@anteros/core 0.0.19 → 0.0.21

package/lib/files.ts

@@ -2,6 +2,7 @@ import { getFileCollection } from "../database/file";
 import { useRest } from "../database/rest";
 import { cfg } from "../server/config";
 import { AppError } from "./error";
+import { S3Client } from "bun";
 import type { FileCollection } from "../types/file";
 import path from "path";
 import fs from "fs/promises";
@@ -53,7 +54,8 @@ export function createDiskStorage(baseDir?: string): FileStorage {
       const filename = `${meta.id}${ext}`;
       const filepath = path.join(dir, filename);
       const buffer = await file.arrayBuffer();
-      await fs.writeFile(filepath, new Uint8Array(buffer));
+      // Faille 17: 'wx' — fail if file already exists (no silent overwrite)
+      await fs.writeFile(filepath, new Uint8Array(buffer), { flag: 'wx' });
       const outPath = subpath ? `${subpath}/${filename}` : `${tenant_id}/${collection}/${filename}`;
       return { path: outPath, size: buffer.byteLength };
     },
@@ -83,6 +85,14 @@ export type S3Config = {
 };
 
 export function createS3Storage(config: S3Config): FileStorage {
+  const client = new S3Client({
+    region: config.region,
+    bucket: config.bucket,
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    ...(config.endpoint ? { endpoint: config.endpoint } : {}),
+  });
+
   return {
     async save(tenant_id, collection, file, meta) {
       const { subpath } = meta;
@@ -90,42 +100,21 @@ export function createS3Storage(config: S3Config): FileStorage {
       const filename = `${meta.id}${ext}`;
       const key = subpath ? `${subpath}/${filename}` : `${tenant_id}/${collection}/${filename}`;
       const buffer = await file.arrayBuffer();
-      // S3 upload via fetch (AWS S3 REST API)
-      const url = config.endpoint
-        ? `${config.endpoint}/${config.bucket}/${key}`
-        : `https://${config.bucket}.s3.${config.region}.amazonaws.com/${key}`;
-      const response = await fetch(url, {
-        method: 'PUT',
-        headers: {
-          'Content-Type': meta.mimetype,
-          'Content-Length': String(buffer.byteLength),
-        },
-        body: buffer,
-      });
-      if (!response.ok) {
-        throw new AppError(`S3 upload failed: ${response.statusText}`, {
-          code: 'S3_UPLOAD_ERROR', status: 500,
-        });
-      }
+      // Native Bun S3 client (handles multipart, retries, signing)
+      await client.write(key, buffer, { type: meta.mimetype });
       return { path: key, size: buffer.byteLength };
     },
 
     async getStream(tenant_id, collection, fileId, filename, subpath) {
       const key = subpath ? `${subpath}/${filename}` : `${tenant_id}/${collection}/${filename}`;
-      const url = config.endpoint
-        ? `${config.endpoint}/${config.bucket}/${key}`
-        : `https://${config.bucket}.s3.${config.region}.amazonaws.com/${key}`;
-      const response = await fetch(url);
-      if (!response.ok) return null;
-      return response.body;
+      const s3file = client.file(key);
+      if (!(await s3file.exists())) return null;
+      return s3file.stream();
     },
 
     async delete(tenant_id, collection, fileId, filename, subpath) {
       const key = subpath ? `${subpath}/${filename}` : `${tenant_id}/${collection}/${filename}`;
-      const url = config.endpoint
-        ? `${config.endpoint}/${config.bucket}/${key}`
-        : `https://${config.bucket}.s3.${config.region}.amazonaws.com/${key}`;
-      await fetch(url, { method: 'DELETE' });
+      await client.delete(key).catch(() => {});
     },
   };
 }
@@ -146,6 +135,15 @@ async function transformImage(
   const format = options.format || 'webp';
   const quality = options.quality ?? 80;
 
+  // Faille 20: validate params (reject NaN / out-of-range)
+  if (!Number.isFinite(quality) || quality < 1 || quality > 100) {
+    throw new AppError('Invalid quality parameter', { code: 'INVALID_TRANSFORM', status: 400 });
+  }
+  if ((options.width != null && (!Number.isFinite(options.width) || options.width <= 0))
+    || (options.height != null && (!Number.isFinite(options.height) || options.height <= 0))) {
+    throw new AppError('Invalid width/height parameter', { code: 'INVALID_TRANSFORM', status: 400 });
+  }
+
   // Convertir ReadableStream en Uint8Array si nécessaire
   let buffer: Uint8Array;
   if (input instanceof Uint8Array) {
@@ -167,6 +165,12 @@ async function transformImage(
     }
   }
 
+  // Faille 20: only transform real images (magic bytes check)
+  const detected = detectMimeFromBuffer(buffer);
+  if (!detected || !detected.startsWith('image/')) {
+    throw new AppError('Not an image file', { code: 'NOT_AN_IMAGE', status: 400 });
+  }
+
   // Utiliser Bun.Image (natif, zéro dépendance)
   const img = new Bun.Image(buffer);
 
@@ -249,6 +253,28 @@ export async function handleUpload(options: UploadOptions): Promise<FileResult>
     });
   }
 
+  // Faille 4: validate magic bytes — don't trust client-declared Content-Type
+  const fullBuffer = new Uint8Array(await file.arrayBuffer());
+  const probe = fullBuffer.subarray(0, 4096);
+  const detected = detectMimeFromBuffer(probe);
+  const declaredMime = mimetype.toLowerCase();
+  const isImageDeclared = declaredMime.startsWith('image/');
+  const isImageDetected = detected?.startsWith('image/') ?? false;
+
+  // Reject content that lies about being an image (e.g. HTML/JS uploaded as image/png)
+  if (isImageDeclared && !isImageDetected) {
+    throw new AppError(`File content does not match declared MIME type '${mimetype}'`, {
+      code: 'MIMETYPE_MISMATCH', status: 400,
+    });
+  }
+
+  // Hardening: block SVG with embedded script (stored XSS)
+  if (detected === 'image/svg+xml' && svgContainsScript(probe)) {
+    throw new AppError('SVG with executable content is not allowed', {
+      code: 'SVG_SCRIPT_NOT_ALLOWED', status: 400,
+    });
+  }
+
   // Validate file size
   const maxSize = col.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
   if (file.size > maxSize) {
@@ -358,20 +384,39 @@ export async function handleServe(
   fileId: string,
   filename: string,
   transform?: TransformOptions,
-): Promise<{ stream: ReadableStream; mimetype: string; size?: number } | null> {
+): Promise<{ stream: ReadableStream; mimetype: string; size?: number; attachment?: boolean } | null> {
   const storage = getStorageForCollection(collection, tenant_id);
   const col = getFileCollection(collection, tenant_id);
   const subpath = col?.storage?.path || undefined;
   const stream = await storage.getStream(tenant_id, collection, fileId, filename, subpath);
   if (!stream) return null;
 
-  let mimetype = getMimeType(filename);
+  // Faille 10: serve the MIME validated at upload time (content-checked),
+  // not re-derived from the extension.
+  let mimetype: string | undefined;
+  try {
+    const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
+    const doc = await rest.db.collection(collection).findOne(
+      { _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any },
+      { projection: { '_file.mimetype': 1 } },
+    );
+    mimetype = (doc as any)?._file?.mimetype;
+  } catch {}
+
+  // Fallback: extension-derived MIME only when nothing stored
+  mimetype = mimetype || getMimeType(filename);
+  const isSvg = mimetype === 'image/svg+xml';
 
   if (transform && (transform.width || transform.height || transform.format)) {
     const { data, mimetype: newMime } = await transformImage(stream, transform);
     return { stream: new ReadableStream({ start(controller) { controller.enqueue(data); controller.close(); } }), mimetype: newMime, size: data.length };
   }
 
+  // Faille 4: SVG is served as an attachment (never inline) to prevent stored XSS
+  if (isSvg) {
+    return { stream, mimetype, attachment: true };
+  }
+
   return { stream, mimetype };
 }
 
@@ -389,6 +434,44 @@ function getMimeType(filename: string): string {
   return map[ext] || 'application/octet-stream';
 }
 
+/**
+ * Detect a file's real type from its magic bytes.
+ * Returns null when unknown. Used to prevent content spoofing (XSS via SVG etc).
+ */
+export function detectMimeFromBuffer(buf: Uint8Array): string | null {
+  const head = (offset: number, len: number) =>
+    String.fromCharCode(...buf.slice(offset, offset + len));
+  const hex = (offset: number, len: number) =>
+    Array.from(buf.slice(offset, offset + len)).map(b => b.toString(16).padStart(2, '0')).join('');
+
+  // JPEG: FF D8 FF
+  if (hex(0, 3) === 'ffd8ff') return 'image/jpeg';
+  // PNG: 89 50 4E 47
+  if (hex(0, 4) === '89504e47') return 'image/png';
+  // GIF: GIF87a / GIF89a
+  if (head(0, 4) === 'GIF8') return 'image/gif';
+  // WebP: RIFF....WEBP
+  if (head(0, 4) === 'RIFF' && head(8, 4) === 'WEBP') return 'image/webp';
+  // AVIF: ftypavif / ftypavis at offset 4
+  if (hex(4, 4) === '66747970' && (head(8, 4) === 'avif' || head(8, 4) === 'avis')) return 'image/avif';
+  // BMP: BM
+  if (head(0, 2) === 'BM') return 'image/bmp';
+  // PDF: %PDF
+  if (head(0, 4) === '%PDF') return 'application/pdf';
+  // ZIP (docx/xlsx/etc): PK\x03\x04
+  if (hex(0, 4) === '504b0304') return 'application/zip';
+  // SVG: XML declaration or <svg — MUST be served as attachment
+  const text = new TextDecoder().decode(buf.subarray(0, 2048));
+  if (/^\s*(<\?xml|<!DOCTYPE|<svg)/i.test(text)) return 'image/svg+xml';
+  return null;
+}
+
+/** True if the file content contains executable script (used for SVG hardening) */
+function svgContainsScript(buf: Uint8Array): boolean {
+  const text = new TextDecoder().decode(buf.subarray(0, 65536)); // first 64KB is enough
+  return /<script|onload\s*=|onerror\s*=|javascript:/i.test(text);
+}
+
 export async function handleDelete(
   tenant_id: string,
   collection: string,
@@ -403,7 +486,7 @@ export async function handleDelete(
   try {
     const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
     const doc = await rest.db.collection(collection).findOne(
-      { _id: ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId },
+      { _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any },
       { projection: { '_file.filename': 1 } },
     );
     filename = doc?._file?.filename;
@@ -426,7 +509,7 @@ export async function handleDelete(
   try {
     const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
     await rest.db.collection(collection).deleteOne({
-      _id: ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId,
+      _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any,
     });
   } catch (err: any) {
     console.error('Failed to delete file metadata:', err?.message || err);

package/lib/mcp.ts

@@ -0,0 +1,59 @@
+import { Glob } from "bun"
+import { cfg } from "../server/config"
+import path from "path"
+import fs from "fs/promises"
+import type { McpTool, McpResource } from "../types/mcp"
+
+/**
+ * Load MCP tools & resources from each tenant's `mcp/` folder:
+ *   {tenant.dir}/mcp/tools/**\/*.tool.ts        → tools
+ *   {tenant.dir}/mcp/resources/**\/*.resource.ts → resources
+ */
+async function syncMcpTools() {
+    try {
+        const tools: McpTool[] = []
+        const resources: McpResource[] = []
+        for (let tenant of cfg.tenants ?? []) {
+            const TENANT_PATH = path.join(process.cwd(), tenant.dir)
+            const MCP_PATH = path.join(TENANT_PATH, 'mcp')
+            let exist = await fs.exists(MCP_PATH)
+            if (!exist) continue;
+            const isDirectory = await (await fs.stat(MCP_PATH)).isDirectory()
+            if (!isDirectory) continue;
+
+            // tools: mcp/tools/**/*.tool.ts
+            const TOOLS_PATH = path.join(MCP_PATH, 'tools')
+            if (await fs.exists(TOOLS_PATH)) {
+                const toolsGlob = new Glob(path.join(TOOLS_PATH, '**/*.tool.ts'))
+                for await (let file of toolsGlob.scan('.')) {
+                    let module = await import(file)
+                    if (module?.default?._isMcpTool_ && module?.default?.enabled !== false) {
+                        tools.push({ ...module?.default, _tenant_: tenant.id })
+                    }
+                }
+            }
+
+            // resources: mcp/resources/**/*.resource.ts
+            const RESOURCES_PATH = path.join(MCP_PATH, 'resources')
+            if (await fs.exists(RESOURCES_PATH)) {
+                const resourcesGlob = new Glob(path.join(RESOURCES_PATH, '**/*.resource.ts'))
+                for await (let file of resourcesGlob.scan('.')) {
+                    let module = await import(file)
+                    if (module?.default?._isMcpResource_ && module?.default?.enabled !== false) {
+                        resources.push({ ...module?.default, _tenant_: tenant.id })
+                    }
+                }
+            }
+        }
+
+        cfg.mcpTools = tools
+        cfg.mcpResources = resources
+
+    } catch (err: any) {
+        console.error(err?.message)
+    }
+}
+
+export {
+    syncMcpTools
+}

package/lib/scriptWorker.ts

@@ -0,0 +1,76 @@
+import { cfg } from "../server/config";
+import { useRest } from "../database/rest";
+import { syncTenants } from "../database/tenant";
+import { syncCollections } from "../database/collection";
+import { syncFileCollections } from "../database/file";
+import { asyncContextStorage, requestCtxStorage } from "./asyncContextStorage";
+
+// ─── Heavy-script worker entrypoint ─────────────────────────────────────────
+// Spawned by runScripts() for scripts marked `heavy: true`.
+//
+//   bun run lib/scriptWorker.ts <absolute-script-path>
+//
+// The tenant config (id, dir, database.uri…) is received as JSON on **stdin**
+// (never argv, to avoid leaking credentials in `ps`). The worker rebuilds the
+// minimal app context — tenant DB connection + collection schemas — then runs
+// the script and reports progress via IPC (process.send).
+
+async function main() {
+    const scriptPath = process.argv[2];
+    if (!scriptPath) {
+        console.error('[script-worker] usage: scriptWorker <scriptPath>');
+        process.exit(1);
+    }
+
+    // Read the tenant config from stdin (written by the parent)
+    let tenant: any;
+    try {
+        const input = (await new Response(process.stdin).json()) as { tenant?: any };
+        tenant = input?.tenant;
+    } catch (err: any) {
+        console.error('[script-worker] failed to read tenant config from stdin:', err?.message);
+        process.exit(1);
+    }
+    if (!tenant?.id || !tenant?.database?.uri) {
+        console.error('[script-worker] missing tenant config (id / database.uri)');
+        process.exit(1);
+    }
+
+    try {
+        // Rebuild the app context, same as boot: connect DB, load collection schemas
+        cfg.tenants = [tenant];
+        await syncTenants();
+        await syncCollections();
+        await syncFileCollections();
+    } catch (err: any) {
+        console.error('[script-worker] failed to bootstrap context:', err?.message);
+        process.exit(1);
+    }
+
+    const module = await import(scriptPath);
+    const script = module?.default;
+    if (!script?._isScript_ || !script.enabled) {
+        console.error(`[script-worker] '${scriptPath}' is not an enabled script`);
+        process.exit(1);
+    }
+
+    const rest = new useRest({ tenant_id: tenant.id });
+    const progress = (percent: number, info?: any) =>
+        process.send?.({ type: 'progress', percent, info });
+
+    try {
+        await asyncContextStorage.run(new Map(), async () => {
+            requestCtxStorage.set('trace', { id: crypto.randomUUID() });
+            requestCtxStorage.set('internal', true);
+            await script.exec({ rest, progress, tenant });
+        });
+        process.send?.({ type: 'done' });
+        process.exit(0);
+    } catch (err: any) {
+        process.send?.({ type: 'error', message: err?.message });
+        console.error('[script-worker] script failed:', err);
+        process.exit(1);
+    }
+}
+
+main();

package/lib/scripts.ts

@@ -3,12 +3,70 @@ import { cfg } from "../server/config"
 import path from "path"
 import fs from "fs/promises"
 import type { Script } from "../types/scripts"
+import type { Tenant } from "../types/tenant"
 import { useRest } from "../database/rest"
 import { asyncContextStorage, requestCtxStorage } from "./asyncContextStorage"
 
 
+// Path of the heavy-script worker entrypoint (spawned as its own Bun process)
+const WORKER_PATH = path.join(import.meta.dir, 'scriptWorker.ts');
+
+/**
+ * Run a `heavy` script in a separate Bun process so it never blocks the HTTP
+ * server. The worker reconnects the tenant DB and rebuilds collection schemas.
+ * Progress is reported back via IPC when the script calls `progress(...)`.
+ */
+async function runHeavyScript(file: string, tenant: Tenant, timeout?: number): Promise<void> {
+    const scriptPath = path.resolve(file);
+    const proc = Bun.spawn(['bun', 'run', WORKER_PATH, scriptPath], {
+        env: { ...process.env },
+        stdin: 'pipe',
+        stdout: 'inherit',
+        stderr: 'inherit',
+        ipc: (message: any) => {
+            if (message?.type === 'progress') {
+                console.log(`[script:${path.basename(file)}] ${message.percent}%`, message.info ?? '');
+            } else if (message?.type === 'error') {
+                console.error(`[script:${path.basename(file)}]`, message?.message);
+            }
+        },
+    });
+
+    // Send the serializable tenant config (uri/options only — never client/db
+    // Mongo instances, which are not JSON-serializable)
+    const payload = JSON.stringify({
+        tenant: {
+            id: tenant.id,
+            name: tenant.name,
+            description: tenant.description,
+            dir: tenant.dir,
+            routes: tenant.routes,
+            database: {
+                uri: tenant.database?.uri,
+                options: tenant.database?.options,
+            },
+        },
+    });
+    proc.stdin.write(payload);
+    proc.stdin.end();
+
+    // Optional hard timeout — kills the worker if it exceeds it
+    const timer = timeout ? setTimeout(() => {
+        console.error(`[script:${path.basename(file)}] timed out after ${timeout}ms — killing`);
+        proc.kill();
+    }, timeout) : null;
+
+    const code = await proc.exited;
+    if (timer) clearTimeout(timer);
+    if (code !== 0) {
+        console.error(`[script:${path.basename(file)}] exited with code ${code}`);
+    }
+}
+
+
 async function runScripts() {
-    let scripts: (Script & { rest: InstanceType<typeof useRest> })[] = []
+    type ScriptEntry = { script: Script; file: string; tenant: Tenant };
+    const entries: ScriptEntry[] = [];
     for (let tenant of cfg.tenants ?? []) {
         const TENANT_PATH = path.join(process.cwd(), tenant.dir)
         const SCRIPTS_PATH = path.join(TENANT_PATH, 'scripts')
@@ -20,28 +78,35 @@ async function runScripts() {
             for await (let file of glob.scan('.')) {
                 let scriptModule = await import(file)
                 if (scriptModule?.default?._isScript_ && scriptModule?.default?.enabled) {
-                    scripts.push({
-                        ...scriptModule?.default,
-                        rest: new useRest({
-                            tenant_id: tenant.id,
-                        })
-                    })
+                    entries.push({ script: scriptModule.default, file, tenant })
                 }
             }
         }
     }
 
-    for (let script of scripts) {
-        asyncContextStorage.run(new Map(), async () => {
+    const heavyTasks: Promise<void>[] = [];
+    for (const { script, file, tenant } of entries) {
+        if (script.heavy) {
+            // Heavy scripts run in a subprocess — never block the server
+            heavyTasks.push(runHeavyScript(file, tenant, script.timeout));
+            continue;
+        }
+
+        await asyncContextStorage.run(new Map(), async () => {
             requestCtxStorage.set('trace', { id: crypto.randomUUID() })
             requestCtxStorage.set('internal', true)
-
             await script.exec({
-                rest: script.rest
+                rest: new useRest({ tenant_id: tenant.id }),
+                tenant,
             })
         })
     }
+
+    // Wait for all heavy subprocesses (they keep running after this resolves)
+    if (heavyTasks.length) {
+        await Promise.allSettled(heavyTasks);
+    }
 }
 export {
     runScripts
-}
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.19",
+  "version": "0.0.21",
   "type": "module",
   "description": "Anteros Core",
   "private": false,
@@ -17,16 +17,19 @@
   },
   "dependencies": {
     "@colors/colors": "1.6.0",
+    "@hono/mcp": "^0.3.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@socket.io/bun-engine": "0.1.1",
     "bentocache": "1.6.1",
     "boxen": "^8.0.1",
     "dayjs": "1.11.21",
-    "hono": "4.13.0",
+    "hono": "^4.13.1",
     "ioredis": "6.0.0",
     "joi": "18.2.3",
     "jose": "6.2.8",
     "mongodb": "7.5.0",
     "socket.io": "4.8.3",
-    "ufo": "1.6.4"
+    "ufo": "1.6.4",
+    "zod": "^4.4.3"
   }
 }

package/probe-cache.ts

@@ -0,0 +1,16 @@
+import { Cache } from "./utils/cache";
+
+async function probe() {
+    const c = new Cache("memory");
+    const v = await c.get({ key: "k" });
+    const p = await c.pull({ key: "p" });
+    const g = await c.getOrSet({ key: "g", factory: () => 42 });
+    const s = await c.set({ key: "a", value: 1 });
+    const h = await c.has({ key: "a" });
+    const i: unknown = v;
+    const j: unknown = p;
+    const k: unknown = g;
+    console.log(typeof v, typeof p, typeof g, s, h);
+    void i; void j; void k;
+}
+void probe;