@3sln/trove 0.0.7 → 0.0.8

package/packages/core/src/uploads.js

@@ -14,6 +14,9 @@
 
 import { TroveError, ErrorCode } from './errors.js';
 import { newId, isValidItemName } from './util.js';
+import { cipherSize, DEFAULT_CHUNK_SIZE, isEnvelope, decodeHeader, HEADER_BYTES as ENVELOPE_HEAD } from './encryption/envelope.js';
+import { toHex } from './encryption/keys.js';
+import { shouldEncrypt } from './encryption/policy.js';
 
 export const DEFAULT_PART_SIZE = 8 * 1024 * 1024; // 8 MiB
 const MIN_MULTIPART_PART = 5 * 1024 * 1024; // S3 floor (except final part)
@@ -48,6 +51,58 @@ class MemorySessionStore {
   }
 }
 
+/** The namespace upload sessions live under. */
+const SESSION_NS = 'uploads';
+
+/**
+ * Upload sessions in the KeyValueStore, so they outlive the process that made one.
+ *
+ * An upload is three or more separate requests — create, the bytes, complete — and the
+ * session is the only thing joining them. Held in a `Map`, that works exactly as long as
+ * every request happens to reach the same process: an assumption a long-lived server gets
+ * away with and a serverless one does not. On Cloudflare Workers an isolate can be
+ * discarded the moment a response resolves, and a cold drive fans a burst of requests
+ * across several isolates at once, so `create` writes to one Map and `complete` reads an
+ * empty one. The user is told their upload session does not exist while its own 24h TTL
+ * is nowhere near up — because it never expired, it was simply somewhere else.
+ *
+ * Retrying does not rescue that and must not: a missing session is `notFound`, correctly
+ * classified non-retryable, and one that genuinely expired is never coming back. The fix
+ * is for the session to live somewhere every request can see.
+ *
+ * Values are plain JSON, which is all a session ever was.
+ */
+export class KvSessionStore {
+  /** @param {{kv: import('./kv.js').KeyValueStore, ns?: string}} deps */
+  constructor({ kv, ns = SESSION_NS } = {}) {
+    if (!kv) throw TroveError.invalid('KvSessionStore needs a KeyValueStore');
+    this.kv = kv;
+    this.ns = ns;
+  }
+  async get(id) {
+    return (await this.kv.get(this.ns, id)) || null;
+  }
+  async put(session) {
+    await this.kv.set(this.ns, session.id, session);
+  }
+  async delete(id) {
+    await this.kv.delete(this.ns, id);
+  }
+  /**
+   * Which sessions have expired — WITHOUT deleting them, for the reason given on
+   * MemorySessionStore.expired: the session holds the multipart `uploadId`, and dropping
+   * the record strands the uploaded parts in the bucket with nothing left to abort them.
+   */
+  async expired(now) {
+    const rows = await this.kv.list(this.ns, '');
+    return rows
+      .map((r) => r.value)
+      .filter(Boolean)
+      .filter((s) => now - s.createdAt > SESSION_TTL_MS)
+      .map((s) => s.id);
+  }
+}
+
 export class UploadManager {
   /**
    * @param {object} deps
@@ -55,10 +110,14 @@ export class UploadManager {
    * @param {object} [deps.sessions] session store (defaults in-memory)
    * @param {number} [deps.partSize]
    */
-  constructor({ storage, storageFor, sessions, partSize = DEFAULT_PART_SIZE, maxBytes = null }) {
+  constructor({ storage, storageFor, sessions, encryptionFor, partSize = DEFAULT_PART_SIZE, maxBytes = null }) {
     // Either a single backend, or a resolver keyed by collectionId (collections).
     this.storageFor = storageFor ?? (async () => storage);
     this.sessions = sessions ?? new MemorySessionStore();
+    // What a collection encrypts, and the key to do it with:
+    // `(collectionId) => { encryption, dataKey } | null`. Absent means nothing is
+    // encrypted, which is what every existing deployment is.
+    this.encryptionFor = encryptionFor ?? (async () => null);
     this.partSize = partSize;
     this.maxBytes = maxBytes || null; // per-file quota (null = unbounded)
   }
@@ -85,19 +144,50 @@ export class UploadManager {
   async create(req) {
     if (!isValidItemName(req.name)) throw TroveError.invalid(`Invalid file name "${req.name}"`);
     if (!(req.size >= 0)) throw TroveError.invalid('size must be a non-negative number');
-    if (this.maxBytes && req.size > this.maxBytes) {
+    const collectionId = req.collectionId || 'default';
+    const storage = await this.#storage(collectionId);
+    const caps = storage.capabilities;
+    const storageKey = newId('obj');
+    const contentType = req.contentType || 'application/octet-stream';
+
+    // Does this item get encrypted, and with what?
+    //
+    // Decided here, once, and recorded on the session — not re-derived at `complete`,
+    // because the collection's rules can change between the two and an object half-planned
+    // as one thing and finished as another is unreadable either way.
+    //
+    // Everything downstream negotiates against the STORED size, which is larger: a header
+    // plus an authentication tag per chunk. Planning multipart boundaries against the
+    // plaintext size is short by exactly that, which is the difference between a final part
+    // that exists and one that does not.
+    const policy = await this.encryptionFor(collectionId);
+    const encrypting = !!policy && shouldEncrypt(policy.encryption, { name: req.name, contentType });
+    const chunkSize = policy?.encryption?.chunkSize || DEFAULT_CHUNK_SIZE;
+    const storedSize = encrypting ? cipherSize(req.size, chunkSize) : req.size;
+
+    // The per-file limit is checked against what will be STORED, and checked here rather
+    // than against `req.size` at the top of this method.
+    //
+    // `complete` compares the size read back from the store, which for an encrypted upload
+    // is the envelope. Checking the plaintext size at negotiation and the envelope size at
+    // completion meant a file just under the limit was accepted, transferred in full, and
+    // then DELETED by the too-large branch at the end — the user paying for the whole
+    // upload and losing the file. Both ends now measure the same thing.
+    if (this.maxBytes && storedSize > this.maxBytes) {
       // Deterministic per-file limit — retrying can't help, so it's non-retryable
       // (capacity/rate quotas stay retryable via the default).
       // TOO_LARGE (413), not QUOTA: the store has plenty of room, this file is simply
       // bigger than this deployment permits. Reporting it as a capacity problem would
       // send the user looking for space to free that would not help.
-      throw TroveError.tooLarge(`File exceeds the maximum upload size of ${this.maxBytes} bytes`, { details: { maxBytes: this.maxBytes, size: req.size } });
+      throw TroveError.tooLarge(
+        encrypting && req.size <= this.maxBytes
+          // Naming the reason, because "your 10MB file exceeds the 10MB limit" is a
+          // maddening thing to be told.
+          ? `Encrypted, this file needs ${storedSize} bytes of storage, over the ${this.maxBytes}-byte limit`
+          : `File exceeds the maximum upload size of ${this.maxBytes} bytes`,
+        { details: { maxBytes: this.maxBytes, size: req.size, storedSize } },
+      );
     }
-    const collectionId = req.collectionId || 'default';
-    const storage = await this.#storage(collectionId);
-    const caps = storage.capabilities;
-    const storageKey = newId('obj');
-    const contentType = req.contentType || 'application/octet-stream';
 
     const session = {
       id: newId('up'),
@@ -108,7 +198,13 @@ export class UploadManager {
       // the session because the decision is made when the upload STARTS but has to be
       // honoured when it COMPLETES, possibly much later.
       overwrite: !!req.overwrite,
+      // The size the USER sees, which is what the item is recorded as. `storedSize` is
+      // what actually occupies the bucket.
       size: req.size,
+      storedSize,
+      encrypted: encrypting,
+      chunkSize: encrypting ? chunkSize : null,
+      keyFingerprint: encrypting ? policy.encryption.fingerprint : null,
       contentType,
       createdAt: Date.now(),
       strategy: null,
@@ -120,17 +216,17 @@ export class UploadManager {
     const limits = this.#limits();
 
     // Small file + presign → single PUT straight to storage (never through us).
-    if (req.size <= SINGLE_PUT_LIMIT && caps.presignUpload) {
+    if (storedSize <= SINGLE_PUT_LIMIT && caps.presignUpload) {
       session.strategy = 'single';
       await this.sessions.put(session);
       const url = await storage.presignPut(storageKey, { contentType });
-      return { ...planSummary(session), strategy: 'single', multipart: false, presigned: true, url, limits };
+      return { ...planSummary(session), strategy: 'single', multipart: false, presigned: true, url, limits, encryption: this.#planEncryption(session, policy) };
     }
 
     // Multipart (presigned parts straight to storage, or streamed through us).
     if (caps.multipart) {
       session.strategy = caps.presignUpload ? 'presign' : 'direct';
-      const partCount = Math.max(1, Math.ceil(req.size / this.partSize));
+      const partCount = Math.max(1, Math.ceil(storedSize / this.partSize));
       // `#limits()` advertises maxParts in the very same response, and nothing enforced
       // it: a 150 GiB file planned 19,200 parts against a ceiling of 10,000, which S3
       // rejects at part 10,001 — after the client has transferred 80 GiB. On a presign
@@ -139,7 +235,7 @@ export class UploadManager {
       if (partCount > MAX_PARTS) {
         throw TroveError.tooLarge(
           `This file needs ${partCount.toLocaleString()} parts of ${this.partSize} bytes, over the ${MAX_PARTS.toLocaleString()}-part limit`,
-          { details: { maxParts: MAX_PARTS, partCount, partSize: this.partSize, size: req.size } },
+          { details: { maxParts: MAX_PARTS, partCount, partSize: this.partSize, size: storedSize } },
         );
       }
       // Only now open the multipart. Refusing AFTER creating it left an upload open in
@@ -153,13 +249,74 @@ export class UploadManager {
           parts.push({ partNumber: n, url: await storage.presignPart(storageKey, session.uploadId, n) });
         }
       }
-      return { ...planSummary(session), strategy: session.strategy, multipart: true, presigned: session.strategy === 'presign', partCount, parts, limits };
+      return { ...planSummary(session), strategy: session.strategy, multipart: true, presigned: session.strategy === 'presign', partCount, parts, limits, encryption: this.#planEncryption(session, policy) };
     }
 
     // Fallback: whole-object PUT streamed through us (tiny/simple backends).
     session.strategy = 'direct-single';
     await this.sessions.put(session);
-    return { ...planSummary(session), strategy: 'direct-single', multipart: false, presigned: false, limits };
+    return { ...planSummary(session), strategy: 'direct-single', multipart: false, presigned: false, limits, encryption: this.#planEncryption(session, policy) };
+  }
+
+  /**
+   * What the client needs in order to encrypt before the bytes leave the browser.
+   *
+   * The key travels, the bytes do not. That is what keeps a presigned direct-to-bucket
+   * upload possible while the bucket only ever sees ciphertext: the client seals the file
+   * locally and PUTs the envelope. Sending the key here is the explicit trade of this
+   * design — it defends the storage host, not the server, and the server had the key
+   * already in order to be able to index.
+   *
+   * Null for anything not being encrypted, so a client has one thing to check.
+   */
+  #planEncryption(session, policy) {
+    if (!session.encrypted) return null;
+    return {
+      algorithm: 'AES-256-GCM',
+      chunkSize: session.chunkSize,
+      fingerprint: policy.encryption.fingerprint,
+      // Hex rather than raw bytes: this rides in a JSON plan.
+      key: policy.dataKeyHex,
+      // What the client should end up PUTting, so it can check its own work before
+      // spending the bytes.
+      storedSize: session.storedSize,
+    };
+  }
+
+
+  /**
+   * Refuse an upload that was supposed to be encrypted and is not.
+   *
+   * Deleted rather than kept, like the over-size branch: an object that cannot be read is
+   * not worth the storage, and leaving it would also leave plaintext in a bucket the
+   * collection promises is ciphertext.
+   */
+  async #assertSealed(storage, s) {
+    let head;
+    try {
+      const got = await storage.get(s.storageKey, { range: { start: 0, end: ENVELOPE_HEAD - 1 } });
+      head = new Uint8Array(await new Response(got.stream).arrayBuffer());
+    } catch {
+      return; // a backend that cannot serve a range gets the benefit of the doubt
+    }
+    const sealed = isEnvelope(head);
+    const matches = sealed && (() => {
+      try {
+        return toHex(decodeHeader(head).fingerprint) === s.keyFingerprint;
+      } catch {
+        return false;
+      }
+    })();
+    if (sealed && matches) return;
+
+    await storage.delete(s.storageKey).catch(() => {});
+    await this.sessions.delete(s.id);
+    throw TroveError.invalid(
+      sealed
+        ? 'This upload was encrypted with the wrong key for this collection.'
+        : 'This collection encrypts its files, and this upload arrived unencrypted. The client '
+          + 'must seal the bytes using the key in the upload plan before sending them.',
+    );
   }
 
   /** Re-issue a signed URL for one part (resume after expiry). */
@@ -292,15 +449,40 @@ export class UploadManager {
         { details: { maxBytes: this.maxBytes, size } },
       );
     }
+    // An upload planned as encrypted must have ARRIVED encrypted.
+    //
+    // `complete` otherwise records what the session INTENDED, so a client that ignores
+    // `plan.encryption` — which is every client that has not implemented it yet — uploads
+    // plaintext and the item is stamped with a key fingerprint anyway. The result is the
+    // worst of both: permanently unreadable, because the read path looks for an envelope
+    // that is not there, and not actually protected, because the bytes are sitting in the
+    // bucket in the clear on a collection labelled encrypted.
+    //
+    // The envelope header is readable without the key, which is exactly what makes this
+    // checkable here. One small ranged read, once, at the end of an upload.
+    if (s.encrypted) {
+      await this.#assertSealed(storage, s);
+    }
+
     await this.sessions.delete(uploadId);
     return {
       storageKey: s.storageKey,
-      size,
+      // For an encrypted object the store holds an envelope, which is larger than the
+      // file. The item records the file: that is the number a user recognises, the one
+      // search results and quotas are about, and the one a range request is against.
+      size: s.encrypted ? s.size : size,
+      storedSize: size,
       contentType: s.contentType,
       etag,
       collectionId: s.collectionId,
       name: s.name,
       overwrite: !!s.overwrite,
+      // Which key opens this object. Recorded on the item so reading it does not have to
+      // fetch the envelope header first, and so a rotation can find what it has not yet
+      // converted without opening every object in the bucket.
+      encryption: s.encrypted
+        ? { fingerprint: s.keyFingerprint, chunkSize: s.chunkSize }
+        : null,
     };
   }
 

package/packages/core/src/vfs.js

@@ -12,6 +12,8 @@
 
 import { TroveError, isOutOfSpace } from './errors.js';
 import { UploadManager } from './uploads.js';
+import { toHex } from './encryption/keys.js';
+import { decryptStream, decodeHeader, cipherRangeFor, cipherSize, HEADER_BYTES } from './encryption/envelope.js';
 import { IndexerRegistry } from './indexers/registry.js';
 import { ParsingSearchTransformer, matchTagFilters } from './search/transformer.js';
 import { extname } from './util.js';
@@ -36,8 +38,46 @@ const CONTENT_TYPES = {
   '.mp4': 'video/mp4', '.webm': 'video/webm', '.zip': 'application/zip',
 };
 
+
+/** Drain a stream into one buffer. Only ever used for the fixed-size envelope header. */
+async function bytesOf(stream) {
+  const reader = stream.getReader();
+  const parts = [];
+  let total = 0;
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    parts.push(value);
+    total += value.length;
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const p of parts) { out.set(p, at); at += p.length; }
+  return out;
+}
+
+/**
+ * Emit only the bytes between `start` and `end` of a stream.
+ *
+ * A plaintext range rarely lines up with a chunk boundary, so decryption yields whole
+ * chunks and this drops the overhang at each end — without collecting the middle, which is
+ * the entire point of streaming in the first place.
+ */
+function trimStream(stream, start, end) {
+  let seen = 0;
+  return stream.pipeThrough(new TransformStream({
+    transform(chunk, controller) {
+      const from = Math.max(0, start - seen);
+      const to = Math.min(chunk.length, end - seen);
+      if (to > from) controller.enqueue(chunk.subarray(from, to));
+      seen += chunk.length;
+      if (seen >= end) controller.terminate();
+    },
+  }));
+}
+
 export class Vfs {
-  constructor({ storage, metadata, search, indexers, sidecar, collections, searchTransformer, issues, signedUrls = null, publicUrl = '', maxIndexBytes = 2 * 1024 * 1024, maxUploadBytes = null, uploadPartSize = undefined }) {
+  constructor({ storage, metadata, search, indexers, sidecar, collections, searchTransformer, issues, signedUrls = null, publicUrl = '', maxIndexBytes = 2 * 1024 * 1024, maxUploadBytes = null, uploadPartSize = undefined, uploadSessions = undefined }) {
     if (!storage && !collections) throw TroveError.invalid('Vfs requires a storage backend or a CollectionService');
     if (!metadata) throw TroveError.invalid('Vfs requires a metadata store');
     this.storage = storage; // primary backend (default collection + capability reporting)
@@ -49,7 +89,27 @@ export class Vfs {
     this.collections = collections ?? null;
     this.indexers = indexers ?? new IndexerRegistry();
     // One UploadManager; it resolves the right backend per session's collection.
-    this.uploads = new UploadManager({ storageFor: (cid) => this.storageFor(cid), maxBytes: maxUploadBytes, partSize: uploadPartSize });
+    //
+    // `uploadSessions` is where the sessions live. It defaults to memory, which is right
+    // for a test and wrong for anything where two requests of one upload can be served by
+    // different processes — see KvSessionStore. Injected rather than built here because
+    // core does not otherwise need a KeyValueStore.
+    this.uploads = new UploadManager({
+      storageFor: (cid) => this.storageFor(cid),
+      sessions: uploadSessions,
+      // What a collection encrypts and the key for it. Only the CollectionService knows,
+      // and only it is allowed to hand the key out — see collections/index.js.
+      encryptionFor: async (cid) => {
+        if (!this.collections?.encryptionFor) return null;
+        const encryption = await this.collections.encryptionFor(cid);
+        if (!encryption?.enabled) return null;
+        const key = await this.collections.dataKeyFor(cid);
+        if (!key) return null;
+        return { encryption, dataKeyHex: toHex(key) };
+      },
+      maxBytes: maxUploadBytes,
+      partSize: uploadPartSize,
+    });
     this.maxIndexBytes = maxIndexBytes;
     // The indexing subsystem (run/backfill/purge/contributions) lives here.
     // Where a failure to index becomes a standing, retryable problem rather than a
@@ -223,17 +283,20 @@ export class Vfs {
    * — and an unconditional replace at completion silently destroys whichever landed
    * first. So an upload re-resolves the collision at the moment it commits.
    */
-  async #upsertItem({ collectionId, name, storageKey, size, contentType, etag, overwrite = true }) {
+  async #upsertItem({ collectionId, name, storageKey, size, contentType, etag, overwrite = true, encryption = null }) {
     let finalName = name;
     const existing = await this.metadata.getByName(collectionId, name);
     if (existing && overwrite) {
       const oldKey = existing.storageKey;
-      const updated = await this.metadata.update(existing.id, { storageKey, size, contentType, etag });
+      const updated = await this.metadata.update(existing.id, { storageKey, size, contentType, etag, encryption });
       if (oldKey && oldKey !== storageKey) (await this.storageFor(collectionId)).delete(oldKey).catch(() => {});
       return updated;
     }
     if (existing) finalName = await this.#uniqueName(collectionId, name);
-    return this.metadata.create({ collectionId, name: finalName, storageKey, size, contentType, etag });
+    // `encryption` names which key opens this object. Carried on the item so a read does
+    // not have to fetch the envelope header to find out, and so a rotation can tell what it
+    // has not converted without opening every object in the bucket.
+    return this.metadata.create({ collectionId, name: finalName, storageKey, size, contentType, etag, encryption });
   }
 
   /**
@@ -399,15 +462,23 @@ export class Vfs {
 
   // --- download --------------------------------------------------------------
 
-  async getDownload(id, { expiresIn, download } = {}) {
+  async getDownload(id, { expiresIn, download, ciphertext = false } = {}) {
     const node = await this.resolve(id);
     const storage = await this.storageFor(node.collectionId);
+    // An encrypted object is not redirected to by default. A redirect hands the caller raw
+    // ciphertext, and most callers of a download URL cannot do anything with it — an <img
+    // src>, a <video src>, a signed URL given to an external service. Proxying is the
+    // answer that is always correct, so it is the default; a client that holds the key and
+    // knows it can decrypt asks for `ciphertext` and gets the direct path back.
+    if (node.encryption && !ciphertext) return { mode: 'proxy', node };
     if (storage.capabilities.presignDownload) {
       const url = await storage.presignGet(node.storageKey, {
         expiresIn, responseContentType: node.contentType,
         downloadName: download ? node.name : undefined,
       });
-      return { mode: 'redirect', url, node };
+      // Named on the way out so a client that asked for ciphertext knows which key opens
+      // what it is about to receive.
+      return { mode: 'redirect', url, node, encryption: node.encryption || null };
     }
     return { mode: 'proxy', node };
   }
@@ -457,7 +528,75 @@ export class Vfs {
   async readStream(id, { range, signal } = {}) {
     const node = await this.resolve(id);
     if (!node.storageKey) throw TroveError.notFound('File content');
-    return (await this.storageFor(node.collectionId)).get(node.storageKey, { range, signal });
+    const storage = await this.storageFor(node.collectionId);
+    if (!node.encryption) return storage.get(node.storageKey, { range, signal });
+
+    // An encrypted object is decrypted HERE, for everything that reads through the server.
+    //
+    // The browser can decrypt for itself when it fetches — and does, which is what keeps a
+    // presigned download direct. But an <img src>, a <video src>, a signed URL handed to an
+    // external service, and the service worker's own cache fills cannot: they are bare URLs
+    // that get bytes and have nowhere to run our code. Those all arrive here, so this is
+    // where correctness has to live.
+    //
+    // The plaintext range the caller asked for is mapped onto the chunks that hold it, so a
+    // seek into a video still fetches a chunk rather than the film.
+    // The ENVELOPE is read first, and it is authoritative.
+    //
+    // The item's own record says which key sealed it and at what chunk size, and that is
+    // what makes a listing cheap — but it is a copy, and a copy can be stale: an object
+    // restored from a backup, adopted by a scan, or written by another version. Deriving
+    // the byte ranges from the record and then decrypting with the object's real geometry
+    // is how you get chunk indices computed against one layout and nonces against another,
+    // which surfaces as "the data has been altered" on data nobody altered.
+    const head = await storage.get(node.storageKey, { range: { start: 0, end: HEADER_BYTES - 1 }, signal });
+    const header = decodeHeader(await bytesOf(head.stream));
+    // The plaintext size likewise: the envelope knows, the record remembers.
+    const plaintextSize = header.plaintextSize ?? node.size;
+    const key = await this.#keyForNode(node, header);
+
+    const want = range
+      ? cipherRangeFor({ start: range.start, end: range.end }, { ...header, plaintextSize })
+      : {
+        cipherStart: 0,
+        cipherEnd: cipherSize(plaintextSize, header.chunkSize) - 1,
+        firstChunk: 0,
+        trimStart: 0,
+        trimEnd: plaintextSize,
+      };
+
+    const body = await storage.get(node.storageKey, {
+      range: { start: Math.max(want.cipherStart, HEADER_BYTES), end: want.cipherEnd }, signal,
+    });
+    const plain = await decryptStream(key, header, body.stream, want.firstChunk);
+    return {
+      stream: trimStream(plain, want.trimStart, want.trimEnd),
+      size: want.trimEnd - want.trimStart,
+      contentType: node.contentType,
+      etag: head.etag,
+      range: range ? { start: range.start, end: range.start + (want.trimEnd - want.trimStart) - 1, total: plaintextSize } : null,
+    };
+  }
+
+  /**
+   * The key that opens this object, chosen by what the ENVELOPE names.
+   *
+   * The object is the authority on which key sealed it; the item's record is a copy kept
+   * for cheap listings. Trusting the record would mean a stale one sends us to the wrong
+   * key and the failure reads as corruption.
+   */
+  async #keyForNode(node, header) {
+    const want = toHex(header.fingerprint);
+    const key = this.collections?.dataKeyFor
+      ? await this.collections.dataKeyFor(node.collectionId, want)
+      : null;
+    if (!key) {
+      throw TroveError.invalid(
+        'This item is encrypted with a key this collection no longer holds. It was probably '
+        + 'retired before a key rotation finished moving everything onto the new one.',
+      );
+    }
+    return key;
   }
 
   // --- uploads ---------------------------------------------------------------
@@ -511,7 +650,7 @@ export class Vfs {
       const node = await this.#upsertItem({
         collectionId: obj.collectionId, name: obj.name, storageKey: obj.storageKey,
         size: obj.size, contentType: obj.contentType, etag: obj.etag,
-        overwrite: obj.overwrite,
+        overwrite: obj.overwrite, encryption: obj.encryption || null,
       });
       this.indexing.indexNode(node).catch((e) => console.error('index error', e));
       return node;

package/packages/server/src/engine/providers/core.js

@@ -32,6 +32,7 @@ import {
   IdentityProvider, JwtIdentityProvider, HeaderIdentityProvider, AnonymousIdentityProvider,
   cloudflareAccess,
   KeyValueStore, MemoryKV, SqliteKV,
+  KvSessionStore,
   SqliteProvider, LocalSqliteProvider,
   SidecarService, NotificationCenter, WebPushService, WebPushChannel, NotificationChannel,
   ApiKeyService, CapabilityProvider, ApiKeyCapabilityProvider,
@@ -461,11 +462,17 @@ export function coreProviders(config, lifecycleState) {
       async (deps) => {
         const r = await need(deps, [
           'storage', 'metadata', 'search', 'indexers', 'sidecar', 'collections',
-          'searchTransformer', 'issues', 'signedUrls',
+          'searchTransformer', 'issues', 'signedUrls', 'kv',
         ]);
         const vfs = new Vfs({
           ...r,
           maxUploadBytes: config.maxUploadBytes ?? null,
+          // Upload sessions in the KeyValueStore rather than this process's memory. An
+          // upload spans several requests and the session is the only thing joining them,
+          // so on a runtime that can serve those requests from different isolates an
+          // in-memory Map means "upload session not found" on a drive where nothing is
+          // wrong. See KvSessionStore.
+          uploadSessions: new KvSessionStore({ kv: r.kv }),
           // Where this server can be reached from outside, for the URLs that leave the
           // browser (an indexer hands one to an external API). Absent, those are refused
           // rather than handed out as links to nowhere.
@@ -475,7 +482,7 @@ export function coreProviders(config, lifecycleState) {
         return vfs;
       },
       null,
-      { deps: ['storage', 'metadata', 'search', 'indexers', 'sidecar', 'collections', 'searchTransformer', 'issues', 'signedUrls'] },
+      { deps: ['storage', 'metadata', 'search', 'indexers', 'sidecar', 'collections', 'searchTransformer', 'issues', 'signedUrls', 'kv'] },
     ),
 
     // Bulk plugin package blobs. Defaults to the primary storage under a prefix;

package/packages/server/src/routes.js

@@ -5,6 +5,7 @@
 import { Router, json, parseRange } from './router.js';
 import {
   TroveError, assertSafePluginSql, concatBytes, metadataUrl, publicOrigin,
+  shouldEncrypt,
 } from '@3sln/trove/core';
 import { parseContribUri, CORE_DOMAIN } from '@3sln/trove/core/plugins/identity.js';
 
@@ -444,10 +445,20 @@ export function createRouter() {
 
   // --- uploads ---------------------------------------------------------------
 
-  r.post('/api/collections/:collection/uploads', [], async (ctx) => {
+  r.post('/api/collections/:collection/uploads', ['collections', 'vfs'], async (ctx) => {
     const b = await body(ctx.req);
     if (!b.name) throw TroveError.invalid('name is required');
     const collection = await ctx.access.collection(scopedCollection(ctx), 'write');
+    // An upload onto an encrypted collection is handed the collection's key, so the client
+    // can seal the bytes before they reach the bucket. That key decrypts EVERYTHING in the
+    // collection, which makes it a read capability however it arrives — and `write` does
+    // not imply `read` here (only `admin` expands). Without this, a write-only API key,
+    // which the key model explicitly supports, could ask for a plan for a one-byte file and
+    // receive the means to decrypt the whole collection.
+    //
+    // Refused rather than quietly narrowed to a plaintext upload: silently storing in the
+    // clear on a collection someone set up to be encrypted is the worse failure.
+    await assertReadIfKeyed(ctx, b);
     return uploadDescriptor(await collection.createUpload({
       name: b.name, size: Number(b.size ?? 0), contentType: b.contentType,
       overwrite: b.overwrite === true,
@@ -1150,6 +1161,23 @@ async function assertTaskAccess(ctx, task, what) {
  * manage API keys, however broadly it was scoped, because a key that can mint keys can
  * outlive its own revocation. Then the ordinary admin check on the principal.
  */
+
+/**
+ * An upload plan that will carry the collection key needs `read`, not merely `write`.
+ *
+ * Checked before the session is created, so a refusal costs nothing and leaves no orphan.
+ */
+async function assertReadIfKeyed(ctx, body) {
+  if (!ctx.collections?.encryptionFor) return;
+  const collectionId = scopedCollection(ctx);
+  const encryption = await ctx.collections.encryptionFor(collectionId);
+  if (!encryption?.enabled) return;
+  const contentType = body.contentType || ctx.vfs?.guessContentType?.(body.name) || '';
+  if (!shouldEncrypt(encryption, { name: body.name, contentType })) return;
+  // Throws if the caller does not hold read on this collection.
+  await ctx.access.collection(collectionId, 'read');
+}
+
 function requireHumanAdmin(ctx, action) {
   if (ctx.grant) {
     throw TroveError.forbidden(`An API key cannot ${action} — sign in as an administrator`);