Skip to content

PROGRESS.md

Latest commit

 

History

History
122 lines (114 loc) · 13.6 KB

PROGRESS.md

File metadata and controls

122 lines (114 loc) · 13.6 KB
Raw

NextList Refactoring Progress

Core Features (核心功能)

  • 部署方便，开箱即用 (Deploy easily, out of the box) - Supported via Node.js container backend
  • 文件预览（PDF、markdown、代码、纯文本等） (File preview)
  • 画廊模式下的图片预览 (Gallery mode image preview)
  • 视频和音频预览，支持歌词和字幕 (Video/audio preview)
  • Office 文档预览 (docx, pptx, xlsx etc)
  • README.md 预览渲染 (README.md render)
  • 文件永久链接复制和直接文件下载 (File permalink copy and direct download)
  • 黑暗模式 (Dark mode)
  • 国际化 (i18n)
  • 受保护的路由（密码保护和认证） (Protected routes) - Implemented for admin login
  • WebDAV (WebDAV) - Full RFC 4918 server at /dav: Basic/Bearer auth, PROPFIND (Depth 0/1), PROPPATCH, MKCOL, GET/HEAD (Range, proxy + local stream), PUT, DELETE, MOVE/COPY (Destination/Overwrite), LOCK/UNLOCK (class 2 fake locks); webdav_read/webdav_manage permission bits + base_path jailing; 42 e2e tests (npx tsx scripts/test-webdav.mts)
  • Docker 部署 (Docker deploy) - Supported via container
  • Cloudflare Workers / Vercel 代理 - Supported via entrypoints
  • 文件/文件夹打包下载 (File/folder archive download) - Implemented via browser ZIP stream
  • 网页上传、删除、新建文件夹、重命名、移动和复制 (Web upload, delete, create folder, rename, move, copy) - Implemented for Local storage
  • 离线下载 (Offline download) - Basic implementation (Serverless mode limited)
  • 跨存储复制文件 (Cross-storage file copy) - Supported via /fs/copy API abstraction
  • 单文件多线程下载/流式加速 (Multi-thread download/stream acceleration) - Implemented HTTP Range requests support in backend
  • 分享功能 (Shares) - Full CRUD + /@s/{id} browse + /sd/{id} download + auto ID + copy URL
  • 任务管理 (Task management) - Full task API (list/retry/cancel/delete/clear)
  • 备份/恢复 (Backup / Restore) - JSON export/import with encryption, skip-existing logic
  • 元数据管理 (Meta management) - Full CRUD via /admin/meta/*
  • 目录树 (Folder tree) - Via /fs/dirs endpoint
  • 文件搜索 (File search) - Via /fs/search traversal search (BFS, depth-10 / 500-dir / 5000-match caps, scope + pagination)
  • 驱动扩展操作 (Driver "other" ops) - Via /fs/other dispatch: Aliyun Drive video_preview (live transcoding)
  • 两步验证 2FA (TOTP) - RFC 6238 via Web Crypto: /auth/2fa/generate + /verify, login 402 → otp_code flow, admin /admin/user/cancel_2fa, /me otp flag
  • 回归测试：scripts/test-tier3.mts (17 项：搜索 scope/分页、other 分发、2FA 全流程)
  • 插件系统 (Plugin system) - Ported from OpenListNext (upstream-compatible): plugin.json manifest + config_schema 可视化配置、ZIP 上传 / URL 安装、后台插件管理（列表 / 启停 / 配置 / 导出 / 导入）、运行时 SDK（window.OpenListPlugin：悬浮挂件 / 文件与头部操作注入 / 事件总线 / 钩子 / Notify / 资源加载 / fs / admin API）、/admin/plugin/* 管理 API + /public/plugins 公开 API、示例插件 plugins_src/oplist-plugin-live2d
  • MCP (Model Context Protocol) - _完整 JSON-RPC 2.0 实现：initialize 握手（协议版本协商 2025-03-26/2024-11-05）、ping、tools/list + tools/call（list_files / get_file_info / search_files / get_system_info 真实执行）、resources/read（storage/metrics + storage/list）、prompts/get（summarize_directory）；双传输：Streamable HTTP（POST /api/mcp）+ 旧版 SSE（GET /api/mcp/sse + POST /api/mcp/messages，keepalive）；鉴权复用 getUserFromContext（JWT / 静态 API Token / 启用的 guest），initialize 与 ping 免鉴权

Storages (多种存储)

  • 本地存储 (Local storage) - Node.js container; guarded in Edge runtime
  • 阿里云盘 (Aliyundrive) - Implemented + order settings
  • OneDrive / Sharepoint - Implemented + order settings
  • GoogleDrive - Implemented + order settings
  • 123云盘 (123Pan) - Implemented + CRC32 sign + token-first login (avoids overseas risk control)
  • 夸克网盘 (Quark Drive) - Implemented + download headers (Cookie/Referer)
  • 百度网盘 (Baidu Netdisk) - Re-ported from Go v4 driver (driver.go/util.go/types.go/meta.go): official/crack/crack_video download, chunked upload + rapid upload, MD5 obfuscation (EncryptMd5/DecryptMd5), vip slice sizes, dynamic upload domain, token persistence
  • 网易云音乐云盘 (NeteaseMusic) - Ported from Go v4 driver: cloud song list (weapi), linuxapi play URL, virtual .lrc lyrics served inline (raw_content), cloud delete, full upload pipeline (check → alloc token → NOS upload → publish) + ID3v2 tag reading; pure Web Crypto (AES-CBC/ECB, raw RSA via BigInt) verified byte-exact against an independent reference
  • S3 - Removed by request
  • 天翼云盘 (189Cloud) - Re-ported from Polonium-salts/openlistnext (Alpha 0.4.2): chunked session upload (createUploadSession/uploadPart/completeUploadSession), large-ID safe JSON parsing, trusted redirect handling, deferred cookie persistence (consumePendingCookie + flushPendingDriverState), download headers; 20 unit tests (npm run test:189)
  • FTP / SFTP
  • PikPak - Ported from Go v4 driver (Web platform: WebClientID/Secret + WebAlgorithms captcha sign + MD5 device-id from username+password). login → refreshToken → captchaTokenAtLogin flow, token refresh retry on 4122/4121/16/9. list/get/mkdir/move/copy/rename/remove implemented; put() throws (requires OSS multipart upload pipeline).
  • Seafile - Ported from Go v4 driver: token-based auth (token or username/password), supports library listing at root, dir listing, mkdir/move/rename/copy/remove + multipart upload via /api2/repos/{id}/upload-link/. Encrypted libraries decryptable via repo_pwd.
  • 又拍云对象存储 (Upyun/USS) - Ported from Go v4 driver using pure fetch (no upyun-sdk): Basic auth with operator:password, list via X-Upyun-List header, move/copy via X-Upyun-Move/Copy-Source headers, anti-theft-chain URL signing via MD5(prefix+expireAt+key). Includes pure-JS MD5 (RFC 1321) since Web Crypto Subtle doesn't support MD5.
  • WebDAV
  • Teambition - Ported from Go v4 driver: cookie-based auth (china/international region switch), collections + works dual listing, archive-based remove, fork-based copy, move-based rename. put() throws (requires S3 upload token pipeline).
  • MediaFire - Ported from Go v4 driver (simplified): cookie + auto-acquired session_token via /application/get_session_token.php, renew_session_token for token refresh, /folder/get_content.php dual fetch (folders + files with chunk pagination), /file/get_links.php direct_download with HEAD redirect follow. list/get/mkdir/move/copy/rename/remove implemented; put() throws (requires action token + chunked upload pipeline).
  • 分秒帧 (Fenmiao / MediaTrack) - Ported from Go v4 driver: Bearer access_token auth, /v4/assets/{id}/children paginated listing, /v1/download_token/asset → /v1/download/redirect redirect chain for download URL. list/get/mkdir/move/copy/rename/remove implemented; put() throws (requires COS S3 temporary credentials pipeline).
  • ProtonDrive - Skipped: requires full ProtonMail crypto stack (SRP-6a + bcrypt + Curve25519 + AES-256-GCM + OpenPGP packet parsing). ~3000 LOC of Go → ~3000+ LOC TS. Documented in drivers/proton_drive/types.ts as future work. Recommended: use @pdrive/sdk npm package on Node.js container backend (breaks CF Workers compat).
  • 和彩云 (Mcloud / 139Cloud) - Ported from Go v4 driver (simplified, personal_new variant only): Base64-encoded authorization with type:account:token format, XML-based token refresh via /tellin/authTokenRefresh.do, route policy query for personal cloud host, mcloud-sign request signing (encodeURIComponent + sort + base64 + MD5). list/get/mkdir/move/copy/rename/remove implemented; put() throws (requires chunked upload pipeline).
  • YandexDisk - Ported from Go v4 driver: OAuth refresh_token + access_token flow, supports online API (api.oplist.org/yandexui/renewapi) or direct oauth.yandex.com/token refresh, /v1/disk/resources REST API with pagination, /download and /upload link endpoints. Full list/get/mkdir/move/copy/rename/remove + PUT upload via Yandex's href-based upload.
  • Terabox - Ported from Go v4 driver: cookie + jsToken authentication (jsToken parsed from /page HTML via function%20fn%28a%29%7Bwindow.jsToken regex), auto-renewal on errno 4000023/450016, automatic base_url switch on errno -6 redirect (Url-Domain-Prefix header), RC4-based sign() function for /api/download, /api/filemanager CRUD with async=0&filelist=...&ondup=newcopy body format. Full list/get/mkdir/move/copy/rename/remove + simplified single-chunk put().
  • UC网盘 (UC Drive) - Ported from Go v4 driver (quark_uc variant with UC config): pc-api.uc.cn API endpoint, UCBrowser pr header, drive.uc.cn referer. Cookie-based auth with __puus auto-refresh. Same /file/sort listing + /file/download link pattern as Quark. Full list/get/mkdir/move/copy/rename/remove implemented; put() throws.
  • 迅雷网盘 (Xunlei Drive) - Already implemented as ThunderDriver + ThunderExpertDriver; ThunderBrowser and ThunderX variants can be configured via ThunderExpertDriver with custom algorithms/client_id (no separate driver needed).
  • 批量移植 OpenList HTTP 驱动 (27 个新驱动) - 全部纯 fetch + Web Crypto 实现，保持 Cloudflare Workers 兼容:
    • AListV3 (兼容 OpenList 服务器，含 put 上传 + 401 重登录)
    • OpenListShare (分享链接只读浏览, /@s/ + /sd/ 直链)
    • Misskey (drive API 全读写 + multipart 上传)
    • Emby (api_key/用户名密码双模式, 剧集显示名逻辑, 只读)
    • WoPan 联通云盘 (wire 协议 1:1: md5 签名 + AES-128-CBC, token 自动刷新)
    • KodBox (session 鉴权, 全读写 + multipart put)
    • CnbReleases (CNB/GitCode 仓库 Releases, 只读)
    • AliyundriveShare (refresh_token 轮换 + share_token 双层鉴权 + 限流)
    • GitHubReleases (latest/all-versions 双模式 + gh_proxy 直链加速)
    • GooglePhoto (相册/全部照片虚拟目录, mediaItems:search)
    • Dropbox (OAuth 双模式 + 完整上传会话 20MB 分片)
    • FebBox (OAuth client_credentials/refresh_token, error_code -10001 重试)
    • PikPakShare (captcha 签名链 + pass_code, 三平台)
    • LenovoNasShare (stoken 换取 + dtoken 下载直链)
    • CloudflareImgBed (三种上传管线: standard/分片/HuggingFace LFS + 虚拟目录)
    • AliDoc 阿里云文档 (钉钉 cookie 鉴权 + 预签名 OSS 直链)
    • Cloudreve v3 (session cookie, 全读写)
    • Cloudreve v4 (token 鉴权, 全读写)
    • ChaoXingGroupDrive 超星云盘 (cookie, 全读写)
    • BunnyStorage (AccessKey 头鉴权, 路径型)
    • OnedriveSharelink (分享链接解析, 免账号只读)
    • Teldrive (JWT 鉴权; Telegram 分片上传 put 抛错)
    • 123PanShare (CRC32 签名 + 700ms 限速, 只读)
    • Degoo (GraphQL + 登录链; S3 分片上传 put 抛错)
    • WPS (cookie 鉴权, Personal/Business 双端 + 完整预签名上传)
    • GuangYaPan 光速盘 (token/短信双模式 + 任务轮询)
    • Doubao 豆包网盘 (cookie, 三分支直链: download/play/file_url)
  • 上一批 13 驱动补齐 admin 表单配置 (pikpak/seafile/uss/teambition/mediatrack/yandex_disk/terabox/uc/139/mediafire)
  • 中央驱动注册表 src/backend/drivers/registry.ts (37 个配置聚合)
  • storage.ts 统一注册 + token/cookie 持久化回调 (persistAdditionFields 辅助)
  • 修复: UC 驱动名被 Quark 分支抢占的注册冲突; AliyundriveShare 占位映射指向新驱动

Cloudflare Workers 兼容性

  • 无 Node.js 模块依赖（纯 fetch / Web Crypto / ReadableStream）
  • KV 持久化（NEXTLIST_KV binding，wrangler.toml 已配置）
  • 动态 base 移除（静态资源 /assets/* 直接由 ASSETS binding 提供）
  • 回归测试：scripts/test-workers-env.mts (11 项)
  • 驱动注册：Local（守卫）/ Quark / BaiduNetdisk / 123Pan / Onedrive / AliyundriveOpen / GoogleDrive / NeteaseMusic

Developer TODOs

  • Implement backend auth endpoints (/api/auth) correctly with JWT (using .env for credentials).
  • 后台管理功能 (Admin management): Implement basic Storage and Settings management via local JSON database.
  • Implement backend fs operations for Local driver mapping to container filesystem.
  • Implement storage management CRUD endpoints (list storages, update, delete, get).
  • 分享管理 CRUD (/api/share/*) + 分享访问 (/@s/ 浏览、/sd/ 下载、密码/过期/禁用校验、虚拟列表)
  • 任务管理 API (/api/task/*) — list/retry/cancel/delete/clear
  • 元数据管理 API (/api/admin/meta/*) — CRUD
  • 目录树 API (/api/fs/dirs)
  • 批量重命名 API (/api/fs/batch_rename) — 逐条容错，返回失败明细
  • 删除空目录 API (/api/fs/remove_empty_directory) — 递归自底向上、保护挂载点、有遍历上限
  • 表单上传 API (PUT /api/fs/form) — multipart，复用 putItem
  • SSH 公钥管理 API (/api/me/sshkey/_ + /api/admin/user/sshkey/_) — 格式校验 + SHA256 指纹
  • 123Pan 驱动 (types/util/driver + 注册 + 配置表单)
  • 所有网盘驱动统一 order_by/order_direction 排列设置（共享 sortFileItems）
  • 品牌统一 OpenList → NextList（站点标题/图标/标识符/KV 名称）
  • 移除 S3 全部功能（驱动/路由/设置/前端菜单）
  • 中英文语言 JSON 完善（15 个文件 key 完全一致 + 代码引用 0 缺失）
  • 生产构建修复（移除 vite-plugin-dynamic-base，资源路径恢复正常）
  • 关于页面改为本地打包 README（离线可用）