Function expressCreateServer

src/node/hooks/express/updateStatus.ts:127–224

(
  _hookName: string,
  {app}: ArgsExpressType,
  cb: Function,
)

};

export const expressCreateServer = (
  _hookName: string,
  {app}: ArgsExpressType,
  cb: Function,
): void => {
  // Tier "off" disables the entire updater feature, including its HTTP surface.
  if (settings.updates.tier === 'off') return cb();

  // Public endpoint. Cached for 60s per (padId, authorId) key.
  app.get('/api/version-status', wrapAsync(async (req, res) => {
    const padId = typeof req.query.padId === 'string' ? req.query.padId : null;
    const authorId = await resolveRequestAuthor(req);
    const key = `${padId ?? ''}|${authorId ?? ''}`;
    const now = Date.now();

    const hit = cache.get(key);
    if (hit && now - hit.at <= TTL_MS) {
      res.json(hit.value);
      return;
    }

    let flight = inFlight.get(key);
    if (!flight) {
      flight = computeOutdated(padId, authorId).finally(() => { inFlight.delete(key); });
      inFlight.set(key, flight);
    }
    const value = await flight;
    cache.set(key, {value, at: now});
    res.json(value);
  }));

  // Admin UI status endpoint. By default this is open: the running version is already
  // exposed publicly via /health, and latest/changelog come from a public GitHub
  // release. Admins who want the endpoint gated to authenticated admin sessions —
  // without disabling the updater entirely — set updates.requireAdminForStatus=true.
  app.get('/admin/update/status', wrapAsync(async (req, res) => {
    const isAdmin = !!req.session?.user?.is_admin;
    if (settings.updates.requireAdminForStatus) {
      const user = req.session?.user;
      if (!user) return res.status(401).send('Authentication required');
      if (!user.is_admin) return res.status(403).send('Forbidden');
    }
    const state = await loadState(stateFilePath());
    const current = getEpVersion();
    const installMethod = getDetectedInstallMethod();
    const policy = state.latest
      ? evaluatePolicy({
          installMethod,
          tier: settings.updates.tier,
          current,
          latest: state.latest.version,
          executionStatus: state.execution.status,
          maintenanceWindow: settings.updates.maintenanceWindow,
        })
      : null;
    const lockHeld = await isHeld(path.join(settings.root, 'var', 'update.lock'));
    // Tier 4: surface the configured window + the next opening so the admin UI
    // can render the picker and the "deferred until..." subtitle on the