boneio 1.6.0.dev29__tar.gz → 1.6.0.dev30__tar.gz

{boneio-1.6.0.dev29/boneio.egg-info → boneio-1.6.0.dev30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev29
+Version: 1.6.0.dev30
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0

boneio-1.6.0.dev30/boneio/core/auth/jwt_secret.py

@@ -0,0 +1,129 @@
+"""The secret the panel signs its login tokens with.
+
+Kept in ``jwt_secret`` next to config.yaml so a token outlives a restart. Here
+rather than in the web server so recovery mode signs with the same secret
+without importing the web server, which pulls in the whole Manager: a token
+issued in recovery keeps working once the controller is back, and the other
+way round.
+
+The secret belongs to one controller, and the file says which: its second
+line is a hash of the machine-id it was drawn on. A file that names another
+machine — or none — came from somewhere else, most likely an SD card image
+built on a controller that had already run, and every device flashed from that
+image would otherwise sign with the same key. Anyone holding the image could
+then sign an administrator's token for all of them. Such a file is replaced
+rather than trusted, which signs everybody out once.
+
+Only the hash is stored: machine-id is meant to stay on the machine, and the
+file needs no more than to recognise it.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import secrets
+from pathlib import Path
+
+_LOGGER = logging.getLogger(__name__)
+
+JWT_SECRET_FILENAME = "jwt_secret"
+
+#: Where systemd keeps this installation's identity. Emptied when an image is
+#: sealed and drawn afresh on the first boot, which is what makes it the thing
+#: to bind to.
+MACHINE_ID_PATH = Path("/etc/machine-id")
+
+_BINDING_PREFIX = "machine:"
+
+
+def _machine_binding(machine_id_path: Path) -> str | None:
+    """The binding line for this machine, or None when it has no identity yet.
+
+    None is not an error. On an image being built machine-id is empty on
+    purpose; a secret drawn then stays unbound and is replaced on the first
+    boot, once there is an identity to bind it to.
+
+    Args:
+        machine_id_path: The machine-id file.
+
+    Returns:
+        ``machine:<sha256 of machine-id>``, or None.
+    """
+    try:
+        machine_id = machine_id_path.read_text().strip()
+    except OSError:
+        return None
+    if not machine_id:
+        return None
+    digest = hashlib.sha256(f"boneio-jwt:{machine_id}".encode()).hexdigest()
+    return f"{_BINDING_PREFIX}{digest}"
+
+
+def _write_secret(path: Path, secret: str, binding: str | None) -> None:
+    """Write the secret readable by its owner only, from the first byte.
+
+    Created 0600 rather than chmod-ed afterwards, and swapped in with a rename,
+    so there is never a moment when the key is on disk with looser permissions
+    or half written.
+    """
+    content = secret + (f"\n{binding}" if binding else "") + "\n"
+    tmp = path.with_name(f".{path.name}.tmp")
+    try:
+        tmp.unlink()
+    except FileNotFoundError:
+        pass
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(content)
+        f.flush()
+        os.fsync(f.fileno())
+    os.replace(tmp, path)
+
+
+def load_or_create_jwt_secret(
+    config_dir: str | os.PathLike[str],
+    machine_id_path: Path = MACHINE_ID_PATH,
+) -> str:
+    """Read the token secret, creating it on first use.
+
+    A stored secret is used only if it was drawn on this machine. One with no
+    binding, or another machine's, is replaced — unless this machine has no
+    identity to compare with, in which case it is kept as it is: replacing it
+    then would sign everybody out on every start.
+
+    Never raises: a secret that cannot be persisted is replaced by one that
+    lives as long as the process, which logs everybody out on the next restart
+    but does not keep the panel from starting.
+
+    Args:
+        config_dir: The directory config.yaml is in.
+        machine_id_path: The machine-id file. A parameter for the tests.
+
+    Returns:
+        The secret.
+    """
+    jwt_secret_file = Path(config_dir) / JWT_SECRET_FILENAME
+    binding = _machine_binding(machine_id_path)
+
+    try:
+        if jwt_secret_file.exists():
+            lines = jwt_secret_file.read_text().split()
+            stored = lines[0] if lines else ""
+            stored_binding = lines[1] if len(lines) > 1 else None
+            if stored and (binding is None or stored_binding == binding):
+                return stored
+            if stored:
+                _LOGGER.warning(
+                    "The token secret was not drawn on this controller; "
+                    "replacing it. Everybody signed in has to sign in again."
+                )
+
+        jwt_secret = secrets.token_hex(32)  # 256-bit random secret
+        _write_secret(jwt_secret_file, jwt_secret, binding)
+    except Exception as e:
+        # If we can't persist the secret, generate a temporary one
+        _LOGGER.error(f"Failed to handle JWT secret file: {e}")
+        jwt_secret = secrets.token_hex(32)
+    return jwt_secret

{boneio-1.6.0.dev29 → boneio-1.6.0.dev30}/boneio/core/cloud/registration.py

@@ -88,6 +88,7 @@ class CloudRegistration:
         self._task: asyncio.Task | None = None
         self._session: aiohttp.ClientSession | None = None
         self._last_error: str | None = None
+        self._switching = False
 
     @property
     def domain(self) -> str | None:
@@ -104,6 +105,18 @@ class CloudRegistration:
         """Get the last error message, if any."""
         return self._last_error
 
+    @property
+    def serving(self) -> bool:
+        """Whether Caddy is up on the cloud template with the certificate.
+
+        False while the template is being swapped and Caddy recreated: the
+        compose file already names the cloud script then, but the proxy — the
+        only way into a panel with ``web.expose: proxy`` — is down for the half
+        minute that takes. Anything sending somebody to the registered name
+        has to wait for this rather than for the template.
+        """
+        return self._domain is not None and not self._switching and self.is_cloud_config_active()
+
     @property
     def is_compose_writable(self) -> bool:
         """Check if docker-compose.yaml is writable without side effects."""
@@ -551,6 +564,14 @@ class CloudRegistration:
         Returns:
             True if the switch was successful.
         """
+        self._switching = True
+        try:
+            return await self._apply_cloud_config()
+        finally:
+            self._switching = False
+
+    async def _apply_cloud_config(self) -> bool:
+        """The body of :meth:`_switch_to_cloud_config`, without the flag."""
         # The init script still comes from the package; it is mounted read-only
         # into the container and is not what compose executes on the host.
         self._ensure_cloud_script()
@@ -571,7 +592,9 @@ class CloudRegistration:
             return False
 
         _LOGGER.info("Switched docker-compose.yaml to the cloud template")
-        return await self._recreate_caddy()
+        # The service definition changed, so ``up`` recreates the container
+        # and it reads the certificate as it starts.
+        return await self._recreate_caddy(restart=False)
 
     async def _restore_local_config(self) -> bool:
         """Restore the plain compose template and restart Caddy.
@@ -595,14 +618,21 @@ class CloudRegistration:
             return False
 
         _LOGGER.info("Restored the local docker-compose.yaml template")
-        return await self._recreate_caddy()
+        return await self._recreate_caddy(restart=False)
 
-    async def _recreate_caddy(self) -> bool:
+    async def _recreate_caddy(self, restart: bool = True) -> bool:
         """Recreate and restart Caddy so it picks up new certs or compose config.
 
         Both steps go through the container helper, so neither passes anything
         from here to Docker.
 
+        Args:
+            restart: Restart after ``up``. Needed when the compose file did not
+                change — ``up`` then leaves the running container alone and it
+                keeps the certificate it read at start. Not after a template
+                swap: ``up`` has just recreated it, and a restart on top takes
+                the proxy down a second time.
+
         Returns:
             True if the recreate was successful.
         """
@@ -614,12 +644,16 @@ class CloudRegistration:
             )
             return False
 
+        if not restart:
+            _LOGGER.info("Caddy container recreated successfully")
+            return True
+
         # Restart as well: mounted TLS certificates are only re-read on start.
-        restart = await loop.run_in_executor(None, containers.restart_caddy)
-        if not restart.ok:
+        restarted = await loop.run_in_executor(None, containers.restart_caddy)
+        if not restarted.ok:
             _LOGGER.warning(
                 "Caddy was recreated but the restart failed: %s",
-                restart.stderr.strip() or "unknown error",
+                restarted.stderr.strip() or "unknown error",
             )
 
         _LOGGER.info("Caddy container recreated and restarted successfully")

boneio-1.6.0.dev30/boneio/core/nodered_guard.py

@@ -0,0 +1,141 @@
+"""Make sure the running Node-RED asks for a password.
+
+Node-RED reads ``settings.js`` once, when its container starts. The file can
+say ``adminAuth`` while the editor still answers anyone: a migration installs
+the file during an update, and an update restarts boneIO, not the controller,
+so the container goes on with the settings it started with — an open editor,
+and deploying a flow with an ``exec`` node is code execution in it.
+
+So after boneIO starts it asks Node-RED, through the local proxy the way a
+browser would, what its login looks like. An editor that wants no login while
+the file on disk asks for one is restarted, once. Anything else is left alone:
+Node-RED switched off, still starting, or behind a proxy that is being
+recreated all look like "no answer", which is not a reason to restart.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import ssl
+import urllib.error
+import urllib.request
+from collections.abc import Callable
+from pathlib import Path
+
+from boneio.core import containers
+
+_LOGGER = logging.getLogger(__name__)
+
+SETTINGS_FILE = containers.PROJECT_DIR / "node-red" / "settings.js"
+
+#: Node-RED needs a while after a boot; so does the first start of Caddy.
+FIRST_CHECK_AFTER = 60.0
+RETRY_EVERY = 60.0
+ATTEMPTS = 10
+
+OPEN = "open"
+PROTECTED = "protected"
+UNKNOWN = "unknown"
+
+
+def probe(port: int, timeout: float = 5.0) -> str:
+    """Ask the editor how it signs people in.
+
+    ``GET /nodered/auth/login`` answers ``{}`` when ``adminAuth`` is off and
+    names the login type when it is on. The proxy's certificate is the
+    device's own, unverifiable from here, and this request never leaves the
+    machine, so it is not checked.
+
+    Args:
+        port: The HTTPS port Caddy publishes.
+        timeout: Seconds to wait.
+
+    Returns:
+        OPEN, PROTECTED, or UNKNOWN when there was no usable answer.
+    """
+    context = ssl.create_default_context()
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE
+    url = f"https://127.0.0.1:{port}/nodered/auth/login"
+    try:
+        with urllib.request.urlopen(url, timeout=timeout, context=context) as response:  # noqa: S310
+            body = json.loads(response.read(4096) or b"null")
+    except (OSError, ValueError, urllib.error.URLError):
+        return UNKNOWN
+    if not isinstance(body, dict):
+        return UNKNOWN
+    return PROTECTED if body.get("type") else OPEN
+
+
+def settings_require_login(path: Path = SETTINGS_FILE) -> bool:
+    """Whether the settings on disk turn ``adminAuth`` on.
+
+    Args:
+        path: Node-RED's settings.js.
+
+    Returns:
+        True when the file configures it.
+    """
+    try:
+        return "adminAuth" in path.read_text()
+    except OSError:
+        return False
+
+
+async def ensure_admin_auth(
+    port: int,
+    *,
+    first_check_after: float = FIRST_CHECK_AFTER,
+    retry_every: float = RETRY_EVERY,
+    attempts: int = ATTEMPTS,
+    probe_fn: Callable[[int], str] = probe,
+    settings_path: Path = SETTINGS_FILE,
+    restart: Callable[[], containers.Result] = containers.restart_nodered,
+) -> str:
+    """Restart Node-RED once if it runs open while its settings say otherwise.
+
+    Args:
+        port: The HTTPS port Caddy publishes.
+        first_check_after: Seconds before the first look.
+        retry_every: Seconds between looks while there is no answer.
+        attempts: Looks before giving up on an editor that never answers.
+        probe_fn: The probe. A parameter for the tests.
+        settings_path: Node-RED's settings.js.
+        restart: Restarts the container. A parameter for the tests.
+
+    Returns:
+        What it found or did: ``protected``, ``restarted``, ``open`` (the file
+        itself asks for no login), ``restart_failed`` or ``unknown``.
+    """
+    loop = asyncio.get_running_loop()
+    await asyncio.sleep(first_check_after)
+    for attempt in range(attempts):
+        if attempt:
+            await asyncio.sleep(retry_every)
+        state = await loop.run_in_executor(None, probe_fn, port)
+        if state == UNKNOWN:
+            continue
+        if state == PROTECTED:
+            return PROTECTED
+        if not settings_require_login(settings_path):
+            _LOGGER.error(
+                "Node-RED's editor accepts anyone, and %s does not configure "
+                "adminAuth either. Apply the pending system migrations.",
+                settings_path,
+            )
+            return OPEN
+        _LOGGER.warning(
+            "Node-RED is running without the login its settings ask for; "
+            "restarting it so it reads them."
+        )
+        result = await loop.run_in_executor(None, restart)
+        if not result.ok:
+            _LOGGER.error(
+                "Could not restart Node-RED: %s",
+                (result.stderr or result.stdout).strip() or "unknown error",
+            )
+            return "restart_failed"
+        return "restarted"
+    return UNKNOWN

boneio-1.6.0.dev30/boneio/migrations/plans/1.6.34.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/home/boneio/docker/nodered/node-red/settings.js","expected_sha256":"bff00753c72fb17609a6f7b3a58ef78b7b394da12d19fd65b875f2889695e2b4","group":"boneio","mode":420,"owner":"boneio","src":"docker/nodered/node-red/settings.js","template_vars":{}}]

boneio-1.6.0.dev30/boneio/migrations/plans/1.6.34.sig

@@ -0,0 +1,2 @@
+/�Kb'щ��*���g��fJ<�҃wߏ
+�G��)���J�ؼ���v*���4�>Z�z�
��

{boneio-1.6.0.dev29 → boneio-1.6.0.dev30}/boneio/migrations/plans/manifest.json

@@ -1 +1 @@
-{"plans":{"1.3.0":"645ac6bdda8dc0a73c219aa3684a29df4bdd4032aad97a833b259de489b2ce32","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"19508f66d84f1e16bd24932aaa17d45417912ffd1c20d326b2f003b931ac2f8c","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"8cfaeae24ceefe171d40241549c1f62527ce41821e5fd2904c0df1973596c0c7","1.6.16":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.17":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.18":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.19":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.20":"28027c836eef19b21b95500760961e181f6078d22cccf8cca62b77bbbb11a0c5","1.6.21":"b0d0777e81edc8532d42bcd3b6d518fecd6078153dfe9f5f859469d2c13b369d","1.6.22":"6600f96197356bdc676e9cd7d2d40b18c9d8838323f8cae0892f056175396313","1.6.23":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.24":"701460ed5e3ed236c8c7273ba0a98a0235786b4a04bd6c7aa6088fb835549aa6","1.6.25":"efa09d1677148bdfe4639273479c9a1fa527d4cf5d2ca9af6dd876883652ba22","1.6.26":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.27":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.28":"6e219d09a06a5de8162a521c9b3c3b54067e6bb4d1d15b3b47a8ec522fd76b5c","1.6.29":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.30":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.31":"fe5e93397dfe4e459cb7c19bfb09153707ebe4b6c92a60a279bf61b0fbc482fb","1.6.32":"c5dbc5a513107d179d55c2f7360e66299167107acd92bc1f5c3a6b19bc7b6e31","1.6.33":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"65a083182affb9a2beef674bb17dee390bec0007441f1ee71b92e05117c65937","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"5c03d447037a48211f0223bb9ecc8cdc1fa84b93bec8e61b1a3073188ac7ea4e","1.6.9":"978c88cc23a2ce07fe419d40a4f9aaf1a1388d01c6b43235e6f08fc09a03a96f"},"release":"1.6.0.dev29"}
+{"plans":{"1.3.0":"645ac6bdda8dc0a73c219aa3684a29df4bdd4032aad97a833b259de489b2ce32","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"19508f66d84f1e16bd24932aaa17d45417912ffd1c20d326b2f003b931ac2f8c","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"8cfaeae24ceefe171d40241549c1f62527ce41821e5fd2904c0df1973596c0c7","1.6.16":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.17":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.18":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.19":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.20":"28027c836eef19b21b95500760961e181f6078d22cccf8cca62b77bbbb11a0c5","1.6.21":"b0d0777e81edc8532d42bcd3b6d518fecd6078153dfe9f5f859469d2c13b369d","1.6.22":"6600f96197356bdc676e9cd7d2d40b18c9d8838323f8cae0892f056175396313","1.6.23":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.24":"701460ed5e3ed236c8c7273ba0a98a0235786b4a04bd6c7aa6088fb835549aa6","1.6.25":"efa09d1677148bdfe4639273479c9a1fa527d4cf5d2ca9af6dd876883652ba22","1.6.26":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.27":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.28":"6e219d09a06a5de8162a521c9b3c3b54067e6bb4d1d15b3b47a8ec522fd76b5c","1.6.29":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.30":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.31":"fe5e93397dfe4e459cb7c19bfb09153707ebe4b6c92a60a279bf61b0fbc482fb","1.6.32":"c5dbc5a513107d179d55c2f7360e66299167107acd92bc1f5c3a6b19bc7b6e31","1.6.33":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.34":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"65a083182affb9a2beef674bb17dee390bec0007441f1ee71b92e05117c65937","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"5c03d447037a48211f0223bb9ecc8cdc1fa84b93bec8e61b1a3073188ac7ea4e","1.6.9":"978c88cc23a2ce07fe419d40a4f9aaf1a1388d01c6b43235e6f08fc09a03a96f"},"release":"1.6.0.dev30"}

boneio-1.6.0.dev30/boneio/migrations/versions/v1_6_34_nodered_admin_auth_again.py

@@ -0,0 +1,51 @@
+"""BoneIO 1.6.34 — install the Node-RED settings that require a login, again.
+
+1.6.0 installed ``settings.js`` with ``adminAuth`` delegated to boneIO, and
+recorded itself as applied. On the SD card images that record did not mean the
+file was still there: the images are built on a rootfs that had already been
+through setup once, so 1.6.0 counted as done, and the image script's own step
+then wrote its four-line ``settings.js`` over the real one — no ``adminAuth``.
+Every controller flashed from such an image (seen on dev29, blk239bb2, audit
+finding A-02) ran Node-RED's editor open to anyone who could reach the device,
+which is F-01 back: a flow with an ``exec`` node is code execution.
+
+The same file again, under a new version so it is applied once more on every
+device. Where the file is already the right one, the helper finds the hash
+matching and writes nothing.
+
+The running container keeps the settings it started with. boneIO restarts it
+on its own after starting, when the editor answers without a login while this
+file asks for one (see :mod:`boneio.core.nodered_guard`), so an update is
+enough and no reboot is needed.
+
+To retry on a device, delete ``/var/lib/boneio/migrations.d/1.6.34.applied``
+and restart boneIO.
+"""
+
+from __future__ import annotations
+
+from boneio.migrations.actions import InstallFile, MigrationAction
+
+VERSION = "1.6.34"
+DESCRIPTION = "Install the Node-RED settings that require a login, again (F-01, A-02)"
+REQUIRES_ROOT = True
+
+_BONEIO_HOME = "/home/boneio"
+_BONEIO_USER = "boneio"
+
+
+def plan() -> list[MigrationAction]:
+    """Return the ordered list of migration actions for version 1.6.34.
+
+    Returns:
+        List of :class:`MigrationAction` to apply in order.
+    """
+    return [
+        InstallFile(
+            src="docker/nodered/node-red/settings.js",
+            dst=f"{_BONEIO_HOME}/docker/nodered/node-red/settings.js",
+            mode=0o644,
+            owner=_BONEIO_USER,
+            group=_BONEIO_USER,
+        ),
+    ]

{boneio-1.6.0.dev29 → boneio-1.6.0.dev30}/boneio/runner.py

@@ -616,6 +616,16 @@ async def async_run(
 
     stable_task = asyncio.create_task(_forgive_earlier_crashes())
 
+    # An update restarts boneIO, not the controller, so a Node-RED settings
+    # file installed by it is not what the running editor read. Not in the
+    # main gather either: it finishes after a look or two.
+    from boneio.const import DEFAULT_PROXY_PORT
+    from boneio.core.nodered_guard import ensure_admin_auth
+
+    nodered_task = asyncio.create_task(
+        ensure_admin_auth(_config_helper.proxy_port or DEFAULT_PROXY_PORT)
+    )
+
     try:
         # Convert tasks set to list for main gather
         task_list = list(tasks)
@@ -668,6 +678,7 @@ async def async_run(
     finally:
         _LOGGER.info("Cleaning up resources...")
         stable_task.cancel()
+        nodered_task.cancel()
 
         # Cancel pending deferred state saves and write final state synchronously.
         # This MUST happen before event_bus.stop() which may trigger sigterm

boneio-1.6.0.dev30/boneio/version.py

@@ -0,0 +1,2 @@
+# flake8: noqa
+__version__ = "1.6.0.dev30"

{boneio-1.6.0.dev29 → boneio-1.6.0.dev30}/boneio/webui/app.py

@@ -14,7 +14,7 @@ from typing import TYPE_CHECKING
 from fastapi import Depends, FastAPI, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.middleware.gzip import GZipMiddleware
-from fastapi.responses import FileResponse, JSONResponse
+from fastapi.responses import FileResponse, JSONResponse, Response
 from fastapi.staticfiles import StaticFiles
 from starlette.types import Receive, Scope, Send
 from starlette.websockets import WebSocketState
@@ -1096,6 +1096,10 @@ if FRONTEND_DIR.exists() and (FRONTEND_DIR / "index.html").exists():
             headers={"Cache-Control": "no-store, no-cache, must-revalidate"},
         )
 
+    #: FastAPI's own schema and docs routes. In dev mode they are registered
+    #: ahead of this catch-all and answer first; otherwise nothing should.
+    _API_DOC_PATHS = frozenset({"docs", "docs/oauth2-redirect", "redoc", "openapi.json"})
+
     @app.get("/{filename:path}")
     async def serve_react_app(filename: str):
         """Serve static files from frontend-dist, fallback to index.html for SPA routing.
@@ -1104,6 +1108,11 @@ if FRONTEND_DIR.exists() and (FRONTEND_DIR / "index.html").exists():
         them. index.html (SPA fallback) is never cached to prevent stale
         versions being served through Cloudflare Tunnel or other caching proxies.
         """
+        if filename in _API_DOC_PATHS:
+            # The schema is off outside dev mode, and these names answering
+            # with the panel's index.html read to a scanner as an exposed API
+            # schema. Saying "not here" is the truth.
+            return Response(status_code=404)
         file_path = (FRONTEND_DIR / filename).resolve()
         if filename and file_path.is_relative_to(FRONTEND_DIR.resolve()) and file_path.exists() and file_path.is_file():
             return FileResponse(str(file_path))

boneio-1.6.0.dev29/boneio/webui/frontend-dist/assets/AccountsView-hSkFhGZn.js → boneio-1.6.0.dev30/boneio/webui/frontend-dist/assets/AccountsView-C5bNw-zJ.js

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{H as t,Qt as n,V as r,fn as i,ln as a,ot as o,un as s,vn as c,yn as l}from"./fa-ChDOCx3T.js";import{a as u,i as d,n as f,o as p,r as m,t as h}from"./dialog-DMaCttcv.js";import{n as g}from"./axios-DyqbZVcF.js";import{B as _,F as v,I as y,N as b,P as x,R as S,T as C,h as w,m as T,y as E}from"./index-DULLFI0R.js";import{t as D}from"./LoadingState-BnMjvLnH.js";var O=e(l(),1),k=c(),A=3;function j({id:e,label:n,value:i,onChange:a,autoComplete:o,error:s,autoFocus:c}){let{t:l}=S(),[u,d]=(0,O.useState)(!1);return(0,k.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,k.jsx)(`label`,{htmlFor:e,className:`text-sm font-medium`,children:n}),(0,k.jsxs)(`div`,{className:`input w-full pr-1 ${s?`input-error`:``}`,children:[(0,k.jsx)(`input`,{id:e,type:u?`text`:`password`,autoComplete:o,autoFocus:c,required:!0,className:`grow font-mono`,"aria-invalid":s?!0:void 0,"aria-describedby":s?`${e}-error`:void 0,value:i,onChange:e=>a(e.target.value)}),(0,k.jsx)(`button`,{type:`button`,onClick:()=>d(e=>!e),className:`btn btn-ghost btn-square btn-sm`,"aria-label":l(u?`login.hide_password`:`login.show_password`),"aria-pressed":u,title:l(u?`login.hide_password`:`login.show_password`),children:u?(0,k.jsx)(t,{className:`h-4 w-4 opacity-70`}):(0,k.jsx)(r,{className:`h-4 w-4 opacity-70`})})]}),s&&(0,k.jsx)(`p`,{id:`${e}-error`,role:`alert`,className:`text-error text-xs`,children:s})]})}function M({username:e,isSelf:t,onClose:n,onChanged:r}){let{t:i}=S(),[a,s]=(0,O.useState)(``),[c,l]=(0,O.useState)(``),[_,y]=(0,O.useState)(``),[b,C]=(0,O.useState)(null),[w,T]=(0,O.useState)(null),[E,D]=(0,O.useState)(!1),M=v(c,_,e??``),N=c&&M&&M!==`mismatch`?i(x[M],{min:8}):null,P=_&&M===`mismatch`?i(`accounts.password_mismatch`):null,F=async n=>{if(n.preventDefault(),!(!e||M||t&&!a)){C(null),T(null),D(!0);try{let{data:n}=t?await g.put(`/api/account/password`,{current_password:a,new_password:c},{timeout:6e4}):await g.put(`/api/accounts/${encodeURIComponent(e)}/password`,{password:c},{timeout:6e4});typeof n?.token==`string`&&localStorage.setItem(`token`,n.token),r(e)}catch(e){let t=e.response;if(t?.status===403&&t.data?.code===`current_password_wrong`){let e=t.data.attempts_left;C(typeof e==`number`&&e<=A?`${i(`accounts.current_password_wrong`)} ${i(`reauth.attempts_left`,{count:e})}`:i(`accounts.current_password_wrong`))}else t?.status===429?T(i(`reauth.throttled`)):t?.status!==401&&T(t?.data?.detail||i(`accounts.password_failed`))}finally{D(!1)}}},I=t?i(`accounts.change_own_password_title`):i(`accounts.change_password_title`,{username:e??``});return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!E&&n(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:F,className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(o,{})}),(0,k.jsx)(p,{children:I})]}),(0,k.jsx)(m,{children:i(t?`accounts.change_own_password_intro`:`accounts.change_password_intro`)})]}),t&&(0,k.jsx)(j,{id:`account-current-password`,label:i(`accounts.current_password`),value:a,onChange:e=>{s(e),C(null)},autoComplete:`current-password`,error:b,autoFocus:!0}),(0,k.jsx)(j,{id:`account-new-password`,label:i(`accounts.new_password`),value:c,onChange:l,autoComplete:`new-password`,error:N,autoFocus:!t}),(0,k.jsx)(j,{id:`account-repeat-password`,label:i(`accounts.repeat_password`),value:_,onChange:y,autoComplete:`new-password`,error:P}),(0,k.jsx)(`p`,{className:`text-xs opacity-70`,children:i(`accounts.ssh_password_separate`)}),w&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:w}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:n,disabled:E,children:i(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:E||!!M||t&&!a,children:[E&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),i(`accounts.change_password_button`)]})]})]})})})}function N({username:e,onClose:t,onConfirm:n}){let{t:r}=S(),[i,o]=(0,O.useState)(!1);return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!i&&t(),children:(0,k.jsxs)(f,{className:`sm:max-w-sm`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0 text-error`,children:(0,k.jsx)(a,{})}),(0,k.jsx)(p,{children:r(`accounts.confirm_delete`,{username:e??``})})]}),(0,k.jsx)(m,{children:r(`accounts.confirm_delete_intro`)})]}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:t,disabled:i,children:r(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`button`,className:`btn btn-error max-sm:btn-lg`,onClick:async()=>{if(e){o(!0);try{await n(e)}finally{o(!1)}}},disabled:i,children:[i&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),r(`accounts.delete`)]})]})]})})}function P(e,t){return e===`locked`||e===`empty`?e:e===`set`||e===`shipped`?t?`form`:`outdated`:`unknown`}var F=`boneio`,I=3;function L({open:e,shipped:t,onClose:r,onChanged:i,onStale:a}){let{t:o}=S(),[s,c]=(0,O.useState)(``),[l,_]=(0,O.useState)(``),[y,b]=(0,O.useState)(``),[C,w]=(0,O.useState)(null),[T,E]=(0,O.useState)(null),[D,A]=(0,O.useState)(!1),M=v(l,y,F),N=l&&M&&M!==`mismatch`?o(x[M],{min:8}):null,P=y&&M===`mismatch`?o(`accounts.password_mismatch`):null;return(0,k.jsx)(h,{open:e,onOpenChange:e=>!e&&!D&&r(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:async e=>{if(e.preventDefault(),!M&&s){w(null),E(null),A(!0);try{await g.put(`/api/accounts/ssh-password`,{current_password:s,new_password:l},{timeout:6e4}),i()}catch(e){let t=e.response,n=t?.data?.code;if(t?.status===403&&n===`current_password_wrong`){let e=t.data?.attempts_left;w(typeof e==`number`&&e<=I?`${o(`accounts.ssh_current_wrong`)} ${o(`accounts.ssh_attempts_left`,{count:e})}`:o(`accounts.ssh_current_wrong`))}else if(t?.status===429){let e=t.data?.retry_after;E(o(`accounts.ssh_throttled`,{minutes:Math.max(1,Math.ceil((typeof e==`number`?e:900)/60))}))}else n===`helper_outdated`||n===`ssh_password_not_set`?a():t?.status!==401&&E(t?.data?.detail||o(`accounts.ssh_failed`))}finally{A(!1)}}},className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(n,{})}),(0,k.jsx)(p,{children:o(`accounts.ssh_dialog_title`)})]}),(0,k.jsx)(m,{children:o(t?`accounts.ssh_dialog_intro_shipped`:`accounts.ssh_dialog_intro`)})]}),(0,k.jsx)(j,{id:`ssh-current-password`,label:o(`accounts.ssh_current`),value:s,onChange:e=>{c(e),w(null)},autoComplete:`current-password`,error:C,autoFocus:!0}),(0,k.jsx)(j,{id:`ssh-new-password`,label:o(`accounts.ssh_new`),value:l,onChange:_,autoComplete:`new-password`,error:N}),(0,k.jsx)(j,{id:`ssh-repeat-password`,label:o(`accounts.ssh_repeat`),value:y,onChange:b,autoComplete:`new-password`,error:P}),T&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:T}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:r,disabled:D,children:o(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:D||!!M||!s,children:[D&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),o(`accounts.ssh_button`)]})]})]})})})}function R(){let{t:e}=S(),[t,r]=(0,O.useState)(null),[i,a]=(0,O.useState)(!1),[o,s]=(0,O.useState)(!0),[c,l]=(0,O.useState)(null),[u,d]=(0,O.useState)(0),[f,p]=(0,O.useState)(!1),m=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts/ssh-password`,{timeout:3e4});r(e?.state??null),a(!!e?.supported)}catch{r(null)}finally{s(!1)}},[]);(0,O.useEffect)(()=>{m()},[m]);let h=P(t,i),_=()=>o?(0,k.jsx)(D,{className:`py-2`}):h===`form`?t===`shipped`?(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.ssh_shipped`)}):null:(0,k.jsx)(b,{variant:h===`empty`?`warning`:`info`,message:e(`accounts.ssh_${h}`)});return(0,k.jsxs)(k.Fragment,{children:[(0,k.jsx)(E,{icon:(0,k.jsx)(n,{}),title:e(`accounts.ssh_title`),description:e(`accounts.ssh_intro`),action:h===`form`&&!o?(0,k.jsx)(`button`,{type:`button`,className:`btn btn-primary btn-sm`,onClick:()=>{l(null),d(e=>e+1),p(!0)},children:e(`accounts.ssh_button`)}):void 0,children:(c||_())&&(0,k.jsxs)(`div`,{className:`flex flex-col gap-3`,children:[c&&(0,k.jsx)(b,{variant:`success`,message:c}),_()]})}),(0,k.jsx)(L,{open:f,shipped:t===`shipped`,onClose:()=>p(!1),onChanged:()=>{p(!1),l(e(`accounts.ssh_changed`)),m()},onStale:()=>{p(!1),m()}},u)]})}function z(e,t){return e?.response?.data?.detail||t}function B(){let{t:e}=S(),{username:t,isAdmin:n}=_(),[r,a]=(0,O.useState)([]),[o,c]=(0,O.useState)(!0),[l,u]=(0,O.useState)(null),[d,f]=(0,O.useState)(null),[p,m]=(0,O.useState)(``),[h,v]=(0,O.useState)(``),[A,j]=(0,O.useState)(`viewer`),[P,F]=(0,O.useState)(!1),[I,L]=(0,O.useState)(null),[B,V]=(0,O.useState)(null),H=h?y(h,p):null,U=H?e(x[H],{min:8}):null,W=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts`);a(e.accounts??[]),u(null)}catch(t){u(z(t,e(`accounts.load_failed`)))}finally{c(!1)}},[e]);(0,O.useEffect)(()=>{n&&W()},[n,W]);let G=async t=>{t.preventDefault(),u(null),f(null),F(!0);try{await g.post(`/api/accounts`,{username:p,password:h,role:A}),m(``),v(``),j(`viewer`),f(e(`accounts.created`)),await W()}catch(t){u(z(t,e(`accounts.create_failed`)))}finally{F(!1)}},K=async t=>{u(null),f(null);try{await g.delete(`/api/accounts/${encodeURIComponent(t)}`),f(e(`accounts.deleted`,{username:t})),await W()}catch(t){u(z(t,e(`accounts.delete_failed`)))}finally{V(null)}},q=async(t,n)=>{u(null),f(null);try{await g.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await W()}catch(t){u(z(t,e(`accounts.role_failed`))),await W()}},J=t=>{L(null),u(null),f(e(`accounts.password_reset`,{username:t}))},Y=e=>e.toLowerCase()===(t??``).toLowerCase();return n?(0,k.jsxs)(C,{width:`wide`,children:[l&&(0,k.jsx)(b,{variant:`error`,message:l}),d&&(0,k.jsx)(b,{variant:`success`,message:d}),(0,k.jsx)(E,{icon:(0,k.jsx)(i,{}),title:e(`accounts.title`),children:o?(0,k.jsx)(D,{className:`py-6`}):(0,k.jsx)(`ul`,{className:`stg-inset divide-y divide-base-content/10`,children:r.map(t=>{let n=Y(t.username);return(0,k.jsxs)(`li`,{className:`flex flex-wrap items-center gap-x-3 gap-y-2 px-3 py-2.5`,children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-2 min-w-0 flex-1`,children:[(0,k.jsx)(`span`,{className:`font-medium font-mono truncate`,children:t.username}),n&&(0,k.jsx)(`span`,{className:`badge badge-ghost badge-xs shrink-0`,children:e(`accounts.you`)})]}),(0,k.jsxs)(`select`,{className:`select select-xs select-bordered w-auto`,"aria-label":e(`accounts.role`),value:t.role,disabled:n,onChange:e=>q(t,e.target.value),children:[(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]}),(0,k.jsxs)(`div`,{className:`flex justify-end gap-1 w-full sm:w-auto`,children:[(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>{f(null),L(t.username)},children:e(`accounts.reset_password`)}),(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error`,disabled:n,onClick:()=>V(t.username),children:e(`accounts.delete`)})]})]},t.username)})})}),(0,k.jsx)(`form`,{onSubmit:G,children:(0,k.jsx)(E,{icon:(0,k.jsx)(s,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,k.jsx)(T,{children:(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:P||!p||!h||!!U,children:[P&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,k.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,k.jsx)(w,{label:e(`accounts.username`),children:(0,k.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:p,onChange:e=>m(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.password`),error:U||void 0,children:(0,k.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${U?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":U?!0:void 0,"aria-describedby":U?`accounts-password-error`:void 0,value:h,onChange:e=>v(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,k.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})}),(0,k.jsx)(R,{}),(0,k.jsx)(M,{username:I,isSelf:I!==null&&Y(I),onClose:()=>L(null),onChanged:J},I??``),(0,k.jsx)(N,{username:B,onClose:()=>V(null),onConfirm:K})]}):(0,k.jsx)(C,{width:`wide`,children:(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{B as default};
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{H as t,Qt as n,V as r,fn as i,ln as a,ot as o,un as s,vn as c,yn as l}from"./fa-ChDOCx3T.js";import{a as u,i as d,n as f,o as p,r as m,t as h}from"./dialog-DMaCttcv.js";import{n as g}from"./axios-DyqbZVcF.js";import{B as _,F as v,I as y,N as b,P as x,R as S,T as C,h as w,m as T,y as E}from"./index-CoFvRO76.js";import{t as D}from"./LoadingState-hl_hkPPN.js";var O=e(l(),1),k=c(),A=3;function j({id:e,label:n,value:i,onChange:a,autoComplete:o,error:s,autoFocus:c}){let{t:l}=S(),[u,d]=(0,O.useState)(!1);return(0,k.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,k.jsx)(`label`,{htmlFor:e,className:`text-sm font-medium`,children:n}),(0,k.jsxs)(`div`,{className:`input w-full pr-1 ${s?`input-error`:``}`,children:[(0,k.jsx)(`input`,{id:e,type:u?`text`:`password`,autoComplete:o,autoFocus:c,required:!0,className:`grow font-mono`,"aria-invalid":s?!0:void 0,"aria-describedby":s?`${e}-error`:void 0,value:i,onChange:e=>a(e.target.value)}),(0,k.jsx)(`button`,{type:`button`,onClick:()=>d(e=>!e),className:`btn btn-ghost btn-square btn-sm`,"aria-label":l(u?`login.hide_password`:`login.show_password`),"aria-pressed":u,title:l(u?`login.hide_password`:`login.show_password`),children:u?(0,k.jsx)(t,{className:`h-4 w-4 opacity-70`}):(0,k.jsx)(r,{className:`h-4 w-4 opacity-70`})})]}),s&&(0,k.jsx)(`p`,{id:`${e}-error`,role:`alert`,className:`text-error text-xs`,children:s})]})}function M({username:e,isSelf:t,onClose:n,onChanged:r}){let{t:i}=S(),[a,s]=(0,O.useState)(``),[c,l]=(0,O.useState)(``),[_,y]=(0,O.useState)(``),[b,C]=(0,O.useState)(null),[w,T]=(0,O.useState)(null),[E,D]=(0,O.useState)(!1),M=v(c,_,e??``),N=c&&M&&M!==`mismatch`?i(x[M],{min:8}):null,P=_&&M===`mismatch`?i(`accounts.password_mismatch`):null,F=async n=>{if(n.preventDefault(),!(!e||M||t&&!a)){C(null),T(null),D(!0);try{let{data:n}=t?await g.put(`/api/account/password`,{current_password:a,new_password:c},{timeout:6e4}):await g.put(`/api/accounts/${encodeURIComponent(e)}/password`,{password:c},{timeout:6e4});typeof n?.token==`string`&&localStorage.setItem(`token`,n.token),r(e)}catch(e){let t=e.response;if(t?.status===403&&t.data?.code===`current_password_wrong`){let e=t.data.attempts_left;C(typeof e==`number`&&e<=A?`${i(`accounts.current_password_wrong`)} ${i(`reauth.attempts_left`,{count:e})}`:i(`accounts.current_password_wrong`))}else t?.status===429?T(i(`reauth.throttled`)):t?.status!==401&&T(t?.data?.detail||i(`accounts.password_failed`))}finally{D(!1)}}},I=t?i(`accounts.change_own_password_title`):i(`accounts.change_password_title`,{username:e??``});return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!E&&n(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:F,className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(o,{})}),(0,k.jsx)(p,{children:I})]}),(0,k.jsx)(m,{children:i(t?`accounts.change_own_password_intro`:`accounts.change_password_intro`)})]}),t&&(0,k.jsx)(j,{id:`account-current-password`,label:i(`accounts.current_password`),value:a,onChange:e=>{s(e),C(null)},autoComplete:`current-password`,error:b,autoFocus:!0}),(0,k.jsx)(j,{id:`account-new-password`,label:i(`accounts.new_password`),value:c,onChange:l,autoComplete:`new-password`,error:N,autoFocus:!t}),(0,k.jsx)(j,{id:`account-repeat-password`,label:i(`accounts.repeat_password`),value:_,onChange:y,autoComplete:`new-password`,error:P}),(0,k.jsx)(`p`,{className:`text-xs opacity-70`,children:i(`accounts.ssh_password_separate`)}),w&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:w}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:n,disabled:E,children:i(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:E||!!M||t&&!a,children:[E&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),i(`accounts.change_password_button`)]})]})]})})})}function N({username:e,onClose:t,onConfirm:n}){let{t:r}=S(),[i,o]=(0,O.useState)(!1);return(0,k.jsx)(h,{open:e!==null,onOpenChange:e=>!e&&!i&&t(),children:(0,k.jsxs)(f,{className:`sm:max-w-sm`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0 text-error`,children:(0,k.jsx)(a,{})}),(0,k.jsx)(p,{children:r(`accounts.confirm_delete`,{username:e??``})})]}),(0,k.jsx)(m,{children:r(`accounts.confirm_delete_intro`)})]}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:t,disabled:i,children:r(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`button`,className:`btn btn-error max-sm:btn-lg`,onClick:async()=>{if(e){o(!0);try{await n(e)}finally{o(!1)}}},disabled:i,children:[i&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),r(`accounts.delete`)]})]})]})})}function P(e,t){return e===`locked`||e===`empty`?e:e===`set`||e===`shipped`?t?`form`:`outdated`:`unknown`}var F=`boneio`,I=3;function L({open:e,shipped:t,onClose:r,onChanged:i,onStale:a}){let{t:o}=S(),[s,c]=(0,O.useState)(``),[l,_]=(0,O.useState)(``),[y,b]=(0,O.useState)(``),[C,w]=(0,O.useState)(null),[T,E]=(0,O.useState)(null),[D,A]=(0,O.useState)(!1),M=v(l,y,F),N=l&&M&&M!==`mismatch`?o(x[M],{min:8}):null,P=y&&M===`mismatch`?o(`accounts.password_mismatch`):null;return(0,k.jsx)(h,{open:e,onOpenChange:e=>!e&&!D&&r(),children:(0,k.jsx)(f,{className:`sm:max-w-md`,children:(0,k.jsxs)(`form`,{onSubmit:async e=>{if(e.preventDefault(),!M&&s){w(null),E(null),A(!0);try{await g.put(`/api/accounts/ssh-password`,{current_password:s,new_password:l},{timeout:6e4}),i()}catch(e){let t=e.response,n=t?.data?.code;if(t?.status===403&&n===`current_password_wrong`){let e=t.data?.attempts_left;w(typeof e==`number`&&e<=I?`${o(`accounts.ssh_current_wrong`)} ${o(`accounts.ssh_attempts_left`,{count:e})}`:o(`accounts.ssh_current_wrong`))}else if(t?.status===429){let e=t.data?.retry_after;E(o(`accounts.ssh_throttled`,{minutes:Math.max(1,Math.ceil((typeof e==`number`?e:900)/60))}))}else n===`helper_outdated`||n===`ssh_password_not_set`?a():t?.status!==401&&E(t?.data?.detail||o(`accounts.ssh_failed`))}finally{A(!1)}}},className:`flex flex-col gap-4`,children:[(0,k.jsxs)(u,{children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-3`,children:[(0,k.jsx)(`span`,{className:`stg-chip w-10 h-10 rounded-xl flex items-center justify-center shrink-0`,children:(0,k.jsx)(n,{})}),(0,k.jsx)(p,{children:o(`accounts.ssh_dialog_title`)})]}),(0,k.jsx)(m,{children:o(t?`accounts.ssh_dialog_intro_shipped`:`accounts.ssh_dialog_intro`)})]}),(0,k.jsx)(j,{id:`ssh-current-password`,label:o(`accounts.ssh_current`),value:s,onChange:e=>{c(e),w(null)},autoComplete:`current-password`,error:C,autoFocus:!0}),(0,k.jsx)(j,{id:`ssh-new-password`,label:o(`accounts.ssh_new`),value:l,onChange:_,autoComplete:`new-password`,error:N}),(0,k.jsx)(j,{id:`ssh-repeat-password`,label:o(`accounts.ssh_repeat`),value:y,onChange:b,autoComplete:`new-password`,error:P}),T&&(0,k.jsx)(`p`,{role:`alert`,className:`text-error text-sm`,children:T}),(0,k.jsxs)(d,{children:[(0,k.jsx)(`button`,{type:`button`,className:`btn btn-ghost max-sm:btn-lg`,onClick:r,disabled:D,children:o(`common.cancel`)}),(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary max-sm:btn-lg`,disabled:D||!!M||!s,children:[D&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-sm`}),o(`accounts.ssh_button`)]})]})]})})})}function R(){let{t:e}=S(),[t,r]=(0,O.useState)(null),[i,a]=(0,O.useState)(!1),[o,s]=(0,O.useState)(!0),[c,l]=(0,O.useState)(null),[u,d]=(0,O.useState)(0),[f,p]=(0,O.useState)(!1),m=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts/ssh-password`,{timeout:3e4});r(e?.state??null),a(!!e?.supported)}catch{r(null)}finally{s(!1)}},[]);(0,O.useEffect)(()=>{m()},[m]);let h=P(t,i),_=()=>o?(0,k.jsx)(D,{className:`py-2`}):h===`form`?t===`shipped`?(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.ssh_shipped`)}):null:(0,k.jsx)(b,{variant:h===`empty`?`warning`:`info`,message:e(`accounts.ssh_${h}`)});return(0,k.jsxs)(k.Fragment,{children:[(0,k.jsx)(E,{icon:(0,k.jsx)(n,{}),title:e(`accounts.ssh_title`),description:e(`accounts.ssh_intro`),action:h===`form`&&!o?(0,k.jsx)(`button`,{type:`button`,className:`btn btn-primary btn-sm`,onClick:()=>{l(null),d(e=>e+1),p(!0)},children:e(`accounts.ssh_button`)}):void 0,children:(c||_())&&(0,k.jsxs)(`div`,{className:`flex flex-col gap-3`,children:[c&&(0,k.jsx)(b,{variant:`success`,message:c}),_()]})}),(0,k.jsx)(L,{open:f,shipped:t===`shipped`,onClose:()=>p(!1),onChanged:()=>{p(!1),l(e(`accounts.ssh_changed`)),m()},onStale:()=>{p(!1),m()}},u)]})}function z(e,t){return e?.response?.data?.detail||t}function B(){let{t:e}=S(),{username:t,isAdmin:n}=_(),[r,a]=(0,O.useState)([]),[o,c]=(0,O.useState)(!0),[l,u]=(0,O.useState)(null),[d,f]=(0,O.useState)(null),[p,m]=(0,O.useState)(``),[h,v]=(0,O.useState)(``),[A,j]=(0,O.useState)(`viewer`),[P,F]=(0,O.useState)(!1),[I,L]=(0,O.useState)(null),[B,V]=(0,O.useState)(null),H=h?y(h,p):null,U=H?e(x[H],{min:8}):null,W=(0,O.useCallback)(async()=>{try{let{data:e}=await g.get(`/api/accounts`);a(e.accounts??[]),u(null)}catch(t){u(z(t,e(`accounts.load_failed`)))}finally{c(!1)}},[e]);(0,O.useEffect)(()=>{n&&W()},[n,W]);let G=async t=>{t.preventDefault(),u(null),f(null),F(!0);try{await g.post(`/api/accounts`,{username:p,password:h,role:A}),m(``),v(``),j(`viewer`),f(e(`accounts.created`)),await W()}catch(t){u(z(t,e(`accounts.create_failed`)))}finally{F(!1)}},K=async t=>{u(null),f(null);try{await g.delete(`/api/accounts/${encodeURIComponent(t)}`),f(e(`accounts.deleted`,{username:t})),await W()}catch(t){u(z(t,e(`accounts.delete_failed`)))}finally{V(null)}},q=async(t,n)=>{u(null),f(null);try{await g.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await W()}catch(t){u(z(t,e(`accounts.role_failed`))),await W()}},J=t=>{L(null),u(null),f(e(`accounts.password_reset`,{username:t}))},Y=e=>e.toLowerCase()===(t??``).toLowerCase();return n?(0,k.jsxs)(C,{width:`wide`,children:[l&&(0,k.jsx)(b,{variant:`error`,message:l}),d&&(0,k.jsx)(b,{variant:`success`,message:d}),(0,k.jsx)(E,{icon:(0,k.jsx)(i,{}),title:e(`accounts.title`),children:o?(0,k.jsx)(D,{className:`py-6`}):(0,k.jsx)(`ul`,{className:`stg-inset divide-y divide-base-content/10`,children:r.map(t=>{let n=Y(t.username);return(0,k.jsxs)(`li`,{className:`flex flex-wrap items-center gap-x-3 gap-y-2 px-3 py-2.5`,children:[(0,k.jsxs)(`div`,{className:`flex items-center gap-2 min-w-0 flex-1`,children:[(0,k.jsx)(`span`,{className:`font-medium font-mono truncate`,children:t.username}),n&&(0,k.jsx)(`span`,{className:`badge badge-ghost badge-xs shrink-0`,children:e(`accounts.you`)})]}),(0,k.jsxs)(`select`,{className:`select select-xs select-bordered w-auto`,"aria-label":e(`accounts.role`),value:t.role,disabled:n,onChange:e=>q(t,e.target.value),children:[(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]}),(0,k.jsxs)(`div`,{className:`flex justify-end gap-1 w-full sm:w-auto`,children:[(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>{f(null),L(t.username)},children:e(`accounts.reset_password`)}),(0,k.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error`,disabled:n,onClick:()=>V(t.username),children:e(`accounts.delete`)})]})]},t.username)})})}),(0,k.jsx)(`form`,{onSubmit:G,children:(0,k.jsx)(E,{icon:(0,k.jsx)(s,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,k.jsx)(T,{children:(0,k.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:P||!p||!h||!!U,children:[P&&(0,k.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,k.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,k.jsx)(w,{label:e(`accounts.username`),children:(0,k.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:p,onChange:e=>m(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.password`),error:U||void 0,children:(0,k.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${U?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":U?!0:void 0,"aria-describedby":U?`accounts-password-error`:void 0,value:h,onChange:e=>v(e.target.value)})}),(0,k.jsx)(w,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,k.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,k.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,k.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})}),(0,k.jsx)(R,{}),(0,k.jsx)(M,{username:I,isSelf:I!==null&&Y(I),onClose:()=>L(null),onChanged:J},I??``),(0,k.jsx)(N,{username:B,onClose:()=>V(null),onConfirm:K})]}):(0,k.jsx)(C,{width:`wide`,children:(0,k.jsx)(b,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{B as default};

boneio-1.6.0.dev29/boneio/webui/frontend-dist/assets/AppInitContext-XnlT3sSY.js → boneio-1.6.0.dev30/boneio/webui/frontend-dist/assets/AppInitContext-D7KZMwlj.js

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{vn as t,yn as n}from"./fa-ChDOCx3T.js";import{n as r}from"./axios-DyqbZVcF.js";import{i}from"./configCache-DZ0vWq_Z.js";var a=e(n(),1),o=`boneio-provisioned`;function s(e){let t=e?.match(/\/(proxy\/\d+)\/?$/);return t?`${o}-${t[1].replace(`/`,`-`)}`:o}function c(e,t){try{return e?.getItem(s(t))===`1`}catch{return!1}}function l(e,t,n){try{e?.setItem(s(t),n?`0`:`1`)}catch{}}var u=`boneio-update`,d=`boneio-stale-reload`;function f(e,t){let n=t?.match(/\/(proxy\/\d+)\/?$/);return n?`${e}-${n[1].replace(`/`,`-`)}`:e}function p(e){if(!e)return null;let t=e.trim();return t.startsWith(`v`)?t.slice(1):t}function m(e,t,n){try{let r=e?.getItem(f(u,t));if(!r)return null;let i=JSON.parse(r);return typeof i?.startedAt!=`number`||typeof i.fromVersion!=`string`||n-i.startedAt>36e5||i.startedAt>n+6e4?null:i}catch{return null}}function h(e,t,n){try{e?.setItem(f(u,t),JSON.stringify(n))}catch{}}function g(e,t){try{e?.removeItem(f(u,t))}catch{}}function _(e,t,n){if(t)return e.wentDown||e.downSince===void 0?e:{...e,downSince:void 0};let r=e.downSince??n,i=!!e.wentDown||n-r>=15e3;return r===e.downSince&&i===!!e.wentDown?e:{...e,downSince:r,wentDown:i}}function v(e,t){let n=p(t);if(!n)return!1;let r=p(e.toVersion);return r?n===r:n!==p(e.fromVersion)}function y(e){let{reachable:t,serverVersion:n,panelVersion:r,mark:i}=e;if(!t)return i?`updating`:`probably_updating`;let a=p(n),o=p(r);return a&&o&&a!==o?`stale_panel`:i&&i.wentDown&&a&&!v(i,a)&&a===p(i.fromVersion)?`update_failed`:`ok`}function b(e,t){try{return e?.getItem(d)===t}catch{return!0}}function x(e,t){try{e?.setItem(d,t)}catch{}}var S=t(),C=(0,a.createContext)({data:null,isLoading:!0,isApiAvailable:!0,needsOnboarding:!1,panelState:`ok`,dismissPanelState:()=>{},refetch:async()=>{}});function w(){return(0,a.useContext)(C)}function T(e,t){return e||!!t?.needs_onboarding}var E=2,D=1e3,O=3e4,k=5e3,A=`boneio-stale-bypass`,j=`1.6.0.dev29`;function M(e){try{return window.sessionStorage.getItem(e)}catch{return null}}function N({children:e}){let[t,n]=(0,a.useState)(null),[o,s]=(0,a.useState)(!0),[c,u]=(0,a.useState)(!0),[d,f]=(0,a.useState)(!1),[p,b]=(0,a.useState)(`ok`),x=(0,a.useCallback)((e,t)=>{let n=window.__BONEIO_BASE_PATH__,r=Date.now(),i=m(window.localStorage,n,r);if(i){let t=_(i,e,r);t!==i&&h(window.localStorage,n,t),i=t}i&&e&&v(i,t)&&(g(window.localStorage,n),i=null);let a=y({reachable:e,serverVersion:t,panelVersion:j,mark:i});a===`stale_panel`&&t&&M(A)===t&&(a=`ok`),b(a)},[]),w=(0,a.useCallback)(()=>{g(window.localStorage,window.__BONEIO_BASE_PATH__);let e=t?.version;if(p===`stale_panel`&&e)try{window.sessionStorage.setItem(A,e)}catch{}b(`ok`)},[t?.version,p]),N=(0,a.useCallback)(async()=>{for(let e=0;e<=E;e++)try{let{data:e}=await r.get(`/api/init`);n(t=>t&&JSON.stringify(t)===JSON.stringify(e)?t:e),f(t=>T(t,e)),l(window.localStorage,window.__BONEIO_BASE_PATH__,!!e?.needs_onboarding),x(!0,e?.version??null),u(!0),s(!1),i();return}catch{e<E&&await new Promise(e=>setTimeout(e,D))}x(!1,null),u(!1),s(!1)},[x]);(0,a.useEffect)(()=>{N()},[N]);let P=!c||p===`stale_panel`;return(0,a.useEffect)(()=>{let e=setInterval(N,P?k:O);return()=>clearInterval(e)},[N,P]),(0,a.useEffect)(()=>{let e=()=>{document.visibilityState===`visible`&&N()};return document.addEventListener(`visibilitychange`,e),()=>document.removeEventListener(`visibilitychange`,e)},[N]),(0,S.jsx)(C.Provider,{value:{data:t,isLoading:o,isApiAvailable:c,needsOnboarding:d,panelState:p,dismissPanelState:w,refetch:N},children:e})}export{p as a,v as c,g as i,h as l,w as n,x as o,b as r,m as s,N as t,c as u};
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{vn as t,yn as n}from"./fa-ChDOCx3T.js";import{n as r}from"./axios-DyqbZVcF.js";import{i}from"./configCache-DZ0vWq_Z.js";var a=e(n(),1),o=`boneio-provisioned`;function s(e){let t=e?.match(/\/(proxy\/\d+)\/?$/);return t?`${o}-${t[1].replace(`/`,`-`)}`:o}function c(e,t){try{return e?.getItem(s(t))===`1`}catch{return!1}}function l(e,t,n){try{e?.setItem(s(t),n?`0`:`1`)}catch{}}var u=`boneio-update`,d=`boneio-stale-reload`;function f(e,t){let n=t?.match(/\/(proxy\/\d+)\/?$/);return n?`${e}-${n[1].replace(`/`,`-`)}`:e}function p(e){if(!e)return null;let t=e.trim();return t.startsWith(`v`)?t.slice(1):t}function m(e,t,n){try{let r=e?.getItem(f(u,t));if(!r)return null;let i=JSON.parse(r);return typeof i?.startedAt!=`number`||typeof i.fromVersion!=`string`||n-i.startedAt>36e5||i.startedAt>n+6e4?null:i}catch{return null}}function h(e,t,n){try{e?.setItem(f(u,t),JSON.stringify(n))}catch{}}function g(e,t){try{e?.removeItem(f(u,t))}catch{}}function _(e,t,n){if(t)return e.wentDown||e.downSince===void 0?e:{...e,downSince:void 0};let r=e.downSince??n,i=!!e.wentDown||n-r>=15e3;return r===e.downSince&&i===!!e.wentDown?e:{...e,downSince:r,wentDown:i}}function v(e,t){let n=p(t);if(!n)return!1;let r=p(e.toVersion);return r?n===r:n!==p(e.fromVersion)}function y(e){let{reachable:t,serverVersion:n,panelVersion:r,mark:i}=e;if(!t)return i?`updating`:`probably_updating`;let a=p(n),o=p(r);return a&&o&&a!==o?`stale_panel`:i&&i.wentDown&&a&&!v(i,a)&&a===p(i.fromVersion)?`update_failed`:`ok`}function b(e,t){try{return e?.getItem(d)===t}catch{return!0}}function x(e,t){try{e?.setItem(d,t)}catch{}}var S=t(),C=(0,a.createContext)({data:null,isLoading:!0,isApiAvailable:!0,needsOnboarding:!1,panelState:`ok`,dismissPanelState:()=>{},refetch:async()=>{}});function w(){return(0,a.useContext)(C)}function T(e,t){return e||!!t?.needs_onboarding}var E=2,D=1e3,O=3e4,k=5e3,A=`boneio-stale-bypass`,j=`1.6.0.dev30`;function M(e){try{return window.sessionStorage.getItem(e)}catch{return null}}function N({children:e}){let[t,n]=(0,a.useState)(null),[o,s]=(0,a.useState)(!0),[c,u]=(0,a.useState)(!0),[d,f]=(0,a.useState)(!1),[p,b]=(0,a.useState)(`ok`),x=(0,a.useCallback)((e,t)=>{let n=window.__BONEIO_BASE_PATH__,r=Date.now(),i=m(window.localStorage,n,r);if(i){let t=_(i,e,r);t!==i&&h(window.localStorage,n,t),i=t}i&&e&&v(i,t)&&(g(window.localStorage,n),i=null);let a=y({reachable:e,serverVersion:t,panelVersion:j,mark:i});a===`stale_panel`&&t&&M(A)===t&&(a=`ok`),b(a)},[]),w=(0,a.useCallback)(()=>{g(window.localStorage,window.__BONEIO_BASE_PATH__);let e=t?.version;if(p===`stale_panel`&&e)try{window.sessionStorage.setItem(A,e)}catch{}b(`ok`)},[t?.version,p]),N=(0,a.useCallback)(async()=>{for(let e=0;e<=E;e++)try{let{data:e}=await r.get(`/api/init`);n(t=>t&&JSON.stringify(t)===JSON.stringify(e)?t:e),f(t=>T(t,e)),l(window.localStorage,window.__BONEIO_BASE_PATH__,!!e?.needs_onboarding),x(!0,e?.version??null),u(!0),s(!1),i();return}catch{e<E&&await new Promise(e=>setTimeout(e,D))}x(!1,null),u(!1),s(!1)},[x]);(0,a.useEffect)(()=>{N()},[N]);let P=!c||p===`stale_panel`;return(0,a.useEffect)(()=>{let e=setInterval(N,P?k:O);return()=>clearInterval(e)},[N,P]),(0,a.useEffect)(()=>{let e=()=>{document.visibilityState===`visible`&&N()};return document.addEventListener(`visibilitychange`,e),()=>document.removeEventListener(`visibilitychange`,e)},[N]),(0,S.jsx)(C.Provider,{value:{data:t,isLoading:o,isApiAvailable:c,needsOnboarding:d,panelState:p,dismissPanelState:w,refetch:N},children:e})}export{p as a,v as c,g as i,h as l,w as n,x as o,b as r,m as s,N as t,c as u};