Improve static file handling, URL path derivation, and add MQTT port support

- Refactor static.ts to properly handle index.html paths, simplify path joining, and log received entries.
- Fix deriveURLPath to standardize Windows-style paths and eliminate incorrect path joining for URLs.
- Enhance checkAllowedModulePath for precise error reporting and improved URL-to-path conversion.
- Add MQTT and MQTTS port constants to harperLifecycle and update lifecycle variables to prevent port conflicts in integration tests.

Author: kriszyp

components/deriveURLPath.ts

@@ -8,6 +8,7 @@ function pathStartsWithBase(base: string, path: string) {
 }
 
 export function deriveURLPath(component: Component | ComponentV1, path: string, type: 'file' | 'directory'): string {
+	path = path.replace(/\\/g, '/'); // converting from potential windows path to URL paths
 	if (path.startsWith('./')) {
 		path = path.slice(2); // remove leading './'
 	}
@@ -53,5 +54,5 @@ export function deriveURLPath(component: Component | ComponentV1, path: string,
 		}
 	}
 
-	return join(component.baseURLPath, path);
+	return component.baseURLPath + path; // note, do NOT use join here, this is not a file system path, this is a URL path
 }

integrationTests/utils/harperLifecycle.ts

@@ -11,6 +11,8 @@ import { equal } from 'node:assert';
 // Constants
 const HTTP_PORT = 9926;
 const HTTPS_PORT = 9927;
+const MQTT_PORT = 1883;
+const MQTTS_PORT = 8883;
 export const OPERATIONS_API_PORT = 9925;
 export const DEFAULT_ADMIN_USERNAME = 'admin';
 export const DEFAULT_ADMIN_PASSWORD = 'Abc1234!';
@@ -310,6 +312,8 @@ export async function startHarper(ctx: ContextWithHarper, options?: StartHarperO
 		`--NODE_HOSTNAME=${loopbackAddress}`,
 		`--HTTP_PORT=${loopbackAddress}:${HTTP_PORT}`,
 		`--OPERATIONSAPI_NETWORK_PORT=${loopbackAddress}:${OPERATIONS_API_PORT}`,
+		`--MQTT_NETWORK_PORT=${loopbackAddress}:${MQTT_PORT}`,
+		`--MQTT_NETWORK_SECUREPORT=${loopbackAddress}:${MQTTS_PORT}`,
 		'--LOGGING_LEVEL=debug',
 		'--LOGGING_STDSTREAMS=false',
 	];

security/jsLoader.ts

@@ -922,14 +922,14 @@ function createSpawn(spawnFunction: (...args: any) => child_process.ChildProcess
  */
 function checkAllowedModulePath(moduleUrl: string, allowedPath?: string): boolean {
 	if (moduleUrl.startsWith('file:')) {
-		let path = moduleUrl.slice(7);
+		let path = fileURLToPath(moduleUrl);
 		try {
 			path = realpathSync(path);
 		} catch {}
 		if (!allowedPath || path.startsWith(allowedPath)) {
 			return;
 		}
-		throw new Error(`Can not load module outside of allowed path`);
+		throw new Error(`Can not load module at ${path} outside of allowed path ${allowedPath}`);
 	}
 	let simpleName = moduleUrl.startsWith('node:') ? moduleUrl.slice(5) : moduleUrl;
 	simpleName = simpleName.split('/')[0];

server/static.ts

@@ -1,5 +1,5 @@
 import { realpathSync, existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 import { Scope } from '../components/Scope';
 import send from 'send';
 
@@ -36,6 +36,7 @@ export function handleApplication(scope: Scope) {
 
 	// Handle entry events for the default entry handler based on the `files` and `urlPath` options
 	scope.handleEntry((entry) => {
+		logger.error('static received entry', entry);
 		switch (entry.eventType) {
 			// Directories only matter for the `index` files
 			case 'addDir':
@@ -53,17 +54,20 @@ export function handleApplication(scope: Scope) {
 				// If the file is an index.html, also store it in the index entries
 				if (entry.urlPath.endsWith('index.html')) {
 					// Without trailing slash; null -> 301 redirect to trailing slash
-					indexEntries.set(dirname(entry.urlPath), null);
+					let lastSlashIndex = entry.urlPath.lastIndexOf('/');
+					indexEntries.set(entry.urlPath.slice(0, lastSlashIndex), null);
 					// With trailing slash; serves the index.html file
-					indexEntries.set(join(dirname(entry.urlPath), '/'), entry.absolutePath);
+					indexEntries.set(entry.urlPath.slice(0, lastSlashIndex + 1), entry.absolutePath);
 				}
 				break;
 			case 'unlink':
 				// Remove the file from memory when it is deleted
 				staticFiles.delete(entry.urlPath);
 				// If the file is an index.html, remove it from the index entries as well
 				if (entry.urlPath.endsWith('index.html')) {
-					indexEntries.delete(dirname(entry.urlPath));
+					let lastSlashIndex = entry.urlPath.lastIndexOf('/');
+					indexEntries.delete(entry.urlPath.slice(0, lastSlashIndex));
+					indexEntries.delete(entry.urlPath.slice(0, lastSlashIndex + 1));
 				}
 				break;
 		}
@@ -101,7 +105,7 @@ export function handleApplication(scope: Scope) {
 						return {
 							status: 301,
 							headers: {
-								Location: join(req.pathname, '/'),
+								Location: req.pathname + '/',
 							},
 						};
 					}