its kinda possible my idea is to upload or download the files out of the .nodered directory . dowload no problem just copy but the upload is risky you have to stop nodered replace the file with a the new one and the start nodered again i dont know if it can done because the deploy button isnt a command
We are doing this in our prototypes to quickly update a flow. After upload you just restart (which is same as a deploy). What you can do for example, create a checksum of your flow and then ask the user to re-enter the sum to confirm it's the same file.
Sorry, the checksum thing doesn't really make sense.
A flow itself can be risky too. So detecting whether it's an actual flow file does not really help here. "Password protection" is the only way, I guess.
As I said, that part isn't the problem - it's solved in the linked thread. And, as @rko said, restarting the system works for this.
The question is how to get (at least some) assurance that the uploaded file is intended for use as a Node-RED Flows file.
Yes - that's the kind of thing. But this would be for Flows that have already been "approved" for distribution (as in the linked thread)
What I was thinking was some sort of "archive" or container that would contain the Flow file and its "checksum" - so the upload process would upload this "archive", decompress/unpack it, and check that the "checksum" is OK. Only then would it replace the Flows file & restart.
So the question is how to do that packaging/unpacking & checking in Node-RED.
Have a look at the Code from Node-RED, hope I found the right bit where a flow is being validated before an import into the editor. Maybe you can re-use some or all of this. I am also not sure if there is a validation "feature" somewhere already .. you have to ask the experts.
I am planning to invest some time to improve the update procedure because it is a real time-saver, especially if the Node-RED system is far away and only the customer has access to it. But unfortunately I have to finish some other work first.
In my case, the customer should only be uploading files that have been provided, so they should already be validated as "good" for Node-RED.
So the issue really is to just make sure they don't "accidentally" load something that isn't a provided file.
I guess I really only need some distinct text string within the file ...
Yes, I think then you could add another json object along with flow object and your import procedure should check if it's there. Uploading something else will fail, because the mentioned bit is missing. Or you just add something into your flow to make life easier (and keep it a valid flow file).