Initial scaffold: blob store server, CLI scripts, and PWA share target
Clipboard/screenshot sync across own devices via a single DEVICE_TOKEN-gated blob store, plus a small installable web app so a phone can push/pull clips and share screenshots via the OS share sheet.
This commit is contained in:
Fredrik Johansson
@@ -0,0 +1,10 @@
|
|||||||
|
# Server (docker-compose.yml)
|
||||||
|
IMAGE=
|
||||||
|
HOST_PORT=3041
|
||||||
|
DEVICE_TOKEN=change-me
|
||||||
|
CLIP_TTL_SECONDS=86400
|
||||||
|
SHOT_TTL_SECONDS=1209600
|
||||||
|
MAX_UPLOAD_BYTES=52428800
|
||||||
|
|
||||||
|
# CLI scripts (source into ~/.config/scrot/env)
|
||||||
|
SCROT_SERVER=https://scrot.example.com
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
node_modules/
|
||||||
|
dist/
|
||||||
|
data/
|
||||||
|
.env
|
||||||
|
*.tsbuildinfo
|
||||||
+41
@@ -0,0 +1,41 @@
|
|||||||
|
# ── Stage 1: compile the TypeScript server ────────────────────────────────
|
||||||
|
FROM node:24-slim AS server-build
|
||||||
|
|
||||||
|
# better-sqlite3 has a native addon with no prebuilt binary for this
|
||||||
|
# platform/Node combo yet — build it from source.
|
||||||
|
RUN apt-get update -q && apt-get install -y --no-install-recommends python3 make g++ \
|
||||||
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
COPY server/package*.json server/
|
||||||
|
COPY server/tsconfig.json server/
|
||||||
|
RUN npm install --prefix server
|
||||||
|
|
||||||
|
COPY server/src/ server/src/
|
||||||
|
RUN npm run build --prefix server
|
||||||
|
|
||||||
|
# ── Stage 2: runtime ───────────────────────────────────────────────────────
|
||||||
|
FROM node:24-slim
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
RUN apt-get update -q && apt-get install -y --no-install-recommends python3 make g++ \
|
||||||
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
COPY server/package*.json server/
|
||||||
|
RUN npm install --prefix server --omit=dev \
|
||||||
|
&& apt-get purge -y python3 make g++ && apt-get autoremove -y
|
||||||
|
|
||||||
|
COPY --from=server-build /app/server/dist server/dist
|
||||||
|
COPY server/public/ server/public/
|
||||||
|
|
||||||
|
# Do NOT copy data/ — mutable runtime volume holding the SQLite DB and blob
|
||||||
|
# bytes. Baking it into the image would clobber it on every redeploy.
|
||||||
|
ENV NODE_ENV=production
|
||||||
|
ENV PORT=3000
|
||||||
|
ENV DATA_DIR=/app/data
|
||||||
|
|
||||||
|
EXPOSE 3000
|
||||||
|
|
||||||
|
CMD ["node", "server/dist/index.js"]
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2026 explewd
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
+153
@@ -0,0 +1,153 @@
|
|||||||
|
# Proposal: `scrot` — clipboard sync + screenshot sharing, one blob store
|
||||||
|
|
||||||
|
**Status:** proposed, being scaffolded. Self-contained — written so a fresh
|
||||||
|
agent with no prior conversation context can pick this up and implement it
|
||||||
|
without anything explained first.
|
||||||
|
|
||||||
|
## Motivation
|
||||||
|
|
||||||
|
Two small personal itches, both solved by the same mechanism:
|
||||||
|
|
||||||
|
1. **Clipboard/note sync across your own devices** — copy something on one
|
||||||
|
machine, paste it on another, without a cloud clipboard manager whose
|
||||||
|
sync feature might get paywalled or discontinued (Authy killed its
|
||||||
|
desktop app; plenty of "free" sync tools have gone the same way).
|
||||||
|
2. **Screenshot → instant public link** — hit a hotkey, get a shareable URL
|
||||||
|
on the clipboard, without depending on Imgur/CloudApp/ShareX's own
|
||||||
|
uploader service.
|
||||||
|
|
||||||
|
Both are "send a blob to `<server>`, get it back later" — one privately (to
|
||||||
|
your own other devices), one publicly (a link you hand to someone else).
|
||||||
|
Building two separate services would just be `wisp` and `flit` again with
|
||||||
|
extra steps. `scrot` is one blob store with a `visibility` flag, because the
|
||||||
|
underlying problem is identical and only the retrieval path differs.
|
||||||
|
|
||||||
|
## What it isn't
|
||||||
|
|
||||||
|
- **Not `wisp`.** wisp is single-retrieval, end-to-end encrypted,
|
||||||
|
multi-user (anyone with the link decrypts). `scrot` is single-user
|
||||||
|
(you and only you, across your own devices), multi-retrieval for
|
||||||
|
clipboard items (poll for "is there something newer than what I have"),
|
||||||
|
and does not need E2E encryption — the server is already fully trusted
|
||||||
|
homelab infrastructure, same trust level as `keep`.
|
||||||
|
- **Not `flit`.** flit is synchronous peer-to-peer (both devices online at
|
||||||
|
once, WebRTC, zero server storage). `scrot` is deliberately the opposite:
|
||||||
|
async, server-stored, no P2P handshake — you copy on your phone at lunch
|
||||||
|
and it's there on your laptop that evening.
|
||||||
|
- **Not a general file sync tool.** No folder watching, no bidirectional
|
||||||
|
sync, no conflict resolution. One blob at a time, pushed explicitly, read
|
||||||
|
explicitly. If this needs Syncthing-shaped features later, that's a sign
|
||||||
|
it's the wrong tool for the job, not a sign to add them here.
|
||||||
|
|
||||||
|
## Core model
|
||||||
|
|
||||||
|
Single `blobs` table. Every row has a `kind` (`clip` | `shot`) and a
|
||||||
|
`visibility` implied by kind:
|
||||||
|
|
||||||
|
- **`clip`** — text or small file, private. Pull-only: any of your
|
||||||
|
authenticated devices can ask "what's the latest clip?" and get it back.
|
||||||
|
No public URL is ever minted for a `clip` blob.
|
||||||
|
- **`shot`** — image, public. Upload returns a short unguessable link
|
||||||
|
(`/s/:id`) that renders/downloads the image, no auth required to view —
|
||||||
|
same trust model as handing someone a link to a photo, not a secret.
|
||||||
|
|
||||||
|
TTL-based cleanup for both (default: clips expire fast, a day or so —
|
||||||
|
they're meant to be grabbed promptly, not archived; shots live longer,
|
||||||
|
long enough to actually be shared and viewed — a week or two). This
|
||||||
|
reuses `wisp`'s sweep-on-interval `cleanup.ts` pattern outright, just with
|
||||||
|
per-kind TTLs instead of one global one.
|
||||||
|
|
||||||
|
**No E2E encryption.** Unlike wisp (built for sharing with other people,
|
||||||
|
where the server operator shouldn't be able to read the payload), scrot's
|
||||||
|
server is single-user infrastructure you already trust with everything
|
||||||
|
else (`keep`, `trace`). Adding client-side crypto here would be defense
|
||||||
|
against a threat model (yourself, or your own trusted host) that doesn't
|
||||||
|
apply — skip it, keep the client thin.
|
||||||
|
|
||||||
|
## Auth
|
||||||
|
|
||||||
|
Single shared `DEVICE_TOKEN` (env var, server refuses to start without it —
|
||||||
|
same posture as wisp's `UPLOAD_PASSWORD`), sent as `X-Device-Token` on every
|
||||||
|
request. Not a per-device registry: this is you, across a handful of
|
||||||
|
machines you personally set up, not a multi-tenant service. If a device
|
||||||
|
needs revoking, rotate the token and re-provision the (few) devices that
|
||||||
|
need it — full device-management UI would be over-engineering for a
|
||||||
|
single-user tool.
|
||||||
|
|
||||||
|
## API
|
||||||
|
|
||||||
|
- `POST /api/blobs` — body is the raw content (text for `clip`, image
|
||||||
|
bytes for `shot`), `X-Blob-Kind: clip|shot` header selects the table row
|
||||||
|
shape. Requires `X-Device-Token`. Returns `{ id, retrieveAt }` — for
|
||||||
|
`shot`, `retrieveAt` is the public `/s/:id` URL; for `clip`, it's null
|
||||||
|
(nothing public to hand back).
|
||||||
|
- `GET /api/clip/latest` — requires `X-Device-Token`. Returns the most
|
||||||
|
recent non-expired `clip` blob's content plus its `id`/`created_at`, or
|
||||||
|
`204` if there isn't one. Polling this (or calling it on-demand from a
|
||||||
|
keybinding) is the whole "pull" side of clipboard sync — no push
|
||||||
|
notification, no websocket, deliberately simple.
|
||||||
|
- `GET /s/:id` — public, no auth. Serves the `shot` blob's bytes with the
|
||||||
|
right `Content-Type`. 404 once expired/swept.
|
||||||
|
|
||||||
|
That's the entire API surface. No listing endpoint, no delete endpoint
|
||||||
|
(TTL handles cleanup), no rename/metadata — matches the family's existing
|
||||||
|
bias toward the smallest API that solves the actual problem.
|
||||||
|
|
||||||
|
## Server implementation
|
||||||
|
|
||||||
|
Directly reuses `wisp/server`'s shape: Express + `better-sqlite3`, TS,
|
||||||
|
WAL-mode SQLite, `data/` volume holding both the DB and blob bytes on disk
|
||||||
|
(not inline in SQLite — same reasoning as wisp, keeps the DB small and
|
||||||
|
lets large images stream instead of buffering fully into a BLOB column).
|
||||||
|
|
||||||
|
```
|
||||||
|
server/
|
||||||
|
src/
|
||||||
|
config.ts // PORT, DATA_DIR, DEVICE_TOKEN, CLIP_TTL_SECONDS, SHOT_TTL_SECONDS
|
||||||
|
db.ts // blobs table, blobPath()
|
||||||
|
ids.ts // reused verbatim from wisp (base62 random ids)
|
||||||
|
auth.ts // checkDeviceToken(req) — single timing-safe comparison
|
||||||
|
routes.ts // POST /blobs, GET /clip/latest
|
||||||
|
public.ts // GET /s/:id (separate from routes.ts: no auth middleware)
|
||||||
|
cleanup.ts // per-kind TTL sweep, same interval-timer pattern as wisp
|
||||||
|
index.ts
|
||||||
|
```
|
||||||
|
|
||||||
|
## Client side
|
||||||
|
|
||||||
|
No native app. Two thin shell scripts under `cli/`, each a keybinding away
|
||||||
|
from useless friction, plus a small installable PWA (`server/public/`) for
|
||||||
|
mobile — see [README.md](./README.md#mobile--pwa) for the share-target /
|
||||||
|
onboarding design, added once this looked headed for public use and "SSH in
|
||||||
|
and edit a dotfile" stopped being an acceptable mobile onboarding story:
|
||||||
|
|
||||||
|
- `cli/scrot-clip-push` — reads the system clipboard (`wl-paste`/`xclip`
|
||||||
|
depending on session type), `curl -X POST` with `X-Blob-Kind: clip`.
|
||||||
|
- `cli/scrot-clip-pull` — `curl GET /api/clip/latest`, writes the result
|
||||||
|
back into the system clipboard (`wl-copy`/`xclip -selection clipboard`).
|
||||||
|
- `cli/scrot-shot` — runs the local screenshot capture tool (`grim -g "$(slurp)"`
|
||||||
|
on Wayland, or `maim -s` on X11 — detect via `$XDG_SESSION_TYPE`), pipes
|
||||||
|
the PNG straight to `curl -X POST` with `X-Blob-Kind: shot`, and copies
|
||||||
|
the returned `/s/:id` URL to the clipboard so the very next action is
|
||||||
|
"paste the link."
|
||||||
|
|
||||||
|
Each script is `DEVICE_TOKEN`/`SCROT_SERVER` via environment (sourced from
|
||||||
|
a `~/.config/scrot/env` file, gitignored, same as every other project's
|
||||||
|
`.env` convention) — no config file parsing needed beyond that.
|
||||||
|
|
||||||
|
## Deploy
|
||||||
|
|
||||||
|
Directly mirrors `wisp`'s `Dockerfile`/`docker-compose.yml` — single-stage
|
||||||
|
server build (no client/ to build in stage 1, since there's no browser UI
|
||||||
|
at all), named volume for `data/`, env-driven config, later migrated onto
|
||||||
|
`keep` for secret delivery like every other project on the migration list.
|
||||||
|
|
||||||
|
## Open questions (deliberately deferred, not blocking scaffolding)
|
||||||
|
|
||||||
|
- Does `clip` need a history (last N items) instead of just "latest"? Start
|
||||||
|
with latest-only — it's the actual use case (grab what I just copied
|
||||||
|
elsewhere), and multi-item history is a strictly bigger feature to add
|
||||||
|
later if it turns out to matter.
|
||||||
|
- Should `shot` support a "burn after first view" mode like wisp's drops?
|
||||||
|
Deferred — the primary use case is "share a link with someone," which
|
||||||
|
wants repeat viewing, not single-retrieval.
|
||||||
@@ -0,0 +1,93 @@
|
|||||||
|
# scrot
|
||||||
|
|
||||||
|
Clipboard sync across your own devices, and screenshot → instant public
|
||||||
|
link. One blob store, one small server, two thin CLI scripts.
|
||||||
|
|
||||||
|
## Why
|
||||||
|
|
||||||
|
Two small itches, solved by the same mechanism — see
|
||||||
|
[PROPOSAL.md](./PROPOSAL.md) for the full design rationale, and why this
|
||||||
|
isn't just `wisp` or `flit` again:
|
||||||
|
|
||||||
|
- **Clipboard sync**: copy on one machine, pull it on another, without a
|
||||||
|
cloud clipboard manager that might get paywalled or discontinued.
|
||||||
|
- **Screenshot → link**: capture a region, get a shareable URL on your
|
||||||
|
clipboard immediately, without an Imgur/CloudApp-style third-party
|
||||||
|
uploader.
|
||||||
|
|
||||||
|
## Model
|
||||||
|
|
||||||
|
A single `blobs` table with a `kind`:
|
||||||
|
|
||||||
|
- `clip` — private, text. Pull-only — your other devices ask "what's the
|
||||||
|
latest clip?" No public URL is ever minted.
|
||||||
|
- `shot` — public, image. Upload returns a short link (`/s/:id`) anyone
|
||||||
|
with the link can view — no auth required, same trust level as handing
|
||||||
|
someone a photo link.
|
||||||
|
|
||||||
|
Single shared `DEVICE_TOKEN` gates every write and the private clip-read —
|
||||||
|
this is single-user infrastructure across your own machines, not a
|
||||||
|
multi-tenant service, so there's no per-device registry to manage.
|
||||||
|
|
||||||
|
No end-to-end encryption: unlike `wisp` (built for sharing with other
|
||||||
|
people), this server is already fully trusted homelab infra, same trust
|
||||||
|
level as `keep`/`trace`. Adding client-side crypto here would defend
|
||||||
|
against a threat that doesn't apply.
|
||||||
|
|
||||||
|
## Server
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd server
|
||||||
|
npm install
|
||||||
|
DEVICE_TOKEN=... npm run dev
|
||||||
|
```
|
||||||
|
|
||||||
|
See [.env.example](./.env.example) for the full config surface
|
||||||
|
(`CLIP_TTL_SECONDS`, `SHOT_TTL_SECONDS`, `MAX_UPLOAD_BYTES`, ...).
|
||||||
|
|
||||||
|
## CLI
|
||||||
|
|
||||||
|
Four scripts in [cli/](./cli/), each meant to sit behind a keybinding:
|
||||||
|
|
||||||
|
- `scrot-clip-push` — pushes the current system clipboard as a `clip`.
|
||||||
|
- `scrot-clip-pull` — fetches the latest `clip` into the system clipboard.
|
||||||
|
- `scrot-shot` — captures a region screenshot, uploads it as a `shot`,
|
||||||
|
copies the resulting public link to the clipboard.
|
||||||
|
- `scrot-onboard` — prints (and, with `qrencode` installed, renders as a
|
||||||
|
terminal QR code) the link that onboards a phone onto the PWA below.
|
||||||
|
|
||||||
|
Each needs `SCROT_SERVER` and `DEVICE_TOKEN` in the environment — source
|
||||||
|
them from `~/.config/scrot/env` (gitignored, not tracked here). Wayland
|
||||||
|
(`wl-paste`/`wl-copy`/`grim`+`slurp`) and X11 (`xclip`/`maim`) are both
|
||||||
|
supported, auto-detected via `$WAYLAND_DISPLAY`.
|
||||||
|
|
||||||
|
## Mobile / PWA
|
||||||
|
|
||||||
|
The server also serves a small installable web app (`server/public/`) —
|
||||||
|
paste-or-share text as a `clip`, upload/share an image as a `shot`, and pull
|
||||||
|
the latest clip back down. No separate mobile client.
|
||||||
|
|
||||||
|
Onboarding a phone onto the shared `DEVICE_TOKEN`: run `scrot-onboard` and
|
||||||
|
open the printed link (or scan the QR) on the phone. That saves the token
|
||||||
|
into the page's `localStorage` and mirrors it into a cookie. Add the app to
|
||||||
|
the home screen and reopen it once — that re-fetches `/manifest.webmanifest`
|
||||||
|
with the token now baked into its `share_target.action` URL (see
|
||||||
|
[server/src/manifest.ts](./server/src/manifest.ts)), which is what makes
|
||||||
|
"Share to scrot" show up in the OS share sheet for photos and selected text.
|
||||||
|
No service worker involved: the share sheet POSTs straight to `/share`
|
||||||
|
([server/src/share.ts](./server/src/share.ts)), which checks the token in
|
||||||
|
the query string (custom headers aren't available to a share-target POST)
|
||||||
|
and inserts the blob through the same path as `POST /api/blobs`.
|
||||||
|
|
||||||
|
## Status
|
||||||
|
|
||||||
|
Scaffolded: server (routes, auth, TTL cleanup, SQLite, PWA share target) and
|
||||||
|
CLI scripts written, not yet run against a real deployment or wired into
|
||||||
|
`keep`. Next: `npm install` + smoke test locally, then a first deploy.
|
||||||
|
|
||||||
|
## Deploy
|
||||||
|
|
||||||
|
Mirrors the rest of the project family — `Dockerfile` + `docker-compose.yml`,
|
||||||
|
named volume for `data/`, env-driven config. Not yet migrated onto `keep`
|
||||||
|
for secret delivery (tracked in goonk's `FUTURE.md` ops migration list
|
||||||
|
alongside every other project still on hand-copied `.env`).
|
||||||
Executable
+26
@@ -0,0 +1,26 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Fetches the latest `clip` blob from scrot and writes it into the local
|
||||||
|
# system clipboard.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
: "${SCROT_SERVER:?set SCROT_SERVER, e.g. https://scrot.example.com}"
|
||||||
|
: "${DEVICE_TOKEN:?set DEVICE_TOKEN}"
|
||||||
|
|
||||||
|
response=$(curl -sf -w '\n%{http_code}' "$SCROT_SERVER/api/clip/latest" \
|
||||||
|
-H "X-Device-Token: $DEVICE_TOKEN")
|
||||||
|
|
||||||
|
status="${response##*$'\n'}"
|
||||||
|
body="${response%$'\n'*}"
|
||||||
|
|
||||||
|
if [ "$status" = "204" ]; then
|
||||||
|
echo "no clip yet" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -n "${WAYLAND_DISPLAY:-}" ]; then
|
||||||
|
printf '%s' "$body" | wl-copy
|
||||||
|
else
|
||||||
|
printf '%s' "$body" | xclip -selection clipboard
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "clip pulled into clipboard"
|
||||||
Executable
+21
@@ -0,0 +1,21 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Reads the system clipboard and pushes it to scrot as a `clip` blob.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
: "${SCROT_SERVER:?set SCROT_SERVER, e.g. https://scrot.example.com}"
|
||||||
|
: "${DEVICE_TOKEN:?set DEVICE_TOKEN}"
|
||||||
|
|
||||||
|
if [ -n "${WAYLAND_DISPLAY:-}" ]; then
|
||||||
|
content=$(wl-paste --no-newline)
|
||||||
|
else
|
||||||
|
content=$(xclip -selection clipboard -o)
|
||||||
|
fi
|
||||||
|
|
||||||
|
curl -sf -X POST "$SCROT_SERVER/api/blobs" \
|
||||||
|
-H "X-Device-Token: $DEVICE_TOKEN" \
|
||||||
|
-H "X-Blob-Kind: clip" \
|
||||||
|
-H "Content-Type: text/plain; charset=utf-8" \
|
||||||
|
--data-binary "$content" \
|
||||||
|
-o /dev/null
|
||||||
|
|
||||||
|
echo "clip pushed"
|
||||||
Executable
+30
@@ -0,0 +1,30 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Prints (and, if qrencode is installed, renders as a terminal QR code) the
|
||||||
|
# onboarding link for the scrot PWA: opening it on a phone saves the device
|
||||||
|
# token (via app.js's #t= handler) and, once the app is added to the home
|
||||||
|
# screen, enables "Share to scrot" from the OS share sheet.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
: "${SCROT_SERVER:?set SCROT_SERVER, e.g. https://scrot.example.com}"
|
||||||
|
: "${DEVICE_TOKEN:?set DEVICE_TOKEN}"
|
||||||
|
|
||||||
|
url="$SCROT_SERVER/#t=$DEVICE_TOKEN"
|
||||||
|
|
||||||
|
echo "$url"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if command -v qrencode >/dev/null 2>&1; then
|
||||||
|
qrencode -t ANSIUTF8 "$url"
|
||||||
|
else
|
||||||
|
echo "(install qrencode to render this as a scannable QR code in-terminal)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat <<'EOF'
|
||||||
|
|
||||||
|
On the phone:
|
||||||
|
1. Open the link/QR above — saves the device token, this device is now onboarded.
|
||||||
|
2. Add scrot to the home screen (share/menu -> "Add to Home Screen").
|
||||||
|
3. Reopen from the home screen icon once — this re-fetches the manifest
|
||||||
|
with the token baked into the share target, enabling "Share to scrot"
|
||||||
|
from the OS share sheet (photos, browser selection, etc).
|
||||||
|
EOF
|
||||||
Executable
+33
@@ -0,0 +1,33 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Captures a region screenshot, pushes it to scrot as a `shot` blob, and
|
||||||
|
# copies the returned public link to the clipboard.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
: "${SCROT_SERVER:?set SCROT_SERVER, e.g. https://scrot.example.com}"
|
||||||
|
: "${DEVICE_TOKEN:?set DEVICE_TOKEN}"
|
||||||
|
|
||||||
|
tmpfile=$(mktemp --suffix=.png)
|
||||||
|
trap 'rm -f "$tmpfile"' EXIT
|
||||||
|
|
||||||
|
if [ -n "${WAYLAND_DISPLAY:-}" ]; then
|
||||||
|
grim -g "$(slurp)" "$tmpfile"
|
||||||
|
else
|
||||||
|
maim -s "$tmpfile"
|
||||||
|
fi
|
||||||
|
|
||||||
|
response=$(curl -sf -X POST "$SCROT_SERVER/api/blobs" \
|
||||||
|
-H "X-Device-Token: $DEVICE_TOKEN" \
|
||||||
|
-H "X-Blob-Kind: shot" \
|
||||||
|
-H "Content-Type: image/png" \
|
||||||
|
--data-binary "@$tmpfile")
|
||||||
|
|
||||||
|
url=$(printf '%s' "$response" | grep -o '"url":"[^"]*"' | cut -d'"' -f4)
|
||||||
|
full_url="$SCROT_SERVER$url"
|
||||||
|
|
||||||
|
if [ -n "${WAYLAND_DISPLAY:-}" ]; then
|
||||||
|
printf '%s' "$full_url" | wl-copy
|
||||||
|
else
|
||||||
|
printf '%s' "$full_url" | xclip -selection clipboard
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "screenshot uploaded: $full_url"
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
services:
|
||||||
|
app:
|
||||||
|
image: ${IMAGE}
|
||||||
|
container_name: scrot
|
||||||
|
restart: unless-stopped
|
||||||
|
pull_policy: always
|
||||||
|
ports:
|
||||||
|
- "${HOST_PORT:-3041}:3000"
|
||||||
|
environment:
|
||||||
|
- CLIP_TTL_SECONDS=${CLIP_TTL_SECONDS:-86400}
|
||||||
|
- SHOT_TTL_SECONDS=${SHOT_TTL_SECONDS:-1209600}
|
||||||
|
- MAX_UPLOAD_BYTES=${MAX_UPLOAD_BYTES:-52428800}
|
||||||
|
- DEVICE_TOKEN=${DEVICE_TOKEN}
|
||||||
|
volumes:
|
||||||
|
# Named volume, not a bind mount into the build context — the SQLite
|
||||||
|
# DB and blob bytes live here and must survive image redeploys.
|
||||||
|
- scrot-data:/app/data
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
scrot-data:
|
||||||
Generated
+2008
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,24 @@
|
|||||||
|
{
|
||||||
|
"name": "scrot-server",
|
||||||
|
"private": true,
|
||||||
|
"license": "MIT",
|
||||||
|
"type": "module",
|
||||||
|
"scripts": {
|
||||||
|
"dev": "tsx watch --env-file=../.env src/index.ts",
|
||||||
|
"build": "tsc -p tsconfig.json",
|
||||||
|
"start": "node --env-file=../.env dist/index.js"
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"better-sqlite3": "^11.3.0",
|
||||||
|
"express": "^4.21.0",
|
||||||
|
"multer": "^2.2.0"
|
||||||
|
},
|
||||||
|
"devDependencies": {
|
||||||
|
"@types/better-sqlite3": "^7.6.11",
|
||||||
|
"@types/express": "^4.17.21",
|
||||||
|
"@types/multer": "^2.2.0",
|
||||||
|
"@types/node": "^22.7.4",
|
||||||
|
"tsx": "^4.19.1",
|
||||||
|
"typescript": "^5.6.2"
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,155 @@
|
|||||||
|
// scrot PWA — thin client mirroring cli/scrot-clip-push, scrot-clip-pull,
|
||||||
|
// scrot-shot. Token lives in localStorage (used for every fetch here) and
|
||||||
|
// mirrored into a cookie (read server-side by /manifest.webmanifest to bake
|
||||||
|
// the token into the share_target action — see server/src/manifest.ts).
|
||||||
|
|
||||||
|
const TOKEN_KEY = 'scrot_token'
|
||||||
|
|
||||||
|
const $ = (id) => document.getElementById(id)
|
||||||
|
const toastEl = $('toast')
|
||||||
|
const onboardEl = $('onboard')
|
||||||
|
const tokenInput = $('tokenInput')
|
||||||
|
|
||||||
|
function getToken() {
|
||||||
|
return localStorage.getItem(TOKEN_KEY) || ''
|
||||||
|
}
|
||||||
|
|
||||||
|
function setToken(token) {
|
||||||
|
localStorage.setItem(TOKEN_KEY, token)
|
||||||
|
// 1 year, Lax is enough since this cookie is only ever read by our own
|
||||||
|
// manifest route, never sent cross-site meaningfully.
|
||||||
|
document.cookie = `scrot_token=${encodeURIComponent(token)}; path=/; max-age=31536000; samesite=lax`
|
||||||
|
}
|
||||||
|
|
||||||
|
function toast(message) {
|
||||||
|
toastEl.textContent = message
|
||||||
|
toastEl.style.display = 'block'
|
||||||
|
clearTimeout(toast._t)
|
||||||
|
toast._t = setTimeout(() => { toastEl.style.display = 'none' }, 4000)
|
||||||
|
}
|
||||||
|
|
||||||
|
function refreshOnboardVisibility() {
|
||||||
|
const has = !!getToken()
|
||||||
|
onboardEl.style.display = has ? 'none' : 'block'
|
||||||
|
if (has) tokenInput.value = getToken()
|
||||||
|
}
|
||||||
|
|
||||||
|
// --- onboarding: pick up #t=<token> from cli/scrot-onboard's QR/link ---
|
||||||
|
function consumeHashToken() {
|
||||||
|
const match = location.hash.match(/(?:^#|&)t=([^&]+)/)
|
||||||
|
if (!match) return false
|
||||||
|
const token = decodeURIComponent(match[1])
|
||||||
|
setToken(token)
|
||||||
|
history.replaceState(null, '', location.pathname + location.search)
|
||||||
|
toast('Device token saved. Add scrot to your home screen to enable "Share to scrot".')
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
const hadHashToken = consumeHashToken()
|
||||||
|
if (!hadHashToken && getToken()) setToken(getToken()) // re-assert cookie in case it expired
|
||||||
|
refreshOnboardVisibility()
|
||||||
|
|
||||||
|
$('saveToken').addEventListener('click', () => {
|
||||||
|
const token = tokenInput.value.trim()
|
||||||
|
if (!token) return
|
||||||
|
setToken(token)
|
||||||
|
refreshOnboardVisibility()
|
||||||
|
toast('Device token saved.')
|
||||||
|
})
|
||||||
|
|
||||||
|
$('editToken').addEventListener('click', () => {
|
||||||
|
onboardEl.style.display = 'block'
|
||||||
|
tokenInput.focus()
|
||||||
|
})
|
||||||
|
|
||||||
|
// --- share-target redirect landing ---
|
||||||
|
const params = new URLSearchParams(location.search)
|
||||||
|
if (params.get('shared') === 'clip') toast('Shared text saved as a clip.')
|
||||||
|
if (params.get('shared') === 'shot') toast('Shared screenshot uploaded.')
|
||||||
|
if (params.get('shared') === 'empty') toast('Nothing shareable in that share (no text or image).')
|
||||||
|
if (params.has('shared')) history.replaceState(null, '', location.pathname)
|
||||||
|
|
||||||
|
// --- push clip ---
|
||||||
|
$('pasteFromClipboard').addEventListener('click', async () => {
|
||||||
|
try {
|
||||||
|
$('clipText').value = await navigator.clipboard.readText()
|
||||||
|
} catch {
|
||||||
|
toast('Clipboard read not available — paste manually instead.')
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
$('pushClip').addEventListener('click', async () => {
|
||||||
|
const text = $('clipText').value
|
||||||
|
if (!text) return
|
||||||
|
const result = $('clipResult')
|
||||||
|
result.textContent = 'Sending…'
|
||||||
|
try {
|
||||||
|
const res = await fetch('/api/blobs', {
|
||||||
|
method: 'POST',
|
||||||
|
headers: { 'X-Device-Token': getToken(), 'X-Blob-Kind': 'clip', 'Content-Type': 'text/plain; charset=utf-8' },
|
||||||
|
body: text,
|
||||||
|
})
|
||||||
|
if (!res.ok) throw new Error(await res.text())
|
||||||
|
result.textContent = 'Sent.'
|
||||||
|
} catch (err) {
|
||||||
|
result.textContent = `Failed: ${err.message || err}`
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
// --- pull clip ---
|
||||||
|
let lastPulled = ''
|
||||||
|
$('pullClip').addEventListener('click', async () => {
|
||||||
|
const result = $('pullResult')
|
||||||
|
result.textContent = 'Fetching…'
|
||||||
|
try {
|
||||||
|
const res = await fetch('/api/clip/latest', { headers: { 'X-Device-Token': getToken() } })
|
||||||
|
if (res.status === 204) {
|
||||||
|
result.textContent = 'No clip yet.'
|
||||||
|
$('copyPulled').disabled = true
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if (!res.ok) throw new Error(await res.text())
|
||||||
|
lastPulled = await res.text()
|
||||||
|
result.textContent = lastPulled
|
||||||
|
$('copyPulled').disabled = false
|
||||||
|
} catch (err) {
|
||||||
|
result.textContent = `Failed: ${err.message || err}`
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
$('copyPulled').addEventListener('click', async () => {
|
||||||
|
try {
|
||||||
|
await navigator.clipboard.writeText(lastPulled)
|
||||||
|
toast('Copied.')
|
||||||
|
} catch {
|
||||||
|
toast('Clipboard write not available.')
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
// --- push shot ---
|
||||||
|
$('pushShot').addEventListener('click', async () => {
|
||||||
|
const file = $('shotFile').files[0]
|
||||||
|
const result = $('shotResult')
|
||||||
|
if (!file) {
|
||||||
|
result.textContent = 'Pick an image first.'
|
||||||
|
return
|
||||||
|
}
|
||||||
|
result.textContent = 'Uploading…'
|
||||||
|
try {
|
||||||
|
const res = await fetch('/api/blobs', {
|
||||||
|
method: 'POST',
|
||||||
|
headers: { 'X-Device-Token': getToken(), 'X-Blob-Kind': 'shot', 'Content-Type': file.type || 'application/octet-stream' },
|
||||||
|
body: file,
|
||||||
|
})
|
||||||
|
if (!res.ok) throw new Error(await res.text())
|
||||||
|
const { url } = await res.json()
|
||||||
|
const fullUrl = new URL(url, location.origin).toString()
|
||||||
|
result.innerHTML = `<a href="${fullUrl}" target="_blank" rel="noopener">${fullUrl}</a>`
|
||||||
|
try {
|
||||||
|
await navigator.clipboard.writeText(fullUrl)
|
||||||
|
toast('Link copied to clipboard.')
|
||||||
|
} catch { /* clipboard write may be unavailable; link is still shown above */ }
|
||||||
|
} catch (err) {
|
||||||
|
result.textContent = `Failed: ${err.message || err}`
|
||||||
|
}
|
||||||
|
})
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 192">
|
||||||
|
<rect width="192" height="192" rx="40" fill="#111318"/>
|
||||||
|
<text x="96" y="128" font-family="system-ui, sans-serif" font-size="104" font-weight="700"
|
||||||
|
fill="#6ee7b7" text-anchor="middle">s</text>
|
||||||
|
</svg>
|
||||||
|
After Width: | Height: | Size: 274 B |
@@ -0,0 +1,104 @@
|
|||||||
|
<!doctype html>
|
||||||
|
<html lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
|
||||||
|
<title>scrot</title>
|
||||||
|
<link rel="manifest" href="/manifest.webmanifest">
|
||||||
|
<link rel="icon" href="/icon.svg" type="image/svg+xml">
|
||||||
|
<link rel="apple-touch-icon" href="/icon.svg">
|
||||||
|
<meta name="theme-color" content="#111318">
|
||||||
|
<meta name="apple-mobile-web-app-capable" content="yes">
|
||||||
|
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
|
||||||
|
<style>
|
||||||
|
:root { color-scheme: dark; }
|
||||||
|
* { box-sizing: border-box; }
|
||||||
|
body {
|
||||||
|
margin: 0; padding: 1.25rem; padding-bottom: 3rem;
|
||||||
|
background: #111318; color: #e6e8ec;
|
||||||
|
font: 16px/1.4 system-ui, sans-serif;
|
||||||
|
max-width: 32rem; margin-inline: auto;
|
||||||
|
}
|
||||||
|
h1 { font-size: 1.1rem; font-weight: 600; color: #9aa1ad; margin: 0 0 1.25rem; }
|
||||||
|
section {
|
||||||
|
background: #191c22; border: 1px solid #262b34; border-radius: 12px;
|
||||||
|
padding: 1rem; margin-bottom: 1rem;
|
||||||
|
}
|
||||||
|
section h2 { font-size: 0.95rem; margin: 0 0 0.75rem; }
|
||||||
|
textarea {
|
||||||
|
width: 100%; min-height: 6rem; resize: vertical;
|
||||||
|
background: #0d0f13; color: #e6e8ec; border: 1px solid #2c323d;
|
||||||
|
border-radius: 8px; padding: 0.6rem; font: inherit;
|
||||||
|
}
|
||||||
|
input[type="text"], input[type="password"] {
|
||||||
|
width: 100%; background: #0d0f13; color: #e6e8ec;
|
||||||
|
border: 1px solid #2c323d; border-radius: 8px; padding: 0.6rem; font: inherit;
|
||||||
|
}
|
||||||
|
button {
|
||||||
|
appearance: none; border: none; border-radius: 8px;
|
||||||
|
background: #2c7a5f; color: #eafff5; font: inherit; font-weight: 600;
|
||||||
|
padding: 0.6rem 1rem; margin-top: 0.6rem; margin-right: 0.5rem;
|
||||||
|
cursor: pointer;
|
||||||
|
}
|
||||||
|
button.secondary { background: #262b34; color: #cfd4dc; }
|
||||||
|
button:disabled { opacity: 0.5; cursor: default; }
|
||||||
|
.row { display: flex; gap: 0.5rem; flex-wrap: wrap; }
|
||||||
|
#clipResult, #shotResult, #toast { font-size: 0.9rem; color: #9aa1ad; margin-top: 0.6rem; word-break: break-all; }
|
||||||
|
#shotResult a { color: #6ee7b7; }
|
||||||
|
#toast { display: none; padding: 0.6rem; background: #1c3a2c; border-radius: 8px; color: #b9f5da; margin-bottom: 1rem; }
|
||||||
|
#onboard { display: none; }
|
||||||
|
label { display: block; font-size: 0.85rem; color: #9aa1ad; margin-bottom: 0.3rem; }
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>scrot</h1>
|
||||||
|
|
||||||
|
<div id="toast"></div>
|
||||||
|
|
||||||
|
<section id="onboard">
|
||||||
|
<h2>Device token</h2>
|
||||||
|
<label for="tokenInput">Paste the token from <code>~/.config/scrot/env</code>, or open this page's link/QR from <code>cli/scrot-onboard</code>.</label>
|
||||||
|
<input id="tokenInput" type="password" autocomplete="off" placeholder="device token">
|
||||||
|
<div class="row">
|
||||||
|
<button id="saveToken">Save</button>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Push clipboard</h2>
|
||||||
|
<textarea id="clipText" placeholder="Paste or type text to sync to your other devices"></textarea>
|
||||||
|
<div class="row">
|
||||||
|
<button id="pasteFromClipboard" class="secondary">Paste from clipboard</button>
|
||||||
|
<button id="pushClip">Send</button>
|
||||||
|
</div>
|
||||||
|
<div id="clipResult"></div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Pull latest clip</h2>
|
||||||
|
<div class="row">
|
||||||
|
<button id="pullClip">Fetch latest</button>
|
||||||
|
<button id="copyPulled" class="secondary" disabled>Copy to clipboard</button>
|
||||||
|
</div>
|
||||||
|
<div id="pullResult"></div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Share screenshot</h2>
|
||||||
|
<input id="shotFile" type="file" accept="image/*" capture="environment">
|
||||||
|
<div class="row">
|
||||||
|
<button id="pushShot">Upload</button>
|
||||||
|
</div>
|
||||||
|
<div id="shotResult"></div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Settings</h2>
|
||||||
|
<div class="row">
|
||||||
|
<button id="editToken" class="secondary">Change device token</button>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<script src="/app.js"></script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
import { timingSafeEqual } from 'node:crypto'
|
||||||
|
import type { Request } from 'express'
|
||||||
|
import { config } from './config.js'
|
||||||
|
|
||||||
|
export function timingSafeStringEqual(a: string, b: string): boolean {
|
||||||
|
const bufA = Buffer.from(a)
|
||||||
|
const bufB = Buffer.from(b)
|
||||||
|
return bufA.length === bufB.length && timingSafeEqual(bufA, bufB)
|
||||||
|
}
|
||||||
|
|
||||||
|
export function checkDeviceToken(req: Request): boolean {
|
||||||
|
const token = req.get('X-Device-Token')
|
||||||
|
if (token === undefined) return false
|
||||||
|
return timingSafeStringEqual(token, config.deviceToken)
|
||||||
|
}
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
import { config } from './config.js'
|
||||||
|
import { db } from './db.js'
|
||||||
|
|
||||||
|
// Shared by both upload paths: the raw-body POST /api/blobs (CLI, curl) and
|
||||||
|
// the multipart POST /share (PWA share target) — same row shape either way.
|
||||||
|
export function insertBlobRecord(
|
||||||
|
id: string,
|
||||||
|
kind: 'clip' | 'shot',
|
||||||
|
contentType: string,
|
||||||
|
sizeBytes: number,
|
||||||
|
): void {
|
||||||
|
const now = Math.floor(Date.now() / 1000)
|
||||||
|
const ttl = kind === 'clip' ? config.clipTtlSeconds : config.shotTtlSeconds
|
||||||
|
db.prepare(
|
||||||
|
`INSERT INTO blobs (id, kind, content_type, size_bytes, created_at, expires_at)
|
||||||
|
VALUES (?, ?, ?, ?, ?, ?)`,
|
||||||
|
).run(id, kind, contentType, sizeBytes, now, now + ttl)
|
||||||
|
}
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
import fs from 'node:fs'
|
||||||
|
import { config } from './config.js'
|
||||||
|
import { db, blobPath } from './db.js'
|
||||||
|
|
||||||
|
// Sweeps expired blobs of either kind. Unlike wisp's single-retrieval
|
||||||
|
// drops (deleted immediately on confirmed download), scrot blobs are
|
||||||
|
// multi-retrieval — clips get polled repeatedly, shots get viewed
|
||||||
|
// repeatedly — so TTL expiry is the only deletion trigger there is.
|
||||||
|
export function sweepExpiredBlobs(): void {
|
||||||
|
const now = Math.floor(Date.now() / 1000)
|
||||||
|
const expired = db.prepare(`SELECT id FROM blobs WHERE expires_at < ?`).all(now) as {
|
||||||
|
id: string
|
||||||
|
}[]
|
||||||
|
|
||||||
|
for (const { id } of expired) {
|
||||||
|
fs.rm(blobPath(id), { force: true }, () => {})
|
||||||
|
}
|
||||||
|
|
||||||
|
db.prepare(`DELETE FROM blobs WHERE expires_at < ?`).run(now)
|
||||||
|
}
|
||||||
|
|
||||||
|
export function startCleanupJob(): NodeJS.Timeout {
|
||||||
|
return setInterval(sweepExpiredBlobs, config.cleanupIntervalSeconds * 1000)
|
||||||
|
}
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
import path from 'node:path'
|
||||||
|
|
||||||
|
if (!process.env.DEVICE_TOKEN) {
|
||||||
|
console.error('DEVICE_TOKEN is not set — refusing to start with an open blob store.')
|
||||||
|
process.exit(1)
|
||||||
|
}
|
||||||
|
|
||||||
|
export const config = {
|
||||||
|
port: Number(process.env.PORT ?? 3000),
|
||||||
|
dataDir: process.env.DATA_DIR ?? path.resolve('data'),
|
||||||
|
deviceToken: process.env.DEVICE_TOKEN,
|
||||||
|
// Clips are meant to be grabbed promptly, not archived — short TTL.
|
||||||
|
clipTtlSeconds: Number(process.env.CLIP_TTL_SECONDS ?? 60 * 60 * 24), // 1 day
|
||||||
|
// Shots are meant to actually be shared and viewed — longer TTL.
|
||||||
|
shotTtlSeconds: Number(process.env.SHOT_TTL_SECONDS ?? 60 * 60 * 24 * 14), // 14 days
|
||||||
|
maxUploadBytes: Number(process.env.MAX_UPLOAD_BYTES ?? 50 * 1024 * 1024), // 50MB
|
||||||
|
cleanupIntervalSeconds: Number(process.env.CLEANUP_INTERVAL_SECONDS ?? 60 * 15),
|
||||||
|
}
|
||||||
@@ -0,0 +1,29 @@
|
|||||||
|
import Database from 'better-sqlite3'
|
||||||
|
import fs from 'node:fs'
|
||||||
|
import path from 'node:path'
|
||||||
|
import { config } from './config.js'
|
||||||
|
|
||||||
|
fs.mkdirSync(config.dataDir, { recursive: true })
|
||||||
|
fs.mkdirSync(path.join(config.dataDir, 'blobs'), { recursive: true })
|
||||||
|
|
||||||
|
export const db = new Database(path.join(config.dataDir, 'scrot.db'))
|
||||||
|
db.pragma('journal_mode = WAL')
|
||||||
|
|
||||||
|
db.exec(`
|
||||||
|
CREATE TABLE IF NOT EXISTS blobs (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
kind TEXT NOT NULL CHECK (kind IN ('clip', 'shot')),
|
||||||
|
content_type TEXT NOT NULL,
|
||||||
|
size_bytes INTEGER NOT NULL,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
expires_at INTEGER NOT NULL
|
||||||
|
);
|
||||||
|
|
||||||
|
-- Fetching "the latest clip" is the hot path for clipboard pull — index
|
||||||
|
-- the (kind, created_at) pair it actually filters and sorts on.
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_blobs_kind_created ON blobs (kind, created_at DESC);
|
||||||
|
`)
|
||||||
|
|
||||||
|
export function blobPath(id: string): string {
|
||||||
|
return path.join(config.dataDir, 'blobs', id)
|
||||||
|
}
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
import { randomBytes } from 'node:crypto'
|
||||||
|
|
||||||
|
const BASE62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
|
||||||
|
|
||||||
|
// 128-bit random value, rendered as base62 — unguessable, safe to use as a
|
||||||
|
// public URL segment for `shot` blobs.
|
||||||
|
function randomBase62(bits: number): string {
|
||||||
|
const bytes = randomBytes(Math.ceil(bits / 8) + 4) // headroom for the mod-bias trim below
|
||||||
|
let value = 0n
|
||||||
|
for (const b of bytes) value = (value << 8n) | BigInt(b)
|
||||||
|
|
||||||
|
let out = ''
|
||||||
|
const base = BigInt(BASE62.length)
|
||||||
|
while (value > 0n) {
|
||||||
|
out = BASE62[Number(value % base)] + out
|
||||||
|
value /= base
|
||||||
|
}
|
||||||
|
return out.padStart(Math.ceil(bits / Math.log2(62)), '0')
|
||||||
|
}
|
||||||
|
|
||||||
|
export function newBlobId(): string {
|
||||||
|
return randomBase62(128)
|
||||||
|
}
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
import express from 'express'
|
||||||
|
import path from 'node:path'
|
||||||
|
import { fileURLToPath } from 'node:url'
|
||||||
|
import { config } from './config.js'
|
||||||
|
import { router } from './routes.js'
|
||||||
|
import { publicRouter } from './public.js'
|
||||||
|
import { manifestRouter } from './manifest.js'
|
||||||
|
import { shareRouter } from './share.js'
|
||||||
|
import { startCleanupJob, sweepExpiredBlobs } from './cleanup.js'
|
||||||
|
|
||||||
|
const __dirname = path.dirname(fileURLToPath(import.meta.url))
|
||||||
|
|
||||||
|
const app = express()
|
||||||
|
|
||||||
|
app.use(manifestRouter)
|
||||||
|
app.use(shareRouter)
|
||||||
|
app.use('/api', router)
|
||||||
|
app.use(publicRouter)
|
||||||
|
app.use(express.static(path.join(__dirname, '../public')))
|
||||||
|
|
||||||
|
sweepExpiredBlobs()
|
||||||
|
startCleanupJob()
|
||||||
|
|
||||||
|
app.listen(config.port, () => {
|
||||||
|
console.log(`scrot server listening on :${config.port}`)
|
||||||
|
})
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
import { Router } from 'express'
|
||||||
|
import type { Request } from 'express'
|
||||||
|
|
||||||
|
export const manifestRouter = Router()
|
||||||
|
|
||||||
|
// No cookie-parser dependency for one cookie — a few lines of parsing beats
|
||||||
|
// a new package.
|
||||||
|
function getCookie(req: Request, name: string): string | undefined {
|
||||||
|
const header = req.get('Cookie')
|
||||||
|
if (!header) return undefined
|
||||||
|
for (const part of header.split(';')) {
|
||||||
|
const eq = part.indexOf('=')
|
||||||
|
if (eq === -1) continue
|
||||||
|
if (part.slice(0, eq).trim() === name) return decodeURIComponent(part.slice(eq + 1).trim())
|
||||||
|
}
|
||||||
|
return undefined
|
||||||
|
}
|
||||||
|
|
||||||
|
// Served dynamically (not a static file) so the share_target action can
|
||||||
|
// carry this device's token — baked in at manifest-fetch time, once the
|
||||||
|
// onboarding cookie is set. Until then the manifest omits share_target
|
||||||
|
// entirely: "Add to Home Screen" still works, "Share to scrot" doesn't
|
||||||
|
// appear until the app has actually been onboarded.
|
||||||
|
manifestRouter.get('/manifest.webmanifest', (req, res) => {
|
||||||
|
const token = getCookie(req, 'scrot_token')
|
||||||
|
|
||||||
|
const manifest: Record<string, unknown> = {
|
||||||
|
name: 'scrot',
|
||||||
|
short_name: 'scrot',
|
||||||
|
description: 'Push clipboard text and screenshots to your other devices.',
|
||||||
|
start_url: '/',
|
||||||
|
scope: '/',
|
||||||
|
display: 'standalone',
|
||||||
|
background_color: '#111318',
|
||||||
|
theme_color: '#111318',
|
||||||
|
icons: [{ src: '/icon.svg', sizes: 'any', type: 'image/svg+xml', purpose: 'any maskable' }],
|
||||||
|
}
|
||||||
|
|
||||||
|
if (token) {
|
||||||
|
manifest.share_target = {
|
||||||
|
action: `/share?t=${encodeURIComponent(token)}`,
|
||||||
|
method: 'POST',
|
||||||
|
enctype: 'multipart/form-data',
|
||||||
|
params: {
|
||||||
|
title: 'title',
|
||||||
|
text: 'text',
|
||||||
|
url: 'url',
|
||||||
|
files: [{ name: 'images', accept: ['image/*'] }],
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
res.set('Content-Type', 'application/manifest+json')
|
||||||
|
res.json(manifest)
|
||||||
|
})
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
import { Router } from 'express'
|
||||||
|
import fs from 'node:fs'
|
||||||
|
import { db, blobPath } from './db.js'
|
||||||
|
|
||||||
|
// Separate router from routes.ts: /s/:id is deliberately unauthenticated —
|
||||||
|
// a "shot" blob's whole point is being a link you hand to someone else who
|
||||||
|
// doesn't have (and shouldn't need) a device token.
|
||||||
|
export const publicRouter = Router()
|
||||||
|
|
||||||
|
publicRouter.get('/s/:id', (req, res) => {
|
||||||
|
const now = Math.floor(Date.now() / 1000)
|
||||||
|
const row = db
|
||||||
|
.prepare(`SELECT content_type FROM blobs WHERE id = ? AND kind = 'shot' AND expires_at > ?`)
|
||||||
|
.get(req.params.id, now) as { content_type: string } | undefined
|
||||||
|
|
||||||
|
if (!row) {
|
||||||
|
res.status(404).send('not found or expired')
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
res.set('Content-Type', row.content_type)
|
||||||
|
fs.createReadStream(blobPath(req.params.id)).pipe(res)
|
||||||
|
})
|
||||||
@@ -0,0 +1,89 @@
|
|||||||
|
import { Router } from 'express'
|
||||||
|
import fs from 'node:fs'
|
||||||
|
import { config } from './config.js'
|
||||||
|
import { db, blobPath } from './db.js'
|
||||||
|
import { newBlobId } from './ids.js'
|
||||||
|
import { checkDeviceToken } from './auth.js'
|
||||||
|
import { insertBlobRecord } from './blobs.js'
|
||||||
|
|
||||||
|
export const router = Router()
|
||||||
|
|
||||||
|
interface BlobRow {
|
||||||
|
id: string
|
||||||
|
kind: 'clip' | 'shot'
|
||||||
|
content_type: string
|
||||||
|
size_bytes: number
|
||||||
|
created_at: number
|
||||||
|
expires_at: number
|
||||||
|
}
|
||||||
|
|
||||||
|
router.post('/blobs', (req, res) => {
|
||||||
|
if (!checkDeviceToken(req)) {
|
||||||
|
res.status(401).json({ error: 'bad device token' })
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
const kind = req.get('X-Blob-Kind')
|
||||||
|
if (kind !== 'clip' && kind !== 'shot') {
|
||||||
|
res.status(400).json({ error: 'X-Blob-Kind must be "clip" or "shot"' })
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
const contentLength = Number(req.get('Content-Length') ?? 0)
|
||||||
|
if (contentLength > config.maxUploadBytes) {
|
||||||
|
res.status(413).json({ error: 'blob too large' })
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
const id = newBlobId()
|
||||||
|
const dest = blobPath(id)
|
||||||
|
const writeStream = fs.createWriteStream(dest, { flags: 'wx' })
|
||||||
|
|
||||||
|
let bytesReceived = 0
|
||||||
|
req.on('data', (chunk: Buffer) => {
|
||||||
|
bytesReceived += chunk.length
|
||||||
|
if (bytesReceived > config.maxUploadBytes) {
|
||||||
|
req.destroy()
|
||||||
|
writeStream.destroy()
|
||||||
|
fs.rm(dest, { force: true }, () => {})
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
req.pipe(writeStream)
|
||||||
|
|
||||||
|
writeStream.on('finish', () => {
|
||||||
|
insertBlobRecord(id, kind, req.get('Content-Type') ?? 'application/octet-stream', bytesReceived)
|
||||||
|
res.json({ id, url: kind === 'shot' ? `/s/${id}` : null })
|
||||||
|
})
|
||||||
|
|
||||||
|
writeStream.on('error', () => {
|
||||||
|
fs.rm(dest, { force: true }, () => {})
|
||||||
|
if (!res.headersSent) res.status(500).json({ error: 'write failed' })
|
||||||
|
})
|
||||||
|
})
|
||||||
|
|
||||||
|
// Latest non-expired clip, for the pull side of clipboard sync — no
|
||||||
|
// history, no listing, just "what's the newest thing I copied elsewhere."
|
||||||
|
router.get('/clip/latest', (req, res) => {
|
||||||
|
if (!checkDeviceToken(req)) {
|
||||||
|
res.status(401).json({ error: 'bad device token' })
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
const now = Math.floor(Date.now() / 1000)
|
||||||
|
const row = db
|
||||||
|
.prepare(
|
||||||
|
`SELECT * FROM blobs WHERE kind = 'clip' AND expires_at > ? ORDER BY created_at DESC LIMIT 1`,
|
||||||
|
)
|
||||||
|
.get(now) as BlobRow | undefined
|
||||||
|
|
||||||
|
if (!row) {
|
||||||
|
res.status(204).end()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
res.set('Content-Type', row.content_type)
|
||||||
|
res.set('X-Blob-Id', row.id)
|
||||||
|
res.set('X-Blob-Created-At', String(row.created_at))
|
||||||
|
fs.createReadStream(blobPath(row.id)).pipe(res)
|
||||||
|
})
|
||||||
@@ -0,0 +1,49 @@
|
|||||||
|
import { Router } from 'express'
|
||||||
|
import fs from 'node:fs'
|
||||||
|
import multer from 'multer'
|
||||||
|
import { config } from './config.js'
|
||||||
|
import { blobPath } from './db.js'
|
||||||
|
import { newBlobId } from './ids.js'
|
||||||
|
import { insertBlobRecord } from './blobs.js'
|
||||||
|
import { timingSafeStringEqual } from './auth.js'
|
||||||
|
|
||||||
|
// Separate from routes.ts: the OS share sheet POSTs here directly (no
|
||||||
|
// custom headers possible), so auth rides in the query string instead of
|
||||||
|
// X-Device-Token — see manifest.ts for where that URL gets the token baked
|
||||||
|
// in. Same trust level as the token in ~/.config/scrot/env: not a secret
|
||||||
|
// from the machine it's on, just from the network.
|
||||||
|
export const shareRouter = Router()
|
||||||
|
|
||||||
|
const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: config.maxUploadBytes } })
|
||||||
|
|
||||||
|
shareRouter.post('/share', upload.any(), (req, res) => {
|
||||||
|
const token = typeof req.query.t === 'string' ? req.query.t : ''
|
||||||
|
if (!timingSafeStringEqual(token, config.deviceToken)) {
|
||||||
|
res.status(401).send('bad or missing device token — re-add scrot to your home screen to re-onboard')
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
const files = (req.files as Express.Multer.File[] | undefined) ?? []
|
||||||
|
const image = files.find((f) => f.mimetype.startsWith('image/'))
|
||||||
|
|
||||||
|
if (image) {
|
||||||
|
const id = newBlobId()
|
||||||
|
fs.writeFileSync(blobPath(id), image.buffer)
|
||||||
|
insertBlobRecord(id, 'shot', image.mimetype, image.buffer.length)
|
||||||
|
res.redirect(303, `/?shared=shot&id=${id}`)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
const body = req.body as Record<string, string>
|
||||||
|
const text = (body.text || body.url || body.title || '').trim()
|
||||||
|
if (text) {
|
||||||
|
const id = newBlobId()
|
||||||
|
const buf = Buffer.from(text, 'utf8')
|
||||||
|
fs.writeFileSync(blobPath(id), buf)
|
||||||
|
insertBlobRecord(id, 'clip', 'text/plain; charset=utf-8', buf.length)
|
||||||
|
res.redirect(303, '/?shared=clip')
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
res.redirect(303, '/?shared=empty')
|
||||||
|
})
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
{
|
||||||
|
"compilerOptions": {
|
||||||
|
"target": "ES2022",
|
||||||
|
"module": "NodeNext",
|
||||||
|
"moduleResolution": "NodeNext",
|
||||||
|
"outDir": "dist",
|
||||||
|
"rootDir": "src",
|
||||||
|
"strict": true,
|
||||||
|
"esModuleInterop": true,
|
||||||
|
"skipLibCheck": true,
|
||||||
|
"resolveJsonModule": true
|
||||||
|
},
|
||||||
|
"include": ["src"]
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user