
+    }
+
+    async get(account: string, bucketName: string, path: string, range?: { start: number; end: number }): Promise<Buffer | undefined> {
+        await requireAccess(account);
+        return await getState().blobStore.get(fileKey(account, bucketName, path), range);
+    }
+    async set(account: string, bucketName: string, path: string, data: Buffer): Promise<void> {
+        await requireAccess(account);
+        let writeConfig = await getBucketWriteConfig(account, bucketName);
+        await getState().blobStore.set(fileKey(account, bucketName, path), Buffer.from(data), writeConfig);
+    }
+    async del(account: string, bucketName: string, path: string): Promise<void> {
+        await requireAccess(account);
+        let writeConfig = await getBucketWriteConfig(account, bucketName);
+        await getState().blobStore.del(fileKey(account, bucketName, path), writeConfig);
+    }
+    async getInfo(account: string, bucketName: string, path: string): Promise<{ writeTime: number; size: number } | undefined> {
+        await requireAccess(account);
+        return await getState().blobStore.getInfo(fileKey(account, bucketName, path));
+    }
+    async findInfo(account: string, bucketName: string, prefix: string, config?: { shallow?: boolean; type?: "files" | "folders" }): Promise<ArchiveFileInfo[]> {
+        await requireAccess(account);
+        assertValidName(bucketName, "bucket name");
+        let bucketRoot = `${account}/${bucketName}/`;
+        let infos = await getState().blobStore.findInfo(bucketRoot + prefix, config);
+        return infos.map(info => ({ ...info, path: info.path.slice(bucketRoot.length) }));
+    }
+
+    async startLargeFile(account: string, bucketName: string, path: string): Promise<string> {
+        await requireAccess(account);
+        // Validates now, so the upload doesn't fail at the end
+        fileKey(account, bucketName, path);
+        let id = await getState().blobStore.startLargeUpload();
+        largeUploadInfo.set(id, { account, bucketName, path });
+        return id;
+    }
+    async uploadPart(uploadId: string, data: Buffer): Promise<void> {
+        let info = largeUploadInfo.get(uploadId);
+        if (!info) throw new Error(`Unknown large upload ${uploadId}`);
+        await requireAccess(info.account);
+        await getState().blobStore.appendLargeUpload(uploadId, Buffer.from(data));
+    }
+    async finishLargeFile(uploadId: string): Promise<void> {
+        let info = largeUploadInfo.get(uploadId);
+        if (!info) throw new Error(`Unknown large upload ${uploadId}`);
+        await requireAccess(info.account);
+        largeUploadInfo.delete(uploadId);
+        await getState().blobStore.finishLargeUpload(uploadId, fileKey(info.account, info.bucketName, info.path));
+    }
+    async cancelLargeFile(uploadId: string): Promise<void> {
+        let info = largeUploadInfo.get(uploadId);
+        if (!info) return;
+        await requireAccess(info.account);
+        largeUploadInfo.delete(uploadId);
+        await getState().blobStore.cancelLargeUpload(uploadId);
+    }
+
+    // Serves files from public buckets over plain HTTP GET (see IArchives getURL). No
+    // authentication, which is what public means (private buckets are API-access only).
+    async getPublicFile(account: string, bucketName: string, path: string): Promise<Buffer> {
+        let state = getState();
+        let bucket = await state.buckets.get(`${account}/${bucketName}`);
+        if (!bucket?.public) {
+            throw new Error(`Bucket ${account}/${bucketName} is not public`);
+        }
+        let data = await state.blobStore.get(fileKey(account, bucketName, path));
+        if (!data) {
+            throw new Error(`File not found: ${path} in ${account}/${bucketName}`);
+        }
+        let ext = path.split(".").pop() || "";
+        return setHTTPResultHeaders(data, {
+            "Content-Type": CONTENT_TYPES[ext.toLowerCase()] || "application/octet-stream",
+        });
+    }
+}
+
+const largeUploadInfo = new Map<string, { account: string; bucketName: string; path: string }>();
+
+export const RemoteStorageController = SocketFunction.register(
+    REMOTE_STORAGE_CLASS_GUID,
+    new RemoteStorageControllerBase(),
+    () => ({
+        authenticate: {},
+        requestAccess: {},
+        getAccessState: {},
+        adminListRequests: {},
+        adminGrantAccess: {},
+        ensureBucket: {},
+        get: {},
+        set: {},
+        del: {},
+        getInfo: {},
+        findInfo: {},
+        startLargeFile: {},
+        uploadPart: {},
+        finishLargeFile: {},
+        cancelLargeFile: {},
+        getPublicFile: {},
+    })
+);

package/storage/remoteStorage/storageServer.d.ts

@@ -0,0 +1 @@
+import "./accessPage";

package/storage/remoteStorage/storageServer.ts

@@ -0,0 +1,132 @@
+process.env.NODE_ENV = "production";
+import os from "os";
+import path from "path";
+import { SocketFunction } from "socket-function/SocketFunction";
+import { getExternalIP } from "socket-function/src/networking";
+import { RequireController } from "socket-function/require/RequireController";
+import { hostServer } from "../../misc/https/hostServer";
+import { getFileStorageNested2 } from "../FileFolderAPI";
+import { TransactionStorage } from "../TransactionStorage";
+import { JSONStorage } from "../JSONStorage";
+import { BlobStore } from "./blobStore";
+import {
+    RemoteStorageController, setStorageServerState,
+    AccessRequest, TrustRecord, BucketConfig,
+} from "./storageController";
+import { authenticateStorage } from "./ArchivesRemote";
+// Import browser code, so it is allowed to be required by the client
+import "./accessPage";
+
+// The remote storage server. Run modes:
+//   Host the server:
+//     typenode storage/remoteStorage/storageServer.ts --domain storage.example.com --port 4444
+//       --folder /storage/data --cloudflareApiTokenPath ~/example.com.key
+//   Admin commands (run on the storage machine itself, against the running server):
+//     --listAccess <ip>            lists pending access requests from that IP (with requestIds)
+//     --grantAccess <requestId>    trusts the machine from that request for the requested account
+
+process.on("unhandledRejection", (error) => {
+    console.error("Unhandled promise rejection:", error);
+});
+process.on("uncaughtException", (error) => {
+    console.error("Uncaught exception:", error);
+});
+
+// The absolute command that runs this script (with the given args) on this machine, usable from
+// any working directory (ex: over ssh)
+function getServerCommand(args: string): string {
+    return `${process.execPath} ${require.resolve("typenode/bootstrap.js")} ${__filename} ${args}`;
+}
+
+function getArg(name: string): string | undefined {
+    let index = process.argv.indexOf(`--${name}`);
+    if (index < 0) return undefined;
+    let value = process.argv[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`Missing value for --${name}`);
+    }
+    return value;
+}
+
+async function runAdminCommand(config: { domain: string; port: number; listAccess?: string; grantAccess?: string }) {
+    let nodeId = SocketFunction.connect({ address: config.domain, port: config.port });
+    let controller = RemoteStorageController.nodes[nodeId];
+    await authenticateStorage({ address: config.domain, port: config.port, nodeId });
+    if (config.listAccess) {
+        let requests = await controller.adminListRequests(config.listAccess);
+        if (!requests.length) {
+            console.log(`No access requests from ${config.listAccess}`);
+            return;
+        }
+        console.log(`Access requests from ${config.listAccess}:`);
+        for (let request of requests) {
+            console.log(`  --grantAccess ${request.requestId}  (account ${request.account}, machine ${request.machineId}, requested ${new Date(request.time).toISOString()})`);
+        }
+        console.log(`Grant one with: ${getServerCommand(`--domain ${config.domain} --port ${config.port} --grantAccess <requestId>`)}`);
+        return;
+    }
+    if (config.grantAccess) {
+        let record = await controller.adminGrantAccess(config.grantAccess);
+        console.log(`Granted machine ${record.machineId} access to account ${JSON.stringify(record.account)}`);
+    }
+}
+
+async function main() {
+    let domain = getArg("domain");
+    if (!domain) throw new Error(`--domain is required (ex: --domain storage.example.com)`);
+    let port = +(getArg("port") || 443);
+
+    let listAccess = getArg("listAccess");
+    let grantAccess = getArg("grantAccess");
+    if (listAccess || grantAccess) {
+        await runAdminCommand({ domain, port, listAccess, grantAccess });
+        process.exit(0);
+    }
+
+    let folder = getArg("folder");
+    if (!folder) throw new Error(`--folder is required (where the storage server keeps its data)`);
+    let cloudflareApiTokenPath = getArg("cloudflareApiTokenPath");
+    if (!cloudflareApiTokenPath) throw new Error(`--cloudflareApiTokenPath is required (path to a Cloudflare API token file, for HTTPS certs)`);
+
+    let root = await getFileStorageNested2(path.resolve(folder));
+    let system = await root.folder.getStorage("system");
+    let trust = new JSONStorage<TrustRecord>(new TransactionStorage(await system.folder.getStorage("trust"), "storageTrust"));
+    let requests = new JSONStorage<AccessRequest[]>(new TransactionStorage(await system.folder.getStorage("requests"), "storageRequests"));
+    let buckets = new JSONStorage<BucketConfig>(new TransactionStorage(await system.folder.getStorage("buckets"), "storageBuckets"));
+
+    setStorageServerState({
+        domain,
+        port,
+        rootDomain: domain.split(".").slice(-2).join("."),
+        sshTarget: `${os.userInfo().username}@${await getExternalIP()}`,
+        serverCommand: getServerCommand(`--domain ${domain} --port ${port}`),
+        blobStore: new BlobStore(path.resolve(folder)),
+        trust,
+        requests,
+        buckets,
+    });
+
+    RequireController.allowAllNodeModules();
+    SocketFunction.expose(RequireController);
+    SocketFunction.expose(RemoteStorageController);
+    // No static roots, so the access page HTML is served at every path (the path is the account
+    // name, see accessPage.tsx)
+    // A full URL, so the page resolves modules from the origin root even when served at
+    // /accountName (a relative require would resolve inside the account path)
+    SocketFunction.setDefaultHTTPCall(RequireController, "requireHTML", {
+        requireCalls: [`https://${domain}:${port}/./storage/remoteStorage/accessPage.tsx`],
+    });
+
+    await hostServer({
+        domain,
+        port,
+        cloudflareApiTokenPath,
+        setDNSRecord: true,
+    });
+    console.log(`Storage server running at https://${domain}:${port}`);
+}
+
+main().catch(e => {
+    console.error(e);
+    process.exit(1);
+});

package/teststorage/browser.tsx

@@ -0,0 +1,148 @@
+module.allowclient = true;
+
+import preact from "preact";
+import { observable } from "mobx";
+import { observer } from "../render-utils/observer";
+import { isNode } from "socket-function/src/misc";
+import { delay } from "socket-function/src/batching";
+import { formatNumber, formatDateTime } from "socket-function/src/formatting/format";
+import { css } from "typesafecss";
+import { InputLabel } from "../render-utils/InputLabel";
+import { redButton, greenButton, errorMessage } from "../render-utils/colors";
+import { ArchivesRemote } from "../storage/remoteStorage/ArchivesRemote";
+import { ArchiveFileInfo } from "../storage/IArchives";
+
+const STORAGE_ADDRESS = "storage.vidgridweb.com";
+const STORAGE_PORT = 4444;
+const ACCOUNT = "test";
+const BUCKET = "testfiles";
+const ACCESS_CHECK_INTERVAL = 1000 * 15;
+
+const archives = new ArchivesRemote({
+    address: STORAGE_ADDRESS,
+    port: STORAGE_PORT,
+    account: ACCOUNT,
+    bucketName: BUCKET,
+});
+
+@observer
+class TestStoragePage extends preact.Component {
+    synced = observable({
+        files: [] as ArchiveFileInfo[],
+        loaded: false,
+        selectedPath: "",
+        content: "",
+        contentLoaded: false,
+        newFileName: "",
+        accessLink: "",
+        error: "",
+    });
+
+    componentDidMount() {
+        void (async () => {
+            while (true) {
+                let link = await archives.waitingForAccess();
+                this.synced.accessLink = link || "";
+                if (!link) break;
+                await delay(ACCESS_CHECK_INTERVAL);
+            }
+            await this.refresh();
+        })();
+    }
+
+    private async refresh() {
+        try {
+            this.synced.files = await archives.findInfo("", { type: "files" });
+            this.synced.loaded = true;
+            this.synced.error = "";
+        } catch (e) {
+            this.synced.error = String(e);
+        }
+    }
+
+    private async openFile(path: string) {
+        this.synced.selectedPath = path;
+        this.synced.contentLoaded = false;
+        let data = await archives.get(path);
+        this.synced.content = data && data.toString() || "";
+        this.synced.contentLoaded = true;
+    }
+
+    private async createFile() {
+        let name = this.synced.newFileName.trim();
+        if (!name) return;
+        await archives.set(name, Buffer.from(""));
+        this.synced.newFileName = "";
+        await this.refresh();
+        await this.openFile(name);
+    }
+
+    private async deleteFile(path: string) {
+        await archives.del(path);
+        if (this.synced.selectedPath === path) {
+            this.synced.selectedPath = "";
+            this.synced.content = "";
+            this.synced.contentLoaded = false;
+        }
+        await this.refresh();
+    }
+
+    render() {
+        let synced = this.synced;
+        return <div className={css.vbox(12).pad2(16)}>
+            <div>Storage test site. Account {ACCOUNT}, bucket {BUCKET} on {STORAGE_ADDRESS}:{STORAGE_PORT}</div>
+            {synced.error && <div className={errorMessage}>{synced.error}</div>}
+            {!synced.loaded && !synced.accessLink && <div>Loading files...</div>}
+            {!synced.loaded && synced.accessLink && <div className={css.vbox(8)}>
+                <div>This machine does not have access to the account yet. Grant it here:</div>
+                <a href={synced.accessLink} target="_blank">{synced.accessLink}</a>
+            </div>}
+            {synced.loaded && <div className={css.hbox(24).alignItems("flex-start")}>
+                <div className={css.vbox(8)}>
+                    {synced.files.length === 0 && <div>No files yet</div>}
+                    {synced.files.map(file => <div key={file.path} className={css.hbox(8).alignItems("center")}>
+                        <button onClick={async () => this.openFile(file.path)}>
+                            {file.path}
+                        </button>
+                        <div>{formatNumber(file.size)}B, {formatDateTime(file.createTime)}</div>
+                        <button className={redButton} onClick={async () => this.deleteFile(file.path)}>
+                            Delete
+                        </button>
+                    </div>)}
+                    <div className={css.hbox(8).alignItems("center")}>
+                        <InputLabel
+                            label="New file"
+                            hot
+                            value={synced.newFileName}
+                            onChangeValue={value => { synced.newFileName = value; }}
+                        />
+                        <button className={greenButton} onClick={async () => this.createFile()}>
+                            Create
+                        </button>
+                    </div>
+                </div>
+                {synced.selectedPath && <div className={css.vbox(8).flexGrow(1)}>
+                    <div>Editing {synced.selectedPath}</div>
+                    {!synced.contentLoaded && <div>Loading content...</div>}
+                    {synced.contentLoaded && <InputLabel
+                        textarea
+                        fillWidth
+                        value={synced.content}
+                        onChangeValue={async value => {
+                            await archives.set(synced.selectedPath, Buffer.from(value));
+                            synced.content = value;
+                            await this.refresh();
+                        }}
+                    />}
+                </div>}
+            </div>}
+        </div>;
+    }
+}
+
+async function main() {
+    if (isNode()) return;
+    preact.render(<TestStoragePage />, document.body);
+}
+
+main().catch(console.error);