10.1: bug fixes, ui & self-hosting improvements, better security (#775)

This commit is contained in:
wukko 2024-09-23 23:00:01 +06:00 committed by GitHub
commit 6e80703aa7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
52 changed files with 723 additions and 412 deletions

View file

@ -1,7 +1,7 @@
{
"name": "@imput/cobalt-api",
"description": "save what you love",
"version": "10.0.0",
"version": "10.1.0",
"author": "imput",
"exports": "./src/cobalt.js",
"type": "module",

View file

@ -34,10 +34,15 @@ const env = {
externalProxy: process.env.API_EXTERNAL_PROXY,
turnstileSitekey: process.env.TURNSTILE_SITEKEY,
turnstileSecret: process.env.TURNSTILE_SECRET,
jwtSecret: process.env.JWT_SECRET,
jwtLifetime: process.env.JWT_EXPIRY || 120,
sessionEnabled: process.env.TURNSTILE_SITEKEY
&& process.env.TURNSTILE_SECRET
&& process.env.JWT_SECRET,
enabledServices,
}

View file

@ -49,6 +49,7 @@ export const runAPI = (express, app, __dirname) => {
url: env.apiURL,
startTime: `${startTimestamp}`,
durationLimit: env.durationLimit,
turnstileSitekey: env.sessionEnabled ? env.turnstileSitekey : undefined,
services: [...env.enabledServices].map(e => {
return friendlyServiceName(e);
}),
@ -109,16 +110,14 @@ export const runAPI = (express, app, __dirname) => {
if (!acceptRegex.test(req.header('Accept'))) {
return fail(res, "error.api.header.accept");
}
if (!acceptRegex.test(req.header('Content-Type'))) {
return fail(res, "error.api.header.content_type");
}
next();
});
app.post('/', (req, res, next) => {
if (!env.turnstileSecret || !env.jwtSecret) {
if (!env.sessionEnabled) {
return next();
}
@ -160,7 +159,7 @@ export const runAPI = (express, app, __dirname) => {
});
app.post("/session", async (req, res) => {
if (!env.turnstileSecret || !env.jwtSecret) {
if (!env.sessionEnabled) {
return fail(res, "error.api.auth.not_configured")
}

View file

@ -84,41 +84,25 @@ importers:
packages/version-info: {}
web:
dependencies:
devDependencies:
'@eslint/js':
specifier: ^9.5.0
version: 9.8.0
'@fontsource-variable/noto-sans-mono':
specifier: ^5.0.20
version: 5.0.20
'@fontsource/ibm-plex-mono':
specifier: ^5.0.13
version: 5.0.13
'@fontsource/redaction-10':
specifier: ^5.0.2
version: 5.0.2
'@imput/libav.js-remux-cli':
specifier: ^5.5.6
version: 5.5.6
'@imput/version-info':
specifier: workspace:^
version: link:../packages/version-info
'@tabler/icons-svelte':
specifier: 3.6.0
version: 3.6.0(svelte@4.2.18)
'@vitejs/plugin-basic-ssl':
specifier: ^1.1.0
version: 1.1.0(vite@5.3.5(@types/node@20.14.14))
mime:
specifier: ^4.0.4
version: 4.0.4
sveltekit-i18n:
specifier: ^2.4.2
version: 2.4.2(svelte@4.2.18)
ts-deepmerge:
specifier: ^7.0.0
version: 7.0.1
devDependencies:
'@eslint/js':
specifier: ^9.5.0
version: 9.8.0
'@fontsource/redaction-10':
specifier: ^5.0.2
version: 5.0.2
'@sveltejs/adapter-static':
specifier: ^3.0.2
version: 3.0.2(@sveltejs/kit@2.5.19(@sveltejs/vite-plugin-svelte@3.1.1(svelte@4.2.18)(vite@5.3.5(@types/node@20.14.14)))(svelte@4.2.18)(vite@5.3.5(@types/node@20.14.14)))
@ -128,6 +112,9 @@ importers:
'@sveltejs/vite-plugin-svelte':
specifier: ^3.0.0
version: 3.1.1(svelte@4.2.18)(vite@5.3.5(@types/node@20.14.14))
'@tabler/icons-svelte':
specifier: 3.6.0
version: 3.6.0(svelte@4.2.18)
'@types/eslint__js':
specifier: ^8.42.3
version: 8.42.3
@ -137,9 +124,15 @@ importers:
'@types/node':
specifier: ^20.14.10
version: 20.14.14
'@vitejs/plugin-basic-ssl':
specifier: ^1.1.0
version: 1.1.0(vite@5.3.5(@types/node@20.14.14))
compare-versions:
specifier: ^6.1.0
version: 6.1.1
dotenv:
specifier: ^16.0.1
version: 16.4.5
eslint:
specifier: ^8.57.0
version: 8.57.0
@ -149,6 +142,9 @@ importers:
mdsvex:
specifier: ^0.11.2
version: 0.11.2(svelte@4.2.18)
mime:
specifier: ^4.0.4
version: 4.0.4
svelte:
specifier: ^4.2.7
version: 4.2.18
@ -158,6 +154,12 @@ importers:
svelte-preprocess:
specifier: ^6.0.2
version: 6.0.2(postcss@8.4.40)(svelte@4.2.18)(typescript@5.5.4)
sveltekit-i18n:
specifier: ^2.4.2
version: 2.4.2(svelte@4.2.18)
ts-deepmerge:
specifier: ^7.0.1
version: 7.0.1
tslib:
specifier: ^2.4.1
version: 2.6.3

View file

@ -1,5 +1,6 @@
{
"link_area": "link input area",
"link_area.turnstile": "link input area. checking if you're not a robot.",
"clear_input": "clear input",
"download": "download",
"download.think": "processing the link...",

View file

@ -12,5 +12,19 @@
"community.twitter": "news account on twitter",
"community.github": "github repo",
"community.email": "support email",
"community.telegram": "news channel on telegram"
"community.telegram": "news channel on telegram",
"heading.general": "general terms",
"heading.licenses": "licenses",
"heading.summary": "best way to save what you love",
"heading.privacy": "leading privacy",
"heading.speed": "blazing speed",
"heading.community": "open community",
"heading.local": "on-device processing",
"heading.saving": "saving",
"heading.encryption": "encryption",
"heading.plausible": "anonymous traffic analytics",
"heading.cloudflare": "web privacy & security",
"heading.responsibility": "user responsibilities",
"heading.abuse": "reporting abuse"
}

View file

@ -0,0 +1,37 @@
<script lang="ts">
import { contacts, docs } from "$lib/env";
import { t } from "$lib/i18n/translations";
import SectionHeading from "$components/misc/SectionHeading.svelte";
</script>
<section id="meowbalt">
<SectionHeading
title={$t("general.meowbalt")}
sectionId="meowbalt"
/>
meowbalt is cobalt's speedy mascot. he is an extremely expressive cat that loves fast internet.
all amazing drawings of meowbalt that you see in cobalt were made by [GlitchyPSI](https://glitchypsi.xyz/).
he is also the original designer of the character.
you cannot use or modify GlitchyPSI's artworks of meowbalt without his explicit permission.
you cannot use or modify the meowbalt character design commercially or in any form that isn't fan art.
</section>
<section id="licenses">
<SectionHeading
title={$t("about.heading.licenses")}
sectionId="licenses"
/>
cobalt processing server is open source and licensed under [AGPL-3.0]({docs.apiLicense}).
cobalt frontend is [source first](https://sourcefirst.com/) and licensed under [CC-BY-NC-SA 4.0]({docs.webLicense}).
we decided to use this license to stop grifters from profiting off our work & from creating malicious clones that deceive people and hurt our public identity.
we rely on many open source libraries, create & distribute our own.
you can see the full list of dependencies on [github]({contacts.github}).
</section>

View file

@ -0,0 +1,79 @@
<script lang="ts">
import { t } from "$lib/i18n/translations";
import { partners, contacts, docs } from "$lib/env";
import SectionHeading from "$components/misc/SectionHeading.svelte";
</script>
<section id="saving">
<SectionHeading
title={$t("about.heading.summary")}
sectionId="saving"
/>
cobalt lets you save anything from your favorite websites: video, audio, photos or gifs — cobalt can do it all!
no ads, trackers, or paywalls, no nonsense. just a convenient web app that works everywhere.
</section>
<section id="privacy">
<SectionHeading
title={$t("about.heading.privacy")}
sectionId="privacy"
/>
all requests to backend are anonymous and all tunnels are encrypted.
we have a strict zero log policy and don't track *anything* about individual people.
to avoid caching or storing downloaded files, cobalt processes them on-the-fly, sending processed pieces directly to client.
this technology is used when your request needs additional processing, such as when source service stores video & audio in separate files.
for even higher level of protection, you can [ask cobalt to always tunnel everything](/settings/privacy#tunnel).
when enabled, cobalt will proxy everything through itself. no one will know what you download, even your network provider/admin.
all they'll see is that you're using cobalt.
</section>
<section id="speed">
<SectionHeading
title={$t("about.heading.speed")}
sectionId="speed"
/>
since we don't rely on any existing downloaders and develop our own from ground up,
cobalt is extremely efficient and a processing server can run on basically any hardware.
main processing instances are hosted on several dedicated servers in several countries,
to reduce latency and distribute the traffic.
we constantly improve our infrastructure along with our long-standing partner, [royalehosting.net]({partners.royalehosting})!
you're in good hands, and will get what you need within seconds.
</section>
<section id="community">
<SectionHeading
title={$t("about.heading.community")}
sectionId="community"
/>
cobalt is used by countless artists, educators, and content creators to do what they love.
we're always on the line with our community and work together to create even more useful tools for them.
feel free to [join the conversation](/about/community)!
we believe that the future of the internet is open, which is why cobalt is [source first](https://sourcefirst.com/) and [easily self-hostable]({docs.instanceHosting}). you can [check the source code & contribute to cobalt]({contacts.github})
at any time, we welcome all contributions and suggestions.
you can use any processing instances hosted by the community, including your own.
if your friend hosts one, just ask them for a domain and [add it in instance settings](/settings/instances#community).
</section>
<section id="local">
<SectionHeading
title={$t("about.heading.local")}
sectionId="local"
/>
new features, such as [remuxing](/remux), work on-device.
on-device processing is efficient and never sends anything over the internet.
it perfectly aligns with our future goal of moving as much processing as possible to client.
</section>

View file

@ -0,0 +1,76 @@
<script lang="ts">
import env from "$lib/env";
import { t } from "$lib/i18n/translations";
import SectionHeading from "$components/misc/SectionHeading.svelte";
</script>
<section id="general">
<SectionHeading
title={$t("about.heading.general")}
sectionId="general"
/>
cobalt's privacy policy is simple: we don't collect or store anything about you. what you do is solely your business, not ours or anyone else's.
these terms are applicable only when using the official cobalt instance. in other cases, you may need to contact the hoster for accurate info.
</section>
<section id="local">
<SectionHeading
title={$t("about.heading.local")}
sectionId="local"
/>
tools that use on-device processing work offline, locally, and never send any data anywhere. they are explicitly marked as such whenever applicable.
</section>
<section id="saving">
<SectionHeading
title={$t("about.heading.saving")}
sectionId="saving"
/>
when using saving functionality, in some cases cobalt will encrypt & temporarily store information needed for tunneling. it's stored in processing server's RAM for 90 seconds and irreversibly purged afterwards. no one has access to it, even instance owners, as long as they don't modify the official cobalt image.
processed/tunneled files are never cached anywhere. everything is tunneled live. cobalt's saving functionality is essentially a fancy proxy service.
</section>
<section id="encryption">
<SectionHeading
title={$t("about.heading.encryption")}
sectionId="encryption"
/>
temporarily stored tunnel data is encrypted using the AES-256 standard. decryption keys are only included in the access link and never logged/cached/stored anywhere. only the end user has access to the link & encryption keys. keys are generated uniquely for each requested tunnel.
</section>
{#if env.PLAUSIBLE_ENABLED}
<section id="plausible">
<SectionHeading
title={$t("about.heading.plausible")}
sectionId="plausible"
/>
for sake of privacy, we use [plausible's anonymous traffic analytics](https://plausible.io/) to get an approximate number of active cobalt users. no identifiable information about you or your requests is ever stored. all data is anonymized and aggregated. the plausible instance we use is hosted & managed by us.
plausible doesn't use cookies and is fully compliant with GDPR, CCPA, and PECR.
[learn more about plausible's dedication to privacy.](https://plausible.io/privacy-focused-web-analytics)
if you wish to opt out of anonymous analytics, you can do it in <a href="/settings/privacy#analytics">privacy settings</a>.
</section>
{/if}
<section id="cloudflare">
<SectionHeading
title={$t("about.heading.cloudflare")}
sectionId="cloudflare"
/>
we use cloudflare services for ddos & bot protection. we also use cloudflare pages for deploying & hosting the static web app. all of these are required to provide the best experience for everyone. it's the most private & reliable provider that we know of.
cloudflare is fully compliant with GDPR and HIPAA.
[learn more about cloudflare's dedication to privacy.](https://www.cloudflare.com/trust-hub/privacy-and-data-protection/)
</section>

View file

@ -0,0 +1,47 @@
<script lang="ts">
import { t } from "$lib/i18n/translations";
import SectionHeading from "$components/misc/SectionHeading.svelte";
</script>
<section id="general">
<SectionHeading
title={$t("about.heading.general")}
sectionId="general"
/>
these terms are applicable only when using the official cobalt instance. in other cases, you may need to contact the hoster for accurate info.
</section>
<section id="saving">
<SectionHeading
title={$t("about.heading.saving")}
sectionId="saving"
/>
saving functionality simplifies downloading content from the internet and takes zero liability for what the saved content is used for. processing servers work like advanced proxies and don't ever write any content to disk. everything is handled in RAM and permanently purged once the tunnel is done. we have no downloading logs and can't identify anyone.
[you can read more about how tunnels work in our privacy policy.](/about/privacy)
</section>
<section id="responsibility">
<SectionHeading
title={$t("about.heading.responsibility")}
sectionId="responsibility"
/>
you (end user) are responsible for what you do with our tools, how you use and distribute resulting content. please be mindful when using content of others and always credit original creators. make sure you don't violate any terms or licenses.
when used in educational purposes, always cite sources and credit original creators.
fair use and credits benefit everyone.
</section>
<section id="abuse">
<SectionHeading
title={$t("about.heading.abuse")}
sectionId="abuse"
/>
we have no way of detecting abusive behavior automatically, as cobalt is 100% anonymous.
however, you can report such activities to us and we will do our best to comply manually: [safety@imput.net](mailto:safety@imput.net)
</section>

View file

@ -7,6 +7,7 @@
"download": "download",
"share": "share",
"copy": "copy",
"copy.section": "copy the section link",
"copied": "copied",
"import": "import",
"continue": "continue",

View file

@ -8,6 +8,8 @@
"tunnel.probe": "couldn't verify whether you can download this file. try again in a few seconds!",
"captcha_ongoing": "still checking if you're not a bot. wait for the spinner to disappear and try again.\n\nif it takes too long, please let us know! we use cloudflare turnstile for bot protection and sometimes it blocks people for no reason.",
"api.auth.jwt.missing": "couldn't confirm whether you're not a robot because the processing server didn't receive the human access token. try again in a few seconds or reload the page!",
"api.auth.jwt.invalid": "couldn't confirm whether you're not a robot because your human access token expired and wasn't renewed. try again in a few seconds or reload the page!",
"api.auth.turnstile.missing": "couldn't confirm whether you're not a robot because the processing server didn't receive the human access token. try again in a few seconds or reload the page!",
@ -36,7 +38,7 @@
"api.content.too_long": "the media you requested is too long. current duration limit is {{ limit }} minutes. try something shorter instead!",
"api.content.video.unavailable": "i can't access this video. it may be restricted on {{ service }}'s side. have you pasted the right link?",
"api.content.video.live": "this video is currently live, so i can't download it yet. wait for the livestream to finish, and then try again!",
"api.content.video.live": "this video is currently live, so i can't download it yet. wait for the live stream to finish, and then try again!",
"api.content.video.private": "this video is private, so i cannot access it. change its visibility or try another one!",
"api.content.video.age": "this video is age-restricted, so i can't access it anonymously. try another one!",
"api.content.video.region": "this video is region locked, and the processing server is in a different location. try another one!",
@ -45,7 +47,7 @@
"api.content.post.private": "this post is from a private account, so i can't access it. have you pasted the right link?",
"api.content.post.age": "this post is age-restricted, so i can't access it anonymously. have you pasted the right link?",
"api.youtube.codec": "youtube didn't return anything with your preferred codec & resolution. try another set of settings!",
"api.youtube.codec": "youtube didn't return anything with your preferred video codec. try another one in settings!",
"api.youtube.decipher": "youtube updated its decipher algorithm and i couldn't extract the info about the video.\n\ntry again in a few seconds, but if issue sticks, contact us for support.",
"api.youtube.login": "couldn't get this video because youtube labeled me as a bot. this is potentially caused by the processing instance not having any active account tokens. try again in a few seconds, but if it still doesn't work, tell the instance owner about this error!",
"api.youtube.token_expired": "couldn't get this video because the youtube token expired and i couldn't refresh it. try again in a few seconds, but if it still doesn't work, tell the instance owner about this error!"

View file

@ -91,7 +91,7 @@
"language.auto.title": "automatic selection",
"language.auto.description": "cobalt will use your browser's default language if translation is available. if not, english will be used instead.",
"language.preferred.title": "preferred language",
"language.preferred.description": "this language will be used when automatic selection is disabled. any text that isn't translated will be displayed in english.",
"language.preferred.description": "this language will be used when automatic selection is disabled. any text that isn't translated will be displayed in english.\n\nwe use community-sourced translations for languages other than english, russian, and czech. they may be inaccurate or incomplete.",
"privacy.analytics": "anonymous traffic analytics",
"privacy.analytics.title": "don't contribute to analytics",

View file

@ -1,6 +1,6 @@
{
"name": "@imput/cobalt-web",
"version": "10.0.0",
"version": "10.1.0",
"type": "module",
"private": true,
"scripts": {
@ -25,35 +25,34 @@
"homepage": "https://cobalt.tools/",
"devDependencies": {
"@eslint/js": "^9.5.0",
"@fontsource-variable/noto-sans-mono": "^5.0.20",
"@fontsource/ibm-plex-mono": "^5.0.13",
"@fontsource/redaction-10": "^5.0.2",
"@imput/libav.js-remux-cli": "^5.5.6",
"@imput/version-info": "workspace:^",
"@sveltejs/adapter-static": "^3.0.2",
"@sveltejs/kit": "^2.0.0",
"@sveltejs/vite-plugin-svelte": "^3.0.0",
"@tabler/icons-svelte": "3.6.0",
"@types/eslint__js": "^8.42.3",
"@types/fluent-ffmpeg": "^2.1.25",
"@types/node": "^20.14.10",
"@vitejs/plugin-basic-ssl": "^1.1.0",
"compare-versions": "^6.1.0",
"dotenv": "^16.0.1",
"eslint": "^8.57.0",
"glob": "^10.4.5",
"mdsvex": "^0.11.2",
"mime": "^4.0.4",
"svelte": "^4.2.7",
"svelte-check": "^3.6.0",
"svelte-preprocess": "^6.0.2",
"sveltekit-i18n": "^2.4.2",
"ts-deepmerge": "^7.0.1",
"tslib": "^2.4.1",
"turnstile-types": "^1.2.2",
"typescript": "^5.4.5",
"typescript-eslint": "^7.13.1",
"vite": "^5.0.3"
},
"dependencies": {
"@fontsource-variable/noto-sans-mono": "^5.0.20",
"@fontsource/ibm-plex-mono": "^5.0.13",
"@imput/libav.js-remux-cli": "^5.5.6",
"@imput/version-info": "workspace:^",
"@tabler/icons-svelte": "3.6.0",
"@vitejs/plugin-basic-ssl": "^1.1.0",
"mime": "^4.0.4",
"sveltekit-i18n": "^2.4.2",
"ts-deepmerge": "^7.0.0"
}
}

View file

@ -14,6 +14,7 @@
export let number: number;
let imageLoaded = false;
const isTunnel = new URL(item.url).pathname === "/tunnel";
$: itemType = item.type ?? "photo";
</script>
@ -23,6 +24,7 @@
on:click={() =>
downloadFile({
url: item.url,
urlType: isTunnel ? "tunnel" : "redirect",
})}
>
<div class="picker-type">

View file

@ -10,6 +10,8 @@
shareFile,
} from "$lib/download";
import type { CobaltFileUrlType } from "$lib/types/api";
import DialogContainer from "$components/dialog/DialogContainer.svelte";
import Meowbalt from "$components/misc/Meowbalt.svelte";
@ -22,12 +24,14 @@
import IconFileDownload from "@tabler/icons-svelte/IconFileDownload.svelte";
import CopyIcon from "$components/misc/CopyIcon.svelte";
export let id: string;
export let dismissable = true;
export let bodyText: string = "";
export let url: string = "";
export let file: File | undefined = undefined;
export let urlType: CobaltFileUrlType | undefined = undefined;
let close: () => void;
@ -55,7 +59,7 @@
</div>
<div class="action-buttons">
{#if device.supports.directDownload}
{#if device.supports.directDownload && !(device.is.iOS && urlType === "redirect")}
<VerticalActionButton
id="save-download"
fill

View file

@ -5,8 +5,6 @@
import Imput from "$components/icons/Imput.svelte";
import Meowbalt from "$components/misc/Meowbalt.svelte";
import IconHeart from "@tabler/icons-svelte/IconHeart.svelte";
</script>
<header id="banner">

View file

@ -107,11 +107,13 @@
</div>
<div id="donation-options">
{#each Object.entries(PRESET_DONATION_AMOUNTS) as [ amount, component ]}
<OuterLink href={donationMethods[processor](+amount * 100)}>
<DonationOption price={+amount} desc={$t(`donate.card.option.${amount}`)}>
<svelte:component this={component} />
</DonationOption>
</OuterLink>
<DonationOption
price={+amount}
desc={$t(`donate.card.option.${amount}`)}
href={donationMethods[processor](+amount * 100)}
>
<svelte:component this={component} />
</DonationOption>
{/each}
</div>
<div id="donation-custom">

View file

@ -1,18 +1,24 @@
<script lang="ts">
export let price: number;
export let desc: string;
export let href: string;
const USD = new Intl.NumberFormat('en-US', {
style: 'currency',
currency: 'USD',
minimumFractionDigits: 0
const USD = new Intl.NumberFormat("en-US", {
style: "currency",
currency: "USD",
minimumFractionDigits: 0,
});
</script>
<button class="donation-option">
<button
class="donation-option"
on:click={() => {
window.open(href, "_blank");
}}
>
<div class="donate-card-title">
<slot></slot>
{ USD.format(price) }
{USD.format(price)}
</div>
<div class="donate-card-subtitle">{desc}</div>
</button>

View file

@ -0,0 +1,9 @@
<!-- Workaround for https://github.com/pngwn/MDsveX/issues/116 -->
<script lang="ts" context="module">
import a from "$components/misc/OuterLink.svelte";
export { a };
</script>
<div class="long-text-noto about">
<slot></slot>
</div>

View file

@ -0,0 +1,91 @@
<script lang="ts">
import { page } from "$app/stores";
import { t } from "$lib/i18n/translations";
import { copyURL } from "$lib/download";
import CopyIcon from "$components/misc/CopyIcon.svelte";
export let title: string;
export let sectionId: string;
export let beta = false;
let copied = false;
$: if (copied) {
setTimeout(() => {
copied = false;
}, 1500);
}
</script>
<div class="heading-container">
<h3 class="content-title">{title}</h3>
{#if beta}
<div class="beta-label">{$t("general.beta")}</div>
{/if}
<button
class="link-copy"
aria-label={copied ? $t("button.copied") : $t("button.copy.section")}
on:click={() => {
copied = true;
copyURL(`${$page.url.origin}${$page.url.pathname}#${sectionId}`);
}}
>
<CopyIcon check={copied} />
</button>
</div>
<style>
.heading-container {
display: flex;
flex-direction: row;
flex-wrap: wrap-reverse;
gap: 6px;
justify-content: start;
align-items: center;
box-shadow: none;
}
.link-copy {
background: transparent;
padding: 2px;
box-shadow: none;
border-radius: 5px;
transition: opacity 0.2s;
opacity: 0.7;
}
.link-copy:focus-visible {
opacity: 1;
}
.link-copy :global(.copy-animation) {
width: 17px;
height: 17px;
}
.link-copy :global(.copy-animation *) {
width: 17px;
height: 17px;
}
.beta-label {
display: flex;
justify-content: center;
align-items: center;
border-radius: 5px;
padding: 0 5px;
background: var(--secondary);
color: var(--primary);
font-size: 11px;
font-weight: 500;
line-height: 1.9;
text-transform: uppercase;
}
@media (hover: hover) {
.heading-container:hover .link-copy {
opacity: 1;
}
}
</style>

View file

@ -1,14 +1,14 @@
<script lang="ts">
import env from "$lib/env";
import { onMount } from "svelte";
import { cachedInfo } from "$lib/api/server-info";
import { turnstileLoaded, turnstileCreated } from "$lib/state/turnstile";
let turnstileElement: HTMLElement;
let turnstileScript: HTMLElement;
onMount(() => {
const sitekey = env.TURNSTILE_KEY;
const sitekey = $cachedInfo?.info?.cobalt?.turnstileSitekey;
if (!sitekey) return;
$turnstileCreated = true;
@ -17,7 +17,7 @@
window.turnstile?.render(turnstileElement, {
sitekey,
"error-callback": (error) => {
console.log("turnstile error code:", error);
console.log("error code from turnstile:", error);
return true;
},
callback: () => {

View file

@ -4,12 +4,12 @@
import { browser } from "$app/environment";
import { SvelteComponent, tick } from "svelte";
import env from "$lib/env";
import { t } from "$lib/i18n/translations";
import dialogs from "$lib/dialogs";
import { link } from "$lib/state/omnibox";
import { cachedInfo } from "$lib/api/server-info";
import { updateSetting } from "$lib/state/settings";
import { turnstileLoaded } from "$lib/state/turnstile";
@ -35,7 +35,10 @@
let downloadButton: SvelteComponent;
let isFocused = false;
let isDisabled = false;
let isLoading = false;
let isBotCheckOngoing = false;
const validLink = (url: string) => {
try {
@ -57,16 +60,18 @@
goto("/", { replaceState: true });
}
$: if (env.TURNSTILE_KEY) {
$: if ($cachedInfo?.info?.cobalt?.turnstileSitekey) {
if ($turnstileLoaded) {
isDisabled = false;
isBotCheckOngoing = false;
} else {
isDisabled = true;
isBotCheckOngoing = true;
}
} else {
isBotCheckOngoing = false;
}
const pasteClipboard = () => {
if (isDisabled || $dialogs.length > 0) {
if ($dialogs.length > 0 || isDisabled || isLoading) {
return;
}
@ -75,8 +80,10 @@
if (matchLink) {
$link = matchLink[0];
await tick(); // wait for button to render
downloadButton.download($link);
if (!isBotCheckOngoing) {
await tick(); // wait for button to render
downloadButton.download($link);
}
}
});
};
@ -86,7 +93,7 @@
};
const handleKeydown = (e: KeyboardEvent) => {
if (!linkInput || $dialogs.length > 0 || isDisabled) {
if (!linkInput || $dialogs.length > 0 || isDisabled || isLoading) {
return;
}
@ -133,8 +140,11 @@
class:focused={isFocused}
class:downloadable={validLink($link)}
>
<div id="input-link-icon" class:loading={isDisabled}>
{#if isDisabled}
<div
id="input-link-icon"
class:loading={isLoading || isBotCheckOngoing}
>
{#if isLoading || isBotCheckOngoing}
<IconLoader2 />
{:else}
<IconLink />
@ -153,12 +163,14 @@
autocapitalize="off"
maxlength="512"
placeholder={$t("save.input.placeholder")}
aria-label={$t("a11y.save.link_area")}
aria-label={isBotCheckOngoing
? $t("a11y.save.link_area.turnstile")
: $t("a11y.save.link_area")}
data-form-type="other"
disabled={isDisabled}
/>
{#if $link}
{#if $link && !isLoading}
<ClearButton click={() => ($link = "")} />
{/if}
{#if validLink($link)}
@ -166,6 +178,7 @@
url={$link}
bind:this={downloadButton}
bind:disabled={isDisabled}
bind:loading={isLoading}
/>
{/if}
</div>

View file

@ -10,6 +10,7 @@
export let url: string;
export let disabled = false;
export let loading = false;
$: buttonText = ">>";
$: buttonAltText = $t("a11y.save.download");
@ -31,6 +32,7 @@
const changeDownloadButton = (state: DownloadButtonState) => {
disabled = state !== "idle";
loading = state === "think" || state === "check";
buttonText = {
idle: ">>",
@ -86,6 +88,7 @@
return downloadFile({
url: response.url,
urlType: "redirect",
});
}

View file

@ -122,5 +122,6 @@
.button-row {
display: flex;
gap: var(--padding);
flex-wrap: wrap;
}
</style>

View file

@ -1,6 +1,8 @@
<script lang="ts">
import { page } from "$app/stores";
import { t } from "$lib/i18n/translations";
import { copyURL as _copyURL } from "$lib/download";
import SectionHeading from "$components/misc/SectionHeading.svelte";
export let title: string;
export let sectionId: string;
@ -9,12 +11,19 @@
export let beta = false;
let focus = false;
let copied = false;
$: hash = $page.url.hash.replace("#", "");
$: if (hash === sectionId) {
focus = true;
}
$: if (copied) {
setTimeout(() => {
copied = false;
}, 1500);
}
</script>
<section
@ -24,12 +33,7 @@
class:disabled
aria-hidden={disabled}
>
<div class="settings-content-header">
<h3 class="settings-content-title">{title}</h3>
{#if beta}
<div class="beta-label">{$t("general.beta")}</div>
{/if}
</div>
<SectionHeading {title} {sectionId} {beta} />
<slot></slot>
</section>
@ -82,27 +86,6 @@
}
}
.settings-content-header {
display: flex;
flex-direction: row;
flex-wrap: wrap;
gap: 8px;
}
.beta-label {
display: flex;
justify-content: center;
align-items: center;
border-radius: 5px;
padding: 0 5px;
background: var(--secondary);
color: var(--primary);
font-size: 11px;
font-weight: 500;
line-height: 0;
text-transform: uppercase;
}
@media screen and (max-width: 750px) {
.settings-content {
padding: var(--padding);

View file

@ -70,7 +70,6 @@
#sidebar-tabs {
height: 100%;
width: var(--sidebar-width);
justify-content: space-between;
padding: var(--sidebar-inner-padding);
padding-bottom: var(--border-radius);
@ -110,7 +109,6 @@
overflow-x: scroll;
padding-bottom: 0;
padding: var(--sidebar-inner-padding) 0;
width: unset;
height: fit-content;
}

View file

@ -28,11 +28,6 @@
$: if (isTabActive && tab) {
showTab(tab);
tab.classList.add("animate");
setTimeout(() => {
tab.classList.remove("animate");
}, 250);
}
</script>
@ -59,11 +54,11 @@
flex-direction: column;
align-items: center;
text-align: center;
gap: 5px;
padding: var(--padding) 5px;
gap: 3px;
padding: var(--padding) 3px;
color: var(--sidebar-highlight);
font-size: var(--sidebar-font-size);
opacity: 0.8;
opacity: 0.75;
height: fit-content;
border-radius: var(--border-radius);
transition: transform 0.2s;
@ -72,12 +67,14 @@
text-decoration-line: none;
position: relative;
scroll-behavior: smooth;
cursor: pointer;
}
.sidebar-tab :global(svg) {
stroke-width: 1.2px;
height: 21px;
width: 21px;
height: 22px;
width: 22px;
}
:global([data-iphone="true"] .sidebar-tab svg) {
@ -88,19 +85,17 @@
color: var(--sidebar-bg);
background: var(--sidebar-highlight);
opacity: 1;
transition: none;
transform: none;
transition: none;
animation: pressButton 0.3s;
cursor: default;
}
:global(.sidebar-tab.animate) {
animation: pressButton 0.2s;
}
.sidebar-tab:active:not(.active) {
.sidebar-tab:not(.active):active {
transform: scale(0.95);
}
:global([data-reduce-motion="true"]) .sidebar-tab:active:not(.active) {
:global([data-reduce-motion="true"]) .sidebar-tab:active {
transform: none;
}
@ -112,10 +107,10 @@
@keyframes pressButton {
0% {
transform: scale(0.95);
transform: scale(0.9);
}
50% {
transform: scale(1.02);
transform: scale(1.015);
}
100% {
transform: scale(1);
@ -127,6 +122,7 @@
opacity: 1;
background-color: var(--sidebar-hover);
}
.sidebar-tab:hover:not(.active) {
opacity: 1;
background-color: var(--sidebar-hover);
@ -149,10 +145,10 @@
@keyframes pressButton {
0% {
transform: scale(0.9);
transform: scale(0.8);
}
60% {
transform: scale(1.015);
50% {
transform: scale(1.02);
}
100% {
transform: scale(1);

View file

@ -73,7 +73,10 @@
</h3>
{:else}
{#if pageSubtitle}
<div class="subtext subnav-subtitle">
<div
class="subtext subnav-subtitle"
class:hidden={pageSubtitle === "\xa0"}
>
{pageSubtitle}
</div>
{/if}
@ -89,7 +92,10 @@
>
<slot name="navigation"></slot>
{#if isMobile && isHome && pageSubtitle}
<div class="subtext subnav-subtitle center">
<div
class="subtext subnav-subtitle center"
class:hidden={pageSubtitle === "\xa0"}
>
{pageSubtitle}
</div>
{/if}
@ -132,7 +138,7 @@
}
.subnav-page-content.wide {
max-width: 800px;
max-width: 700px;
}
.subnav-page-content.padding {
@ -170,6 +176,11 @@
.subnav-subtitle {
padding: 0;
transition: opacity 0.1s;
}
.subnav-subtitle.hidden {
opacity: 0;
}
.subnav-subtitle.center {

View file

@ -47,6 +47,8 @@
text-decoration: none;
text-decoration-line: none;
cursor: pointer;
}
.subnav-tab-left {
@ -93,6 +95,7 @@
.subnav-tab.active {
background: var(--secondary);
color: var(--primary);
cursor: default;
}
.subnav-tab-text {

View file

@ -1,12 +1,16 @@
import { get } from "svelte/store";
import settings from "$lib/state/settings";
import lazySettingGetter from "$lib/settings/lazy-get";
import { getSession } from "$lib/api/session";
import { currentApiURL } from "$lib/api/api-url";
import { turnstileLoaded } from "$lib/state/turnstile";
import { apiOverrideWarning } from "$lib/api/safety-warning";
import { cachedInfo, getServerInfo } from "$lib/api/server-info";
import type { Optional } from "$lib/types/generic";
import type { CobaltAPIResponse, CobaltErrorResponse } from "$lib/types/api";
import lazySettingGetter from "$lib/settings/lazy-get";
const request = async (url: string) => {
const getSetting = lazySettingGetter(get(settings));
@ -34,11 +38,32 @@ const request = async (url: string) => {
await apiOverrideWarning();
const usingCustomInstance = getSetting("processing", "enableCustomInstances")
&& getSetting("processing", "customInstanceURL");
await getServerInfo();
const getCachedInfo = get(cachedInfo);
if (!getCachedInfo) {
return {
status: "error",
error: {
code: "error.api.unreachable"
}
} as CobaltErrorResponse;
}
if (getCachedInfo?.info?.cobalt?.turnstileSitekey && !get(turnstileLoaded)) {
return {
status: "error",
error: {
code: "error.captcha_ongoing"
}
} as CobaltErrorResponse;
}
const api = currentApiURL();
// FIXME: rewrite this to allow custom instances to specify their own turnstile tokens
const session = usingCustomInstance ? undefined : await getSession();
const session = getCachedInfo?.info?.cobalt?.turnstileSitekey
? await getSession() : undefined;
let extraHeaders = {}

View file

@ -1,3 +1,5 @@
import { browser } from "$app/environment";
import { get, writable } from "svelte/store";
import { currentApiURL } from "$lib/api/api-url";
@ -50,6 +52,17 @@ export const getServerInfo = async () => {
info: freshInfo,
origin: currentApiURL(),
});
/*
reload the page if turnstile sitekey changed.
there's no other proper way to do this, at least i couldn't find any :(
*/
if (cache?.info?.cobalt?.turnstileSitekey && freshInfo?.cobalt?.turnstileSitekey) {
if (browser) {
window.location.reload();
}
}
return true;
}

View file

@ -4,16 +4,31 @@ import settings from "$lib/state/settings";
import { device } from "$lib/device";
import { t } from "$lib/i18n/translations";
import { createDialog } from "$lib/dialogs";
import type { DialogInfo } from "$lib/types/dialog";
const openSavingDialog = ({ url, file, body }: { url?: string, file?: File, body?: string }) => {
import type { DialogInfo } from "$lib/types/dialog";
import type { CobaltFileUrlType } from "$lib/types/api";
type DownloadFileParams = {
url?: string,
file?: File,
urlType?: CobaltFileUrlType,
}
type SavingDialogParams = {
url?: string,
file?: File,
body?: string,
urlType?: CobaltFileUrlType,
}
const openSavingDialog = ({ url, file, body, urlType }: SavingDialogParams) => {
const dialogData: DialogInfo = {
type: "saving",
id: "saving",
file,
url,
urlType,
}
if (body) dialogData.bodyText = body;
@ -60,13 +75,13 @@ export const copyURL = async (url: string) => {
return await navigator?.clipboard?.writeText(url);
}
export const downloadFile = ({ url, file }: { url?: string, file?: File }) => {
export const downloadFile = ({ url, file, urlType }: DownloadFileParams) => {
if (!url && !file) throw new Error("attempted to download void");
const pref = get(settings).save.savingMethod;
if (pref === "ask") {
return openSavingDialog({ url, file });
return openSavingDialog({ url, file, urlType });
}
/*
@ -85,6 +100,7 @@ export const downloadFile = ({ url, file }: { url?: string, file?: File }) => {
url,
file,
body: get(t)("dialog.saving.timeout"),
urlType
});
}
@ -100,7 +116,8 @@ export const downloadFile = ({ url, file }: { url?: string, file?: File }) => {
if (url) {
if (pref === "share" && device.supports.share) {
return shareURL(url);
} else if (pref === "download" && device.supports.directDownload) {
} else if (pref === "download" && device.supports.directDownload
&& !(device.is.iOS && urlType === "redirect")) {
return openURL(url);
} else if (pref === "copy" && !file) {
return copyURL(url);
@ -108,5 +125,5 @@ export const downloadFile = ({ url, file }: { url?: string, file?: File }) => {
}
} catch { /* catch & ignore */ }
return openSavingDialog({ url, file });
return openSavingDialog({ url, file, urlType });
}

View file

@ -14,7 +14,6 @@ const variables = {
PLAUSIBLE_HOST: getEnv('PLAUSIBLE_HOST'),
PLAUSIBLE_ENABLED: getEnv('HOST') && getEnv('PLAUSIBLE_HOST'),
DEFAULT_API: getEnv('DEFAULT_API'),
TURNSTILE_KEY: getEnv('TURNSTILE_KEY'),
}
const contacts = {

View file

@ -1 +1,2 @@
import "./polyfills/user-activation";
import "./polyfills/abortsignal-timeout";

View file

@ -0,0 +1,10 @@
import { browser } from "$app/environment";
if (browser && 'AbortSignal' in window && !window.AbortSignal.timeout) {
window.AbortSignal.timeout = (milliseconds: number) => {
const controller = new AbortController();
setTimeout(() => controller.abort("timed out"), milliseconds);
return controller.signal;
}
}

View file

@ -40,6 +40,8 @@ type CobaltTunnelResponse = {
status: CobaltResponseType.Tunnel,
} & CobaltPartialURLResponse;
export type CobaltFileUrlType = "redirect" | "tunnel";
export type CobaltSession = {
token: string,
exp: number,
@ -51,6 +53,7 @@ export type CobaltServerInfo = {
url: string,
startTime: string,
durationLimit: number,
turnstileSitekey?: string,
services: string[]
},
git: {
@ -64,6 +67,6 @@ export type CobaltSessionResponse = CobaltSession | CobaltErrorResponse;
export type CobaltServerInfoResponse = CobaltServerInfo | CobaltErrorResponse;
export type CobaltAPIResponse = CobaltErrorResponse
| CobaltPickerResponse
| CobaltRedirectResponse
| CobaltTunnelResponse;
| CobaltPickerResponse
| CobaltRedirectResponse
| CobaltTunnelResponse;

View file

@ -1,3 +1,4 @@
import type { CobaltFileUrlType } from "$lib/types/api";
import type { MeowbaltEmotions } from "$lib/types/meowbalt";
export type DialogButton = {
@ -43,6 +44,7 @@ type SavingDialog = Dialog & {
bodyText?: string,
url?: string,
file?: File,
urlType?: CobaltFileUrlType,
};
export type DialogInfo = SmallDialog | PickerDialog | SavingDialog;

View file

@ -7,6 +7,7 @@
import { updated } from "$app/stores";
import { browser } from "$app/environment";
import { afterNavigate } from "$app/navigation";
import { getServerInfo, cachedInfo } from "$lib/api/server-info";
import "$lib/polyfills";
import env from "$lib/env";
@ -31,10 +32,16 @@
$settings.appearance.reduceTransparency ||
device.prefers.reducedTransparency;
afterNavigate(() => {
$: spawnTurnstile = !!$cachedInfo?.info?.cobalt?.turnstileSitekey;
afterNavigate(async() => {
const to_focus: HTMLElement | null =
document.querySelector("[data-first-focus]");
to_focus?.focus();
if ($page.url.pathname === "/") {
await getServerInfo();
}
});
</script>
@ -77,7 +84,7 @@
<DialogHolder />
<Sidebar />
<div id="content">
{#if (env.TURNSTILE_KEY && $page.url.pathname === "/") || $turnstileCreated}
{#if (spawnTurnstile && $page.url.pathname === "/") || $turnstileCreated}
<Turnstile />
{/if}
<slot></slot>
@ -485,6 +492,14 @@
margin-block-start: 0.3em;
}
:global(.long-text-noto.about .heading-container) {
padding-top: calc(var(--padding) / 2);
}
:global(.long-text-noto.about section:first-of-type .heading-container) {
padding-top: 0;
}
@media screen and (max-width: 535px) {
:global(.long-text-noto),
:global(.long-text-noto *:not(h1, h2, h3, h4, h5, h6)) {

View file

@ -0,0 +1,21 @@
export function GET() {
const _headers = {
"/*": {
"Cross-Origin-Opener-Policy": "same-origin",
"Cross-Origin-Embedder-Policy": "require-corp",
}
}
return new Response(
Object.entries(_headers).map(
([path, headers]) => [
path,
Object.entries(headers).map(
([key, value]) => ` ${key}: ${value}`
)
].flat().join("\n")
).join("\n\n")
);
}
export const prerender = true;

View file

@ -0,0 +1,6 @@
<script lang="ts">
import type { PageData } from './$types';
export let data: PageData;
</script>
<svelte:component this={data.component} />

View file

@ -0,0 +1,29 @@
import type { ComponentType, SvelteComponent } from 'svelte';
import { get } from 'svelte/store';
import { error } from '@sveltejs/kit';
import type { PageLoad } from './$types';
import locale from '$lib/i18n/locale';
import type { DefaultImport } from '$lib/types/generic';
import { defaultLocale } from '$lib/i18n/translations';
const pages = import.meta.glob('$i18n/*/about/*.md');
export const load: PageLoad = async ({ params }) => {
const getPage = (locale: string) => Object.keys(pages).find(
file => file.endsWith(`${locale}/about/${params.page}.md`)
);
const componentPath = getPage(get(locale)) || getPage(defaultLocale);
if (componentPath) {
type Component = ComponentType<SvelteComponent>;
const componentImport = pages[componentPath] as DefaultImport<Component>;
return { component: (await componentImport()).default }
}
error(404, 'Not found');
};
export const prerender = true;

View file

@ -1,41 +0,0 @@
<script lang="ts">
import { contacts, docs } from "$lib/env";
import OuterLink from "$components/misc/OuterLink.svelte";
</script>
<div id="credits-body" class="long-text-noto about">
<section id="meowbalt">
<h3>meowbalt</h3>
<p>
meowbalt is cobalt's speedy mascot. he is an extremely expressive cat that loves fast internet.
</p>
<p>
all amazing drawings of meowbalt that you see in cobalt were made by
<OuterLink href="https://glitchypsi.xyz/">GlitchyPSI</OuterLink>.
he is also the original designer of the character.
</p>
<p>
you cannot use or modify GlitchyPSI's artworks of meowbalt without his explicit permission.
</p>
<p>
you cannot use or modify the meowbalt character design commercially or in any form that isn't fan art.
</p>
</section>
<section id="licenses">
<h3>cobalt licenses</h3>
<p>
cobalt processing server is open source and licensed under <OuterLink href={docs.apiLicense}>AGPL-3.0</OuterLink>.
</p>
<p>
cobalt frontend is
<OuterLink href="https://sourcefirst.com/">source first</OuterLink>
and licensed under
<OuterLink href={docs.webLicense}>CC-BY-NC-SA 4.0</OuterLink>.
we decided to use this license to stop grifters from profiting off our work & from creating malicious clones that deceive people and hurt our public identity.
</p>
<p>
we rely on many open source libraries, create & distribute our own.
you can see the full list of dependencies on <OuterLink href={contacts.github}>github</OuterLink>.
</p>
</section>
</div>

View file

@ -1,87 +0,0 @@
<script lang="ts">
import { partners, contacts, docs } from "$lib/env";
import OuterLink from "$components/misc/OuterLink.svelte";
</script>
<div id="privacy-body" class="long-text-noto about">
<section id="saving">
<h3>best way to save what you love</h3>
<p>
cobalt lets you save anything from your favorite websites: video, audio, photos or gifs — cobalt can do it all!
</p>
<p>
no ads, trackers, or paywalls, no nonsense. just a convenient web app that works everywhere.
</p>
</section>
<section id="privacy">
<h3>leading privacy</h3>
<p>
all requests to backend are anonymous and all tunnels are encrypted.
we have a strict zero log policy and don't track <i>anything</i> about individual people.
</p>
<p>
to avoid caching or storing downloaded files, cobalt processes them on-fly, sending processed pieces directly to client.
this technology is used when your request needs additional processing, such as when source service stores video & audio in separate files.
</p>
<p>
for even higher level of protection, you can <a href="/settings/privacy#tunnel">ask cobalt to always tunnel everything</a>.
when enabled, cobalt will proxy everything through itself. no one will know what you download, even your network provider/admin.
all they'll see is that you're using cobalt.
</p>
</section>
<section id="speed">
<h3>blazing speed</h3>
<p>
since we don't rely on any existing downloaders and develop our own from ground up,
cobalt is extremely efficient and a processing server can run on basically any hardware.
</p>
<p>
main processing instances are hosted on several dedicated servers in several countries,
to reduce latency and distribute the traffic.
</p>
<p>
we constantly improve our infrastructure along with our long-standing partner,
<OuterLink href="{partners.royalehosting}">royalehosting.net</OuterLink>!
you're in good hands, and will get what you need within seconds.
</p>
</section>
<section id="community">
<h3>open community</h3>
<p>
cobalt is used by countless artists, educators, and content creators to do what they love.
we're always on the line with our community and work together to create even more useful tools for them.
feel free to <a href="/about/community">join the conversation</a>!
</p>
<p>
we believe that the future of the internet is open,
which is why cobalt is
<OuterLink
href="https://sourcefirst.com/">
source first
</OuterLink>
and
<OuterLink href={docs.instanceHosting}>
easily self-hostable.
</OuterLink>
you can <OuterLink href="{contacts.github}">check the source code & contribute to cobalt</OuterLink>
at any time, we welcome all contributions and suggestions.
</p>
<p>
you can use any processing instances hosted by the community, including your own.
if your friend hosts one, just ask them for a domain and <a href="/settings/instances#community">add it in instance settings</a>.
</p>
</section>
<section id="local">
<h3>on-device processing</h3>
<p>
new features, such as <a href="/remux">remuxing</a>, work on-device.
on-device processing is efficient and never sends anything over the internet.
it perfectly aligns with our future goal of moving as much processing as possible to client.
</p>
</section>
</div>

View file

@ -1,81 +0,0 @@
<script lang="ts">
import env from "$lib/env";
import { t } from "$lib/i18n/translations";
import OuterLink from "$components/misc/OuterLink.svelte";
</script>
<div id="privacy-body" class="long-text-noto about">
<section id="general">
<h3>general terms</h3>
<p>
cobalt's privacy policy is simple: we don't collect or store anything about you. what you do is solely your business, not ours or anyone else's.
</p>
<p>
these terms are applicable only when using the official cobalt instance. in other cases, you may need to contact the hoster for accurate info.
</p>
</section>
<section id="local">
<h3>on-device processing</h3>
<p>
tools that use on-device processing work offline, locally, and never send any data anywhere. they are explicitly marked as such whenever applicable.
</p>
</section>
<section id="saving">
<h3>saving</h3>
<p>
when using saving functionality, in some cases cobalt will encrypt & temporarily store information needed for tunneling. it's stored in processing server's RAM for 90 seconds and irreversibly purged afterwards. no one has access to it, even instance owners, as long as they don't modify the official cobalt image.
</p>
<p>
processed/tunneled files are never cached anywhere. everything is tunneled live. cobalt's saving functionality is essentially a fancy proxy service.
</p>
</section>
<section id="encryption">
<h3>encryption</h3>
<p>
temporarily stored tunnel data is encrypted using the AES-256 standard. decryption keys are only included in the access link and never logged/cached/stored anywhere. only the end user has access to the link & encryption keys. keys are generated uniquely for each requested tunnel.
</p>
</section>
{#if env.PLAUSIBLE_ENABLED}
<section id="plausible">
<h3>anonymous traffic analytics</h3>
<p>
for sake of privacy, we use
<OuterLink href="https://plausible.io/"> plausible's anonymous traffic analytics</OuterLink>
to get an approximate number of active cobalt users. no identifiable information about you or your requests is ever stored. all data is anonymized and aggregated. the plausible instance we use is hosted & managed by us.
</p>
<p>
plausible doesn't use cookies and is fully compliant with GDPR, CCPA, and PECR.
</p>
<p>
<OuterLink href="https://plausible.io/privacy-focused-web-analytics">
{$t("settings.privacy.analytics.learnmore")}
</OuterLink>
</p>
<p>
if you wish to opt out of anonymous analytics, you can do it in <a href="/settings/privacy#analytics">privacy settings</a>.
</p>
</section>
{/if}
<section id="cloudflare">
<h3>web privacy & security</h3>
<p>
we use cloudflare services for ddos & bot protection. we also use cloudflare pages for deploying & hosting the static web app. all of these are required to provide the best experience for everyone. it's the most private & reliable provider that we know of.
</p>
<p>
cloudflare is fully compliant with GDPR and HIPAA.
</p>
<p>
<OuterLink href="https://www.cloudflare.com/trust-hub/privacy-and-data-protection/">
learn more about cloudflare's dedication to privacy.
</OuterLink>
</p>
</section>
</div>

View file

@ -1,37 +0,0 @@
<div id="terms-body" class="long-text-noto about">
<section id="saving">
<section id="general">
<h3>general terms</h3>
<p>
these terms are applicable only when using the official cobalt instance. in other cases, you may need to contact the hoster for accurate info.
</p>
</section>
<h3>saving</h3>
<p>
saving functionality simplifies downloading content from the internet and takes zero liability for what the saved content is used for. processing servers work like advanced proxies and don't ever write any content to disk. everything is handled in RAM and permanently purged once the tunnel is done. we have no downloading logs and can't identify anyone.
</p>
<p>
<a href="/about/privacy">you can read more about how tunnels work in our privacy policy.</a>
</p>
</section>
<section id="responsibiliy">
<h3>responsibilities</h3>
<p>
you (end user) are responsible for what you do with our tools, how you use and distribute resulting content. please be mindful when using content of others and always credit original creators. make sure you don't violate any terms or licenses.
</p>
<p>
when used in educational purposes, always cite sources and credit original creators.
</p>
<p>
fair use and credits benefit everyone.
</p>
</section>
<section id="abuse">
<h3>reporting abuse</h3>
<p>
we have no way of detecting abusive behavior automatically, as cobalt is 100% anonymous. however, you can report such activities to us and we will do our best to comply manually: <a href="mailto:safety@imput.net">safety@imput.net</a>
</p>
</section>
</div>

View file

@ -9,7 +9,7 @@
import SettingsToggle from "$components/buttons/SettingsToggle.svelte";
</script>
<SettingsCategory sectionId="audio-format" title={$t("settings.audio.format")}>
<SettingsCategory sectionId="format" title={$t("settings.audio.format")}>
<Switcher big={true} description={$t("settings.audio.format.description")}>
{#each audioFormatOptions as value}
<SettingsButton
@ -23,8 +23,7 @@
</Switcher>
</SettingsCategory>
<SettingsCategory sectionId="audio-bitrate" title={$t("settings.audio.bitrate")}>
<SettingsCategory sectionId="bitrate" title={$t("settings.audio.bitrate")}>
<Switcher big={true} description={$t("settings.audio.bitrate.description")}>
{#each audioBitrateOptions as value}
<SettingsButton

View file

@ -45,7 +45,7 @@
</SettingsCategory>
<SettingsCategory
sectionId="disable-metadata"
sectionId="metadata"
title={$t("settings.metadata.file")}
>
<SettingsToggle

View file

@ -17,7 +17,7 @@
</script>
<SettingsCategory
sectionId="video-quality"
sectionId="quality"
title={$t("settings.video.quality")}
>
<Switcher big={true} description={$t("settings.video.quality.description")}>
@ -34,7 +34,7 @@
</SettingsCategory>
<SettingsCategory
sectionId="youtube-codec"
sectionId="codec"
title={$t("settings.video.youtube.codec")}
>
<Switcher

View file

@ -1,3 +0,0 @@
/*
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

View file

@ -1,8 +1,10 @@
import adapter from '@sveltejs/adapter-static';
import { mdsvex } from 'mdsvex';
import { fileURLToPath } from 'node:url';
import { dirname, join } from 'node:path';
import { sveltePreprocess } from 'svelte-preprocess';
import "dotenv/config";
import adapter from "@sveltejs/adapter-static";
import { mdsvex } from "mdsvex";
import { fileURLToPath } from "node:url";
import { dirname, join } from "node:path";
import { sveltePreprocess } from "svelte-preprocess";
/** @type {import('@sveltejs/kit').Config} */
const config = {
@ -24,10 +26,16 @@ const config = {
sveltePreprocess(),
mdsvex({
extensions: ['.md'],
layout: join(
dirname(fileURLToPath(import.meta.url)),
'/src/components/changelog/ChangelogEntryWrapper.svelte'
)
layout: {
about: join(
dirname(fileURLToPath(import.meta.url)),
'/src/components/misc/AboutPageWrapper.svelte'
),
changelogs: join(
dirname(fileURLToPath(import.meta.url)),
'/src/components/changelog/ChangelogEntryWrapper.svelte'
)
}
})
],
kit: {
@ -40,6 +48,37 @@ const config = {
precompress: false,
strict: true
}),
csp: {
mode: "hash",
directives: {
"connect-src": ["*"],
"default-src": ["none"],
"font-src": ["self"],
"style-src": ["self", "unsafe-inline"],
"img-src": ["*", "data:"],
"manifest-src": ["self"],
"worker-src": ["self"],
"object-src": ["none"],
"frame-src": [
"self",
"challenges.cloudflare.com"
],
"script-src": [
"self",
"wasm-unsafe-eval",
"challenges.cloudflare.com",
// eslint-disable-next-line no-undef
process.env.WEB_PLAUSIBLE_HOST ? process.env.WEB_PLAUSIBLE_HOST : "",
// hash of the theme preloader in app.html
"sha256-g67gIjM3G8yMbjbxyc3QUoVsKhdxgcQzCmSKXiZZo6s=",
]
}
},
env: {
publicPrefix: 'WEB_'
},

View file

@ -43,7 +43,6 @@ const exposeLibAV: PluginOption = (() => {
for (const module of modules) {
const distFolder = join(IMPUT_MODULE_DIR, module, 'dist/');
console.log(distFolder);
await cp(distFolder, assets, { recursive: true });
}
}
@ -72,7 +71,7 @@ export default defineConfig({
rollupOptions: {
output: {
manualChunks: (id) => {
if (id.includes('/web/i18n')) {
if (id.includes('/web/i18n') && id.endsWith('.json')) {
const lang = id.split('/web/i18n/')?.[1].split('/')?.[0];
if (lang) {
return `i18n_${lang}`;