@3sln/trove 0.0.11 → 0.0.13

package/packages/core/src/vfs.js

@@ -119,16 +119,15 @@ export class Vfs {
     this.uploads = new UploadManager({
       storageFor: (cid) => this.storageFor(cid),
       sessions: uploadSessions,
-      // What a collection encrypts and the key for it. Only the CollectionService knows,
-      // and only it is allowed to hand the key out — see collections/index.js.
-      encryptionFor: async (cid) => {
-        if (!this.collections?.encryptionFor) return null;
-        const encryption = await this.collections.encryptionFor(cid);
-        if (!encryption?.enabled) return null;
-        const key = await this.collections.dataKeyFor(cid);
-        if (!key) return null;
-        return { encryption, dataKeyHex: toHex(key) };
-      },
+      // ONE implementation of "does this item get sealed, and with what" — the same method
+      // `writeFile` uses, so a collection with per-item rules answers identically whichever
+      // way the bytes arrive, and both paths fail CLOSED when the key is missing.
+      sealingFor: (cid, name, contentType) => this.#sealingFor(cid, name, contentType),
+      // The key a fingerprint names, so an upload seals its later parts with the key it
+      // decided on rather than with whatever became current meanwhile. Only the
+      // CollectionService knows it, and only it is allowed to hand it out.
+      keyFor: async (cid, fingerprint) =>
+        (this.collections?.dataKeyFor ? this.collections.dataKeyFor(cid, fingerprint) : null),
       maxBytes: maxUploadBytes,
       partSize: uploadPartSize,
     });
@@ -177,7 +176,12 @@ export class Vfs {
     if (!shouldEncrypt(encryption, { name, contentType })) return null;
     const key = await this.collections.dataKeyFor(collectionId);
     if (!key) throw TroveError.internal('This collection is encrypted but its key is unavailable');
-    return { key, fingerprint: fromHex(encryption.fingerprint), chunkSize: encryption.chunkSize || DEFAULT_CHUNK_SIZE };
+    // `DEFAULT_CHUNK_SIZE`, not `encryption.chunkSize`. A collection cannot choose one:
+    // `normalizeEncryption` emits exactly `{ enabled, fingerprint, rules }` and every
+    // writer of `c.encryption` goes through it, so the field was structurally always
+    // undefined and the `||` read as a knob that could be turned. The per-OBJECT chunk
+    // size is real and separate — the envelope writes it, and reads take it from there.
+    return { key, fingerprint: fromHex(encryption.fingerprint), chunkSize: DEFAULT_CHUNK_SIZE };
   }
 
   /** Resolve the storage backend for a collection. */
@@ -476,8 +480,11 @@ export class Vfs {
   async #note(kind, subject, title, err) {
     try {
       await this.issues?.raise({
+        // No `retryable`: `raise` builds a fixed field set and never reads one, and the
+        // route recomputes it from whether a handler is registered for `retry.op`. A field
+        // that is written, ignored and then contradicted is worse than no field.
         kind, subject, severity: 'warning', title,
-        detail: err?.message || String(err), retryable: false,
+        detail: err?.message || String(err),
       });
     } catch { /* the issue registry is itself best-effort here */ }
   }
@@ -536,25 +543,25 @@ export class Vfs {
 
   // --- download --------------------------------------------------------------
 
-  async getDownload(id, { expiresIn, download, ciphertext = false } = {}) {
+  /**
+   * May the download route hand this object straight to the store?
+   *
+   * A PREDICATE rather than a second download implementation. `getDownload` used to
+   * encode the presign-or-proxy rule here while `mintUrl` encoded it two hundred lines
+   * away, and they disagreed: mintUrl presigned whenever the store COULD and never asked
+   * whether the object was sealed, so on any encrypted collection with a presigning store
+   * every thumbnail, preview and externally-handed URL pointed at CIPHERTEXT. That
+   * incident report is server/test/mint-url-encryption.test.js.
+   *
+   * An encrypted object is never redirected to. A redirect hands the caller raw ciphertext
+   * and most callers of a download URL can do nothing with it — an `<img src>`, a `<video
+   * src>`, a signed URL given to an external service. Proxying is the answer that is always
+   * correct.
+   */
+  async canRedirect(id) {
     const node = await this.resolve(id);
-    const storage = await this.storageFor(node.collectionId);
-    // An encrypted object is not redirected to by default. A redirect hands the caller raw
-    // ciphertext, and most callers of a download URL cannot do anything with it — an <img
-    // src>, a <video src>, a signed URL given to an external service. Proxying is the
-    // answer that is always correct, so it is the default; a client that holds the key and
-    // knows it can decrypt asks for `ciphertext` and gets the direct path back.
-    if (node.encryption && !ciphertext) return { mode: 'proxy', node };
-    if (storage.capabilities.presignDownload) {
-      const url = await storage.presignGet(node.storageKey, {
-        expiresIn, responseContentType: node.contentType,
-        downloadName: download ? node.name : undefined,
-      });
-      // Named on the way out so a client that asked for ciphertext knows which key opens
-      // what it is about to receive.
-      return { mode: 'redirect', url, node, encryption: node.encryption || null };
-    }
-    return { mode: 'proxy', node };
+    if (node.encryption) return false;
+    return !!(await this.storageFor(node.collectionId)).capabilities?.presignDownload;
   }
 
   /**
@@ -576,8 +583,9 @@ export class Vfs {
     const node = await this.resolve(id);
     if (!node.storageKey) throw TroveError.notFound('File content');
     const storage = await this.storageFor(node.collectionId);
-    // An ENCRYPTED object is never presigned to the store — the same rule `getDownload`
-    // already follows, and the one place it was missing. A bucket URL serves CIPHERTEXT,
+    // An ENCRYPTED object is never presigned to the store. This is now the ONE place that
+    // rule is written — `getDownload` held a second copy and this was the copy that was
+    // missing the guard, which is how it shipped. A bucket URL serves CIPHERTEXT,
     // and everything a minted URL exists for (an <img src>, a <video src>, cache.add(), a
     // URL handed to an external service) fetches bytes with nowhere to run decryption. So
     // every thumbnail and preview in an encrypted collection on a presigning store pointed
@@ -611,8 +619,25 @@ export class Vfs {
     return { url: `${base}/api/items/download?${q}`, expiresAt: g.expiresAt, node, signed: 'trove' };
   }
 
-  async readStream(id, { range, signal } = {}) {
-    const node = await this.resolve(id);
+  async readStream(id, opts = {}) {
+    return this.readNode(await this.resolve(id), opts);
+  }
+
+  /**
+   * Read a node the caller has ALREADY resolved.
+   *
+   * The trash guard belongs to resolution, not to reading: `resolve` refuses a trashed
+   * item so a deleted file cannot answer a download-by-id, and that is the whole of the
+   * rule. Reading is mechanical — a storage key, an envelope, a key ring.
+   *
+   * Key rotation is the caller that needs the distinction. A trashed object keeps its
+   * bytes and is still sealed with whatever key sealed it, so the rotation must move it
+   * before that key can be retired; it reaches those nodes through `listSealed`, which
+   * spans the trash on purpose. Going around this and reading storage directly would put
+   * a second copy of the envelope/range/key-ring logic in the rotation, which is the one
+   * thing this file has spent the most comments arguing against.
+   */
+  async readNode(node, { range, signal } = {}) {
     if (!node.storageKey) throw TroveError.notFound('File content');
     const storage = await this.storageFor(node.collectionId);
     if (!node.encryption) return storage.get(node.storageKey, { range, signal });

package/packages/plugin-sdk/src/browser.js

@@ -42,6 +42,116 @@
   }
   const emit = (method, params) => port.postMessage({ __trove: 'event', method, params });
 
+  /**
+   * A file's bytes, addressable without holding them.
+   *
+   * `Blob` is already the browser's interface for exactly that — `slice()` is free,
+   * `stream()` is a reader, and everything that eats bytes eats a Blob — so a range reader
+   * wears the interface that exists rather than inventing a parallel vocabulary.
+   *
+   * THE SHARP EDGE, and it is sharp: a Blob SUBCLASS only overrides what JavaScript calls.
+   * Anything reading the blob's internal bytes — `URL.createObjectURL`, `new
+   * Response(blob)`, `fetch(url, {body})`, and structured clone through `postMessage` —
+   * bypasses every override here and sees the empty blob passed to `super()`. Two
+   * consequences the design is built around:
+   *
+   *   1. A RemoteBlob cannot be posted INTO this frame from the host; it would arrive as a
+   *      plain, empty Blob. It is constructed here, in the frame that uses it.
+   *   2. `local()` is the escape hatch for all of them. A realized Blob really does hold
+   *      its bytes, so it works with `createObjectURL` — which is the download-then-play
+   *      path for anything that cannot be streamed.
+   */
+  class RemoteBlob extends Blob {
+    constructor(id, { size = 0, type = '', etag = null, start = 0, end = null } = {}) {
+      super();
+      this.id = id;
+      this.type = type;
+      this.etag = etag;
+      // A window on the source. `size` is this window's length, which is what makes
+      // `slice()` of a slice behave the way a caller expects.
+      this._start = start;
+      this._end = end == null ? size : end;
+    }
+
+    get size() { return Math.max(0, this._end - this._start); }
+
+    /**
+     * A window on the same source. No bytes move and none need to exist yet.
+     *
+     * Negative indices count from the end, as `Blob.slice` does — which is what makes
+     * "the last 64 KiB" expressible, and reading the tail of a file is half of what a
+     * container parser does.
+     */
+    slice(begin = 0, finish = this.size, type = this.type) {
+      const len = this.size;
+      const from = begin < 0 ? Math.max(0, len + begin) : Math.min(begin, len);
+      const to = finish < 0 ? Math.max(0, len + finish) : Math.min(finish, len);
+      const win = new RemoteBlob(this.id, {
+        type, etag: this.etag,
+        start: this._start + from,
+        end: this._start + Math.max(from, to),
+      });
+      return win;
+    }
+
+    /**
+     * The bytes of this window.
+     *
+     * A `signal` is checked BEFORE the call and not during it: an in-flight request over
+     * the port cannot be recalled, so the honest granularity is per read. `chunks()` is
+     * where cancelling actually bites, because there the reads are small and there are
+     * many of them.
+     */
+    async bytes({ signal } = {}) {
+      if (signal && signal.aborted) throw new Error('Aborted');
+      const r = await call('files:bytes', { id: this.id, start: this._start, end: this._end });
+      // Every read refreshes the etag, because a file overwritten in place keeps its id
+      // and anything cached off these bytes has to notice.
+      if (r.etag) this.etag = r.etag;
+      return new Uint8Array(r.bytes);
+    }
+    async arrayBuffer() { return (await this.bytes()).buffer; }
+    async text() { return new TextDecoder().decode(await this.bytes()); }
+
+    /** One window at a time, so a caller can walk a large file without holding it. */
+    async *chunks({ size = 4 * 1024 * 1024, signal } = {}) {
+      for (let at = 0; at < this.size; at += size) {
+        yield this.slice(at, Math.min(at + size, this.size)).bytes({ signal });
+      }
+    }
+
+    stream() {
+      const iter = this.chunks();
+      return new ReadableStream({
+        async pull(controller) {
+          const { value, done } = await iter.next();
+          if (done) controller.close();
+          else controller.enqueue(value);
+        },
+      });
+    }
+
+    /**
+     * REALIZE the bytes into an ordinary Blob.
+     *
+     * The escape hatch named above, and the download half of "this book cannot be
+     * streamed, here is a Download button". `onProgress` fires once with `loaded: 0`
+     * BEFORE the first chunk, so a bar appears at 0% instead of jumping in partway.
+     */
+    async local({ onProgress, signal, chunkSize = 4 * 1024 * 1024 } = {}) {
+      const total = this.size;
+      const parts = [];
+      let loaded = 0;
+      if (onProgress) onProgress({ loaded: 0, total, ratio: 0 });
+      for await (const chunk of this.chunks({ size: chunkSize, signal })) {
+        parts.push(chunk);
+        loaded += chunk.length;
+        if (onProgress) onProgress({ loaded, total, ratio: total ? loaded / total : 0 });
+      }
+      return new Blob(parts, { type: this.type });
+    }
+  }
+
   // What this frame reports about itself on every heartbeat. Contributions are the
   // host's own manifest reading — all the plugin can usefully say is which of its
   // declared contributions it actually bound a handler to, plus whether it thinks
@@ -259,9 +369,54 @@
         list: (pathOrId, opts) => (requireCap('files'), call('files:list', Object.assign({ pathOrId }, opts))),
         stat: (id) => (requireCap('files'), call('files:stat', { id })),
         downloadUrl: (id) => (requireCap('files'), call('files:downloadUrl', { id })),
+
+        /**
+         * A file's bytes as a Blob you can slice, stream and realize — see RemoteBlob.
+         *
+         * `stat` first, because a Blob has to know its own size before `slice` means
+         * anything. One round trip, and every later read is a range.
+         */
+        async blob(id) {
+          requireCap('files');
+          const { node } = await call('files:stat', { id });
+          return new RemoteBlob(id, { size: node.size || 0, type: node.contentType || '', etag: node.etag || null });
+        },
+
+        /**
+         * A URL a media element can load by itself, for streaming.
+         *
+         * It is MINTED — it carries its own grant and expires — which is the one place a
+         * host URL deliberately reaches a plugin. `<audio src>` is the only way to play a
+         * progressive MP4 without a fragmenter: MSE refuses one, and a Blob has to be
+         * whole before it can become an object URL. Use `blob(id)` for the parsing (a
+         * container's chapters are a few kilobytes out of a few hundred megabytes) and
+         * this for the playing.
+         */
+        mediaUrl: (id, opts) => (requireCap('files'), call('files:mediaUrl', Object.assign({ id }, opts))),
+
+        /**
+         * Keeping a file, which is a DIFFERENT act from reading one.
+         *
+         * Ranging over a file stores nothing. `start(id)` is someone asking to have it
+         * offline, and from then on every chunk a read fetches is kept and the background
+         * filler skips it — so a book listened straight through downloads itself exactly
+         * once, and a book skipped around in fills its gaps.
+         */
+        offline: {
+          start: (id) => (requireCap('files'), call('files:offline:start', { id })),
+          status: (id) => (requireCap('files'), call('files:offline:status', { id })),
+          cancel: (id) => (requireCap('files'), call('files:offline:cancel', { id })),
+          remove: (id) => (requireCap('files'), call('files:offline:remove', { id })),
+        },
         // index(indexerId, nodeId, contribution) where contribution is
         // { semanticTexts?, tags?, metadata? }. Legacy (indexerId, nodeId, documents[], facet)
         // is still accepted when the 3rd arg is an array of documents.
+        //
+        // "Contribution" here is per-node ENRICHMENT — what an indexer says ABOUT a file,
+        // addressed by contributorId. It is a different noun from the `contributes` map in
+        // your manifest, which declares extension points addressed by URI. A plugin
+        // declares an `indexer` contribution (that sense) and it produces contributions
+        // (this sense).
         index: (indexerId, nodeId, contribution, facet) => {
           requireCap('indexer');
           var payload = Array.isArray(contribution) ? { documents: contribution, facet: facet } : (contribution || {});

package/packages/plugin-sdk/src/protocol.js

@@ -41,7 +41,19 @@ export const METHODS = {
   // its `commands` allowlist) to run someone else's. The direction disambiguates.
   command: { execute: 'command:execute' },
   resources: { list: 'resources:list', read: 'resources:read' },
-  files: { read: 'files:read', list: 'files:list', stat: 'files:stat', downloadUrl: 'files:downloadUrl', index: 'files:index' },
+  files: {
+    read: 'files:read', list: 'files:list', stat: 'files:stat', downloadUrl: 'files:downloadUrl',
+    index: 'files:index',
+    // Bytes by range — the only way a viewer gets binary content at all, since `read`
+    // answers text and a sandboxed frame cannot authenticate a bare download URL.
+    bytes: 'files:bytes',
+    // A minted URL for a media element. See pluginRpc.js for why this one host URL crosses.
+    mediaUrl: 'files:mediaUrl',
+    offline: {
+      start: 'files:offline:start', status: 'files:offline:status',
+      cancel: 'files:offline:cancel', remove: 'files:offline:remove',
+    },
+  },
   net: { fetch: 'net:fetch' },
   storage: { sql: 'storage:sql' },
   settings: { get: 'settings:get', set: 'settings:set', getSecret: 'settings:getSecret' },

package/packages/server/src/access/externalEvaluation.js

@@ -35,6 +35,18 @@
 //        Evaluate URL   https://<your drive>/api/access/evaluate
 //        Keys URL       https://<your drive>/api/access/keys
 //
+//   4. AND let Access reach them. If the drive sits behind Access — which is the whole
+//      point — then by default these two paths do as well, and Access would have to
+//      authenticate to itself to call them. It cannot, so it fails with nothing useful to
+//      say. Add a Bypass policy for `/api/access/*`.
+//
+//      Bypassing is safe here rather than a concession, and that is by construction: the
+//      keys endpoint serves a public key, and the evaluate endpoint authenticates its
+//      caller itself by verifying the assertion. Neither ever depended on Access for its
+//      own protection. They are also `public: true`, so this drive's OWN identity
+//      requirement does not apply to them either — Access holds no Trove session and
+//      never will.
+//
 // WHY IT REFUSES TO RUN UNVERIFIED
 //
 // This endpoint answers "does this email have access to this drive". That is a question
@@ -116,6 +128,10 @@ export function externalEvaluation({ privateJwk, team, kid = 'trove-access', jwk
           method: 'POST',
           path: '/api/access/evaluate',
           deps: ['collections'],
+          // No Trove identity: the caller is Cloudflare, not a user of this drive, and it
+          // authenticates by signing the assertion — which `verifyJwt` below checks. A
+          // session requirement here would be asking Access to log in as somebody.
+          public: true,
           async handler(ctx) {
             const token = await parseAssertion(ctx.req);
             if (!token) throw TroveError.invalid('No access assertion in the request');
@@ -141,6 +157,7 @@ export function externalEvaluation({ privateJwk, team, kid = 'trove-access', jwk
           method: 'GET',
           path: '/api/access/keys',
           deps: [],
+          public: true,
           // Public by design: it is a public key, and Cloudflare fetches it unauthenticated.
           handler() {
             return { keys: [publicJwkOf(privateJwk, { kid })] };

package/packages/server/src/adapters/bun.js

@@ -9,7 +9,7 @@
 //   bun packages/server/src/adapters/bun.js
 
 import { readFileSync } from 'node:fs';
-import { createServer, configFromEnv, warnOnOpenAccess } from '../index.js';
+import { createServer, configFromEnv } from '../index.js';
 // This runtime HAS a filesystem, so it registers the filesystem driver. Imported from
 // storage/filesystem.js rather than the package barrel: that import is what pulls in
 // node:fs, and the Workers adapter deliberately never makes it — so there, Filesystem is
@@ -49,7 +49,6 @@ const staticAssets = WEB_DIST && createStaticAssets({
 
 const hasWeb = !!WEB_DIST;
 const envConfig = configFromEnv();
-warnOnOpenAccess(envConfig);
 const { handle, close } = await createServer({
   ...envConfig,
   storageDrivers: [filesystemDriver()],

package/packages/server/src/adapters/node.js

@@ -11,7 +11,7 @@ import http from 'node:http';
 import fs, { readFileSync } from 'node:fs';
 import fsp from 'node:fs/promises';
 import { Readable } from 'node:stream';
-import { createServer, configFromEnv, warnOnOpenAccess } from '../index.js';
+import { createServer, configFromEnv } from '../index.js';
 // This runtime HAS a filesystem, so it registers the filesystem driver. Imported from
 // storage/filesystem.js rather than the package barrel: that import is what pulls in
 // node:fs, and the Workers adapter deliberately never makes it — so there, Filesystem is
@@ -84,7 +84,6 @@ async function writeWebResponse(res, webRes) {
 
 const hasWeb = !!WEB_DIST;
 const envConfig = configFromEnv();
-warnOnOpenAccess(envConfig);
 const { handle, close } = await createServer({
   ...envConfig,
   storageDrivers: [filesystemDriver()],

package/packages/server/src/engine/index.js

@@ -49,7 +49,7 @@ export function createDriveEngine(config = {}, lifecycleState = { closing: false
 export const BACKBONE = [
   'storage', 'sqlite', 'metadata', 'kv', 'tasks', 'issues', 'notifications',
   'sidecar', 'collections', 'identity', 'auth', 'search', 'vfs', 'plugins',
-  'apiKeys', 'capabilities', 'rotation', 'lifecycle',
+  'apiKeys', 'capabilities', 'rotation', 'lifecycle', 'storageCheck', 'rateLimiter',
 ];
 
 /** The shape `beginScan` has always returned, so no caller has to change. */

package/packages/server/src/engine/providers/access.js

@@ -23,15 +23,6 @@
 import { Provider } from '@3sln/ngin';
 import { TroveError } from '@3sln/trove/core';
 
-/**
- * The one place that decides whether this deployment enforces ACLs at all.
- *
- * From configuration, never from whether a service is present — those agree when
- * everything is wired correctly and diverge exactly when it is not, and the
- * second stops enforcing at the worst possible moment.
- */
-const enforcing = (config) => config?.collections !== false;
-
 /** Conversations are optional; a drive without them says so rather than crashing. */
 function requireSidecar(sidecar) {
   if (!sidecar) throw TroveError.unsupported('Conversations are not enabled on this server');
@@ -120,7 +111,10 @@ function nodeHandle(vfs, sidecar, node, held) {
   // much its content as its bytes are.
   if (permits('read')) {
     handle.read = (opts) => vfs.readStream(node.id, opts);
-    handle.download = (opts) => vfs.getDownload(node.id, opts);
+    // Two calls, deliberately: "may we redirect" and "mint the URL". `mintUrl` is where
+    // the expiry clamp and the encrypted-never-presigns rule live, so a download URL and
+    // an <img src> URL are produced by the same code rather than by two that agreed once.
+    handle.canRedirect = () => vfs.canRedirect(node.id);
     // Minting a URL that carries its own grant is an exercise of `read` — you are
     // delegating the read you hold, to something that cannot present credentials. So it
     // hangs off the read handle like everything else, and a caller without `read`
@@ -206,14 +200,13 @@ function collectionHandle(vfs, collectionId, held) {
  * never runs — when the node is missing or the capability is not held.
  */
 export class NodeAccessProvider extends Provider {
-  static deps = ['vfs', 'sidecar', 'collections', 'config', 'signedUrls'];
+  static deps = ['vfs', 'sidecar', 'collections', 'signedUrls'];
 
-  constructor({ vfs, sidecar, collections, config, signedUrls }) {
+  constructor({ vfs, sidecar, collections, signedUrls }) {
     super();
     this.vfs = vfs;
     this.sidecar = sidecar;
     this.collections = collections;
-    this.config = config;
     this.signedUrls = signedUrls;
   }
 
@@ -256,9 +249,6 @@ export class NodeAccessProvider extends Provider {
       return nodeHandle(vfs, sidecar, node, new Set(['read']));
     }
 
-    const config = await this.config.obtain();
-    if (!enforcing(config)) return nodeHandle(vfs, sidecar, node, requested(capability));
-
     // A key IS the grant, scoped to the node's own collection. Checked before the ACL
     // and never alongside it: a request bearing a key is the key's request, and falling
     // back to whatever principal happens to be attached would let a weak key borrow a
@@ -290,20 +280,17 @@ export class NodeAccessProvider extends Provider {
  * usage, starting an upload.
  */
 export class CollectionAccessProvider extends Provider {
-  static deps = ['vfs', 'collections', 'config'];
+  static deps = ['vfs', 'collections'];
 
-  constructor({ vfs, collections, config }) {
+  constructor({ vfs, collections }) {
     super();
     this.vfs = vfs;
     this.collections = collections;
-    this.config = config;
   }
 
   async obtain({ principal, grant = null, id = 'default', capability = 'read' } = {}) {
     assertCapability(capability);
     const vfs = await this.vfs.obtain();
-    const config = await this.config.obtain();
-    if (!enforcing(config)) return collectionHandle(vfs, id, requested(capability));
 
     // Same rule as the node path: a key's grant decides, alone, and refuses rather than
     // narrowing. This is the check that keeps a key scoped to `photos` out of `invoices`.
@@ -333,13 +320,12 @@ export class CollectionAccessProvider extends Provider {
  * grant was thrown away in every one. Here the session IS the handle.
  */
 export class UploadAccessProvider extends Provider {
-  static deps = ['vfs', 'collections', 'config'];
+  static deps = ['vfs', 'collections'];
 
-  constructor({ vfs, collections, config }) {
+  constructor({ vfs, collections }) {
     super();
     this.vfs = vfs;
     this.collections = collections;
-    this.config = config;
   }
 
   async obtain({ principal, grant = null, id } = {}) {
@@ -348,16 +334,13 @@ export class UploadAccessProvider extends Provider {
     // Resolving first is what makes the check possible at all: only the session knows
     // which collection the bytes are destined for.
     const session = await vfs.uploadStatus(id);
-    const config = await this.config.obtain();
-    if (enforcing(config)) {
-      // Re-checked on EVERY request of the upload, keys included — the point of this
-      // provider. A key revoked between `POST /api/uploads` and `complete` stops the
-      // upload, which it would not if the grant were only checked when it began.
-      if (grant) grantedCapabilities(grant, session.collectionId, 'write');
-      else {
-        const collections = await this.collections.obtain();
-        await collections.assert(principal, session.collectionId, 'write');
-      }
+    // Re-checked on EVERY request of the upload, keys included — the point of this
+    // provider. A key revoked between `POST /api/uploads` and `complete` stops the
+    // upload, which it would not if the grant were only checked when it began.
+    if (grant) grantedCapabilities(grant, session.collectionId, 'write');
+    else {
+      const collections = await this.collections.obtain();
+      await collections.assert(principal, session.collectionId, 'write');
     }
     return {
       id,