WIP.

.docker/chromium/Dockerfile

@@ -10,7 +10,7 @@ RUN set -eux; \
     #
     # install widevine module
     CHROMIUM_DIR="/usr/lib/chromium"; \
-    WIDEVINE_VERSION=$(wget --quiet -O - https://dl.google.com/widevine-cdm/versions.txt | sort --version-sort | tail -n 1); \
+    WIDEVINE_VERSION=$(wget --quiet -O - https://dl.google.com/widevine-cdm/versions.txt | tail -n 1); \
     wget -O /tmp/widevine.zip "https://dl.google.com/widevine-cdm/${WIDEVINE_VERSION}-linux-x64.zip"; \
     mkdir -p "${CHROMIUM_DIR}/WidevineCdm/_platform_specific/linux_x64"; \
     unzip -p /tmp/widevine.zip LICENSE.txt > "${CHROMIUM_DIR}/WidevineCdm/LICENSE"; \

.docker/chromium/Dockerfile.nvidia

@@ -14,7 +14,7 @@ RUN set -eux; \
     #
     # install widevine module
     CHROMIUM_DIR="/usr/lib/chromium"; \
-    WIDEVINE_VERSION=$(wget --quiet -O - https://dl.google.com/widevine-cdm/versions.txt | sort --version-sort | tail -n 1); \
+    WIDEVINE_VERSION=$(wget --quiet -O - https://dl.google.com/widevine-cdm/versions.txt | tail -n 1); \
     wget -O /tmp/widevine.zip "https://dl.google.com/widevine-cdm/${WIDEVINE_VERSION}-linux-x64.zip"; \
     mkdir -p "${CHROMIUM_DIR}/WidevineCdm/_platform_specific/linux_x64"; \
     unzip -p /tmp/widevine.zip LICENSE.txt > "${CHROMIUM_DIR}/WidevineCdm/LICENSE"; \

.docker/microsoft-edge/Dockerfile

@@ -8,7 +8,7 @@ ARG API_URL="https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edg
 RUN set -eux; apt-get update; \
     #
     # fetch latest release
-    SRC_URL="${API_URL}$(wget -O - "${API_URL}" 2>/dev/null | sed -n 's/.*href="\([^"]*\).*/\1/p' | sort --version-sort | tail -1)"; \
+    SRC_URL="${API_URL}$(wget -O - "${API_URL}" 2>/dev/null | sed -n 's/.*href="\([^"]*\).*/\1/p' | tail -1)"; \
     wget -O /tmp/microsoft-edge.deb "${SRC_URL}"; \
     apt-get install -y --no-install-recommends openbox /tmp/microsoft-edge.deb; \
     #

.docker/microsoft-edge/Dockerfile.nvidia

@@ -8,7 +8,7 @@ ARG API_URL="https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edg
 RUN set -eux; apt-get update; \
     #
     # fetch latest release
-    SRC_URL="${API_URL}$(wget -O - "${API_URL}" 2>/dev/null | sed -n 's/.*href="\([^"]*\).*/\1/p' | sort --version-sort | tail -1)"; \
+    SRC_URL="${API_URL}$(wget -O - "${API_URL}" 2>/dev/null | sed -n 's/.*href="\([^"]*\).*/\1/p' | tail -1)"; \
     wget -O /tmp/microsoft-edge.deb "${SRC_URL}"; \
     apt-get install -y --no-install-recommends openbox /tmp/microsoft-edge.deb; \
     #

.docker/opera/Dockerfile

@@ -9,7 +9,7 @@ ARG LIBFFMPEG_API_URL="https://api.github.com/repos/nwjs-ffmpeg-prebuilt/nwjs-ff
 RUN set -eux; apt-get update; \
     #
     # fetch latest release
-    VERSION="$(wget -O - "${API_URL}" 2>/dev/null | sed -n 's/.*href="\([^"/]*\).*/\1/p' | sort --version-sort | tail -1)"; \
+    VERSION="$(wget -O - "${API_URL}" 2>/dev/null | sed -n 's/.*href="\([^"/]*\).*/\1/p' | tail -1)"; \
     wget -O /tmp/opera.deb "${API_URL}${VERSION}/linux/opera-stable_${VERSION}_amd64.deb"; \
     apt-get install -y --no-install-recommends openbox jq unzip /tmp/opera.deb; \
     #

.docker/ungoogled-chromium/Dockerfile

@@ -21,7 +21,7 @@ RUN set -eux; apt-get update; \
     chmod 4755 /usr/lib/chromium/chrome-sandbox; \
     #
     # install widevine module
-    WIDEVINE_VERSION=$(wget --quiet -O - https://dl.google.com/widevine-cdm/versions.txt | sort --version-sort | tail -n 1); \
+    WIDEVINE_VERSION=$(wget --quiet -O - https://dl.google.com/widevine-cdm/versions.txt | tail -n 1); \
     wget -O /tmp/widevine.zip "https://dl.google.com/widevine-cdm/${WIDEVINE_VERSION}-linux-x64.zip"; \
     unzip -p /tmp/widevine.zip libwidevinecdm.so > /usr/lib/chromium/libwidevinecdm.so; \
     chmod 644 /usr/lib/chromium/libwidevinecdm.so; \

client/src/app.vue

@@ -204,9 +204,7 @@
 
     @Watch('volume', { immediate: true })
     onVolume(volume: number) {
-      if (new URL(location.href).searchParams.has('volume')) {
-        this.$accessor.video.setVolume(volume)
-      }
+      this.$accessor.video.setVolume(volume)
     }
 
     @Watch('hideControls', { immediate: true })

client/src/components/controls.vue

@@ -1,6 +1,6 @@
 <template>
   <ul>
-    <li v-if="!implicitHosting && hosting">
+    <li v-if="!implicitHosting && (!controlLocked || hosting)">
       <i
         :class="[
           !disabeld && shakeKbd ? 'shake' : '',
@@ -22,9 +22,9 @@
     </li>
     <li class="no-pointer" v-if="implicitHosting">
       <i
-        :class="['fas', 'fa-mouse-pointer']"
+        :class="[controlLocked ? 'disabled' : '', 'fas', 'fa-mouse-pointer']"
         v-tooltip="{
-          content: $t('controls.has'),
+          content: controlLocked ? $t('controls.hasnot') : $t('controls.has'),
           placement: 'top',
           offset: 5,
           boundariesElement: 'body',
@@ -32,7 +32,7 @@
         }"
       />
     </li>
-    <li v-if="implicitHosting || (!implicitHosting && hosting)">
+    <li v-if="implicitHosting || (!implicitHosting && (!controlLocked || hosting))">
       <label
         class="switch"
         v-tooltip="{
@@ -43,7 +43,7 @@
           delay: { show: 300, hide: 100 },
         }"
       >
-        <input type="checkbox" v-model="locked" :disabled="!hosting || implicitHosting" />
+        <input type="checkbox" v-model="locked" :disabled="!hosting || (implicitHosting && controlLocked)" />
         <span />
       </label>
     </li>
@@ -258,6 +258,10 @@
   export default class extends Vue {
     @Prop(Boolean) readonly shakeKbd!: boolean
 
+    get controlLocked() {
+      return 'control' in this.$accessor.locked && this.$accessor.locked['control'] && !this.$accessor.user.admin
+    }
+
     get disabeld() {
       return this.$accessor.remote.hosted
     }

client/src/components/files.vue

@@ -0,0 +1,520 @@
+<template>
+  <div class="files">
+    <div class="files-cwd">
+      <p>{{ cwd }}</p>
+      <i class="fas fa-rotate-right refresh" @click="refresh" />
+    </div>
+    <div class="files-list">
+      <div v-for="item in files" :key="item.name" class="files-list-item">
+        <i :class="fileIcon(item)" />
+        <p class="file-name" :title="item.name">{{ item.name }}</p>
+        <p class="file-size">{{ fileSize(item.size) }}</p>
+        <i v-if="item.type !== 'dir'" class="fas fa-download download" @click="download(item)" />
+      </div>
+    </div>
+    <div class="transfer-area">
+      <div class="transfers" v-if="transfers.length > 0">
+        <p v-if="downloads.length > 0" class="transfers-list-header">
+          <span>{{ $t('files.downloads') }}</span>
+          <i class="fas fa-xmark remove-transfer" @click="downloads.forEach((t) => removeTransfer(t))"></i>
+        </p>
+        <div v-for="download in downloads" :key="download.id" class="transfers-list-item">
+          <div class="transfer-info">
+            <i
+              class="fas transfer-status"
+              :class="{
+                'fa-clock': download.status === 'pending',
+                'fa-arrows-rotate': download.status === 'inprogress',
+                'fa-check': download.status === 'completed',
+                'fa-warning': download.status === 'failed',
+              }"
+            ></i>
+            <p class="file-name" :title="download.name">{{ download.name }}</p>
+            <p class="file-size">{{ Math.min(100, Math.round((download.progress / download.size) * 100)) }}%</p>
+            <i class="fas fa-xmark remove-transfer" @click="removeTransfer(download)"></i>
+          </div>
+          <div v-if="download.status === 'failed'" class="transfer-error">{{ download.error }}</div>
+          <progress
+            v-else
+            class="transfer-progress"
+            :aria-label="download.name + ' progress'"
+            :value="download.progress"
+            :max="download.size"
+          ></progress>
+        </div>
+        <p v-if="uploads.length > 0" class="transfers-list-header">
+          <span>{{ $t('files.uploads') }}</span>
+          <i class="fas fa-xmark remove-transfer" @click="uploads.forEach((t) => removeTransfer(t))"></i>
+        </p>
+        <div v-for="upload in uploads" :key="upload.id" class="transfers-list-item">
+          <div class="transfer-info">
+            <i
+              class="fas transfer-status"
+              :title="upload.status"
+              :class="{
+                'fa-clock': upload.status === 'pending',
+                'fa-arrows-rotate': upload.status === 'inprogress',
+                'fa-check': upload.status === 'completed',
+                'fa-warning': upload.status === 'failed',
+              }"
+            ></i>
+            <p class="file-name" :title="upload.name">{{ upload.name }}</p>
+            <p class="file-size">{{ Math.min(100, Math.round((upload.progress / upload.size) * 100)) }}%</p>
+            <i class="fas fa-xmark remove-transfer" @click="removeTransfer(upload)"></i>
+          </div>
+          <div v-if="upload.status === 'failed'" class="transfer-error">{{ upload.error }}</div>
+          <progress
+            v-else
+            class="transfer-progress"
+            :aria-label="upload.name + ' progress'"
+            :value="upload.progress"
+            :max="upload.size"
+          ></progress>
+        </div>
+      </div>
+      <div
+        class="upload-area"
+        :class="{ 'upload-area-drag': uploadAreaDrag }"
+        @dragover.prevent="uploadAreaDrag = true"
+        @dragleave.prevent="uploadAreaDrag = false"
+        @drop.prevent="(e) => upload(e.dataTransfer)"
+        @click="openFileBrowser"
+      >
+        <i class="fas fa-file-arrow-up" />
+        <p>{{ $t('files.upload_here') }}</p>
+      </div>
+    </div>
+  </div>
+</template>
+
+<style lang="scss" scoped>
+  .files {
+    flex: 1;
+    flex-direction: column;
+    display: flex;
+    max-width: 100%;
+
+    .files-cwd {
+      display: flex;
+      flex-direction: row;
+      margin: 10px 10px 0px 10px;
+      padding: 0.5em;
+      font-weight: 600;
+      background-color: rgba($color: #fff, $alpha: 0.05);
+      border-radius: 5px;
+    }
+
+    .files-list {
+      margin: 10px 10px 10px 10px;
+      background-color: rgba($color: #fff, $alpha: 0.05);
+      border-radius: 5px;
+      overflow-y: scroll;
+      scrollbar-width: thin;
+      scrollbar-color: $background-tertiary transparent;
+
+      &::-webkit-scrollbar {
+        width: 8px;
+      }
+
+      &::-webkit-scrollbar-track {
+        background-color: transparent;
+      }
+
+      &::-webkit-scrollbar-thumb {
+        background-color: $background-tertiary;
+        border: 2px solid $background-primary;
+        border-radius: 4px;
+      }
+
+      &::-webkit-scrollbar-thumb:hover {
+        background-color: $background-floating;
+      }
+    }
+
+    .files-list-item {
+      padding: 0.5em;
+      border-bottom: 2px solid rgba($color: #fff, $alpha: 0.1);
+      display: flex;
+      flex-direction: row;
+      line-height: 1.2;
+    }
+
+    .transfers-list-header {
+      display: flex;
+      justify-content: space-between;
+      border-bottom: 2px solid rgba($color: #fff, $alpha: 0.1);
+    }
+
+    .file-icon,
+    .transfer-status {
+      width: 14px;
+      margin-right: 0.5em;
+    }
+
+    .transfer-error {
+      border: 1px solid $style-error;
+      border-radius: 5px;
+      padding: 10px;
+    }
+
+    .files-list-item:last-child {
+      border-bottom: 0px;
+    }
+
+    .refresh {
+      margin-left: auto;
+    }
+
+    .file-name {
+      text-overflow: ellipsis;
+      overflow: hidden;
+      white-space: nowrap;
+    }
+
+    .file-size {
+      margin-left: auto;
+      margin-right: 0.5em;
+      color: rgba($color: #fff, $alpha: 0.4);
+      white-space: nowrap;
+    }
+
+    .refresh:hover,
+    .download:hover,
+    .remove-transfer:hover {
+      cursor: pointer;
+    }
+
+    .transfer-area {
+      margin-top: auto;
+    }
+
+    .transfers {
+      margin: 10px 10px 10px 10px;
+      background-color: rgba($color: #fff, $alpha: 0.05);
+      border-radius: 5px;
+      max-height: 50vh;
+      overflow-y: scroll;
+      overflow-x: hidden;
+      scrollbar-width: thin;
+      scrollbar-color: $background-tertiary transparent;
+
+      &::-webkit-scrollbar {
+        width: 8px;
+      }
+
+      &::-webkit-scrollbar-track {
+        background-color: transparent;
+      }
+
+      &::-webkit-scrollbar-thumb {
+        background-color: $background-tertiary;
+        border: 2px solid $background-primary;
+        border-radius: 4px;
+      }
+
+      &::-webkit-scrollbar-thumb:hover {
+        background-color: $background-floating;
+      }
+    }
+
+    .transfers > p {
+      padding: 10px;
+      font-weight: 600;
+    }
+
+    .transfer-info {
+      display: flex;
+      flex-direction: row;
+      max-width: 100%;
+      padding: 10px;
+    }
+
+    .transfer-progress {
+      margin: 0px 10px 10px 10px;
+      width: 95%;
+    }
+
+    .upload-area {
+      display: flex;
+      flex-direction: column;
+      text-align: center;
+      justify-content: center;
+      margin: 10px 10px 10px 10px;
+      background-color: rgba($color: #fff, $alpha: 0.05);
+      border-radius: 5px;
+    }
+
+    .upload-area:hover {
+      cursor: pointer;
+    }
+
+    .upload-area-drag,
+    .upload-area:hover {
+      background-color: rgba($color: #fff, $alpha: 0.1);
+    }
+
+    .upload-area > i {
+      font-size: 4em;
+      margin: 10px 10px 10px 10px;
+    }
+
+    .upload-area > p {
+      margin: 0px 10px 10px 10px;
+    }
+  }
+</style>
+
+<script lang="ts">
+  import { Component, Vue } from 'vue-property-decorator'
+
+  import Markdown from './markdown'
+  import Content from './context.vue'
+  import { FileTransfer, FileListItem } from '~/neko/types'
+
+  @Component({
+    name: 'neko-files',
+    components: {
+      'neko-markdown': Markdown,
+      'neko-context': Content,
+    },
+  })
+  export default class extends Vue {
+    public uploadAreaDrag: boolean = false
+
+    get cwd() {
+      return this.$accessor.files.cwd
+    }
+
+    get files() {
+      return this.$accessor.files.files
+    }
+
+    get transfers() {
+      return this.$accessor.files.transfers
+    }
+
+    get downloads() {
+      return this.$accessor.files.transfers.filter((t) => t.direction === 'download')
+    }
+
+    get uploads() {
+      return this.$accessor.files.transfers.filter((t) => t.direction === 'upload')
+    }
+
+    refresh() {
+      this.$accessor.files.refresh()
+    }
+
+    download(item: FileListItem) {
+      if (this.downloads.map((t) => t.name).includes(item.name)) {
+        return
+      }
+
+      const url =
+        '/file?pwd=' + encodeURIComponent(this.$accessor.password) + '&filename=' + encodeURIComponent(item.name)
+      const abortController = new AbortController()
+
+      let transfer: FileTransfer = {
+        id: Math.round(Math.random() * 10000),
+        name: item.name,
+        direction: 'download',
+        // this may be smaller than the actual transfer amount, but for large files the
+        // content length is not sent (chunked transfer)
+        size: item.size,
+        progress: 0,
+        status: 'pending',
+        abortController: abortController,
+      }
+
+      this.$http
+        .get(url, {
+          responseType: 'blob',
+          signal: abortController.signal,
+          withCredentials: false,
+          onDownloadProgress: (x) => {
+            transfer.progress = x.loaded
+
+            if (x.total && transfer.size !== x.total) {
+              transfer.size = x.total
+            }
+            if (transfer.progress === transfer.size) {
+              transfer.status = 'completed'
+            } else if (transfer.status !== 'inprogress') {
+              transfer.status = 'inprogress'
+            }
+          },
+        })
+        .then((res) => {
+          const url = window.URL.createObjectURL(new Blob([res.data]))
+          const link = document.createElement('a')
+          link.href = url
+          link.setAttribute('download', item.name)
+          document.body.appendChild(link)
+          link.click()
+          document.body.removeChild(link)
+
+          transfer.progress = transfer.size
+          transfer.status = 'completed'
+        })
+        .catch((error) => {
+          this.$log.error(error)
+
+          transfer.status = 'failed'
+          transfer.error = error.message
+        })
+
+      this.$accessor.files.addTransfer(transfer)
+    }
+
+    upload(dt: DataTransfer) {
+      const url = '/file?pwd=' + encodeURIComponent(this.$accessor.password)
+      this.uploadAreaDrag = false
+
+      for (const file of dt.files) {
+        const abortController = new AbortController()
+
+        const formdata = new FormData()
+        formdata.append('files', file, file.name)
+
+        let transfer: FileTransfer = {
+          id: Math.round(Math.random() * 10000),
+          name: file.name,
+          direction: 'upload',
+          size: file.size,
+          progress: 0,
+          status: 'pending',
+          abortController: abortController,
+        }
+
+        this.$http
+          .post(url, formdata, {
+            signal: abortController.signal,
+            withCredentials: false,
+            onUploadProgress: (x: any) => {
+              transfer.progress = x.loaded
+
+              if (transfer.size !== x.total) {
+                transfer.size = x.total
+              }
+              if (transfer.progress === transfer.size) {
+                transfer.status = 'completed'
+              } else if (transfer.status !== 'inprogress') {
+                transfer.status = 'inprogress'
+              }
+            },
+          })
+          .catch((error) => {
+            this.$log.error(error)
+
+            transfer.status = 'failed'
+            transfer.error = error.message
+          })
+
+        this.$accessor.files.addTransfer(transfer)
+      }
+    }
+
+    openFileBrowser() {
+      const input = document.createElement('input')
+      input.type = 'file'
+      input.setAttribute('multiple', 'true')
+      input.onchange = (e: Event) => {
+        if (e === null) return
+
+        const dt = new DataTransfer()
+        const target = e.target as HTMLInputElement
+        if (target.files === null) return
+
+        for (const f of target.files) {
+          dt.items.add(f)
+        }
+
+        this.upload(dt)
+      }
+      input.click()
+    }
+
+    removeTransfer(transfer: FileTransfer) {
+      if (transfer.status !== 'completed') {
+        transfer.abortController?.abort()
+      }
+      this.$accessor.files.removeTransfer(transfer)
+    }
+
+    fileIcon(file: FileListItem) {
+      let className = 'file-icon fas '
+      // if is directory
+      if (file.type === 'dir') {
+        className += 'fa-folder'
+        return className
+      }
+      // try to get file extension
+      const ext = file.name.split('.').pop()
+      if (ext === undefined) {
+        className += 'fa-file'
+        return className
+      }
+      // try to find icon
+      switch (ext.toLowerCase()) {
+        case 'txt':
+        case 'md':
+          className += 'fa-file-text'
+          break
+        case 'pdf':
+          className += 'fa-file-pdf'
+          break
+        case 'zip':
+        case 'rar':
+        case '7z':
+        case 'gz':
+          className += 'fa-archive'
+          break
+        case 'aac':
+        case 'flac':
+        case 'midi':
+        case 'mp3':
+        case 'ogg':
+        case 'wav':
+          className += 'fa-music'
+          break
+        case 'avi':
+        case 'mkv':
+        case 'mov':
+        case 'mpeg':
+        case 'mp4':
+        case 'webm':
+          className += 'fa-film'
+          break
+        case 'bmp':
+        case 'gif':
+        case 'jpeg':
+        case 'jpg':
+        case 'png':
+        case 'svg':
+        case 'tiff':
+        case 'webp':
+          className += 'fa-image'
+          break
+        default:
+          className += 'fa-file'
+      }
+      return className
+    }
+
+    fileSize(size: number) {
+      if (size < 1024) {
+        return size + ' B'
+      }
+      if (size < 1024 * 1024) {
+        return Math.round(size / 1024) + ' KB'
+      }
+      if (size < 1024 * 1024 * 1024) {
+        return Math.round(size / (1024 * 1024)) + ' MB'
+      }
+      if (size < 1024 * 1024 * 1024 * 1024) {
+        return Math.round(size / (1024 * 1024 * 1024)) + ' GB'
+      }
+      return Math.round(size / (1024 * 1024 * 1024 * 1024)) + ' TB'
+    }
+  }
+</script>

client/src/components/header.vue

@@ -5,6 +5,45 @@
       <span><b>n</b>.eko</span>
     </a>
     <ul class="menu">
+      <li>
+        <i
+          :class="[{ disabled: !admin }, { locked: isLocked('control') }, 'fas', 'fa-mouse']"
+          @click="toggleLock('control')"
+          v-tooltip="{
+            content: lockedTooltip('control'),
+            placement: 'bottom',
+            offset: 5,
+            boundariesElement: 'body',
+            delay: { show: 300, hide: 100 },
+          }"
+        />
+      </li>
+      <li>
+        <i
+          :class="[{ disabled: !admin }, { locked: isLocked('login') }, locked ? 'fa-lock' : 'fa-lock-open', 'fas']"
+          @click="toggleLock('login')"
+          v-tooltip="{
+            content: lockedTooltip('login'),
+            placement: 'bottom',
+            offset: 5,
+            boundariesElement: 'body',
+            delay: { show: 300, hide: 100 },
+          }"
+        />
+      </li>
+      <li v-if="fileTransfer">
+        <i
+          :class="[{ disabled: !admin }, { locked: isLocked('file_transfer') }, 'fas', 'fa-file']"
+          @click="toggleLock('file_transfer')"
+          v-tooltip="{
+            content: lockedTooltip('file_transfer'),
+            placement: 'bottom',
+            offset: 5,
+            boundariesElement: 'body',
+            delay: { show: 300, hide: 100 },
+          }"
+        />
+      </li>
       <li>
         <span v-if="showBadge" class="badge">&bull;</span>
         <i class="fas fa-bars toggle" @click="toggleMenu" />
@@ -123,6 +162,14 @@
 
   @Component({ name: 'neko-settings' })
   export default class extends Vue {
+    get admin() {
+      return this.$accessor.user.admin
+    }
+
+    get locked() {
+      return this.$accessor.locked
+    }
+
     get side() {
       return this.$accessor.client.side
     }
@@ -135,10 +182,30 @@
       return !this.side && this.readTexts != this.texts
     }
 
+    get fileTransfer() {
+      return this.$accessor.remote.fileTransfer
+    }
+
+    toggleLock(resource: AdminLockResource) {
+      this.$accessor.toggleLock(resource)
+    }
+
+    isLocked(resource: AdminLockResource): boolean {
+      return this.$accessor.isLocked(resource)
+    }
+
     readTexts: number = 0
     toggleMenu() {
       this.$accessor.client.toggleSide()
       this.readTexts = this.texts
     }
+
+    lockedTooltip(resource: AdminLockResource) {
+      if (this.admin) {
+        return this.$t(`locks.${resource}.` + (this.isLocked(resource) ? `unlock` : `lock`))
+      }
+
+      return this.$t(`locks.${resource}.` + (this.isLocked(resource) ? `locked` : `unlocked`))
+    }
   }
 </script>

client/src/components/menu.vue

@@ -82,14 +82,6 @@
       if (default_lang && this.langs.includes(default_lang)) {
         this.$i18n.locale = default_lang
       }
-      const show_side = new URL(location.href).searchParams.get('show_side')
-      if (show_side !== null) {
-        this.$accessor.client.setSide(show_side === '1')
-      }
-      const mute_chat = new URL(location.href).searchParams.get('mute_chat')
-      if (mute_chat !== null) {
-        this.$accessor.settings.setSound(mute_chat !== '1')
-      }
     }
   }
 </script>

client/src/components/side.vue

@@ -6,6 +6,10 @@
           <i class="fas fa-comment-alt" />
           <span>{{ $t('side.chat') }}</span>
         </li>
+        <li v-if="filetransferAllowed" :class="{ active: tab === 'files' }" @click.stop.prevent="change('files')">
+          <i class="fas fa-file" />
+          <span>{{ $t('side.files') }}</span>
+        </li>
         <li :class="{ active: tab === 'settings' }" @click.stop.prevent="change('settings')">
           <i class="fas fa-sliders-h" />
           <span>{{ $t('side.settings') }}</span>
@@ -75,23 +79,47 @@
 </style>
 
 <script lang="ts">
-  import { Vue, Component } from 'vue-property-decorator'
+  import { Vue, Component, Watch } from 'vue-property-decorator'
 
   import Settings from '~/components/settings.vue'
   import Chat from '~/components/chat.vue'
+  import Files from '~/components/files.vue'
 
   @Component({
     name: 'neko',
     components: {
       'neko-settings': Settings,
       'neko-chat': Chat,
+      'neko-files': Files,
     },
   })
   export default class extends Vue {
+    get filetransferAllowed() {
+      return (
+        this.$accessor.remote.fileTransfer && (this.$accessor.user.admin || !this.$accessor.isLocked('file_transfer'))
+      )
+    }
+
     get tab() {
       return this.$accessor.client.tab
     }
 
+    @Watch('tab', { immediate: true })
+    @Watch('filetransferAllowed', { immediate: true })
+    onTabChange() {
+      // do not show the files tab if file transfer is disabled
+      if (this.tab === 'files' && !this.filetransferAllowed) {
+        this.change('chat')
+      }
+    }
+
+    @Watch('filetransferAllowed')
+    onFileTransferAllowedChange() {
+      if (this.filetransferAllowed) {
+        this.$accessor.files.refresh()
+      }
+    }
+
     change(tab: string) {
       this.$accessor.client.setTab(tab)
     }

client/src/components/video.vue

@@ -13,7 +13,6 @@
           class="overlay"
           tabindex="0"
           data-gramm="false"
-          :style="{ pointerEvents: hosting ? 'auto' : 'none' }"
           @click.stop.prevent
           @contextmenu.stop.prevent
           @wheel.stop.prevent="onWheel"
@@ -37,7 +36,7 @@
       <ul v-if="!fullscreen && !hideControls" class="video-menu top">
         <li><i @click.stop.prevent="requestFullscreen" class="fas fa-expand"></i></li>
         <li v-if="admin"><i @click.stop.prevent="openResolution" class="fas fa-desktop"></i></li>
-        <li v-if="!controlLocked && !implicitHosting" :class="extraControls || 'extra-control'">
+        <li v-if="!implicitHosting" :class="extraControls || 'extra-control'">
           <i
             :class="[hosted && !hosting ? 'disabled' : '', !hosted && !hosting ? 'faded' : '', 'fas', 'fa-keyboard']"
             @click.stop.prevent="toggleControl"

client/src/locale/de-de.ts

@@ -52,6 +52,33 @@ export const controls = {
   unlock: 'Steuerung entsperren',
 }
 
+export const locks = {
+  control: {
+    lock: 'Steuerung sperren (für Nutzer)',
+    unlock: 'Steuerung entsperren (für Nutzer)',
+    locked: 'Steuerung gesperrt (für Nutzer)',
+    unlocked: 'Steuerung entsperrt (für Nutzer)',
+    notif_locked: 'Steuerung sperren für Nutzer',
+    notif_unlocked: 'Steuerung entsperren für Nutzer',
+  },
+  login: {
+    lock: 'Raum sperren (für Nutzer)',
+    unlock: 'Raum entsperren (für Nutzer)',
+    locked: 'Raum gesperrt (für Nutzer)',
+    unlocked: 'Raum entsperrt (für Nutzer)',
+    notif_locked: 'Raum gesperrt',
+    notif_unlocked: 'Raum entsperrt',
+  },
+  file_transfer: {
+    lock: 'Dateiübertragung sperren (für Nutzer)',
+    unlock: 'Dateiübertragung entsperren (für Nutzer)',
+    locked: 'Dateiübertragung gesperrt (für Nutzer)',
+    unlocked: 'Dateiübertragung entsperrt (für Nutzer)',
+    notif_locked: 'Dateiübertragung gesperrt',
+    notif_unlocked: 'Dateiübertragung entsperrt',
+  },
+}
+
 export const setting = {
   scroll: 'Scroll-Empfindlichkeit',
   scroll_invert: 'Bildlauf umkehren',

client/src/locale/en-us.ts

@@ -54,6 +54,33 @@ export const controls = {
   hasnot: 'You do not have control',
 }
 
+export const locks = {
+  control: {
+    lock: 'Lock Controls (for users)',
+    unlock: 'Unlock Controls (for users)',
+    locked: 'Controls Locked (for users)',
+    unlocked: 'Controls Unlocked (for users)',
+    notif_locked: 'locked controls for users',
+    notif_unlocked: 'unlocked controls for users',
+  },
+  login: {
+    lock: 'Lock Room (for users)',
+    unlock: 'Unlock Room (for users)',
+    locked: 'Room Locked (for users)',
+    unlocked: 'Room Unlocked (for users)',
+    notif_locked: 'locked the room',
+    notif_unlocked: 'unlocked the room',
+  },
+  file_transfer: {
+    lock: 'Lock File Transfer (for users)',
+    unlock: 'Unlock File Transfer (for users)',
+    locked: 'File Transfer Locked (for users)',
+    unlocked: 'File Transfer Unlocked (for users)',
+    notif_locked: 'locked file transfer',
+    notif_unlocked: 'unlocked file transfer',
+  },
+}
+
 export const setting = {
   scroll: 'Scroll Sensitivity',
   scroll_invert: 'Invert Scroll',

client/src/locale/es-sp.ts

@@ -57,6 +57,35 @@ export const controls = {
   //hasnot: 'You do not have control',
 }
 
+export const locks = {
+  // TODO
+  //control: {
+  //  lock: 'Lock Controls (for users)',
+  //  unlock: 'Unlock Controls (for users)',
+  //  locked: 'Controls Locked (for users)',
+  //  unlocked: 'Controls Unlocked (for users)',
+  //  notif_locked: 'locked controls for users',
+  //  notif_unlocked: 'unlocked controls for users',
+  //},
+  login: {
+    lock: 'Bloquear sala (para usuarios)',
+    unlock: 'Desbloquear sala (para usuarios)',
+    locked: 'Sala bloqueada (para usuarios)',
+    unlocked: 'Sala desbloqueada (para usuarios)',
+    notif_locked: 'bloqueó la sala',
+    notif_unlocked: 'desbloqueó la sala',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: 'Sensibilidad del Scroll',
   scroll_invert: 'Invertir Scroll',

client/src/locale/fi-fi.ts

@@ -54,6 +54,34 @@ export const controls = {
   hasnot: 'Sinulle ei ole kontrolleja',
 }
 
+export const locks = {
+  control: {
+    lock: 'Lukitse kontrollit (käyttäjiltä)',
+    unlock: 'Vapauta kontrollit (käyttäjiltä)',
+    locked: 'Kontrollit lukittu (käyttäjiltä)',
+    unlocked: 'Kontrollit vapautettu (käyttäjiltä)',
+    notif_locked: 'kontrollit on lukittu käyttäjiltä',
+    notif_unlocked: 'kontrollit on vapautettu käyttäjille',
+  },
+  login: {
+    lock: 'Lukitse huone (käyttäjiltä)',
+    unlock: 'Vapauta huone (käyttäjiltä)',
+    locked: 'Huone lukittu (käyttäjiltä)',
+    unlocked: 'Huone vapautettu (käyttäjiltä)',
+    notif_locked: 'lukittu huone',
+    notif_unlocked: 'vapautettu huone',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: 'Scrollin herkkyys',
   scroll_invert: 'Käänteinen Scroll',

client/src/locale/fr-fr.ts

@@ -57,6 +57,35 @@ export const controls = {
   //  hasnot: 'You do not have control',
 }
 
+export const locks = {
+  // TODO
+  //control: {
+  //  lock: 'Lock Controls (for users)',
+  //  unlock: 'Unlock Controls (for users)',
+  //  locked: 'Controls Locked (for users)',
+  //  unlocked: 'Controls Unlocked (for users)',
+  //  notif_locked: 'locked controls for users',
+  //  notif_unlocked: 'unlocked controls for users',
+  //},
+  login: {
+    lock: 'Vérouiller la salle (pour les utilisateurs)',
+    unlock: 'Dévérouiller la salle (pour les utilisateurs)',
+    locked: 'Salle vérouillée (pour les utilisateurs)',
+    unlocked: 'Salle dévérouillée (pour les utilisateurs)',
+    notif_locked: 'a vérouillé la salle',
+    notif_unlocked: 'a dévérouillé la salle',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: 'Sensibilité de défilement (scroll)',
   scroll_invert: 'Inverser le défilement (scroll)',

client/src/locale/index.ts

@@ -9,7 +9,6 @@ import * as ko from './ko-kr'
 import * as fi from './fi-fi'
 import * as ru from './ru-ru'
 import * as cn from './zh-cn'
-import * as tw from './zh-tw'
 
 export const messages = {
   en,
@@ -23,5 +22,4 @@ export const messages = {
   fi,
   ru,
   cn,
-  tw,
 }

client/src/locale/ko-kr.ts

@@ -52,6 +52,34 @@ export const controls = {
   unlock: '조작 잠금 해제하기',
 }
 
+export const locks = {
+  control: {
+    lock: '조작 잠그기 (사용자)',
+    unlock: '조작 잠금 해제하기 (사용자)',
+    locked: '조작이 잠겼습니다 (사용자)',
+    unlocked: '조작 잠금이 해제됐습니다 (사용자)',
+    notif_locked: '사용자의 조작을 잠궜습니다',
+    notif_unlocked: '사용자의 조작 잠금을 해제했습니다',
+  },
+  login: {
+    lock: '방 잠그기 (사용자)',
+    unlock: '방 잠금 해제하기 (사용자)',
+    locked: '방이 잠겼습니다 (사용자)',
+    unlocked: '방 잠금이 해제됐습니다 (사용자)',
+    notif_locked: '방이 잠겼습니다',
+    notif_unlocked: '방 잠금이 해제됐습니다',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: '스크롤 감도',
   scroll_invert: '스크롤 반전',

client/src/locale/nb-no.ts

@@ -57,6 +57,35 @@ export const controls = {
   //hasnot: 'You do not have control',
 }
 
+export const locks = {
+  // TODO
+  //control: {
+  //  lock: 'Lock Controls (for users)',
+  //  unlock: 'Unlock Controls (for users)',
+  //  locked: 'Controls Locked (for users)',
+  //  unlocked: 'Controls Unlocked (for users)',
+  //  notif_locked: 'locked controls for users',
+  //  notif_unlocked: 'unlocked controls for users',
+  //},
+  login: {
+    lock: 'Lås rommet (for brukere)',
+    unlock: 'Lås opp rommet (for brukere)',
+    locked: 'Rom låst (for brukere)',
+    unlocked: 'Rom opplåst (for brukere)',
+    notif_locked: 'låste rommet',
+    notif_unlocked: 'låste opp rommet',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: 'Rullingssensitivitet',
   scroll_invert: 'Inverter rulling',

client/src/locale/ru-ru.ts

@@ -54,6 +54,34 @@ export const controls = {
   hasnot: 'Вы не управляете',
 }
 
+export const locks = {
+  control: {
+    lock: 'Закрепить управление (для пользователей)',
+    unlock: 'Открепить управление (для пользователей)',
+    locked: 'Управление закреплено (для пользователей)',
+    unlocked: 'Управление откреплено (для пользователей)',
+    notif_locked: 'закреплено управление для пользователей',
+    notif_unlocked: 'откреплено управление для пользователей',
+  },
+  login: {
+    lock: 'Закрыть комнату (для пользователей)',
+    unlock: 'Открыть комнату (для пользователей)',
+    locked: 'Комната закрыта (для пользователей)',
+    unlocked: 'Комната открыта (для пользователей)',
+    notif_locked: 'комната закрыта',
+    notif_unlocked: 'комната открыта',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: 'Чувствительность прокрутки',
   scroll_invert: 'Инвертировать прокрутку',

client/src/locale/sk-sk.ts

@@ -57,6 +57,34 @@ export const controls = {
   //hasnot: 'You do not have control',
 }
 
+export const locks = {
+  control: {
+    lock: 'Zakázať ovládanie (pre používateľov)',
+    unlock: 'Povoliť ovládanie (pre používateľov)',
+    locked: 'Ovládanie je zakázané (pre používateľov)',
+    unlocked: 'Ovládanie je povolené (pre používateľov)',
+    notif_locked: 'zakázal/a ovládanie pre používateľov',
+    notif_unlocked: 'povolil/a ovládanie pre používateľov',
+  },
+  login: {
+    lock: 'Zamknúť miestnosť (pre používateľov)',
+    unlock: 'Odomknúť miestnosť (pre používateľov)',
+    locked: 'Miestnosť je zamknutá (pre používateľov)',
+    unlocked: 'Miestnosť odomknutá (pre používateľov)',
+    notif_locked: 'miestnosť bola zamknutá',
+    notif_unlocked: 'miestnosť bola odomknutá',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: 'Citlivosť kolieska myši',
   scroll_invert: 'Invertovať koliesko myši',

client/src/locale/sv-se.ts

@@ -57,6 +57,35 @@ export const controls = {
   //hasnot: 'You do not have control',
 }
 
+export const locks = {
+  // TODO
+  //control: {
+  //  lock: 'Lock Controls (for users)',
+  //  unlock: 'Unlock Controls (for users)',
+  //  locked: 'Controls Locked (for users)',
+  //  unlocked: 'Controls Unlocked (for users)',
+  //  notif_locked: 'locked controls for users',
+  //  notif_unlocked: 'unlocked controls for users',
+  //},
+  login: {
+    lock: 'Lås rum (för användare)',
+    unlock: 'Lås upp rummet (för användare)',
+    locked: 'Rum låst (för användare)',
+    unlocked: 'Rum upplåst (för användare)',
+    notif_locked: 'låste rummet',
+    notif_unlocked: 'låste upp rummet',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: 'Scrollkänslighet',
   scroll_invert: 'Vänd Scrollen',

client/src/locale/zh-cn.ts

@@ -54,6 +54,34 @@ export const controls = {
   hasnot: '你没有控制',
 }
 
+export const locks = {
+  control: {
+    lock: '对所有用户进行锁定控制',
+    unlock: '对所有用户进行解锁控制',
+    locked: '锁定的控制装置',
+    unlocked: '解锁的控制装置',
+    notif_locked: '为用户锁定控制',
+    notif_unlocked: '为用户解锁控制',
+  },
+  login: {
+    lock: '所有用户的锁定室',
+    unlock: '所有用户的解锁室',
+    locked: '为所有用户锁定的房间',
+    unlocked: '为所有用户解锁的房间',
+    notif_locked: '锁上房间',
+    notif_unlocked: '解锁房间',
+  },
+  // TODO
+  //file_transfer: {
+  //  lock: 'Lock File Transfer (for users)',
+  //  unlock: 'Unlock File Transfer (for users)',
+  //  locked: 'File Transfer Locked (for users)',
+  //  unlocked: 'File Transfer Unlocked (for users)',
+  //  notif_locked: 'locked file transfer',
+  //  notif_unlocked: 'unlocked file transfer',
+  //},
+}
+
 export const setting = {
   scroll: '滚动敏感度',
   scroll_invert: '反转滚动敏感度',

client/src/locale/zh-tw.ts

@@ -1,100 +0,0 @@
-export const logout = '登出'
-export const unsupported = '您的網頁瀏覽器不支援 WebRTC'
-export const admin_loggedin = '您已經以管理員身份登入'
-export const you = '您'
-export const somebody = '某人'
-export const send_a_message = '傳送訊息'
-
-export const side = {
-  chat: '聊天',
-  files: '檔案',
-  settings: '設定',
-}
-
-export const connect = {
-  login_title: '請登入',
-  invitation_title: '您已被邀請進入此房間',
-  displayname: '輸入您的顯示名稱',
-  password: '密碼',
-  connect: '連線',
-  error: '登入錯誤',
-  empty_displayname: '顯示名稱不能為空。',
-}
-
-export const context = {
-  ignore: '忽略',
-  unignore: '取消忽略',
-  mute: '靜音',
-  unmute: '解除靜音',
-  release: '強制釋放控制',
-  take: '強制接管控制',
-  give: '移交控制',
-  kick: '踢出',
-  ban: '封鎖 IP',
-  confirm: {
-    kick_title: '踢出 {name}？',
-    kick_text: '您確定要踢出 {name} 嗎？',
-    ban_title: '封鎖 {name}？',
-    ban_text: '您是否要封鎖 {name}？封鎖後需要重新啟動伺服器才能取消封鎖。',
-    mute_title: '靜音 {name}？',
-    mute_text: '您確定要將 {name} 設為靜音嗎？',
-    unmute_title: '解除靜音 {name}？',
-    unmute_text: '您是否要解除 {name} 的靜音？',
-    button_yes: '是',
-    button_cancel: '取消',
-  },
-}
-
-export const controls = {
-  release: '釋放控制',
-  request: '請求控制',
-  lock: '鎖定控制',
-  unlock: '解鎖控制',
-  has: '您擁有控制權',
-  hasnot: '您沒有控制權',
-}
-
-export const setting = {
-  scroll: '滾動靈敏度',
-  scroll_invert: '反向滾動',
-  autoplay: '自動播放影片',
-  ignore_emotes: '忽略表情符號',
-  chat_sound: '播放聊天音效',
-  keyboard_layout: '鍵盤配置',
-  broadcast_title: '直播',
-}
-
-export const connection = {
-  logged_out: '您已登出。',
-  reconnecting: '正在重新連線…',
-  connected: '已連線',
-  disconnected: '已斷線',
-  kicked: '您已被移出此房間。',
-  button_confirm: '確定',
-}
-
-export const notifications = {
-  connected: '{name} 已連線',
-  disconnected: '{name} 已斷線',
-  controls_taken: '{name} 接管了控制權',
-  controls_taken_force: '強制接管控制權',
-  controls_taken_steal: '從 {name} 奪取了控制權',
-  controls_released: '{name} 釋放了控制權',
-  controls_released_force: '強制釋放控制權',
-  controls_released_steal: '從 {name} 強制釋放控制權',
-  controls_given: '將控制權交給 {name}',
-  controls_has: '{name} 擁有控制權',
-  controls_has_alt: '但我已通知對方您有意接管',
-  controls_requesting: '{name} 正在請求控制權',
-  resolution: '將解析度改為 {width}x{height}@{rate}',
-  banned: '已封鎖 {name}',
-  kicked: '已踢出 {name}',
-  muted: '已將 {name} 靜音',
-  unmuted: '已解除 {name} 的靜音',
-}
-
-export const files = {
-  downloads: '下載',
-  uploads: '上傳',
-  upload_here: '點選或拖曳檔案至此上傳',
-}

client/src/neko/events.ts

@@ -38,6 +38,10 @@ export const EVENT = {
     MESSAGE: 'chat/message',
     EMOTE: 'chat/emote',
   },
+  FILETRANSFER: {
+    LIST: 'filetransfer/list',
+    REFRESH: 'filetransfer/refresh',
+  },
   SCREEN: {
     CONFIGURATIONS: 'screen/configurations',
     RESOLUTION: 'screen/resolution',
@@ -51,6 +55,8 @@ export const EVENT = {
   ADMIN: {
     BAN: 'admin/ban',
     KICK: 'admin/kick',
+    LOCK: 'admin/lock',
+    UNLOCK: 'admin/unlock',
     MUTE: 'admin/mute',
     UNMUTE: 'admin/unmute',
     CONTROL: 'admin/control',
@@ -67,6 +73,7 @@ export type WebSocketEvents =
   | MemberEvents
   | SignalEvents
   | ChatEvents
+  | FileTransferEvents
   | ScreenEvents
   | BroadcastEvents
   | AdminEvents
@@ -90,6 +97,8 @@ export type SignalEvents =
 
 export type ChatEvents = typeof EVENT.CHAT.MESSAGE | typeof EVENT.CHAT.EMOTE
 
+export type FileTransferEvents = typeof EVENT.FILETRANSFER.LIST | typeof EVENT.FILETRANSFER.REFRESH
+
 export type ScreenEvents = typeof EVENT.SCREEN.CONFIGURATIONS | typeof EVENT.SCREEN.RESOLUTION | typeof EVENT.SCREEN.SET
 
 export type BroadcastEvents =
@@ -100,6 +109,8 @@ export type BroadcastEvents =
 export type AdminEvents =
   | typeof EVENT.ADMIN.BAN
   | typeof EVENT.ADMIN.KICK
+  | typeof EVENT.ADMIN.LOCK
+  | typeof EVENT.ADMIN.UNLOCK
   | typeof EVENT.ADMIN.MUTE
   | typeof EVENT.ADMIN.UNMUTE
   | typeof EVENT.ADMIN.CONTROL

client/src/neko/index.ts

@@ -22,6 +22,7 @@ import {
   AdminLockMessage,
   SystemInitPayload,
   AdminLockResource,
+  FileTransferListPayload,
 } from './messages'
 
 interface NekoEvents extends BaseEvents {}
@@ -133,9 +134,17 @@ export class NekoClient extends BaseClient implements EventEmitter<NekoEvents> {
   /////////////////////////////
   // System Events
   /////////////////////////////
-  protected [EVENT.SYSTEM.INIT]({ implicit_hosting, file_transfer }: SystemInitPayload) {
+  protected [EVENT.SYSTEM.INIT]({ implicit_hosting, locks, file_transfer }: SystemInitPayload) {
     this.$accessor.remote.setImplicitHosting(implicit_hosting)
     this.$accessor.remote.setFileTransfer(file_transfer)
+
+    for (const resource in locks) {
+      this[EVENT.ADMIN.LOCK]({
+        event: EVENT.ADMIN.LOCK,
+        resource: resource as AdminLockResource,
+        id: locks[resource],
+      })
+    }
   }
 
   protected [EVENT.SYSTEM.DISCONNECT]({ message }: SystemMessagePayload) {
@@ -344,6 +353,14 @@ export class NekoClient extends BaseClient implements EventEmitter<NekoEvents> {
     this.$accessor.chat.newEmote({ type: emote })
   }
 
+  /////////////////////////////
+  // File Transfer Events
+  /////////////////////////////
+  protected [EVENT.FILETRANSFER.LIST]({ cwd, files }: FileTransferListPayload) {
+    this.$accessor.files.setCwd(cwd)
+    this.$accessor.files.setFileList(files)
+  }
+
   /////////////////////////////
   // Screen Events
   /////////////////////////////
@@ -469,6 +486,28 @@ export class NekoClient extends BaseClient implements EventEmitter<NekoEvents> {
     })
   }
 
+  protected [EVENT.ADMIN.LOCK]({ id, resource }: AdminLockMessage) {
+    this.$accessor.setLocked(resource)
+
+    this.$accessor.chat.newMessage({
+      id,
+      content: this.$vue.$t(`locks.${resource}.notif_locked`) as string,
+      type: 'event',
+      created: new Date(),
+    })
+  }
+
+  protected [EVENT.ADMIN.UNLOCK]({ id, resource }: AdminLockMessage) {
+    this.$accessor.setUnlocked(resource)
+
+    this.$accessor.chat.newMessage({
+      id,
+      content: this.$vue.$t(`locks.${resource}.notif_unlocked`) as string,
+      type: 'event',
+      created: new Date(),
+    })
+  }
+
   protected [EVENT.ADMIN.CONTROL]({ id, target }: AdminTargetPayload) {
     this.$accessor.remote.setHost(id)
     this.$accessor.remote.changeKeyboard()

client/src/neko/messages.ts

@@ -8,8 +8,9 @@ import {
   ChatEvents,
   ScreenEvents,
   AdminEvents,
+  FileTransferEvents,
 } from './events'
-import { Member, ScreenConfigurations, ScreenResolution } from './types'
+import { FileListItem, Member, ScreenConfigurations, ScreenResolution } from './types'
 
 export type WebSocketMessages =
   | WebSocketMessage
@@ -193,6 +194,18 @@ export interface EmojiSendPayload {
   emote: string
 }
 
+/*
+  FILE TRANSFER PAYLOADS
+*/
+export interface FileTransferListMessage extends WebSocketMessage, FileTransferListPayload {
+  event: FileTransferEvents
+}
+
+export interface FileTransferListPayload {
+  cwd: string
+  files: FileListItem[]
+}
+
 /*
   SCREEN PAYLOADS
 */

client/src/neko/types.ts

@@ -22,3 +22,20 @@ export interface ScreenResolution {
   height: number
   rate: number
 }
+
+export interface FileListItem {
+  name: string
+  type: 'file' | 'dir'
+  size: number
+}
+
+export interface FileTransfer {
+  id: number
+  name: string
+  direction: 'upload' | 'download'
+  size: number
+  progress: number
+  status: 'pending' | 'inprogress' | 'completed' | 'failed'
+  error?: string
+  abortController?: AbortController
+}

client/src/store/client.ts

@@ -27,10 +27,6 @@ export const mutations = mutationTree(state, {
     state.side = !state.side
     set('side', state.side)
   },
-  setSide(state, side: boolean) {
-    state.side = side
-    set('side', side)
-  },
 })
 
 export const actions = actionTree({ state, getters, mutations }, {})

client/src/store/files.ts

@@ -0,0 +1,72 @@
+import { actionTree, getterTree, mutationTree } from 'typed-vuex'
+import { FileListItem, FileTransfer } from '~/neko/types'
+import { EVENT } from '~/neko/events'
+import { accessor } from '~/store'
+
+export const state = () => ({
+  cwd: '',
+  files: [] as FileListItem[],
+  transfers: [] as FileTransfer[],
+})
+
+export const getters = getterTree(state, {
+  //
+})
+
+export const mutations = mutationTree(state, {
+  _setCwd(state, cwd: string) {
+    state.cwd = cwd
+  },
+
+  _setFileList(state, files: FileListItem[]) {
+    state.files = files
+  },
+
+  _addTransfer(state, transfer: FileTransfer) {
+    state.transfers = [...state.transfers, transfer]
+  },
+
+  _removeTransfer(state, transfer: FileTransfer) {
+    state.transfers = state.transfers.filter((t) => t.id !== transfer.id)
+  },
+})
+
+export const actions = actionTree(
+  { state, getters, mutations },
+  {
+    setCwd(store, cwd: string) {
+      accessor.files._setCwd(cwd)
+    },
+
+    setFileList(store, files: FileListItem[]) {
+      accessor.files._setFileList(files)
+    },
+
+    addTransfer(store, transfer: FileTransfer) {
+      if (transfer.status !== 'pending') {
+        return
+      }
+      accessor.files._addTransfer(transfer)
+    },
+
+    removeTransfer(store, transfer: FileTransfer) {
+      accessor.files._removeTransfer(transfer)
+    },
+
+    cancelAllTransfers() {
+      for (const t of accessor.files.transfers) {
+        if (t.status !== 'completed') {
+          t.abortController?.abort()
+        }
+        accessor.files.removeTransfer(t)
+      }
+    },
+
+    refresh() {
+      if (!accessor.connected) {
+        return
+      }
+      $client.sendMessage(EVENT.FILETRANSFER.REFRESH)
+    },
+  },
+)

client/src/store/index.ts

@@ -7,6 +7,7 @@ import { get, set } from '~/utils/localstorage'
 
 import * as video from './video'
 import * as chat from './chat'
+import * as files from './files'
 import * as remote from './remote'
 import * as user from './user'
 import * as settings from './settings'
@@ -19,6 +20,7 @@ export const state = () => ({
   active: false,
   connecting: false,
   connected: false,
+  locked: {} as Record<string, boolean>,
 })
 
 export const mutations = mutationTree(state, {
@@ -31,6 +33,14 @@ export const mutations = mutationTree(state, {
     state.password = password
   },
 
+  setLocked(state, resource: string) {
+    Vue.set(state.locked, resource, true)
+  },
+
+  setUnlocked(state, resource: string) {
+    Vue.set(state.locked, resource, false)
+  },
+
   setConnnecting(state) {
     state.connected = false
     state.connecting = true
@@ -46,7 +56,9 @@ export const mutations = mutationTree(state, {
   },
 })
 
-export const getters = getterTree(state, {})
+export const getters = getterTree(state, {
+  isLocked: (state) => (resource: AdminLockResource) => resource in state.locked && state.locked[resource],
+})
 
 export const actions = actionTree(
   { state, getters, mutations },
@@ -56,6 +68,30 @@ export const actions = actionTree(
       accessor.settings.initialise()
     },
 
+    lock(_, resource: AdminLockResource) {
+      if (!accessor.connected || !accessor.user.admin) {
+        return
+      }
+
+      $client.sendMessage(EVENT.ADMIN.LOCK, { resource })
+    },
+
+    unlock(_, resource: AdminLockResource) {
+      if (!accessor.connected || !accessor.user.admin) {
+        return
+      }
+
+      $client.sendMessage(EVENT.ADMIN.UNLOCK, { resource })
+    },
+
+    toggleLock(_, resource: AdminLockResource) {
+      if (accessor.isLocked(resource)) {
+        accessor.unlock(resource)
+      } else {
+        accessor.lock(resource)
+      }
+    },
+
     login(store, { displayname, password }: { displayname: string; password: string }) {
       accessor.setLogin({ displayname, password })
       $client.login(password, displayname)
@@ -75,7 +111,7 @@ export const storePattern = {
   mutations,
   actions,
   getters,
-  modules: { video, chat, user, remote, settings, client, emoji },
+  modules: { video, chat, files, user, remote, settings, client, emoji },
 }
 
 Vue.use(Vuex)

docs/_sidebar.md

@@ -6,7 +6,6 @@
   * [Reverse Proxy](/getting-started/reverse-proxy)
   * [Configuration](/getting-started/configuration)
   * [Troubleshooting](/getting-started/troubleshooting)
-  * [Frequently Asked Questions](/getting-started/faq)
 * [Mobile Support](/mobile-support)
 * [Contributing](/contributing)
   * [Non Goals](/non-goals)

docs/changelog.md

@@ -5,19 +5,9 @@
 ### New Features
 - Added nvidia support for firefox.
 - Added `?lang=<lang>` parameter to the URL, which will set the language of the interface (by @mbattista).
-- Added `?show_side=1` and `?mute_chat=1` parameter to the URL, for chat mute and show side (by @mbattista).
-
-### Bugs
-- Fix incorrect version sorting for chromium, microsoft-edge, opera and ungoogledchromium.
-- Fix buffer overflow in Gstreamer log function [#382](https://github.com/m1k1o/neko/pull/382) (by @@tt2468).
 
 ### Misc
-- Added RTMP broadcast support to nvidia docker image [#274](https://github.com/m1k1o/neko/issues/274).
-- Ensured that paths are writable by neko user [#277](https://github.com/m1k1o/neko/issues/277).
 - Git commit and tag are now included in the build when creating a docker image.
-- Remove any temporary files associated with a Form after file upload, that would be otherwise never removed.
-- Add check for volume parameter in URL before setting volume (by @FapFapDragon).
-- Add glib main loop to capture manager [#383](https://github.com/m1k1o/neko/pull/383) (by @tt2468).
 
 ## [n.eko v2.8.0](https://github.com/m1k1o/neko/releases/tag/v2.8.0)
 

docs/contributing.md

@@ -10,7 +10,7 @@
 
 ## Server build dependencies
 
-If you want to compile Golang code locally, you must install additional dependencies in order for it to compile.
+If you want to compile goalng code locally, you must install additional dependencies in order for it to compile.
 
 ```shell
 apt-get install -y --no-install-recommends libx11-dev libxrandr-dev libxtst-dev libgstreamer1.0-dev

docs/getting-started/README.md

@@ -87,48 +87,7 @@ GHCR images are built using GitHub actions for every tag.
 ### Networking:
 - If you want to use n.eko in **external** network, you can omit `NEKO_NAT1TO1`. It will automatically get your Public IP.
 - If you want to use n.eko in **internal** network, set `NEKO_NAT1TO1` to your local IP address (e.g. `NEKO_NAT1TO1: 192.168.1.20`)-
-
-Currently, it is not supported to supply multiple NAT addresses directly to neko  (see https://github.com/m1k1o/neko/issues/47).
-
-But it can be acheived by deploying own turn server alongside neko that is accessible from your LAN:
-
-```yaml
-version: "3.4"
-services:
-  neko:
-    image: "m1k1o/neko:firefox"
-    restart: "unless-stopped"
-    shm_size: "2gb"
-    ports:
-      - "8080:8080"
-      - "52000-52100:52000-52100/udp"
-    environment:
-      NEKO_SCREEN: 1920x1080@30
-      NEKO_PASSWORD: neko
-      NEKO_PASSWORD_ADMIN: admin
-      NEKO_EPR: 52000-52100
-      NEKO_ICESERVERS: '[{ "urls": [ "turn:192.168.1.60:3478" ], "username":"neko", "credential":"neko" }, { "urls": [ "stun:stun.nextcloud.com:3478" ] }]'
-  coturn:
-    image: 'coturn/coturn:latest'
-    network_mode: "host"
-    command: |
-      -n
-      --realm=localhost
-      --fingerprint
-      --listening-ip=0.0.0.0
-      --external-ip=192.168.1.60
-      --listening-port=3478
-      --min-port=49160
-      --max-port=49200
-      --log-file=stdout
-      --user=neko:neko
-      --lt-cred-mech
-```
-
-- Replace `192.168.1.60` with your LAN IP address, and allow ports `49160-49200/udp` and `3478/tcp` in your LAN.
-- Make sure you don't use `NEKO_ICELITE: true` because ICE LITE does not support TURN servers.
-
-This setup adds local turn server to neko. It won't be reachable by your remote clients and your own IP won't be reachable from your lan. So it effectively just adds local candidate and allows connections from LAN.
+- Currently, it is not supported to supply multiple NAT addresses (see https://github.com/m1k1o/neko/issues/47).
 
 ### Why so many ports?
 - WebRTC needs UDP ports in order to transfer Audio/Video towards user and Mouse/Keyboard events to the server in real time.
@@ -217,7 +176,7 @@ NEKO_ICESERVERS: '[{"urls": ["turn:<MY-COTURN-SERVER>:443?transport=udp", "turn:
 
 ### Nvidia GPU acceleration
 
-You need to have [NVIDIA Container Toolkit](https://github.com/NVIDIA/nvidia-container-toolkit) installed, start the container with `--gpus all` flag and use images built for nvidia (see above).
+You need to have [nvidia-docker](https://github.com/NVIDIA/nvidia-docker) installed, start the container with `--gpus all` flag and use images built for nvidia (see above).
 
 ```bash
 docker run -d --gpus all \
@@ -298,8 +257,6 @@ NEKO_BROADCAST_PIPELINE: "flvmux name=mux ! rtmpsink location={url} pulsesrc dev
   - Adding `?embed=1` will hide most additional components and show only video.
   - Adding `?volume=<0-1>` will set volume to given value.
   - Adding `?lang=<language>` will set language to given value.
-  - Adding `?show_side=1` will show the sidebar on startup.
-  - Adding `?mute_chat=1` will mute the chat on startup.
   - e.g. `http(s)://<URL:Port>/?pwd=neko&usr=guest&cast=1`
 
 ### Screen size

docs/getting-started/faq.md

@@ -1,57 +0,0 @@
-# Frequently Asked Questions
-
-## How to enable debug mode?
-
-To see verbose information from n.eko server, you can enable debug mode using `NEKO_DEBUG`.
-
-```diff
-version: "3.4"
-services:
-  neko:
-    image: "m1k1o/neko:firefox"
-    restart: "unless-stopped"
-    shm_size: "2gb"
-    ports:
-      - "8080:8080"
-      - "52000-52100:52000-52100/udp"
-    environment:
-     NEKO_SCREEN: 1920x1080@30
-     NEKO_PASSWORD: neko
-     NEKO_PASSWORD_ADMIN: admin
-     NEKO_EPR: 52000-52100
-     NEKO_ICELITE: 1
-+     NEKO_DEBUG: 1
-```
-
-Ensure, that you have enabled debug mode in javascript console too, in order to see verbose information from client.
-
-## Chinese input method is not working
-
-There exists an extension for Chrome that allows you to use Chinese input method. You can install it from [here](https://chrome.google.com/webstore/detail/mclkkofklkfljcocdinagocijmpgbhab). Alternatively, you can use Google Input Tools from [here](https://www.google.com/inputtools/chrome/).
-
-## Only black screen is displayed but remote cursor is moving for Chromium-based browsers (Chrome, Edge, etc.)
-
-Check if you did not forget to add cap_add to your docker-compose file.
-
-```yaml
-    cap_add:
-      - SYS_ADMIN
-```
-
-## How can I embed the Neko desktop into web page without login prompt coming up for viewers?
-
-You can use the following URL to embed the Neko desktop into a web page without login prompt coming up for viewers:
-
-```
-http://<your-neko-server-ip>:8080/?usr=neko&pwd=neko
-```
-
-https://stackoverflow.com/questions/15276929/how-to-make-a-video-fullscreen-when-it-is-placed-inside-an-iframe
-
-Your iframe needs an attribute: `allowfullscreen="true" webkitallowfullscreen="true" mozallowfullscreen="true"` or more modern `allow="fullscreen *"`. For the second you can remove the star if your iframe has the same origin or replace it with your iframe origin.
-
-## Can I use neko without docker?
-
-It is strongly recommended to use Neko with Docker, as it is the easiest way to run it. But you should be able to install Neko "natively" on your host system. Neko is based on Debian and uses Xorg and Pulseaudio. You would just need to follow steps that are in Dockerfile, install all dependencies on your host system and then just run it.
-
-However, it is recommend to start with existing system that has GUI with desktop manager, is based on Xorg and uses Pulseaudio (e.g. Ubuntu Desktop 22.04). For that matter you only need to install gstreamer dependencies, configure pulseaudio properly and run neko binary (you don't need to build it from scratch, you can copy it from docker image).

docs/getting-started/troubleshooting.md

@@ -94,7 +94,7 @@ services:
 +     NEKO_IPFETCH: https://ifconfig.co/ip
 ```
 
-Or you can specify your IP address manually using `NEKO_NAT1TO1`: (It's read as NAT 1 to 1, so it's capital letter 'O', not zero '0', in NAT1`TO`1)
+Or you can specify your IP address manually using `NEKO_NAT1TO1`:
 
 ```diff
 version: "3.4"
@@ -129,7 +129,6 @@ Example for pfsense with truecharts docker container:
 - Test externally to confirm it works.
 - Internally you have to access it using `<your-public-ip>:port`
 
-If your router does not support NAT Loopback (NAT Hairpinning), you can use turn servers to overcome this issue. See [more details here](https://neko.m1k1o.net/#/getting-started/?id=networking) on how to setup local coturn instance.
 
 ### Neko works locally, but not externally
 

server/internal/capture/gst/gst.c

@@ -3,8 +3,8 @@
 static void gstreamer_pipeline_log(GstPipelineCtx *ctx, char* level, const char* format, ...) {
   va_list argptr;
   va_start(argptr, format);
-  char buffer[4096];
-  vsnprintf(buffer, sizeof(buffer), format, argptr);
+  char buffer[100];
+  vsprintf(buffer, format, argptr);
   va_end(argptr);
   goPipelineLog(level, buffer, ctx->pipelineId);
 }

server/internal/capture/gst/gst.go

@@ -31,29 +31,12 @@ var pSerial int32
 var pipelines = make(map[int]*Pipeline)
 var pipelinesLock sync.Mutex
 var registry *C.GstRegistry
-var gMainLoop *C.GMainLoop
 
 func init() {
 	C.gst_init(nil, nil)
 	registry = C.gst_registry_get()
 }
 
-func RunMainLoop() {
-	if gMainLoop != nil {
-		return
-	}
-	gMainLoop = C.g_main_loop_new(nil, C.int(0))
-	C.g_main_loop_run(gMainLoop)
-}
-
-func QuitMainLoop() {
-	if gMainLoop == nil {
-		return
-	}
-	C.g_main_loop_quit(gMainLoop)
-	gMainLoop = nil
-}
-
 func CreatePipeline(pipelineStr string) (*Pipeline, error) {
 	id := atomic.AddInt32(&pSerial, 1)
 

server/internal/capture/manager.go

@@ -6,7 +6,6 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 
-	"m1k1o/neko/internal/capture/gst"
 	"m1k1o/neko/internal/config"
 	"m1k1o/neko/internal/types"
 )
@@ -54,7 +53,6 @@ func (manager *CaptureManagerCtx) Start() {
 		}
 	}
 
-	go gst.RunMainLoop()
 	go func() {
 		for {
 			before, ok := <-manager.desktop.GetScreenSizeChangeChannel()
@@ -102,8 +100,6 @@ func (manager *CaptureManagerCtx) Shutdown() error {
 	manager.audio.shutdown()
 	manager.video.shutdown()
 
-	gst.QuitMainLoop()
-
 	return nil
 }
 

server/internal/config/server.go

@@ -14,7 +14,6 @@ type Server struct {
 	Cert       string
 	Key        string
 	Bind       string
-	Proxy      bool
 	Static     string
 	PathPrefix string
 	CORS       []string
@@ -36,11 +35,6 @@ func (Server) Init(cmd *cobra.Command) error {
 		return err
 	}
 
-	cmd.PersistentFlags().Bool("proxy", false, "enable reverse proxy mode")
-	if err := viper.BindPFlag("proxy", cmd.PersistentFlags().Lookup("proxy")); err != nil {
-		return err
-	}
-
 	cmd.PersistentFlags().String("static", "./www", "path to neko client files to serve")
 	if err := viper.BindPFlag("static", cmd.PersistentFlags().Lookup("static")); err != nil {
 		return err
@@ -63,7 +57,6 @@ func (s *Server) Set() {
 	s.Cert = viper.GetString("cert")
 	s.Key = viper.GetString("key")
 	s.Bind = viper.GetString("bind")
-	s.Proxy = viper.GetBool("proxy")
 	s.Static = viper.GetString("static")
 	s.PathPrefix = path.Join("/", path.Clean(viper.GetString("path_prefix")))
 

server/internal/config/websocket.go

@@ -1,6 +1,8 @@
 package config
 
 import (
+	"path/filepath"
+
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -8,6 +10,13 @@ import (
 type WebSocket struct {
 	Password      string
 	AdminPassword string
+	Proxy         bool
+	Locks         []string
+
+	ControlProtection bool
+
+	FileTransferEnabled bool
+	FileTransferPath    string
 }
 
 func (WebSocket) Init(cmd *cobra.Command) error {
@@ -21,10 +30,45 @@ func (WebSocket) Init(cmd *cobra.Command) error {
 		return err
 	}
 
+	cmd.PersistentFlags().Bool("proxy", false, "enable reverse proxy mode")
+	if err := viper.BindPFlag("proxy", cmd.PersistentFlags().Lookup("proxy")); err != nil {
+		return err
+	}
+
+	cmd.PersistentFlags().StringSlice("locks", []string{}, "resources, that will be locked when starting (control, login)")
+	if err := viper.BindPFlag("locks", cmd.PersistentFlags().Lookup("locks")); err != nil {
+		return err
+	}
+
+	cmd.PersistentFlags().Bool("control_protection", false, "control protection means, users can gain control only if at least one admin is in the room")
+	if err := viper.BindPFlag("control_protection", cmd.PersistentFlags().Lookup("control_protection")); err != nil {
+		return err
+	}
+
+	// File transfer
+
+	cmd.PersistentFlags().Bool("file_transfer_enabled", false, "enable file transfer feature")
+	if err := viper.BindPFlag("file_transfer_enabled", cmd.PersistentFlags().Lookup("file_transfer_enabled")); err != nil {
+		return err
+	}
+
+	cmd.PersistentFlags().String("file_transfer_path", "/home/neko/Downloads", "path to use for file transfer")
+	if err := viper.BindPFlag("file_transfer_path", cmd.PersistentFlags().Lookup("file_transfer_path")); err != nil {
+		return err
+	}
+
 	return nil
 }
 
 func (s *WebSocket) Set() {
 	s.Password = viper.GetString("password")
 	s.AdminPassword = viper.GetString("password_admin")
+	s.Proxy = viper.GetBool("proxy")
+	s.Locks = viper.GetStringSlice("locks")
+
+	s.ControlProtection = viper.GetBool("control_protection")
+
+	s.FileTransferEnabled = viper.GetBool("file_transfer_enabled")
+	s.FileTransferPath = viper.GetString("file_transfer_path")
+	s.FileTransferPath = filepath.Clean(s.FileTransferPath)
 }

server/internal/http/http.go

@@ -3,9 +3,12 @@ package http
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"image/jpeg"
+	"io"
 	"net/http"
 	"os"
+	"regexp"
 	"strconv"
 
 	"github.com/go-chi/chi/v5"
@@ -18,6 +21,8 @@ import (
 	"m1k1o/neko/internal/types"
 )
 
+const FILE_UPLOAD_BUF_SIZE = 65000
+
 type Server struct {
 	logger zerolog.Logger
 	router *chi.Mux
@@ -30,9 +35,6 @@ func New(conf *config.Server, webSocketHandler types.WebSocketHandler, desktop t
 
 	router := chi.NewRouter()
 	router.Use(middleware.RequestID) // Create a request ID for each request
-	if conf.Proxy {
-		router.Use(middleware.RealIP)
-	}
 	router.Use(middleware.RequestLogger(&logformatter{logger}))
 	router.Use(middleware.Recoverer) // Recover from panics without crashing server
 	router.Use(middleware.Compress(5, "application/octet-stream"))
@@ -93,6 +95,11 @@ func New(conf *config.Server, webSocketHandler types.WebSocketHandler, desktop t
 			return
 		}
 
+		if webSocketHandler.IsLocked("login") {
+			http.Error(w, "room is locked", http.StatusLocked)
+			return
+		}
+
 		quality, err := strconv.Atoi(r.URL.Query().Get("quality"))
 		if err != nil {
 			quality = 90
@@ -108,6 +115,78 @@ func New(conf *config.Server, webSocketHandler types.WebSocketHandler, desktop t
 		}
 	})
 
+	// allow downloading and uploading files
+	if webSocketHandler.FileTransferEnabled() {
+		router.Get("/file", func(w http.ResponseWriter, r *http.Request) {
+			password := r.URL.Query().Get("pwd")
+			isAuthorized, err := webSocketHandler.CanTransferFiles(password)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusForbidden)
+				return
+			}
+
+			if !isAuthorized {
+				http.Error(w, "bad authorization", http.StatusUnauthorized)
+				return
+			}
+
+			filename := r.URL.Query().Get("filename")
+			badChars, _ := regexp.MatchString(`(?m)\.\.(?:\/|$)`, filename)
+			if filename == "" || badChars {
+				http.Error(w, "bad filename", http.StatusBadRequest)
+				return
+			}
+
+			filePath := webSocketHandler.FileTransferPath(filename)
+			f, err := os.Open(filePath)
+			if err != nil {
+				http.Error(w, "not found or unable to open", http.StatusNotFound)
+				return
+			}
+			defer f.Close()
+
+			w.Header().Set("Content-Type", "application/octet-stream")
+			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
+			io.Copy(w, f)
+		})
+
+		router.Post("/file", func(w http.ResponseWriter, r *http.Request) {
+			password := r.URL.Query().Get("pwd")
+			isAuthorized, err := webSocketHandler.CanTransferFiles(password)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusForbidden)
+				return
+			}
+
+			if !isAuthorized {
+				http.Error(w, "bad authorization", http.StatusUnauthorized)
+				return
+			}
+
+			r.ParseMultipartForm(32 << 20)
+			for _, formheader := range r.MultipartForm.File["files"] {
+				filePath := webSocketHandler.FileTransferPath(formheader.Filename)
+
+				formfile, err := formheader.Open()
+				if err != nil {
+					logger.Warn().Err(err).Msg("failed to open formdata file")
+					http.Error(w, "error writing file", http.StatusInternalServerError)
+					return
+				}
+				defer formfile.Close()
+
+				f, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE, 0644)
+				if err != nil {
+					http.Error(w, "unable to open file for writing", http.StatusInternalServerError)
+					return
+				}
+				defer f.Close()
+
+				io.Copy(f, formfile)
+			}
+		})
+	}
+
 	router.Get("/health", func(w http.ResponseWriter, r *http.Request) {
 		_, _ = w.Write([]byte("true"))
 	})

server/internal/session/manager.go

@@ -28,6 +28,8 @@ type SessionManager struct {
 	capture       types.CaptureManager
 	members       map[string]*Session
 	eventsChannel chan types.SessionEvent
+	// TODO: Handle locks in sessions as flags.
+	controlLocked bool
 }
 
 func (manager *SessionManager) New(id string, admin bool, socket types.WebSocket) types.Session {
@@ -116,6 +118,16 @@ func (manager *SessionManager) Get(id string) (types.Session, bool) {
 	return session, ok
 }
 
+// TODO: Handle locks in sessions as flags.
+func (manager *SessionManager) SetControlLocked(locked bool) {
+	manager.controlLocked = locked
+}
+
+func (manager *SessionManager) CanControl(id string) bool {
+	session, ok := manager.Get(id)
+	return ok && (!manager.controlLocked || session.Admin())
+}
+
 func (manager *SessionManager) Admins() []*types.Member {
 	manager.mu.Lock()
 	defer manager.mu.Unlock()

server/internal/types/event/events.go

@@ -34,6 +34,11 @@ const (
 	CHAT_EMOTE   = "chat/emote"
 )
 
+const (
+	FILETRANSFER_LIST    = "filetransfer/list"
+	FILETRANSFER_REFRESH = "filetransfer/refresh"
+)
+
 const (
 	SCREEN_CONFIGURATIONS = "screen/configurations"
 	SCREEN_RESOLUTION     = "screen/resolution"
@@ -49,7 +54,9 @@ const (
 const (
 	ADMIN_BAN     = "admin/ban"
 	ADMIN_KICK    = "admin/kick"
+	ADMIN_LOCK    = "admin/lock"
 	ADMIN_MUTE    = "admin/mute"
+	ADMIN_UNLOCK  = "admin/unlock"
 	ADMIN_UNMUTE  = "admin/unmute"
 	ADMIN_CONTROL = "admin/control"
 	ADMIN_RELEASE = "admin/release"

server/internal/types/message/messages.go

@@ -11,8 +11,10 @@ type Message struct {
 }
 
 type SystemInit struct {
-	Event           string `json:"event"`
-	ImplicitHosting bool   `json:"implicit_hosting"`
+	Event           string            `json:"event"`
+	ImplicitHosting bool              `json:"implicit_hosting"`
+	Locks           map[string]string `json:"locks"`
+	FileTransfer    bool              `json:"file_transfer"`
 }
 
 type SystemMessage struct {
@@ -105,6 +107,12 @@ type EmoteSend struct {
 	Emote string `json:"emote"`
 }
 
+type FileTransferList struct {
+	Event string               `json:"event"`
+	Cwd   string               `json:"cwd"`
+	Files []types.FileListItem `json:"files"`
+}
+
 type Admin struct {
 	Event string `json:"event"`
 	ID    string `json:"id"`

server/internal/types/session.go

@@ -55,6 +55,8 @@ type SessionManager interface {
 	ClearHost()
 	Has(id string) bool
 	Get(id string) (Session, bool)
+	SetControlLocked(locked bool)
+	CanControl(id string) bool
 	Members() []*Member
 	Admins() []*Member
 	Destroy(id string)

server/internal/types/websocket.go

@@ -11,12 +11,14 @@ type Stats struct {
 	Members     []*Member `json:"members"`
 
 	Banned map[string]string `json:"banned"` // IP -> session ID (that banned it)
+	Locked map[string]string `json:"locked"` // resource name -> session ID (that locked it)
 
 	ServerStartedAt time.Time  `json:"server_started_at"`
 	LastAdminLeftAt *time.Time `json:"last_admin_left_at"`
 	LastUserLeftAt  *time.Time `json:"last_user_left_at"`
 
-	ImplicitControl bool `json:"implicit_control"`
+	ControlProtection bool `json:"control_protection"`
+	ImplicitControl   bool `json:"implicit_control"`
 }
 
 type WebSocket interface {
@@ -30,5 +32,17 @@ type WebSocketHandler interface {
 	Shutdown() error
 	Upgrade(w http.ResponseWriter, r *http.Request) error
 	Stats() Stats
+	IsLocked(resource string) bool
 	IsAdmin(password string) (bool, error)
+
+	// File Transfer
+	CanTransferFiles(password string) (bool, error)
+	FileTransferPath(filename string) string
+	FileTransferEnabled() bool
+}
+
+type FileListItem struct {
+	Filename string `json:"name"`
+	Type     string `json:"type"`
+	Size     int64  `json:"size"`
 }

server/internal/utils/files.go

@@ -0,0 +1,36 @@
+package utils
+
+import (
+	"os"
+
+	"m1k1o/neko/internal/types"
+)
+
+func ListFiles(path string) ([]types.FileListItem, error) {
+	items, err := os.ReadDir(path)
+	if err != nil {
+		return nil, err
+	}
+
+	out := make([]types.FileListItem, len(items))
+	for i, item := range items {
+		var itemType string = ""
+		var size int64 = 0
+		if item.IsDir() {
+			itemType = "dir"
+		} else {
+			itemType = "file"
+			info, err := item.Info()
+			if err == nil {
+				size = info.Size()
+			}
+		}
+		out[i] = types.FileListItem{
+			Filename: item.Name(),
+			Type:     itemType,
+			Size:     size,
+		}
+	}
+
+	return out, nil
+}

server/internal/utils/ip.go

@@ -38,3 +38,14 @@ func GetIP(serverUrl string) (string, error) {
 
 	return string(bytes.TrimSpace(buf)), nil
 }
+
+func GetHttpRequestIP(r *http.Request, proxy bool) string {
+	IPAddress := r.Header.Get("X-Real-Ip")
+	if IPAddress == "" {
+		IPAddress = r.Header.Get("X-Forwarded-For")
+	}
+	if IPAddress == "" || !proxy {
+		IPAddress = r.RemoteAddr
+	}
+	return IPAddress
+}

server/internal/webrtc/handle.go

@@ -39,7 +39,7 @@ type PayloadKey struct {
 }
 
 func (manager *WebRTCManager) handle(id string, msg webrtc.DataChannelMessage) error {
-	if (!manager.config.ImplicitControl && !manager.sessions.IsHost(id)) || manager.config.ImplicitControl {
+	if (!manager.config.ImplicitControl && !manager.sessions.IsHost(id)) || (manager.config.ImplicitControl && !manager.sessions.CanControl(id)) {
 		return nil
 	}
 

server/internal/websocket/handler/admin.go

@@ -8,6 +8,78 @@ import (
 	"m1k1o/neko/internal/types/message"
 )
 
+func (h *MessageHandler) adminLock(id string, session types.Session, payload *message.AdminLock) error {
+	if !session.Admin() {
+		h.logger.Debug().Msg("user not admin")
+		return nil
+	}
+
+	if h.state.IsLocked(payload.Resource) {
+		h.logger.Debug().Str("resource", payload.Resource).Msg("resource already locked...")
+		return nil
+	}
+
+	// allow only known resources
+	switch payload.Resource {
+	case "login":
+	case "control":
+	case "file_transfer":
+	default:
+		h.logger.Debug().Msg("unknown lock resource")
+		return nil
+	}
+
+	// TODO: Handle locks in sessions as flags.
+	if payload.Resource == "control" {
+		h.sessions.SetControlLocked(true)
+	}
+
+	h.state.Lock(payload.Resource, id)
+
+	if err := h.sessions.Broadcast(
+		message.AdminLock{
+			Event:    event.ADMIN_LOCK,
+			ID:       id,
+			Resource: payload.Resource,
+		}, nil); err != nil {
+		h.logger.Warn().Err(err).Msgf("broadcasting event %s has failed", event.ADMIN_LOCK)
+		return err
+	}
+
+	return nil
+}
+
+func (h *MessageHandler) adminUnlock(id string, session types.Session, payload *message.AdminLock) error {
+	if !session.Admin() {
+		h.logger.Debug().Msg("user not admin")
+		return nil
+	}
+
+	if !h.state.IsLocked(payload.Resource) {
+		h.logger.Debug().Str("resource", payload.Resource).Msg("resource not locked...")
+		return nil
+	}
+
+	// TODO: Handle locks in sessions as flags.
+	if payload.Resource == "control" {
+		h.sessions.SetControlLocked(false)
+	}
+
+	h.state.Unlock(payload.Resource)
+
+	if err := h.sessions.Broadcast(
+		message.AdminLock{
+			Event:    event.ADMIN_UNLOCK,
+			ID:       id,
+			Resource: payload.Resource,
+		}, nil); err != nil {
+		h.logger.Warn().Err(err).Msgf("broadcasting event %s has failed", event.ADMIN_UNLOCK)
+		return err
+	}
+
+	return nil
+}
+
 func (h *MessageHandler) adminControl(id string, session types.Session) error {
 	if !session.Admin() {
 		h.logger.Debug().Msg("user not admin")

server/internal/websocket/handler/control.go

@@ -33,6 +33,12 @@ func (h *MessageHandler) controlRelease(id string, session types.Session) error
 func (h *MessageHandler) controlRequest(id string, session types.Session) error {
 	// check for host
 	if !h.sessions.HasHost() {
+		// check if control is locked or user is admin
+		if h.state.IsLocked("control") && !session.Admin() {
+			h.logger.Debug().Msg("control is locked")
+			return nil
+		}
+
 		// set host
 		err := h.sessions.SetHost(id)
 		if err != nil {
@@ -90,6 +96,12 @@ func (h *MessageHandler) controlGive(id string, session types.Session, payload *
 		return nil
 	}
 
+	// check if control is locked or giver is admin
+	if h.state.IsLocked("control") && !session.Admin() {
+		h.logger.Debug().Msg("control is locked")
+		return nil
+	}
+
 	// set host
 	err := h.sessions.SetHost(payload.ID)
 	if err != nil {
@@ -112,7 +124,7 @@ func (h *MessageHandler) controlGive(id string, session types.Session, payload *
 
 func (h *MessageHandler) controlClipboard(id string, session types.Session, payload *message.Clipboard) error {
 	// check if session can access clipboard
-	if (!h.webrtc.ImplicitControl() && !h.sessions.IsHost(id)) || h.webrtc.ImplicitControl() {
+	if (!h.webrtc.ImplicitControl() && !h.sessions.IsHost(id)) || (h.webrtc.ImplicitControl() && !h.sessions.CanControl(id)) {
 		h.logger.Debug().Str("id", id).Msg("cannot access clipboard")
 		return nil
 	}
@@ -123,7 +135,7 @@ func (h *MessageHandler) controlClipboard(id string, session types.Session, payl
 
 func (h *MessageHandler) controlKeyboard(id string, session types.Session, payload *message.Keyboard) error {
 	// check if session can control keyboard
-	if (!h.webrtc.ImplicitControl() && !h.sessions.IsHost(id)) || h.webrtc.ImplicitControl() {
+	if (!h.webrtc.ImplicitControl() && !h.sessions.IsHost(id)) || (h.webrtc.ImplicitControl() && !h.sessions.CanControl(id)) {
 		h.logger.Debug().Str("id", id).Msg("cannot control keyboard")
 		return nil
 	}

server/internal/websocket/handler/filetransfer.go

@@ -0,0 +1,47 @@
+package handler
+
+import (
+	"m1k1o/neko/internal/types"
+	"m1k1o/neko/internal/types/event"
+	"m1k1o/neko/internal/types/message"
+	"m1k1o/neko/internal/utils"
+)
+
+func (h *MessageHandler) FileTransferRefresh(session types.Session) error {
+	if !h.state.FileTransferEnabled() {
+		return nil
+	}
+
+	fileTransferPath := h.state.FileTransferPath("") // root
+
+	// allow users only if file transfer is not locked
+	if session != nil && !(session.Admin() || !h.state.IsLocked("file_transfer")) {
+		h.logger.Debug().Msg("file transfer is locked for users")
+		return nil
+	}
+
+	// TODO: keep list of files in memory and update it on file changes
+	files, err := utils.ListFiles(fileTransferPath)
+	if err != nil {
+		return err
+	}
+
+	message := message.FileTransferList{
+		Event: event.FILETRANSFER_LIST,
+		Cwd:   fileTransferPath,
+		Files: files,
+	}
+
+	// send to just one user
+	if session != nil {
+		return session.Send(message)
+	}
+
+	// broadcast to all admins
+	if h.state.IsLocked("file_transfer") {
+		return h.sessions.AdminBroadcast(message, nil)
+	}
+
+	// broadcast to all users
+	return h.sessions.Broadcast(message, nil)
+}

server/internal/websocket/handler/handler.go

@@ -50,6 +50,11 @@ func (h *MessageHandler) Connected(admin bool, address string) (bool, string) {
 		}
 	}
 
+	if h.state.IsLocked("login") && !admin {
+		h.logger.Debug().Msg("server locked")
+		return false, "locked"
+	}
+
 	return true, ""
 }
 
@@ -127,6 +132,10 @@ func (h *MessageHandler) Message(id string, raw []byte) error {
 				return h.chatEmote(id, session, payload)
 			}), "%s failed", header.Event)
 
+	// File Transfer Events
+	case event.FILETRANSFER_REFRESH:
+		return errors.Wrapf(h.FileTransferRefresh(session), "%s failed", header.Event)
+
 	// Screen Events
 	case event.SCREEN_RESOLUTION:
 		return errors.Wrapf(h.screenResolution(id, session), "%s failed", header.Event)
@@ -150,6 +159,18 @@ func (h *MessageHandler) Message(id string, raw []byte) error {
 		return errors.Wrapf(h.boradcastDestroy(session), "%s failed", header.Event)
 
 	// Admin Events
+	case event.ADMIN_LOCK:
+		payload := &message.AdminLock{}
+		return errors.Wrapf(
+			utils.Unmarshal(payload, raw, func() error {
+				return h.adminLock(id, session, payload)
+			}), "%s failed", header.Event)
+	case event.ADMIN_UNLOCK:
+		payload := &message.AdminLock{}
+		return errors.Wrapf(
+			utils.Unmarshal(payload, raw, func() error {
+				return h.adminUnlock(id, session, payload)
+			}), "%s failed", header.Event)
 	case event.ADMIN_CONTROL:
 		return errors.Wrapf(h.adminControl(id, session), "%s failed", header.Event)
 	case event.ADMIN_RELEASE:

server/internal/websocket/handler/session.go

@@ -16,6 +16,8 @@ func (h *MessageHandler) SessionCreated(id string, session types.Session) error
 	if err := session.Send(message.SystemInit{
 		Event:           event.SYSTEM_INIT,
 		ImplicitHosting: h.webrtc.ImplicitControl(),
+		Locks:           h.state.AllLocked(),
+		FileTransfer:    h.state.FileTransferEnabled(),
 	}); err != nil {
 		h.logger.Warn().Str("id", id).Err(err).Msgf("sending event %s has failed", event.SYSTEM_INIT)
 		return err
@@ -33,6 +35,13 @@ func (h *MessageHandler) SessionCreated(id string, session types.Session) error
 		}
 	}
 
+	// send file list if file transfer is enabled
+	if h.state.FileTransferEnabled() && (session.Admin() || !h.state.IsLocked("file_transfer")) {
+		if err := h.FileTransferRefresh(session); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 

server/internal/websocket/state/state.go

@@ -1,14 +1,22 @@
 package state
 
+import "path/filepath"
+
 type State struct {
 	banned map[string]string // IP -> session ID (that banned it)
 	locked map[string]string // resource name -> session ID (that locked it)
+
+	fileTransferEnabled bool
+	fileTransferPath    string // path where files are located
 }
 
-func New() *State {
+func New(fileTransferEnabled bool, fileTransferPath string) *State {
 	return &State{
 		banned: make(map[string]string),
 		locked: make(map[string]string),
+
+		fileTransferEnabled: fileTransferEnabled,
+		fileTransferPath:    fileTransferPath,
 	}
 }
 
@@ -35,3 +43,42 @@ func (s *State) GetBanned(ip string) (string, bool) {
 func (s *State) AllBanned() map[string]string {
 	return s.banned
 }
+
+// Lock
+
+func (s *State) Lock(resource, id string) {
+	s.locked[resource] = id
+}
+
+func (s *State) Unlock(resource string) {
+	delete(s.locked, resource)
+}
+
+func (s *State) IsLocked(resource string) bool {
+	_, ok := s.locked[resource]
+	return ok
+}
+
+func (s *State) GetLocked(resource string) (string, bool) {
+	id, ok := s.locked[resource]
+	return id, ok
+}
+
+func (s *State) AllLocked() map[string]string {
+	return s.locked
+}
+
+// File transfer
+
+func (s *State) FileTransferPath(filename string) string {
+	if filename == "" {
+		return s.fileTransferPath
+	}
+
+	cleanPath := filepath.Clean(filename)
+	return filepath.Join(s.fileTransferPath, cleanPath)
+}
+
+func (s *State) FileTransferEnabled() bool {
+	return s.fileTransferEnabled
+}

server/internal/websocket/websocket.go

@@ -3,10 +3,12 @@ package websocket
 import (
 	"fmt"
 	"net/http"
+	"os"
 	"sync"
 	"sync/atomic"
 	"time"
 
+	"github.com/fsnotify/fsnotify"
 	"github.com/gorilla/websocket"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
@@ -20,10 +22,35 @@ import (
 	"m1k1o/neko/internal/websocket/state"
 )
 
+const CONTROL_PROTECTION_SESSION = "by_control_protection"
+
 func New(sessions types.SessionManager, desktop types.DesktopManager, capture types.CaptureManager, webrtc types.WebRTCManager, conf *config.WebSocket) *WebSocketHandler {
 	logger := log.With().Str("module", "websocket").Logger()
 
-	state := state.New()
+	state := state.New(conf.FileTransferEnabled, conf.FileTransferPath)
+
+	// if control protection is enabled
+	if conf.ControlProtection {
+		state.Lock("control", CONTROL_PROTECTION_SESSION)
+		logger.Info().Msgf("control locked on behalf of control protection")
+	}
+
+	// create file transfer directory if not exists
+	if conf.FileTransferEnabled {
+		if _, err := os.Stat(conf.FileTransferPath); os.IsNotExist(err) {
+			err = os.Mkdir(conf.FileTransferPath, os.ModePerm)
+			logger.Err(err).Msg("creating file transfer directory")
+		}
+	}
+
+	// apply default locks
+	for _, lock := range conf.Locks {
+		state.Lock(lock, "") // empty session ID
+	}
+
+	if len(conf.Locks) > 0 {
+		logger.Info().Msgf("locked resources: %+v", conf.Locks)
+	}
 
 	handler := handler.New(
 		sessions,
@@ -96,6 +123,24 @@ func (ws *WebSocketHandler) Start() {
 					ws.logger.Debug().Str("id", e.Id).Msg("session connected")
 				}
 
+				// if control protection is enabled and at least one admin
+				// and if room was locked on behalf control protection, unlock
+				sess, ok := ws.state.GetLocked("control")
+				if ok && ws.conf.ControlProtection && sess == CONTROL_PROTECTION_SESSION && len(ws.sessions.Admins()) > 0 {
+					ws.state.Unlock("control")
+					ws.sessions.SetControlLocked(false) // TODO: Handle locks in sessions as flags.
+					ws.logger.Info().Msgf("control unlocked on behalf of control protection")
+
+					if err := ws.sessions.Broadcast(
+						message.AdminLock{
+							Event:    event.ADMIN_UNLOCK,
+							ID:       e.Id,
+							Resource: "control",
+						}, nil); err != nil {
+						ws.logger.Warn().Err(err).Msgf("broadcasting event %s has failed", event.ADMIN_UNLOCK)
+					}
+				}
+
 				// remove outdated stats
 				if e.Session.Admin() {
 					ws.lastAdminLeftAt = nil
@@ -112,6 +157,25 @@ func (ws *WebSocketHandler) Start() {
 				membersCount := len(ws.sessions.Members())
 				adminCount := len(ws.sessions.Admins())
 
+				// if control protection is enabled and no admin
+				// and room is not locked, lock
+				ok := ws.state.IsLocked("control")
+				if !ok && ws.conf.ControlProtection && adminCount == 0 {
+					ws.state.Lock("control", CONTROL_PROTECTION_SESSION)
+					ws.sessions.SetControlLocked(true) // TODO: Handle locks in sessions as flags.
+					ws.logger.Info().Msgf("control locked and released on behalf of control protection")
+					ws.handler.AdminRelease(e.Id, e.Session)
+
+					if err := ws.sessions.Broadcast(
+						message.AdminLock{
+							Event:    event.ADMIN_LOCK,
+							ID:       e.Id,
+							Resource: "control",
+						}, nil); err != nil {
+						ws.logger.Warn().Err(err).Msgf("broadcasting event %s has failed", event.ADMIN_LOCK)
+					}
+				}
+
 				// if this was the last admin
 				if e.Session.Admin() && adminCount == 0 {
 					now := time.Now()
@@ -152,6 +216,37 @@ func (ws *WebSocketHandler) Start() {
 			ws.logger.Err(err).Msg("sync clipboard")
 		}
 	}()
+
+	// watch for file changes and send file list if file transfer is enabled
+	if ws.conf.FileTransferEnabled {
+		watcher, err := fsnotify.NewWatcher()
+		if err != nil {
+			ws.logger.Err(err).Msg("unable to start file transfer dir watcher")
+			return
+		}
+
+		go func() {
+			for {
+				select {
+				case e, ok := <-watcher.Events:
+					if !ok {
+						ws.logger.Info().Msg("file transfer dir watcher closed")
+						return
+					}
+					if e.Has(fsnotify.Create) || e.Has(fsnotify.Remove) || e.Has(fsnotify.Rename) {
+						ws.logger.Debug().Str("event", e.String()).Msg("file transfer dir watcher event")
+						ws.handler.FileTransferRefresh(nil)
+					}
+				case err := <-watcher.Errors:
+					ws.logger.Err(err).Msg("error in file transfer dir watcher")
+				}
+			}
+		}()
+
+		if err := watcher.Add(ws.conf.FileTransferPath); err != nil {
+			ws.logger.Err(err).Msg("unable to add file transfer path to watcher")
+		}
+	}
 }
 
 func (ws *WebSocketHandler) Shutdown() error {
@@ -195,7 +290,7 @@ func (ws *WebSocketHandler) Upgrade(w http.ResponseWriter, r *http.Request) erro
 	socket := &WebSocket{
 		id:         id,
 		ws:         ws,
-		address:    r.RemoteAddr,
+		address:    utils.GetHttpRequestIP(r, ws.conf.Proxy),
 		connection: connection,
 	}
 
@@ -252,15 +347,21 @@ func (ws *WebSocketHandler) Stats() types.Stats {
 		Members:     ws.sessions.Members(),
 
 		Banned: ws.state.AllBanned(),
+		Locked: ws.state.AllLocked(),
 
 		ServerStartedAt: ws.serverStartedAt,
 		LastAdminLeftAt: ws.lastAdminLeftAt,
 		LastUserLeftAt:  ws.lastUserLeftAt,
 
-		ImplicitControl: ws.webrtc.ImplicitControl(),
+		ControlProtection: ws.conf.ControlProtection,
+		ImplicitControl:   ws.webrtc.ImplicitControl(),
 	}
 }
 
+func (ws *WebSocketHandler) IsLocked(resource string) bool {
+	return ws.state.IsLocked(resource)
+}
+
 func (ws *WebSocketHandler) IsAdmin(password string) (bool, error) {
 	if password == ws.conf.AdminPassword {
 		return true, nil
@@ -343,3 +444,28 @@ func (ws *WebSocketHandler) handle(connection *websocket.Conn, id string) {
 		}
 	}
 }
+
+//
+// File transfer
+//
+
+func (ws *WebSocketHandler) CanTransferFiles(password string) (bool, error) {
+	if !ws.conf.FileTransferEnabled {
+		return false, nil
+	}
+
+	isAdmin, err := ws.IsAdmin(password)
+	if err != nil {
+		return false, err
+	}
+
+	return isAdmin || !ws.state.IsLocked("file_transfer"), nil
+}
+
+func (ws *WebSocketHandler) FileTransferPath(filename string) string {
+	return ws.state.FileTransferPath(filename)
+}
+
+func (ws *WebSocketHandler) FileTransferEnabled() bool {
+	return ws.conf.FileTransferEnabled
+}

test/docker-compose.yaml

@@ -0,0 +1,64 @@
+version: "3.4"
+
+volumes:
+  X11-unix:
+
+services:
+  xserver:
+    build: "./xserver"
+    restart: "unless-stopped"
+    user: "1000:1000"
+    command: ":0.0"
+    volumes:
+      - "X11-unix:/tmp/.X11-unix:rw"
+
+  pulseaudio:
+    build: "./pulseaudio"
+    restart: "unless-stopped"
+
+  neko:
+    build:
+      context: "../"
+      dockerfile: "test/neko/Dockerfile"
+    restart: "unless-stopped"
+    shm_size: "2gb"
+    ports:
+      - "8081:8080"
+      - "52000-52100:52000-52100/udp"
+    environment:
+      DISPLAY: ":0.0"
+      NEKO_DISPLAY: ":0.0 remote=true"
+      PULSE_SERVER: tcp:pulseaudio:4713
+      NEKO_SCREEN: 1920x1080@30
+      NEKO_PASSWORD: neko
+      NEKO_PASSWORD_ADMIN: admin
+      NEKO_EPR: 52000-52100
+      NEKO_NAT1TO1: 192.168.1.38
+      NEKO_ICELITE: 1
+    volumes:
+      - "X11-unix:/tmp/.X11-unix:ro"
+    depends_on:
+      - xserver
+      - pulseaudio
+
+  openbox:
+    build: "./openbox"
+    restart: "unless-stopped"
+    environment:
+      DISPLAY: ":0.0"
+    volumes:
+      - "X11-unix:/tmp/.X11-unix:ro"
+    depends_on:
+      - xserver
+    
+  firefox:
+    build: "./firefox"
+    restart: "unless-stopped"
+    environment:
+      DISPLAY: ":0.0"
+      PULSE_SERVER: tcp:pulseaudio:4713
+    volumes:
+      - "X11-unix:/tmp/.X11-unix:ro"
+    depends_on:
+      - neko
+      - openbox

test/firefox/Dockerfile

@@ -0,0 +1,32 @@
+FROM m1k1o/neko:base
+
+#
+# install firefox
+RUN set -eux; apt-get update; \
+    apt-get install -y --no-install-recommends firefox-esr; \
+    #
+    # create a non-root user
+    #groupadd --gid 1000 neko; \
+    #useradd --uid 1000 --gid neko --shell /bin/bash --create-home neko; \
+    #
+    # install fonts
+    apt-get install -y --no-install-recommends \
+        # Google emojis
+        fonts-noto-color-emoji \
+        # Japanese fonts
+        fonts-takao-mincho \
+        # Chinese fonts
+        fonts-wqy-zenhei xfonts-intl-chinese xfonts-wqy \
+        # Korean fonts
+        fonts-wqy-microhei; \
+    #
+    # clean up
+    apt-get --purge autoremove -y xz-utils bzip2; \
+    apt-get clean -y; \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+USER neko
+
+ENTRYPOINT [ "/usr/bin/firefox" ]
+
+CMD [ "--display", $DISPLAY, "-setDefaultBrowser", "-width", "1280", "-height", "720" ]

test/neko/Dockerfile

@@ -0,0 +1,102 @@
+#
+# STAGE 1: SERVER
+#
+FROM golang:1.20-bullseye as server
+WORKDIR /src
+
+#
+# install dependencies
+RUN set -eux; apt-get update; \
+    apt-get install -y --no-install-recommends git cmake make libx11-dev libxrandr-dev libxtst-dev \
+    libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly; \
+    #
+    # install libclipboard
+    set -eux; \
+    cd /tmp; \
+    git clone --depth=1 https://github.com/jtanx/libclipboard; \
+    cd libclipboard; \
+    cmake .; \
+    make -j4; \
+    make install; \
+    rm -rf /tmp/libclipboard; \
+    #
+    # clean up
+    apt-get clean -y; \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+#
+# build server
+COPY server/ .
+RUN ./build
+
+#
+# STAGE 2: CLIENT
+#
+FROM node:18-bullseye-slim as client
+WORKDIR /src
+
+#
+# install dependencies
+COPY client/package*.json ./
+RUN npm install
+
+#
+# build client
+COPY client/ .
+RUN npm run build
+
+#
+# STAGE 3: RUNTIME
+#
+FROM debian:bullseye-slim
+
+#
+# set custom user
+ARG USERNAME=neko
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
+RUN set -eux; \
+    apt-get update; \
+    #
+    # install dependencies
+    apt-get install -y --no-install-recommends pulseaudio dbus-x11 xserver-xorg-video-dummy; \
+    apt-get install -y --no-install-recommends libcairo2 libxcb1 libxrandr2 libxv1 libopus0 libvpx6; \
+    #
+    # gst
+    apt-get install -y --no-install-recommends \
+        libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
+        gstreamer1.0-plugins-base gstreamer1.0-plugins-good \
+        gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly \ 
+        gstreamer1.0-pulseaudio; \
+    #
+    # create a non-root user
+    groupadd --gid $USER_GID $USERNAME; \
+    useradd --uid $USER_UID --gid $USERNAME --shell /bin/bash --create-home $USERNAME; \
+    #
+    # make directories for neko
+    mkdir -p /etc/neko /var/www /var/log/neko; \
+    chmod 1777 /var/log/neko; \
+    chown -R $USERNAME:$USERNAME /home/$USERNAME; \
+    #
+    # clean up
+    apt-get clean -y; \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+#
+# set default envs
+ENV USER=$USERNAME
+ENV NEKO_PASSWORD=neko
+ENV NEKO_PASSWORD_ADMIN=admin
+ENV NEKO_BIND=:8080
+
+#
+# copy static files from previous stages
+COPY --from=server /src/bin/neko /usr/bin/neko
+COPY --from=client /src/dist/ /var/www
+
+USER $USERNAME
+
+ENTRYPOINT [ "/usr/bin/neko" ]
+
+CMD [ "serve", "--static", "/var/www" ]

test/openbox/Dockerfile

@@ -0,0 +1,34 @@
+FROM debian:bullseye-slim
+
+#
+# set custom user
+ARG USERNAME=neko
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
+#
+# install dependencies
+RUN set -eux; apt-get update; \
+    apt-get install -y --no-install-recommends openbox; \
+    #
+    # create a non-root user
+    groupadd --gid $USER_GID $USERNAME; \
+    useradd --uid $USER_UID --gid $USERNAME --shell /bin/bash --create-home $USERNAME; \
+    #
+    # clean up
+    apt-get clean -y; \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+#
+# set default envs
+ENV USER=$USERNAME
+
+#
+# copy configuation files
+COPY openbox.xml /etc/neko/openbox.xml
+
+USER $USERNAME
+
+ENTRYPOINT [ "/usr/bin/openbox" ]
+
+CMD [ "--config-file", "/etc/neko/openbox.xml" ]

test/openbox/openbox.xml

@@ -0,0 +1,763 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- Default openbox config but all window decorations are moved
+  thereby making it harder to accidentally close the virtual browser -->
+
+<openbox_config xmlns="http://openbox.org/3.4/rc"
+                xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<resistance>
+  <strength>10</strength>
+  <screen_edge_strength>20</screen_edge_strength>
+</resistance>
+
+<applications>
+    <!-- Match all windows and remove their decorations (obxprop | grep "^_OB_APP") -->
+    <application class="firefox" name="Navigator" role="browser">
+      <decor>no</decor>
+      <maximized>true</maximized>
+      <focus>yes</focus>
+      <layer>normal</layer>
+    </application>
+</applications>
+
+<focus>
+  <focusNew>yes</focusNew>
+  <!-- always try to focus new windows when they appear. other rules do
+       apply -->
+  <followMouse>no</followMouse>
+  <!-- move focus to a window when you move the mouse into it -->
+  <focusLast>yes</focusLast>
+  <!-- focus the last used window when changing desktops, instead of the one
+       under the mouse pointer. when followMouse is enabled -->
+  <underMouse>no</underMouse>
+  <!-- move focus under the mouse, even when the mouse is not moving -->
+  <focusDelay>200</focusDelay>
+  <!-- when followMouse is enabled, the mouse must be inside the window for
+       this many milliseconds (1000 = 1 sec) before moving focus to it -->
+  <raiseOnFocus>no</raiseOnFocus>
+  <!-- when followMouse is enabled, and a window is given focus by moving the
+       mouse into it, also raise the window -->
+</focus>
+
+<placement>
+  <policy>Smart</policy>
+  <!-- 'Smart' or 'UnderMouse' -->
+  <center>yes</center>
+  <!-- whether to place windows in the center of the free area found or
+       the top left corner -->
+  <monitor>Primary</monitor>
+  <!-- with Smart placement on a multi-monitor system, try to place new windows
+       on: 'Any' - any monitor, 'Mouse' - where the mouse is, 'Active' - where
+       the active window is, 'Primary' - only on the primary monitor -->
+  <primaryMonitor>1</primaryMonitor>
+  <!-- The monitor where Openbox should place popup dialogs such as the
+       focus cycling popup, or the desktop switch popup.  It can be an index
+       from 1, specifying a particular monitor.  Or it can be one of the
+       following: 'Mouse' - where the mouse is, or
+                  'Active' - where the active window is -->
+</placement>
+
+<theme>
+  <name>Clearlooks</name>
+  <titleLayout>NLIMC</titleLayout>
+  <!--
+      available characters are NDSLIMC, each can occur at most once.
+      N: window icon
+      L: window label (AKA title).
+      I: iconify
+      M: maximize
+      C: close
+      S: shade (roll up/down)
+      D: omnipresent (on all desktops).
+  -->
+  <keepBorder>yes</keepBorder>
+  <animateIconify>yes</animateIconify>
+  <font place="ActiveWindow">
+    <name>sans</name>
+    <size>8</size>
+    <!-- font size in points -->
+    <weight>bold</weight>
+    <!-- 'bold' or 'normal' -->
+    <slant>normal</slant>
+    <!-- 'italic' or 'normal' -->
+  </font>
+  <font place="InactiveWindow">
+    <name>sans</name>
+    <size>8</size>
+    <!-- font size in points -->
+    <weight>bold</weight>
+    <!-- 'bold' or 'normal' -->
+    <slant>normal</slant>
+    <!-- 'italic' or 'normal' -->
+  </font>
+  <font place="MenuHeader">
+    <name>sans</name>
+    <size>9</size>
+    <!-- font size in points -->
+    <weight>normal</weight>
+    <!-- 'bold' or 'normal' -->
+    <slant>normal</slant>
+    <!-- 'italic' or 'normal' -->
+  </font>
+  <font place="MenuItem">
+    <name>sans</name>
+    <size>9</size>
+    <!-- font size in points -->
+    <weight>normal</weight>
+    <!-- 'bold' or 'normal' -->
+    <slant>normal</slant>
+    <!-- 'italic' or 'normal' -->
+  </font>
+  <font place="ActiveOnScreenDisplay">
+    <name>sans</name>
+    <size>9</size>
+    <!-- font size in points -->
+    <weight>bold</weight>
+    <!-- 'bold' or 'normal' -->
+    <slant>normal</slant>
+    <!-- 'italic' or 'normal' -->
+  </font>
+  <font place="InactiveOnScreenDisplay">
+    <name>sans</name>
+    <size>9</size>
+    <!-- font size in points -->
+    <weight>bold</weight>
+    <!-- 'bold' or 'normal' -->
+    <slant>normal</slant>
+    <!-- 'italic' or 'normal' -->
+  </font>
+</theme>
+
+<desktops>
+  <!-- this stuff is only used at startup, pagers allow you to change them
+       during a session
+
+       these are default values to use when other ones are not already set
+       by other applications, or saved in your session
+
+       use obconf if you want to change these without having to log out
+       and back in -->
+  <number>1</number>
+  <firstdesk>1</firstdesk>
+  <names>
+    <!-- set names up here if you want to, like this:
+    <name>desktop 1</name>
+    <name>desktop 2</name>
+    -->
+  </names>
+  <popupTime>875</popupTime>
+  <!-- The number of milliseconds to show the popup for when switching
+       desktops.  Set this to 0 to disable the popup. -->
+</desktops>
+
+<resize>
+  <drawContents>yes</drawContents>
+  <popupShow>Nonpixel</popupShow>
+  <!-- 'Always', 'Never', or 'Nonpixel' (xterms and such) -->
+  <popupPosition>Center</popupPosition>
+  <!-- 'Center', 'Top', or 'Fixed' -->
+  <popupFixedPosition>
+    <!-- these are used if popupPosition is set to 'Fixed' -->
+
+    <x>10</x>
+    <!-- positive number for distance from left edge, negative number for
+         distance from right edge, or 'Center' -->
+    <y>10</y>
+    <!-- positive number for distance from top edge, negative number for
+         distance from bottom edge, or 'Center' -->
+  </popupFixedPosition>
+</resize>
+
+<!-- You can reserve a portion of your screen where windows will not cover when
+     they are maximized, or when they are initially placed.
+     Many programs reserve space automatically, but you can use this in other
+     cases. -->
+<margins>
+  <top>0</top>
+  <bottom>0</bottom>
+  <left>0</left>
+  <right>0</right>
+</margins>
+
+<dock>
+  <position>TopLeft</position>
+  <!-- (Top|Bottom)(Left|Right|)|Top|Bottom|Left|Right|Floating -->
+  <floatingX>0</floatingX>
+  <floatingY>0</floatingY>
+  <noStrut>no</noStrut>
+  <stacking>Above</stacking>
+  <!-- 'Above', 'Normal', or 'Below' -->
+  <direction>Vertical</direction>
+  <!-- 'Vertical' or 'Horizontal' -->
+  <autoHide>no</autoHide>
+  <hideDelay>300</hideDelay>
+  <!-- in milliseconds (1000 = 1 second) -->
+  <showDelay>300</showDelay>
+  <!-- in milliseconds (1000 = 1 second) -->
+  <moveButton>Middle</moveButton>
+  <!-- 'Left', 'Middle', 'Right' -->
+</dock>
+
+<keyboard>
+  <chainQuitKey>C-g</chainQuitKey>
+
+  <!-- Keybindings for desktop switching -->
+  <keybind key="C-A-Left">
+    <action name="GoToDesktop"><to>left</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="C-A-Right">
+    <action name="GoToDesktop"><to>right</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="C-A-Up">
+    <action name="GoToDesktop"><to>up</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="C-A-Down">
+    <action name="GoToDesktop"><to>down</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="S-A-Left">
+    <action name="SendToDesktop"><to>left</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="S-A-Right">
+    <action name="SendToDesktop"><to>right</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="S-A-Up">
+    <action name="SendToDesktop"><to>up</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="S-A-Down">
+    <action name="SendToDesktop"><to>down</to><wrap>no</wrap></action>
+  </keybind>
+  <keybind key="W-F1">
+    <action name="GoToDesktop"><to>1</to></action>
+  </keybind>
+  <keybind key="W-F2">
+    <action name="GoToDesktop"><to>2</to></action>
+  </keybind>
+  <keybind key="W-F3">
+    <action name="GoToDesktop"><to>3</to></action>
+  </keybind>
+  <keybind key="W-F4">
+    <action name="GoToDesktop"><to>4</to></action>
+  </keybind>
+  <keybind key="W-d">
+    <action name="ToggleShowDesktop"/>
+  </keybind>
+
+  <!-- Keybindings for windows -->
+  <keybind key="A-F4">
+    <action name="Close"/>
+  </keybind>
+  <keybind key="A-Escape">
+    <action name="Lower"/>
+    <action name="FocusToBottom"/>
+    <action name="Unfocus"/>
+  </keybind>
+  <keybind key="A-space">
+    <!--action name="ShowMenu"><menu>client-menu</menu></action-->
+  </keybind>
+  <!-- Take a screenshot of the current window with scrot when Alt+Print are pressed -->
+  <keybind key="A-Print">
+    <action name="Execute"><command>scrot -s</command></action>
+  </keybind>
+
+  <!-- Keybindings for window switching -->
+  <keybind key="A-Tab">
+    <action name="NextWindow">
+      <finalactions>
+        <action name="Focus"/>
+        <action name="Raise"/>
+        <action name="Unshade"/>
+      </finalactions>
+    </action>
+  </keybind>
+  <keybind key="A-S-Tab">
+    <action name="PreviousWindow">
+      <finalactions>
+        <action name="Focus"/>
+        <action name="Raise"/>
+        <action name="Unshade"/>
+      </finalactions>
+    </action>
+  </keybind>
+  <keybind key="C-A-Tab">
+    <action name="NextWindow">
+      <panels>yes</panels><desktop>yes</desktop>
+      <finalactions>
+        <action name="Focus"/>
+        <action name="Raise"/>
+        <action name="Unshade"/>
+      </finalactions>
+    </action>
+  </keybind>
+
+  <!-- Keybindings for window switching with the arrow keys -->
+  <keybind key="W-S-Right">
+    <action name="DirectionalCycleWindows">
+      <direction>right</direction>
+    </action>
+  </keybind>
+  <keybind key="W-S-Left">
+    <action name="DirectionalCycleWindows">
+      <direction>left</direction>
+    </action>
+  </keybind>
+  <keybind key="W-S-Up">
+    <action name="DirectionalCycleWindows">
+      <direction>up</direction>
+    </action>
+  </keybind>
+  <keybind key="W-S-Down">
+    <action name="DirectionalCycleWindows">
+      <direction>down</direction>
+    </action>
+  </keybind>
+
+  <!-- Keybindings for running applications -->
+  <keybind key="W-e">
+    <action name="Execute">
+      <startupnotify>
+        <enabled>true</enabled>
+        <name>Konqueror</name>
+      </startupnotify>
+      <command>kfmclient openProfile filemanagement</command>
+    </action>
+  </keybind>
+  <!-- Launch scrot when Print is pressed -->
+  <keybind key="Print">
+    <action name="Execute"><command>scrot</command></action>
+  </keybind>
+</keyboard>
+
+<mouse>
+  <dragThreshold>1</dragThreshold>
+  <!-- number of pixels the mouse must move before a drag begins -->
+  <doubleClickTime>500</doubleClickTime>
+  <!-- in milliseconds (1000 = 1 second) -->
+  <screenEdgeWarpTime>400</screenEdgeWarpTime>
+  <!-- Time before changing desktops when the pointer touches the edge of the
+       screen while moving a window, in milliseconds (1000 = 1 second).
+       Set this to 0 to disable warping -->
+  <screenEdgeWarpMouse>false</screenEdgeWarpMouse>
+  <!-- Set this to TRUE to move the mouse pointer across the desktop when
+       switching due to hitting the edge of the screen -->
+
+  <context name="Frame">
+    <mousebind button="A-Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+    <mousebind button="A-Left" action="Click">
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="A-Left" action="Drag">
+      <action name="Move"/>
+    </mousebind>
+
+    <mousebind button="A-Right" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="A-Right" action="Drag">
+      <action name="Resize"/>
+    </mousebind>
+
+    <mousebind button="A-Middle" action="Press">
+      <action name="Lower"/>
+      <action name="FocusToBottom"/>
+      <action name="Unfocus"/>
+    </mousebind>
+
+    <mousebind button="A-Up" action="Click">
+      <action name="GoToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="A-Down" action="Click">
+      <action name="GoToDesktop"><to>next</to></action>
+    </mousebind>
+    <mousebind button="C-A-Up" action="Click">
+      <action name="GoToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="C-A-Down" action="Click">
+      <action name="GoToDesktop"><to>next</to></action>
+    </mousebind>
+    <mousebind button="A-S-Up" action="Click">
+      <action name="SendToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="A-S-Down" action="Click">
+      <action name="SendToDesktop"><to>next</to></action>
+    </mousebind>
+  </context>
+
+  <context name="Titlebar">
+    <mousebind button="Left" action="Drag">
+      <action name="Move"/>
+    </mousebind>
+    <mousebind button="Left" action="DoubleClick">
+      <action name="ToggleMaximize"/>
+    </mousebind>
+
+    <mousebind button="Up" action="Click">
+      <action name="if">
+        <shaded>no</shaded>
+        <then>
+          <action name="Shade"/>
+          <action name="FocusToBottom"/>
+          <action name="Unfocus"/>
+          <action name="Lower"/>
+        </then>
+      </action>
+    </mousebind>
+    <mousebind button="Down" action="Click">
+      <action name="if">
+        <shaded>yes</shaded>
+        <then>
+          <action name="Unshade"/>
+          <action name="Raise"/>
+        </then>
+      </action>
+    </mousebind>
+  </context>
+
+  <context name="Titlebar Top Right Bottom Left TLCorner TRCorner BRCorner BLCorner">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+
+    <mousebind button="Middle" action="Press">
+      <action name="Lower"/>
+      <action name="FocusToBottom"/>
+      <action name="Unfocus"/>
+    </mousebind>
+
+    <!--mousebind button="Right" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="ShowMenu"><menu>client-menu</menu></action>
+    </mousebind-->
+  </context>
+
+  <context name="Top">
+    <mousebind button="Left" action="Drag">
+      <action name="Resize"><edge>top</edge></action>
+    </mousebind>
+  </context>
+
+  <context name="Left">
+    <mousebind button="Left" action="Drag">
+      <action name="Resize"><edge>left</edge></action>
+    </mousebind>
+  </context>
+
+  <context name="Right">
+    <mousebind button="Left" action="Drag">
+      <action name="Resize"><edge>right</edge></action>
+    </mousebind>
+  </context>
+
+  <context name="Bottom">
+    <mousebind button="Left" action="Drag">
+      <action name="Resize"><edge>bottom</edge></action>
+    </mousebind>
+
+    <!--mousebind button="Right" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="ShowMenu"><menu>client-menu</menu></action>
+    </mousebind-->
+  </context>
+
+  <context name="TRCorner BRCorner TLCorner BLCorner">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="Left" action="Drag">
+      <action name="Resize"/>
+    </mousebind>
+  </context>
+
+  <context name="Client">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+    <mousebind button="Middle" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+    <mousebind button="Right" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+  </context>
+
+  <context name="Icon">
+    <!--mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+      <action name="ShowMenu"><menu>client-menu</menu></action>
+    </mousebind>
+    <mousebind button="Right" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="ShowMenu"><menu>client-menu</menu></action>
+    </mousebind-->
+  </context>
+
+  <context name="AllDesktops">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="Left" action="Click">
+      <action name="ToggleOmnipresent"/>
+    </mousebind>
+  </context>
+
+  <context name="Shade">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+    <mousebind button="Left" action="Click">
+      <action name="ToggleShade"/>
+    </mousebind>
+  </context>
+
+  <context name="Iconify">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+    <mousebind button="Left" action="Click">
+      <action name="Iconify"/>
+    </mousebind>
+  </context>
+
+  <context name="Maximize">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="Middle" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="Right" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="Left" action="Click">
+      <action name="ToggleMaximize"/>
+    </mousebind>
+    <mousebind button="Middle" action="Click">
+      <action name="ToggleMaximize"><direction>vertical</direction></action>
+    </mousebind>
+    <mousebind button="Right" action="Click">
+      <action name="ToggleMaximize"><direction>horizontal</direction></action>
+    </mousebind>
+  </context>
+
+  <context name="Close">
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+      <action name="Unshade"/>
+    </mousebind>
+    <mousebind button="Left" action="Click">
+      <action name="Close"/>
+    </mousebind>
+  </context>
+
+  <context name="Desktop">
+    <mousebind button="Up" action="Click">
+      <action name="GoToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="Down" action="Click">
+      <action name="GoToDesktop"><to>next</to></action>
+    </mousebind>
+
+    <mousebind button="A-Up" action="Click">
+      <action name="GoToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="A-Down" action="Click">
+      <action name="GoToDesktop"><to>next</to></action>
+    </mousebind>
+    <mousebind button="C-A-Up" action="Click">
+      <action name="GoToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="C-A-Down" action="Click">
+      <action name="GoToDesktop"><to>next</to></action>
+    </mousebind>
+
+    <mousebind button="Left" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+    <mousebind button="Right" action="Press">
+      <action name="Focus"/>
+      <action name="Raise"/>
+    </mousebind>
+  </context>
+
+  <context name="Root">
+    <!-- Menus -->
+    <!--mousebind button="Middle" action="Press">
+      <action name="ShowMenu"><menu>client-list-combined-menu</menu></action>
+    </mousebind>
+    <mousebind button="Right" action="Press">
+      <action name="ShowMenu"><menu>root-menu</menu></action>
+    </mousebind-->
+  </context>
+
+  <context name="MoveResize">
+    <mousebind button="Up" action="Click">
+      <action name="GoToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="Down" action="Click">
+      <action name="GoToDesktop"><to>next</to></action>
+    </mousebind>
+    <mousebind button="A-Up" action="Click">
+      <action name="GoToDesktop"><to>previous</to></action>
+    </mousebind>
+    <mousebind button="A-Down" action="Click">
+      <action name="GoToDesktop"><to>next</to></action>
+    </mousebind>
+  </context>
+</mouse>
+
+<menu>
+  <!-- You can specify more than one menu file in here and they are all loaded,
+       just don't make menu ids clash or, well, it'll be kind of pointless -->
+
+  <!-- default menu file (or custom one in $HOME/.config/openbox/) -->
+  <!-- system menu files on Debian systems -->
+  <!--file>/var/lib/openbox/debian-menu.xml</file-->
+  <file>menu.xml</file>
+  <hideDelay>200</hideDelay>
+  <!-- if a press-release lasts longer than this setting (in milliseconds), the
+       menu is hidden again -->
+  <middle>no</middle>
+  <!-- center submenus vertically about the parent entry -->
+  <submenuShowDelay>100</submenuShowDelay>
+  <!-- time to delay before showing a submenu after hovering over the parent
+       entry.
+       if this is a negative value, then the delay is infinite and the
+       submenu will not be shown until it is clicked on -->
+  <submenuHideDelay>400</submenuHideDelay>
+  <!-- time to delay before hiding a submenu when selecting another
+       entry in parent menu
+       if this is a negative value, then the delay is infinite and the
+       submenu will not be hidden until a different submenu is opened -->
+  <showIcons>yes</showIcons>
+  <!-- controls if icons appear in the client-list-(combined-)menu -->
+  <manageDesktops>yes</manageDesktops>
+  <!-- show the manage desktops section in the client-list-(combined-)menu -->
+</menu>
+
+<applications>
+<!--
+  # this is an example with comments through out. use these to make your
+  # own rules, but without the comments of course.
+  # you may use one or more of the name/class/role/title/type rules to specify
+  # windows to match
+
+  <application name="the window's _OB_APP_NAME property (see obxprop)"
+              class="the window's _OB_APP_CLASS property (see obxprop)"
+          groupname="the window's _OB_APP_GROUP_NAME property (see obxprop)"
+         groupclass="the window's _OB_APP_GROUP_CLASS property (see obxprop)"
+               role="the window's _OB_APP_ROLE property (see obxprop)"
+              title="the window's _OB_APP_TITLE property (see obxprop)"
+               type="the window's _OB_APP_TYPE property (see obxprob)..
+                      (if unspecified, then it is 'dialog' for child windows)">
+  # you may set only one of name/class/role/title/type, or you may use more
+  # than one together to restrict your matches.
+
+  # the name, class, role, and title use simple wildcard matching such as those
+  # used by a shell. you can use * to match any characters and ? to match
+  # any single character.
+
+  # the type is one of: normal, dialog, splash, utility, menu, toolbar, dock,
+  #    or desktop
+
+  # when multiple rules match a window, they will all be applied, in the
+  # order that they appear in this list
+
+
+    # each rule element can be left out or set to 'default' to specify to not
+    # change that attribute of the window
+
+    <decor>yes</decor>
+    # enable or disable window decorations
+
+    <shade>no</shade>
+    # make the window shaded when it appears, or not
+
+    <position force="no">
+      # the position is only used if both an x and y coordinate are provided
+      # (and not set to 'default')
+      # when force is "yes", then the window will be placed here even if it
+      # says you want it placed elsewhere.  this is to override buggy
+      # applications who refuse to behave
+      <x>center</x>
+      # a number like 50, or 'center' to center on screen. use a negative number
+      # to start from the right (or bottom for <y>), ie -50 is 50 pixels from
+      # the right edge (or bottom). use 'default' to specify using value
+      # provided by the application, or chosen by openbox, instead.
+      <y>200</y>
+      <monitor>1</monitor>
+      # specifies the monitor in a xinerama setup.
+      # 1 is the first head, or 'mouse' for wherever the mouse is
+    </position>
+
+    <size>
+      # the size to make the window.
+      <width>20</width>
+      # a number like 20, or 'default' to use the size given by the application.
+      # you can use fractions such as 1/2 or percentages such as 75% in which
+      # case the value is relative to the size of the monitor that the window
+      # appears on.
+      <height>30%</height>
+    </size>
+
+    <focus>yes</focus>
+    # if the window should try be given focus when it appears. if this is set
+    # to yes it doesn't guarantee the window will be given focus. some
+    # restrictions may apply, but Openbox will try to
+
+    <desktop>1</desktop>
+    # 1 is the first desktop, 'all' for all desktops
+
+    <layer>normal</layer>
+    # 'above', 'normal', or 'below'
+
+    <iconic>no</iconic>
+    # make the window iconified when it appears, or not
+
+    <skip_pager>no</skip_pager>
+    # asks to not be shown in pagers
+
+    <skip_taskbar>no</skip_taskbar>
+    # asks to not be shown in taskbars. window cycling actions will also
+    # skip past such windows
+
+    <fullscreen>yes</fullscreen>
+    # make the window in fullscreen mode when it appears
+
+    <maximized>true</maximized>
+    # 'Horizontal', 'Vertical' or boolean (yes/no)
+  </application>
+
+  # end of the example
+-->
+</applications>
+
+</openbox_config>

test/pulseaudio/Dockerfile

@@ -0,0 +1,38 @@
+FROM debian:bullseye-slim
+
+#
+# set custom user
+ARG USERNAME=neko
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
+#
+# install dependencies
+RUN set -eux; apt-get update; \
+    apt-get install -y --no-install-recommends pulseaudio; \
+    #
+    # create a non-root user
+    groupadd --gid $USER_GID $USERNAME; \
+    useradd --uid $USER_UID --gid $USERNAME --shell /bin/bash --create-home $USERNAME; \
+    #
+    # make directories
+    mkdir -p /home/$USERNAME/.config/pulse; \
+    chown -R $USERNAME:$USERNAME /home/$USERNAME; \
+    #
+    # clean up
+    apt-get clean -y; \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+#
+# set default envs
+ENV USER=$USERNAME
+
+#
+# copy configuation files
+COPY default.pa /etc/pulse/default.pa
+
+USER $USERNAME
+
+ENTRYPOINT [ "/usr/bin/pulseaudio" ]
+
+CMD [ "--log-level=info", "--disallow-module-loading", "--disallow-exit", "--exit-idle-time=-1" ]

test/pulseaudio/default.pa

@@ -0,0 +1,10 @@
+#!/usr/bin/pulseaudio -nF
+
+### Create virtual output device sink
+load-module module-null-sink sink_name=audio_output sink_properties=device.description="Virtual\ Audio\ Output"
+
+# Allow pulse audio to be accessed via TCP (from localhost only), to allow other users to access the virtual devices
+load-module module-native-protocol-tcp port=4713 auth-anonymous=1
+
+### Make sure we always have a sink around, even if it is a null sink.
+load-module module-always-sink

test/xserver/Dockerfile

@@ -0,0 +1,17 @@
+FROM debian:bullseye-slim
+
+#
+# install dependencies
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends x11-xserver-utils xserver-xorg-video-dummy; \
+    #
+    # clean up
+    apt-get clean -y; \
+    rm -rf /var/lib/apt/lists/* /var/cache/apt/*
+
+#
+# copy configuation files
+COPY xorg.conf /etc/neko/xorg.conf
+
+ENTRYPOINT [ "/usr/bin/X", "-config", "/etc/neko/xorg.conf", "-nolisten", "local", "-logfile", "/dev/stderr" ]

test/xserver/xorg.conf

@@ -0,0 +1,88 @@
+# This xorg configuration file is meant to be used by xpra
+# to start a dummy X11 server.
+# For details, please see:
+# https://xpra.org/trac/wiki/Xdummy
+
+Section "ServerFlags"
+  Option "DontVTSwitch" "true"
+  Option "AllowMouseOpenFail" "true"
+  Option "PciForceNone" "true"
+  Option "AutoEnableDevices" "false"
+  Option "AutoAddDevices" "false"
+EndSection
+
+Section "InputDevice"
+  Identifier "dummy_mouse"
+  Option "CorePointer" "true"
+  Driver "void"
+EndSection
+
+Section "InputDevice"
+  Identifier "dummy_keyboard"
+  Option "CoreKeyboard" "true"
+  Driver "void"
+EndSection
+
+Section "Device"
+  Identifier "dummy_videocard"
+  Driver "dummy"
+  Option "ConstantDPI" "true"
+  #VideoRam 4096000
+  #VideoRam 256000
+  VideoRam 192000
+EndSection
+
+Section "Monitor"
+  Identifier "dummy_monitor"
+  HorizSync   5.0 - 1000.0
+  VertRefresh 5.0 - 200.0
+  #This can be used to get a specific DPI, but only for the default resolution:
+  #DisplaySize 508 317
+  #NOTE: the highest modes will not work without increasing the VideoRam
+  # for the dummy video card.
+  # https://arachnoid.com/modelines/
+
+  # 1280x720 @ 30.00 Hz (GTF) hsync: 21.99 kHz; pclk: 33.78 MHz
+  Modeline "1280x720_30.00" 33.78 1280 1288 1408 1536 720 721 724 733 -HSync +Vsync
+
+  # 1280x720 @ 60.00 Hz (GTF) hsync: 44.76 kHz; pclk: 74.48 MHz
+  Modeline "1280x720_60.00" 74.48 1280 1336 1472 1664 720 721 724 746 -HSync +Vsync
+  # 1152x648 @ 60.00 Hz (GTF) hsync: 40.26 kHz; pclk: 59.91 MHz
+  Modeline "1152x648_60.00" 59.91 1152 1200 1320 1488 648 649 652 671 -HSync +Vsync
+  # 1024x576 @ 60.00 Hz (GTF) hsync: 35.82 kHz; pclk: 47.00 MHz
+  Modeline "1024x576_60.00" 47.00 1024 1064 1168 1312 576 577 580 597 -HSync +Vsync
+  # 960x720 @ 60.00 Hz (GTF) hsync: 44.76 kHz; pclk: 55.86 MHz
+  Modeline "960x720_60.00" 55.86 960 1008 1104 1248 720 721 724 746 -HSync +Vsync
+  # 800x600 @ 60.00 Hz (GTF) hsync: 37.32 kHz; pclk: 38.22 MHz
+  Modeline "800x600_60.00" 38.22 800 832 912 1024 600 601 604 622 -HSync +Vsync
+  
+  # 1920x1080 @ 30.00 Hz (GTF) hsync: 32.97 kHz; pclk: 80.18 MHz
+  Modeline "1920x1080_30.00" 80.18 1920 1984 2176 2432 1080 1081 1084 1099 -HSync +Vsync
+  # 1152x648 @ 30.00 Hz (GTF) hsync: 19.80 kHz; pclk: 26.93 MHz
+  Modeline "1152x648_30.00" 26.93 1152 1144 1256 1360 648 649 652 660 -HSync +Vsync
+  # 1024x576 @ 30.00 Hz (GTF) hsync: 17.61 kHz; pclk: 20.85 MHz
+  Modeline "1024x576_30.00" 20.85 1024 1008 1104 1184 576 577 580 587 -HSync +Vsync
+  # 960x720 @ 30.00 Hz (GTF) hsync: 21.99 kHz; pclk: 25.33 MHz
+  Modeline "960x720_30.00" 25.33 960 960 1056 1152 720 721 724 733 -HSync +Vsync
+  # 800x600 @ 30.00 Hz (GTF) hsync: 18.33 kHz; pclk: 17.01 MHz
+  Modeline "800x600_30.00" 17.01 800 792 864 928 600 601 604 611 -HSync +Vsync
+EndSection
+
+Section "Screen"
+  Identifier "dummy_screen"
+  Device "dummy_videocard"
+  Monitor "dummy_monitor"
+  DefaultDepth 24
+  SubSectionSub "Display"
+    Viewport 0 0
+    Depth 24
+    Modes "1280x720_30.00" "1920x1080_60.00" "1280x720_60.00" "1152x648_60.00" "1024x576_60.00" "960x720_60.00" "800x600_60.00" "1920x1080_30.00" "1152x648_30.00" "1024x576_30.00" "960x720_30.00" "800x600_30.00"
+  EndSubSection
+EndSection
+
+Section "ServerLayout"
+  Identifier   "dummy_layout"
+  Screen       "dummy_screen"
+  InputDevice  "dummy_mouse"
+  InputDevice  "dummy_keyboard"
+EndSection