update resolver_conf_parsing version to 1.31.6

Dockerfile

@@ -1,15 +1,15 @@
 # syntax=docker/dockerfile:1.27.0@sha256:bde3983e9c939224420ddaf6b784cc30e09b035a4dea01f581230c50809f372e
-FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS nginx
+FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS nginx
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 
 ARG LUAJIT_INC=/usr/include/luajit-2.1
 ARG LUAJIT_LIB=/usr/lib
 
-ARG AWSLC_VER=a3d1e685552f05a9ad04a2946962c03e97bdecac # v5.8.0
+ARG AWSLC_VER=39b142ec346e514af5e49cbd6036e2ed3b893466 # v5.9.0
 
-ARG NGINX_VER=c82a590adc3a317dfb9b738d76cb2dd45e3cfcbe # release-1.31.5
+ARG NGINX_VER=45a318d05a0fd23f57ffe9579f7f0969c0fe402a # release-1.31.6
 ARG DTR_VER=1.29.2
-ARG RCP_VER=1.31.4
+ARG RCP_VER=1.31.6
 ARG ZNP_VER=1.30.0
 
 ARG NB_VER=35ec7c13cf2baf758845f727dae220acf9fb3445 # master
@@ -19,7 +19,7 @@ ARG NHUZFM_VER=658990e20a5f1cefbf760eb427741ce95b6eebc9 # main
 ARG NF_VER=047589e4dc0041517b8a47739fa960c430c4045e # v0.6.0
 ARG HMNM_VER=0bf283ff92017acd616814b0e5153e0ccf93e2c9 # v0.40
 ARG NDK_VER=bd44d16302273052d6005d7bdb55f74e23813de3 # v0.3.4
-ARG LNM_VER=84cc201565bc2ef12dcab6eb25e7ccaf44d56d42 # v0.10.32rc4
+ARG LNM_VER=58ece96055227399bbffa5e06cb5b54ebeeacef9 # v0.10.32rc5
 
 ARG NJS_VER=1b648f8805596c95368f8fa428a5c38c5d279857 # 1.0.1
 ARG NAL_VER=241200eac8e4acae74d353291bd27f79e5ca3dc4 # master
@@ -73,7 +73,7 @@ RUN git-clone-commit.sh https://github.com/nginx/nginx "$NGINX_VER" /src/nginx &
     echo "0aa9c73e7515dbbd48ecc798f7894412c1a50e96e98aee25847e823059faf821  /src/nginx/4.patch" | sha256sum -c - && \
     git apply /src/nginx/4.patch && \
     wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$RCP_VER"/nginx-"$RCP_VER"-resolver_conf_parsing.patch -O /src/nginx/5.patch && \
-    echo "bda9db7d2766b20c9490f1ccd6d2da72fee402ade219efb32fe341851dbdd7c8  /src/nginx/5.patch" | sha256sum -c - && \
+    echo "354bb2c05a41357efe3ea9d28a2fc8ff2a5fe6482e0fdda61a237d6bb5a96d51  /src/nginx/5.patch" | sha256sum -c - && \
     git apply /src/nginx/5.patch && \
     wget -q https://raw.githubusercontent.com/zlib-ng/patches/master/nginx/"$ZNP_VER"-zlib-ng.patch -O /src/nginx/6.patch && \
     echo "bcd0f2fb9723fc1f251f94cead8d5160e767f7d4a04365331396a72a9ba54c6b  /src/nginx/6.patch" | sha256sum -c - && \
@@ -170,7 +170,7 @@ RUN find /usr/local/nginx/modules -name "*.so" -exec llvm-strip -s {} \; && \
     /usr/local/nginx/sbin/nginx -V
 
 
-FROM --platform="$BUILDPLATFORM" alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS frontend
+FROM --platform="$BUILDPLATFORM" alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS frontend
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 ARG NODE_ENV=production
 WORKDIR /app
@@ -185,7 +185,7 @@ COPY frontend /app
 RUN pnpm vite build && \
     find /app/dist -type f ! -name "*.jpg" ! -name "*.png" -print0 | xargs -r0 -P "$(nproc)" -n 1 brotli -q 11 -sf
 
-FROM --platform=$BUILDPLATFORM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS backend
+FROM --platform=$BUILDPLATFORM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS backend
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 ARG NODE_ENV=production
 ARG TARGETARCH
@@ -207,7 +207,7 @@ RUN apk upgrade --no-cache -a && \
 COPY backend /app
 
 
-FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 ENV NODE_ENV=production
 ARG LRC_VER=be42297c57dc2393cdbb09d4597d9d4840a7c769 # v0.1.35rc1

backend/internal/dead-host.js

@@ -22,6 +22,8 @@ const internalDeadHost = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("dead_hosts:manage");
@@ -83,6 +85,8 @@ const internalDeadHost = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("dead_hosts:manage");

backend/internal/nginx.js

@@ -339,17 +339,8 @@ const internalNginx = {
 			const originalLocations = [...host.locations];
 			host.locations = await internalNginx.renderLocations(host);
 
-			const providerEnvMap = {
-				anubis: "AUTH_REQUEST_ANUBIS_UPSTREAM",
-				tinyauth: "AUTH_REQUEST_TINYAUTH_UPSTREAM",
-				oauth2proxy: "AUTH_REQUEST_OAUTH2PROXY_UPSTREAM",
-				voidauth: "AUTH_REQUEST_VOIDAUTH_UPSTREAM",
-				authelia: "AUTH_REQUEST_AUTHELIA_UPSTREAM",
-				authentik: "AUTH_REQUEST_AUTHENTIK_UPSTREAM",
-			};
-
-			for (const [provider, envKey] of Object.entries(providerEnvMap)) {
-				let effectiveUpstream = process.env[envKey] || "";
+			for (const provider of ["anubis", "tinyauth", "oauth2proxy", "voidauth", "authelia", "authentik"]) {
+				let effectiveUpstream = "";
 
 				if (
 					(host.npmplus_auth_request === provider ||

backend/internal/proxy-host-access-list.js

@@ -366,10 +366,11 @@ const internalProxyHostAccessList = {
 
 	/**
 	 * Ensures the provided acls are valid (if custom, at least 1 acl must be specified)
+	 * @param {Access} access
 	 * @param {*} proxyHost
 	 * @returns
 	 */
-	validateAccessLists: async (proxyHost) => {
+	validateAccessLists: async (access, proxyHost) => {
 		if (!proxyHost) {
 			return;
 		}
@@ -399,12 +400,18 @@ const internalProxyHostAccessList = {
 		}
 		// make sure no ACLs that are being uploaded have been soft deleted
 		if (aclIds.size > 0) {
-			const rows = await accessListModel
+			const query = accessListModel
 				.query()
 				.whereIn("id", [...aclIds])
 				.andWhere("is_deleted", 0)
 				.select("id");
 
+			if (access.visibility !== "all") {
+				query.andWhere("owner_user_id", access.token.getUserId(1));
+			}
+
+			const rows = await query;
+
 			const validIds = new Set(rows.map((row) => row.id));
 			const invalidIds = [...aclIds].filter((id) => !validIds.has(id));
 

backend/internal/proxy-host.js

@@ -23,6 +23,8 @@ const internalProxyHost = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("proxy_hosts:manage");
@@ -40,7 +42,7 @@ const internalProxyHost = {
 		thisData.owner_user_id = access.token.getUserId(1);
 		thisData = internalHost.cleanSslHstsData(createCertificate, thisData);
 		thisData = internalProxyHostAccessList.cleanAccessListTypes(thisData);
-		await internalProxyHostAccessList.validateAccessLists(thisData);
+		await internalProxyHostAccessList.validateAccessLists(access, thisData);
 
 		const createdRow = utils.omitRow(omissions())(
 			await proxyHostModel.transaction(async (trx) => {
@@ -101,6 +103,8 @@ const internalProxyHost = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("proxy_hosts:manage");
@@ -141,7 +145,7 @@ const internalProxyHost = {
 		thisData = { domain_names: existingRow.domain_names, ...thisData };
 		thisData = internalHost.cleanSslHstsData(createCertificate, thisData, existingRow);
 		thisData = internalProxyHostAccessList.cleanAccessListTypes(thisData);
-		await internalProxyHostAccessList.validateAccessLists(thisData);
+		await internalProxyHostAccessList.validateAccessLists(access, thisData);
 
 		await proxyHostModel.transaction(async (trx) => {
 			const patchResult = await proxyHostModel.query(trx).where({ id: thisData.id }).patch(thisData);

backend/internal/redirection-host.js

@@ -22,6 +22,8 @@ const internalRedirectionHost = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("redirection_hosts:manage");
@@ -83,6 +85,8 @@ const internalRedirectionHost = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("redirection_hosts:manage");

backend/internal/stream.js

@@ -22,6 +22,8 @@ const internalStream = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("streams:manage");
@@ -72,6 +74,8 @@ const internalStream = {
 
 		if (createCertificate) {
 			delete thisData.certificate_id;
+		} else if (Number(thisData.certificate_id) > 0) {
+			await internalCertificate.get(access, { id: thisData.certificate_id });
 		}
 
 		access.can("streams:manage");

backend/internal/user.js

@@ -77,12 +77,12 @@ const internalUser = {
 		await userPermissionModel.query().insert({
 			user_id: user.id,
 			visibility: isAdmin ? "all" : "user",
-			proxy_hosts: "manage",
-			redirection_hosts: "manage",
-			dead_hosts: "manage",
-			streams: "manage",
-			access_lists: "manage",
-			certificates: "manage",
+			proxy_hosts: "hidden",
+			redirection_hosts: "hidden",
+			dead_hosts: "hidden",
+			streams: "hidden",
+			access_lists: "hidden",
+			certificates: "hidden",
 		});
 
 		await userModel
@@ -446,6 +446,17 @@ const internalUser = {
 		const { id, ...permissionData } = data;
 		const existing_auth = await userPermissionModel.query().where("user_id", user.id).first();
 
+		const merged = { ...existing_auth, ...permissionData };
+		if (merged.proxy_hosts !== "hidden" && merged.access_lists === "hidden") {
+			throw new errs.ValidationError("Access lists can not be hidden while proxy hosts are visible");
+		}
+		if (
+			merged.certificates === "hidden" &&
+			["proxy_hosts", "redirection_hosts", "dead_hosts", "streams"].some((type) => merged[type] !== "hidden")
+		) {
+			throw new errs.ValidationError("Certificates can not be hidden while hosts are visible");
+		}
+
 		if (existing_auth) {
 			permissions = await userPermissionModel
 				.query()

backend/package.json

@@ -31,6 +31,6 @@
 	},
 	"devDependencies": {
 		"@apidevtools/swagger-parser": "13.0.0",
-		"@biomejs/biome": "2.5.13"
+		"@biomejs/biome": "2.5.14"
 	}
 }