spec-3nweb-server 1.8.11 → 1.9.0

package/.gitlab-ci-linux.yml

@@ -48,3 +48,16 @@ pack mock for linux:
 #     paths:
 #       - 3nweb-*.deb
 #     expire_in: 3d
+
+
+publish to npm:
+  stage: publish
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master"'
+      when: manual
+  needs:
+    - build for linux
+    - test on linux
+  image: node-24
+  script:
+    - bash publish-task.sh $NPM_PUBLISH_TOKEN

package/.gitlab-ci.yml

@@ -47,16 +47,6 @@ pack mock:
     - npm run clear-for-packing-mock
 
 
-publish to npm:
-  stage: publish
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "master"'
-      when: manual
-  image: node-24
-  script:
-    - bash publish-task.sh $NPM_PUBLISH_TOKEN
-
-
 include:
   - .gitlab-ci-linux.yml
   - .gitlab-ci-windows.yml

package/build/3nstorage/routes/owner/param-getter.js

@@ -20,9 +20,6 @@ exports.getParam = void 0;
 const users_1 = require("../../resources/users");
 const owner_1 = require("../../../lib-common/service-api/3nstorage/owner");
 function getParam(paramGetter) {
-    if ('function' !== typeof paramGetter) {
-        throw new TypeError("Given argument 'paramGetter' must be function, but is not.");
-    }
     return async (req, res, next) => {
         const session = req.session;
         const userId = session.params.userId;
@@ -32,7 +29,7 @@ function getParam(paramGetter) {
         }
         catch (err) {
             if (err === users_1.SC.USER_UNKNOWN) {
-                res.status(owner_1.ERR_SC.server).send("Recipient disappeared from the system.");
+                res.status(owner_1.ERR_SC.server).send("User disappeared from the system.");
                 session.close();
             }
             else {

package/build/3nstorage/routes/owner/session-params.js

@@ -35,7 +35,7 @@ function sessionParams(maxChunk) {
                 next(err);
             }
             else if (err === users_1.SC.USER_UNKNOWN) {
-                res.status(owner_1.ERR_SC.server).send("Recipient disappeared from the system.");
+                res.status(owner_1.ERR_SC.server).send("User disappeared from the system.");
                 req.session.close();
             }
             else {

package/build/asmail/resources/utils.d.ts

@@ -3,4 +3,8 @@ export declare function getObjIdFromParams(req: Request): {
     objId: string;
     objIdParseErr?: string;
 };
+export declare function getMsgIdFromParams(req: Request): {
+    msgId: string;
+    msgIdParseErr?: string;
+};
 export declare function replyWithErr(status: number, msg: string, res: Response, reqToDrainBytesFrom?: Request): void;

package/build/asmail/resources/utils.js

@@ -16,7 +16,7 @@
  this program. If not, see <http://www.gnu.org/licenses/>.
 */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.replyWithErr = exports.getObjIdFromParams = void 0;
+exports.replyWithErr = exports.getMsgIdFromParams = exports.getObjIdFromParams = void 0;
 const buffer_utils_1 = require("../../lib-common/buffer-utils");
 const body_parsers_1 = require("../../lib-server/middleware/body-parsers");
 function getObjIdFromParams(req) {
@@ -26,6 +26,13 @@ function getObjIdFromParams(req) {
         { objId: undefined, objIdParseErr: "Bad object id" });
 }
 exports.getObjIdFromParams = getObjIdFromParams;
+function getMsgIdFromParams(req) {
+    const msgId = req.params.msgId;
+    return ((!!msgId && buffer_utils_1.base64urlSafe.allCharsFromAlphabet(msgId)) ?
+        { msgId } :
+        { msgId: undefined, msgIdParseErr: "Bad message id" });
+}
+exports.getMsgIdFromParams = getMsgIdFromParams;
 function replyWithErr(status, msg, res, reqToDrainBytesFrom) {
     if (reqToDrainBytesFrom) {
         (0, body_parsers_1.attachByteDrainToRequest)(reqToDrainBytesFrom);

package/build/asmail/routes/delivery/restart-session.js

@@ -22,6 +22,7 @@ const delivery_1 = require("../../../lib-common/service-api/asmail/delivery");
 const canonical_address_1 = require("../../../lib-common/canonical-address");
 const confUtil = require("../../../lib-server/conf-util");
 const utils_1 = require("../../resources/utils");
+const buffer_utils_1 = require("../../../lib-common/buffer-utils");
 /**
  * This creates a session restart route handler.
  * @param sessionGenFunc is a promise returning function that generates new session objects.
@@ -69,7 +70,8 @@ function restartSession(sessionGenFunc, sessionForMsgFunc, incompleteMsgFunc, ma
             return (0, utils_1.replyWithErr)(delivery_1.ERR_SC.malformed, "Recipient is either missing in the request, or is malformed", res);
         }
         // check message id
-        if (typeof msgId !== 'string') {
+        if ((typeof msgId !== 'string') || !msgId || !buffer_utils_1.base64urlSafe.allCharsFromAlphabet(msgId)) {
+            console.log(`msgId ->`, msgId, '\n', `!base64urlSafe.allCharsFromAlphabet(msgId) ->`, !buffer_utils_1.base64urlSafe.allCharsFromAlphabet(msgId));
             return (0, utils_1.replyWithErr)(delivery_1.ERR_SC.malformed, "Message id is either missing, or is malformed", res);
         }
         try {

package/build/asmail/routes/retrieval/get-message-meta.js

@@ -23,7 +23,10 @@ const utils_1 = require("../../resources/utils");
 function getMsgMeta(getMsgMetaFunc) {
     return async (req, res, next) => {
         const userId = req.session.params.userId;
-        const msgId = req.params.msgId;
+        const { msgId, msgIdParseErr } = (0, utils_1.getMsgIdFromParams)(req);
+        if (msgIdParseErr) {
+            return (0, utils_1.replyWithErr)(retrieval_1.ERR_SC.malformed, msgIdParseErr, res, req);
+        }
         try {
             const meta = await getMsgMetaFunc(userId, msgId);
             res.status(retrieval_1.msgMetadata.SC.ok).json(meta);

package/build/asmail/routes/retrieval/get-message-obj.js

@@ -41,7 +41,10 @@ function extractQueryOptions(req) {
 function getMsgObj(getMsgObjFunc) {
     return async (req, res, next) => {
         const userId = req.session.params.userId;
-        const msgId = req.params.msgId;
+        const { msgId, msgIdParseErr } = (0, utils_1.getMsgIdFromParams)(req);
+        if (msgIdParseErr) {
+            return (0, utils_1.replyWithErr)(retrieval_1.ERR_SC.malformed, msgIdParseErr, res, req);
+        }
         const { objId, objIdParseErr } = (0, utils_1.getObjIdFromParams)(req);
         if (objIdParseErr) {
             return (0, utils_1.replyWithErr)(retrieval_1.ERR_SC.malformed, objIdParseErr, res);

package/build/asmail/routes/retrieval/remove-message.js

@@ -23,7 +23,10 @@ const utils_1 = require("../../resources/utils");
 function deleteMsg(delMsgFunc) {
     return async (req, res, next) => {
         const userId = req.session.params.userId;
-        const msgId = req.params.msgId;
+        const { msgId, msgIdParseErr } = (0, utils_1.getMsgIdFromParams)(req);
+        if (msgIdParseErr) {
+            return (0, utils_1.replyWithErr)(retrieval_1.ERR_SC.malformed, msgIdParseErr, res, req);
+        }
         try {
             await delMsgFunc(userId, msgId);
             res.status(retrieval_1.rmMsg.SC.ok).send();

package/build/lib.d.ts

@@ -1,5 +1,5 @@
 export { AppWithWSs } from './lib-server/web-sockets/app';
-export { Configurations, servicesApp, accountsApp } from './services';
+export { Configurations, servicesApp, accountsApp, wellKnownApp } from './services';
 export { addSingleUserSignup } from './config/signup';
 export import errors = require('./lib-server/middleware/error-handler');
 export * as mock from './mock/run-in-proc';

package/build/lib.js

@@ -16,12 +16,13 @@
  this program. If not, see <http://www.gnu.org/licenses/>.
 */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.mock = exports.addSingleUserSignup = exports.accountsApp = exports.servicesApp = exports.AppWithWSs = void 0;
+exports.mock = exports.addSingleUserSignup = exports.wellKnownApp = exports.accountsApp = exports.servicesApp = exports.AppWithWSs = void 0;
 var app_1 = require("./lib-server/web-sockets/app");
 Object.defineProperty(exports, "AppWithWSs", { enumerable: true, get: function () { return app_1.AppWithWSs; } });
 var services_1 = require("./services");
 Object.defineProperty(exports, "servicesApp", { enumerable: true, get: function () { return services_1.servicesApp; } });
 Object.defineProperty(exports, "accountsApp", { enumerable: true, get: function () { return services_1.accountsApp; } });
+Object.defineProperty(exports, "wellKnownApp", { enumerable: true, get: function () { return services_1.wellKnownApp; } });
 var signup_1 = require("./config/signup");
 Object.defineProperty(exports, "addSingleUserSignup", { enumerable: true, get: function () { return signup_1.addSingleUserSignup; } });
 exports.errors = require("./lib-server/middleware/error-handler");

package/build/main.js

@@ -36,6 +36,7 @@ async function run(conf) {
         const app = new lib_1.AppWithWSs();
         app.use((0, lib_1.servicesApp)(conf, 'console', 'console'));
         app.use((0, lib_1.accountsApp)(conf, 'console', 'console'));
+        app.use((0, lib_1.wellKnownApp)(conf));
         return app;
     }
     async function stopProcess() {
@@ -61,7 +62,7 @@ async function run(conf) {
     }
     async function startAppWithoutTLS(port, hostname) {
         await app.start(undefined, port, hostname);
-        console.log(`🚀 Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} without TLS, and requiring TLS reverse proxy infront.`);
+        console.log(`🚀 Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} without TLS, and requiring TLS or Tor-like reverse proxy infront.`);
     }
     try {
         app = createApp(conf);

package/build/services.d.ts

@@ -27,6 +27,12 @@ export interface Configurations {
         noTokenFile?: string;
         serviceUrl?: string;
     };
+    wellKnown3NWeb?: {
+        mailerid?: string;
+        asmail?: string;
+        "3nstorage"?: string;
+    };
 }
 export declare function servicesApp(conf: Configurations, errLogger?: ErrLogger | 'console', logSetup?: 'console'): AppWithWSs;
 export declare function accountsApp(conf: Configurations, errLogger?: ErrLogger | 'console', logSetup?: 'console'): AppWithWSs;
+export declare function wellKnownApp(conf: Configurations): AppWithWSs;

package/build/services.js

@@ -1,6 +1,6 @@
 "use strict";
 /*
- Copyright (C) 2015 - 2017, 2020, 2024 - 2025 3NSoft Inc.
+ Copyright (C) 2015 - 2017, 2020, 2024 - 2026 3NSoft Inc.
  
  This program is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free Software
@@ -16,7 +16,7 @@
  this program. If not, see <http://www.gnu.org/licenses/>.
 */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accountsApp = exports.servicesApp = void 0;
+exports.wellKnownApp = exports.accountsApp = exports.servicesApp = void 0;
 const mailerid_authorizer_1 = require("./lib-server/resources/mailerid-authorizer");
 const app_1 = require("./lib-server/web-sockets/app");
 const mailerId_app_1 = require("./mailerId/mailerId-app");
@@ -25,6 +25,7 @@ const _3nstorage_app_1 = require("./3nstorage/3nstorage-app");
 const signup_app_1 = require("./signup/signup-app");
 const error_handler_1 = require("./lib-server/middleware/error-handler");
 const locker_app_1 = require("./locker/locker-app");
+const well_known_route_app_1 = require("./well-known/well-known-route-app");
 function servicesApp(conf, errLogger, logSetup) {
     var _a;
     if (!conf.enabledServices || (typeof conf.enabledServices !== 'object')) {
@@ -75,4 +76,12 @@ function accountsApp(conf, errLogger, logSetup) {
     return app;
 }
 exports.accountsApp = accountsApp;
+function wellKnownApp(conf) {
+    const app = new app_1.AppWithWSs();
+    if (conf.wellKnown3NWeb) {
+        app.http.use('/.well-known', (0, well_known_route_app_1.makeWellKnownApp)(conf.wellKnown3NWeb));
+    }
+    return app;
+}
+exports.wellKnownApp = wellKnownApp;
 Object.freeze(exports);

package/build/tests/libs-for-tests/mailerid.js

@@ -24,7 +24,6 @@ const provisioning_1 = require("../../lib-common/service-api/mailer-id/provision
 const mid_sigs_NaCl_Ed_1 = require("../../lib-common/mid-sigs-NaCl-Ed");
 const pkl_1 = require("./pkl");
 const random_node_1 = require("../../lib-common/random-node");
-const url_1 = require("url");
 async function getMidData(midUrl) {
     let reqOpts = {
         url: midUrl,
@@ -97,7 +96,7 @@ async function doMailerIdLogin(loginUrl, user) {
         responseType: 'json',
         sessionId
     };
-    let serviceDomain = (0, url_1.parse)(loginUrl).hostname;
+    let serviceDomain = (new URL(loginUrl)).hostname;
     if (!serviceDomain) {
         throw new Error(`Cannot parse hostname from login url ${loginUrl}`);
     }

package/build/tests/protocols/asmail/delivery/specs/restart-session.js

@@ -63,7 +63,7 @@ exports.specs.definition = (setup) => (() => {
     (0, async_jasmine_1.itAsync)(`returns error status when message is not known in delivery`, async () => {
         const req = {
             recipient: user2.id,
-            msgId: 'unknown message'
+            msgId: 'unknown_message'
         };
         const rep = await (0, xhr_utils_1.doJsonRequest)(reqOpts, req);
         expect(rep.status).withContext('status for unknown message').toBe(delivery_1.sessionRestart.SC.unknownMsg);

package/build/tests/protocols/asmail/delivery/test-utils.js

@@ -36,8 +36,7 @@ exports.msg = {
     msgObjs: [exports.obj1, exports.obj2]
 };
 async function startSessionAndSendMsgObjs(deliveryUrl, recipient, msg) {
-    const sessInfo = await (0, asmail_1.startMsgDelivery)(deliveryUrl, { recipient }, { pid: msg.cryptoMeta.pid,
-        objIds: [msg.msgObjs[0].objId, msg.msgObjs[1].objId] });
+    const sessInfo = await (0, asmail_1.startMsgDelivery)(deliveryUrl, { recipient }, { pid: msg.cryptoMeta.pid, objIds: [msg.msgObjs[0].objId, msg.msgObjs[1].objId] });
     await (0, asmail_1.sendMsgObj)(deliveryUrl, sessInfo.sessionId, msg.msgObjs[0], sessInfo.maxChunkSize);
     await (0, asmail_1.sendMsgObj)(deliveryUrl, sessInfo.sessionId, msg.msgObjs[1], sessInfo.maxChunkSize);
     return sessInfo;

package/build/tests/shared-checks/check-mid-login.js

@@ -71,7 +71,7 @@ function midLoginSpecs(loginUrl, user) {
                 responseType: 'json',
                 sessionId
             };
-            const serviceDomain = (0, url_1.parse)(loginUrl()).hostname;
+            const serviceDomain = (new URL(loginUrl())).hostname;
             if (!serviceDomain) {
                 throw new Error(`Cannot get hostname from ${loginUrl()}`);
             }

package/build/well-known/well-known-route-app.d.ts

@@ -0,0 +1,3 @@
+import * as express from 'express';
+import { Configurations } from '../services';
+export declare function makeWellKnownApp(w3n: NonNullable<Configurations['wellKnown3NWeb']>): express.Application;

package/build/well-known/well-known-route-app.js

@@ -0,0 +1,53 @@
+"use strict";
+/*
+ Copyright (C) 2026 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeWellKnownApp = void 0;
+const express = require("express");
+function makeWellKnownApp(w3n) {
+    const app = express();
+    const w3nJson = confTo3NWebJSON(w3n);
+    app.get('3nweb.json', (req, res) => {
+        // the following implicitly sets content type application/json
+        res.status(200).json(w3nJson);
+    });
+    return app;
+}
+exports.makeWellKnownApp = makeWellKnownApp;
+function confTo3NWebJSON(conf) {
+    const json = {};
+    const fields = ['3nstorage', 'asmail', 'mailerid'];
+    for (const field in fields) {
+        const href = conf[field];
+        if (href) {
+            let u;
+            try {
+                u = new URL(href);
+            }
+            catch (err) {
+                console.error(` ❌  Configuration field ${field} for well-known needs potocol section`);
+                throw err;
+            }
+            if ((u.protocol !== 'https:') && (u.protocol !== 'http:')) {
+                throw new Error(` ❌  Configuration field ${field} for well-known needs potocol section`);
+            }
+            json[field] = href;
+        }
+    }
+    return json;
+}
+Object.freeze(exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spec-3nweb-server",
-  "version": "1.8.11",
+  "version": "1.9.0",
   "description": "3NWeb spec server.",
   "main": "build/lib.js",
   "types": "build/lib.d.ts",

package/ts-code/3nstorage/routes/owner/archive-obj-version.ts

@@ -30,6 +30,7 @@ export function archiveCurrentObjVersion(
 	return async (req: Request, res, next) => {
 
 		const userId = req.session.params.userId;
+
 		const { objId, objIdParseErr } = getObjIdFromParams(root, req);
 		if (objIdParseErr) {
 			return replyWithErr(ERR_SC.malformed, objIdParseErr, res);

package/ts-code/3nstorage/routes/owner/cancel-trans.ts

@@ -28,6 +28,7 @@ export function cancelTransaction(
 	return async (req: Request, res, next) => {
 
 		const userId = req.session.params.userId;
+
 		const { objId, objIdParseErr } = getObjIdFromParams(root, req);
 		if (objIdParseErr) {
 			return replyWithErr(ERR_SC.malformed, objIdParseErr, res);

package/ts-code/3nstorage/routes/owner/delete-obj.ts

@@ -33,6 +33,7 @@ function deleteObj(
 	return async (req: Request, res, next) => {
 
 		const userId = req.session.params.userId;
+
 		const { objId, objIdParseErr } = getObjIdFromParams(root, req);
 		if (objIdParseErr) {
 			return replyWithErr(ERR_SC.malformed, objIdParseErr, res);

package/ts-code/3nstorage/routes/owner/get-archived-obj-ver.ts

@@ -56,6 +56,7 @@ export function getArchivedObjVersion(
 	return async (req: Request, res, next) => {
 		
 		const userId = req.session.params.userId;
+
 		const { objId, objIdParseErr } = getObjIdFromParams(root, req);
 		if (objIdParseErr) {
 			return replyWithErr(ERR_SC.malformed, objIdParseErr, res);

package/ts-code/3nstorage/routes/owner/get-current-obj.ts

@@ -63,6 +63,7 @@ export function getCurrentObj(
 	return async (req: Request, res, next) => {
 		
 		const userId = req.session.params.userId;
+
 		const { objId, objIdParseErr } = getObjIdFromParams(root, req);
 		if (objIdParseErr) {
 			return replyWithErr(ERR_SC.malformed, objIdParseErr, res);

package/ts-code/3nstorage/routes/owner/get-obj-status.ts

@@ -28,6 +28,7 @@ export function getObjStatus(
 	return async (req: Request, res, next) => {
 
 		const userId = req.session.params.userId;
+
 		const { objId, objIdParseErr } = getObjIdFromParams(root, req);
 		if (objIdParseErr) {
 			return replyWithErr(ERR_SC.malformed, objIdParseErr, res);

package/ts-code/3nstorage/routes/owner/param-getter.ts

@@ -24,9 +24,6 @@ export function getParam<T>(
 	paramGetter: (userId: string) => Promise<T>
 ): RequestHandler {
 	
-	if ('function' !== typeof paramGetter) { throw new TypeError(
-			"Given argument 'paramGetter' must be function, but is not."); }
-	
 	return async (req: Request, res, next) => {
 		
 		const session = req.session;
@@ -37,8 +34,7 @@ export function getParam<T>(
 			res.status(PARAM_SC.ok).json(value);
 		} catch (err) {
 			if (err === storeSC.USER_UNKNOWN) {
-				res.status(ERR_SC.server).send(
-					"Recipient disappeared from the system.");
+				res.status(ERR_SC.server).send("User disappeared from the system.");
 				session.close();
 			} else {
 				next(err);

package/ts-code/3nstorage/routes/owner/put-current-obj.ts

@@ -47,6 +47,7 @@ export function saveCurrentObj(
 		}
 	
 		const userId = req.session.params.userId;
+
 		const { objId, objIdParseErr } = getObjIdFromParams(root, req);
 		if (objIdParseErr) {
 			return replyWithErr(ERR_SC.malformed, objIdParseErr, res, req);

package/ts-code/3nstorage/routes/owner/session-params.ts

@@ -37,7 +37,7 @@ export function sessionParams(maxChunk: number|string): RequestHandler {
 			if ("string" !== typeof err) {
 				next(err);
 			} else if (err === storeSC.USER_UNKNOWN) {
-				res.status(ERR_SC.server).send("Recipient disappeared from the system.");
+				res.status(ERR_SC.server).send("User disappeared from the system.");
 				req.session.close();
 			} else {
 				next(new Error("Unhandled storage error code: "+err));

package/ts-code/asmail/resources/utils.ts

@@ -30,6 +30,16 @@ export function getObjIdFromParams(req: Request): {
 	);
 }
 
+export function getMsgIdFromParams(req: Request): {
+	msgId: string; msgIdParseErr?: string;
+} {
+	const msgId = req.params.msgId;
+	return ((!!msgId && base64urlSafe.allCharsFromAlphabet(msgId)) ?
+		{ msgId } :
+		{ msgId: undefined as any, msgIdParseErr: "Bad message id" }
+	);
+}
+
 export function replyWithErr(status: number, msg: string, res: Response, reqToDrainBytesFrom?: Request): void {
 	if (reqToDrainBytesFrom) {
 		attachByteDrainToRequest(reqToDrainBytesFrom);

package/ts-code/asmail/routes/delivery/restart-session.ts

@@ -23,6 +23,7 @@ import { Redirect } from './start-session';
 import { checkAndTransformAddress } from '../../../lib-common/canonical-address';
 import * as confUtil from '../../../lib-server/conf-util';
 import { replyWithErr } from '../../resources/utils';
+import { base64urlSafe } from '../../../lib-common/buffer-utils';
 
 /**
  * This creates a session restart route handler.
@@ -84,7 +85,11 @@ export function restartSession(
 		}
 
 		// check message id
-		if (typeof msgId !== 'string') {
+		if ((typeof msgId !== 'string') || !msgId || !base64urlSafe.allCharsFromAlphabet(msgId)) {
+			console.log(
+				`msgId ->`, msgId, '\n',
+				`!base64urlSafe.allCharsFromAlphabet(msgId) ->`, !base64urlSafe.allCharsFromAlphabet(msgId)
+			);
 			return replyWithErr(ERR_SC.malformed, "Message id is either missing, or is malformed", res);
 		}
 

package/ts-code/asmail/routes/retrieval/get-message-meta.ts

@@ -19,14 +19,18 @@ import { RequestHandler } from 'express';
 import { SC as recipSC, MsgRetrieval } from '../../resources/recipients';
 import { msgMetadata as api, ERR_SC } from '../../../lib-common/service-api/asmail/retrieval';
 import { Request } from '../../resources/sessions';
-import { replyWithErr } from '../../resources/utils';
+import { getMsgIdFromParams, replyWithErr } from '../../resources/utils';
 
 export function getMsgMeta(
 	getMsgMetaFunc: MsgRetrieval['getMsgMeta']
 ): RequestHandler {
 	return async (req: Request, res, next) => {
 		const userId = req.session.params.userId;
-		const msgId: string = req.params.msgId;
+
+		const { msgId, msgIdParseErr } = getMsgIdFromParams(req);
+		if (msgIdParseErr) {
+			return replyWithErr(ERR_SC.malformed, msgIdParseErr, res, req);
+		}
 
 		try {
 			const meta = await getMsgMetaFunc(userId, msgId);

package/ts-code/asmail/routes/retrieval/get-message-obj.ts

@@ -21,7 +21,7 @@ import { GetObjQueryOpts, ERR_SC, msgObj as api, HTTP_HEADER } from '../../../li
 import { Request } from '../../resources/sessions';
 import { errWithCause } from '../../../lib-common/exceptions/error';
 import { EMPTY_BUFFER } from '../../../lib-common/buffer-utils';
-import { getObjIdFromParams, replyWithErr } from '../../resources/utils';
+import { getMsgIdFromParams, getObjIdFromParams, replyWithErr } from '../../resources/utils';
 
 function extractQueryOptions(req: Request): undefined|{
 	header: boolean; limit: number|undefined; ofs: number;
@@ -52,7 +52,11 @@ export function getMsgObj(
 	return async (req: Request, res, next) => {
 
 		const userId = req.session.params.userId;
-		const msgId: string = req.params.msgId;
+
+		const { msgId, msgIdParseErr } = getMsgIdFromParams(req);
+		if (msgIdParseErr) {
+			return replyWithErr(ERR_SC.malformed, msgIdParseErr, res, req);
+		}
 
 		const { objId, objIdParseErr } = getObjIdFromParams(req);
 		if (objIdParseErr) {

package/ts-code/asmail/routes/retrieval/remove-message.ts

@@ -19,12 +19,16 @@ import { RequestHandler } from 'express';
 import { SC as recipSC, MsgRetrieval } from '../../resources/recipients';
 import { rmMsg as api, ERR_SC } from '../../../lib-common/service-api/asmail/retrieval';
 import { Request } from '../../resources/sessions';
-import { replyWithErr } from '../../resources/utils';
+import { getMsgIdFromParams, replyWithErr } from '../../resources/utils';
 
 export function deleteMsg(delMsgFunc: MsgRetrieval['deleteMsg']): RequestHandler {
 	return async (req: Request, res, next) => {
 		const userId = req.session.params.userId;
-		const msgId: string = req.params.msgId;
+
+		const { msgId, msgIdParseErr } = getMsgIdFromParams(req);
+		if (msgIdParseErr) {
+			return replyWithErr(ERR_SC.malformed, msgIdParseErr, res, req);
+		}
 
 		try {
 			await delMsgFunc(userId, msgId);

package/ts-code/lib.ts

@@ -17,7 +17,7 @@
 
 export { AppWithWSs } from './lib-server/web-sockets/app';
 
-export { Configurations, servicesApp, accountsApp } from './services';
+export { Configurations, servicesApp, accountsApp, wellKnownApp } from './services';
 
 export { addSingleUserSignup } from './config/signup';
 

package/ts-code/main.ts

@@ -25,7 +25,7 @@ import { ServerOptions } from 'https';
 import { CliUsageDisplay, parseProcessArgv } from './cli';
 import { readYamlConfFile } from './config/from-yaml';
 import { sslOptsFromConfig } from './config/letsencrypt';
-import { Configurations, servicesApp, accountsApp, AppWithWSs } from './lib';
+import { Configurations, servicesApp, accountsApp, AppWithWSs, wellKnownApp } from './lib';
 import { addMultiDomainSignup, addSingleUserSignup, readAllSignupTokens, readNoTokensFile, readTokenFile } from './config/signup';
 import { DEFAULT_CONFIG_PATH } from './config/default-confs';
 import { Code } from './lib-common/exceptions/file';
@@ -45,6 +45,7 @@ async function run(conf: Configurations): Promise<void> {
 		const app = new AppWithWSs();
 		app.use(servicesApp(conf, 'console', 'console'));
 		app.use(accountsApp(conf, 'console', 'console'));
+		app.use(wellKnownApp(conf));
 		return app;
 	}
 
@@ -73,7 +74,7 @@ async function run(conf: Configurations): Promise<void> {
 		port: number, hostname: string|undefined
 	): Promise<void> {
 		await app!.start(undefined, port, hostname);
-		console.log(`🚀 Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} without TLS, and requiring TLS reverse proxy infront.`);	
+		console.log(`🚀 Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} without TLS, and requiring TLS or Tor-like reverse proxy infront.`);
 	}
 
 	try {

package/ts-code/services.ts

@@ -1,5 +1,5 @@
 /*
- Copyright (C) 2015 - 2017, 2020, 2024 - 2025 3NSoft Inc.
+ Copyright (C) 2015 - 2017, 2020, 2024 - 2026 3NSoft Inc.
  
  This program is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free Software
@@ -30,6 +30,7 @@ import { makeSignupApp } from './signup/signup-app';
 import { ErrLogger, makeErrLoggerToConsole } from "./lib-server/middleware/error-handler";
 import { makeLockerApp } from "./locker/locker-app";
 import { MidAuthorizer } from "./lib-server/routes/sessions/mid-auth";
+import { makeWellKnownApp } from "./well-known/well-known-route-app";
 
 export interface Configurations {
 	enabledServices: {
@@ -56,6 +57,11 @@ export interface Configurations {
 		noTokenFile?: string;
 		serviceUrl?: string;
 	};
+	wellKnown3NWeb?: {
+		mailerid?: string;
+		asmail?: string;
+		"3nstorage"?: string;
+	};
 }
 
 export function servicesApp(
@@ -135,4 +141,15 @@ export function accountsApp(
 	return app;
 }
 
+export function wellKnownApp(conf: Configurations): AppWithWSs {
+
+	const app = new AppWithWSs();
+
+	if (conf.wellKnown3NWeb) {
+		app.http.use('/.well-known', makeWellKnownApp(conf.wellKnown3NWeb));
+	}
+
+	return app;
+}
+
 Object.freeze(exports);

package/ts-code/tests/libs-for-tests/mailerid.ts

@@ -25,7 +25,6 @@ import { certify as certApi }
 import { user as midUser }	from '../../lib-common/mid-sigs-NaCl-Ed';
 import { doPubKeyLogin, User } from './pkl';
 import { bytesSync as randomBytes } from '../../lib-common/random-node';
-import { parse as parseUrl } from 'url';
 
 export { User } from './pkl';
 
@@ -106,7 +105,7 @@ export async function doMailerIdLogin(loginUrl: string, user: User):
 		responseType: 'json',
 		sessionId
 	};
-	let serviceDomain = parseUrl(loginUrl).hostname;
+	let serviceDomain = (new URL(loginUrl)).hostname;
 	if (!serviceDomain) { throw new Error(
 		`Cannot parse hostname from login url ${loginUrl}`); }
 	let req: authSession.Request = {

package/ts-code/tests/libs-for-tests/pkl.ts

@@ -23,7 +23,7 @@ import { makeSessionEncryptor, SessionEncryptor }
 	from '../../lib-common/session-encryptor';
 import { doJsonRequest, RequestOpts, doBinaryRequest }
 	from './xhr-utils';
-import { parse as parseUrl, resolve as resolveUrl } from 'url';
+import { resolve as resolveUrl } from 'url';
 import { bytesEqual } from './bytes-equal';
 
 export interface User {

package/ts-code/tests/protocols/asmail/delivery/specs/restart-session.ts

@@ -36,8 +36,7 @@ specs.definition = (setup: () => TestSetup) => (() => {
 	beforeAllAsync(async () => {
 		user2 = setup().user2;
 		const deliveryUrl = await setup().asmailServer.getDeliveryUrl();
-		initialSession = await startSessionAndSendMsgObjs(
-			deliveryUrl, user2.id, msg);
+		initialSession = await startSessionAndSendMsgObjs(deliveryUrl, user2.id, msg);
 		reqOpts = {
 			url: resolveUrl(deliveryUrl, api.URL_END),
 			method: 'POST',
@@ -74,7 +73,7 @@ specs.definition = (setup: () => TestSetup) => (() => {
 			async () => {
 		const req: api.Request = {
 			recipient: user2.id,
-			msgId: 'unknown message'
+			msgId: 'unknown_message'
 		};
 		const rep = await doJsonRequest<api.Reply>(reqOpts, req);
 		expect(rep.status).withContext('status for unknown message').toBe(api.SC.unknownMsg);

package/ts-code/tests/protocols/asmail/delivery/test-utils.ts

@@ -50,14 +50,13 @@ export const msg: Msg = {
 
 export async function startSessionAndSendMsgObjs(deliveryUrl: string,
 		recipient: string, msg: Msg): Promise<DeliveryInfo> {
-	const sessInfo = await startMsgDelivery(deliveryUrl,
+	const sessInfo = await startMsgDelivery(
+		deliveryUrl,
 		{ recipient },
-		{ pid: msg.cryptoMeta.pid,
-			objIds: [ msg.msgObjs[0].objId, msg.msgObjs[1].objId ] });
-	await sendMsgObj(deliveryUrl, sessInfo.sessionId, msg.msgObjs[0],
-		sessInfo.maxChunkSize);
-	await sendMsgObj(deliveryUrl, sessInfo.sessionId, msg.msgObjs[1],
-		sessInfo.maxChunkSize);
+		{ pid: msg.cryptoMeta.pid, objIds: [ msg.msgObjs[0].objId, msg.msgObjs[1].objId ] }
+	);
+	await sendMsgObj(deliveryUrl, sessInfo.sessionId, msg.msgObjs[0], sessInfo.maxChunkSize);
+	await sendMsgObj(deliveryUrl, sessInfo.sessionId, msg.msgObjs[1], sessInfo.maxChunkSize);
 	return sessInfo;
 }
 

package/ts-code/tests/shared-checks/check-mid-login.ts

@@ -22,7 +22,7 @@ import { startMidSession, provisionMidSigner, User } from '../libs-for-tests/mai
 import { expectNonAcceptanceOfBadJsonRequest, expectNonAcceptanceOfBadSessionId } from './requests';
 import * as mid from '../../lib-common/mid-sigs-NaCl-Ed';
 import { bytesSync as randomBytes } from '../../lib-common/random-node';
-import { parse as parseUrl, resolve as resolveUrl } from 'url';
+import { resolve as resolveUrl } from 'url';
 
 export function midLoginSpecs(
 	loginUrl: () => string,
@@ -86,7 +86,7 @@ export function midLoginSpecs(
 				sessionId
 			};
 			
-			const serviceDomain = parseUrl(loginUrl()).hostname;
+			const serviceDomain = (new URL(loginUrl())).hostname;
 			if (!serviceDomain) { throw new Error(
 				`Cannot get hostname from ${loginUrl()}`); }
 			const req: authSession.Request = {

package/ts-code/well-known/well-known-route-app.ts

@@ -0,0 +1,66 @@
+/*
+ Copyright (C) 2026 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import * as express from 'express';
+import { Configurations } from '../services';
+
+export function makeWellKnownApp(w3n: NonNullable<Configurations['wellKnown3NWeb']>): express.Application {
+
+	const app = express();
+
+	const w3nJson = confTo3NWebJSON(w3n);
+
+	app.get('3nweb.json', (req, res) => {
+		// the following implicitly sets content type application/json
+		res.status(200).json(w3nJson);
+	});
+
+	return app;
+}
+
+interface WellKnown3NWeb {
+  mailerid?: string;
+  asmail?: string;
+  '3nstorage'?: string;
+  report?: string;
+  'w3n-app'?: string;
+}
+
+function confTo3NWebJSON(conf: NonNullable<Configurations['wellKnown3NWeb']>): WellKnown3NWeb {
+	const json: WellKnown3NWeb = {};
+	const fields: (keyof WellKnown3NWeb)[] = [ '3nstorage', 'asmail', 'mailerid' ];
+	for (const field in fields) {
+		const href = conf[field];
+		if (href) {
+			let u: URL;
+			try {
+				u = new URL(href);
+			} catch (err) {
+				console.error(` ❌  Configuration field ${field} for well-known needs potocol section`);
+				throw err;
+			}
+			if ((u.protocol !== 'https:') && (u.protocol !== 'http:')) {
+				throw new Error(` ❌  Configuration field ${field} for well-known needs potocol section`);
+			}
+			json[field] = href;
+		}
+	}
+	return json;
+}
+
+
+Object.freeze(exports);