Merge pull request #332 from HeyPuter/release-please--branches--main--components--puter.com

chore(main): release 1.0.0

.commit

@@ -0,0 +1,6 @@
+# === FOR EMPTY COMMITS ===
+# Select reason for empty commit:
+- [ ] Add conventional commit message for changelog
+- [x] Forgot to use conventional commit style
+# Increment this value if nothing above was changed
+0

.env.example

@@ -1 +1 @@
-PORT=4000
+PORT=4000

.github/workflows/docker-image.yaml

@@ -5,8 +5,10 @@ name: Docker Image CI
 # branch called `main`.
 on:
   push:
-    branches: ['release']
-  
+    tags:
+      - '*.*.*'
+    # branches:
+    #   - 'release'
 
 # Defines two custom environment variables for the workflow. These are used
 # for the Container registry domain, and a name for the Docker image that
@@ -40,8 +42,8 @@ jobs:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-          
-      - name: Set up QEMU 
+
+      - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
@@ -56,16 +58,10 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
           tags: |
-            type=schedule
-            type=ref,event=branch
-            type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }}
-            type=sha
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
 
       # This step uses the `docker/build-push-action` action to build the
       # image, based on your repository's `Dockerfile`. If the build succeeds,
@@ -81,6 +77,8 @@ jobs:
         with:
           platforms: linux/amd64,linux/arm64
           context: .
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/lint.yml

@@ -1,6 +1,6 @@
-# This workflow runs the tools/check-translations.js script to make sure that the translation data is valid.
+# Lint PRs and pushes to the main branch
 
-name: Check Translations
+name: Lint
 
 env:
   NODE_VERSION: 21.x
@@ -13,7 +13,7 @@ on:
     branches: [ "main" ]
 
 jobs:
-  test:
+  build:
     runs-on: ubuntu-latest
 
     steps:
@@ -24,5 +24,10 @@ jobs:
         node-version: ${{ env.NODE_VERSION }}
         cache: 'npm'
         cache-dependency-path: ./package-lock.json
-    - run: npm ci
-    - run: npm run check-translations
+    - name: Install dependencies
+      run: npm ci
+    - name: Run ESLint
+      run: npx eslint
+    - name: Check translations
+      if: '!cancelled()'
+      run: npm run check-translations

.github/workflows/main.yml

@@ -0,0 +1,40 @@
+name: Maintain Release Merge PR
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  update-release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Git
+        run: |
+          git config user.name github-actions
+          git config user.email [email protected]
+      - name: Check for existing PR
+        id: find-pr
+        uses: juliangruber/find-pull-request-action@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          branch: release
+      - uses: actions/checkout@v4
+        if: steps.find-pr.outputs.number == ''
+        with:
+          ref: release
+      - name: Reset release branch
+        if: steps.find-pr.outputs.number == ''
+        run: |
+          git fetch origin main:main
+          git reset --hard main
+      - name: Create/Update PR
+        if: steps.find-pr.outputs.number == ''
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Update release branch
+          title: Merge Release Auto-PR
+          body: Merging this PR will invoke release actions          
+          branch: auto-update/release

.gitignore

@@ -1,12 +1,28 @@
+# Misc
 .DS_Store
+
+# Dependencies
 node_modules/
+
 *.zip
 *.tgz
 license.config.json
 license-header.txt
+
+# Build Outputs
 dist/
-.vscode/
+
+# VS Code IDE
+.vscode/**/*
+!.vscode/extensions.json
+!.vscode/launch.json
+!.vscode/settings.json
+!.vscode/tasks.json
+
+# Local env files
 .env
+!.env.example
+
 # this is for jetbrain IDEs
 .idea/
 /puter

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+    "cSpell.words": [
+        "dnsmasq",
+        "heyputer",
+        "Puter"
+    ]
+}

CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## 2.3.0 (2024-05-22)
+
+
+### Features
+
+* add /healthcheck endpoint ([c166560](https://github.com/HeyPuter/puter/commit/c166560ff4ab5a453d3ec4f97326c995deb7f522))
+* Add command names to phoenix tab-completion ([cf0eee1](https://github.com/HeyPuter/puter/commit/cf0eee1fa35328e05aefc8a425b5977efe5f4ec9))
+* add option to change desktop background to default ([03f05f3](https://github.com/HeyPuter/puter/commit/03f05f316f11e8afe5fcee40b2b80a0de5e6826f))
+* allow apps to add a menubar via puter.js ([331d9e7](https://github.com/HeyPuter/puter/commit/331d9e75428ec7609394f59b1755374c7340f83e))
+* Allow querying puter-apps driver by partial app names ([dc5b010](https://github.com/HeyPuter/puter/commit/dc5b010d0913d2151b4851f8da5df72d2c8f42e7))
+* Display upload errors in UIWindowProgress dialog ([edebbee](https://github.com/HeyPuter/puter/commit/edebbee9e7e9efbb33bf709b637c103be40d15a8))
+* Implement 'Like' predicate in entity storage ([a854a0d](https://github.com/HeyPuter/puter/commit/a854a0dc0aa79a31695db833184c5ca3698632a9))
+* improve password recovery experience ([04432df](https://github.com/HeyPuter/puter/commit/04432df5540811710ce1cc47ce6c136e5453bccb))
+* **security:** add ip rate limiting ([ccf1afc](https://github.com/HeyPuter/puter/commit/ccf1afc93c24ee7f9a126216209a185d6b4d9fe4))
+* Show "Deleting /foo" in progress window when deleting files ([f07c13a](https://github.com/HeyPuter/puter/commit/f07c13a50cee790eec44bce2f6e56fbcbf73f9b0))
+
+
+### Bug Fixes
+
+* Add missing file extension to 0009_app-prefix-fix.sql in DB init ([a8160a8](https://github.com/HeyPuter/puter/commit/a8160a8cdcdd6aff98728a6f1643d93386e6bb5a))
+* Add missing TextEncoder to PTT ([8d4a1e0](https://github.com/HeyPuter/puter/commit/8d4a1e0ed3872e2c82b9e4be9b6d8b359e9cea09))
+* Correct APIError imports ([062e23b](https://github.com/HeyPuter/puter/commit/062e23b5c9673db1f8b0ff0469289d52dd1e3f99))
+* Correct grep output when asking for line numbers ([c8a20ca](https://github.com/HeyPuter/puter/commit/c8a20cadbfd539d185d32f4558916825fcf265ba))
+* Correct inverted instanceof check in SignalReader.read() ([d4c2b49](https://github.com/HeyPuter/puter/commit/d4c2b492ef4864804776d3cb7d24797fdc536886))
+* Correct variables used in errors in sign.js ([fa7c6be](https://github.com/HeyPuter/puter/commit/fa7c6bee9699527028be0ae9759155bc67c52324))
+* Eliminates duplicate translation keys ([5800350](https://github.com/HeyPuter/puter/commit/5800350b253994dea410afff64e3df2a171e7775))
+* fix error handling for outdated node versions ([4c1d5a4](https://github.com/HeyPuter/puter/commit/4c1d5a4b6d009ce075897d499d3517219bd745a4))
+* Fix phoenix app prefix and TokenService test ([afb9d86](https://github.com/HeyPuter/puter/commit/afb9d866b5091058711db931cde904947e661c15))
+* increase QR code size ([d2de46e](https://github.com/HeyPuter/puter/commit/d2de46edfbc05d132d5c929f6935b82515fbbda0))
+* Make PathCommandProvider reject queries with path separators ([d733119](https://github.com/HeyPuter/puter/commit/d73311945610417a1ebc7bb0723ced0a599594b4))
+* Make url variable accessible to all users of it ([2f30ae7](https://github.com/HeyPuter/puter/commit/2f30ae7a825adcd8da95888c38fe39c34acee0ff))
+* Only run Component initialization functions once ([5b43358](https://github.com/HeyPuter/puter/commit/5b43358219402bee3eadf4a0f184a4b924d3293b))
+* Parse octal echo escapes ([6ad8f5e](https://github.com/HeyPuter/puter/commit/6ad8f5e06abd050d319271f818d72debf5bc8e44))
+* reduce token lengths ([5a76bad](https://github.com/HeyPuter/puter/commit/5a76bad28dfd8ec89a309941e410a54927fae22d))
+* reliability issue :bug: ([1d546d9](https://github.com/HeyPuter/puter/commit/1d546d9ef70ef9066ad5838e9782ae330d289f29))
+* Remove null or duplicate app entries from suggest_app_for_fsentry() ([6900233](https://github.com/HeyPuter/puter/commit/6900233c5aaa2d1a49f495e9f9a060796757a91e))
+* **security:** always use application/octet-stream ([74e213a](https://github.com/HeyPuter/puter/commit/74e213a534dbf2844c8cebeee7eb59ec70de306e))
+* **security:** Fix session revocation ([eb166a6](https://github.com/HeyPuter/puter/commit/eb166a67a9f0caf4fd77f9e27dc8209c2fc51f4c))
+* **security:** Move token for socket.io to request body ([49b257e](https://github.com/HeyPuter/puter/commit/49b257ecffbb1e12090b86a67528a5ad09da69db))
+* **security:** Prevent email enumeration ([ed70314](https://github.com/HeyPuter/puter/commit/ed703146863f896df76c98fad7127c6748c0ef9b))
+* **security:** skip cache when checking old passwd ([7800ef6](https://github.com/HeyPuter/puter/commit/7800ef61029c8d1ba47491b4028a0cb972298725))
+* **Terminal:** Accept input from Chrome on Android ([4ef3e53](https://github.com/HeyPuter/puter/commit/4ef3e53de34f0097950a7e707ca2483863beafb5))
+* test release-please action [#3](https://github.com/HeyPuter/puter/issues/3) ([8fb0a66](https://github.com/HeyPuter/puter/commit/8fb0a66ef21921990e564e5f61c0e80e7f929dc7))
+* test release-please action [#4](https://github.com/HeyPuter/puter/issues/4) ([f392de7](https://github.com/HeyPuter/puter/commit/f392de722a5232b622ed91b656a31cdc443c2e84))
+* typographical error :bug: ([2949f71](https://github.com/HeyPuter/puter/commit/2949f71691eb0a258888c5d2a5bb496d2fe64a23))
+* typographical errors :bug: ([4d30740](https://github.com/HeyPuter/puter/commit/4d30740198402cd1cc61b9ea4c45e006b69ec87e))
+* Use correct variable for version number ([52d5299](https://github.com/HeyPuter/puter/commit/52d52993744dffa9f7f59a232da5df9077560731))
+* use primary read in signup ([30f17ad](https://github.com/HeyPuter/puter/commit/30f17ade3a893d2283316e581836607e2029f9b9))
+
+## [2.2.0](https://github.com/HeyPuter/puter/compare/v2.1.1...v2.2.0) (2024-04-23)
+
+
+### Features
+
+* add /healthcheck endpoint ([c166560](https://github.com/HeyPuter/puter/commit/c166560ff4ab5a453d3ec4f97326c995deb7f522))
+* allow apps to add a menubar via puter.js ([331d9e7](https://github.com/HeyPuter/puter/commit/331d9e75428ec7609394f59b1755374c7340f83e))
+
 ## [2.1.1](https://github.com/HeyPuter/puter/compare/v2.1.0...v2.1.1) (2024-04-22)
 
 

README.md

@@ -31,7 +31,7 @@ Puter is an advanced, open-source internet operating system designed to be featu
 
 ## Getting Started
 
-After reading this section, please proceed to **Self-Hosting** and **Configuration** below.
+After reading this section, please proceed to [**Self-Hosting**](#%EF%B8%8F-self-hosting-%EF%B8%8F) and [**Configuration**](#configuration) below.
 Read these instructions carefully or you may see errors due to
 an invalid setup.
 
@@ -40,6 +40,7 @@ an invalid setup.
 ```bash
 git clone https://github.com/HeyPuter/puter
 cd puter
+cp .env.example .env
 npm install
 npm start
 ```
@@ -76,6 +77,19 @@ See [Configuration](#configuration) for next steps.
 ## ⚠️ Self-Hosting ⚠️
 The self-hosted version of Puter is currently in alpha stage and should not be used in production yet. It is under active development and may contain bugs, other issues. Please exercise caution and use it for testing and evaluation purposes only.
 
+### Self-Hosting Differences
+Currently, the self-hosted version of Puter is different in a few ways from [Puter.com](https://puter.com):
+- There is no built-in way to install or create other apps (see below)
+- Several "core" apps are missing, such as **Code** or **Draw**, because we can't include them in this repository
+- Some icons are different
+
+Work is ongoing to improve the **App Center** and make it available on self-hosted.
+Until then, it's possible to add other apps by manually editing the database file.
+This process is not recommended unless you know what you are doing.
+The file will appear after you first launch Puter, and should be found in `puter/data/puter-database.sqlite` for Docker,
+or `volatile/runtime/puter-database.sqlite` otherwise.
+You will need a database tool that can understand SQLite databases.
+
 <br/>
 
 ## Configuration

doc/contributors/extensions.md

@@ -0,0 +1,2 @@
+### `vscode`
+- `es6-string-html`

doc/self-hosters/domains.md

@@ -1,4 +1,4 @@
-# Configurating Domains for Self-Hosted Puter
+# Configuring Domains for Self-Hosted Puter
 
 ## Local Network Configuration
 
@@ -51,7 +51,7 @@ Setting up a local DNS server on your network allows for flexible and scalable d
 
 - **Pi-hole**: Acts as both an ad-blocker and a DNS server. Ideal for easy setup and maintenance.
 - **BIND9**: Offers comprehensive DNS server capabilities for complex setups.
-- **Dnsmasq**: Lightweight and suitable for smaller networks or those new to running a DNS server.
+- **dnsmasq**: Lightweight and suitable for smaller networks or those new to running a DNS server.
 
 **contributors note:** feel free to add any software you're aware of
 which might help with this to the list. Also, feel free to add instructions here for specific software; our goal is for Puter to be easy to setup with tools you're already familiar with.
@@ -60,7 +60,7 @@ which might help with this to the list. Also, feel free to add instructions here
 
 1. Choose and install DNS server software on a device within your network.
 2. Configure the DNS server to resolve `puter.local` and `api.puter.local` to the IP address of your Puter hosting device.
-3. Update your router’s DHCP settings to distribute the DNS server's IP address to all devices on the network.
+3. Update your router's DHCP settings to distribute the DNS server's IP address to all devices on the network.
 
 By setting up a local DNS server, you gain the most flexibility and control over your network's domain name resolution, ensuring that all devices can access Puter and its API without manual configuration.
 
@@ -68,5 +68,5 @@ By setting up a local DNS server, you gain the most flexibility and control over
 
 Please note the self-hosting feature is still in alpha and a public production
 deployment is not recommended at this time. However, if you wish to host
-publically you can do so following the same steps you normally would to configure
+publicly you can do so following the same steps you normally would to configure
 a domain name and ensuring the `api` subdomain points to the server as well.

eslint.config.js

@@ -0,0 +1,106 @@
+import js from "@eslint/js";
+import globals from "globals";
+
+export default [
+    js.configs.recommended,
+
+    {
+        // Global ignores
+        ignores: [
+            "**/*.min.js",
+            "**/src/lib/**",
+            "**/dist/",
+            "packages/backend/src/public/assets/**",
+        ],
+    },
+    {
+        // Top-level and tools use Node
+        files: [
+            "tools/**/*.js",
+        ],
+        languageOptions: {
+            globals: {
+                ...globals.node,
+            }
+        }
+    },
+    {
+        // Back end
+        files: [
+            "packages/backend/**/*.js",
+            "dev-server.js",
+            "utils.js",
+        ],
+        languageOptions: {
+            globals: {
+                ...globals.node,
+                "kv": true,
+            }
+        }
+    },
+    {
+        // Front end
+        files: [
+            "index.js",
+            "initgui.js",
+            "src/**/*.js",
+            "packages/**/*.js",
+        ],
+        ignores: [
+            "packages/backend/**/*.js",
+        ],
+        languageOptions: {
+            globals: {
+                ...globals.browser,
+                ...globals.commonjs,
+                "puter": true,
+                "i18n": true,
+                "html_encode": true,
+                "html_decode": true,
+                "isMobile": true,
+                // Libraries
+                "saveAs": true,         // FileSaver
+                "iro": true,            // iro.js color picker
+                "$": true,              // jQuery
+                "jQuery": true,         // jQuery
+                "JSZip": true,          // JSZip
+                "_": true,              // lodash
+                "QRCode": true,         // qrcode
+                "io": true,             // socket.io
+                "timeago": true,        // timeago
+                "SelectionArea": true,  // viselect
+            }
+        }
+    },
+    {
+        // Tests
+        files: [
+            "**/test/**/*.js",
+        ],
+        languageOptions: {
+            globals: {
+                ...globals.mocha,
+            }
+        }
+    },
+    {
+        // Phoenix
+        files: [
+            "packages/phoenix/**/*.js",
+        ],
+        languageOptions: {
+            globals: {
+                ...globals.node,
+            }
+        }
+    },
+    {
+        // Global rule settings
+        rules: {
+            "no-prototype-builtins": "off", // Complains about any use of hasOwnProperty()
+            "no-unused-vars": "off", // Temporary, we just have a lot of these
+            "no-debugger": "warn",
+            "no-async-promise-executor": "off",  // We do this quite often and it's fine
+        }
+    },
+];

package.json

@@ -1,6 +1,6 @@
 {
   "name": "puter.com",
-  "version": "2.1.1",
+  "version": "2.3.0",
   "author": "Puter Technologies Inc.",
   "license": "AGPL-3.0-only",
   "description": "Desktop environment in the browser!",
@@ -11,10 +11,13 @@
     "lib": "lib"
   },
   "devDependencies": {
+    "@eslint/js": "^9.1.1",
     "chalk": "^4.1.0",
     "clean-css": "^5.3.2",
     "dotenv": "^16.4.5",
+    "eslint": "^9.1.1",
     "express": "^4.18.2",
+    "globals": "^15.0.0",
     "html-entities": "^2.3.3",
     "nodemon": "^3.1.0",
     "uglify-js": "^3.17.4",

packages/backend/doc/contributors/boot-sequence.md

@@ -0,0 +1,87 @@
+# Puter Backend Boot Sequence
+
+This document describes the boot sequence of Puter's backend.
+
+**Constriction**
+  - Data structures are created
+
+**Initialization**
+  - Registries are populated
+  - Services prepare for next phase
+
+**Consolidation**
+  - Service event bus receives first event (`boot.consolidation`)
+  - Services perform coordinated setup behaviors
+  - Services prepare for next phase
+
+**Activation**
+  - Blocking listeners of `boot.consolidation` have resolved
+  - HTTP servers start listening
+
+**Ready**
+  - Services are informed that Puter is providing service
+
+## Boot Phases
+
+### Construction
+
+Services implement a method called `construct` which initializes members
+of an instance. Services do not override the class constructor of
+**BaseService**. This makes it possible to use the `new` operator without
+invoking a service's constructor behavior during debugging.
+
+The first phase of the boot sequence, "construction", is simply a loop to
+call `construct` on all registered services.
+
+The `_construct` override should not:
+- call other services
+- emit events
+
+### Initialization
+
+At initialization, the `init()` method is called on all services.
+The `_init` override can be used to:
+- register information with other services, when services don't
+  need to register this information in a specific sequence.
+  An example of this is registering commands with CommandService.
+- perform setup that is required before the consolidation phase starts.
+
+### Consolidation
+
+Consolidation is a phase where services should emit events that
+are related to bringing up the system. For example, WebServerService
+('web-server') emits an event telling services to install middlewares,
+and later emits an event telling services to install routes.
+
+Consolidation starts when Kernel emits `boot.consolidation` to the
+services event bus, which happens after `init()` resolves for all
+services.
+
+### Activation
+
+Activation is a phase where services begin listening on external
+interfaces. For example, this is when the web server starts listening.
+
+Activation starts when Kernel emits `boot.activation`.
+
+### Ready
+
+Ready is a phase where services are informed that everything is up.
+
+Ready starts when Kernel emits `boot.ready`.
+
+## Events and Asynchronous Execution
+
+The services event bus is implemented so you can `await` a call to `.emit()`.
+Event listeners can choose to have blocking behavior by returning a promise.
+
+During emission of a particular event, listeners of this event will not
+block each other, but all listeners must resolve before the call to
+`.emit()` is resolved. (i.e. `emit` uses `Promise.all`)
+
+## Legacy Services
+
+Some services were implemented before the `BaseService` class - which
+implements the `init` method - was created. These services are called
+"legacy services" and they are instantiated _after_ initialization but
+_before_ consolidation.

packages/backend/doc/contributors/index.md

@@ -55,8 +55,8 @@ If your answer is the second, you should find a way to
 In my experience, the harder I think about the correct way to implement
 something, the bigger a mistake I'm going to make; ***unless*** a big part
 of the reason I'm thinking so hard is because I want to find a solution
-that reduces complexity and has the right maintanence trade-off.
+that reduces complexity and has the right maintenance trade-off.
 There's no easy solution for this so just keep it in mind; there are some
 things we might write 2 times, 3 times, even more times over before we
 really get it right and *that's okay*; sometimes part of doing useful work is
-doing the useless work that reveals what the useful work is.
+doing the useless work that reveals what the useful work is.

packages/backend/exports.js

@@ -20,7 +20,7 @@ const CoreModule = require("./src/CoreModule.js");
 const { Kernel } = require("./src/Kernel.js");
 const DatabaseModule = require("./src/DatabaseModule.js");
 const LocalDiskStorageModule = require("./src/LocalDiskStorageModule.js");
-const SelfhostedModule = require("./src/SelfhostedModule.js");
+const SelfHostedModule = require("./src/SelfHostedModule.js");
 const PuterDriversModule = require("./src/PuterDriversModule.js");
 const { testlaunch } = require("./src/index.js");
 const BaseService = require("./src/services/BaseService.js");
@@ -45,5 +45,5 @@ module.exports = {
     DatabaseModule,
     PuterDriversModule,
     LocalDiskStorageModule,
-    SelfhostedModule,
+    SelfHostedModule,
 };

packages/backend/package.json

@@ -6,12 +6,10 @@
   "scripts": {
     "test": "npx mocha"
   },
-  "workspaces": [
-    "packages/*"
-  ],
   "dependencies": {
     "@heyputer/kv.js": "^0.1.3",
     "@heyputer/multest": "^0.0.2",
+    "@heyputer/puter-js-common": "^1.0.0",
     "@opentelemetry/api": "^1.4.1",
     "@opentelemetry/auto-instrumentations-node": "^0.43.0",
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.40.0",
@@ -30,11 +28,13 @@
     "composite-error": "^1.0.2",
     "compression": "^1.7.4",
     "cookie-parser": "^1.4.6",
+    "dedent": "^1.5.3",
     "express": "^4.18.2",
     "file-type": "^18.5.0",
     "form-data": "^4.0.0",
     "handlebars": "^4.7.8",
     "helmet": "^7.0.0",
+    "hi-base32": "^0.5.1",
     "html-entities": "^2.3.3",
     "is-glob": "^4.0.3",
     "isbot": "^3.7.1",
@@ -54,6 +54,7 @@
     "nodemailer": "^6.9.3",
     "on-finished": "^2.4.1",
     "openai": "^4.20.1",
+    "otpauth": "9.2.4",
     "prompt-sync": "^4.2.0",
     "recursive-readdir": "^2.2.3",
     "response-time": "^2.3.2",

packages/backend/packages/puter-js-common/README.md

@@ -1,7 +1,7 @@
 # Puter - Common Javascript Module
 
 This is a small module for javascript which you might call a
-"langauge tool"; it adds some behavior to make javascript classes
+"language tool"; it adds some behavior to make javascript classes
 more flexible, with an aim to avoid any significant complexity.
 
 Each class in this module is best described as an _idea_:
@@ -9,7 +9,7 @@ Each class in this module is best described as an _idea_:
 ### BasicBase
 
 **BasicBase** is the idea that there should be a common way to
-see the inheretence chain of the current instance, and obtain
+see the inheritance chain of the current instance, and obtain
 merged objects and arrays from static members of these classes.
 
 ### TraitBase

packages/backend/packages/puter-js-common/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "puter-js-common",
+  "name": "@heyputer/puter-js-common",
   "version": "1.0.0",
   "description": "",
   "main": "index.js",

packages/backend/src/CoreModule.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { Context } = require('./util/context');
 
 
@@ -192,6 +192,27 @@ const install = async ({ services, app }) => {
 
     const { SessionService } = require('./services/SessionService');
     services.registerService('session', SessionService);
+
+    const { EdgeRateLimitService } = require('./services/abuse-prevention/EdgeRateLimitService');
+    services.registerService('edge-rate-limit', EdgeRateLimitService);
+
+    const { Emailservice } = require('./services/EmailService');
+    services.registerService('email', Emailservice);
+
+    const { TokenService } = require('./services/auth/TokenService');
+    services.registerService('token', TokenService);
+
+    const { OTPService } = require('./services/auth/OTPService');
+    services.registerService('otp', OTPService);
+
+    const { UserProtectedEndpointsService } = require("./services/web/UserProtectedEndpointsService");
+    services.registerService('__user-protected-endpoints', UserProtectedEndpointsService);
+
+    const { AntiCSRFService } = require('./services/auth/AntiCSRFService');
+    services.registerService('anti-csrf', AntiCSRFService);
+
+    const { LockService } = require('./services/LockService');
+    services.registerService('lock', LockService);
 }
 
 const install_legacy = async ({ services }) => {
@@ -203,7 +224,6 @@ const install_legacy = async ({ services }) => {
     const { OperationTraceService } = require('./services/OperationTraceService');
     const { WSPushService } = require('./services/WSPushService');
     const { ReferralCodeService } = require('./services/ReferralCodeService');
-    const { Emailservice } = require('./services/EmailService');
     const { ClientOperationService } = require('./services/ClientOperationService');
     const { EngPortalService } = require('./services/EngPortalService');
     const { AppInformationService } = require('./services/AppInformationService');
@@ -217,7 +237,6 @@ const install_legacy = async ({ services }) => {
     services.registerService('operationTrace', OperationTraceService);
     services.registerService('__event-push-ws', WSPushService);
     services.registerService('referral-code', ReferralCodeService);
-    services.registerService('email', Emailservice);
     services.registerService('file-cache', FileCacheService);
     services.registerService('client-operation', ClientOperationService);
     services.registerService('app-information', AppInformationService);

packages/backend/src/DatabaseModule.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 
 class DatabaseModule extends AdvancedBase {
     async install (context) {

packages/backend/src/Kernel.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { Context } = require('./util/context');
 
 class Kernel extends AdvancedBase {
@@ -152,17 +152,7 @@ class Kernel extends AdvancedBase {
         const { services } = this;
 
         await services.ready;
-        {
-            const app = services.get('web-server').app;
-            app.use(async (req, res, next) => {
-                req.services = services;
-                next();
-            });
-            await services.emit('boot.services-initialized');
-            await services.emit('install.middlewares.context-aware', { app });
-            await services.emit('install.routes', { app });
-            await services.emit('install.routes-gui', { app });
-        }
+        await services.emit('boot.consolidation');
 
         // === END: Initialize Service Registry ===
 
@@ -178,9 +168,8 @@ class Kernel extends AdvancedBase {
             });
         })();
 
-
-        await services.emit('start.webserver');
-        await services.emit('ready.webserver');
+        await services.emit('boot.activation');
+        await services.emit('boot.ready');
     }
 }
 

packages/backend/src/LocalDiskStorageModule.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 
 class LocalDiskStorageModule extends AdvancedBase {
     async install (context) {

packages/backend/src/PuterDriversModule.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 
 class PuterDriversModule extends AdvancedBase {
     async install () {}

packages/backend/src/SelfHostedModule.js

@@ -1,7 +1,7 @@
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const config = require("./config");
 
-class SelfhostedModule extends AdvancedBase {
+class SelfHostedModule extends AdvancedBase {
     async install (context) {
         const services = context.get('services');
 
@@ -63,4 +63,4 @@ class SelfhostedModule extends AdvancedBase {
     }
 }
 
-module.exports = SelfhostedModule;
+module.exports = SelfHostedModule;

packages/backend/src/ThirdPartyDriversModule.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 
 class ThirdPartyDriversModule extends AdvancedBase {
     // constructor () {

packages/backend/src/api/APIError.js

@@ -220,6 +220,10 @@ module.exports = class APIError {
             status: 400,
             message: 'Missing fileinfo entry or BLOB for operation.',
         },
+        'invalid_file_metadata': {
+            status: 400,
+            message: 'Invalid file metadata.',
+        },
 
         // Open
         'no_suitable_app': {
@@ -319,6 +323,10 @@ module.exports = class APIError {
             status: 401,
             message: 'This authentication token is not supported here.',
         },
+        'token_expired': {
+            status: 401,
+            message: 'Authentication token has expired.',
+        },
         'account_suspended': {
             status: 403,
             message: 'Account suspended.',
@@ -331,6 +339,40 @@ module.exports = class APIError {
             status: 403,
             message: 'Attempted to create an access token with no permissions.',
         },
+        'invalid_action': {
+            status: 400,
+            message: ({ action }) => `Invalid action: ${quot(action)}.`,
+        },
+        '2fa_already_enabled': {
+            status: 409,
+            message: '2FA is already enabled.',
+        },
+        '2fa_not_configured': {
+            status: 409,
+            message: '2FA is not configured.',
+        },
+
+        // protected endpoints
+        'too_many_requests': {
+            status: 429,
+            message: 'Too many requests.',
+        },
+        'user_tokens_only': {
+            status: 403,
+            message: 'This endpoint must be requested with a user session',
+        },
+        'temporary_accounts_not_allowed': {
+            status: 403,
+            message: 'Temporary accounts cannot perform this action',
+        },
+        'password_required': {
+            status: 400,
+            message: 'Password is required.',
+        },
+        'password_mismatch': {
+            status: 403,
+            message: 'Password does not match.',
+        },
 
         // Object Mapping
         'field_not_allowed_for_create': {

packages/backend/src/api/filesystem/FlagParam.js

@@ -16,6 +16,8 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
+const APIError = require('../../api/APIError');
+
 module.exports = class FlagParam {
     constructor (srckey, options) {
         this.srckey = srckey;

packages/backend/src/api/filesystem/StringParam.js

@@ -16,6 +16,8 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
+const APIError = require('../../api/APIError');
+
 module.exports = class StringParam {
     constructor (srckey, options) {
         this.srckey = srckey;

packages/backend/src/boot/RuntimeEnvironment.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { quot } = require("../util/strutil");
 const { TechnicalError } = require("../errors/TechnicalError");
 const { print_error_help } = require("../errors/error_help_details");

packages/backend/src/config.js

@@ -62,6 +62,8 @@ config.thumb_width = 80;
 config.thumb_height = 80;
 config.app_max_icon_size = 5*1024*1024;
 
+config.defaultjs_asset_path = '../../';
+
 // config.origin = config.protocol + '://' + config.domain;
 // config.api_base_url = config.protocol + '://api.' + config.domain;
 // config.social_card = `${config.origin}/assets/img/screenshot.png`;

packages/backend/src/config/ConfigLoader.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { quot } = require("../util/strutil");
 
 class ConfigLoader extends AdvancedBase {

packages/backend/src/connective/data_model.js

@@ -1,25 +0,0 @@
-/*
- * Copyright (C) 2024 Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-{
-    registries: {
-        type: {
-            description: 'high-level types'
-        }
-    }
-}

packages/backend/src/filesystem/FilesystemService.js

@@ -27,7 +27,7 @@ const SystemFSEntryService = require('./storage/SystemFSEntryService.js');
 const PerformanceMonitor = require('../monitor/PerformanceMonitor.js');
 const { NodePathSelector, NodeUIDSelector, NodeInternalIDSelector } = require('./node/selectors.js');
 const FSNodeContext = require('./FSNodeContext.js');
-const { AdvancedBase } = require('puter-js-common');
+const { AdvancedBase } = require('@heyputer/puter-js-common');
 const { Context } = require('../util/context.js');
 const { simple_retry } = require('../util/retryutil.js');
 const APIError = require('../api/APIError.js');
@@ -138,7 +138,6 @@ class FilesystemService extends AdvancedBase {
                 return permission.startsWith('fs:');
             },
             checker: async (actor, permission) => {
-                debugger;
                 if ( !(actor.type instanceof UserActorType) ) {
                     return undefined;
                 }
@@ -363,7 +362,7 @@ class FilesystemService extends AdvancedBase {
             [new_path, old_path.length + 1, old_path + '%', user_id]
         );
 
-        const log = services.get('log-service').create('update_child_paths');
+        const log = this.services.get('log-service').create('update_child_paths');
         log.info(`updated ${old_path} -> ${new_path}`);
 
         monitor.end();

packages/backend/src/filesystem/batch/BatchExecutor.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require('puter-js-common');
+const { AdvancedBase } = require('@heyputer/puter-js-common');
 const PathResolver = require('../../routers/filesystem_api/batch/PathResolver');
 const commands = require('./commands').commands;
 const { WorkUnit } = require('../../services/runtime-analysis/ExpectationService');
@@ -118,7 +118,7 @@ class BatchExecutor extends AdvancedBase {
                         alarm: true,
                     });
 
-                    e = APIError.adapt(e);
+                    e = APIError.adapt(e); // eslint-disable-line no-ex-assign
                 }
 
                 // Consume stream if there's a file

packages/backend/src/filesystem/batch/commands.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { AsyncProviderTrait } = require("../../traits/AsyncProviderTrait");
 const { HLMkdir, QuickMkdir } = require("../hl_operations/hl_mkdir");
 const { Context } = require("../../util/context");

packages/backend/src/filesystem/hl_operations/hl_data_read.js

@@ -18,6 +18,9 @@
  */
 const { stream_to_buffer } = require("../../util/streamutil");
 const { HLFilesystemOperation } = require("./definitions");
+const { chkperm } = require('../../helpers');
+const { LLRead } = require('../ll_operations/ll_read');
+const APIError = require('../../api/APIError');
 
 /**
  * HLDataRead reads a stream of objects from a file containing structured data.
@@ -38,6 +41,7 @@ class HLDataRead extends HLFilesystemOperation {
 
         const {
             fsNode,
+            version_id,
         } = this.values;
 
         if ( ! await fsNode.exists() ) {
@@ -85,6 +89,7 @@ class HLDataRead extends HLFilesystemOperation {
     }
 
     _stream_jsonl_lines_to_objects (stream) {
+        const { PassThrough } = this.modules.stream;
         const output_stream = new PassThrough();
         (async () => {
             for await (const line of stream) {

packages/backend/src/filesystem/hl_operations/hl_mkdir.js

@@ -63,6 +63,7 @@ class MkTree extends HLFilesystemOperation {
 
     async _run () {
         const { values, context } = this;
+        const fs = context.get('services').get('filesystem');
 
         await this.create_branch_({
             parent_node: values.parent || await fs.node(new RootNodeSelector()),

packages/backend/src/filesystem/hl_operations/hl_move.js

@@ -17,7 +17,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 const APIError = require("../../api/APIError");
-const { chkperm, validate_fsentry_name, is_ancestor_of } = require("../../helpers");
+const { chkperm, validate_fsentry_name, is_ancestor_of, df, get_user } = require("../../helpers");
 const { LLMove } = require("../ll_operations/ll_move");
 const { RootNodeSelector } = require("../node/selectors");
 const { HLFilesystemOperation } = require("./definitions");

packages/backend/src/filesystem/hl_operations/hl_read.js

@@ -41,7 +41,7 @@ class HLRead extends HLFilesystemOperation {
         }
 
         const ll_read = new LLRead();
-        const stream = await ll_read.run({
+        let stream = await ll_read.run({
             fsNode, actor,
             version_id,
             ...(byte_count !== undefined ? {

packages/backend/src/filesystem/hl_operations/hl_stat.js

@@ -19,6 +19,7 @@
 const { chkperm } = require("../../helpers");
 const { Context } = require("../../util/context");
 const { HLFilesystemOperation } = require("./definitions");
+const APIError = require('../../api/APIError');
 
 class HLStat extends HLFilesystemOperation {
     static MODULES = {

packages/backend/src/filesystem/lib/PuterPath.js

@@ -64,10 +64,6 @@ class PuterPath {
         return ! this.isAbsolute();
     }
 
-    get hasRelativePortion () {
-
-    }
-
     get reference () {
         if ( this.isAbsolute ) return this.constructor.NULL_UUID;
 

packages/backend/src/filesystem/ll_operations/ll_copy_idea.js

@@ -30,6 +30,7 @@
     - easier to diagnose stuck operations
 
 */
+/* eslint-disable */
 
 const STEPS_COPY_CONTENTS = [
     {

packages/backend/src/filesystem/ll_operations/ll_read.js

@@ -91,7 +91,7 @@ class LLRead extends LLFilesystemOperation {
                 const context = a.iget('context');
                 const svc_fileCache = context.get('services').get('file-cache');
 
-                const { fsNode } = a.values();
+                const { fsNode, offset, length } = a.values();
 
                 const maybe_buffer = await svc_fileCache.try_get(fsNode, a.log);
                 if ( maybe_buffer ) {

packages/backend/src/filesystem/ll_operations/ll_rmnode.js

@@ -19,6 +19,7 @@
 const { Context } = require("../../util/context");
 const { ParallelTasks } = require("../../util/otelutil");
 const { LLFilesystemOperation } = require("./definitions");
+const APIError = require("../../api/APIError");
 
 class LLRmNode extends LLFilesystemOperation {
     async _run () {

packages/backend/src/filesystem/storage/DatabaseFSEntryService.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { id2path } = require("../../helpers");
 
 const { PuterPath } = require("../lib/PuterPath");

packages/backend/src/filesystem/storage/SystemFSEntryService.js

@@ -17,6 +17,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 const { PuterPath } = require("../lib/PuterPath");
+const _path = require('path');
 
 // Redis keys:
 // <env>:<service>:<class>:<type>:<property>:<id>

packages/backend/src/filesystem/validation.js

@@ -22,10 +22,12 @@ This module contains functions that validate filesystem operations.
 
 */
 
+/* eslint-disable no-control-regex */
+
 const config = require("../config");
 
 const path_excludes = () => /[\x00-\x1F]/g;
-const node_excludes = () => /[\/\x00-\x1F]/g;
+const node_excludes = () => /[/\x00-\x1F]/g;
 
 // this characters are not allowed in path names because
 // they might be used to trick the user into thinking

packages/backend/src/helpers.js

@@ -184,7 +184,7 @@ async function id2uuid(id){
 
     const cached = options.cached ?? true;
 
-    if ( cached ) {
+    if ( cached && ! options.force ) {
         if (options.username) user = kv.get('users:username:' + options.username);
         else if (options.email) user = kv.get('users:email:' + options.email);
         else if (options.uuid) user = kv.get('users:uuid:' + options.uuid);
@@ -194,16 +194,18 @@ async function id2uuid(id){
         if ( user ) return user;
     }
 
-    if(options.username)
-        user = await db.read("SELECT * FROM `user` WHERE `username` = ? LIMIT 1", [options.username]);
-    else if(options.email)
-        user = await db.read("SELECT * FROM `user` WHERE `email` = ? LIMIT 1", [options.email]);
-    else if(options.uuid)
-        user = await db.read("SELECT * FROM `user` WHERE `uuid` = ? LIMIT 1", [options.uuid]);
-    else if(options.id)
-        user = await db.read("SELECT * FROM `user` WHERE `id` = ? LIMIT 1", [options.id]);
-    else if(options.referral_code)
-        user = await db.read("SELECT * FROM `user` WHERE `referral_code` = ? LIMIT 1", [options.referral_code]);
+    if ( ! options.force ) {
+        if(options.username)
+            user = await db.read("SELECT * FROM `user` WHERE `username` = ? LIMIT 1", [options.username]);
+        else if(options.email)
+            user = await db.read("SELECT * FROM `user` WHERE `email` = ? LIMIT 1", [options.email]);
+        else if(options.uuid)
+            user = await db.read("SELECT * FROM `user` WHERE `uuid` = ? LIMIT 1", [options.uuid]);
+        else if(options.id)
+            user = await db.read("SELECT * FROM `user` WHERE `id` = ? LIMIT 1", [options.id]);
+        else if(options.referral_code)
+            user = await db.read("SELECT * FROM `user` WHERE `referral_code` = ? LIMIT 1", [options.referral_code]);
+    }
 
     if(!user || !user[0]){
         if(options.username)
@@ -679,7 +681,7 @@ const get_descendants_0 = async (path, user, depth, return_thumbnail = false) =>
             [user.id]
         );
         // users that have shared files/dirs with this user
-        sharing_users = await db.read(
+        const sharing_users = await db.read(
             `SELECT DISTINCT(owner_user_id), user.username
                 FROM share
                 INNER JOIN user ON user.id = share.owner_user_id
@@ -717,7 +719,7 @@ const get_descendants_0 = async (path, user, depth, return_thumbnail = false) =>
             return [];
 
         // shared files/dirs with this user
-        shared_fsentries = await db.read(
+        const shared_fsentries = await db.read(
             `SELECT
                 fsentries.id, fsentries.user_id, fsentries.uuid, fsentries.parent_uid, fsentries.bucket, fsentries.bucket_region,
                 fsentries.name, fsentries.shortcut_to, fsentries.is_shortcut, fsentries.metadata, fsentries.is_dir, fsentries.modified,
@@ -897,7 +899,7 @@ const get_descendants = async (...args) => {
         if ( ! result || ! result[0] ) {
             errors.report('id2path.select', {
                 alarm: true,
-                message: `no result for ${entry_uid}: ${e.message}`,
+                message: `no result for ${entry_uid}`,
                 extra: {
                     entry_uid,
                 }
@@ -951,12 +953,12 @@ function cp(source_path, dest_path, user, overwrite, change_name, check_perms =
     throw new Error(`legacy copy function called`);
 }
 
-isString =  function (variable) {
+function isString(variable) {
     return typeof variable === 'string' || variable instanceof String;
 }
 
 // checks to see if given variable is an object
-isObject = function (variable) {
+function isObject(variable) {
     return variable !== null && typeof variable === 'object';
 }
 
@@ -1144,8 +1146,8 @@ async function jwt_auth(req){
     else if(req.query && req.query.auth_token)
         token = req.query.auth_token;
     // Socket
-    else if(req.handshake && req.handshake.query && req.handshake.query.auth_token)
-        token = req.handshake.query.auth_token;
+    else if(req.handshake && req.handshake.auth && req.handshake.auth.auth_token)
+        token = req.handshake.auth.auth_token;
 
     if(!token || token === 'null')
         throw('No auth token found');
@@ -1545,56 +1547,16 @@ async function generate_system_fsentries(user){
 }
 
 function send_email_verification_code(email_confirm_code, email){
-    const nodemailer = require("nodemailer");
-
-    // send email notif
-    let transporter = nodemailer.createTransport({
-        host: config.smtp_server,
-        port: config.smpt_port,
-        secure: true, // STARTTLS
-        auth: {
-            user: config.smtp_username,
-            pass: config.smtp_password,
-        },
-    });
-
-    transporter.sendMail({
-        from: '"Puter" [email protected]', // sender address
-        to: email, // list of receivers
-        subject: `${hyphenize_confirm_code(email_confirm_code)} is your confirmation code`, // Subject line
-        html: `<p>Hi there,</p>
-            <p><strong>${hyphenize_confirm_code(email_confirm_code)}</strong> is your email confirmation code.</p>
-            <p>Sincerely,</p>
-            <p>Puter</p>
-        `,
-    });
+    const svc_email = Context.get('services').get('email');
+    svc_email.send_email({ email }, 'email_verification_code', {
+        code: hyphenize_confirm_code(email_confirm_code),
+    })
 }
 
 function send_email_verification_token(email_confirm_token, email, user_uuid){
-    const nodemailer = require("nodemailer");
-
-    // send email notif
-    let transporter = nodemailer.createTransport({
-        host: config.smtp_server,
-        port: config.smpt_port,
-        secure: true, // STARTTLS
-        auth: {
-            user: config.smtp_username,
-            pass: config.smtp_password,
-        },
-    });
-
-    let link = `${config.origin}/confirm-email-by-token?user_uuid=${user_uuid}&token=${email_confirm_token}`;
-    transporter.sendMail({
-        from: '"Puter" [email protected]', // sender address
-        to: email, // list of receivers
-        subject: `Please confirm your email`, // Subject line
-        html: `<p>Hi there,</p>
-            <p>Please confirm your email address using this link: <strong><a href="${link}">${link}</a></strong>.</p>
-            <p>Sincerely,</p>
-            <p>Puter</p>
-        `,
-    });
+    const svc_email = Context.get('services').get('email');
+    const link = `${config.origin}/confirm-email-by-token?user_uuid=${user_uuid}&token=${email_confirm_token}`;
+    svc_email.send_email({ email }, 'email_verification_link', { link });
 }
 
 async function generate_random_username(){
@@ -1808,7 +1770,15 @@ async function suggest_app_for_fsentry(fsentry, options){
     monitor.end();
 
     // return list
-    return suggested_apps;
+    return suggested_apps.filter((suggested_app, pos, self) => {
+        // Remove any null values caused by calling `get_app()` for apps that don't exist.
+        // This happens on self-host because we don't include `code`, among others.
+        if (!suggested_app)
+            return false;
+
+        // Remove any duplicate entries
+        return self.indexOf(suggested_app) === pos;
+    });
 }
 
 function build_item_object(item){
@@ -1847,7 +1817,7 @@ async function get_taskbar_items(user) {
         try {
             taskbar_items_from_db = JSON.parse(user.taskbar_items);
         }catch(e){
-
+            // ignore errors
         }
     }
 

packages/backend/src/om/IdentifierUtil.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { WeakConstructorTrait } = require("../traits/WeakConstructorTrait");
 const { Eq, And } = require("./query/query");
 const { Entity } = require("./entitystorage/Entity");

packages/backend/src/om/definitions/Mapping.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { instance_ } = require("../../monitor/PerformanceMonitor");
 const { WeakConstructorTrait } = require("../../traits/WeakConstructorTrait");
 const { Property } = require("./Property");

packages/backend/src/om/definitions/PropType.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { WeakConstructorTrait } = require("../../traits/WeakConstructorTrait");
 
 class PropType extends AdvancedBase {

packages/backend/src/om/definitions/Property.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { WeakConstructorTrait } = require("../../traits/WeakConstructorTrait");
 
 class Property extends AdvancedBase {

packages/backend/src/om/entitystorage/AppES.js

@@ -23,7 +23,7 @@ const { AppUnderUserActorType } = require("../../services/auth/Actor");
 const { DB_WRITE } = require("../../services/database/consts");
 const { Context } = require("../../util/context");
 const { origin_from_url } = require("../../util/urlutil");
-const { Eq, Or } = require("../query/query");
+const { Eq, Like, Or } = require("../query/query");
 const { BaseES } = require("./BaseES");
 
 const uuidv4 = require('uuid').v4;
@@ -34,13 +34,19 @@ class AppES extends BaseES {
             const services = this.context.get('services');
             this.db = services.get('database').get(DB_WRITE, 'apps');
         },
-        async create_predicate (id) {
+        async create_predicate (id, ...args) {
             if ( id === 'user-can-edit' ) {
                 return new Eq({
                     key: 'owner',
                     value: Context.get('user').id,
                 });
             }
+            if ( id === 'name-like' ) {
+                return new Like({
+                    key: 'name',
+                    value: args[0],
+                });
+            }
         },
         async delete (uid, extra) {
             const svc_appInformation = this.context.get('services').get('app-information');

packages/backend/src/om/entitystorage/BaseES.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { WeakConstructorTrait } = require("../../traits/WeakConstructorTrait");
 const { Context } = require("../../util/context");
 

packages/backend/src/om/entitystorage/Entity.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { WeakConstructorTrait } = require("../../traits/WeakConstructorTrait");
 
 class Entity extends AdvancedBase {

packages/backend/src/om/entitystorage/SQLES.js

@@ -16,13 +16,13 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { BaseES } = require("./BaseES");
 
 const APIError = require("../../api/APIError");
 const { Entity } = require("./Entity");
 const { WeakConstructorTrait } = require("../../traits/WeakConstructorTrait");
-const { And, Or, Eq, Predicate, Null, PredicateUtil } = require("../query/query");
+const { And, Or, Eq, Like, Null, Predicate, PredicateUtil } = require("../query/query");
 const { DB_WRITE } = require("../../services/database/consts");
 
 class RawCondition extends AdvancedBase {
@@ -355,6 +355,22 @@ class SQLES extends BaseES {
 
                 return new RawCondition({ sql, values });
             }
+
+            if ( om_query instanceof Like ) {
+                const key = om_query.key;
+                let value = om_query.value;
+                const prop = this.om.properties[key];
+
+                value = await prop.sql_reference(value);
+
+                const options = prop.descriptor.sql ?? {};
+                const col_name = options.column_name ?? prop.name;
+
+                const sql = `${col_name} LIKE ?`;
+                const values = [value];
+
+                return new RawCondition({ sql, values });
+            }
         }
     }
 }

packages/backend/src/om/entitystorage/ValidationES.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { BaseES } = require("./BaseES");
 
 const APIError = require("../../api/APIError");
@@ -86,6 +86,7 @@ class ValidationES extends BaseES {
                 } catch ( e ) {
                     if ( ! (e instanceof APIError) ) {
                         console.log('THIS IS HAPPENING', e);
+                        // eslint-disable-next-line no-ex-assign
                         e = APIError.create('field_invalid', null, {
                             key: prop.name,
                             converted_from_another_error: true,

packages/backend/src/om/proptypes/__all__.js

@@ -163,7 +163,7 @@ module.exports = {
         },
         async adapt (value, { descriptor }) {
             if ( descriptor.debug ) {
-                debugger;
+                debugger; // eslint-disable-line no-debugger
             }
             if ( ! descriptor.service ) return value;
             if ( ! value ) return null;

packages/backend/src/om/query/query.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const { WeakConstructorTrait } = require("../../traits/WeakConstructorTrait");
 
 class Predicate extends AdvancedBase {
@@ -50,6 +50,15 @@ class Eq extends Predicate {
     }
 }
 
+class Like extends Predicate {
+    async check (entity) {
+        // Convert SQL LIKE pattern to RegExp
+        // TODO: Support escaping the pattern characters
+        const regex = new RegExp(this.value.replaceAll('%', '.*').replaceAll('_', '.'), 'i');
+        return regex.test(await entity.get(this.key));
+    }
+}
+
 Predicate.prototype.and = function (other) {
     return new And({ children: [this, other] });
 }
@@ -105,4 +114,5 @@ module.exports = {
     And,
     Or,
     Eq,
+    Like,
 };

packages/backend/src/routers/_default.js

@@ -26,6 +26,7 @@ const auth = require('../middleware/auth.js');
 const { generate_puter_page_html } = require('../temp/puter_page_loader');
 const { Context } = require('../util/context');
 const { DB_READ } = require('../services/database/consts');
+const { PathBuilder } = require('../util/pathutil.js');
 
 let auth_user;
 
@@ -46,7 +47,7 @@ router.all('*', async function(req, res, next) {
     // cloud.js must be accessible globally regardless of subdomain
     // --------------------------------------
     else if (path === '/cloud.js') {
-        return res.sendFile(_path.join(__dirname, '../../puter.js/alpha.js'), function (err) {
+        return res.sendFile(_path.join(__dirname, config.defaultjs_asset_path, 'puter.js/alpha.js'), function (err) {
             if (err && err.statusCode) {
                 return res.status(err.statusCode).send('Error /cloud.js')
             }
@@ -56,14 +57,14 @@ router.all('*', async function(req, res, next) {
     // /puter.js/v1 must be accessible globally regardless of subdomain
     // --------------------------------------
     else if (path === '/puter.js/v1' || path === '/puter.js/v1/') {
-        return res.sendFile(_path.join(__dirname, '../../puter.js/v1.js'), function (err) {
+        return res.sendFile(_path.join(__dirname, config.defaultjs_asset_path, 'puter.js/v1.js'), function (err) {
             if (err && err.statusCode) {
                 return res.status(err.statusCode).send('Error /puter.js')
             }
         });
     }
     else if (path === '/puter.js/v2' || path === '/puter.js/v2/') {
-        return res.sendFile(_path.join(__dirname, '../../puter.js/v2.js'), function (err) {
+        return res.sendFile(_path.join(__dirname, config.defaultjs_asset_path, 'puter.js/v2.js'), function (err) {
             if (err && err.statusCode) {
                 return res.status(err.statusCode).send('Error /puter.js')
             }
@@ -74,14 +75,14 @@ router.all('*', async function(req, res, next) {
     // --------------------------------------
     else if( subdomain === 'js'){
         if (path === '/v1' || path === '/v1/') {
-            return res.sendFile(_path.join(__dirname, '../../puter.js/v1.js'), function (err) {
+            return res.sendFile(_path.join(__dirname, config.defaultjs_asset_path, 'puter.js/v1.js'), function (err) {
                 if (err && err.statusCode) {
                     return res.status(err.statusCode).send('Error /puter.js')
                 }
             });
         }
         if (path === '/v2' || path === '/v2/') {
-            return res.sendFile(_path.join(__dirname, '../../puter.js/v2.js'), function (err) {
+            return res.sendFile(_path.join(__dirname, config.defaultjs_asset_path, 'puter.js/v2.js'), function (err) {
                 if (err && err.statusCode) {
                     return res.status(err.statusCode).send('Error /puter.js')
                 }
@@ -176,7 +177,7 @@ router.all('*', async function(req, res, next) {
                 const user = await get_user({uuid: req.query.user_uuid})
 
                 // more validation
-                if(user === undefined || user === null || user === false)
+                if(!user)
                     h += '<p style="text-align:center; color:red;">User not found.</p>';
                 else if(user.unsubscribed === 1)
                     h += '<p style="text-align:center; color:green;">You are already unsubscribed.</p>';
@@ -208,7 +209,7 @@ router.all('*', async function(req, res, next) {
                 const {get_user} = require('../helpers')
 
                 // get user
-                const user = await get_user({uuid: req.query.user_uuid})
+                const user = await get_user({uuid: req.query.user_uuid, force: true})
 
                 // more validation
                 if(user === undefined || user === null || user === false)
@@ -219,6 +220,13 @@ router.all('*', async function(req, res, next) {
                     h += '<p style="text-align:center; color:red;">invalid token.</p>';
                 // mark user as confirmed
                 else{
+                    // If other users have the same unconfirmed email, revoke it
+                    await db.write(
+                        'UPDATE `user` SET `unconfirmed_change_email` = NULL, `change_email_confirm_token` = NULL WHERE `unconfirmed_change_email` = ?',
+                        [user.email],
+                    );
+
+                    // update user
                     await db.write(
                         "UPDATE `user` SET `email_confirmed` = 1, `requires_email_confirmation` = 0 WHERE id = ?",
                         [user.id]
@@ -246,6 +254,7 @@ router.all('*', async function(req, res, next) {
         // /assets/
         // ------------------------
         else if (path.startsWith('/assets/')) {
+            path = PathBuilder.resolve(path);
             return res.sendFile(path, { root: __dirname + '../../public' }, function (err) {
                 if (err && err.statusCode) {
                     return res.status(err.statusCode).send('Error /public/')
@@ -338,7 +347,7 @@ router.all('*', async function(req, res, next) {
 
             // /dist/...
             else if(path.startsWith('/dist/') || path.startsWith('/src/')){
-                path = _path.resolve(path);
+                path = PathBuilder.resolve(path);
                 return res.sendFile(path, {root: config.assets.gui}, function(err){
                     if(err && err.statusCode){
                         return res.status(err.statusCode).send('Error /gui/dist/')
@@ -348,6 +357,7 @@ router.all('*', async function(req, res, next) {
 
             // All other paths
             else{
+                path = PathBuilder.resolve(path);
                 return res.sendFile(path, {root: _path.join(config.assets.gui, 'src')}, function(err){
                     if(err && err.statusCode){
                         return res.status(err.statusCode).send('Error /gui/')
@@ -364,7 +374,11 @@ router.all('*', async function(req, res, next) {
             subdomain === 'draw' || subdomain === 'camera' || subdomain === 'recorder' ||
             subdomain === 'dev-center' || subdomain === 'terminal'){
 
-        let root = _path.join(__dirname, '../../apps/', subdomain);
+        let root = PathBuilder
+            .add(__dirname)
+            .add(config.defaultjs_asset_path, { allow_traversal: true })
+            .add('apps').add(subdomain)
+            .build();
         if ( subdomain === 'docs' ) root += '/dist';
         root = _path.normalize(root);
 
@@ -402,7 +416,7 @@ router.all('*', async function(req, res, next) {
             });
         } catch (e) {
             console.error('error from sendFile', e);
-            return res.status(err.statusCode).send('Error /apps/')
+            return res.status(e.statusCode).send('Error /apps/')
         }
     }
     // --------------------------------------

packages/backend/src/routers/auth/configure-2fa.js

@@ -0,0 +1,123 @@
+const APIError = require("../../api/APIError");
+const eggspress = require("../../api/eggspress");
+const { get_user } = require("../../helpers");
+const { UserActorType } = require("../../services/auth/Actor");
+const { DB_WRITE } = require("../../services/database/consts");
+const { Context } = require("../../util/context");
+
+module.exports = eggspress('/auth/configure-2fa/:action', {
+    subdomain: 'api',
+    auth2: true,
+    allowedMethods: ['POST'],
+}, async (req, res, next) => {
+    const action = req.params.action;
+    const x = Context.get();
+
+    // Only users can configure 2FA
+    const actor = Context.get('actor');
+    if ( ! (actor.type instanceof UserActorType) ) {
+        throw APIError.create('forbidden');
+    }
+
+    const user = actor.type.user;
+
+    const actions = {};
+
+    const db = await x.get('services').get('database').get(DB_WRITE, '2fa');
+
+    actions.setup = async () => {
+        const user = await get_user({ id: req.user.id, force: true });
+
+        if ( user.otp_enabled ) {
+            throw APIError.create('2fa_already_enabled');
+        }
+
+        const svc_otp = x.get('services').get('otp');
+
+        // generate secret
+        const result = svc_otp.create_secret(user.username);
+
+        // generate recovery codes
+        result.codes = [];
+        for ( let i = 0; i < 10; i++ ) {
+            result.codes.push(svc_otp.create_recovery_code());
+        }
+
+        const hashed_recovery_codes = result.codes.map(code => {
+            const crypto = require('crypto');
+            const hash = crypto
+                .createHash('sha256')
+                .update(code)
+                .digest('base64')
+                // We're truncating the hash for easier storage, so we have 128
+                // bits of entropy instead of 256. This is plenty for recovery
+                // codes, which have only 48 bits of entropy to begin with.
+                .slice(0, 22);
+            return hash;
+        });
+
+        // update user
+        await db.write(
+            `UPDATE user SET otp_secret = ?, otp_recovery_codes = ? WHERE uuid = ?`,
+            [result.secret, hashed_recovery_codes.join(','), user.uuid]
+        );
+        req.user.otp_secret = result.secret;
+        req.user.otp_recovery_codes = hashed_recovery_codes.join(',');
+        user.otp_secret = result.secret;
+        user.otp_recovery_codes = hashed_recovery_codes.join(',');
+
+        return result;
+    };
+
+    // IMPORTANT: only use to verify the user's 2FA setup;
+    // this should never be used to verify the user's 2FA code
+    // for authentication purposes.
+    actions.test = async () => {
+        const user = req.user;
+        const svc_otp = x.get('services').get('otp');
+        const code = req.body.code;
+        const ok = svc_otp.verify(user.username, user.otp_secret, code);
+        return { ok };
+    };
+
+    actions.enable = async () => {
+        const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+        if ( ! svc_edgeRateLimit.check('enable-2fa') ) {
+            return res.status(429).send('Too many requests.');
+        }
+
+        const user = await get_user({ id: req.user.id, force: true });
+
+        // Verify that 2FA isn't already enabled
+        if ( user.otp_enabled ) {
+            throw APIError.create('2fa_already_enabled');
+        }
+
+        // Verify that TOTP secret was set (configuration step not skipped)
+        if ( ! user.otp_secret ) {
+            throw APIError.create('2fa_not_configured');
+        }
+
+        await db.write(
+            `UPDATE user SET otp_enabled = 1 WHERE uuid = ?`,
+            [user.uuid]
+        );
+        // update cached user
+        req.user.otp_enabled = 1;
+
+        const svc_email = req.services.get('email');
+        await svc_email.send_email({ email: user.email }, 'enabled_2fa', {
+            username: user.username,
+        });
+
+        return {};
+    };
+
+    if ( ! actions[action] ) {
+        throw APIError.create('invalid_action', null, { action });
+    }
+
+    const result = await actions[action]();
+
+    res.json(result);
+});

packages/backend/src/routers/auth/list-permissions.js

@@ -21,6 +21,7 @@ const { get_app, get_user } = require("../../helpers");
 const { UserActorType } = require("../../services/auth/Actor");
 const { DB_READ } = require("../../services/database/consts");
 const { Context } = require("../../util/context");
+const APIError = require('../../api/APIError');
 
 module.exports = eggspress('/auth/list-permissions', {
     subdomain: 'api',

packages/backend/src/routers/auth/list-sessions.js

@@ -1,6 +1,7 @@
 const eggspress = require("../../api/eggspress");
 const { UserActorType } = require("../../services/auth/Actor");
 const { Context } = require("../../util/context");
+const APIError = require('../../api/APIError');
 
 module.exports = eggspress('/auth/list-sessions', {
     subdomain: 'api',

packages/backend/src/routers/auth/revoke-user-app.js

@@ -19,6 +19,7 @@
 const eggspress = require("../../api/eggspress");
 const { UserActorType } = require("../../services/auth/Actor");
 const { Context } = require("../../util/context");
+const APIError = require('../../api/APIError');
 
 module.exports = eggspress('/auth/revoke-user-app', {
     subdomain: 'api',

packages/backend/src/routers/change_email.js

@@ -28,62 +28,6 @@ const config = require('../config.js');
 const jwt = require('jsonwebtoken');
 const { invalidate_cached_user_by_id } = require('../helpers.js');
 
-const CHANGE_EMAIL_START = eggspress('/change_email/start', {
-    subdomain: 'api',
-    auth: true,
-    verified: true,
-    allowedMethods: ['POST'],
-}, async (req, res, next) => {
-    const user = req.user;
-    const new_email = req.body.new_email;
-
-    // TODO: DRY: signup.js
-    // validation
-    if( ! new_email ) {
-        throw APIError.create('field_missing', null, { key: 'new_email' });
-    }
-    if ( typeof new_email !== 'string' ) {
-        throw APIError.create('field_invalid', null, {
-            key: 'new_email', expected: 'a valid email address' });
-    }
-    if ( ! validator.isEmail(new_email) ) {
-        throw APIError.create('field_invalid', null, {
-            key: 'new_email', expected: 'a valid email address' });
-    }
-
-    // check if email is already in use
-    const db = req.services.get('database').get(DB_WRITE, 'auth');
-    const rows = await db.read(
-        'SELECT COUNT(*) AS `count` FROM `user` WHERE `email` = ?',
-        [new_email]
-    );
-    if ( rows[0].count > 0 ) {
-        throw APIError.create('email_already_in_use', null, { email: new_email });
-    }
-
-    // generate confirmation token
-    const token = crypto.randomBytes(4).toString('hex');
-    const jwt_token = jwt.sign({
-        user_id: user.id,
-        token,
-    }, config.jwt_secret, { expiresIn: '24h' });
-
-    // send confirmation email
-    const svc_email = req.services.get('email');
-    await svc_email.send_email({ email: new_email }, 'email_change_request', {
-        confirm_url: `${config.origin}/change_email/confirm?token=${jwt_token}`,
-        username: user.username,
-    });
-
-    // update user
-    await db.write(
-        'UPDATE `user` SET `unconfirmed_change_email` = ?, `change_email_confirm_token` = ? WHERE `id` = ?',
-        [new_email, token, user.id]
-    );
-
-    res.send({ success: true });
-});
-
 const CHANGE_EMAIL_CONFIRM = eggspress('/change_email/confirm', {
     allowedMethods: ['GET'],
 }, async (req, res, next) => {
@@ -93,6 +37,11 @@ const CHANGE_EMAIL_CONFIRM = eggspress('/change_email/confirm', {
         throw APIError.create('field_missing', null, { key: 'token' });
     }
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('change-email-confirm') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     const { token, user_id } = jwt.verify(jwt_token, config.jwt_secret);
 
     const db = req.services.get('database').get(DB_WRITE, 'auth');
@@ -104,10 +53,25 @@ const CHANGE_EMAIL_CONFIRM = eggspress('/change_email/confirm', {
         throw APIError.create('token_invalid');
     }
 
+    // Scenario: email was confirmed on another account already
+    const rows2 = await db.read(
+        'SELECT `id` FROM `user` WHERE `email` = ?',
+        [rows[0].unconfirmed_change_email]
+    );
+    if ( rows2.length > 0 ) {
+        throw APIError.create('email_already_in_use');
+    }
+
+    // If other users have the same unconfirmed email, revoke it
+    await db.write(
+        'UPDATE `user` SET `unconfirmed_change_email` = NULL, `change_email_confirm_token` = NULL WHERE `unconfirmed_change_email` = ?',
+        [rows[0].unconfirmed_change_email]
+    );
+
     const new_email = rows[0].unconfirmed_change_email;
 
     await db.write(
-        'UPDATE `user` SET `email` = ?, `unconfirmed_change_email` = NULL, `change_email_confirm_token` = NULL WHERE `id` = ?',
+        'UPDATE `user` SET `email` = ?, `unconfirmed_change_email` = NULL, `change_email_confirm_token` = NULL, `pass_recovery_token` = NULL WHERE `id` = ?',
         [new_email, user_id]
     );
 
@@ -122,6 +86,5 @@ const CHANGE_EMAIL_CONFIRM = eggspress('/change_email/confirm', {
 });
 
 module.exports = app => {
-    app.use(CHANGE_EMAIL_START);
     app.use(CHANGE_EMAIL_CONFIRM);
 }

packages/backend/src/routers/change_username.js

@@ -54,6 +54,11 @@ module.exports = eggspress('/change_username', {
     if(await username_exists(req.body.new_username))
         throw APIError.create('username_already_in_use', null, { username: req.body.new_username });
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('change-email-start') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     const db = Context.get('services').get('database').get(DB_WRITE, 'auth');
 
     // Has the user already changed their username twice this month?

packages/backend/src/routers/confirm-email.js

@@ -22,6 +22,7 @@ const { invalidate_cached_user } = require('../helpers');
 const router = new express.Router();
 const auth = require('../middleware/auth.js');
 const { DB_WRITE } = require('../services/database/consts');
+const APIError = require('../api/APIError.js');
 
 // -----------------------------------------------------------------------//
 // POST /confirm-email
@@ -34,6 +35,11 @@ router.post('/confirm-email', auth, express.json(), async (req, res, next)=>{
     if(!req.body.code)
         req.status(400).send('code is required');
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('confirm-email') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     // Modules
     const db = req.services.get('database').get(DB_WRITE, 'auth');
 
@@ -43,6 +49,22 @@ router.post('/confirm-email', auth, express.json(), async (req, res, next)=>{
     // Set expiry for rate limit
     kv.expire(`confirm-email|${req.ip}|${req.body.email ?? req.body.username}`, 60 * 10, 'NX')
 
+    // Scenario: email was confirmed on another account already
+    const rows = await db.read(
+        'SELECT `id` FROM `user` WHERE `email` = ? AND `email_confirmed` = 1',
+        [req.body.email],
+    );
+    if ( rows.length > 0 ) {
+        APIError.create('email_already_in_use').write(res);
+        return;
+    }
+
+    // If other users have the same unconfirmed email, revoke it
+    await db.write(
+        'UPDATE `user` SET `unconfirmed_change_email` = NULL, `change_email_confirm_token` = NULL WHERE `unconfirmed_change_email` = ?',
+        [req.user.email],
+    );
+
     if(req.body.code === req.user.email_confirm_code) {
         await db.write(
             "UPDATE `user` SET `email_confirmed` = 1, `requires_email_confirmation` = 0 WHERE id = ? LIMIT 1",

packages/backend/src/routers/contactUs.js

@@ -32,10 +32,6 @@ router.post('/contactUs', auth, express.json(), async (req, res, next)=>{
     if(require('../helpers').subdomain(req) !== 'api')
         next();
 
-    // check if user is verified
-    if((config.strict_email_verification_required || req.user.requires_email_confirmation) && !req.user.email_confirmed)
-        return res.status(400).send({code: 'account_is_not_verified', message: 'Account is not verified'});
-
     // message is required
     if(!req.body.message)
         return res.status(400).send({message: 'message is required'})
@@ -46,6 +42,11 @@ router.post('/contactUs', auth, express.json(), async (req, res, next)=>{
     else if(req.body.message.length > 100000)
         return res.status(400).send({message: 'message is too long'})
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('contact-us') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     // modules
     const db = req.services.get('database').get(DB_WRITE, 'feedback');
 
@@ -66,20 +67,8 @@ router.post('/contactUs', auth, express.json(), async (req, res, next)=>{
         let user = await get_user({id: req.user.id});
 
         // send email to support
-        const nodemailer = require("nodemailer");
-
-        // send email notif
-        let transporter = nodemailer.createTransport({
-            host: config.smtp_server,
-            port: config.smpt_port,
-            secure: true, // STARTTLS
-            auth: {
-                user: config.smtp_username,
-                pass: config.smtp_password,
-            },
-        });
-
-        transporter.sendMail({
+        const svc_email = req.services.get('email');
+        svc_email.sendMail({
             from: '"Puter" [email protected]', // sender address
             to: '[email protected]', // list of receivers
             replyTo: user.email === null ? undefined : user.email,

packages/backend/src/routers/delete-site.js

@@ -40,7 +40,6 @@ router.post('/delete-site', auth, express.json(), async (req, res, next)=>{
         return res.status(400).send('site_uuid is required')
 
     // modules
-    const {} = require('../helpers');
     const db = req.services.get('database').get(DB_WRITE, 'subdomains:legacy');
 
     await db.write(

packages/backend/src/routers/down.js

@@ -11,7 +11,7 @@ const { HLRead } = require('../filesystem/hl_operations/hl_read.js');
 // -----------------------------------------------------------------------//
 // GET /down
 // -----------------------------------------------------------------------//
-router.get('/down', auth, fs, express.json(), async (req, res, next)=>{
+router.post('/down', auth, fs, express.json(), async (req, res, next)=>{
     // check subdomain
     if(require('../helpers').subdomain(req) !== 'api')
         next();
@@ -20,6 +20,12 @@ router.get('/down', auth, fs, express.json(), async (req, res, next)=>{
     if((config.strict_email_verification_required || req.user.requires_email_confirmation) && !req.user.email_confirmed)
         return res.status(400).send({code: 'account_is_not_verified', message: 'Account is not verified'});
 
+    // check anti-csrf token
+    const svc_antiCSRF = req.services.get('anti-csrf');
+    if ( ! svc_antiCSRF.consume_token(req.user.uuid, req.body.anti_csrf) ) {
+        return res.status(400).json({ message: 'incorrect anti-CSRF token' });
+    }
+
     // validation
     if(!req.query.path)
         return res.status(400).send('path is required')

packages/backend/src/routers/drivers/usage.js

@@ -143,7 +143,7 @@ module.exports = eggspress('/drivers/usage', {
         // usages.apps.push(usage);
     }
 
-    for ( k in usages.apps ) {
+    for ( const k in usages.apps ) {
         usages.apps[k] = Object.values(usages.apps[k]);
     }
 

packages/backend/src/routers/drivers/xd.js

@@ -65,8 +65,9 @@ const script = async function script () {
         return await response.json();
     };
 
+    /* global window */
     window.addEventListener('message', async event => {
-        const { id, interface, method, params } = event.data;
+        const { id, interface: interface_, method, params } = event.data;
         let has_file = false;
         for ( const k in params ) {
             if ( params[k] instanceof File ) {
@@ -75,11 +76,11 @@ const script = async function script () {
             }
         }
         const result = has_file ? await fcall({
-            interface_name: interface,
+            interface_name: interface_,
             method_name: method,
             params,
         }) : await call({
-            interface_name: interface,
+            interface_name: interface_,
             method_name: method,
             params,
         });

packages/backend/src/routers/file.js

@@ -96,7 +96,7 @@ router.get('/file', async (req, res, next)=>{
     res.resource_owner = fsentry[0].user_id;
 
     // try to deduce content-type
-    const contentType = mime.contentType(fsentry[0].name)
+    const contentType = "application/octet-stream";
 
     // update `accessed`
     db.write(

packages/backend/src/routers/filesystem_api/batch/all.js

@@ -26,6 +26,7 @@ const Busboy = require('busboy');
 const { BatchExecutor } = require("../../../filesystem/batch/BatchExecutor");
 const { TeePromise } = require("../../../util/promise");
 const { EWMA, MovingMode } = require("../../../util/opmath");
+const { get_app } = require('../../../helpers');
 
 const commands = require('../../../filesystem/batch/commands.js').commands;
 
@@ -191,7 +192,11 @@ module.exports = eggspress('/batch', {
             }
 
             if ( fieldname === 'fileinfo' ) {
-                fileinfos.push(JSON.parse(value));
+                const fileinfo = JSON.parse(value);
+                if ( fileinfo.size < 0 ) {
+                    throw APIError.create('invalid_file_metadata');
+                }
+                fileinfos.push(fileinfo);
                 return;
             }
 
@@ -221,28 +226,6 @@ module.exports = eggspress('/batch', {
     let ps = [];
 
     busboy.on('file', async (fieldname, stream, detais) => {
-        if (false) {
-            ended[i] = false;
-            ps[i] = new TeePromise();
-            const this_i = i;
-            stream.on('end', () => {
-                ps[this_i].resolve();
-                ended[this_i] = true;
-                batch_widget.ec++;
-            });
-            if ( i > 0 ) {
-                if ( ! ended[i-1] ) {
-                    batch_widget.sc++;
-                    // stream.pause();
-                    batch_widget.wc++;
-                    await Promise.all(Array(i).fill(0).map((_, j) => ps[j]));
-                    batch_widget.wc--;
-                    // stream.resume();
-                }
-            }
-            i++;
-        }
-
         if ( batch_exe.total_tbd ) {
             batch_exe.total_tbd = false;
             batch_widget.ic = pending_operations.length;

packages/backend/src/routers/filesystem_api/copy.js

@@ -66,18 +66,6 @@ module.exports = eggspress('/copy', {
         x.set(operationTraceSvc.ckey('frame'), frame);
     }
 
-    // TEMP: Testing copy with its own sql queue
-    if ( false ) {
-        const x = Context.get();
-        const svc = new ProxyContainer(x.get('services'));
-        const s = new DatabaseFSEntryService({
-            services: x.get('services'),
-            label: 'Copy-DatabaseFSEntryService',
-        });
-        svc.set('systemFSEntryService', s);
-        x.set('services', svc);
-    }
-
     const log = req.services.get('log-service').create('copy');
     const filesystem = req.services.get('filesystem');
 
@@ -103,7 +91,6 @@ module.exports = eggspress('/copy', {
             source: req.values.source,
             new_name: req.body.new_name,
 
-            new_name: req.body.new_name,
             overwrite: req.body.overwrite ?? false,
             dedupe_name,
 

packages/backend/src/routers/filesystem_api/read.js

@@ -74,15 +74,4 @@ module.exports = eggspress('/read', {
     res.set('Content-Type', 'application/octet-stream');
 
     stream.pipe(res);
-
-    return;
-
-    const filesystem = req.services.get('filesystem');
-    await filesystem.read(req.fs, res, {
-        ...req.values,
-        user: req.user,
-        version_id: req.query.version_id,
-        line_count,
-        byte_count,
-    });
 });

packages/backend/src/routers/filesystem_api/token-read.js

@@ -49,12 +49,10 @@ module.exports = eggspress('/token-read', {
     const actor = await svc_auth.authenticate_from_token(access_jwt);
 
     if ( ! actor ) {
-        throw new Error('A');
         throw APIError.create('token_auth_failed');
     }
 
     if ( ! (actor.type instanceof AccessTokenActorType) ) {
-        throw new Error('B');
         throw APIError.create('token_auth_failed');
     }
 
@@ -98,16 +96,5 @@ module.exports = eggspress('/token-read', {
     res.setHeader('Content-Type', mime_type);
 
     stream.pipe(res);
-
-    return;
-
-    const filesystem = req.services.get('filesystem');
-    await filesystem.read(req.fs, res, {
-        ...req.values,
-        user: req.user,
-        version_id: req.query.version_id,
-        line_count,
-        byte_count,
-    });
 });
 

packages/backend/src/routers/healthcheck.js

@@ -16,16 +16,17 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-class Registry {
-    constructor() {
-        this._registry = {};
-    }
+"use strict"
+const express = require('express');
+const router = new express.Router();
 
-    put(name, value) {
-        this._registry[name] = value;
-    }
+// -----------------------------------------------------------------------// 
+// GET /healthcheck
+// -----------------------------------------------------------------------//
+router.get('/healthcheck', async (req, res) => {
+    const svc_serverHealth = req.services.get('server-health');
 
-    get(name) {
-        return this._registry[name];
-    }
-}
+    const status = await svc_serverHealth.get_status();
+    res.json(status);
+})
+module.exports = router

packages/backend/src/routers/hosting/puter-site.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 const api_error_handler = require("../../api/api_error_handler");
 const config = require("../../config");
 const { get_user, get_app, id2path } = require("../../helpers");
@@ -62,7 +62,7 @@ class PuterSiteMiddleware extends AdvancedBase {
             req.subdomains[0] === 'devtest' ? 'devtest' :
             req.hostname.slice(0, -1 * (config.static_hosting_domain.length + 1));
 
-        let path = (req.baseUrl + req.path) ?? 'index.html';
+        let path = (req.baseUrl + req.path) || 'index.html';
 
         const context = Context.get();
         const services = context.get('services');

packages/backend/src/routers/kvstore/clearItems.js

@@ -38,6 +38,8 @@ module.exports = eggspress('/clearItems', {
     }
 
     const svc_mysql = req.services.get('mysql');
+    // TODO: Check if used anywhere, maybe remove
+    // eslint-disable-next-line no-undef
     const dbrw = svc_mysql.get(DB_MODE_WRITE, 'kvstore-clearItems');
     await dbrw.execute(
         `DELETE FROM kv WHERE user_id=? AND app=?`,

packages/backend/src/routers/login.js

@@ -21,6 +21,36 @@ const express = require('express');
 const router = new express.Router();
 const { get_user, body_parser_error_handler } = require('../helpers');
 const config = require('../config');
+const { DB_WRITE } = require('../services/database/consts');
+
+
+const complete_ = async ({ req, res, user }) => {
+    const svc_auth = req.services.get('auth');
+    const { token } = await svc_auth.create_session_token(user, { req });
+
+    //set cookie
+    // res.cookie(config.cookie_name, token);
+    res.cookie(config.cookie_name, token, {
+        sameSite: 'none',
+        secure: true,
+        httpOnly: true,
+    });
+
+    // send response
+    console.log('200 response?');
+    return res.send({
+        proceed: true,
+        next_step: 'complete',
+        token: token,
+        user:{
+            username: user.username,
+            uuid: user.uuid,
+            email: user.email,
+            email_confirmed: user.email_confirmed,
+            is_temp: (user.password === null && user.email === null),
+        }
+    })
+};
 
 // -----------------------------------------------------------------------//
 // POST /file
@@ -32,7 +62,6 @@ router.post('/login', express.json(), body_parser_error_handler, async (req, res
 
     // modules
     const bcrypt = require('bcrypt')
-    const jwt = require('jsonwebtoken')
     const validator = require('validator')
 
     // either username or email must be provided
@@ -60,11 +89,10 @@ router.post('/login', express.json(), body_parser_error_handler, async (req, res
     else if(req.body.email && !validator.isEmail(req.body.email))
         return res.status(400).send('Invalid email.')
 
-    // Increment & check rate limit
-    if(kv.incr(`login|${req.ip}|${req.body.email ?? req.body.username}`) > 10)
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('login') ) {
         return res.status(429).send('Too many requests.');
-    // Set expiry for rate limit
-    kv.expire(`login|${req.ip}|${req.body.email ?? req.body.username}`, 60*10, 'NX')
+    }
 
     try{
         let user;
@@ -89,34 +117,156 @@ router.post('/login', express.json(), body_parser_error_handler, async (req, res
             return res.status(400).send('Incorrect password.')
         // check password
         if(await bcrypt.compare(req.body.password, user.password)){
-            const svc_auth = req.services.get('auth');
-            const { token } = await svc_auth.create_session_token(user, { req });
-            //set cookie
-            // res.cookie(config.cookie_name, token);
-            res.cookie(config.cookie_name, token, {
-                sameSite: 'none',
-                secure: true,
-                httpOnly: true,
-            });
+            // We create a JWT that can ONLY be used on the endpoint that
+            // accepts the OTP code.
+            if ( user.otp_enabled ) {
+                const svc_token = req.services.get('token');
+                const otp_jwt_token = svc_token.sign('otp', {
+                    user_uid: user.uuid,
+                }, { expiresIn: '5m' });
 
-            // send response
-            return res.send({
-                token: token,
-                user:{
-                    username: user.username,
-                    uuid: user.uuid,
-                    email: user.email,
-                    email_confirmed: user.email_confirmed,
-                    is_temp: (user.password === null && user.email === null),
-                }
-            })
+                return res.status(202).send({
+                    proceed: true,
+                    next_step: 'otp',
+                    otp_jwt_token: otp_jwt_token,
+                });
+            }
+
+            console.log('UMM?');
+            return await complete_({ req, res, user });
         }else{
             return res.status(400).send('Incorrect password.')
         }
     }catch(e){
+        console.error(e);
         return res.status(400).send(e);
     }
 
 })
 
-module.exports = router
+router.post('/login/otp', express.json(), body_parser_error_handler, async (req, res, next) => {
+    // either api. subdomain or no subdomain
+    if(require('../helpers').subdomain(req) !== 'api' && require('../helpers').subdomain(req) !== '')
+        next();
+
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('login-otp') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
+    if ( ! req.body.token ) {
+        return res.status(400).send('token is required.');
+    }
+
+    if ( ! req.body.code ) {
+        return res.status(400).send('code is required.');
+    }
+
+    const svc_token = req.services.get('token');
+    let decoded; try {
+        decoded = svc_token.verify('otp', req.body.token);
+    } catch ( e ) {
+        return res.status(400).send('Invalid token.');
+    }
+
+    if ( ! decoded.user_uid ) {
+        return res.status(400).send('Invalid token.');
+    }
+
+    const user = await get_user({ uuid: decoded.user_uid, cached: false });
+    if ( ! user ) {
+        return res.status(400).send('User not found.');
+    }
+
+    const svc_otp = req.services.get('otp');
+    if ( ! svc_otp.verify(user.username, user.otp_secret, req.body.code) ) {
+
+        // THIS MAY BE COUNTER-INTUITIVE
+        //
+        // A successfully handled request, with the correct format,
+        // but incorrect credentials when NOT using the HTTP
+        // authentication framework provided by RFC 7235, SHOULD
+        // return status 200.
+        //
+        // Source: I asked Julian Reschke in an email, and then he
+        // contributed to this discussion:
+        // https://stackoverflow.com/questions/32752578
+
+        return res.status(200).send({
+            proceed: false,
+        });
+    }
+
+    return await complete_({ req, res, user });
+});
+
+router.post('/login/recovery-code', express.json(), body_parser_error_handler, async (req, res, next) => {
+    // either api. subdomain or no subdomain
+    if(require('../helpers').subdomain(req) !== 'api' && require('../helpers').subdomain(req) !== '')
+        next();
+
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('login-recovery') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
+    if ( ! req.body.token ) {
+        return res.status(400).send('token is required.');
+    }
+
+    if ( ! req.body.code ) {
+        return res.status(400).send('code is required.');
+    }
+
+    const svc_token = req.services.get('token');
+    let decoded; try {
+        decoded = svc_token.verify('otp', req.body.token);
+    } catch ( e ) {
+        return res.status(400).send('Invalid token.');
+    }
+
+    if ( ! decoded.user_uid ) {
+        return res.status(400).send('Invalid token.');
+    }
+
+    const user = await get_user({ uuid: decoded.user_uid, cached: false });
+    if ( ! user ) {
+        return res.status(400).send('User not found.');
+    }
+
+    const code = req.body.code;
+
+    const crypto = require('crypto');
+
+    const codes = user.otp_recovery_codes.split(',');
+    const hashed_code = crypto
+        .createHash('sha256')
+        .update(code)
+        .digest('base64')
+        // We're truncating the hash for easier storage, so we have 128
+        // bits of entropy instead of 256. This is plenty for recovery
+        // codes, which have only 48 bits of entropy to begin with.
+        .slice(0, 22);
+
+    if ( ! codes.includes(hashed_code) ) {
+        return res.status(200).send({
+            proceed: false,
+        });
+    }
+
+    // Remove the code from the list
+    const index = codes.indexOf(hashed_code);
+    codes.splice(index, 1);
+    
+    // update user
+    const db = req.services.get('database').get(DB_WRITE, '2fa');
+    await db.write(
+        `UPDATE user SET otp_recovery_codes = ? WHERE uuid = ?`,
+        [codes.join(','), user.uuid]
+    );
+    user.otp_recovery_codes = codes.join(',');
+
+    return await complete_({ req, res, user });
+});
+
+module.exports = router;

packages/backend/src/routers/logout.js

@@ -29,6 +29,11 @@ router.post('/logout', auth, express.json(), async (req, res, next)=>{
     // check subdomain
     if(require('../helpers').subdomain(req) !== 'api' && require('../helpers').subdomain(req) !== '')
         next();
+    // check anti-csrf token
+    const svc_antiCSRF = req.services.get('anti-csrf');
+    if ( ! svc_antiCSRF.consume_token(req.user.uuid, req.body.anti_csrf) ) {
+        return res.status(400).json({ message: 'incorrect anti-CSRF token' });
+    }
     // delete cookie
     res.clearCookie(config.cookie_name);
     // delete session

packages/backend/src/routers/open_item.js

@@ -45,7 +45,7 @@ module.exports = eggspress('/open_item', {
     const subject = req.values.subject;
 
     const actor = Context.get('actor');
-    if ( ! actor.type instanceof UserActorType ) {
+    if ( ! (actor.type instanceof UserActorType) ) {
         throw APIError.create('forbidden');
     }
 

packages/backend/src/routers/passwd.js

@@ -18,7 +18,7 @@
  */
 "use strict"
 const express = require('express');
-const { invalidate_cached_user } = require('../helpers');
+const { invalidate_cached_user, get_user } = require('../helpers');
 const router = new express.Router();
 const auth = require('../middleware/auth.js');
 const { DB_WRITE } = require('../services/database/consts');
@@ -45,9 +45,15 @@ router.post('/passwd', auth, express.json(), async (req, res, next)=>{
     else if (typeof req.body.new_pass !== 'string')
         return res.status(400).send('new_pass must be a string.')
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('passwd') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     try{
+        const user = await get_user({ id: req.user.id, force: true });
         // check old_pass
-        const isMatch = await bcrypt.compare(req.body.old_pass, req.user.password)
+        const isMatch = await bcrypt.compare(req.body.old_pass, user.password)
         if(!isMatch)
             return res.status(400).send('old_pass does not match your current password.')
         // check new_pass length
@@ -56,10 +62,14 @@ router.post('/passwd', auth, express.json(), async (req, res, next)=>{
             return res.status(400).send('new_pass must be at least 6 characters long.')
         else{
             await db.write(
-                'UPDATE user SET password=? WHERE `id` = ?',
+                'UPDATE user SET password=?, `pass_recovery_token` = NULL, `change_email_confirm_token` = NULL WHERE `id` = ?',
                 [await bcrypt.hash(req.body.new_pass, 8), req.user.id]
             );
             invalidate_cached_user(req.user);
+
+            const svc_email = req.services.get('email');
+            svc_email.send_email({ email: user.email }, 'password_change_notification');
+
             return res.send('Password successfully updated.')
         }
     }catch(e){

packages/backend/src/routers/save_account.js

@@ -19,7 +19,7 @@
 "use strict"
 const express = require('express');
 const router = new express.Router();
-const {get_taskbar_items, username_exists, send_email_verification_code, send_email_verification_token, invalidate_cached_user} = require('../helpers');
+const {get_taskbar_items, username_exists, send_email_verification_code, send_email_verification_token, invalidate_cached_user, get_user } = require('../helpers');
 const auth = require('../middleware/auth.js');
 const config = require('../config');
 const { Context } = require('../util/context');
@@ -70,127 +70,137 @@ router.post('/save_account', auth, express.json(), async (req, res, next)=>{
     else if(req.body.password.length < config.min_pass_length)
         return res.status(400).send(`Password must be at least ${config.min_pass_length} characters long.`)
 
-    // duplicate username check, do this only if user has supplied a new username
-    if(req.body.username !== req.user.username && await username_exists(req.body.username))
-        return res.status(400).send('This username already exists in our database. Please use another one.');
-    // duplicate email check (pseudo-users don't count)
-    let rows2 = await db.read(`SELECT EXISTS(SELECT 1 FROM user WHERE email=? AND password IS NOT NULL) AS email_exists`, [req.body.email]);
-    if(rows2[0].email_exists)
-        return res.status(400).send('This email already exists in our database. Please use another one.');
-    // get pseudo user, if exists
-    let pseudo_user = await db.read(`SELECT * FROM user WHERE email = ? AND password IS NULL`, [req.body.email]);
-    pseudo_user = pseudo_user[0];
-    // get uuid user, if exists
-    if(req.body.uuid){
-        uuid_user = await db.read(`SELECT * FROM user WHERE uuid = ? LIMIT 1`, [req.body.uuid]);
-        uuid_user = uuid_user[0];
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('save-account') ) {
+        return res.status(429).send('Too many requests.');
     }
 
-    // send_confirmation_code
-    req.body.send_confirmation_code = req.body.send_confirmation_code ?? true;
+    const svc_lock = req.services.get('lock');
+    return svc_lock.lock([
+        `save-account:username:${req.body.username}`,
+        `save-account:email:${req.body.email}`
+    ], async () => {
+        await new Promise((rslv) => {
+            setTimeout(rslv, 5000);
+        });
+        // duplicate username check, do this only if user has supplied a new username
+        if(req.body.username !== req.user.username && await username_exists(req.body.username))
+            return res.status(400).send('This username already exists in our database. Please use another one.');
+        // duplicate email check (pseudo-users don't count)
+        let rows2 = await db.read(`SELECT EXISTS(SELECT 1 FROM user WHERE email=? AND password IS NOT NULL) AS email_exists`, [req.body.email]);
+        if(rows2[0].email_exists)
+            return res.status(400).send('This email already exists in our database. Please use another one.');
+        // get pseudo user, if exists
+        let pseudo_user = await db.read(`SELECT * FROM user WHERE email = ? AND password IS NULL`, [req.body.email]);
+        pseudo_user = pseudo_user[0];
 
-    // todo email confirmation is required by default unless:
-    // Pseudo user converting and matching uuid is provided
-    let email_confirmation_required = 0;
+        // send_confirmation_code
+        req.body.send_confirmation_code = req.body.send_confirmation_code ?? true;
 
-    // -----------------------------------
-    // Get referral user
-    // -----------------------------------
-    let referred_by_user = undefined;
-    if ( req.body.referral_code ) {
-        referred_by_user = await get_user({ referral_code: req.body.referral_code });
-        if ( ! referred_by_user ) {
-            return res.status(400).send('Referral code not found');
+        // todo email confirmation is required by default unless:
+        // Pseudo user converting and matching uuid is provided
+        let email_confirmation_required = 0;
+
+        // -----------------------------------
+        // Get referral user
+        // -----------------------------------
+        let referred_by_user = undefined;
+        if ( req.body.referral_code ) {
+            referred_by_user = await get_user({ referral_code: req.body.referral_code });
+            if ( ! referred_by_user ) {
+                return res.status(400).send('Referral code not found');
+            }
         }
-    }
 
-    // -----------------------------------
-    // New User
-    // -----------------------------------
-    const user_uuid = req.user.uuid;
-    let email_confirm_code = Math.floor(100000 + Math.random() * 900000);
-    const email_confirm_token = uuidv4();
+        // -----------------------------------
+        // New User
+        // -----------------------------------
+        const user_uuid = req.user.uuid;
+        let email_confirm_code = Math.floor(100000 + Math.random() * 900000);
+        const email_confirm_token = uuidv4();
 
-    if(pseudo_user === undefined){
-        await db.write(
-            `UPDATE user
-             SET
-             username = ?, email = ?, password = ?, email_confirm_code = ?, email_confirm_token = ?${
-                referred_by_user ? ', referred_by = ?' : '' }
-             WHERE
-             id = ?`,
-            [
-                // username
-                req.body.username,
-                // email
-                req.body.email,
-                // password
-                await bcrypt.hash(req.body.password, 8),
-                // email_confirm_code
-                email_confirm_code,
-                //email_confirm_token
-                email_confirm_token,
-                // referred_by
-                ...(referred_by_user ? [referred_by_user.id] : []),
-                // id
-                req.user.id
-            ]
-        );
-        invalidate_cached_user(req.user);
+        if(pseudo_user === undefined){
+            await db.write(
+                `UPDATE user
+                SET
+                username = ?, email = ?, password = ?, email_confirm_code = ?, email_confirm_token = ?${
+                    referred_by_user ? ', referred_by = ?' : '' }
+                WHERE
+                id = ?`,
+                [
+                    // username
+                    req.body.username,
+                    // email
+                    req.body.email,
+                    // password
+                    await bcrypt.hash(req.body.password, 8),
+                    // email_confirm_code
+                    email_confirm_code,
+                    //email_confirm_token
+                    email_confirm_token,
+                    // referred_by
+                    ...(referred_by_user ? [referred_by_user.id] : []),
+                    // id
+                    req.user.id
+                ]
+            );
+            invalidate_cached_user(req.user);
 
-        // Update root directory name
-        await db.write(
-            `UPDATE fsentries SET name = ? WHERE user_id = ? and parent_uid IS NULL`,
-            [
-                // name
-                req.body.username,
-                // id
-                req.user.id,
-            ]
-        );
-        const filesystem = req.services.get('filesystem');
-        await filesystem.update_child_paths(`/${req.user.username}`, `/${req.body.username}`, req.user.id);
+            // Update root directory name
+            await db.write(
+                `UPDATE fsentries SET name = ? WHERE user_id = ? and parent_uid IS NULL`,
+                [
+                    // name
+                    req.body.username,
+                    // id
+                    req.user.id,
+                ]
+            );
+            const filesystem = req.services.get('filesystem');
+            await filesystem.update_child_paths(`/${req.user.username}`, `/${req.body.username}`, req.user.id);
 
-        if(req.body.send_confirmation_code)
-            send_email_verification_code(email_confirm_code, req.body.email);
-        else
-            send_email_verification_token(email_confirm_token, req.body.email, user_uuid);
-    }
-
-    // create token for login
-    const token = await jwt.sign({uuid: user_uuid}, config.jwt_secret);
-
-    // user id
-    // todo if pseudo user, assign directly no need to do another DB lookup
-    const user_id = req.user.id;
-    const user_res = await db.read('SELECT * FROM `user` WHERE `id` = ? LIMIT 1', [user_id]);
-    const user = user_res[0];
-
-    // todo send LINK-based verification email
-
-    //set cookie
-    res.cookie(config.cookie_name, token);
-
-    {
-        const svc_event = req.services.get('event');
-        svc_event.emit('user.save_account', { user });
-    }
-
-    // return results
-    return res.send({
-        token: token,
-        user:{
-            username: user.username,
-            uuid: user.uuid,
-            email: user.email,
-            is_temp: false,
-            requires_email_confirmation: user.requires_email_confirmation,
-            email_confirmed: user.email_confirmed,
-            email_confirmation_required: email_confirmation_required,
-            taskbar_items: await get_taskbar_items(user),
-            referral_code: user.referral_code,
+            if(req.body.send_confirmation_code)
+                send_email_verification_code(email_confirm_code, req.body.email);
+            else
+                send_email_verification_token(email_confirm_token, req.body.email, user_uuid);
         }
-    })
+
+        // create token for login
+        const svc_auth = req.services.get('auth');
+        const { token } = await svc_auth.create_session_token(req.user, { req });
+
+        // user id
+        // todo if pseudo user, assign directly no need to do another DB lookup
+        const user_id = req.user.id;
+        const user_res = await db.read('SELECT * FROM `user` WHERE `id` = ? LIMIT 1', [user_id]);
+        const user = user_res[0];
+
+        // todo send LINK-based verification email
+
+        //set cookie
+        res.cookie(config.cookie_name, token);
+
+        {
+            const svc_event = req.services.get('event');
+            svc_event.emit('user.save_account', { user });
+        }
+
+        // return results
+        return res.send({
+            token: token,
+            user:{
+                username: user.username,
+                uuid: user.uuid,
+                email: user.email,
+                is_temp: false,
+                requires_email_confirmation: user.requires_email_confirmation,
+                email_confirmed: user.email_confirmed,
+                email_confirmation_required: email_confirmation_required,
+                taskbar_items: await get_taskbar_items(user),
+                referral_code: user.referral_code,
+            }
+        })
+    });
 })
 
 module.exports = router

packages/backend/src/routers/send-confirm-email.js

@@ -27,6 +27,11 @@ const { DB_WRITE } = require('../services/database/consts.js');
 // POST /send-confirm-email
 // -----------------------------------------------------------------------//
 router.post('/send-confirm-email', auth, express.json(), async (req, res, next)=>{
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('send-confirm-email') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     // check subdomain
     if(require('../helpers').subdomain(req) !== 'api')
         next();

packages/backend/src/routers/send-pass-recovery-email.js

@@ -23,6 +23,8 @@ const { body_parser_error_handler, get_user, invalidate_cached_user } = require(
 const config = require('../config');
 const { DB_WRITE } = require('../services/database/consts');
 
+const jwt = require('jsonwebtoken');
+
 // -----------------------------------------------------------------------//
 // POST /send-pass-recovery-email
 // -----------------------------------------------------------------------//
@@ -51,6 +53,12 @@ router.post('/send-pass-recovery-email', express.json(), body_parser_error_handl
     else if(req.body.email && !validator.isEmail(req.body.email))
         return res.status(400).send('Invalid email.')
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('send-pass-recovery-email') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
+
     try{
         let user;
         // see if username exists
@@ -80,31 +88,20 @@ router.post('/send-pass-recovery-email', express.json(), body_parser_error_handl
         );
         invalidate_cached_user(user);
 
-        // prepare email
-        let transporter = nodemailer.createTransport({
-            host: config.smtp_server,
-            port: config.smpt_port,
-            secure: true, // STARTTLS
-            auth: {
-                user: config.smtp_username,
-                pass: config.smtp_password,
-            },
-        });
+        // create jwt
+        const jwt_token = jwt.sign({
+            user_uid: user.uuid,
+            token,
+            // email change invalidates password recovery
+            email: user.email,
+        }, config.jwt_secret, { expiresIn: '1h' });
 
         // create link
-        const rec_link = config.origin + '/action/set-new-password?user=' + user.uuid + '&token=' + token;
+        const rec_link = config.origin + '/action/set-new-password?token=' + jwt_token;
 
-        // send email
-        transporter.sendMail({
-            from: '[email protected]', // sender address
-            to: user.email, // list of receivers
-            subject: "Password Recovery", // Subject line
-            html: `
-            <p>Hi there,</p>
-            <p>A password recovery request was issued for your account, please follow the link below to reset your password:</p>
-            <p><a href="${rec_link}">${rec_link}</a></p>
-            <p>Sincerely,</p>
-            <p>Puter</p>`,
+        const svc_email = req.services.get('email');
+        await svc_email.send_email({ email: user.email }, 'email_password_recovery', {
+            link: rec_link,
         });
 
         // Send response

packages/backend/src/routers/set-pass-using-token.js

@@ -20,9 +20,14 @@
 const express = require('express')
 const router = new express.Router()
 const config = require('../config')
-const { invalidate_cached_user_by_id } = require('../helpers')
+const { invalidate_cached_user_by_id, get_user } = require('../helpers')
 const { DB_WRITE } = require('../services/database/consts')
 
+const jwt = require('jsonwebtoken');
+
+// Ensure we don't expose branches with differing messages.
+const SAFE_NEGATIVE_RESPONSE = 'This password recovery token is no longer valid.';
+
 // -----------------------------------------------------------------------//
 // POST /set-pass-using-token
 // -----------------------------------------------------------------------//
@@ -39,9 +44,6 @@ router.post('/set-pass-using-token', express.json(), async (req, res, next)=>{
     // password is required
     if(!req.body.password)
         return res.status(401).send('password is required')
-    // user_id is required
-    else if(!req.body.user_id)
-        return res.status(401).send('user_id is required')
     // token is required
     else if(!req.body.token)
         return res.status(401).send('token is required')
@@ -52,14 +54,26 @@ router.post('/set-pass-using-token', express.json(), async (req, res, next)=>{
     else if(req.body.password.length < config.min_pass_length)
         return res.status(400).send(`Password must be at least ${config.min_pass_length} characters long.`)
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('set-pass-using-token') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
+    const { token, user_uid, email } = jwt.verify(req.body.token, config.jwt_secret);
+
+    const user = await get_user({ uuid: user_uid, force: true });
+    if ( user.email !== email ) {
+        return res.status(400).send(SAFE_NEGATIVE_RESPONSE);
+    }
+
     try{
         const info = await db.write(
-            'UPDATE user SET password=?, pass_recovery_token=NULL WHERE `uuid` = ? AND pass_recovery_token = ?',
-            [await bcrypt.hash(req.body.password, 8), req.body.user_id, req.body.token]
+            'UPDATE user SET password=?, pass_recovery_token=NULL, change_email_confirm_token=NULL WHERE `uuid` = ? AND pass_recovery_token = ?',
+            [await bcrypt.hash(req.body.password, 8), user_uid, token],
         );
 
         if ( ! info?.anyRowsAffected ) {
-            return res.status(400).send('Invalid token or user_id.');
+            return res.status(400).send(SAFE_NEGATIVE_RESPONSE);
         }
 
         invalidate_cached_user_by_id(req.body.user_id);

packages/backend/src/routers/sign.js

@@ -34,7 +34,7 @@ module.exports = eggspress('/sign', {
     allowedMethods: ['POST'],
 }, async (req, res, next)=>{
     const actor = Context.get('actor');
-    if ( ! actor.type instanceof UserActorType ) {
+    if ( ! (actor.type instanceof UserActorType) ) {
         throw APIError.create('forbidden');
     }
 
@@ -62,7 +62,8 @@ module.exports = eggspress('/sign', {
 
         app = await get_app({ uid: req.body.app_uid });
         if ( ! app ) {
-            throw APIError.create('no_suitable_app', null, { entry_name: subject.entry.name });
+            // FIXME: subject.entry.name isn't available here
+            throw APIError.create('no_suitable_app', null); //, { entry_name: subject.entry.name });
         }
         // Generate user-app token
         const svc_auth = Context.get('services').get('auth');
@@ -111,7 +112,7 @@ module.exports = eggspress('/sign', {
 
         const svc_acl = Context.get('services').get('acl');
         if ( ! await svc_acl.check(actor, node, 'see') ) {
-            throw await svc_acl.get_safe_acl_error(actor, subject, 'see');
+            throw await svc_acl.get_safe_acl_error(actor, node, 'see');
         }
 
         if ( app !== null ) {

packages/backend/src/routers/signup.js

@@ -44,6 +44,11 @@ module.exports = eggspress(['/signup'], {
     if(require('../helpers').subdomain(req) !== 'api' && require('../helpers').subdomain(req) !== '')
         next();
 
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('signup') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
     // modules
     const db = req.services.get('database').get(DB_WRITE, 'auth');
     const bcrypt = require('bcrypt')
@@ -246,7 +251,7 @@ module.exports = eggspress(['/signup'], {
     // todo if pseudo user, assign directly no need to do another DB lookup
     const user_id = (pseudo_user === undefined) ? insert_res.insertId : pseudo_user.id;
 
-    const [user] = await db.read(
+    const [user] = await db.pread(
         'SELECT * FROM `user` WHERE `id` = ? LIMIT 1',
         [user_id]
     );

packages/backend/src/routers/user-protected/change-email.js

@@ -0,0 +1,68 @@
+const APIError = require("../../api/APIError");
+const { DB_WRITE } = require("../../services/database/consts");
+const jwt = require('jsonwebtoken');
+const validator = require('validator');
+const crypto = require('crypto');
+const config = require("../../config");
+
+module.exports = {
+    route: '/change-email',
+    methods: ['POST'],
+    handler: async (req, res, next) => {
+        const user = req.user;
+        const new_email = req.body.new_email;
+
+        console.log('DID REACH HERE');
+
+        // TODO: DRY: signup.js
+        // validation
+        if( ! new_email ) {
+            throw APIError.create('field_missing', null, { key: 'new_email' });
+        }
+        if ( typeof new_email !== 'string' ) {
+            throw APIError.create('field_invalid', null, {
+                key: 'new_email', expected: 'a valid email address' });
+        }
+        if ( ! validator.isEmail(new_email) ) {
+            throw APIError.create('field_invalid', null, {
+                key: 'new_email', expected: 'a valid email address' });
+        }
+        
+        // check if email is already in use
+        const db = req.services.get('database').get(DB_WRITE, 'auth');
+        const rows = await db.read(
+            'SELECT COUNT(*) AS `count` FROM `user` WHERE `email` = ?',
+            [new_email]
+        );
+        if ( rows[0].count > 0 ) {
+            throw APIError.create('email_already_in_use', null, { email: new_email });
+        }
+
+        // generate confirmation token
+        const token = crypto.randomBytes(4).toString('hex');
+        const jwt_token = jwt.sign({
+            user_id: user.id,
+            token,
+        }, config.jwt_secret, { expiresIn: '24h' });
+
+        // send confirmation email
+        const svc_email = req.services.get('email');
+        await svc_email.send_email({ email: new_email }, 'email_change_request', {
+            confirm_url: `${config.origin}/change_email/confirm?token=${jwt_token}`,
+            username: user.username,
+        });
+        const old_email = user.email;
+        // TODO: NotificationService
+        await svc_email.send_email({ email: old_email }, 'email_change_notification', {
+            new_email: new_email,
+        });
+
+        // update user
+        await db.write(
+            'UPDATE `user` SET `unconfirmed_change_email` = ?, `change_email_confirm_token` = ? WHERE `id` = ?',
+            [new_email, token, user.id]
+        );
+
+        res.send({ success: true });
+    }
+};

packages/backend/src/routers/user-protected/change-password.js

@@ -0,0 +1,93 @@
+// TODO: DRY: This is the same function used by UIWindowChangePassword!
+
+const { invalidate_cached_user } = require("../../helpers");
+const { DB_WRITE } = require("../../services/database/consts");
+
+// duplicate definition is in src/helpers.js (puter GUI)
+const check_password_strength = (password) => {
+    // Define criteria for password strength
+    const criteria = {
+        minLength: 8,
+        hasUpperCase: /[A-Z]/.test(password),
+        hasLowerCase: /[a-z]/.test(password),
+        hasNumber: /\d/.test(password),
+        hasSpecialChar: /[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(password)
+    };
+
+    let overallPass = true;
+
+    // Initialize report object
+    let criteria_report = {
+        minLength: {
+            message: `Password must be at least ${criteria.minLength} characters long`,
+            pass: password.length >= criteria.minLength,
+        },
+        hasUpperCase: {
+            message: 'Password must contain at least one uppercase letter',
+            pass: criteria.hasUpperCase,
+        },
+        hasLowerCase: {
+            message: 'Password must contain at least one lowercase letter',
+            pass: criteria.hasLowerCase,
+        },
+        hasNumber: {
+            message: 'Password must contain at least one number',
+            pass: criteria.hasNumber,
+        },
+        hasSpecialChar: {
+            message: 'Password must contain at least one special character',
+            pass: criteria.hasSpecialChar,
+        },
+    };
+
+    // Check overall pass status and add messages
+    for (let criterion in criteria) {
+        if (!criteria_report[criterion].pass) {
+            overallPass = false;
+            break;
+        }
+    }
+
+    return {
+        overallPass: overallPass,
+        report: criteria_report,
+    };
+}
+
+module.exports = {
+    route: '/change-password',
+    methods: ['POST'],
+    handler: async (req, res, next) => {
+        // Validate new password
+        const { new_pass } = req.body;
+        const { overallPass: strong } = check_password_strength(new_pass);
+        if ( ! strong ) {
+            req.status(400).send('Password does not meet requirements.');
+        }
+
+        // Update user
+        // TODO: DI for endpoint definitions like this one
+        const bcrypt = require('bcrypt');
+        const db = req.services.get('database').get(DB_WRITE, 'auth');
+        await db.write(
+            'UPDATE user SET password=?, `pass_recovery_token` = NULL, `change_email_confirm_token` = NULL WHERE `id` = ?',
+            [await bcrypt.hash(req.body.new_pass, 8), req.user.id]
+        );
+        invalidate_cached_user(req.user);
+
+        // Notify user about password change
+        // TODO: audit log for user in security tab
+        const svc_email = req.services.get('email');
+        svc_email.send_email({ email: req.user.email }, 'password_change_notification');
+
+        // Kick out all other sessions
+        const svc_auth = req.services.get('auth');
+        const sessions = await svc_auth.list_sessions(req.actor);
+        for ( const session of sessions ) {
+            if ( session.current ) continue;
+            await svc_auth.revoke_session(req.actor, session.uuid);
+        }
+
+        return res.send('Password successfully updated.')
+    }
+};

packages/backend/src/routers/user-protected/disable-2fa.js

@@ -0,0 +1,22 @@
+const { DB_WRITE } = require("../../services/database/consts");
+
+module.exports = {
+    route: '/disable-2fa',
+    methods: ['POST'],
+    handler: async (req, res, next) => {
+        const db = req.services.get('database').get(DB_WRITE, '2fa.disable');
+        await db.write(
+            `UPDATE user SET otp_enabled = 0, otp_recovery_codes = NULL, otp_secret = NULL WHERE uuid = ?`,
+            [req.user.uuid]
+        );
+        // update cached user
+        req.user.otp_enabled = 0;
+
+        const svc_email = req.services.get('email');
+        await svc_email.send_email({ email: req.user.email }, 'disabled_2fa', {
+            username: req.user.username,
+        });
+
+        res.send({ success: true });
+    }
+};

packages/backend/src/routers/verify-pass-recovery-token.js

@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2024 Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+"use strict"
+const express = require('express')
+const router = new express.Router()
+const config = require('../config')
+const { invalidate_cached_user_by_id, get_user } = require('../helpers')
+const { DB_WRITE } = require('../services/database/consts')
+
+const jwt = require('jsonwebtoken');
+
+// Ensure we don't expose branches with differing messages.
+const SAFE_NEGATIVE_RESPONSE = 'This password recovery token is no longer valid.';
+
+// -----------------------------------------------------------------------//
+// POST /verify-pass-recovery-token
+// -----------------------------------------------------------------------//
+router.post('/verify-pass-recovery-token', express.json(), async (req, res, next)=>{
+    // check subdomain
+    if(require('../helpers').subdomain(req) !== 'api' && require('../helpers').subdomain(req) !== '')
+        next();
+
+    if ( ! req.body.token ) {
+        return res.status(401).send('token is required')
+    }
+
+    const svc_edgeRateLimit = req.services.get('edge-rate-limit');
+    if ( ! svc_edgeRateLimit.check('verify-pass-recovery-token') ) {
+        return res.status(429).send('Too many requests.');
+    }
+
+    const { exp, user_uid, email } = jwt.verify(req.body.token, config.jwt_secret);
+
+    const user = await get_user({ uuid: user_uid, force: true });
+    if ( user.email !== email ) {
+        return res.status(400).send(SAFE_NEGATIVE_RESPONSE);
+    }
+
+    const current_time = Math.floor(Date.now() / 1000);
+    const time_remaining = exp - current_time;
+
+    return res.status(200).send({ time_remaining });
+})
+
+module.exports = router

packages/backend/src/routers/whoami.js

@@ -41,6 +41,8 @@ const WHOAMI_GET = eggspress('/whoami', {
 
     const is_user = actor.type instanceof UserActorType;
 
+    console.log('user?', req.user);
+
     // send user object
     const details = {
         username: req.user.username,
@@ -54,6 +56,7 @@ const WHOAMI_GET = eggspress('/whoami', {
         is_temp: (req.user.password === null && req.user.email === null),
         taskbar_items: await get_taskbar_items(req.user),
         referral_code: req.user.referral_code,
+        otp: !! req.user.otp_enabled,
         ...(req.new_token ? { token: req.token } : {})
     };
 
@@ -98,6 +101,8 @@ WHOAMI_POST.post('/whoami', auth, fs, express.json(), async (req, response, next
     if(req.query.return_desktop_items === 1 || req.query.return_desktop_items === '1' || req.query.return_desktop_items === 'true'){
         // by cached desktop id
         if(req.user.desktop_id){
+            // TODO: Check if used anywhere, maybe remove
+            // eslint-disable-next-line no-undef
             desktop_items = await db.read(
                 `SELECT * FROM fsentries
                 WHERE user_id = ? AND parent_uid = ?`,

packages/backend/src/services/BaseService.js

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU Affero General Public License
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-const { AdvancedBase } = require("puter-js-common");
+const { AdvancedBase } = require("@heyputer/puter-js-common");
 
 const NOOP = async () => {};
 
@@ -51,7 +51,7 @@ class BaseService extends AdvancedBase {
     async __on (id, args) {
         const handler = this.__get_event_handler(id);
 
-        return await handler(id, args);
+        return await handler(id, ...args);
     }
 
     __get_event_handler (id) {

packages/backend/src/services/ComplainAboutVersionsService.js

@@ -27,7 +27,7 @@ class ComplainAboutVersionsService extends BaseService {
 
         if ( ! current_version_data ) {
             this.log.warn(
-                `failed to check ${current_version} in the EOL database`
+                `failed to check ${major} in the EOL database`
             );
             return;
         }

packages/backend/src/services/Container.js

@@ -26,12 +26,32 @@ class Container {
         this.instances_ = {};
         this.ready = new TeePromise();
     }
+    /**
+     * registerService registers a service with the servuces container.
+     * 
+     * @param {String} name - the name of the service
+     * @param {BaseService.constructor} cls - an implementation of BaseService
+     * @param {Array} args - arguments to pass to the service constructor
+     */
     registerService (name, cls, args) {
         const my_config = config.services?.[name] || {};
         this.instances_[name] = cls.getInstance
             ? cls.getInstance({ services: this, config, my_config, name, args })
             : new cls({ services: this, config, my_config, name, args }) ;
     }
+    /**
+     * patchService allows overriding methods on a service that is already
+     * constructed and initialized.
+     * 
+     * @param {String} name - the name of the service to patch
+     * @param {ServicePatch.constructor} patch - the patch
+     * @param {Array} args - arguments to pass to the patch
+     */
+    patchService (name, patch, args) {
+        const original_service = this.instances_[name];
+        const patch_instance = new patch();
+        patch_instance.patch({ original_service, args });
+    }
     set (name, instance) { this.instances_[name] = instance; }
     get (name, opts) {
         if ( this.instances_[name] ) {
@@ -93,7 +113,7 @@ class Container {
         const promises = [];
         for ( const k in this.instances_ ) {
             if ( this.instances_[k].__on ) {
-                promises.push(this.instances_[k].__on(id, ...args));
+                promises.push(this.instances_[k].__on(id, args));
             }
         }
         await Promise.all(promises);