@anteros/core 0.0.39 → 0.0.40

package/database/collection.ts

@@ -131,7 +131,7 @@ async function initializeOnDatabase(collections: Collection[]) {
                             }
                         }
 
-                        // !! : field.unique peut être 1/0 (Mongo-style) → coercer en vrai booléen
+                        // !! : field.unique may be 1/0 (Mongo-style) → coerce to a real boolean
                         let isSparse = !!(field.type === 'random'
                             || (field.unique && field.required !== true));
 

package/database/field.crypto.ts

@@ -128,7 +128,7 @@ export async function encryptUpdate(col: Collection | null, update: Record<strin
         const pf = pathFields.find((p) => k === p.name || k.startsWith(p.name + "."));
         if (pf) {
             const sub = k === pf.name ? null : k.slice(pf.name.length + 1);
-            // chemin exact, descendant ('zip.sub') ou à travers un index de array ('0.zip')
+            // exact path, descendant ('zip.sub') or through an array index ('0.zip')
             if (sub === null || pf.paths.some((p) => sub === p || sub.startsWith(p + ".") || sub.endsWith("." + p))) {
                 return { kind: "path", field: pf.name, sub, paths: pf.paths };
             }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "type": "module",
   "description": "Anteros Core",
   "private": false,

package/server/api.ts

@@ -15,7 +15,7 @@ import { getTenantMiddlewares } from "../lib/middleware";
 import type { ActivityInput } from "../types/activity";
 import * as os from 'node:os';
 import { basename } from 'node:path';
-import { handleUpload, handleServe, handleDelete } from "../lib/files";
+import { handleUpload, handleServe, handleDelete, type FileResult } from "../lib/files";
 const API_PREFIX = '/api/:tenant_id/:collection/:action';
 const SERVICE_PREFIX = '/services/:tenant_id/:service/:action';
 const UPLOAD_PREFIX = '/upload/:tenant_id/:collection';
@@ -457,7 +457,9 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Content-Type must be multipart/form-data', { code: 'INVALID_CONTENT_TYPE', status: 400 });
             }
 
-            // Faille 11: reject oversized bodies BEFORE parseBody buffers them in memory
+            // Security: reject oversized bodies BEFORE parseBody buffers them in memory.
+            // `maxSize` doubles as the TOTAL request allowance → a multi-file upload must
+            // fit within it (each file is also validated individually in handleUpload).
             const contentLength = Number(c.req.header('Content-Length') ?? 0);
             const maxUploadSize = colUpload.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
             // multipart overhead (boundaries/headers) ≈ 64KB max
@@ -467,21 +469,36 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 });
             }
 
-            const formData = await c.req.parseBody();
-            const fileField = formData['file'] || formData['upload'];
-            if (!fileField || !(fileField instanceof File)) {
+            const formData = await c.req.parseBody({ all: true }); // all: true → every value is an array (several files can share the same field name)
+
+            // Collect files from both accepted field names (single or multiple)
+            const files: File[] = [];
+            for (const key of ['file', 'upload']) {
+                for (const value of formData[key] ?? []) {
+                    if (value instanceof File) files.push(value);
+                }
+            }
+            if (!files.length) {
                 throw new AppError('No file provided. Use field name "file" or "upload".', { code: 'FILE_REQUIRED', status: 400 });
             }
 
+            // Metadata: non-file fields. Single value → scalar (unchanged contract),
+            // repeated under the same name → array.
             const data: Record<string, any> = {};
             for (const [key, value] of Object.entries(formData)) {
-                if (key !== 'file' && key !== 'upload' && !(value instanceof File)) {
-                    data[key] = value;
-                }
+                if (key === 'file' || key === 'upload') continue;
+                const list = (Array.isArray(value) ? value : [value]) as any[];
+                if (list.some((v) => v instanceof File)) continue;
+                data[key] = list.length === 1 ? list[0] : list;
             }
 
-            const result = await handleUpload({ collection, tenant_id, file: fileField, data });
-            return c.json(result);
+            // One document per file (per-file validation: MIME, size, storage, replication).
+            // 1 file → single object (backward compatible), N files → array (SDK contract).
+            const results: FileResult[] = [];
+            for (const file of files) {
+                results.push(await handleUpload({ collection, tenant_id, file, data }));
+            }
+            return c.json(results.length === 1 ? results[0] : results);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
             return errorResponse(c, err);

package/server/boot.ts

@@ -249,7 +249,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
         // DB query cache status (server.cache) — driver: memory | filesystem | redis
         const cacheCfg = cfg.server.cache;
-        // any: @colors/colors type les styles chaînés (.red.bold) comme des fonctions Color
+        // any: @colors/colors types chained styles (.red.bold) as Color functions
         let cacheInfo: any = 'Off'.red.bold;
         if (cacheCfg?.enabled) {
             const driver = cacheCfg.driver ?? 'memory';

package/tests/crypto.test.ts

@@ -62,7 +62,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
 
     it("decrypt(cipher, true, fields) decrypts the listed sub-fields inside the JSON", async () => {
         const c = useSymCrypt({ secret: "s" });
-        // json contenant des sous-champs chiffrés (convention field-level : JSON.stringify)
+        // json containing encrypted sub-fields (field-level convention: JSON.stringify)
         const encZip = await c.encrypt(JSON.stringify("75000"));
         const encPhone = await c.encrypt(JSON.stringify("0600000000"));
         const container = await c.encrypt({ city: "Paris", zip: encZip, contact: { phone: encPhone } });
@@ -72,7 +72,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
         expect(dec.zip).toBe("75000");
         expect(dec.contact.phone).toBe("0600000000");
 
-        // sans les champs → sous-champs toujours chiffrés
+        // without the fields → sub-fields stay encrypted
         const raw = await c.decrypt<any>(container, true);
         expect(raw.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw.city).toBe("Paris");
@@ -94,7 +94,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
         const json = { city: "Paris", note: "plain text", zip: await c.encrypt(JSON.stringify("75000")) };
         const dec = await c.decrypt<any>(json, true, ["zip", "note", "missing"]);
         expect(dec.city).toBe("Paris");
-        expect(dec.note).toBe("plain text"); // pas un ciphertext → inchangé
+        expect(dec.note).toBe("plain text"); // not a ciphertext → kept as-is
         expect(dec.zip).toBe("75000");
     });
 
@@ -103,7 +103,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
         const encZip = await c.encrypt(JSON.stringify("69001"));
         const encOther = await c.encrypt(JSON.stringify("69002"));
 
-        // array conteneur direct (ex: doc.addresses renvoyé par une requête)
+        // direct array container (e.g. doc.addresses returned by a query)
         const arr = [
             { city: "Lyon", zip: encZip },
             { city: "Villeurbanne", zip: encOther },
@@ -111,11 +111,11 @@ describe("crypto — symmetric AES-256-GCM", () => {
         const dec = await c.decrypt<any>(arr, true, ["zip"]);
         expect(dec[0].zip).toBe("69001");
         expect(dec[1].zip).toBe("69002");
-        expect(dec[0].city).toBe("Lyon"); // non-chiffré conservé
-        expect(dec).not.toBe(arr); // copie, pas de mutation
+        expect(dec[0].city).toBe("Lyon"); // non-encrypted value kept
+        expect(dec).not.toBe(arr); // copy, no mutation
         expect(arr[0]!.zip).toMatch(/^[A-Za-z0-9+/=]+$/); // input intact
 
-        // ciphertext dont le plaintext est un array de json
+        // ciphertext whose plaintext is an array of json
         const encContainer = await c.encrypt([{ zip: encZip }, { zip: encOther }]);
         const dec2 = await c.decrypt<any>(encContainer, true, ["zip"]);
         expect(dec2[0].zip).toBe("69001");
@@ -125,10 +125,10 @@ describe("crypto — symmetric AES-256-GCM", () => {
 
 describe("crypto — key rotation (versioned secrets)", () => {
     it("decrypts old ciphertexts after rotating the secret", async () => {
-        const old = useSymCrypt({ secret: "v1-secret" }); // version 1 par défaut
+        const old = useSymCrypt({ secret: "v1-secret" }); // version 1 by default
         const enc = await old.encrypt({ apiKey: "sk-rot" });
 
-        // Rotation : nouvelle clé active v2, l'ancienne conservée en decrypt-only
+        // Rotation: new active key v2, the old one kept for decrypt-only
         const rotated = useSymCrypt({ secret: "v2-secret", version: 2, previousSecrets: { 1: "v1-secret" } });
         const dec = await rotated.decrypt<{ apiKey: string }>(enc, true);
         expect(dec.apiKey).toBe("sk-rot");
@@ -139,7 +139,7 @@ describe("crypto — key rotation (versioned secrets)", () => {
         const enc = await c.encrypt("data");
         const buf = Buffer.from(enc, "base64");
         expect(buf[0]).toBe(2);
-        // round-trip avec la même instance
+        // round-trip with the same instance
         const dec = await c.decrypt(enc);
         expect(dec).toBe("data");
     });
@@ -147,7 +147,7 @@ describe("crypto — key rotation (versioned secrets)", () => {
     it("still decrypts legacy ciphertexts (no version byte)", async () => {
         const c = useSymCrypt({ secret: "s" });
         const enc = await c.encrypt("legacy");
-        // Simule un ciphertext produit AVANT la rotation (format sans octet de version)
+        // Simulates a ciphertext produced BEFORE the rotation (format without a version byte)
         const legacy = Buffer.from(Buffer.from(enc, "base64").subarray(1)).toString("base64");
         const dec = await c.decrypt(legacy);
         expect(dec).toBe("legacy");
@@ -164,11 +164,11 @@ describe("crypto — key rotation (versioned secrets)", () => {
         const c = useSymCrypt({ secret: "s", aad: "myapp:prod" });
         const enc = await c.encrypt({ apiKey: "sk-aad" });
 
-        // même instance → OK (défaut appliqué au decrypt aussi)
+        // same instance → OK (default applied on decrypt too)
         const dec = await c.decrypt<{ apiKey: string }>(enc, true);
         expect(dec.apiKey).toBe("sk-aad");
 
-        // sans l'AAD config → échec (tag invalide)
+        // without the config AAD → fails (invalid tag)
         const other = useSymCrypt({ secret: "s" });
         await expect(other.decrypt(enc, true)).rejects.toThrow();
     });
@@ -178,15 +178,15 @@ describe("crypto — key rotation (versioned secrets)", () => {
         const enc = await c.encrypt("x", "explicit:ctx");
         const dec = await c.decrypt(enc, false, "explicit:ctx");
         expect(dec).toBe("x");
-        // le défaut ne déchiffre pas le chiffré lié à l'explicite
+        // the default cannot decrypt the ciphertext bound to the explicit AAD
         await expect(c.decrypt(enc, false, "default:ctx")).rejects.toThrow();
     });
 
     it("legacy ciphertexts (no AAD) still decrypt after a default AAD is configured", async () => {
-        const legacy = useSymCrypt({ secret: "s" }); // chiffré SANS AAD (ancien comportement)
+        const legacy = useSymCrypt({ secret: "s" }); // encrypted WITHOUT AAD (legacy behavior)
         const enc = await legacy.encrypt("old-data");
 
-        const c = useSymCrypt({ secret: "s", aad: "myapp:prod" }); // config avec AAD par défaut
+        const c = useSymCrypt({ secret: "s", aad: "myapp:prod" }); // config with a default AAD
         const dec = await c.decrypt(enc);
         expect(dec).toBe("old-data");
     });
@@ -223,7 +223,7 @@ describe("crypto — encryption mode (server.encryption.mode)", () => {
     it("resolve() returns the instance matching the configured mode", async () => {
         delete (cfg.server as any).encryption;
         formatConfig({ server: { port: 4000 }, tenants: [] });
-        const priv = await useAsymCrypt().exportPrivateKey(); // pair fraîche, pas de mode config
+        const priv = await useAsymCrypt().exportPrivateKey(); // fresh pair, no configured mode
 
         delete (cfg.server as any).encryption;
         formatConfig({ server: { port: 4000, encryption: { mode: "symmetric", secret: "cfg" } }, tenants: [] });

package/tests/field-encryption.test.ts

@@ -24,12 +24,12 @@ beforeAll(async () => {
     await syncCollections();
     (cfg as any).collections = [encCollection([
         { name: "name", type: "string" },
-        { name: "ssn", type: "string", encryption: true },           // champ chiffré
-        { name: "profile", type: "json", encryption: true },          // objet chiffré
+        { name: "ssn", type: "string", encryption: true },           // whole value encrypted
+        { name: "profile", type: "json", encryption: true },          // whole json encrypted
         { name: "age", type: "number" },
-        { name: "address", type: "json", encryptionOptions: { path: "zip" } },          // json : seul address.zip est chiffré
-        { name: "contacts", type: "json", encryptionOptions: { path: ["phone", "email"] } }, // plusieurs chemins
-        { name: "addresses", type: "json", encryptionOptions: { path: "zip" } },        // array de json
+        { name: "address", type: "json", encryptionOptions: { path: "zip" } },          // json: only address.zip encrypted
+        { name: "contacts", type: "json", encryptionOptions: { path: ["phone", "email"] } }, // several paths
+        { name: "addresses", type: "json", encryptionOptions: { path: "zip" } },        // array of json
     ])];
     rest = new useRest({ internal: false, tenant_id: TENANT });
 });
@@ -44,35 +44,35 @@ describe("field-level encryption", () => {
     it("insert stores ciphertext in Mongo but returns plaintext", async () => {
         const doc: any = await rest.insertOne("patients", { name: "John", ssn: "123-45-6789", profile: { city: "Paris", zip: 75000 }, age: 42 });
 
-        // réponse API = plaintext
+        // API response = plaintext
         expect(doc.ssn).toBe("123-45-6789");
         expect(doc.profile).toEqual({ city: "Paris", zip: 75000 });
 
-        // en base = ciphertext (version byte + IV + data)
+        // in Mongo = ciphertext (version byte + IV + data)
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
         expect(raw).not.toBeNull();
         expect(raw!.ssn).not.toBe("123-45-6789");
         expect(typeof raw!.ssn).toBe("string");
         expect(raw!.ssn).toMatch(/^[A-Za-z0-9+/=]+$/); // base64
         expect(raw!.profile).not.toEqual({ city: "Paris" });
-        // champ non chiffré intact
+        // non-encrypted field untouched
         expect(raw!.name).toBe("John");
         expect(raw!.age).toBe(42);
     });
 
     it("find / findOne return ciphertext (no decrypt on output)", async () => {
         const list: any = await rest.find("patients", { $match: { name: "John" } });
-        // lecture = ciphertext (jamais décrypté automatiquement)
+        // read = ciphertext (never decrypted automatically)
         expect(list[0].ssn).not.toBe("123-45-6789");
         expect(list[0].ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(list[0].profile).not.toEqual({ city: "Paris", zip: 75000 });
-        // champs non chiffrés intacts
+        // non-encrypted fields untouched
         expect(list[0].name).toBe("John");
 
         const one: any = await rest.findOne("patients", list[0]._id);
         expect(one.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
 
-        // décryptage MANUEL explicite (utils.crypt.resolve())
+        // explicit MANUAL decryption (utils.crypt.resolve())
         const cipher = resolve();
         const dec = await cipher.decrypt<string>(one.ssn, true);
         expect(dec).toBe("123-45-6789");
@@ -82,10 +82,10 @@ describe("field-level encryption", () => {
         const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "John" } }))[0]!._id);
         const updated: any = await rest.updateOne("patients", doc._id, { $set: { ssn: "987-65-4321" } });
 
-        // retour = ciphertext (plus de décryptage automatique)
+        // response = ciphertext (no automatic decryption anymore)
         expect(updated.ssn).not.toBe("987-65-4321");
         expect(updated.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
-        // base = nouveau ciphertext
+        // stored = new ciphertext
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
         expect(raw).not.toBeNull();
         expect(raw!.ssn).not.toBe("987-65-4321");
@@ -99,17 +99,17 @@ describe("field-level encryption", () => {
         const raw = await rest.db.collection("patients").find({ name: { $in: ["A", "B"] } }).toArray();
         for (const r of raw) expect(r.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
         const list: any = await rest.find("patients", { $match: { name: { $in: ["A", "B"] } } });
-        // lecture = ciphertext, décrypté manuellement
+        // read = ciphertext, decrypted manually
         for (const d of list) expect(d.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
     });
 
     it("rejects operators that cannot work on ciphertext ($inc on an encrypted field)", async () => {
         const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "John" } }))[0]!._id);
         await expect(
-            rest.updateOne("patients", doc._id, { $set: { ssn: "x" }, $inc: { age: 1 } }) // $inc sur age (non chiffré) OK
+            rest.updateOne("patients", doc._id, { $set: { ssn: "x" }, $inc: { age: 1 } }) // $inc on age (not encrypted) OK
         ).resolves.toBeTruthy();
         await expect(
-            rest.updateOne("patients", doc._id, { $set: { ssn: "y" }, $inc: { ssn: 1 } as any }) // $inc sur champ chiffré → rejeté
+            rest.updateOne("patients", doc._id, { $set: { ssn: "y" }, $inc: { ssn: 1 } as any }) // $inc on an encrypted field → rejected
         ).rejects.toThrow(/ENCRYPTED_FIELD_OPERATOR|not supported/);
     });
 
@@ -119,7 +119,7 @@ describe("field-level encryption", () => {
         await expect(rest.insertOne("patients", { name: "NoCfg", ssn: "000-00-0000" }))
             .rejects.toThrow(/ENCRYPTION_NOT_CONFIGURED|server\.encryption/);
 
-        // restore config pour les tests suivants
+        // restore the config for the following tests
         formatConfig({ server: { port: 4000, encryption: { mode: "symmetric", secret: "field-enc-secret" } }, tenants: [] });
     });
 });
@@ -130,22 +130,22 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
             name: "Alice",
             address: { street: "Rue X", city: "Paris", zip: "75000" },
         });
-        // réponse = plaintext partout
+        // response = plaintext everywhere
         expect(doc.address.zip).toBe("75000");
         expect(doc.address.city).toBe("Paris");
 
-        // en base : seul zip est ciphertext, le reste est en clair
+        // in Mongo: only zip is ciphertext, the rest stays in clear
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
         expect(raw!.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw!.address.city).toBe("Paris");
         expect(raw!.address.street).toBe("Rue X");
 
-        // lecture rest = ciphertext au path, plaintext ailleurs
+        // rest read = ciphertext at the path, plaintext elsewhere
         const list: any = await rest.find("patients", { $match: { name: "Alice" } });
         expect(list[0].address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(list[0].address.city).toBe("Paris");
 
-        // décryptage manuel
+        // manual decryption
         const cipher = resolve();
         const zip = await cipher.decrypt<string>(list[0].address.zip, true);
         expect(zip).toBe("75000");
@@ -158,10 +158,10 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
             addresses: [{ zip: "69001" }, { zip: "69002", city: "Lyon" }],
         });
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
-        // array de json : chaque élément chiffré sur son zip
+        // array of json: every element encrypted on its zip
         expect(raw!.addresses[0].zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw!.addresses[1].zip).toMatch(/^[A-Za-z0-9+/=]+$/);
-        expect(raw!.addresses[1].city).toBe("Lyon"); // non-chiffré intact
+        expect(raw!.addresses[1].city).toBe("Lyon"); // non-encrypted value untouched
         // multiple paths
         expect(raw!.contacts.phone).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw!.contacts.email).toMatch(/^[A-Za-z0-9+/=]+$/);
@@ -171,12 +171,12 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
     it("encrypts the path on $set replacement and dot-notation $set", async () => {
         const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "Alice" } }))[0]!._id);
 
-        // $set du json complet → zip re-chiffré dans le remplacement
+        // $set of the whole json → zip re-encrypted inside the replacement
         const up1: any = await rest.updateOne("patients", doc._id, { $set: { address: { city: "Nice", zip: "06000" } } });
         expect(up1.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(up1.address.city).toBe("Nice");
 
-        // dot-notation $set sur le path exact → valeur chiffrée
+        // dot-notation $set on the exact path → value encrypted
         const up2: any = await rest.updateOne("patients", doc._id, { $set: { "address.zip": "06100" } });
         expect(up2.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });

package/tests/fixtures/index-tenant/collections/variants.model.ts

@@ -1,8 +1,8 @@
 import { define } from "../../../../index";
 
 // Reproduces the Mongo error `sparse: null is not convertible to bool`:
-// `indexOptions.sparse` explicit à null doit être ignoré (jamais envoyé à Mongo),
-// et `unique` accepte le style Mongo 1/0 (coercé en vrai booléen).
+// an explicit `indexOptions.sparse: null` must be ignored (never sent to Mongo),
+// and `unique` accepts the Mongo 1/0 style (coerced to a real boolean).
 export default define.Collection({
     slug: "variants",
     fields: [

package/tests/index-spec.test.ts

@@ -7,8 +7,8 @@ const TENANT = "idx-test";
 const DIR = "packages/core/tests/fixtures/index-tenant";
 const DB = "mongodb://localhost:27017/_DB_IDX_TEST";
 
-// initializeOnDatabase est fire-and-forget dans syncCollections — on attend
-// que les index existent réellement en base.
+// initializeOnDatabase is fire-and-forget inside syncCollections — wait until the
+// indexes really exist in the database.
 async function waitForIndexes(colName: string): Promise<any[]> {
     const db = cfg.tenants?.[0]?.database?.db as any;
     const col = db.collection(colName);
@@ -40,13 +40,13 @@ describe("index spec construction", () => {
     it("drops null/undefined options and coerces Mongo-style 1/0 booleans", async () => {
         const idxs = await waitForIndexes("variants");
 
-        // name : indexOptions.sparse = null → ignoré (pas de sparse:null), index créé
+        // name: indexOptions.sparse = null → ignored (no sparse:null sent), index created
         const nameIdx = idxs.find((i) => i.name === "name_1");
         expect(nameIdx).toBeDefined();
         expect(nameIdx!.sparse).not.toBe(null);
-        expect(nameIdx!.sparse).not.toBe(true); // false / undefined — jamais null
+        expect(nameIdx!.sparse).not.toBe(true); // false / undefined — never null
 
-        // sku : unique: 1 (Mongo-style) → index unique réel
+        // sku: unique: 1 (Mongo-style) → a real unique index
         const skuIdx = idxs.find((i) => i.name === "sku_1");
         expect(skuIdx).toBeDefined();
         expect(skuIdx!.unique).toBe(true);

package/tests/upload.test.ts

@@ -0,0 +1,138 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { getFileCollection } from "../database/file";
+import { useRest } from "../database/rest";
+
+const TENANT = "up-test";
+const DB = "mongodb://localhost:27017/_DB_UP_TEST";
+const SLUG = "photos";
+
+let rest: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "up-tenant", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    // File collection (disk storage) — no syncing from disk, declared directly
+    (cfg as any).fileCollections = [{
+        _tenant_: TENANT,
+        _isFileCollection_: true,
+        slug: SLUG,
+        fields: [{ name: "label", type: "string" }],
+        upload: { allowedMimeTypes: ["image/png", "text/plain"], maxSize: 5 * 1024 * 1024 },
+        storage: { driver: "disk" },
+        api: { access: { "*": true } },
+    }];
+
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await rest.db.collection(SLUG).drop(); } catch {}
+    // clean the uploaded files
+    try {
+        const fs = await import("node:fs/promises");
+        await fs.rm(`${process.cwd()}/storage/${TENANT}/${SLUG}`, { recursive: true, force: true });
+    } catch {}
+    try { server.stop(true); } catch {}
+});
+
+function pngFile(name: string) {
+    // minimal valid PNG (1x1) so content detection sees a real image
+    const bytes = Buffer.from(
+        "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
+        "base64"
+    );
+    return new File([bytes], name, { type: "image/png" });
+}
+
+describe("upload — single file (unchanged contract)", () => {
+    it("returns a single object", async () => {
+        const form = new FormData();
+        form.append("file", pngFile("one.png"));
+        form.append("label", "single");
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(200);
+
+        const body: any = await res.json();
+        expect(Array.isArray(body)).toBe(false);          // ← object, not an array
+        expect(body._id).toBeString();
+        expect(body._file.name).toBe("one.png");
+        expect(body._file.mimetype).toBe("image/png");
+        expect(body._file.url).toContain(`/files/${TENANT}/${SLUG}/`);
+
+        // metadata persisted on the document
+        const doc: any = await rest.findOne(SLUG, body._id);
+        expect(doc.label).toBe("single");
+    });
+
+    it("accepts the 'upload' field name too", async () => {
+        const form = new FormData();
+        form.append("upload", pngFile("alt.png"));
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(200);
+        const body: any = await res.json();
+        expect(Array.isArray(body)).toBe(false);
+        expect(body._file.name).toBe("alt.png");
+    });
+});
+
+describe("upload — multiple files", () => {
+    it("returns an array and creates one document per file", async () => {
+        const form = new FormData();
+        form.append("file", pngFile("a.png"));
+        form.append("file", pngFile("b.png"));
+        form.append("file", pngFile("c.png"));
+        form.append("label", "batch");
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(200);
+
+        const body: any = await res.json();
+        expect(Array.isArray(body)).toBe(true);
+        expect(body.length).toBe(3);
+        expect(body.map((f: any) => f._file.name).sort()).toEqual(["a.png", "b.png", "c.png"]);
+
+        // every file is its own document, all ids distinct, metadata shared
+        const ids = body.map((f: any) => f._id);
+        expect(new Set(ids).size).toBe(3);
+        for (const id of ids) {
+            const doc: any = await rest.findOne(SLUG, id);
+            expect(doc.label).toBe("batch");
+            expect(doc._file.url).toContain(`/files/${TENANT}/${SLUG}/`);
+        }
+    });
+
+    it("still rejects a request without any file", async () => {
+        const form = new FormData();
+        form.append("label", "nofile");
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(400);
+        const body: any = await res.json();
+        expect(body.code).toBe("FILE_REQUIRED");
+    });
+
+    it("rejects the whole batch on an invalid file (per-file validation)", async () => {
+        const form = new FormData();
+        form.append("file", pngFile("ok.png"));
+        form.append("file", new File([Buffer.from("nope")], "bad.exe", { type: "application/x-msdownload" }));
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(400);
+        const body: any = await res.json();
+        expect(body.code).toBe("MIMETYPE_NOT_ALLOWED");
+    });
+});