ipmg 2.1.0__tar.gz → 2.1.1__tar.gz

{ipmg-2.1.0/src/ipmg.egg-info → ipmg-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ipmg
-Version: 2.1.0
+Version: 2.1.1
 Summary: IP Management & Ping Monitoring CLI Tool
 Author: Sameer Alam
 Maintainer-email: Sameer Alam <sameeralam3127@gmail.com>
@@ -436,6 +436,12 @@ ipmg web               # starts http://127.0.0.1:8080 and opens your browser
 
 `ipmg --web` does the same thing, so whichever one you reach for first works.
 
+Each start creates a new access token. The browser opens with it already in
+the link, and IPMG Web prints that link (`http://127.0.0.1:8080/#token=…`)
+in the terminal. If you open IPMG Web in another browser, or after a
+restart, use the link from the terminal. To keep the same token across
+restarts, for example behind a reverse proxy, set `IPMG_WEB_TOKEN`.
+
 It runs fully offline — every stylesheet and script is bundled with the
 package, nothing is loaded from a CDN. It gives you:
 
@@ -465,12 +471,13 @@ it from your workstation with an SSH tunnel:
 
 ```bash
 ssh -L 8080:127.0.0.1:8080 user@server
-# then open http://127.0.0.1:8080 locally
+# then open the link the server printed (http://127.0.0.1:8080/#token=…) locally
 ```
 
-Alternatively, bind to all interfaces with `--host 0.0.0.0` — this exposes an
-unauthenticated API on the network, so only do this on a trusted network or
-behind a reverse proxy with authentication (see [Security](#security)).
+Alternatively, bind to all interfaces with `--host 0.0.0.0`. Every request
+still needs the access token. The traffic, token included, is plain HTTP,
+so on anything but a trusted network put a reverse proxy with TLS in front
+of it (see [Security](#security)).
 
 ---
 
@@ -612,15 +619,18 @@ itself is hardened accordingly:
   validated as an IP address first
 - IPMG Web binds to `127.0.0.1` by default and serves everything
   locally — no CDN assets, no outbound requests
-- WebSocket connections are origin-checked, so a web page you happen to
-  visit cannot connect to your local IPMG Web and read your scan results
+- Every API request and WebSocket needs the access token created when
+  IPMG Web starts, so other users on the machine and web pages you happen
+  to visit cannot start scans or read your results
+- WebSocket connections are also origin-checked, and a client that stops
+  reading live updates is disconnected rather than buffered without limit
 - Uploads are capped at 5 MB and one scan expands to at most 65,536 hosts,
   so a bad input file cannot exhaust memory
 - All database access uses parameterized SQL
 
-If you bind to a non-local address with `--host`, anyone who can reach that
-interface can start scans and read results — put a reverse proxy with
-authentication in front of it.
+If you bind to a non-local address with `--host`, the token still guards the
+API. It travels over plain HTTP, though, so use an SSH tunnel or a reverse
+proxy with TLS on any network you don't trust.
 
 Found a vulnerability? See [SECURITY.md](SECURITY.md) for how to report it.
 

{ipmg-2.1.0 → ipmg-2.1.1}/README.md

@@ -389,6 +389,12 @@ ipmg web               # starts http://127.0.0.1:8080 and opens your browser
 
 `ipmg --web` does the same thing, so whichever one you reach for first works.
 
+Each start creates a new access token. The browser opens with it already in
+the link, and IPMG Web prints that link (`http://127.0.0.1:8080/#token=…`)
+in the terminal. If you open IPMG Web in another browser, or after a
+restart, use the link from the terminal. To keep the same token across
+restarts, for example behind a reverse proxy, set `IPMG_WEB_TOKEN`.
+
 It runs fully offline — every stylesheet and script is bundled with the
 package, nothing is loaded from a CDN. It gives you:
 
@@ -418,12 +424,13 @@ it from your workstation with an SSH tunnel:
 
 ```bash
 ssh -L 8080:127.0.0.1:8080 user@server
-# then open http://127.0.0.1:8080 locally
+# then open the link the server printed (http://127.0.0.1:8080/#token=…) locally
 ```
 
-Alternatively, bind to all interfaces with `--host 0.0.0.0` — this exposes an
-unauthenticated API on the network, so only do this on a trusted network or
-behind a reverse proxy with authentication (see [Security](#security)).
+Alternatively, bind to all interfaces with `--host 0.0.0.0`. Every request
+still needs the access token. The traffic, token included, is plain HTTP,
+so on anything but a trusted network put a reverse proxy with TLS in front
+of it (see [Security](#security)).
 
 ---
 
@@ -565,15 +572,18 @@ itself is hardened accordingly:
   validated as an IP address first
 - IPMG Web binds to `127.0.0.1` by default and serves everything
   locally — no CDN assets, no outbound requests
-- WebSocket connections are origin-checked, so a web page you happen to
-  visit cannot connect to your local IPMG Web and read your scan results
+- Every API request and WebSocket needs the access token created when
+  IPMG Web starts, so other users on the machine and web pages you happen
+  to visit cannot start scans or read your results
+- WebSocket connections are also origin-checked, and a client that stops
+  reading live updates is disconnected rather than buffered without limit
 - Uploads are capped at 5 MB and one scan expands to at most 65,536 hosts,
   so a bad input file cannot exhaust memory
 - All database access uses parameterized SQL
 
-If you bind to a non-local address with `--host`, anyone who can reach that
-interface can start scans and read results — put a reverse proxy with
-authentication in front of it.
+If you bind to a non-local address with `--host`, the token still guards the
+API. It travels over plain HTTP, though, so use an SSH tunnel or a reverse
+proxy with TLS on any network you don't trust.
 
 Found a vulnerability? See [SECURITY.md](SECURITY.md) for how to report it.
 

{ipmg-2.1.0 → ipmg-2.1.1}/pyproject.toml

@@ -13,7 +13,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ipmg"
-version = "2.1.0"  # Managed automatically by semantic-release
+version = "2.1.1"  # Managed automatically by semantic-release
 description = "IP Management & Ping Monitoring CLI Tool"
 readme = "README.md"
 requires-python = ">=3.9"

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/__init__.py

@@ -2,4 +2,4 @@
 ipmg - IP Management & Ping Monitoring Tool
 """
 
-__version__ = "2.1.0"
+__version__ = "2.1.1"

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/core/engine.py

@@ -11,6 +11,11 @@ from ipmg.core.portscan import DEFAULT_PORTS, scan_ports
 from ipmg.exceptions import PingError
 from ipmg.utils.helpers import HostnameCache, clamp_int
 
+#: Upper bound on TCP connect probes in flight across a whole scan. Every host
+#: worker shares this one pool, so --scan-ports cannot create
+#: threads x ports probe threads.
+MAX_PORT_PROBE_WORKERS = 128
+
 
 @dataclass(frozen=True)
 class ScanConfig:
@@ -65,32 +70,27 @@ def execute_scan(
     cache = HostnameCache(config.dns_cache_ttl) if config.resolve else None
     results: List[HostResult] = []
 
+    port_executor: Optional[concurrent.futures.ThreadPoolExecutor] = None
+    if config.scan_ports and config.ports:
+        port_executor = concurrent.futures.ThreadPoolExecutor(
+            max_workers=min(MAX_PORT_PROBE_WORKERS, config.threads * len(config.ports)),
+            thread_name_prefix="ipmg-port",
+        )
+
     executor = concurrent.futures.ThreadPoolExecutor(max_workers=config.threads)
     try:
-        futures = {executor.submit(ping_ip, ip, config.timeout, config.count): ip for ip in ips}
+        futures = [executor.submit(_probe_host, ip, config, cache, port_executor) for ip in ips]
 
         for future in concurrent.futures.as_completed(futures):
             if should_stop is not None and should_stop():
                 executor.shutdown(wait=False, cancel_futures=True)
                 break
 
-            ip = futures[future]
             try:
-                status, latency = future.result()
+                result = future.result()
             except PingError:
                 executor.shutdown(wait=False, cancel_futures=True)
                 raise
-            except Exception:
-                status, latency = "Error", None
-
-            hostname = cache.resolve(ip) if cache else ""
-            open_ports: Tuple[int, ...] = ()
-            if config.scan_ports and status == "Active":
-                open_ports = tuple(scan_ports(ip, config.ports, config.port_timeout))
-
-            result = HostResult(
-                ip=ip, status=status, latency=latency, hostname=hostname, open_ports=open_ports
-            )
             results.append(result)
 
             if on_result is not None:
@@ -103,5 +103,38 @@ def execute_scan(
         raise
     finally:
         executor.shutdown(wait=True)
+        if port_executor is not None:
+            port_executor.shutdown(wait=True)
 
     return results
+
+
+def _probe_host(
+    ip: str,
+    config: ScanConfig,
+    cache: Optional[HostnameCache],
+    port_executor: Optional[concurrent.futures.Executor],
+) -> HostResult:
+    """Ping one host, then resolve its name and probe its ports.
+
+    Runs on a pool worker, so reverse DNS is spread across ``config.threads``
+    workers instead of running one host at a time on the thread that collects
+    results. Port probes go to the scan's shared, bounded ``port_executor``.
+    """
+    try:
+        status, latency = ping_ip(ip, config.timeout, config.count)
+    except PingError:
+        raise
+    except Exception:
+        status, latency = "Error", None
+
+    hostname = cache.resolve(ip) if cache else ""
+    open_ports: Tuple[int, ...] = ()
+    if config.scan_ports and status == "Active":
+        open_ports = tuple(
+            scan_ports(ip, config.ports, config.port_timeout, executor=port_executor)
+        )
+
+    return HostResult(
+        ip=ip, status=status, latency=latency, hostname=hostname, open_ports=open_ports
+    )

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/core/portscan.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import concurrent.futures
 import socket
-from typing import Iterable, List, Tuple
+from typing import Iterable, List, Optional, Tuple
 
 #: Common services worth a quick TCP connect once a host is known to be up.
 DEFAULT_PORTS: Tuple[int, ...] = (21, 22, 25, 53, 80, 443, 445, 1433, 3306, 3389, 5432)
@@ -65,18 +65,27 @@ def parse_port_list(value: str) -> Tuple[int, ...]:
     return tuple(ports)
 
 
-def scan_ports(ip: str, ports: Iterable[int], timeout: float = 1.0) -> List[int]:
-    """Probe ``ports`` on ``ip`` concurrently; return the ones that accepted a connection."""
+def scan_ports(
+    ip: str,
+    ports: Iterable[int],
+    timeout: float = 1.0,
+    executor: Optional[concurrent.futures.Executor] = None,
+) -> List[int]:
+    """Probe ``ports`` on ``ip`` concurrently; return the ones that accepted a connection.
+
+    Pass ``executor`` to share one bounded pool across many hosts; otherwise a
+    pool with one worker per port is created for this call.
+    """
     ports = list(ports)
     if not ports:
         return []
 
-    with concurrent.futures.ThreadPoolExecutor(max_workers=len(ports)) as executor:
-        futures = {executor.submit(_probe, ip, port, timeout): port for port in ports}
-        open_ports = [
-            futures[future]
-            for future in concurrent.futures.as_completed(futures)
-            if future.result()
-        ]
+    if executor is None:
+        with concurrent.futures.ThreadPoolExecutor(max_workers=len(ports)) as own:
+            return scan_ports(ip, ports, timeout, executor=own)
 
+    futures = {executor.submit(_probe, ip, port, timeout): port for port in ports}
+    open_ports = [
+        futures[future] for future in concurrent.futures.as_completed(futures) if future.result()
+    ]
     return sorted(open_ports)

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/utils/helpers.py

@@ -86,9 +86,13 @@ class HostnameCache:
             with self._lock:
                 return self._cache.get(ip, (0.0, "Unresolvable"))[1]
 
+        # Set before the lookup so the finally block always has a value to
+        # cache and always releases threads waiting on this IP.
+        hostname = "Unresolvable"
         try:
             hostname = socket.gethostbyaddr(ip)[0]
-        except OSError:
+        except Exception:
+            # Any lookup failure means "no name", never a failed scan.
             hostname = "Unresolvable"
         finally:
             with self._lock:

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/web/app.py

@@ -9,14 +9,15 @@ from __future__ import annotations
 import asyncio
 import io
 import json
+import secrets
 import tempfile
 from contextlib import asynccontextmanager
 from pathlib import Path
-from typing import Any, Dict, List, Optional
+from typing import Any, Callable, Dict, List, Mapping, Optional
 from urllib.parse import urlsplit
 
 import pandas as pd
-from fastapi import APIRouter, FastAPI, HTTPException, UploadFile, WebSocket
+from fastapi import APIRouter, Depends, FastAPI, HTTPException, Request, UploadFile, WebSocket
 from fastapi.responses import Response
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field
@@ -38,7 +39,7 @@ from ipmg.infrastructure.file_io import (
 from ipmg.reporting.diff_report import DIFF_FORMATS, render_diff
 from ipmg.reporting.frames import results_dataframe
 from ipmg.services.history_service import HistoryService
-from ipmg.web.manager import ScanManager
+from ipmg.web.manager import OVERFLOW, ScanManager
 
 STATIC_DIR = Path(__file__).parent / "static"
 
@@ -58,6 +59,63 @@ DIFF_MEDIA_TYPES = {fmt: REPORT_MEDIA_TYPES[fmt] for fmt in DIFF_FORMATS}
 #: Hostnames that count as "this machine" when checking WebSocket origins.
 _LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
 
+AUTH_ERROR = (
+    "Missing or invalid access token. Open IPMG Web with the link that "
+    "'ipmg web' printed when it started."
+)
+
+
+#: WebSocket subprotocol the server answers with. Browsers cannot set headers
+#: on a WebSocket, so the client offers ``ipmg`` plus ``ipmg.token.<token>``.
+WS_SUBPROTOCOL = "ipmg"
+_WS_AUTH_PREFIX = "ipmg.token."
+
+
+def _bearer_token(headers: Mapping[str, str]) -> Optional[str]:
+    """The token from an ``Authorization: Bearer`` header.
+
+    Tokens are never read from the URL: query strings end up in access logs,
+    proxy logs, and browser history.
+    """
+    scheme, _, credentials = headers.get("authorization", "").partition(" ")
+    if scheme.lower() == "bearer" and credentials.strip():
+        return credentials.strip()
+    return None
+
+
+def _websocket_token(websocket: WebSocket) -> Optional[str]:
+    """A Bearer header (non-browser clients) or the ``ipmg.token.`` subprotocol."""
+    token = _bearer_token(websocket.headers)
+    if token is not None:
+        return token
+    for protocol in websocket.scope.get("subprotocols", []):
+        if protocol.startswith(_WS_AUTH_PREFIX):
+            return protocol[len(_WS_AUTH_PREFIX) :]
+    return None
+
+
+def _token_valid(supplied: Optional[str], expected: str) -> bool:
+    return supplied is not None and secrets.compare_digest(
+        supplied.encode("utf-8"), expected.encode("utf-8")
+    )
+
+
+def _require_token(expected: str) -> Callable[[Request], None]:
+    """FastAPI dependency that rejects API requests without the access token.
+
+    Every API route requires it, on loopback too: it stops other users on the
+    machine, web pages attempting CSRF, and DNS-rebinding attacks from driving
+    the scanner, and makes a non-loopback --host safe to use.
+    """
+
+    def check(request: Request) -> None:
+        if not _token_valid(_bearer_token(request.headers), expected):
+            raise HTTPException(
+                status_code=401, detail=AUTH_ERROR, headers={"WWW-Authenticate": "Bearer"}
+            )
+
+    return check
+
 
 class ScanRequest(BaseModel):
     targets: Optional[str] = Field(default=None, description="Free-form target text")
@@ -335,19 +393,24 @@ def _origin_allowed(websocket: WebSocket) -> bool:
     return origin_host in _LOOPBACK_HOSTS and server_host in _LOOPBACK_HOSTS
 
 
-def _register_websocket(app: FastAPI, manager: ScanManager) -> None:
+def _register_websocket(app: FastAPI, manager: ScanManager, token: str) -> None:
     @app.websocket("/api/v1/ws")
     async def websocket_events(websocket: WebSocket) -> None:
-        if not _origin_allowed(websocket):
+        if not _origin_allowed(websocket) or not _token_valid(_websocket_token(websocket), token):
             await websocket.close(code=1008)
             return
 
-        await websocket.accept()
+        offered = websocket.scope.get("subprotocols", [])
+        await websocket.accept(subprotocol=WS_SUBPROTOCOL if WS_SUBPROTOCOL in offered else None)
         queue = manager.subscribe()
 
         async def forward_events() -> None:
             while True:
                 event = await queue.get()
+                if event is OVERFLOW:
+                    # 1013 "try again later": the client fell too far behind.
+                    await websocket.close(code=1013)
+                    return
                 await websocket.send_json(event)
 
         forward_task = asyncio.create_task(forward_events())
@@ -363,8 +426,10 @@ def _register_websocket(app: FastAPI, manager: ScanManager) -> None:
             manager.unsubscribe(queue)
 
 
-def create_app(db: Optional[Database] = None) -> FastAPI:
+def create_app(db: Optional[Database] = None, token: Optional[str] = None) -> FastAPI:
+    """Build the app. ``token`` guards every API route; a random one is made if omitted."""
     database = db if db is not None else Database(DEFAULT_DB_PATH)
+    token = token or secrets.token_urlsafe(32)
     manager = ScanManager(database)
     history = HistoryService(database)
 
@@ -377,8 +442,9 @@ def create_app(db: Optional[Database] = None) -> FastAPI:
     app.state.db = database
     app.state.manager = manager
     app.state.history = history
+    app.state.token = token
 
-    api = APIRouter(prefix="/api/v1")
+    api = APIRouter(prefix="/api/v1", dependencies=[Depends(_require_token(token))])
     _register_overview_routes(api, database)
     _register_scan_routes(api, database, manager)
     _register_report_routes(api, database)
@@ -386,7 +452,7 @@ def create_app(db: Optional[Database] = None) -> FastAPI:
     _register_upload_route(api)
     app.include_router(api)
 
-    _register_websocket(app, manager)
+    _register_websocket(app, manager, token)
 
     if STATIC_DIR.is_dir():
         app.mount("/", StaticFiles(directory=STATIC_DIR, html=True), name="static")

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/web/manager.py

@@ -11,6 +11,14 @@ from typing import Any, Dict, List, Optional, Set
 from ipmg.core.engine import HostResult, ScanConfig, execute_scan
 from ipmg.web.db import Database
 
+#: Events buffered per WebSocket subscriber. A client this far behind is
+#: disconnected instead of letting its backlog grow without bound; the browser
+#: reconnects and reloads the scan from the REST API.
+SUBSCRIBER_QUEUE_LIMIT = 1000
+
+#: Queued in place of an event to tell the WebSocket handler to close.
+OVERFLOW = None
+
 
 class ScanManager:
     def __init__(self, db: Database) -> None:
@@ -26,7 +34,7 @@ class ScanManager:
         self._loop = loop
 
     def subscribe(self) -> asyncio.Queue:
-        queue: asyncio.Queue = asyncio.Queue()
+        queue: asyncio.Queue = asyncio.Queue(maxsize=SUBSCRIBER_QUEUE_LIMIT)
         with self._lock:
             self._subscribers.add(queue)
         return queue
@@ -42,7 +50,21 @@ class ScanManager:
         with self._lock:
             queues = list(self._subscribers)
         for queue in queues:
-            loop.call_soon_threadsafe(queue.put_nowait, event)
+            loop.call_soon_threadsafe(self._offer, queue, event)
+
+    def _offer(self, queue: asyncio.Queue, event: Dict[str, Any]) -> None:
+        """Queue an event for one subscriber; runs on the event loop."""
+        with self._lock:
+            if queue not in self._subscribers:
+                return
+        if queue.full():
+            # The client is not reading. Drop its backlog and close it.
+            self.unsubscribe(queue)
+            while not queue.empty():
+                queue.get_nowait()
+            queue.put_nowait(OVERFLOW)
+            return
+        queue.put_nowait(event)
 
     # -------------------------------------------------------------- scans
 

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/web/server.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 
 import ipaddress
 import os
+import re
+import secrets
 import sys
 import threading
 import webbrowser
@@ -35,6 +37,26 @@ def _is_loopback(host: str) -> bool:
         return False
 
 
+#: Characters that survive a URL fragment and a WebSocket subprotocol unescaped.
+_TOKEN_PATTERN = re.compile(r"[A-Za-z0-9._~-]{16,}")
+
+
+def _access_token() -> str:
+    """``IPMG_WEB_TOKEN`` when set (e.g. behind a reverse proxy), else a fresh one.
+
+    Like Jupyter, every start gets a new random token unless one is pinned.
+    """
+    pinned = os.environ.get("IPMG_WEB_TOKEN", "").strip()
+    if not pinned:
+        return secrets.token_urlsafe(32)
+    if not _TOKEN_PATTERN.fullmatch(pinned):
+        raise SystemExit(
+            "IPMG_WEB_TOKEN must be at least 16 characters of letters, digits, '.', '_', '~' "
+            "or '-'. Generate one with: python -c \"import secrets; print(secrets.token_urlsafe(32))\""
+        )
+    return pinned
+
+
 def _has_display() -> bool:
     """False on a Linux session with no X11/Wayland display (e.g. over plain SSH)."""
     if sys.platform.startswith("linux"):
@@ -49,13 +71,16 @@ def run_dashboard(
     db_path: Optional[str] = None,
 ) -> None:
     database = Database(Path(db_path) if db_path else DEFAULT_DB_PATH)
-    app = create_app(database)
-    url = f"http://{_display_host(host)}:{port}"
+    token = _access_token()
+    app = create_app(database, token)
+    # The token goes in the fragment, which browsers never send to the server,
+    # so it stays out of access logs and proxies.
+    url = f"http://{_display_host(host)}:{port}/#token={token}"
 
     ui.blank()
     ui.fields(
         [
-            ("Local", url),
+            ("Open", url),
             ("History", database.path),
         ]
     )
@@ -68,9 +93,16 @@ def run_dashboard(
     elif open_browser:
         threading.Timer(1.0, webbrowser.open, args=(url,)).start()
 
+    ui.note("The link carries this session's access token; the API refuses requests without it.")
     if _is_loopback(host):
-        ui.note(f"Remote access: ssh -L {port}:127.0.0.1:{port} user@this-host, then open {url}.")
-        ui.note("Or run with --host 0.0.0.0 (exposes an unauthenticated API — see SECURITY.md).")
+        ui.note(
+            f"Remote access: ssh -L {port}:127.0.0.1:{port} user@this-host, then open the link."
+        )
+    else:
+        ui.note(
+            "Listening beyond this machine over plain HTTP: anyone who can see the traffic "
+            "can read the token. Prefer an SSH tunnel, or a reverse proxy with TLS (see SECURITY.md)."
+        )
 
     ui.blank()
 

{ipmg-2.1.0 → ipmg-2.1.1}/src/ipmg/web/static/index.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>IPMG Web</title>
-  <link rel="stylesheet" href="css/app.css?v=20260911.1">
+  <link rel="stylesheet" href="css/app.css?v=20260920.1">
   <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Ccircle cx='16' cy='16' r='13' fill='none' stroke='%232a78d6' stroke-width='3'/%3E%3Ccircle cx='16' cy='16' r='5' fill='%232a78d6'/%3E%3C/svg%3E">
 </head>
 <body>
@@ -60,6 +60,6 @@
   </div>
   <div id="tooltip" class="tooltip" hidden></div>
   <div id="toast-region" class="toast-region" aria-live="polite" aria-atomic="true"></div>
-  <script type="module" src="js/app.js?v=20260911.1"></script>
+  <script type="module" src="js/app.js?v=20260920.1"></script>
 </body>
 </html>