Merge pull request #24 from mangyan1/fix/upstream-sync-20260916

merge upstream develop: plain javascript frontend, new permission model, fork security invariants kept

Author: mangyan1

.github/workflows/caddy.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: caddy
           platforms: linux/amd64
@@ -61,10 +61,10 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
         with:
           platforms: arm64
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
         with:
           driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
       - name: ghcr.io-login
@@ -74,7 +74,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ github.token }}
       - id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: caddy
           platforms: linux/amd64,linux/arm64

.github/workflows/docker-develop.yml

@@ -18,7 +18,7 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
         with:
           driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
       - name: ghcr.io-login
@@ -32,7 +32,7 @@ jobs:
         run: |
           jq --arg v "$(git rev-parse --short HEAD)" '.version = $v' frontend/package.json > frontend/package.json.tmp && mv frontend/package.json.tmp frontend/package.json
           jq --arg v "$(git rev-parse --short HEAD)" '.version = $v' backend/package.json > backend/package.json.tmp && mv backend/package.json.tmp backend/package.json
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
@@ -51,7 +51,7 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
         with:
           driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
       - name: ghcr.io-login
@@ -65,7 +65,7 @@ jobs:
         run: |
           jq --arg v "$(git rev-parse --short HEAD)" '.version = $v' frontend/package.json > frontend/package.json.tmp && mv frontend/package.json.tmp frontend/package.json
           jq --arg v "$(git rev-parse --short HEAD)" '.version = $v' backend/package.json > backend/package.json.tmp && mv backend/package.json.tmp backend/package.json
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

CHANGELOG.md

@@ -4,7 +4,17 @@ All notable changes to the NPMplus Security Fork are documented here. The fork u
 
 ## Unreleased
 
-Nothing yet.
+### Added
+
+- Reconciled upstream develop through `2fcc605a` manually (the scheduled upstream-sync run had stopped on 42 conflicted files — its fail-closed behavior) and adopted upstream's typescript-to-javascript frontend migration: the react-query client, API modules, components, and pages are plain JavaScript now, and the frontend tsconfig, `tsc` build step, and typescript/`@types/*` devDependencies are gone. The fork-only `.ts`/`.tsx` sources (Anubis/CrowdSec/security UI, deployment recovery, error boundary) remain and run through Node 24 type stripping. Frontend tests run via `node --test test/*.test.ts`.
+
+- Adopted upstream's simplified permission model (`isAdmin`, `canAdmin()`, `canUser(id)`, `can("type:manage")`, `get visibility()`) replacing the per-object permission walk; `access.js` drops to ~120 lines. The nginx privilege guard (raw config and local-path fields stay admin-only) and the CrowdSec route gate now wrap the synchronous `canAdmin()` call, and their tests were updated to the synchronous shape.
+
+- Adopted upstream's nginx control API: config reload now patches `http://localhost/1/control/config` over the `/run/nginx-control.sock` unix socket via the undici client instead of running `nginx -s reload`; the API tests stub the reload since the socket does not exist in the test environment. `undici` 8.10.2 enters the backend manifest (verified 11 days published at merge time, inside the `minimumReleaseAge` window).
+
+- `nickname` is now server-managed: absent from all API schemas and responses, with the `nickname_default` migration backfilling existing rows. API tests no longer send it.
+
+- Every fork security invariant is preserved and re-verified against the merge (127/127 backend tests, 10/10 frontend tests, `vite build`, and `tests/security-invariants.mjs` green): an anonymous missing session is still a 403 at route permission checks rather than upstream's 401 (rejected sessions remain 401); the login, refresh, and OIDC rate limiters and the OIDC `no_redirect` cookie handling are unchanged; gravatar fetching stays bounded (5 s timeout, 1 MiB cap) with avatar cleanup and login-time backfill; the one-time setup-token gate and its field whitelist are kept, and upstream's open `POST /users/setup` endpoint was not taken. `multer` 2.3.0 and `mysql2` 3.24.3 stay fork-side; the remaining upstream dependency bumps that were younger than the `minimumReleaseAge` window were rejected and age out through the renovate cron.
 
 ## v2.15.1-mangyan1.rc.6 - 2026-09-15
 

Dockerfile

@@ -118,6 +118,7 @@ RUN cd /src/nginx && \
     --with-threads \
     --with-file-aio \
     --with-libatomic \
+    --with-control-api \
     --with-pcre \
     --with-pcre-jit \
     --without-select_module \
@@ -133,6 +134,7 @@ RUN cd /src/nginx && \
     --with-http_gunzip_module \
     --with-http_gzip_static_module \
     --with-http_sub_module \
+    --with-http_json_module \
     --with-http_addition_module \
     --with-http_stub_status_module \
     --with-http_auth_request_module \
@@ -180,8 +182,7 @@ RUN apk upgrade --no-cache -a && \
     find /app/node_modules -name "*.node" -type f -exec llvm-strip -s {} \; && \
     find /app/node_modules -name "*.node" -type f -exec file {} \;
 COPY frontend /app
-RUN pnpm tsc -b && \
-    pnpm vite build && \
+RUN pnpm vite build && \
     find /app/dist -type f ! -name "*.jpg" ! -name "*.png" -print0 | xargs -r0 -P "$(nproc)" -n 1 brotli -q 11 -sf
 
 FROM --platform=$BUILDPLATFORM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS backend

backend/internal/access-list.js

@@ -1,4 +1,4 @@
-import { appendFile, rm, unlink, writeFile } from "node:fs/promises";
+import { appendFile, rm, writeFile } from "node:fs/promises";
 import bcrypt from "bcryptjs";
 import _ from "lodash";
 import errs from "../lib/error.js";
@@ -21,7 +21,7 @@ const internalAccessList = {
 	 * @returns {Promise}
 	 */
 	create: async (access, data) => {
-		await access.can("access_lists:create", data);
+		access.can("access_lists:manage");
 		const row = utils.omitRow(omissions())(
 			await accessListModel.query().insertAndFetch({
 				name: data.name,
@@ -101,7 +101,7 @@ const internalAccessList = {
 	 * @return {Promise}
 	 */
 	update: async (access, data) => {
-		await access.can("access_lists:update", data.id);
+		access.can("access_lists:manage");
 		const row = await internalAccessList.get(access, { id: data.id });
 		if (row.id !== data.id) {
 			// Sanity check that something crazy hasn't happened
@@ -208,7 +208,7 @@ const internalAccessList = {
 	 */
 	get: async (access, data, skipMasking) => {
 		const thisData = data || {};
-		const accessData = await access.can("access_lists:get", thisData.id);
+		access.can("access_lists:view");
 
 		const query = accessListModel
 			.query()
@@ -231,7 +231,7 @@ const internalAccessList = {
 			.allowGraph("[owner,items,clients,proxy_hosts.[certificate,access_lists.[clients,items]]]")
 			.first();
 
-		if (accessData.permission_visibility !== "all") {
+		if (access.visibility !== "all") {
 			query.andWhere("access_list.owner_user_id", access.token.getUserId(1));
 		}
 
@@ -265,7 +265,7 @@ const internalAccessList = {
 	 * @returns {Promise}
 	 */
 	delete: async (access, data) => {
-		await access.can("access_lists:delete", data.id);
+		access.can("access_lists:manage");
 		const row = await internalAccessList.get(access, {
 			id: data.id,
 			expand: ["proxy_hosts.[certificate, access_lists.[clients,items]]", "items", "clients"],
@@ -353,11 +353,7 @@ const internalAccessList = {
 		await internalNginx.reload();
 
 		// delete the htpasswd file
-		try {
-			await unlink(internalAccessList.getFilename(row));
-		} catch {
-			// do nothing
-		}
+		await rm(internalAccessList.getFilename(row), { force: true });
 
 		// 4. audit log
 		await internalAuditLog.add(access, {
@@ -378,7 +374,7 @@ const internalAccessList = {
 	 * @returns {Promise}
 	 */
 	getAll: async (access, expand, searchQuery) => {
-		const accessData = await access.can("access_lists:list");
+		access.can("access_lists:view");
 
 		const query = accessListModel
 			.query()
@@ -400,7 +396,7 @@ const internalAccessList = {
 			.allowGraph("[owner,items,clients]")
 			.orderBy("access_list.name", "ASC");
 
-		if (accessData.permission_visibility !== "all") {
+		if (access.visibility !== "all") {
 			query.andWhere("access_list.owner_user_id", access.token.getUserId(1));
 		}
 

backend/internal/audit-log.js

@@ -11,8 +11,8 @@ const internalAuditLog = {
 	 * @param   {String}  [searchQuery]
 	 * @returns {Promise}
 	 */
-	getAll: async (access, expand, searchQuery) => {
-		await access.can("auditlog:list");
+	getAll: (access, expand, searchQuery) => {
+		access.canAdmin();
 
 		const query = auditLogModel
 			.query()
@@ -43,7 +43,7 @@ const internalAuditLog = {
 	 * @return {Promise}
 	 */
 	get: async (access, data) => {
-		await access.can("auditlog:list");
+		access.canAdmin();
 
 		const query = auditLogModel.query().andWhere("id", data.id).allowGraph("[user]").first();
 

backend/internal/certificate.js

@@ -116,7 +116,7 @@ const internalCertificate = {
 	 * @returns {Promise}
 	 */
 	create: async (access, data) => {
-		await access.can("certificates:create", data);
+		access.can("certificates:manage");
 		data.owner_user_id = access.token.getUserId(1);
 
 		if (data.provider === "letsencrypt") {
@@ -191,7 +191,7 @@ const internalCertificate = {
 	 * @return {Promise}
 	 */
 	update: async (access, data) => {
-		await access.can("certificates:update", data.id);
+		access.can("certificates:manage");
 		const row = await internalCertificate.get(access, { id: data.id });
 
 		if (row.id !== data.id) {
@@ -231,15 +231,15 @@ const internalCertificate = {
 	 * @return {Promise}
 	 */
 	get: async (access, data) => {
-		const accessData = await access.can("certificates:get", data.id);
+		access.can("certificates:view");
 		const query = certificateModel
 			.query()
 			.where("is_deleted", 0)
 			.andWhere("id", data.id)
 			.allowGraph("[owner,proxy_hosts,redirection_hosts,dead_hosts,streams]")
 			.first();
 
-		if (accessData.permission_visibility !== "all") {
+		if (access.visibility !== "all") {
 			query.andWhere("owner_user_id", access.token.getUserId(1));
 		}
 
@@ -282,7 +282,7 @@ const internalCertificate = {
 	 * @returns {Promise}
 	 */
 	download: async (access, data) => {
-		await access.can("certificates:get", data);
+		access.can("certificates:view");
 		const certificate = await internalCertificate.get(access, data);
 		if (certificate.provider === "letsencrypt") {
 			const zipDirectory = internalCertificate.getLiveCertPath(data.id);
@@ -356,7 +356,7 @@ const internalCertificate = {
 	 * @returns {Promise}
 	 */
 	delete: async (access, data) => {
-		await access.can("certificates:delete", data.id);
+		access.can("certificates:manage");
 		const row = await internalCertificate.get(access, { id: data.id });
 
 		if (!row?.id) {
@@ -411,7 +411,7 @@ const internalCertificate = {
 	 * @returns {Promise}
 	 */
 	getAll: async (access, expand, searchQuery) => {
-		const accessData = await access.can("certificates:list");
+		access.can("certificates:view");
 
 		const query = certificateModel
 			.query()
@@ -420,7 +420,7 @@ const internalCertificate = {
 			.allowGraph("[owner,proxy_hosts,redirection_hosts,dead_hosts,streams]")
 			.orderBy("nice_name", "ASC");
 
-		if (accessData.permission_visibility !== "all") {
+		if (access.visibility !== "all") {
 			query.andWhere("owner_user_id", access.token.getUserId(1));
 		}
 
@@ -496,15 +496,15 @@ const internalCertificate = {
 
 	/**
 	 * Validates that the certs provided are good.
-	 * No access required here, nothing is changed or stored.
+	 * Nothing is changed or stored.
 	 *
 	 * @param   {Access}  access
 	 * @param   {Object}  data
 	 * @param   {Object}  data.files
-	 * @returns {Promise}
+	 * @returns {Object}
 	 */
-	validate: async (access, data) => {
-		await access.can("certificates:create");
+	validate: (access, data) => {
+		access.can("certificates:manage");
 		const finalData = {};
 		for (const [name, [file]] of Object.entries(data.files)) {
 			if (internalCertificate.allowedSslFiles.includes(name)) {
@@ -536,7 +536,7 @@ const internalCertificate = {
 		}
 		const isMtls = row.provider === "mtls";
 
-		const validations = await internalCertificate.validate(access, data);
+		const validations = internalCertificate.validate(access, data);
 		if (typeof validations.certificate === "undefined") {
 			throw new error.ValidationError("Certificate file was not provided");
 		}
@@ -753,7 +753,7 @@ const internalCertificate = {
 	 * @returns {Promise}
 	 */
 	renew: async (access, data) => {
-		await access.can("certificates:update", data);
+		access.can("certificates:manage");
 		const certificate = await internalCertificate.get(access, data);
 
 		if (certificate.provider === "letsencrypt") {
@@ -910,7 +910,7 @@ const internalCertificate = {
 	 * @returns
 	 */
 	testHttpsChallenge: async (access, payload) => {
-		await access.can("certificates:list");
+		access.can("certificates:view");
 
 		// Create a test challenge file
 		await writeFile("/data/tls/certbot/acme-challenge/.well-known/acme-challenge/test-challenge", "Success", {