node-red

packages/node_modules/@node-red/editor-api/lib/editor/comms.js

@@ -0,0 +1,292 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var ws = require("ws");
+var url = require("url");
+const crypto = require("crypto");
+
+var log = require("@node-red/util").log; // TODO: separate module
+var Tokens;
+var Users;
+var Permissions;
+var Strategies;
+
+var server;
+var settings;
+var runtimeAPI;
+
+var wsServer;
+var activeConnections = [];
+
+var anonymousUser;
+
+var heartbeatTimer;
+var lastSentTime;
+
+function init(_server,_settings,_runtimeAPI) {
+    server = _server;
+    settings = _settings;
+    runtimeAPI = _runtimeAPI;
+    Tokens = require("../auth/tokens");
+    Tokens.onSessionExpiry(handleSessionExpiry);
+    Users = require("../auth/users");
+    Permissions = require("../auth/permissions");
+    Strategies = require("../auth/strategies");
+
+}
+function handleSessionExpiry(session) {
+    activeConnections.forEach(connection => {
+        if (connection.token === session.accessToken) {
+            connection.ws.send(JSON.stringify({auth:"fail"}));
+            connection.ws.close();
+        }
+    })
+}
+
+function CommsConnection(ws, user) {
+    this.session = crypto.randomBytes(32).toString('base64');
+    this.ws = ws;
+    this.stack = [];
+    this.user = user;
+    this.lastSentTime = 0;
+    var self = this;
+
+    log.audit({event: "comms.open"});
+    log.trace("comms.open "+self.session);
+    var preAuthed = !!user;
+    var pendingAuth = !this.user && (settings.adminAuth != null);
+
+    if (!pendingAuth) {
+        addActiveConnection(self);
+    }
+    ws.on('close',function() {
+        log.audit({event: "comms.close",user:self.user, session: self.session});
+        log.trace("comms.close "+self.session);
+        removeActiveConnection(self);
+    });
+
+    const handleAuthPacket = function(msg) {
+        Tokens.get(msg.auth).then(function(client) {
+            if (client) {
+                Users.get(client.user).then(function(user) {
+                    if (user) {
+                        self.user = user;
+                        log.audit({event: "comms.auth",user:self.user});
+                        completeConnection(msg, client.scope,msg.auth,true);
+                    } else {
+                        log.audit({event: "comms.auth.fail"});
+                        completeConnection(msg, null,null,false);
+                    }
+                });
+            } else {
+                Users.tokens(msg.auth).then(function(user) {
+                    if (user) {
+                        self.user = user;
+                        log.audit({event: "comms.auth",user:self.user});
+                        completeConnection(msg, user.permissions,msg.auth,true);
+                    } else {
+                        log.audit({event: "comms.auth.fail"});
+                        completeConnection(msg, null,null,false);
+                    }
+                });
+            }
+        });
+    }
+    const completeConnection = function(msg, userScope, session, sendAck) {
+        try {
+            if (!userScope || !Permissions.hasPermission(userScope,"status.read")) {
+                ws.send(JSON.stringify({auth:"fail"}));
+                ws.close();
+            } else {
+                pendingAuth = false;
+                addActiveConnection(self);
+                self.token = msg.auth;
+                if (sendAck) {
+                    ws.send(JSON.stringify({auth:"ok"}));
+                }
+            }
+        } catch(err) {
+            console.log(err.stack);
+            // Just in case the socket closes before we attempt
+            // to send anything.
+        }
+    }
+    ws.on('message', function(data,flags) {
+        var msg = null;
+        try {
+            msg = JSON.parse(data);
+        } catch(err) {
+            log.trace("comms received malformed message : "+err.toString());
+            return;
+        }
+        if (!pendingAuth) {
+            if (msg.auth) {
+                handleAuthPacket(msg)
+            } else if (msg.subscribe) {
+                self.subscribe(msg.subscribe);
+                // handleRemoteSubscription(ws,msg.subscribe);
+            } else if (msg.topic) {
+                runtimeAPI.comms.receive({
+                    user: self.user,
+                    client: self,
+                    topic: msg.topic,
+                    data: msg.data
+                })
+            }
+        } else {
+            if (msg.auth) {
+                handleAuthPacket(msg)
+            } else {
+                if (anonymousUser) {
+                    log.audit({event: "comms.auth",user:anonymousUser});
+                    self.user = anonymousUser;
+                    completeConnection(msg, anonymousUser.permissions, null, false);
+                    //TODO: duplicated code - pull non-auth message handling out
+                    if (msg.subscribe) {
+                        self.subscribe(msg.subscribe);
+                    }
+                } else {
+                    log.audit({event: "comms.auth.fail"});
+                    completeConnection(msg, null,null,false);
+                }
+            }
+        }
+    });
+    ws.on('error', function(err) {
+        log.warn(log._("comms.error",{message:err.toString()}));
+    });
+}
+
+CommsConnection.prototype.send = function(topic,data) {
+    if (topic && data) {
+        this.stack.push({topic:topic,data:data});
+    }
+    this._queueSend();
+}
+CommsConnection.prototype._queueSend = function() {
+    var self = this;
+    if (!this._xmitTimer) {
+        this._xmitTimer = setTimeout(function() {
+            try {
+                self.ws.send(JSON.stringify(self.stack.splice(0,50)));
+                self.lastSentTime = Date.now();
+            } catch(err) {
+                removeActiveConnection(self);
+                log.warn(log._("comms.error-send",{message:err.toString()}));
+            }
+            delete self._xmitTimer;
+            if (self.stack.length > 0) {
+                self._queueSend();
+            }
+        },50);
+    }
+}
+
+
+CommsConnection.prototype.subscribe = function(topic) {
+    runtimeAPI.comms.subscribe({
+        user: this.user,
+        client: this,
+        topic: topic
+    })
+}
+
+function start() {
+    if (!settings.disableEditor) {
+        Users.default().then(function(_anonymousUser) {
+            anonymousUser = _anonymousUser;
+            var webSocketKeepAliveTime = settings.webSocketKeepAliveTime || 15000;
+            var commsPath = settings.httpAdminRoot || "/";
+            commsPath = (commsPath.slice(0,1) != "/" ? "/":"") + commsPath + (commsPath.slice(-1) == "/" ? "":"/") + "comms";
+            wsServer = new ws.Server({ noServer: true });
+            wsServer.on('connection',function(ws, request, user) {
+                var commsConnection = new CommsConnection(ws, user);
+            });
+            wsServer.on('error', function(err) {
+                log.warn(log._("comms.error-server",{message:err.toString()}));
+            });
+
+            server.on('upgrade', function upgrade(request, socket, head) {
+                const pathname = url.parse(request.url).pathname;
+                if (pathname === commsPath) {
+                    if (Users.tokenHeader() !== null && request.headers[Users.tokenHeader()]) {
+                        // The user has provided custom token handling. For the websocket,
+                        // the token could be provided in two ways:
+                        //  - as an http header (only possible with a reverse proxy setup)
+                        //  - passed over the connected websock in an auth packet
+                        // If the header is present, verify the token. If not, use the auth
+                        // packet over the connected socket
+                        //
+                        Strategies.authenticateUserToken(request).then(user => {
+                            wsServer.handleUpgrade(request, socket, head, function done(ws) {
+                                wsServer.emit('connection', ws, request, user);
+                            });
+                        }).catch(err => {
+                            log.audit({event: "comms.auth.fail"});
+                            socket.destroy();
+                        })
+                        return
+                    }
+                    wsServer.handleUpgrade(request, socket, head, function done(ws) {
+                        wsServer.emit('connection', ws, request, null);
+                    });
+                }
+                // Don't destroy the socket as other listeners may want to handle the
+                // event.
+            });
+
+            lastSentTime = Date.now();
+
+            heartbeatTimer = setInterval(function() {
+                var now = Date.now();
+                if (now-lastSentTime > webSocketKeepAliveTime) {
+                    activeConnections.forEach(connection => connection.send("hb",lastSentTime));
+                }
+            }, webSocketKeepAliveTime);
+        });
+    }
+}
+
+function stop() {
+    if (heartbeatTimer) {
+        clearInterval(heartbeatTimer);
+        heartbeatTimer = null;
+    }
+    if (wsServer) {
+        wsServer.close();
+        wsServer = null;
+    }
+}
+
+function addActiveConnection(connection) {
+    activeConnections.push(connection);
+    runtimeAPI.comms.addConnection({client: connection});
+}
+function removeActiveConnection(connection) {
+    for (var i=0;i<activeConnections.length;i++) {
+        if (activeConnections[i] === connection) {
+            activeConnections.splice(i,1);
+            runtimeAPI.comms.removeConnection({client:connection})
+            break;
+        }
+    }
+}
+
+module.exports = {
+    init:init,
+    start:start,
+    stop:stop
+}

packages/node_modules/@node-red/editor-api/lib/editor/credentials.js

@@ -0,0 +1,36 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var runtimeAPI;
+var apiUtils = require("../util");
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI
+    },
+    get: function (req, res) {
+        var opts = {
+            user: req.user,
+            type: req.params.type,
+            id: req.params.id
+        }
+        runtimeAPI.flows.getNodeCredentials(opts).then(function(result) {
+            res.json(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/index.js

@@ -0,0 +1,132 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var path = require('path');
+
+var comms = require("./comms");
+var info = require("./settings");
+
+var auth = require("../auth");
+var nodes = require("../admin/nodes"); // TODO: move /icons into here
+var needsPermission;
+var runtimeAPI;
+var log = require("@node-red/util").log;
+var i18n = require("@node-red/util").i18n;
+
+var apiUtil = require("../util");
+
+var ensureRuntimeStarted = function(req,res,next) {
+    runtimeAPI.isStarted().then( started => {
+        if (!started) {
+            log.error("Node-RED runtime not started");
+            res.status(503).send("Not started");
+        } else {
+            next()
+        }
+    })
+}
+
+module.exports = {
+    init: function(server, settings, _runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+        needsPermission = auth.needsPermission;
+        if (!settings.disableEditor) {
+            info.init(settings, runtimeAPI);
+            comms.init(server,settings,runtimeAPI);
+
+            var ui = require("./ui");
+
+            ui.init(settings, runtimeAPI);
+
+            const editorApp = apiUtil.createExpressApp(settings)
+
+            if (settings.requireHttps === true) {
+                editorApp.enable('trust proxy');
+                editorApp.use(function (req, res, next) {
+                    if (req.secure) {
+                        next();
+                    } else {
+                        res.redirect('https://' + req.headers.host + req.originalUrl);
+                    }
+                });
+            }
+            var defaultServerSettings = {
+                "x-powered-by": false
+            }
+            var serverSettings = Object.assign({},defaultServerSettings,settings.httpServerOptions||{});
+            for (var eOption in serverSettings) {
+                editorApp.set(eOption, serverSettings[eOption]);
+            }
+            editorApp.get("/",ensureRuntimeStarted,ui.ensureSlash,ui.editor);
+
+            editorApp.get("/icons",needsPermission("nodes.read"),nodes.getIcons,apiUtil.errorHandler);
+            editorApp.get("/icons/:module/:icon",ui.icon);
+            editorApp.get("/icons/:scope/:module/:icon",ui.icon);
+
+            editorApp.get(/^\/resources\/((?:@[^\/]+\/)?[^\/]+)\/(.+)$/,ui.moduleResource);
+
+            var theme = require("./theme");
+            theme.init(settings, runtimeAPI);
+            editorApp.use("/theme",theme.app());
+            editorApp.use("/",ui.editorResources);
+
+            //Projects
+            var projects = require("./projects");
+            projects.init(settings, runtimeAPI);
+            editorApp.use("/projects",projects.app());
+
+            // Locales
+            var locales = require("./locales");
+            locales.init(runtimeAPI);
+            editorApp.get(/^\/locales\/(.+)\/?$/,locales.get,apiUtil.errorHandler);
+
+            // Library
+            var library = require("./library");
+            library.init(runtimeAPI);
+            // editorApp.get("/library/:id",needsPermission("library.read"),library.getLibraryConfig);
+            editorApp.get(/^\/library\/([^\/]+)\/([^\/]+)(?:$|\/(.*))/,needsPermission("library.read"),library.getEntry);
+            editorApp.post(/^\/library\/([^\/]+)\/([^\/]+)\/(.*)/,needsPermission("library.write"),library.saveEntry);
+
+
+            // Credentials
+            var credentials = require("./credentials");
+            credentials.init(runtimeAPI);
+            editorApp.get('/credentials/:type/:id', needsPermission("credentials.read"),credentials.get,apiUtil.errorHandler);
+
+            // Settings
+            //  Main /settings route is an admin route - see lib/admin/settings.js
+            // User Settings
+            editorApp.get("/settings/user",needsPermission("settings.read"),info.userSettings,apiUtil.errorHandler);
+            // User Settings
+            editorApp.post("/settings/user",needsPermission("settings.write"),info.updateUserSettings,apiUtil.errorHandler);
+            // SSH keys
+            editorApp.use("/settings/user/keys",needsPermission("settings.write"),info.sshkeys());
+
+            return editorApp;
+        }
+    },
+    start: function() {
+        var catalogPath = path.resolve(path.join(path.dirname(require.resolve("@node-red/editor-client")),"locales"));
+        return i18n.registerMessageCatalogs([
+            {namespace: "editor",   dir: catalogPath, file:"editor.json"},
+            {namespace: "jsonata",  dir: catalogPath, file:"jsonata.json"},
+            {namespace: "infotips", dir: catalogPath, file:"infotips.json"}
+        ]).then(function(){
+            comms.start();
+        });
+    },
+    stop: comms.stop
+}

packages/node_modules/@node-red/editor-api/lib/editor/library.js

@@ -0,0 +1,81 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var apiUtils = require("../util");
+
+var runtimeAPI;
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    // getLibraryConfig: function(req,res) {
+    //     var opts = {
+    //         user: req.user,
+    //         library: req.params.id
+    //     }
+    //     runtimeAPI.library.getConfig(opts).then(function(result) {
+    //         res.json(result);
+    //     }).catch(function(err) {
+    //         apiUtils.rejectHandler(req,res,err);
+    //     });
+    // },
+    getEntry: function(req,res) {
+        var opts = {
+            user: req.user,
+            library: req.params[0],
+            type: req.params[1],
+            path: req.params[2]||""
+        }
+        runtimeAPI.library.getEntry(opts).then(function(result) {
+            if (typeof result === "string") {
+                if (opts.type === 'flows') {
+                    res.writeHead(200, {'Content-Type': 'application/json'});
+                } else {
+                    res.writeHead(200, {'Content-Type': 'text/plain'});
+                }
+                res.write(result);
+                res.end();
+            } else {
+                res.json(result);
+            }
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        });
+    },
+    saveEntry: function(req,res) {
+        var opts = {
+            user: req.user,
+            library: req.params[0],
+            type: req.params[1],
+            path: req.params[2]||""
+        }
+        // TODO: horrible inconsistencies between flows and all other types
+        if (opts.type === "flows") {
+            opts.meta = {};
+            opts.body = JSON.stringify(req.body);
+        } else {
+            opts.meta = req.body;
+            opts.body = opts.meta.text;
+            delete opts.meta.text;
+        }
+        runtimeAPI.library.saveEntry(opts).then(function(result) {
+            res.status(204).end();
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        });
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/locales.js

@@ -0,0 +1,54 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var i18n = require("@node-red/util").i18n; // TODO: separate module
+
+var runtimeAPI;
+
+function loadResource(lang, namespace) {
+    var catalog = i18n.i.getResourceBundle(lang, namespace);
+    if (!catalog) {
+        var parts = lang.split("-");
+        if (parts.length == 2) {
+            var new_lang = parts[0];
+            return i18n.i.getResourceBundle(new_lang, namespace);
+        }
+    }
+    return catalog;
+}
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    get: function(req,res) {
+        var namespace = req.params[0];
+        namespace = namespace.replace(/\.json$/,"");
+        var lang = req.query.lng || i18n.defaultLang; //apiUtil.determineLangFromHeaders(req.acceptsLanguages() || []);
+        if (/[^0-9a-z=\-\*]/i.test(lang)) {
+            res.json({});
+            return;
+        }
+        var prevLang = i18n.i.language;
+        // Trigger a load from disk of the language if it is not the default
+        i18n.i.changeLanguage(lang, function(){
+            i18n.i.changeLanguage(prevLang, function() {
+                var catalog = loadResource(lang, namespace);
+                res.json(catalog||{});
+            });
+        });
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/projects.js

@@ -0,0 +1,544 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var apiUtils = require("../util");
+
+var settings;
+var runtimeAPI;
+var needsPermission = require("../auth").needsPermission;
+
+function listProjects(req,res) {
+    var opts = {
+        user: req.user,
+        req: apiUtils.getRequestLogObject(req)
+    }
+    runtimeAPI.projects.listProjects(opts).then(function(result) {
+        res.json(result);
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    });
+}
+function getProject(req,res) {
+    var opts = {
+        user: req.user,
+        id: req.params.id,
+        req: apiUtils.getRequestLogObject(req)
+    }
+    runtimeAPI.projects.getProject(opts).then(function(data) {
+        if (data) {
+            res.json(data);
+        } else {
+            res.status(404).end();
+        }
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    })
+}
+function getProjectStatus(req,res) {
+    var opts = {
+        user: req.user,
+        id: req.params.id,
+        remote: req.query.remote,
+        req: apiUtils.getRequestLogObject(req)
+    }
+    runtimeAPI.projects.getStatus(opts).then(function(data){
+        if (data) {
+            res.json(data);
+        } else {
+            res.status(404).end();
+        }
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    })
+}
+function getProjectRemotes(req,res) {
+    var opts = {
+        user: req.user,
+        id: req.params.id,
+        req: apiUtils.getRequestLogObject(req)
+    }
+    runtimeAPI.projects.getRemotes(opts).then(function(data) {
+        res.json(data);
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    })
+}
+module.exports = {
+    init: function(_settings, _runtimeAPI) {
+        settings = _settings;
+        runtimeAPI = _runtimeAPI;
+    },
+    app: function() {
+        var app = apiUtils.createExpressApp(settings)
+
+        app.use(function(req,res,next) {
+            runtimeAPI.projects.available().then(function(available) {
+                if (!available) {
+                    res.status(404).end();
+                } else {
+                    next();
+                }
+            })
+        });
+
+        // Projects
+
+        // List all projects
+        app.get("/", needsPermission("projects.read"),listProjects);
+
+        // Create project
+        app.post("/", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                project: req.body,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.createProject(opts).then(function(result) {
+                res.json(result);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Update a project
+        app.put("/:id", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                project: req.body,
+                req: apiUtils.getRequestLogObject(req)
+            }
+
+            if (req.body.active) {
+                opts.clearContext = req.body.hasOwnProperty('clearContext')?req.body.clearContext:true
+                runtimeAPI.projects.setActiveProject(opts).then(function() {
+                    listProjects(req,res);
+                }).catch(function(err) {
+                    apiUtils.rejectHandler(req,res,err);
+                })
+            } else if (req.body.initialise) {
+                runtimeAPI.projects.initialiseProject(opts).then(function() {
+                    getProject(req,res);
+                }).catch(function(err) {
+                    apiUtils.rejectHandler(req,res,err);
+                })
+            } else if (req.body.hasOwnProperty('credentialSecret') ||
+                       req.body.hasOwnProperty('description') ||
+                       req.body.hasOwnProperty('dependencies')||
+                       req.body.hasOwnProperty('summary') ||
+                       req.body.hasOwnProperty('version') ||
+                       req.body.hasOwnProperty('files') ||
+                        req.body.hasOwnProperty('git')) {
+                runtimeAPI.projects.updateProject(opts).then(function() {
+                    getProject(req,res);
+                }).catch(function(err) {
+                    apiUtils.rejectHandler(req,res,err);
+                })
+            } else {
+                res.status(400).json({error:"unexpected_error", message:"invalid_request"});
+            }
+        });
+
+        // Get project metadata
+        app.get("/:id", needsPermission("projects.read"), getProject);
+
+        // Delete project
+        app.delete("/:id", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.deleteProject(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+
+        // Get project status - files, commit counts, branch info
+        app.get("/:id/status", needsPermission("projects.read"), getProjectStatus);
+
+
+        // Project file listing
+        app.get("/:id/files", needsPermission("projects.read"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getFiles(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+
+        });
+
+
+        // Get file content in a given tree (index/stage)
+        app.get("/:id/files/:treeish/*", needsPermission("projects.read"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                tree: req.params.treeish,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getFile(opts).then(function(data) {
+                res.json({content:data});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Revert a file
+        app.delete("/:id/files/_/*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                req: apiUtils.getRequestLogObject(req)
+            }
+
+            runtimeAPI.projects.revertFile(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Stage a file
+        app.post("/:id/stage/*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.stageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Stage multiple files
+        app.post("/:id/stage", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.body.files,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.stageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Commit changes
+        app.post("/:id/commit", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                message: req.body.message,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.commit(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Unstage a file
+        app.delete("/:id/stage/*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.unstageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Unstage multiple files
+        app.delete("/:id/stage", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.unstageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a file diff
+        app.get("/:id/diff/:type/*", needsPermission("projects.read"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                type: req.params.type,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getFileDiff(opts).then(function(data) {
+                res.json({
+                    diff: data
+                })
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of commits
+        app.get("/:id/commits", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                limit: req.query.limit || 20,
+                before: req.query.before,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getCommits(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get an individual commit details
+        app.get("/:id/commits/:sha", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                sha: req.params.sha,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getCommit(opts).then(function(data) {
+                res.json({commit:data});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Push local commits to remote
+        app.post("/:id/push/?*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params[0],
+                track: req.query.u,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.push(opts).then(function(data) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Pull remote commits
+        app.post("/:id/pull/?*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params[0],
+                track: req.query.setUpstream,
+                allowUnrelatedHistories: req.query.allowUnrelatedHistories,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.pull(opts).then(function(data) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Abort an ongoing merge
+        app.delete("/:id/merge", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.abortMerge(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Resolve a merge
+        app.post("/:id/resolve/*", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                resolution: req.body.resolutions,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.resolveMerge(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of local branches
+        app.get("/:id/branches", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: false,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getBranches(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Delete a local branch - ?force=true
+        app.delete("/:id/branches/:branchName", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.params.branchName,
+                force: !!req.query.force,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.deleteBranch(opts).then(function(data) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of remote branches
+        app.get("/:id/branches/remote", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: true,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getBranches(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get branch status - commit counts/ahead/behind
+        app.get("/:id/branches/remote/*/status", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.params[0],
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.getBranchStatus(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Set the active local branch
+        app.post("/:id/branches", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.body.name,
+                create: req.body.create,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.setBranch(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of remotes
+        app.get("/:id/remotes", needsPermission("projects.read"), getProjectRemotes);
+
+        // Add a remote
+        app.post("/:id/remotes", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.body,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            if (/^https?:\/\/[^/]+@/i.test(req.body.url)) {
+                res.status(400).json({error:"unexpected_error", message:"Git http url must not include username/password"});
+                return;
+            }
+            runtimeAPI.projects.addRemote(opts).then(function(data) {
+                getProjectRemotes(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Delete a remote
+        app.delete("/:id/remotes/:remoteName", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params.remoteName,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.removeRemote(opts).then(function(data) {
+                getProjectRemotes(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Update a remote
+        app.put("/:id/remotes/:remoteName", needsPermission("projects.write"), function(req,res) {
+            var remote = req.body || {};
+            remote.name = req.params.remoteName;
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: remote,
+                req: apiUtils.getRequestLogObject(req)
+            }
+            runtimeAPI.projects.updateRemote(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        return app;
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/settings.js

@@ -0,0 +1,47 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+var apiUtils = require("../util");
+var runtimeAPI;
+var sshkeys = require("./sshkeys");
+
+module.exports = {
+    init: function(settings, _runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+        sshkeys.init(settings, runtimeAPI);
+    },
+    userSettings: function(req, res) {
+        var opts = {
+            user: req.user
+        }
+        runtimeAPI.settings.getUserSettings(opts).then(function(result) {
+            res.json(result);
+        });
+    },
+    updateUserSettings: function(req,res) {
+        var opts = {
+            user: req.user,
+            settings: req.body
+        }
+        runtimeAPI.settings.updateUserSettings(opts).then(function(result) {
+            res.status(204).end();
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        });
+    },
+    sshkeys: function() {
+        return sshkeys.app()
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/sshkeys.js

@@ -0,0 +1,94 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var apiUtils = require("../util");
+var runtimeAPI;
+var settings;
+
+module.exports = {
+    init: function(_settings, _runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+        settings = _settings;
+    },
+    app: function() {
+        const app = apiUtils.createExpressApp(settings);
+
+        // List all SSH keys
+        app.get("/", function(req,res) {
+            var opts = {
+                user: req.user
+            }
+            runtimeAPI.settings.getUserKeys(opts).then(function(list) {
+                res.json({
+                    keys: list
+                });
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Get SSH key detail
+        app.get("/:id", function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.settings.getUserKey(opts).then(function(data) {
+                res.json({
+                    publickey: data
+                });
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Generate a SSH key
+        app.post("/", function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            // TODO: validate params
+            opts.name = req.body.name;
+            opts.password = req.body.password;
+            opts.comment = req.body.comment;
+            opts.size = req.body.size;
+
+            runtimeAPI.settings.generateUserKey(opts).then(function(name) {
+                res.json({
+                    name: name
+                });
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Delete a SSH key
+        app.delete("/:id", function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.settings.removeUserKey(opts).then(function(name) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        return app;
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/theme.js

@@ -0,0 +1,369 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var util = require("util");
+var path = require("path");
+var fs = require("fs");
+var clone = require("clone");
+const apiUtil = require("../util")
+
+var defaultContext = {
+    page: {
+        title: "Node-RED",
+        favicon: "favicon.ico",
+        tabicon: {
+            icon: "red/images/node-red-icon-black.svg",
+            colour: "#8f0000"
+        }
+    },
+    header: {
+        title: "Node-RED",
+        image: "red/images/node-red.svg"
+    },
+    asset: {
+        red: "red/red.min.js",
+        main: "red/main.min.js",
+        vendorMonaco: ""
+    }
+};
+var settings;
+
+var theme = null;
+var themeContext = clone(defaultContext);
+var themeSettings = null;
+
+var activeTheme = null;
+var activeThemeInitialised = false;
+
+var runtimeAPI;
+var themeApp;
+
+function serveFile(app,baseUrl,file) {
+    try {
+        var stats = fs.statSync(file);
+        var url = baseUrl+path.basename(file);
+        //console.log(url,"->",file);
+        app.get(url,function(req, res) {
+            res.sendFile(file);
+        });
+        return "theme"+url;
+    } catch(err) {
+        //TODO: log filenotfound
+        return null;
+    }
+}
+
+function serveFilesFromTheme(themeValue, themeApp, directory, baseDirectory) {
+    var result = [];
+    if (themeValue) {
+        var array = themeValue;
+        if (!Array.isArray(array)) {
+            array = [array];
+        }
+
+        for (var i=0;i<array.length;i++) {
+            let fullPath = array[i];
+            if (baseDirectory) {
+                fullPath = path.resolve(baseDirectory,array[i]);
+                if (fullPath.indexOf(path.resolve(baseDirectory)) !== 0) {
+                    continue;
+                }
+            }
+            var url = serveFile(themeApp,directory,fullPath);
+            if (url) {
+                result.push(url);
+            }
+        }
+    }
+    return result
+}
+
+module.exports = {
+    init: function(_settings, _runtimeAPI) {
+        settings = _settings;
+        runtimeAPI = _runtimeAPI;
+        themeContext = clone(defaultContext);
+        if (process.env.NODE_ENV == "development") {
+            themeContext.asset.red = "red/red.js";
+            themeContext.asset.main = "red/main.js";
+        }
+        themeSettings = null;
+        theme = settings.editorTheme || {};
+        themeContext.asset.vendorMonaco = "vendor/monaco/monaco-bootstrap.js"
+        if (theme.codeEditor && theme.codeEditor.lib === 'ace') {
+            themeContext.asset.vendorMonaco = ''
+        }
+        activeTheme = theme.theme;
+    },
+
+    app: function() {
+        var i;
+        var url;
+        themeSettings = {};
+
+        themeApp = apiUtil.createExpressApp(settings);
+        
+        const defaultServerSettings = {
+            "x-powered-by": false
+        }
+        const serverSettings = Object.assign({},defaultServerSettings,settings.httpServerOptions||{});
+        for (const eOption in serverSettings) {
+            themeApp.set(eOption, serverSettings[eOption]);
+        }
+
+        if (theme.page) {
+
+            themeContext.page.css = serveFilesFromTheme(
+                theme.page.css,
+                themeApp,
+                "/css/")
+            themeContext.page.scripts = serveFilesFromTheme(
+                theme.page.scripts,
+                themeApp,
+                "/scripts/")
+
+            if (theme.page.favicon) {
+                url = serveFile(themeApp,"/favicon/",theme.page.favicon)
+                if (url) {
+                    themeContext.page.favicon = url;
+                }
+            }
+
+            if (theme.page.tabicon) {
+                let icon = theme.page.tabicon.icon || theme.page.tabicon
+                url = serveFile(themeApp,"/tabicon/", icon)
+                if (url) {
+                    themeContext.page.tabicon.icon = url;
+                }
+                if (theme.page.tabicon.colour) {
+                    themeContext.page.tabicon.colour = theme.page.tabicon.colour
+                }
+            }
+
+            themeContext.page.title = theme.page.title || themeContext.page.title;
+
+            // Store the resolved urls to these resources so nodes (such as Debug)
+            // can access them
+            theme.page._ = {
+                css: themeContext.page.css,
+                scripts: themeContext.page.scripts,
+                favicon: themeContext.page.favicon
+            }
+        }
+
+        if (theme.header) {
+
+            themeContext.header.title = theme.header.title || themeContext.header.title;
+
+            if (theme.header.hasOwnProperty("url")) {
+                themeContext.header.url = theme.header.url;
+            }
+
+            if (theme.header.hasOwnProperty("image")) {
+                if (theme.header.image) {
+                    url = serveFile(themeApp,"/header/",theme.header.image);
+                    if (url) {
+                        themeContext.header.image = url;
+                    }
+                } else {
+                    themeContext.header.image = null;
+                }
+            }
+        }
+
+        if (theme.deployButton) {
+            themeSettings.deployButton = {};
+            if (theme.deployButton.label) {
+                themeSettings.deployButton.label = theme.deployButton.label;
+            }
+            if (theme.deployButton.type == "simple") {
+                themeSettings.deployButton.type = theme.deployButton.type;
+                if (theme.deployButton.icon) {
+                    url = serveFile(themeApp,"/deploy/",theme.deployButton.icon);
+                    if (url) {
+                        themeSettings.deployButton.icon = url;
+                    }
+                }
+            }
+        }
+
+        if (theme.hasOwnProperty("userMenu")) {
+            themeSettings.userMenu = theme.userMenu;
+        }
+
+        if (theme.login) {
+            let themeContextLogin = {}
+            let hasLoginTheme = false
+            if (theme.login.image) {
+                url = serveFile(themeApp,"/login/",theme.login.image);
+                if (url) {
+                    themeContextLogin.image = url
+                    hasLoginTheme = true
+                }
+            }
+            if (theme.login.message) {
+                themeContextLogin.message = theme.login.message
+                hasLoginTheme = true
+            }
+            if (theme.login.button) {
+                themeContextLogin.button = theme.login.button
+                hasLoginTheme = true
+            }
+            if (hasLoginTheme) {
+                themeContext.login = themeContextLogin
+            }
+        }
+        themeApp.get("/", async function(req,res) {
+            const themePluginList = await runtimeAPI.plugins.getPluginsByType({type:"node-red-theme"});
+            themeContext.themes = themePluginList.map(theme => theme.id);
+            res.json(themeContext);
+        })
+
+        if (theme.hasOwnProperty("menu")) {
+            themeSettings.menu = theme.menu;
+        }
+
+        if (theme.hasOwnProperty("palette")) {
+            themeSettings.palette = theme.palette;
+        }
+
+        if (theme.hasOwnProperty("projects")) {
+            themeSettings.projects = theme.projects;
+        }
+
+        if (theme.hasOwnProperty("multiplayer")) {
+            themeSettings.multiplayer = theme.multiplayer;
+        }
+
+        if (theme.hasOwnProperty("keymap")) {
+            themeSettings.keymap = theme.keymap;
+        }
+
+        if (theme.theme) {
+            themeSettings.theme = theme.theme;
+        }
+
+        if (theme.hasOwnProperty("tours")) {
+            themeSettings.tours = theme.tours;
+        }
+
+        return themeApp;
+    },
+    context: async function() {
+        if (activeTheme && !activeThemeInitialised) {
+            const themePlugin = await runtimeAPI.plugins.getPlugin({
+                id:activeTheme
+            });
+            if (themePlugin) {
+                if (themePlugin.css) {
+                    const cssFiles = serveFilesFromTheme(
+                        themePlugin.css,
+                        themeApp,
+                        "/css/",
+                        themePlugin.path
+                    );
+                    themeContext.page.css = cssFiles.concat(themeContext.page.css || [])
+                    theme.page = theme.page || {_:{}}
+                    theme.page._.css = cssFiles.concat(theme.page._.css || [])
+                }
+                if (themePlugin.scripts) {
+                    const scriptFiles = serveFilesFromTheme(
+                        themePlugin.scripts,
+                        themeApp,
+                        "/scripts/",
+                        themePlugin.path
+                    )
+                    themeContext.page.scripts = scriptFiles.concat(themeContext.page.scripts || [])
+                    theme.page = theme.page || {_:{}}
+                    theme.page._.scripts = scriptFiles.concat(theme.page._.scripts || [])
+                }
+                // check and load page settings from theme
+                if (themePlugin.page) {
+                    if (themePlugin.page.favicon  && !theme.page.favicon) {
+                        const result = serveFilesFromTheme(
+                            [themePlugin.page.favicon],
+                            themeApp,
+                            "/",
+                            themePlugin.path
+                        )
+                        if(result && result.length > 0) {
+                            // update themeContext page favicon
+                            themeContext.page.favicon = result[0]
+                            theme.page = theme.page || {_:{}}
+                            theme.page._.favicon = result[0]
+                        }
+                    }
+                    if (themePlugin.page.tabicon && themePlugin.page.tabicon.icon && !theme.page.tabicon) {
+                        const result = serveFilesFromTheme(
+                            [themePlugin.page.tabicon.icon],
+                            themeApp,
+                            "/page/",
+                            themePlugin.path
+                        )
+                        if(result && result.length > 0) {
+                            // update themeContext page tabicon
+                            themeContext.page.tabicon.icon = result[0]
+                            themeContext.page.tabicon.colour = themeContext.page.tabicon.colour || themeContext.page.tabicon.colour
+                            theme.page = theme.page || {_:{}}
+                            theme.page._.tabicon = theme.page._.tabicon || {}
+                            theme.page._.tabicon.icon = themeContext.page.tabicon.icon 
+                            theme.page._.tabicon.colour = themeContext.page.tabicon.colour
+                        }
+                    }
+                    // if the plugin has a title AND the users settings.js does NOT
+                    if (themePlugin.page.title && !theme.page.title) {
+                        themeContext.page.title = themePlugin.page.title || themeContext.page.title
+                    }
+                }
+                // check and load header settings from theme
+                if (themePlugin.header) {
+                    if (themePlugin.header.image && !theme.header.image) {
+                        const result = serveFilesFromTheme(
+                            [themePlugin.header.image],
+                            themeApp,
+                            "/header/",
+                            themePlugin.path
+                        )
+                        if(result && result.length > 0) {
+                            // update themeContext header image
+                            themeContext.header.image = result[0]
+                        }
+                    }
+                    // if the plugin has a title AND the users settings.js does NOT have a title
+                    if (themePlugin.header.title && !theme.header.title) {
+                        themeContext.header.title = themePlugin.header.title || themeContext.header.title
+                    }
+                    // if the plugin has a header url AND the users settings.js does NOT
+                    if (themePlugin.header.url && !theme.header.url) {
+                        themeContext.header.url = themePlugin.header.url || themeContext.header.url
+                    }
+                }
+                theme.codeEditor = theme.codeEditor || {}
+                theme.codeEditor.options = Object.assign({}, themePlugin.monacoOptions, theme.codeEditor.options);
+
+                theme.mermaid = Object.assign({}, themePlugin.mermaid, theme.mermaid)
+            }
+            activeThemeInitialised = true;
+        }
+        return themeContext;
+    },
+    settings: function() {
+        return themeSettings;
+    },
+    serveFile: function(baseUrl,file) {
+        return serveFile(themeApp,baseUrl,file);
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/ui.js

@@ -0,0 +1,117 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+const crypto = require('crypto')
+var express = require('express');
+var fs = require("fs");
+var path = require("path");
+var Mustache = require("mustache");
+var mime = require("mime");
+
+var apiUtils = require("../util");
+
+var theme = require("./theme");
+
+var runtimeAPI;
+let settings;
+var editorClientDir = path.dirname(require.resolve("@node-red/editor-client"));
+var defaultNodeIcon = path.join(editorClientDir,"public","red","images","icons","arrow-in.svg");
+var editorTemplatePath = path.join(editorClientDir,"templates","index.mst");
+var editorTemplate;
+let cacheBuster
+
+module.exports = {
+    init: function(_settings, _runtimeAPI) {
+        settings = _settings;
+        runtimeAPI = _runtimeAPI;
+        editorTemplate = fs.readFileSync(editorTemplatePath,"utf8");
+        Mustache.parse(editorTemplate);
+    },
+
+    ensureSlash: function(req,res,next) {
+        var parts = req.originalUrl.split("?");
+        if (parts[0].slice(-1) != "/") {
+            parts[0] += "/";
+            var redirect = parts.join("?");
+            res.redirect(301,redirect);
+        } else {
+            next();
+        }
+    },
+    icon: function(req,res) {
+        var icon = req.params.icon;
+        var scope = req.params.scope;
+        var module = scope ? scope + '/' +  req.params.module : req.params.module;
+        var opts = {
+            user: req.user,
+            module: module,
+            icon: icon
+        }
+        runtimeAPI.nodes.getIcon(opts).then(function(data) {
+            if (data) {
+                var contentType = mime.getType(icon);
+                res.set("Content-Type", contentType);
+                res.send(data);
+            } else {
+                res.sendFile(defaultNodeIcon);
+            }
+        }).catch(function(err) {
+            console.log(err.stack);
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    moduleResource: function(req, res) {
+        let resourcePath = req.params[1];
+        let opts = {
+            user: req.user,
+            module: req.params[0],
+            path: resourcePath
+        }
+        runtimeAPI.nodes.getModuleResource(opts).then(function(data) {
+            if (data) {
+                var contentType = mime.getType(resourcePath);
+                res.set("Content-Type", contentType);
+                res.send(data);
+            } else {
+                res.status(404).end()
+            }
+        }).catch(function(err) {
+            console.log(err.stack);
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    editor: async function(req,res) {
+        if (!cacheBuster) {
+            // settings.instanceId is set asynchronously to the editor-api
+            // being initiaised. So we defer calculating the cacheBuster hash
+            // until the first load of the editor
+            cacheBuster = crypto.createHash('sha1').update(`${settings.version || 'version'}-${settings.instanceId || 'instanceId'}`).digest("hex").substring(0,12)    
+        }
+
+        let sessionMessages;
+        if (req.session && req.session.messages) {
+            sessionMessages = JSON.stringify(req.session.messages);
+            delete req.session.messages
+        }
+        res.send(Mustache.render(editorTemplate,{
+            sessionMessages,
+            cacheBuster,
+            ...await theme.context()
+        }));
+    },
+    editorResources: express.static(path.join(editorClientDir,'public'))
+};