This commit is contained in:
Mateusz Gruszczyński committed 2026-10-13 00:00:06 +02:00
1 parent d23fa5e154
commit 81ab39e70a
51 files changed
+5352 -1489

No files matched your search

+13 -10
View File
@@ -1,7 +1,7 @@
mod documentation;
mod public;
mod panel_content;
mod panel_assets;
mod panel_content;
mod public;
// Embedded asset URLs change with every build, independent of Cargo package version.
// Only an exact identifier from this binary is accepted; arbitrary suffixes are 404.
@@ -11,9 +11,13 @@ fn asset_build_id() -> &'static str {
fn fingerprinted_path(path: &str, prefix: &str) -> Option<String> {
let name = path.strip_prefix(prefix)?;
let (stem, extension) = name.rsplit_once('.')?;
if extension != "js" && extension != "css" { return None; }
if extension != "js" && extension != "css" {
return None;
}
let (base, token) = stem.rsplit_once('_')?;
if token != asset_build_id() { return None; }
if token != asset_build_id() {
return None;
}
Some(format!("{prefix}{base}.{extension}"))
}
@@ -53,6 +57,7 @@ fn admin_app_javascript() -> &'static str {
include_str!("web/app/session-resume.js"),
include_str!("web/app/refresh.js"),
include_str!("web/app/preferences.js"),
include_str!("web/app/stream-dashboard.js"),
include_str!("web/app/config-history.js"),
include_str!("web/app/runtime.js"),
include_str!("web/app/settings.js"),
@@ -306,14 +311,12 @@ fn panel_document_path(path: &str) -> bool {
fn anonymous_allowed(method: &Method, path: &str) -> bool {
if method == Method::GET || method == Method::HEAD {
panel_document_path(path)
|| fingerprinted_path(path, "/assets/")
.is_some_and(|base| matches!(base.as_str(), "/assets/login.js" | "/assets/style.css"))
|| fingerprinted_path(path, "/assets/").is_some_and(|base| {
matches!(base.as_str(), "/assets/login.js" | "/assets/style.css")
})
|| matches!(
path,
"/assets/login-langs.json"
| "/favicon.svg"
| "/healthz"
| "/api/auth/status"
"/assets/login-langs.json" | "/favicon.svg" | "/healthz" | "/api/auth/status"
)
} else {
method == Method::POST && matches!(path, "/api/auth/setup" | "/api/auth/login")