boneIO 1.6.0.dev29__py3-none-any.whl → 1.6.0.dev30__py3-none-any.whl

boneio/core/auth/jwt_secret.py

@@ -5,10 +5,22 @@ rather than in the web server so recovery mode signs with the same secret
 without importing the web server, which pulls in the whole Manager: a token
 issued in recovery keeps working once the controller is back, and the other
 way round.
+
+The secret belongs to one controller, and the file says which: its second
+line is a hash of the machine-id it was drawn on. A file that names another
+machine — or none — came from somewhere else, most likely an SD card image
+built on a controller that had already run, and every device flashed from that
+image would otherwise sign with the same key. Anyone holding the image could
+then sign an administrator's token for all of them. Such a file is replaced
+rather than trusted, which signs everybody out once.
+
+Only the hash is stored: machine-id is meant to stay on the machine, and the
+file needs no more than to recognise it.
 """
 
 from __future__ import annotations
 
+import hashlib
 import logging
 import os
 import secrets
@@ -18,40 +30,98 @@ _LOGGER = logging.getLogger(__name__)
 
 JWT_SECRET_FILENAME = "jwt_secret"
 
+#: Where systemd keeps this installation's identity. Emptied when an image is
+#: sealed and drawn afresh on the first boot, which is what makes it the thing
+#: to bind to.
+MACHINE_ID_PATH = Path("/etc/machine-id")
+
+_BINDING_PREFIX = "machine:"
+
+
+def _machine_binding(machine_id_path: Path) -> str | None:
+    """The binding line for this machine, or None when it has no identity yet.
+
+    None is not an error. On an image being built machine-id is empty on
+    purpose; a secret drawn then stays unbound and is replaced on the first
+    boot, once there is an identity to bind it to.
+
+    Args:
+        machine_id_path: The machine-id file.
+
+    Returns:
+        ``machine:<sha256 of machine-id>``, or None.
+    """
+    try:
+        machine_id = machine_id_path.read_text().strip()
+    except OSError:
+        return None
+    if not machine_id:
+        return None
+    digest = hashlib.sha256(f"boneio-jwt:{machine_id}".encode()).hexdigest()
+    return f"{_BINDING_PREFIX}{digest}"
+
+
+def _write_secret(path: Path, secret: str, binding: str | None) -> None:
+    """Write the secret readable by its owner only, from the first byte.
+
+    Created 0600 rather than chmod-ed afterwards, and swapped in with a rename,
+    so there is never a moment when the key is on disk with looser permissions
+    or half written.
+    """
+    content = secret + (f"\n{binding}" if binding else "") + "\n"
+    tmp = path.with_name(f".{path.name}.tmp")
+    try:
+        tmp.unlink()
+    except FileNotFoundError:
+        pass
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(content)
+        f.flush()
+        os.fsync(f.fileno())
+    os.replace(tmp, path)
 
-def load_or_create_jwt_secret(config_dir: str | os.PathLike[str]) -> str:
+
+def load_or_create_jwt_secret(
+    config_dir: str | os.PathLike[str],
+    machine_id_path: Path = MACHINE_ID_PATH,
+) -> str:
     """Read the token secret, creating it on first use.
 
+    A stored secret is used only if it was drawn on this machine. One with no
+    binding, or another machine's, is replaced — unless this machine has no
+    identity to compare with, in which case it is kept as it is: replacing it
+    then would sign everybody out on every start.
+
     Never raises: a secret that cannot be persisted is replaced by one that
     lives as long as the process, which logs everybody out on the next restart
     but does not keep the panel from starting.
 
     Args:
         config_dir: The directory config.yaml is in.
+        machine_id_path: The machine-id file. A parameter for the tests.
 
     Returns:
         The secret.
     """
     jwt_secret_file = Path(config_dir) / JWT_SECRET_FILENAME
+    binding = _machine_binding(machine_id_path)
 
     try:
         if jwt_secret_file.exists():
-            # Read existing secret
-            with open(jwt_secret_file) as f:
-                jwt_secret = f.read().strip()
-                if jwt_secret:  # Verify it's not empty
-                    return jwt_secret
+            lines = jwt_secret_file.read_text().split()
+            stored = lines[0] if lines else ""
+            stored_binding = lines[1] if len(lines) > 1 else None
+            if stored and (binding is None or stored_binding == binding):
+                return stored
+            if stored:
+                _LOGGER.warning(
+                    "The token secret was not drawn on this controller; "
+                    "replacing it. Everybody signed in has to sign in again."
+                )
 
-        # Generate new secret if file doesn't exist or is empty
         jwt_secret = secrets.token_hex(32)  # 256-bit random secret
-
-        # Save the secret
-        with open(jwt_secret_file, "w") as f:
-            f.write(jwt_secret)
-
-        # Secure the file permissions (read/write only for owner)
-        os.chmod(jwt_secret_file, 0o600)
-
+        _write_secret(jwt_secret_file, jwt_secret, binding)
     except Exception as e:
         # If we can't persist the secret, generate a temporary one
         _LOGGER.error(f"Failed to handle JWT secret file: {e}")

boneio/core/cloud/registration.py

@@ -88,6 +88,7 @@ class CloudRegistration:
         self._task: asyncio.Task | None = None
         self._session: aiohttp.ClientSession | None = None
         self._last_error: str | None = None
+        self._switching = False
 
     @property
     def domain(self) -> str | None:
@@ -104,6 +105,18 @@ class CloudRegistration:
         """Get the last error message, if any."""
         return self._last_error
 
+    @property
+    def serving(self) -> bool:
+        """Whether Caddy is up on the cloud template with the certificate.
+
+        False while the template is being swapped and Caddy recreated: the
+        compose file already names the cloud script then, but the proxy — the
+        only way into a panel with ``web.expose: proxy`` — is down for the half
+        minute that takes. Anything sending somebody to the registered name
+        has to wait for this rather than for the template.
+        """
+        return self._domain is not None and not self._switching and self.is_cloud_config_active()
+
     @property
     def is_compose_writable(self) -> bool:
         """Check if docker-compose.yaml is writable without side effects."""
@@ -551,6 +564,14 @@ class CloudRegistration:
         Returns:
             True if the switch was successful.
         """
+        self._switching = True
+        try:
+            return await self._apply_cloud_config()
+        finally:
+            self._switching = False
+
+    async def _apply_cloud_config(self) -> bool:
+        """The body of :meth:`_switch_to_cloud_config`, without the flag."""
         # The init script still comes from the package; it is mounted read-only
         # into the container and is not what compose executes on the host.
         self._ensure_cloud_script()
@@ -571,7 +592,9 @@ class CloudRegistration:
             return False
 
         _LOGGER.info("Switched docker-compose.yaml to the cloud template")
-        return await self._recreate_caddy()
+        # The service definition changed, so ``up`` recreates the container
+        # and it reads the certificate as it starts.
+        return await self._recreate_caddy(restart=False)
 
     async def _restore_local_config(self) -> bool:
         """Restore the plain compose template and restart Caddy.
@@ -595,14 +618,21 @@ class CloudRegistration:
             return False
 
         _LOGGER.info("Restored the local docker-compose.yaml template")
-        return await self._recreate_caddy()
+        return await self._recreate_caddy(restart=False)
 
-    async def _recreate_caddy(self) -> bool:
+    async def _recreate_caddy(self, restart: bool = True) -> bool:
         """Recreate and restart Caddy so it picks up new certs or compose config.
 
         Both steps go through the container helper, so neither passes anything
         from here to Docker.
 
+        Args:
+            restart: Restart after ``up``. Needed when the compose file did not
+                change — ``up`` then leaves the running container alone and it
+                keeps the certificate it read at start. Not after a template
+                swap: ``up`` has just recreated it, and a restart on top takes
+                the proxy down a second time.
+
         Returns:
             True if the recreate was successful.
         """
@@ -614,12 +644,16 @@ class CloudRegistration:
             )
             return False
 
+        if not restart:
+            _LOGGER.info("Caddy container recreated successfully")
+            return True
+
         # Restart as well: mounted TLS certificates are only re-read on start.
-        restart = await loop.run_in_executor(None, containers.restart_caddy)
-        if not restart.ok:
+        restarted = await loop.run_in_executor(None, containers.restart_caddy)
+        if not restarted.ok:
             _LOGGER.warning(
                 "Caddy was recreated but the restart failed: %s",
-                restart.stderr.strip() or "unknown error",
+                restarted.stderr.strip() or "unknown error",
             )
 
         _LOGGER.info("Caddy container recreated and restarted successfully")

boneio/core/nodered_guard.py

@@ -0,0 +1,141 @@
+"""Make sure the running Node-RED asks for a password.
+
+Node-RED reads ``settings.js`` once, when its container starts. The file can
+say ``adminAuth`` while the editor still answers anyone: a migration installs
+the file during an update, and an update restarts boneIO, not the controller,
+so the container goes on with the settings it started with — an open editor,
+and deploying a flow with an ``exec`` node is code execution in it.
+
+So after boneIO starts it asks Node-RED, through the local proxy the way a
+browser would, what its login looks like. An editor that wants no login while
+the file on disk asks for one is restarted, once. Anything else is left alone:
+Node-RED switched off, still starting, or behind a proxy that is being
+recreated all look like "no answer", which is not a reason to restart.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import ssl
+import urllib.error
+import urllib.request
+from collections.abc import Callable
+from pathlib import Path
+
+from boneio.core import containers
+
+_LOGGER = logging.getLogger(__name__)
+
+SETTINGS_FILE = containers.PROJECT_DIR / "node-red" / "settings.js"
+
+#: Node-RED needs a while after a boot; so does the first start of Caddy.
+FIRST_CHECK_AFTER = 60.0
+RETRY_EVERY = 60.0
+ATTEMPTS = 10
+
+OPEN = "open"
+PROTECTED = "protected"
+UNKNOWN = "unknown"
+
+
+def probe(port: int, timeout: float = 5.0) -> str:
+    """Ask the editor how it signs people in.
+
+    ``GET /nodered/auth/login`` answers ``{}`` when ``adminAuth`` is off and
+    names the login type when it is on. The proxy's certificate is the
+    device's own, unverifiable from here, and this request never leaves the
+    machine, so it is not checked.
+
+    Args:
+        port: The HTTPS port Caddy publishes.
+        timeout: Seconds to wait.
+
+    Returns:
+        OPEN, PROTECTED, or UNKNOWN when there was no usable answer.
+    """
+    context = ssl.create_default_context()
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE
+    url = f"https://127.0.0.1:{port}/nodered/auth/login"
+    try:
+        with urllib.request.urlopen(url, timeout=timeout, context=context) as response:  # noqa: S310
+            body = json.loads(response.read(4096) or b"null")
+    except (OSError, ValueError, urllib.error.URLError):
+        return UNKNOWN
+    if not isinstance(body, dict):
+        return UNKNOWN
+    return PROTECTED if body.get("type") else OPEN
+
+
+def settings_require_login(path: Path = SETTINGS_FILE) -> bool:
+    """Whether the settings on disk turn ``adminAuth`` on.
+
+    Args:
+        path: Node-RED's settings.js.
+
+    Returns:
+        True when the file configures it.
+    """
+    try:
+        return "adminAuth" in path.read_text()
+    except OSError:
+        return False
+
+
+async def ensure_admin_auth(
+    port: int,
+    *,
+    first_check_after: float = FIRST_CHECK_AFTER,
+    retry_every: float = RETRY_EVERY,
+    attempts: int = ATTEMPTS,
+    probe_fn: Callable[[int], str] = probe,
+    settings_path: Path = SETTINGS_FILE,
+    restart: Callable[[], containers.Result] = containers.restart_nodered,
+) -> str:
+    """Restart Node-RED once if it runs open while its settings say otherwise.
+
+    Args:
+        port: The HTTPS port Caddy publishes.
+        first_check_after: Seconds before the first look.
+        retry_every: Seconds between looks while there is no answer.
+        attempts: Looks before giving up on an editor that never answers.
+        probe_fn: The probe. A parameter for the tests.
+        settings_path: Node-RED's settings.js.
+        restart: Restarts the container. A parameter for the tests.
+
+    Returns:
+        What it found or did: ``protected``, ``restarted``, ``open`` (the file
+        itself asks for no login), ``restart_failed`` or ``unknown``.
+    """
+    loop = asyncio.get_running_loop()
+    await asyncio.sleep(first_check_after)
+    for attempt in range(attempts):
+        if attempt:
+            await asyncio.sleep(retry_every)
+        state = await loop.run_in_executor(None, probe_fn, port)
+        if state == UNKNOWN:
+            continue
+        if state == PROTECTED:
+            return PROTECTED
+        if not settings_require_login(settings_path):
+            _LOGGER.error(
+                "Node-RED's editor accepts anyone, and %s does not configure "
+                "adminAuth either. Apply the pending system migrations.",
+                settings_path,
+            )
+            return OPEN
+        _LOGGER.warning(
+            "Node-RED is running without the login its settings ask for; "
+            "restarting it so it reads them."
+        )
+        result = await loop.run_in_executor(None, restart)
+        if not result.ok:
+            _LOGGER.error(
+                "Could not restart Node-RED: %s",
+                (result.stderr or result.stdout).strip() or "unknown error",
+            )
+            return "restart_failed"
+        return "restarted"
+    return UNKNOWN

boneio/migrations/plans/1.6.34.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/home/boneio/docker/nodered/node-red/settings.js","expected_sha256":"bff00753c72fb17609a6f7b3a58ef78b7b394da12d19fd65b875f2889695e2b4","group":"boneio","mode":420,"owner":"boneio","src":"docker/nodered/node-red/settings.js","template_vars":{}}]

boneio/migrations/plans/1.6.34.sig

@@ -0,0 +1,2 @@
+/�Kb'щ��*���g��fJ<�҃wߏ
+�G��)���J�ؼ���v*���4�>Z�z�
��

boneio/migrations/plans/manifest.json

@@ -1 +1 @@
-{"plans":{"1.3.0":"645ac6bdda8dc0a73c219aa3684a29df4bdd4032aad97a833b259de489b2ce32","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"19508f66d84f1e16bd24932aaa17d45417912ffd1c20d326b2f003b931ac2f8c","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"8cfaeae24ceefe171d40241549c1f62527ce41821e5fd2904c0df1973596c0c7","1.6.16":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.17":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.18":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.19":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.20":"28027c836eef19b21b95500760961e181f6078d22cccf8cca62b77bbbb11a0c5","1.6.21":"b0d0777e81edc8532d42bcd3b6d518fecd6078153dfe9f5f859469d2c13b369d","1.6.22":"6600f96197356bdc676e9cd7d2d40b18c9d8838323f8cae0892f056175396313","1.6.23":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.24":"701460ed5e3ed236c8c7273ba0a98a0235786b4a04bd6c7aa6088fb835549aa6","1.6.25":"efa09d1677148bdfe4639273479c9a1fa527d4cf5d2ca9af6dd876883652ba22","1.6.26":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.27":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.28":"6e219d09a06a5de8162a521c9b3c3b54067e6bb4d1d15b3b47a8ec522fd76b5c","1.6.29":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.30":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.31":"fe5e93397dfe4e459cb7c19bfb09153707ebe4b6c92a60a279bf61b0fbc482fb","1.6.32":"c5dbc5a513107d179d55c2f7360e66299167107acd92bc1f5c3a6b19bc7b6e31","1.6.33":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"65a083182affb9a2beef674bb17dee390bec0007441f1ee71b92e05117c65937","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"5c03d447037a48211f0223bb9ecc8cdc1fa84b93bec8e61b1a3073188ac7ea4e","1.6.9":"978c88cc23a2ce07fe419d40a4f9aaf1a1388d01c6b43235e6f08fc09a03a96f"},"release":"1.6.0.dev29"}
+{"plans":{"1.3.0":"645ac6bdda8dc0a73c219aa3684a29df4bdd4032aad97a833b259de489b2ce32","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"19508f66d84f1e16bd24932aaa17d45417912ffd1c20d326b2f003b931ac2f8c","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"8cfaeae24ceefe171d40241549c1f62527ce41821e5fd2904c0df1973596c0c7","1.6.16":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.17":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.18":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.19":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.20":"28027c836eef19b21b95500760961e181f6078d22cccf8cca62b77bbbb11a0c5","1.6.21":"b0d0777e81edc8532d42bcd3b6d518fecd6078153dfe9f5f859469d2c13b369d","1.6.22":"6600f96197356bdc676e9cd7d2d40b18c9d8838323f8cae0892f056175396313","1.6.23":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.24":"701460ed5e3ed236c8c7273ba0a98a0235786b4a04bd6c7aa6088fb835549aa6","1.6.25":"efa09d1677148bdfe4639273479c9a1fa527d4cf5d2ca9af6dd876883652ba22","1.6.26":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.27":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.28":"6e219d09a06a5de8162a521c9b3c3b54067e6bb4d1d15b3b47a8ec522fd76b5c","1.6.29":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.30":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.31":"fe5e93397dfe4e459cb7c19bfb09153707ebe4b6c92a60a279bf61b0fbc482fb","1.6.32":"c5dbc5a513107d179d55c2f7360e66299167107acd92bc1f5c3a6b19bc7b6e31","1.6.33":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.34":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"65a083182affb9a2beef674bb17dee390bec0007441f1ee71b92e05117c65937","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"5c03d447037a48211f0223bb9ecc8cdc1fa84b93bec8e61b1a3073188ac7ea4e","1.6.9":"978c88cc23a2ce07fe419d40a4f9aaf1a1388d01c6b43235e6f08fc09a03a96f"},"release":"1.6.0.dev30"}

boneio/migrations/versions/v1_6_34_nodered_admin_auth_again.py

@@ -0,0 +1,51 @@
+"""BoneIO 1.6.34 — install the Node-RED settings that require a login, again.
+
+1.6.0 installed ``settings.js`` with ``adminAuth`` delegated to boneIO, and
+recorded itself as applied. On the SD card images that record did not mean the
+file was still there: the images are built on a rootfs that had already been
+through setup once, so 1.6.0 counted as done, and the image script's own step
+then wrote its four-line ``settings.js`` over the real one — no ``adminAuth``.
+Every controller flashed from such an image (seen on dev29, blk239bb2, audit
+finding A-02) ran Node-RED's editor open to anyone who could reach the device,
+which is F-01 back: a flow with an ``exec`` node is code execution.
+
+The same file again, under a new version so it is applied once more on every
+device. Where the file is already the right one, the helper finds the hash
+matching and writes nothing.
+
+The running container keeps the settings it started with. boneIO restarts it
+on its own after starting, when the editor answers without a login while this
+file asks for one (see :mod:`boneio.core.nodered_guard`), so an update is
+enough and no reboot is needed.
+
+To retry on a device, delete ``/var/lib/boneio/migrations.d/1.6.34.applied``
+and restart boneIO.
+"""
+
+from __future__ import annotations
+
+from boneio.migrations.actions import InstallFile, MigrationAction
+
+VERSION = "1.6.34"
+DESCRIPTION = "Install the Node-RED settings that require a login, again (F-01, A-02)"
+REQUIRES_ROOT = True
+
+_BONEIO_HOME = "/home/boneio"
+_BONEIO_USER = "boneio"
+
+
+def plan() -> list[MigrationAction]:
+    """Return the ordered list of migration actions for version 1.6.34.
+
+    Returns:
+        List of :class:`MigrationAction` to apply in order.
+    """
+    return [
+        InstallFile(
+            src="docker/nodered/node-red/settings.js",
+            dst=f"{_BONEIO_HOME}/docker/nodered/node-red/settings.js",
+            mode=0o644,
+            owner=_BONEIO_USER,
+            group=_BONEIO_USER,
+        ),
+    ]

boneio/runner.py

@@ -616,6 +616,16 @@ async def async_run(
 
     stable_task = asyncio.create_task(_forgive_earlier_crashes())
 
+    # An update restarts boneIO, not the controller, so a Node-RED settings
+    # file installed by it is not what the running editor read. Not in the
+    # main gather either: it finishes after a look or two.
+    from boneio.const import DEFAULT_PROXY_PORT
+    from boneio.core.nodered_guard import ensure_admin_auth
+
+    nodered_task = asyncio.create_task(
+        ensure_admin_auth(_config_helper.proxy_port or DEFAULT_PROXY_PORT)
+    )
+
     try:
         # Convert tasks set to list for main gather
         task_list = list(tasks)
@@ -668,6 +678,7 @@ async def async_run(
     finally:
         _LOGGER.info("Cleaning up resources...")
         stable_task.cancel()
+        nodered_task.cancel()
 
         # Cancel pending deferred state saves and write final state synchronously.
         # This MUST happen before event_bus.stop() which may trigger sigterm

boneio/version.py

@@ -1,2 +1,2 @@
 # flake8: noqa
-__version__ = "1.6.0.dev29"
+__version__ = "1.6.0.dev30"

boneio/webui/app.py

@@ -14,7 +14,7 @@ from typing import TYPE_CHECKING
 from fastapi import Depends, FastAPI, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.middleware.gzip import GZipMiddleware
-from fastapi.responses import FileResponse, JSONResponse
+from fastapi.responses import FileResponse, JSONResponse, Response
 from fastapi.staticfiles import StaticFiles
 from starlette.types import Receive, Scope, Send
 from starlette.websockets import WebSocketState
@@ -1096,6 +1096,10 @@ if FRONTEND_DIR.exists() and (FRONTEND_DIR / "index.html").exists():
             headers={"Cache-Control": "no-store, no-cache, must-revalidate"},
         )
 
+    #: FastAPI's own schema and docs routes. In dev mode they are registered
+    #: ahead of this catch-all and answer first; otherwise nothing should.
+    _API_DOC_PATHS = frozenset({"docs", "docs/oauth2-redirect", "redoc", "openapi.json"})
+
     @app.get("/{filename:path}")
     async def serve_react_app(filename: str):
         """Serve static files from frontend-dist, fallback to index.html for SPA routing.
@@ -1104,6 +1108,11 @@ if FRONTEND_DIR.exists() and (FRONTEND_DIR / "index.html").exists():
         them. index.html (SPA fallback) is never cached to prevent stale
         versions being served through Cloudflare Tunnel or other caching proxies.
         """
+        if filename in _API_DOC_PATHS:
+            # The schema is off outside dev mode, and these names answering
+            # with the panel's index.html read to a scanner as an exposed API
+            # schema. Saying "not here" is the truth.
+            return Response(status_code=404)
         file_path = (FRONTEND_DIR / filename).resolve()
         if filename and file_path.is_relative_to(FRONTEND_DIR.resolve()) and file_path.exists() and file_path.is_file():
             return FileResponse(str(file_path))

boneio/webui/frontend-dist/assets/{AccountsView-hSkFhGZn.js → AccountsView-C5bNw-zJ.js}

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{H as t,Qt as n,V as r,fn as i,ln as a,ot as o,un as s,vn as c,yn as l}from"./fa-ChDOCx3T.js";import{a as u,i as d,n as f,o as p,r as m,t as h}from"./dialog-DMaCttcv.js";import{n as g}from"./axios-DyqbZVcF.js";import{B as _,F as v,I as y,N as b,P as x,R as S,T as C,h as w,m as T,y as E}from"./index-DULLFI0R.js";import{t as D}from"./LoadingState-BnMjvLnH.js";var O=e(l(),1),k=c(),A=3;function j({id:e,label:n,value:i,onChange:a,autoComplete:o,error:s,autoFocus:c}){let{t:l}=S(),[u,d]=(0,O.useState)(!1);return(0,k.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,k.jsx)(`label`,{htmlFor:e,className:`text-sm font-medium`,children:n}),(0,k.jsxs)(`div`,{className:`input w-full pr-1 ${s?`input-error`:``}`,children:[(0,k.jsx)(`input`,{id:e,type:u?`text`:`password`,autoComplete:o,autoFocus:c,required:!0,className:`grow font-mono`,"aria-invalid":s?!0:void 0,"aria-describedby":s?`${e}-error`:void 0,value:i,onChange:e=>a(e.target.value)}),(0,k.jsx)(`button`,{type:`button`,onClick:()=>d(e=>!e),className:`btn btn-ghost btn-square btn-sm`,"aria-label":l(u?`login.hide_password`:`login.show_password`),"aria-pressed":u,title:l(u?`login.hide_password`:`login.show_password`),children:u?(0,k.jsx)(t,{className:`h-4 w-4 opacity-70`}):(0,k.jsx)(r,{className:`h-4 w-4 opacity-70`})})]}),s&&(0,k.jsx)(`p`,{id:`${e}-error`,role:`alert`,className:`text-error text-xs`,children:s})]})}function M({username:e,isSelf:t,onClose:n,onChanged:r}){let{t:i}=S(),[a,s]=(0,O.useState)(``),[c,l]=(0,O.useState)(``),[_,y]=(0,O.useState)(``),[b,C]=(0,O.useState)(null),[w,T]=(0,O.useState)(null),[E,D]=(0,O.useState)(!1),M=v(c,_,e??``),N=c&&M&&M!==`mismatch`?i(x[M],{min:8}):null,P=_&&M===`mismatch`?i(`accounts.password_mismatch`):null,F=async n=>{if(n.preventDefault(),!(!e||M||t&&!a)){C(null),T(null),D(!0);try{let{data:n}=t?await g.put(`/api/account/password`,{current_password:a,new_password:c},{timeout:6e4}):await g.put(`/api/accounts/${encodeURIComponent(e)}/password`,{password:c},{timeout:6e4});typeof n?.token==`string`&&localStorage.setItem(`token`,n.token),r(e)}catch(e){let t=e.response;if(t?.status===403&&t.data?.code===`current_password_wrong`){let e=t.data.attempts_left;C(typeof e==`number`&&e<=A?`${i(`accounts.current_password_wrong`)} ${i(`reauth.attempts_left`,{count:e})}`:i(`accounts.current_password_wrong`))}else t?.status===429?T(i(`reauth.throttled`)):t?.status!==401&&T(t?.data?.detail||i(`accounts.password_failed`))}finally{D(!1)}}},I=t?i(`accounts.change_own_password_title`):i(`accounts.change_password_title`,{username:e??``});return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!E&&n(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:F,className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(o,{})}),(0,k.jsx)(p,{children:I})]}),(0,k.jsx)(m,{children:i(t?`accounts.change_own_password_intro`:`accounts.change_password_intro`)})]}),t&&(0,k.jsx)(j,{id:`account-current-password`,label:i(`accounts.current_password`),value:a,onChange:e=>{s(e),C(null)},autoComplete:`current-password`,error:b,autoFocus:!0}),(0,k.jsx)(j,{id:`account-new-password`,label:i(`accounts.new_password`),value:c,onChange:l,autoComplete:`new-password`,error:N,autoFocus:!t}),(0,k.jsx)(j,{id:`account-repeat-password`,label:i(`accounts.repeat_password`),value:_,onChange:y,autoComplete:`new-password`,error:P}),(0,k.jsx)(`p`,{className:`text-xs opacity-70`,children:i(`accounts.ssh_password_separate`)}),w&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:w}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:n,disabled:E,children:i(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:E||!!M||t&&!a,children:[E&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),i(`accounts.change_password_button`)]})]})]})})})}function N({username:e,onClose:t,onConfirm:n}){let{t:r}=S(),[i,o]=(0,O.useState)(!1);return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!i&&t(),children:(0,k.jsxs)(f,{className:`sm:max-w-sm`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0 text-error`,children:(0,k.jsx)(a,{})}),(0,k.jsx)(p,{children:r(`accounts.confirm_delete`,{username:e??``})})]}),(0,k.jsx)(m,{children:r(`accounts.confirm_delete_intro`)})]}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:t,disabled:i,children:r(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`button`,className:`btn btn-error max-sm:btn-lg`,onClick:async()=>{if(e){o(!0);try{await n(e)}finally{o(!1)}}},disabled:i,children:[i&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),r(`accounts.delete`)]})]})]})})}function P(e,t){return e===`locked`||e===`empty`?e:e===`set`||e===`shipped`?t?`form`:`outdated`:`unknown`}var F=`boneio`,I=3;function L({open:e,shipped:t,onClose:r,onChanged:i,onStale:a}){let{t:o}=S(),[s,c]=(0,O.useState)(``),[l,_]=(0,O.useState)(``),[y,b]=(0,O.useState)(``),[C,w]=(0,O.useState)(null),[T,E]=(0,O.useState)(null),[D,A]=(0,O.useState)(!1),M=v(l,y,F),N=l&&M&&M!==`mismatch`?o(x[M],{min:8}):null,P=y&&M===`mismatch`?o(`accounts.password_mismatch`):null;return(0,k.jsx)(h,{open:e,onOpenChange:e=>!e&&!D&&r(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:async e=>{if(e.preventDefault(),!M&&s){w(null),E(null),A(!0);try{await g.put(`/api/accounts/ssh-password`,{current_password:s,new_password:l},{timeout:6e4}),i()}catch(e){let t=e.response,n=t?.data?.code;if(t?.status===403&&n===`current_password_wrong`){let e=t.data?.attempts_left;w(typeof e==`number`&&e<=I?`${o(`accounts.ssh_current_wrong`)} ${o(`accounts.ssh_attempts_left`,{count:e})}`:o(`accounts.ssh_current_wrong`))}else if(t?.status===429){let e=t.data?.retry_after;E(o(`accounts.ssh_throttled`,{minutes:Math.max(1,Math.ceil((typeof e==`number`?e:900)/60))}))}else n===`helper_outdated`||n===`ssh_password_not_set`?a():t?.status!==401&&E(t?.data?.detail||o(`accounts.ssh_failed`))}finally{A(!1)}}},className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(n,{})}),(0,k.jsx)(p,{children:o(`accounts.ssh_dialog_title`)})]}),(0,k.jsx)(m,{children:o(t?`accounts.ssh_dialog_intro_shipped`:`accounts.ssh_dialog_intro`)})]}),(0,k.jsx)(j,{id:`ssh-current-password`,label:o(`accounts.ssh_current`),value:s,onChange:e=>{c(e),w(null)},autoComplete:`current-password`,error:C,autoFocus:!0}),(0,k.jsx)(j,{id:`ssh-new-password`,label:o(`accounts.ssh_new`),value:l,onChange:_,autoComplete:`new-password`,error:N}),(0,k.jsx)(j,{id:`ssh-repeat-password`,label:o(`accounts.ssh_repeat`),value:y,onChange:b,autoComplete:`new-password`,error:P}),T&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:T}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:r,disabled:D,children:o(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:D||!!M||!s,children:[D&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),o(`accounts.ssh_button`)]})]})]})})})}function R(){let{t:e}=S(),[t,r]=(0,O.useState)(null),[i,a]=(0,O.useState)(!1),[o,s]=(0,O.useState)(!0),[c,l]=(0,O.useState)(null),[u,d]=(0,O.useState)(0),[f,p]=(0,O.useState)(!1),m=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts/ssh-password`,{timeout:3e4});r(e?.state??null),a(!!e?.supported)}catch{r(null)}finally{s(!1)}},[]);(0,O.useEffect)(()=>{m()},[m]);let h=P(t,i),_=()=>o?(0,k.jsx)(D,{className:`py-2`}):h===`form`?t===`shipped`?(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.ssh_shipped`)}):null:(0,k.jsx)(b,{variant:h===`empty`?`warning`:`info`,message:e(`accounts.ssh_${h}`)});return(0,k.jsxs)(k.Fragment,{children:[(0,k.jsx)(E,{icon:(0,k.jsx)(n,{}),title:e(`accounts.ssh_title`),description:e(`accounts.ssh_intro`),action:h===`form`&&!o?(0,k.jsx)(`button`,{type:`button`,className:`btn btn-primary btn-sm`,onClick:()=>{l(null),d(e=>e+1),p(!0)},children:e(`accounts.ssh_button`)}):void 0,children:(c||_())&&(0,k.jsxs)(`div`,{className:`flex flex-col gap-3`,children:[c&&(0,k.jsx)(b,{variant:`success`,message:c}),_()]})}),(0,k.jsx)(L,{open:f,shipped:t===`shipped`,onClose:()=>p(!1),onChanged:()=>{p(!1),l(e(`accounts.ssh_changed`)),m()},onStale:()=>{p(!1),m()}},u)]})}function z(e,t){return e?.response?.data?.detail||t}function B(){let{t:e}=S(),{username:t,isAdmin:n}=_(),[r,a]=(0,O.useState)([]),[o,c]=(0,O.useState)(!0),[l,u]=(0,O.useState)(null),[d,f]=(0,O.useState)(null),[p,m]=(0,O.useState)(``),[h,v]=(0,O.useState)(``),[A,j]=(0,O.useState)(`viewer`),[P,F]=(0,O.useState)(!1),[I,L]=(0,O.useState)(null),[B,V]=(0,O.useState)(null),H=h?y(h,p):null,U=H?e(x[H],{min:8}):null,W=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts`);a(e.accounts??[]),u(null)}catch(t){u(z(t,e(`accounts.load_failed`)))}finally{c(!1)}},[e]);(0,O.useEffect)(()=>{n&&W()},[n,W]);let G=async t=>{t.preventDefault(),u(null),f(null),F(!0);try{await g.post(`/api/accounts`,{username:p,password:h,role:A}),m(``),v(``),j(`viewer`),f(e(`accounts.created`)),await W()}catch(t){u(z(t,e(`accounts.create_failed`)))}finally{F(!1)}},K=async t=>{u(null),f(null);try{await g.delete(`/api/accounts/${encodeURIComponent(t)}`),f(e(`accounts.deleted`,{username:t})),await W()}catch(t){u(z(t,e(`accounts.delete_failed`)))}finally{V(null)}},q=async(t,n)=>{u(null),f(null);try{await g.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await W()}catch(t){u(z(t,e(`accounts.role_failed`))),await W()}},J=t=>{L(null),u(null),f(e(`accounts.password_reset`,{username:t}))},Y=e=>e.toLowerCase()===(t??``).toLowerCase();return n?(0,k.jsxs)(C,{width:`wide`,children:[l&&(0,k.jsx)(b,{variant:`error`,message:l}),d&&(0,k.jsx)(b,{variant:`success`,message:d}),(0,k.jsx)(E,{icon:(0,k.jsx)(i,{}),title:e(`accounts.title`),children:o?(0,k.jsx)(D,{className:`py-6`}):(0,k.jsx)(`ul`,{className:`stg-inset divide-y divide-base-content/10`,children:r.map(t=>{let n=Y(t.username);return(0,k.jsxs)(`li`,{className:`flex flex-wrap items-center gap-x-3 gap-y-2 px-3 py-2.5`,children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-2 min-w-0 flex-1`,children:[(0,k.jsx)(`span`,{className:`font-medium font-mono truncate`,children:t.username}),n&&(0,k.jsx)(`span`,{className:`badge badge-ghost badge-xs shrink-0`,children:e(`accounts.you`)})]}),(0,k.jsxs)(`select`,{className:`select select-xs select-bordered w-auto`,"aria-label":e(`accounts.role`),value:t.role,disabled:n,onChange:e=>q(t,e.target.value),children:[(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]}),(0,k.jsxs)(`div`,{className:`flex justify-end gap-1 w-full sm:w-auto`,children:[(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>{f(null),L(t.username)},children:e(`accounts.reset_password`)}),(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error`,disabled:n,onClick:()=>V(t.username),children:e(`accounts.delete`)})]})]},t.username)})})}),(0,k.jsx)(`form`,{onSubmit:G,children:(0,k.jsx)(E,{icon:(0,k.jsx)(s,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,k.jsx)(T,{children:(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:P||!p||!h||!!U,children:[P&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,k.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,k.jsx)(w,{label:e(`accounts.username`),children:(0,k.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:p,onChange:e=>m(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.password`),error:U||void 0,children:(0,k.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${U?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":U?!0:void 0,"aria-describedby":U?`accounts-password-error`:void 0,value:h,onChange:e=>v(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,k.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})}),(0,k.jsx)(R,{}),(0,k.jsx)(M,{username:I,isSelf:I!==null&&Y(I),onClose:()=>L(null),onChanged:J},I??``),(0,k.jsx)(N,{username:B,onClose:()=>V(null),onConfirm:K})]}):(0,k.jsx)(C,{width:`wide`,children:(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{B as default};
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{H as t,Qt as n,V as r,fn as i,ln as a,ot as o,un as s,vn as c,yn as l}from"./fa-ChDOCx3T.js";import{a as u,i as d,n as f,o as p,r as m,t as h}from"./dialog-DMaCttcv.js";import{n as g}from"./axios-DyqbZVcF.js";import{B as _,F as v,I as y,N as b,P as x,R as S,T as C,h as w,m as T,y as E}from"./index-CoFvRO76.js";import{t as D}from"./LoadingState-hl_hkPPN.js";var O=e(l(),1),k=c(),A=3;function j({id:e,label:n,value:i,onChange:a,autoComplete:o,error:s,autoFocus:c}){let{t:l}=S(),[u,d]=(0,O.useState)(!1);return(0,k.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,k.jsx)(`label`,{htmlFor:e,className:`text-sm font-medium`,children:n}),(0,k.jsxs)(`div`,{className:`input w-full pr-1 ${s?`input-error`:``}`,children:[(0,k.jsx)(`input`,{id:e,type:u?`text`:`password`,autoComplete:o,autoFocus:c,required:!0,className:`grow font-mono`,"aria-invalid":s?!0:void 0,"aria-describedby":s?`${e}-error`:void 0,value:i,onChange:e=>a(e.target.value)}),(0,k.jsx)(`button`,{type:`button`,onClick:()=>d(e=>!e),className:`btn btn-ghost btn-square btn-sm`,"aria-label":l(u?`login.hide_password`:`login.show_password`),"aria-pressed":u,title:l(u?`login.hide_password`:`login.show_password`),children:u?(0,k.jsx)(t,{className:`h-4 w-4 opacity-70`}):(0,k.jsx)(r,{className:`h-4 w-4 opacity-70`})})]}),s&&(0,k.jsx)(`p`,{id:`${e}-error`,role:`alert`,className:`text-error text-xs`,children:s})]})}function M({username:e,isSelf:t,onClose:n,onChanged:r}){let{t:i}=S(),[a,s]=(0,O.useState)(``),[c,l]=(0,O.useState)(``),[_,y]=(0,O.useState)(``),[b,C]=(0,O.useState)(null),[w,T]=(0,O.useState)(null),[E,D]=(0,O.useState)(!1),M=v(c,_,e??``),N=c&&M&&M!==`mismatch`?i(x[M],{min:8}):null,P=_&&M===`mismatch`?i(`accounts.password_mismatch`):null,F=async n=>{if(n.preventDefault(),!(!e||M||t&&!a)){C(null),T(null),D(!0);try{let{data:n}=t?await g.put(`/api/account/password`,{current_password:a,new_password:c},{timeout:6e4}):await g.put(`/api/accounts/${encodeURIComponent(e)}/password`,{password:c},{timeout:6e4});typeof n?.token==`string`&&localStorage.setItem(`token`,n.token),r(e)}catch(e){let t=e.response;if(t?.status===403&&t.data?.code===`current_password_wrong`){let e=t.data.attempts_left;C(typeof e==`number`&&e<=A?`${i(`accounts.current_password_wrong`)} ${i(`reauth.attempts_left`,{count:e})}`:i(`accounts.current_password_wrong`))}else t?.status===429?T(i(`reauth.throttled`)):t?.status!==401&&T(t?.data?.detail||i(`accounts.password_failed`))}finally{D(!1)}}},I=t?i(`accounts.change_own_password_title`):i(`accounts.change_password_title`,{username:e??``});return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!E&&n(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:F,className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(o,{})}),(0,k.jsx)(p,{children:I})]}),(0,k.jsx)(m,{children:i(t?`accounts.change_own_password_intro`:`accounts.change_password_intro`)})]}),t&&(0,k.jsx)(j,{id:`account-current-password`,label:i(`accounts.current_password`),value:a,onChange:e=>{s(e),C(null)},autoComplete:`current-password`,error:b,autoFocus:!0}),(0,k.jsx)(j,{id:`account-new-password`,label:i(`accounts.new_password`),value:c,onChange:l,autoComplete:`new-password`,error:N,autoFocus:!t}),(0,k.jsx)(j,{id:`account-repeat-password`,label:i(`accounts.repeat_password`),value:_,onChange:y,autoComplete:`new-password`,error:P}),(0,k.jsx)(`p`,{className:`text-xs opacity-70`,children:i(`accounts.ssh_password_separate`)}),w&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:w}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:n,disabled:E,children:i(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:E||!!M||t&&!a,children:[E&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),i(`accounts.change_password_button`)]})]})]})})})}function N({username:e,onClose:t,onConfirm:n}){let{t:r}=S(),[i,o]=(0,O.useState)(!1);return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!i&&t(),children:(0,k.jsxs)(f,{className:`sm:max-w-sm`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0 text-error`,children:(0,k.jsx)(a,{})}),(0,k.jsx)(p,{children:r(`accounts.confirm_delete`,{username:e??``})})]}),(0,k.jsx)(m,{children:r(`accounts.confirm_delete_intro`)})]}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:t,disabled:i,children:r(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`button`,className:`btn btn-error max-sm:btn-lg`,onClick:async()=>{if(e){o(!0);try{await n(e)}finally{o(!1)}}},disabled:i,children:[i&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),r(`accounts.delete`)]})]})]})})}function P(e,t){return e===`locked`||e===`empty`?e:e===`set`||e===`shipped`?t?`form`:`outdated`:`unknown`}var F=`boneio`,I=3;function L({open:e,shipped:t,onClose:r,onChanged:i,onStale:a}){let{t:o}=S(),[s,c]=(0,O.useState)(``),[l,_]=(0,O.useState)(``),[y,b]=(0,O.useState)(``),[C,w]=(0,O.useState)(null),[T,E]=(0,O.useState)(null),[D,A]=(0,O.useState)(!1),M=v(l,y,F),N=l&&M&&M!==`mismatch`?o(x[M],{min:8}):null,P=y&&M===`mismatch`?o(`accounts.password_mismatch`):null;return(0,k.jsx)(h,{open:e,onOpenChange:e=>!e&&!D&&r(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:async e=>{if(e.preventDefault(),!M&&s){w(null),E(null),A(!0);try{await g.put(`/api/accounts/ssh-password`,{current_password:s,new_password:l},{timeout:6e4}),i()}catch(e){let t=e.response,n=t?.data?.code;if(t?.status===403&&n===`current_password_wrong`){let e=t.data?.attempts_left;w(typeof e==`number`&&e<=I?`${o(`accounts.ssh_current_wrong`)} ${o(`accounts.ssh_attempts_left`,{count:e})}`:o(`accounts.ssh_current_wrong`))}else if(t?.status===429){let e=t.data?.retry_after;E(o(`accounts.ssh_throttled`,{minutes:Math.max(1,Math.ceil((typeof e==`number`?e:900)/60))}))}else n===`helper_outdated`||n===`ssh_password_not_set`?a():t?.status!==401&&E(t?.data?.detail||o(`accounts.ssh_failed`))}finally{A(!1)}}},className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(n,{})}),(0,k.jsx)(p,{children:o(`accounts.ssh_dialog_title`)})]}),(0,k.jsx)(m,{children:o(t?`accounts.ssh_dialog_intro_shipped`:`accounts.ssh_dialog_intro`)})]}),(0,k.jsx)(j,{id:`ssh-current-password`,label:o(`accounts.ssh_current`),value:s,onChange:e=>{c(e),w(null)},autoComplete:`current-password`,error:C,autoFocus:!0}),(0,k.jsx)(j,{id:`ssh-new-password`,label:o(`accounts.ssh_new`),value:l,onChange:_,autoComplete:`new-password`,error:N}),(0,k.jsx)(j,{id:`ssh-repeat-password`,label:o(`accounts.ssh_repeat`),value:y,onChange:b,autoComplete:`new-password`,error:P}),T&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:T}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:r,disabled:D,children:o(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:D||!!M||!s,children:[D&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),o(`accounts.ssh_button`)]})]})]})})})}function R(){let{t:e}=S(),[t,r]=(0,O.useState)(null),[i,a]=(0,O.useState)(!1),[o,s]=(0,O.useState)(!0),[c,l]=(0,O.useState)(null),[u,d]=(0,O.useState)(0),[f,p]=(0,O.useState)(!1),m=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts/ssh-password`,{timeout:3e4});r(e?.state??null),a(!!e?.supported)}catch{r(null)}finally{s(!1)}},[]);(0,O.useEffect)(()=>{m()},[m]);let h=P(t,i),_=()=>o?(0,k.jsx)(D,{className:`py-2`}):h===`form`?t===`shipped`?(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.ssh_shipped`)}):null:(0,k.jsx)(b,{variant:h===`empty`?`warning`:`info`,message:e(`accounts.ssh_${h}`)});return(0,k.jsxs)(k.Fragment,{children:[(0,k.jsx)(E,{icon:(0,k.jsx)(n,{}),title:e(`accounts.ssh_title`),description:e(`accounts.ssh_intro`),action:h===`form`&&!o?(0,k.jsx)(`button`,{type:`button`,className:`btn btn-primary btn-sm`,onClick:()=>{l(null),d(e=>e+1),p(!0)},children:e(`accounts.ssh_button`)}):void 0,children:(c||_())&&(0,k.jsxs)(`div`,{className:`flex flex-col gap-3`,children:[c&&(0,k.jsx)(b,{variant:`success`,message:c}),_()]})}),(0,k.jsx)(L,{open:f,shipped:t===`shipped`,onClose:()=>p(!1),onChanged:()=>{p(!1),l(e(`accounts.ssh_changed`)),m()},onStale:()=>{p(!1),m()}},u)]})}function z(e,t){return e?.response?.data?.detail||t}function B(){let{t:e}=S(),{username:t,isAdmin:n}=_(),[r,a]=(0,O.useState)([]),[o,c]=(0,O.useState)(!0),[l,u]=(0,O.useState)(null),[d,f]=(0,O.useState)(null),[p,m]=(0,O.useState)(``),[h,v]=(0,O.useState)(``),[A,j]=(0,O.useState)(`viewer`),[P,F]=(0,O.useState)(!1),[I,L]=(0,O.useState)(null),[B,V]=(0,O.useState)(null),H=h?y(h,p):null,U=H?e(x[H],{min:8}):null,W=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts`);a(e.accounts??[]),u(null)}catch(t){u(z(t,e(`accounts.load_failed`)))}finally{c(!1)}},[e]);(0,O.useEffect)(()=>{n&&W()},[n,W]);let G=async t=>{t.preventDefault(),u(null),f(null),F(!0);try{await g.post(`/api/accounts`,{username:p,password:h,role:A}),m(``),v(``),j(`viewer`),f(e(`accounts.created`)),await W()}catch(t){u(z(t,e(`accounts.create_failed`)))}finally{F(!1)}},K=async t=>{u(null),f(null);try{await g.delete(`/api/accounts/${encodeURIComponent(t)}`),f(e(`accounts.deleted`,{username:t})),await W()}catch(t){u(z(t,e(`accounts.delete_failed`)))}finally{V(null)}},q=async(t,n)=>{u(null),f(null);try{await g.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await W()}catch(t){u(z(t,e(`accounts.role_failed`))),await W()}},J=t=>{L(null),u(null),f(e(`accounts.password_reset`,{username:t}))},Y=e=>e.toLowerCase()===(t??``).toLowerCase();return n?(0,k.jsxs)(C,{width:`wide`,children:[l&&(0,k.jsx)(b,{variant:`error`,message:l}),d&&(0,k.jsx)(b,{variant:`success`,message:d}),(0,k.jsx)(E,{icon:(0,k.jsx)(i,{}),title:e(`accounts.title`),children:o?(0,k.jsx)(D,{className:`py-6`}):(0,k.jsx)(`ul`,{className:`stg-inset divide-y divide-base-content/10`,children:r.map(t=>{let n=Y(t.username);return(0,k.jsxs)(`li`,{className:`flex flex-wrap items-center gap-x-3 gap-y-2 px-3 py-2.5`,children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-2 min-w-0 flex-1`,children:[(0,k.jsx)(`span`,{className:`font-medium font-mono truncate`,children:t.username}),n&&(0,k.jsx)(`span`,{className:`badge badge-ghost badge-xs shrink-0`,children:e(`accounts.you`)})]}),(0,k.jsxs)(`select`,{className:`select select-xs select-bordered w-auto`,"aria-label":e(`accounts.role`),value:t.role,disabled:n,onChange:e=>q(t,e.target.value),children:[(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]}),(0,k.jsxs)(`div`,{className:`flex justify-end gap-1 w-full sm:w-auto`,children:[(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>{f(null),L(t.username)},children:e(`accounts.reset_password`)}),(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error`,disabled:n,onClick:()=>V(t.username),children:e(`accounts.delete`)})]})]},t.username)})})}),(0,k.jsx)(`form`,{onSubmit:G,children:(0,k.jsx)(E,{icon:(0,k.jsx)(s,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,k.jsx)(T,{children:(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:P||!p||!h||!!U,children:[P&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,k.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,k.jsx)(w,{label:e(`accounts.username`),children:(0,k.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:p,onChange:e=>m(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.password`),error:U||void 0,children:(0,k.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${U?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":U?!0:void 0,"aria-describedby":U?`accounts-password-error`:void 0,value:h,onChange:e=>v(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,k.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})}),(0,k.jsx)(R,{}),(0,k.jsx)(M,{username:I,isSelf:I!==null&&Y(I),onClose:()=>L(null),onChanged:J},I??``),(0,k.jsx)(N,{username:B,onClose:()=>V(null),onConfirm:K})]}):(0,k.jsx)(C,{width:`wide`,children:(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{B as default};

boneio/webui/frontend-dist/assets/{AppInitContext-XnlT3sSY.js → AppInitContext-D7KZMwlj.js}

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{vn as t,yn as n}from"./fa-ChDOCx3T.js";import{n as r}from"./axios-DyqbZVcF.js";import{i}from"./configCache-DZ0vWq_Z.js";var a=e(n(),1),o=`boneio-provisioned`;function s(e){let t=e?.match(/\/(proxy\/\d+)\/?$/);return t?`${o}-${t[1].replace(`/`,`-`)}`:o}function c(e,t){try{return e?.getItem(s(t))===`1`}catch{return!1}}function l(e,t,n){try{e?.setItem(s(t),n?`0`:`1`)}catch{}}var u=`boneio-update`,d=`boneio-stale-reload`;function f(e,t){let n=t?.match(/\/(proxy\/\d+)\/?$/);return n?`${e}-${n[1].replace(`/`,`-`)}`:e}function p(e){if(!e)return null;let t=e.trim();return t.startsWith(`v`)?t.slice(1):t}function m(e,t,n){try{let r=e?.getItem(f(u,t));if(!r)return null;let i=JSON.parse(r);return typeof i?.startedAt!=`number`||typeof i.fromVersion!=`string`||n-i.startedAt>36e5||i.startedAt>n+6e4?null:i}catch{return null}}function h(e,t,n){try{e?.setItem(f(u,t),JSON.stringify(n))}catch{}}function g(e,t){try{e?.removeItem(f(u,t))}catch{}}function _(e,t,n){if(t)return e.wentDown||e.downSince===void 0?e:{...e,downSince:void 0};let r=e.downSince??n,i=!!e.wentDown||n-r>=15e3;return r===e.downSince&&i===!!e.wentDown?e:{...e,downSince:r,wentDown:i}}function v(e,t){let n=p(t);if(!n)return!1;let r=p(e.toVersion);return r?n===r:n!==p(e.fromVersion)}function y(e){let{reachable:t,serverVersion:n,panelVersion:r,mark:i}=e;if(!t)return i?`updating`:`probably_updating`;let a=p(n),o=p(r);return a&&o&&a!==o?`stale_panel`:i&&i.wentDown&&a&&!v(i,a)&&a===p(i.fromVersion)?`update_failed`:`ok`}function b(e,t){try{return e?.getItem(d)===t}catch{return!0}}function x(e,t){try{e?.setItem(d,t)}catch{}}var S=t(),C=(0,a.createContext)({data:null,isLoading:!0,isApiAvailable:!0,needsOnboarding:!1,panelState:`ok`,dismissPanelState:()=>{},refetch:async()=>{}});function w(){return(0,a.useContext)(C)}function T(e,t){return e||!!t?.needs_onboarding}var E=2,D=1e3,O=3e4,k=5e3,A=`boneio-stale-bypass`,j=`1.6.0.dev29`;function M(e){try{return window.sessionStorage.getItem(e)}catch{return null}}function N({children:e}){let[t,n]=(0,a.useState)(null),[o,s]=(0,a.useState)(!0),[c,u]=(0,a.useState)(!0),[d,f]=(0,a.useState)(!1),[p,b]=(0,a.useState)(`ok`),x=(0,a.useCallback)((e,t)=>{let n=window.__BONEIO_BASE_PATH__,r=Date.now(),i=m(window.localStorage,n,r);if(i){let t=_(i,e,r);t!==i&&h(window.localStorage,n,t),i=t}i&&e&&v(i,t)&&(g(window.localStorage,n),i=null);let a=y({reachable:e,serverVersion:t,panelVersion:j,mark:i});a===`stale_panel`&&t&&M(A)===t&&(a=`ok`),b(a)},[]),w=(0,a.useCallback)(()=>{g(window.localStorage,window.__BONEIO_BASE_PATH__);let e=t?.version;if(p===`stale_panel`&&e)try{window.sessionStorage.setItem(A,e)}catch{}b(`ok`)},[t?.version,p]),N=(0,a.useCallback)(async()=>{for(let e=0;e<=E;e++)try{let{data:e}=await r.get(`/api/init`);n(t=>t&&JSON.stringify(t)===JSON.stringify(e)?t:e),f(t=>T(t,e)),l(window.localStorage,window.__BONEIO_BASE_PATH__,!!e?.needs_onboarding),x(!0,e?.version??null),u(!0),s(!1),i();return}catch{e<E&&await new Promise(e=>setTimeout(e,D))}x(!1,null),u(!1),s(!1)},[x]);(0,a.useEffect)(()=>{N()},[N]);let P=!c||p===`stale_panel`;return(0,a.useEffect)(()=>{let e=setInterval(N,P?k:O);return()=>clearInterval(e)},[N,P]),(0,a.useEffect)(()=>{let e=()=>{document.visibilityState===`visible`&&N()};return document.addEventListener(`visibilitychange`,e),()=>document.removeEventListener(`visibilitychange`,e)},[N]),(0,S.jsx)(C.Provider,{value:{data:t,isLoading:o,isApiAvailable:c,needsOnboarding:d,panelState:p,dismissPanelState:w,refetch:N},children:e})}export{p as a,v as c,g as i,h as l,w as n,x as o,b as r,m as s,N as t,c as u};
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{vn as t,yn as n}from"./fa-ChDOCx3T.js";import{n as r}from"./axios-DyqbZVcF.js";import{i}from"./configCache-DZ0vWq_Z.js";var a=e(n(),1),o=`boneio-provisioned`;function s(e){let t=e?.match(/\/(proxy\/\d+)\/?$/);return t?`${o}-${t[1].replace(`/`,`-`)}`:o}function c(e,t){try{return e?.getItem(s(t))===`1`}catch{return!1}}function l(e,t,n){try{e?.setItem(s(t),n?`0`:`1`)}catch{}}var u=`boneio-update`,d=`boneio-stale-reload`;function f(e,t){let n=t?.match(/\/(proxy\/\d+)\/?$/);return n?`${e}-${n[1].replace(`/`,`-`)}`:e}function p(e){if(!e)return null;let t=e.trim();return t.startsWith(`v`)?t.slice(1):t}function m(e,t,n){try{let r=e?.getItem(f(u,t));if(!r)return null;let i=JSON.parse(r);return typeof i?.startedAt!=`number`||typeof i.fromVersion!=`string`||n-i.startedAt>36e5||i.startedAt>n+6e4?null:i}catch{return null}}function h(e,t,n){try{e?.setItem(f(u,t),JSON.stringify(n))}catch{}}function g(e,t){try{e?.removeItem(f(u,t))}catch{}}function _(e,t,n){if(t)return e.wentDown||e.downSince===void 0?e:{...e,downSince:void 0};let r=e.downSince??n,i=!!e.wentDown||n-r>=15e3;return r===e.downSince&&i===!!e.wentDown?e:{...e,downSince:r,wentDown:i}}function v(e,t){let n=p(t);if(!n)return!1;let r=p(e.toVersion);return r?n===r:n!==p(e.fromVersion)}function y(e){let{reachable:t,serverVersion:n,panelVersion:r,mark:i}=e;if(!t)return i?`updating`:`probably_updating`;let a=p(n),o=p(r);return a&&o&&a!==o?`stale_panel`:i&&i.wentDown&&a&&!v(i,a)&&a===p(i.fromVersion)?`update_failed`:`ok`}function b(e,t){try{return e?.getItem(d)===t}catch{return!0}}function x(e,t){try{e?.setItem(d,t)}catch{}}var S=t(),C=(0,a.createContext)({data:null,isLoading:!0,isApiAvailable:!0,needsOnboarding:!1,panelState:`ok`,dismissPanelState:()=>{},refetch:async()=>{}});function w(){return(0,a.useContext)(C)}function T(e,t){return e||!!t?.needs_onboarding}var E=2,D=1e3,O=3e4,k=5e3,A=`boneio-stale-bypass`,j=`1.6.0.dev30`;function M(e){try{return window.sessionStorage.getItem(e)}catch{return null}}function N({children:e}){let[t,n]=(0,a.useState)(null),[o,s]=(0,a.useState)(!0),[c,u]=(0,a.useState)(!0),[d,f]=(0,a.useState)(!1),[p,b]=(0,a.useState)(`ok`),x=(0,a.useCallback)((e,t)=>{let n=window.__BONEIO_BASE_PATH__,r=Date.now(),i=m(window.localStorage,n,r);if(i){let t=_(i,e,r);t!==i&&h(window.localStorage,n,t),i=t}i&&e&&v(i,t)&&(g(window.localStorage,n),i=null);let a=y({reachable:e,serverVersion:t,panelVersion:j,mark:i});a===`stale_panel`&&t&&M(A)===t&&(a=`ok`),b(a)},[]),w=(0,a.useCallback)(()=>{g(window.localStorage,window.__BONEIO_BASE_PATH__);let e=t?.version;if(p===`stale_panel`&&e)try{window.sessionStorage.setItem(A,e)}catch{}b(`ok`)},[t?.version,p]),N=(0,a.useCallback)(async()=>{for(let e=0;e<=E;e++)try{let{data:e}=await r.get(`/api/init`);n(t=>t&&JSON.stringify(t)===JSON.stringify(e)?t:e),f(t=>T(t,e)),l(window.localStorage,window.__BONEIO_BASE_PATH__,!!e?.needs_onboarding),x(!0,e?.version??null),u(!0),s(!1),i();return}catch{e<E&&await new Promise(e=>setTimeout(e,D))}x(!1,null),u(!1),s(!1)},[x]);(0,a.useEffect)(()=>{N()},[N]);let P=!c||p===`stale_panel`;return(0,a.useEffect)(()=>{let e=setInterval(N,P?k:O);return()=>clearInterval(e)},[N,P]),(0,a.useEffect)(()=>{let e=()=>{document.visibilityState===`visible`&&N()};return document.addEventListener(`visibilitychange`,e),()=>document.removeEventListener(`visibilitychange`,e)},[N]),(0,S.jsx)(C.Provider,{value:{data:t,isLoading:o,isApiAvailable:c,needsOnboarding:d,panelState:p,dismissPanelState:w,refetch:N},children:e})}export{p as a,v as c,g as i,h as l,w as n,x as o,b as r,m as s,N as t,c as u};