From fbdcc015fe91c9d3d367daaa17fc9d6470eb9df8 Mon Sep 17 00:00:00 2001
From: alan <67932758+alan16742@users.noreply.github.com>
Date: Tue, 22 Oct 2024 17:33:53 +0800
Subject: [PATCH 1/3] fix: download api add

---
 back-end-cf/index.js | 22 ++++++++++------------
 front-end/index.html |  4 ----
 2 files changed, 10 insertions(+), 16 deletions(-)

diff --git a/back-end-cf/index.js b/back-end-cf/index.js
index 7eecdc76..06dd2e87 100644
--- a/back-end-cf/index.js
+++ b/back-end-cf/index.js
@@ -43,7 +43,7 @@ async function handleRequest(request) {
       ? ''
       : decodeURIComponent(requestUrl.pathname));
   // Download a file
-  if (file) {
+  if (file && request.method === 'GET') {
     const fileName = file.split('/').pop();
     if (fileName.toLowerCase() === PASSWD_FILENAME.toLowerCase()) {
       throw new Error('access denied');
@@ -181,11 +181,11 @@ async function fetchFiles(path, fileName, passwd, authOnly) {
   const parent = path || '/';
   if (path === '/') path = '';
   if (path || EXPOSE_PATH)
-    path = ':' + encodeURIComponent(EXPOSE_PATH + path) + ':';
+    path = ':' + EXPOSE_PATH + path;
 
   const accessToken = await fetchAccessToken();
-  const expand =
-    '/children?select=name,size,parentReference,lastModifiedDateTime,@microsoft.graph.downloadUrl&$top=200';
+  const expand = fileName ? `/${fileName}` :
+    ':/children?select=name,size,parentReference,lastModifiedDateTime,@microsoft.graph.downloadUrl&$top=200';
   const uri = OAUTH.apiUrl + path + expand;
 
   let pageRes = await getContent(uri, {
@@ -195,7 +195,7 @@ async function fetchFiles(path, fileName, passwd, authOnly) {
     throw new Error('request failed');
   }
 
-  let children = pageRes.value;
+  let children = pageRes?.value || pageRes;
   while (pageRes['@odata.nextLink']) {
     pageRes = await getContent(pageRes['@odata.nextLink'], {
       Authorization: 'Bearer ' + accessToken,
@@ -203,6 +203,11 @@ async function fetchFiles(path, fileName, passwd, authOnly) {
     children = children.concat(pageRes.value);
   }
 
+  // Download a file
+  if (fileName) {
+    return children?.['@microsoft.graph.downloadUrl'];
+  }
+
   const pwFile = children.find((file) => file.name === PASSWD_FILENAME);
   let authPassed = false;
   if (pwFile) {
@@ -231,13 +236,6 @@ async function fetchFiles(path, fileName, passwd, authOnly) {
     });
   }
 
-  // Download a file
-  if (fileName) {
-    return children.find(
-      (file) => file.name === decodeURIComponent(fileName)
-    )?.['@microsoft.graph.downloadUrl'];
-  }
-
   // List a folder
   return JSON.stringify({
     parent,
diff --git a/front-end/index.html b/front-end/index.html
index baf1076a..676cc0b9 100644
--- a/front-end/index.html
+++ b/front-end/index.html
@@ -18,10 +18,6 @@
       type="module"
       src="//lf3-cdn-tos.bytecdntp.com/cdn/expire-1-M/ionicons/4.6.3/ionicons/ionicons.esm.js"
     ></script>
-    <script
-      nomodule
-      src="//lf3-cdn-tos.bytecdntp.com/cdn/expire-1-M/ionicons/4.6.3/ionicons/ionicons.js"
-    ></script>
     <style>
       .sk-folding-cube {
         margin: 20px auto;

From 92b91d34a1ef3406e18ec0c1e5f91d2f7920e46e Mon Sep 17 00:00:00 2001
From: alan <67932758+alan16742@users.noreply.github.com>
Date: Wed, 23 Oct 2024 19:12:03 +0800
Subject: [PATCH 2/3] fix: upload function

---
 back-end-cf/index.js | 57 ++++++++++++++++++++++++++------------------
 1 file changed, 34 insertions(+), 23 deletions(-)

diff --git a/back-end-cf/index.js b/back-end-cf/index.js
index 06dd2e87..e0e06708 100644
--- a/back-end-cf/index.js
+++ b/back-end-cf/index.js
@@ -4,14 +4,12 @@
  * ONEDRIVE_REFRESHTOKEN: refresh_token
  * PASSWD_FILENAME: 密码文件名
  * PROTECTED_LAYERS: EXPOSE_PATH 目录密码防护层数，防止猜测目录，默认 -1 为关闭，类似 '/Applications' 需要保护填写为 2（保护 EXPOSE_PATH 及其一级子目录），开启需在 EXPORSE_PATH 目录的 PASSWORD_FILENAME 文件中填写密码
- * EXPOSE_PASSWD: 覆盖 EXPOSE_PATH 目录密码，优先级：本目录密码 > EXPOSE_PASSWD > EXPORSE_PATH 目录密码；填写后访问速度稍快，但不便于更改
  */
 const IS_CN = 0;
 const EXPOSE_PATH = '';
 const ONEDRIVE_REFRESHTOKEN = '';
 const PASSWD_FILENAME = '.password';
 const PROTECTED_LAYERS = -1;
-const EXPOSE_PASSWD = '';
 
 addEventListener('scheduled', (event) => {
   event.waitUntil(fetchAccessToken());
@@ -43,13 +41,14 @@ async function handleRequest(request) {
       ? ''
       : decodeURIComponent(requestUrl.pathname));
   // Download a file
-  if (file && request.method === 'GET') {
+  if (file) {
     const fileName = file.split('/').pop();
     if (fileName.toLowerCase() === PASSWD_FILENAME.toLowerCase()) {
       throw new Error('access denied');
     }
-    const url = await fetchFiles(file.replace('/' + fileName, ''), fileName);
-    return Response.redirect(url, 302);
+    const url = await downloadFile(file, requestUrl.searchParams.get('format'));
+    const convertedFile = url instanceof Response ? url : Response.redirect(url, 302);
+    return convertedFile;
   }
 
   // preflight
@@ -74,10 +73,9 @@ async function handleRequest(request) {
 
   // Upload files
   if (requestUrl.searchParams.has('upload')) {
-    const allowUpload = await fetchFiles(requestPath, '.upload');
+    const allowUpload = await downloadFile(`${requestPath}/.upload`);
     const passwdCorrect = await fetchFiles(
       requestPath,
-      null,
       body.passwd,
       true
     );
@@ -100,7 +98,7 @@ async function handleRequest(request) {
   }
 
   // List a folder
-  const files = await fetchFiles(requestPath, null, body.passwd);
+  const files = await fetchFiles(requestPath, body.passwd);
   return new Response(files, {
     headers: returnHeaders,
   });
@@ -177,15 +175,15 @@ async function fetchAccessToken() {
   return result.access_token;
 }
 
-async function fetchFiles(path, fileName, passwd, authOnly) {
+async function fetchFiles(path, passwd, authOnly) {
   const parent = path || '/';
   if (path === '/') path = '';
   if (path || EXPOSE_PATH)
-    path = ':' + EXPOSE_PATH + path;
+    path = ':' + encodeURIComponent(EXPOSE_PATH + path) + ':';
 
   const accessToken = await fetchAccessToken();
-  const expand = fileName ? `/${fileName}` :
-    ':/children?select=name,size,parentReference,lastModifiedDateTime,@microsoft.graph.downloadUrl&$top=200';
+  const expand = 
+    '/children?select=name,size,parentReference,lastModifiedDateTime,@microsoft.graph.downloadUrl&$top=200';
   const uri = OAUTH.apiUrl + path + expand;
 
   let pageRes = await getContent(uri, {
@@ -195,7 +193,7 @@ async function fetchFiles(path, fileName, passwd, authOnly) {
     throw new Error('request failed');
   }
 
-  let children = pageRes?.value || pageRes;
+  let children = pageRes.value;
   while (pageRes['@odata.nextLink']) {
     pageRes = await getContent(pageRes['@odata.nextLink'], {
       Authorization: 'Bearer ' + accessToken,
@@ -203,22 +201,13 @@ async function fetchFiles(path, fileName, passwd, authOnly) {
     children = children.concat(pageRes.value);
   }
 
-  // Download a file
-  if (fileName) {
-    return children?.['@microsoft.graph.downloadUrl'];
-  }
-
   const pwFile = children.find((file) => file.name === PASSWD_FILENAME);
   let authPassed = false;
   if (pwFile) {
     const PASSWD = await getContent(pwFile['@microsoft.graph.downloadUrl']);
     authPassed = PASSWD === passwd;
   } else if (parent.split('/').length <= PROTECTED_LAYERS) {
-    if (EXPOSE_PASSWD) {
-      authPassed = EXPOSE_PASSWD === passwd;
-    } else if (parent !== '/') {
-      authPassed = await fetchFiles('/', null, passwd, true);
-    }
+    authPassed = await fetchFiles(EXPOSE_PATH || '/', passwd, true);
   } else {
     authPassed = true;
   }
@@ -250,6 +239,28 @@ async function fetchFiles(path, fileName, passwd, authOnly) {
   });
 }
 
+async function downloadFile(filePath, format){
+  const path = EXPOSE_PATH + filePath;
+  const accessToken = await fetchAccessToken();
+  const supportedFormats = ['glb', 'html', 'jpg', 'pdf'];
+  const uri = `${OAUTH.apiUrl}:${path}:/content` + (format ? `?format=${format}` : '');
+  if (format && !supportedFormats.includes(format.toLowerCase())) {
+    throw new Error('unsupported target format');
+  }
+
+  const downloadRes =  await cacheFetch(uri, {
+    method: format ? 'GET' : 'HEAD',
+    headers: {
+      Authorization: 'Bearer ' + accessToken,
+    },
+  });
+  if (downloadRes.status >= 400) {
+    throw new Error('download failed');
+  }
+  const location = format ? downloadRes : downloadRes.headers.get('content-location');
+  return location;
+}
+
 async function uploadFiles(fileList) {
   const batchRequest = {
     requests: fileList.map((file, index) => ({

From b281beed8df0fb8073966a4eb5a79019c2c869dc Mon Sep 17 00:00:00 2001
From: LOGI <18008498+vcheckzen@users.noreply.github.com>
Date: Wed, 23 Oct 2024 21:05:02 +0800
Subject: [PATCH 3/3] Update index.js

---
 back-end-cf/index.js | 109 +++++++++++++++++++------------------------
 1 file changed, 48 insertions(+), 61 deletions(-)

diff --git a/back-end-cf/index.js b/back-end-cf/index.js
index e0e06708..6173f1b0 100644
--- a/back-end-cf/index.js
+++ b/back-end-cf/index.js
@@ -34,33 +34,32 @@ const OAUTH = {
 };
 
 async function handleRequest(request) {
+  // Preflight
+  if(request.method === 'OPTIONS') {
+    return new Response(null, {
+      status: 204, 
+      headers: {
+        'Access-Control-Allow-Origin': '*',
+        'Access-Control-Allow-Headers': 'Content-Type',
+        'Access-Control-Max-Age': '86400',
+      }
+    });
+  }
+
   const requestUrl = new URL(request.url);
   const file =
     requestUrl.searchParams.get('file') ||
     (requestUrl.pathname.split('/').filter(Boolean).length === 0
       ? ''
       : decodeURIComponent(requestUrl.pathname));
+
   // Download a file
   if (file) {
     const fileName = file.split('/').pop();
     if (fileName.toLowerCase() === PASSWD_FILENAME.toLowerCase()) {
       throw new Error('access denied');
     }
-    const url = await downloadFile(file, requestUrl.searchParams.get('format'));
-    const convertedFile = url instanceof Response ? url : Response.redirect(url, 302);
-    return convertedFile;
-  }
-
-  // preflight
-  if(request.method === 'OPTIONS') {
-    return new Response(null, {
-      status: 204, 
-      headers: {
-        'Access-Control-Allow-Origin': '*',
-        'Access-Control-Allow-Headers': 'Content-Type',
-        'Access-Control-Max-Age': '86400',
-      }
-    });
+    return downloadFile(file, requestUrl.searchParams.get('format'));
   }
 
   const returnHeaders = {
@@ -73,15 +72,10 @@ async function handleRequest(request) {
 
   // Upload files
   if (requestUrl.searchParams.has('upload')) {
-    const allowUpload = await downloadFile(`${requestPath}/.upload`);
-    const passwdCorrect = await fetchFiles(
-      requestPath,
-      body.passwd,
-      true
-    );
+    const allowUpload = (await downloadFile(`${requestPath}/.upload`)).status === 302;
+    await authenticate();
     const uploadAttack =
       !allowUpload ||
-      !passwdCorrect ||
       body.files.some(
         (file) =>
           file.remotePath.split('/').pop().toLowerCase() ===
@@ -175,11 +169,33 @@ async function fetchAccessToken() {
   return result.access_token;
 }
 
-async function fetchFiles(path, passwd, authOnly) {
+async function authenticate(path, passwd) {
+  const pwFileContent = await downloadFile(`${path}/${PASSWD_FILENAME}`, null, true)
+    .then(resp => resp.status === 404 ? '' : resp.text());
+
+  if (pwFileContent) {
+    if (passwd !== pwFileContent) {
+      throw new Error("wrong password");
+    }
+  } else if (path !== '/' && path.split('/').length <= PROTECTED_LAYERS) {
+    return authenticate('/', passwd);
+  }
+}
+
+async function fetchFiles(path, passwd) {
   const parent = path || '/';
+  try {
+    await authenticate(path, passwd);
+  } catch(_) {
+    return JSON.stringify({
+      parent,
+      files: [],
+      encrypted: true,
+    });
+  }
+
   if (path === '/') path = '';
-  if (path || EXPOSE_PATH)
-    path = ':' + encodeURIComponent(EXPOSE_PATH + path) + ':';
+  if (path || EXPOSE_PATH) path = ':' + encodeURIComponent(EXPOSE_PATH + path) + ':';
 
   const accessToken = await fetchAccessToken();
   const expand = 
@@ -201,31 +217,6 @@ async function fetchFiles(path, passwd, authOnly) {
     children = children.concat(pageRes.value);
   }
 
-  const pwFile = children.find((file) => file.name === PASSWD_FILENAME);
-  let authPassed = false;
-  if (pwFile) {
-    const PASSWD = await getContent(pwFile['@microsoft.graph.downloadUrl']);
-    authPassed = PASSWD === passwd;
-  } else if (parent.split('/').length <= PROTECTED_LAYERS) {
-    authPassed = await fetchFiles(EXPOSE_PATH || '/', passwd, true);
-  } else {
-    authPassed = true;
-  }
-
-  if (authOnly) {
-    return authPassed;
-  }
-
-  // Auth failed
-  if (!authPassed) {
-    return JSON.stringify({
-      parent,
-      files: [],
-      encrypted: true,
-    });
-  }
-
-  // List a folder
   return JSON.stringify({
     parent,
     files: children
@@ -239,26 +230,22 @@ async function fetchFiles(path, passwd, authOnly) {
   });
 }
 
-async function downloadFile(filePath, format){
-  const path = EXPOSE_PATH + filePath;
-  const accessToken = await fetchAccessToken();
+async function downloadFile(filePath, format, stream){
   const supportedFormats = ['glb', 'html', 'jpg', 'pdf'];
-  const uri = `${OAUTH.apiUrl}:${path}:/content` + (format ? `?format=${format}` : '');
   if (format && !supportedFormats.includes(format.toLowerCase())) {
     throw new Error('unsupported target format');
   }
 
-  const downloadRes =  await cacheFetch(uri, {
-    method: format ? 'GET' : 'HEAD',
+  filePath = encodeURIComponent(`${EXPOSE_PATH}${filePath}`);
+  const uri = `${OAUTH.apiUrl}:${filePath}:/content` + (format ? `?format=${format}` : '');
+  const accessToken = await fetchAccessToken();
+
+  return cacheFetch(uri, {
+    redirect: stream ? 'follow': 'manual',
     headers: {
       Authorization: 'Bearer ' + accessToken,
     },
   });
-  if (downloadRes.status >= 400) {
-    throw new Error('download failed');
-  }
-  const location = format ? downloadRes : downloadRes.headers.get('content-location');
-  return location;
 }
 
 async function uploadFiles(fileList) {