A proxy that sets the username header twice, as when Authentik's nginx
snippet and the documented lines are both present, made Node join the values
into "brad, brad" and create an account of that name instead of signing in
brad. Read each occurrence separately: identical repeats count once, and
conflicting ones are refused. The docs now note Authentik's snippet already
sets the headers.
With TRUSTED_HEADER_USERNAME and TRUSTED_PROXIES set, POST
/api/auth/trusted-login signs in the user an authenticating reverse proxy
(such as Authentik forward auth) names in that header, believing it only on
connections from the proxy addresses. Users are matched by username, so an
existing account is adopted; otherwise one is created, the first as admin
as with registration. New accounts get a random password, and a user the
proxy vouches for can set their own password without the current one, to log
in when reached without the proxy.
Flash games Ruffle can play now also report streamable, and the player
offers a switch to the original Flash Player streamed from the server.
Flash games launched from a page, which need the browser plugin, stream
instead of loading a page that can't play, and search no longer hides them
while streaming is enabled.
Games on other platforms (Java applets first) can be played through a
session manager that streams them from a server-side container. When
STREAMING_API_URL and STREAMING_API_TOKEN are set, game details and launch
data report whether a game is streamable, and POST /games/:id/stream-session
starts a session.
GET /api/games/:id/launch only checked games.read via
validateSharedGameAccess, so an authenticated user whose role lacked
games.play could still mount and download games through the API.
When guest access is enabled, guests now receive games.play alongside
games.read and playlists.read, on both the backend guest fallback
(optionalAuth, sharedAccessAuth) and the frontend guest session. Play
statistics stay authenticated-only.
Ruffle publishes tagged releases and daily nightlies into a single
GitHub feed. The updater took whichever release came first carrying a
web-selfhosted.zip, so a stable release landing at the top of the feed
was installed on hosts tracking nightlies -- and because version
comparison normalised everything to a build date, the resulting semver
never matched, leaving the host reporting an update forever.
Selection now filters on GitHub's prerelease flag, and comparison
splits by channel: build date for nightlies, numeric parts for stable.
The channel lives in the ruffle.channel system setting (default
stable) and governs both manual installs and the scheduled job.
Switching channels records the choice and reports the target build;
nothing is downloaded until the install is requested.
Stable releases are months apart and can fall outside the recent page
the changelog is built from, so that channel falls back to the
latest-release endpoint.
The updateRuffle describe block still checked distDir for leftover
ruffle-backup/ruffle-temp directories after Task 1 moved the install
target to dataDir. Those checks were passing vacuously, and the
EACCES injection in "completes when the staging directory cannot be
removed after copying" never matched the real removal path.
The index was scraped from the Flashpoint Datahub wiki on every request.
That page now sits behind a Cloudflare managed challenge that no plain
HTTP client can pass, so the endpoint answered 500 for every caller.
Ship the list instead, extracted from a saved copy of the page into
data/community-playlists.json: 104 playlists across 9 categories. Only
entries whose download URL is on the allowlist are kept, so everything
the modal offers can also be imported. That drops the Old Default
Playlists section, hosted off the allowlist and still in the
pre-Flashpoint 10 format.
The modal now fetches only while open rather than on every render of the
playlists page, and shows when the snapshot was captured. Drops cheerio,
whose only consumer was the scrape.
- Show checkedAt on the up-to-date panel and only claim currency
when versions actually match, with a matching neutral toast path
for unreleased builds
- Add aria-expanded to the changelog toggle
- Reword a review-referencing comment/test title and pin the /app
route's settings.update permission gate in tests
Also close a gap found in review of Task 3: a failed check recorded no
timestamp, so every call during a GitHub outage or rate limit fired a
fresh request that blocked up to the 10s timeout, defeating the 60s
forced-refresh floor exactly when it mattered. Failures now record
lastFailedAt and are subject to the same floor as forced refreshes,
regardless of the force flag, and a success clears it.
Ultimate ships preferences.json without gameDataSources, and validation
treated a missing key as fatal. The whole file was discarded and replaced
with Infinity-shaped defaults, so that edition ran on hardcoded paths,
kept lastLoadFailed set - which drops the cache TTL from 60s to 5s - and
logged an error on every reload.
Normalize instead of validate: fill in the two fields the rest of the app
relies on, pass everything else through as written, and reject only a
file that is not an object. A malformed data source entry is dropped with
a warning rather than taking the file down with it.
The Version Information card could not tell one Flashpoint install from
another: Ultimate names only a major version in version.txt, and nothing
showed when the metadata was last synced.
Serve two more values with the public settings. The package date is the
mtime of version.txt, falling back to .preferences.defaults.json. Both
are written when the package is built and never rewritten afterwards,
unlike preferences.json and flashpoint.sqlite, which the Launcher and
this app write to.
The last update comes from preferences.json. A missing source or the
1970-01-01 placeholder is normalized to null, which the UI renders as
"Never" - what Ultimate always shows, since it ships no metadata source.
On a network share the database copy and cache pre-warm run for minutes,
and the listener only opened after all of it, so anyone who loaded the
page during that window got a connection error.
Open the port immediately after registering the static frontend, and
hold every route that needs the database behind a gate that answers 503
with a machine-readable marker and the current startup phase. The SPA
shell needs nothing the gate blocks, so the frontend renders a "server
is starting" screen on the login page's own background, polls /health,
and reloads once the server reports ready.
Move the database copy out of the entrypoint: it does the same freshness
check the application does, and doing it before node starts kept the port
closed for the longest part of startup. Distinguish a dead server from a
slow one by requiring the backend's own marker, since a proxy in front of
a stopped backend still answers.
The mkdir ran unguarded at module load, so an uncreatable log directory
threw during import and took down server startup. The logger already
handles the same situation by falling back and continuing.
syncAndReload runs on every Launcher write to flashpoint.sqlite, and a
synchronous copy of a multi-hundred-megabyte file froze every in-flight
request for its full duration.
TEMP_DIR was built from process.cwd() plus 'backend', but the container
already runs from /app/backend, so it resolved to a doubled path on the
container's writable layer. Downloads of up to 500MB staged there
instead of a mounted volume, and the mkdir fails outright with EACCES
when PUID moves the app user off the image build UID.
Anchor it to a configured path under /app/data and sweep files a crash
left behind at startup, with an age guard so a second container sharing
the volume cannot delete a download that is still running.
preferences.json, playlist JSON and the cached images all live on the
mount the Flashpoint Launcher reads and writes, and all were rewritten
in place. An interruption leaves a torn file: for preferences.json that
corrupts the desktop app's own config, and a truncated cached image is
served forever because both the proxy and the asset downloader treat any
existing file as valid.
Add a shared helper that fills a sibling temp file and renames it into
place, with a unique per-call suffix so two writers cannot collide, and
a short retry for the Windows and SMB case where another process holds
the target open. It never falls back to writing in place, which would
silently reintroduce the torn-write window.
FileImporter copied straight to the final path, so a size mismatch or a
crash mid-copy left a truncated ZIP that nothing removed. The mount path
finds any {gameId}-*.zip by prefix and mounts it without verifying the
hash, and because a file exists the re-download branch never runs, so
the game becomes unlaunchable until someone deletes it by hand.
Copy to a .part file in the destination directory, verify the size, then
rename into place, and unlink the partial on failure. Import under the
launcher-convention filename the caller already computed instead of
stamping Date.now(), which hid packs from the direct-path lookup and
left one copy per download attempt on disk.
When a mount fails, hash the ZIP against its recorded sha256 and move it
aside only on a genuine mismatch, then retry once. A hash match means
something else failed and the file is left alone: the Launcher writes
this directory too. Recovery is opt-in so the bulk startup mount cannot
turn a transient storage fault into a library-wide re-download.
Updating Ruffle failed in Docker with "EXDEV: cross-device link not
permitted" because overlay2 cannot rename a directory that still lives
in a read-only image layer, even within one parent directory.
Replace the directory renames with a rename-then-copy fallback, and
empty rather than unlink a path that turns out to be a mount point, so
a volume mounted over the install directory also works. Verify the
copied tree against the extracted one before dropping the backup: an
interrupted copy can leave ruffle.js in place while the rest is
missing, which a bare existence check cannot detect.
Also chown the served frontend directory when PUID moves the app user
off the image build UID, or every write there fails with EACCES before
any of this is reached.
A LAN deployment served over plain HTTP logged two console warnings on
every page load. COOP is ignored on origins that are not potentially
trustworthy, and Origin-Agent-Cluster conflicted because /game-proxy and
/game-zip are mounted before helmet -- they must bypass frameguard and the
SPA CSP to be framed -- so game documents carried no header while the rest
of the origin asked for origin-keying.
Send COOP only on connections that used TLS, reusing the X-Forwarded-Proto
detection behind COOKIE_SECURE, and drop Origin-Agent-Cluster so the origin
is uniformly site-keyed.
Critical: DbQueryPool stranded the caller of any query whose worker died —
pending promises were only rejected when the last worker went, so a single
crash left an HTTP request hanging until the timeout. Track the in-flight
query per slot, reject exactly that caller, and settle queued work when the
pool empties or shuts down.
Security: same-origin acceptance compared host but ignored scheme, so a
plaintext page could claim same-origin against an HTTPS deployment; the
metadata source allowlist accepted http://, where a MITM could rewrite the
game database; and asset paths were built from remote game IDs without
validation, allowing traversal outside the images directory.
Also: the reconciler now derives filenames via GameDataDownloader.getFilename
instead of re-parsing dateAdded (formats that helper normalizes would never
have matched), and warns once instead of failing when the database is
read-only — the state of the shipped compose mount. getYearRange runs through
the worker pool like its siblings rather than blocking the main thread.
Images normally arrive lazily: the proxy fetches one from the CDN when a
browser asks for a game the local mount lacks. That is wrong for an offline
host, where a sync can add thousands of games whose images would only ever
appear for whoever browses to them while online.
Add an opt-in setting (off by default) that, after a sync, fetches logos and
screenshots for exactly the games that sync touched. Runs as its own job with
progress and cancellation, and is never awaited by the sync, so a slow or
failing CDN cannot block or fail a metadata update.
better-sqlite3 is synchronous, so a slow read froze the entire server — a
filter-options request over a slow mount was measured blocking it for 167
seconds, during which even /health timed out.
Add DbQueryPool: read-only SQLite connections in worker threads, with
DatabaseService.allAsync routing the full-table scans through them and falling
back in process when workers are unavailable. Filter-options queries now run
concurrently rather than serially. Workers reopen on database reload and stop
on shutdown.
Also set UV_THREADPOOL_SIZE=16: libuv's default of 4 throttled every image and
ZIP read in the process, which dominates on a network mount.
LazyImage and LazyBackgroundImage preload through a detached Image and their
cleanup only set a cancelled flag, so the request kept downloading after
unmount. Navigating away from a grid left dozens of downloads occupying the
browser's six connections and the server's I/O, starving the page the user
actually opened.
Clear the handlers and reset src on cleanup, which is what aborts the request,
and have the image proxy return early when the client has already gone rather
than paying a mount round trip — or a 10s CDN fetch — for nobody.
The server awaited the Ruffle download before listening, so the port stayed
closed for minutes on slow storage and would stay closed indefinitely if the
download stalled. RuffleService also checked frontend/public/ruffle while a
built deployment serves frontend/dist/ruffle, so a fresh container re-downloaded
Ruffle it already shipped.
Install in the background with its own error handling, and target the directory
that is actually served.
Images served from the Flashpoint mount carried no Cache-Control, while the
CDN fallback sent a day of caching, so browsers revalidated every image on
every page view. Over SMB each of those cost four metadata round trips, one of
them a synchronous existsSync that blocked the event loop.
Send the same cache header on both branches, replace existsSync with an async
stat, and resolve the base directory's realpath once instead of per request.
The Ultimate edition ships preferences.json without gameMetadataSources, so
metadata sync was permanently unavailable there with no way to opt in.
Add an admin-only override (metadata.custom_source_enabled / _url) resolved
ahead of preferences, restricted to the two trusted FPFSS hosts and validated
on save. While it is off, the Metadata Update card explains that Ultimate does
not support metadata updates and that updating means a newer full package,
pointing advanced admins at the override. Enabling it requires confirming a
dialog that spells out what a sync rewrites.
Cookies were Secure whenever NODE_ENV=production, so browsers discarded them
on any deployment served over plain HTTP and every login bounced back to the
login page. A fixed flag cannot serve a LAN over HTTP and the internet over
HTTPS from the same instance.
Derive the flag from req.secure, which honours X-Forwarded-Proto from a
trusted proxy, and add COOKIE_SECURE=auto|true|false to override it.
Browsers omit a scheme's default port when serializing Origin, so a page at
http://host:80 sends "http://host". Comparing that to the raw DOMAIN string
rejected every POST from a deployment served on port 80 or 443 — including
same-origin requests under SERVE_FRONTEND, which surfaced as a CORS error on
login with no way to guess the cause.
Compare normalized origins instead, always allow a request whose Origin
matches its own Host, and accept a comma-separated DOMAIN so one deployment
can be reached over both a LAN address and a public domain. Apply the same
normalization to the domains table, which previously built origins without
ports, and reflect the caller's origin on the game-zip admin routes.
Treat `downloaded` as a base cache dimension like platform and library
instead of a dynamic filter. It is two-valued, and every path that can
change presentOnDisk (GameDatabaseUpdater, DownloadedReconciler) plus a
database reload already clear this cache, so the 30-second TTL only forced
the Downloaded page to recompute nine option queries twice a minute.
Pre-warm the downloaded combination at startup so the page is instant on
first visit.
reconcile() called noteSelfWrite() but never cleared GameSearchCache
or the filter options cache. In the post-sync path caches are cleared
at reload and reconcile then runs asynchronously, leaving a window
where a downloaded:true search gets cached without the flags the sync
just wiped. With GameSearchCache's 5-minute TTL and updateAgeOnGet,
a frequently-refreshed Downloaded-page query could stay stale
indefinitely.
markAsDownloaded and markAsNotDownloaded now call
DatabaseService.noteSelfWrite() plus clear the search and filter
options caches themselves, matching the design spec. Previously this
only happened at the gamezipserver.ts call site, so DownloadManager's
Download-button path (non-copy mode) still triggered the file watcher
on every download, causing an unnecessary full reload and cache flush.
Add the public feature flag features.enable_lucky_button (default on)
with an admin switch in Settings > Features. AppShell renders the
floating random-game button only when the flag is enabled.
Unlike the other feature flags, this one is not bypassed for admins:
it controls cosmetic chrome, so an admin hiding it must also stop
seeing it in their own session.
Closes#13
branderson
Darkraise