Merge remote-tracking branch 'upstream/main' into i18n-spanish

scripts/docker-start.mjs

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+/**
+ * Docker launcher — the container's entry point (see Dockerfile).
+ *
+ * `compose.yaml` publishes the port on the host's loopback, but Docker still
+ * delivers the host's own browser to the container FROM the container
+ * network's gateway address, never from 127.0.0.1. Provider Settings admits
+ * loopback only, so without this the POWER UP panel refuses the very machine
+ * running the container. This launcher reads the gateway out of the kernel
+ * routing table and declares exactly that one address trusted, then starts
+ * Vite the way scripts/pinokio-start.mjs does.
+ */
+import { accessSync, constants, readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from './pinokio-install.mjs';
+import { loadViteFromCanonicalRoot } from './pinokio-start.mjs';
+
+const MODULE_PATH = fileURLToPath(import.meta.url);
+const ROOT = realpathSync(path.resolve(path.dirname(MODULE_PATH), '..'));
+const ROUTE_TABLE = '/proc/net/route';
+
+/**
+ * Extract the IPv4 default gateway from Linux `/proc/net/route` text. The
+ * addresses there are little-endian hex and only the default route (a
+ * destination of 00000000 on an interface flagged up) names a gateway.
+ * Returns null when there is none — the `--network none` case, which must
+ * never fabricate an address.
+ * @param {string} text Raw routing-table contents.
+ * @returns {string|null} Dotted-quad gateway, or null.
+ */
+export function defaultGatewayFromRouteTable(text) {
+  const lines = String(text || '').split(/\r?\n/).slice(1);
+  for (const line of lines) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 4) continue;
+    const [, destination, gateway, flags] = fields;
+    if (destination !== '00000000' || !/^[0-9a-f]{8}$/i.test(gateway)) continue;
+    if ((Number.parseInt(flags, 16) & 0x1) === 0) continue; // RTF_UP
+    const octets = [6, 4, 2, 0].map((offset) =>
+      Number.parseInt(gateway.slice(offset, offset + 2), 16),
+    );
+    if (octets.every((octet) => octet === 0)) continue;
+    return octets.join('.');
+  }
+  return null;
+}
+
+/**
+ * Decide this launch's trusted-peer list. An operator value always wins, so a
+ * compose override stays authoritative; otherwise the gateway alone is
+ * trusted. No gateway trusts nothing and Provider Settings stays loopback-only,
+ * exactly as under `npm run dev`.
+ * @param {{env?: NodeJS.ProcessEnv, routeTable?: string}} input
+ * @returns {string} Value for GEV_KEY_SETUP_TRUSTED_PEERS ('' trusts nothing).
+ */
+export function resolveTrustedPeers({ env = process.env, routeTable = '' } = {}) {
+  const explicit = String(env.GEV_KEY_SETUP_TRUSTED_PEERS ?? '').trim();
+  if (explicit) return explicit;
+  return defaultGatewayFromRouteTable(routeTable) ?? '';
+}
+
+/**
+ * A checkout the container cannot write fails quietly: Provider Settings
+ * answers 500 and `.gev-cache` is never created, with nothing in the log. The
+ * usual cause is a clone made as root on a NAS or Proxmox host while the
+ * container runs as 1000:1000. Say so at start, naming both sets of ids.
+ * @param {{root: string, writable: boolean, owner: {uid: number, gid: number}, runAs: {uid: number, gid: number}}} input
+ * @returns {string|null} A warning, or null when the checkout is writable.
+ */
+export function unwritableRootWarning({ root, writable, owner, runAs }) {
+  if (writable) return null;
+  return (
+    `[Docker] ${root} is owned by ${owner.uid}:${owner.gid} but the container runs as ` +
+    `${runAs.uid}:${runAs.gid}, so saving keys and caching will fail. Either give ` +
+    `the checkout to that user (chown -R ${runAs.uid}:${runAs.gid} on the host) or ` +
+    `run as its owner (env UID=${owner.uid} GID=${owner.gid} docker compose up)`
+  );
+}
+
+function readRouteTable() {
+  try {
+    return readFileSync(ROUTE_TABLE, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+async function start() {
+  let writable = true;
+  try {
+    accessSync(ROOT, constants.W_OK);
+  } catch {
+    writable = false;
+  }
+  if (!writable) {
+    const { uid, gid } = statSync(ROOT);
+    console.warn(
+      unwritableRootWarning({
+        root: ROOT,
+        writable,
+        owner: { uid, gid },
+        runAs: { uid: process.getuid?.() ?? -1, gid: process.getgid?.() ?? -1 },
+      }),
+    );
+  }
+
+  const fromOperator = Boolean(
+    String(process.env.GEV_KEY_SETUP_TRUSTED_PEERS ?? '').trim(),
+  );
+  const trustedPeers = resolveTrustedPeers({ routeTable: readRouteTable() });
+  if (trustedPeers) {
+    // Set before Vite is imported: the dev server snapshots process.env during
+    // configuration, and the admission gate reads it per request.
+    process.env.GEV_KEY_SETUP_TRUSTED_PEERS = trustedPeers;
+    console.log(
+      fromOperator
+        ? `[Docker] Provider Settings trusted peers: ${trustedPeers} (GEV_KEY_SETUP_TRUSTED_PEERS).`
+        : `[Docker] Provider Settings trusts the container gateway (${trustedPeers}).`,
+    );
+  } else {
+    console.log('[Docker] No default gateway; Provider Settings stays loopback-only.');
+  }
+
+  const port = Number.parseInt(process.env.PORT, 10) || 4173;
+  const { createServer } = await loadViteFromCanonicalRoot(ROOT);
+  const server = await createServer({
+    root: ROOT,
+    server: {
+      // The container's own namespace. compose publishes this to the host's
+      // 127.0.0.1 only; widening that mapping is the LAN opt-in.
+      host: '0.0.0.0',
+      port,
+      strictPort: true,
+    },
+  });
+  await server.listen();
+  server.printUrls();
+  console.log(`[Docker] Ready at http://localhost:${port}/`);
+
+  for (const signal of ['SIGINT', 'SIGTERM']) {
+    process.once(signal, async () => {
+      await server.close();
+      process.exit(0);
+    });
+  }
+}
+
+if (isDirectInvocation(process.argv[1], MODULE_PATH)) {
+  start().catch((error) => {
+    console.error(`[Docker] Start refused: ${error.message}`);
+    process.exitCode = 1;
+  });
+}

scripts/format-scope.json

@@ -112,6 +112,8 @@
   "server/providers/cctv/cap.js",
   "server/providers/cctv/groundHeights.js",
   "server/providers/cctv/catalog.js",
+  "server/providers/cctv/lithuania.js",
+  "src/data/cctvLithuania.test.mjs",
   "server/providers/cctv/constants.js",
   "server/providers/cctv/media.js",
   "server/providers/cctv/normalize.js",
@@ -546,6 +548,7 @@
   "src/data/cctvEstonia.test.mjs",
   "src/data/cctvWarendorf.test.mjs",
   "src/data/cctvCalgary.test.mjs",
+  "src/data/cctvCataloniaSource.test.mjs",
   "src/data/cctvVegvesen.test.mjs",
   "src/data/cctvNyc.test.mjs",
   "src/data/cctvNswSource.test.mjs",

scripts/package-boundaries.json

@@ -176,6 +176,7 @@
       "server/providers/cctv/cap.js",
       "server/providers/cctv/groundHeights.js",
       "server/providers/cctv/catalog.js",
+      "server/providers/cctv/lithuania.js",
       "server/providers/cctv/constants.js",
       "server/providers/cctv/media.js",
       "server/providers/cctv/normalize.js",