@appweaver/core 1.3.0 → 1.4.0

package/storage/file-service.js

@@ -67,7 +67,9 @@ class FileService {
             file.resourceName &&
             file.resourceId) {
             const resourceService = (0, context_1.injectService)(file.resourceName);
-            const resource = await resourceService.find(file.resourceId);
+            // The owning id is stored as text, so it is converted back to the
+            // primary key type of that model before the lookup
+            const resource = await resourceService.find((0, common_1.toResourceId)(file.resourceId, (0, context_1.injectModel)(file.resourceName, false)?.config?.id));
             if (identity && policy.canAccess?.(identity, resource, file) === false) {
                 throw new errors_1.HttpError('File access is forbidden', 403);
             }
@@ -101,145 +103,41 @@ class FileService {
      * @throws {HttpError} Throws an error if file validation, storage, or resource association fails.
      */
     async saveFile(data, resource, client) {
-        const identity = (0, security_1.currentAuthUser)();
-        if (!(data.fieldname in resource)) {
-            throw new errors_1.HttpError(`File field '${data.fieldname}' does not exist on resource '${client.name}'`, 400);
-        }
-        const fileConfig = this.getFileConfig(client.name, data.fieldname);
-        const policy = this.getFilePolicy(client.name, data.fieldname);
-        if (!(0, utils_1.isValidMimeType)(data.mimetype, fileConfig.mimeType)) {
-            throw new errors_1.HttpError(`Unsupported media file type: ${data.mimetype}`, 400);
-        }
-        if (fileConfig.array) {
-            const fileCount = await this.fileCount(data.fieldname, client.name, resource.id);
-            if (fileConfig.maxCount && fileConfig.maxCount < fileCount + 1) {
-                throw new errors_1.HttpError(`Maximum number of files allowed: ${fileConfig.maxCount}`, 400);
-            }
-        }
-        let pattern;
-        if ((0, common_1.isFunction)(fileConfig.namePattern)) {
-            pattern = fileConfig.namePattern({
-                fieldName: data.fieldname,
-                fileName: data.filename,
-                encoding: data.encoding,
-                mimeType: data.mimetype,
-                bytesRead: data.file.bytesRead,
-                truncated: data.file.truncated
-            }, resource);
-        }
-        else {
-            pattern = fileConfig.namePattern;
-        }
-        let generatedName = (0, utils_1.generateFileName)(data.filename, pattern, {
-            resourceField: data.fieldname,
-            resourceName: client.name,
-            resourceId: resource.id,
-            userId: identity?.id,
-            userEmail: identity?.email
-        });
-        // The generated name may come from a name pattern configured as a function,
-        // which cannot be validated on startup, so it is checked here as well.
-        this.assertPathNotReserved(generatedName);
-        let nameRegenCount = 0;
-        while (await this._storage.exists(generatedName)) {
-            nameRegenCount++;
-            if (nameRegenCount === 10) {
-                throw new errors_1.HttpError('Unable to generate unique file name', 500);
-            }
-            const hash = (0, common_1.generateToken)('bytes');
-            const nameParts = generatedName.split('.');
-            if (nameParts.length > 1) {
-                const ext = nameParts.pop();
-                const base = nameParts.join('.');
-                generatedName = `${base}-${hash}.${ext}`;
-            }
-            else {
-                generatedName = `${nameParts[0]}-${hash}`;
-            }
-        }
-        const createFile = {
-            name: generatedName,
-            originalName: data.filename,
+        return this.saveContent({
+            fieldName: data.fieldname,
+            fileName: data.filename,
             mimeType: data.mimetype,
-            sizeBytes: data.file.bytesRead,
-            resourceField: data.fieldname,
-            resourceName: client.name,
-            resourceId: resource.id,
-            createdById: identity?.id
-        };
-        if (identity &&
-            policy.canCreate?.(identity, resource, createFile) === false) {
-            throw new errors_1.HttpError('Creating file is forbidden', 403);
-        }
-        let fileStream = data.file;
-        if ((0, utils_1.isProcessableImage)(data.mimetype)) {
-            fileStream = (0, utils_1.processImage)(data.file, data.mimetype, fileConfig.image);
-        }
-        // Tee the stream so the checksum is calculated over the exact bytes
-        // written to storage in a single pass, without buffering the file.
-        const storageStream = new node_stream_1.PassThrough();
-        const checksumStream = new node_stream_1.PassThrough();
-        fileStream.pipe(storageStream);
-        fileStream.pipe(checksumStream);
-        // pipe() does not forward source errors to destinations, so both branches
-        // must be destroyed manually to avoid hanging on a failed upload stream.
-        fileStream.on('error', (e) => {
-            common_1.logger.error(e, 'Error calculating file checksum');
-            storageStream.destroy(e);
-            checksumStream.destroy(e);
-        });
-        const [fileName, checksum] = await Promise.all([
-            this._storage.store(generatedName, storageStream),
-            (0, common_1.makeHash)(checksumStream)
-        ]);
-        if (!fileName) {
-            throw new errors_1.HttpError('Error saving file to storage', 500);
-        }
-        createFile.name = fileName;
-        createFile.checksum = checksum;
-        // File size checks must come after storing a file due to bytesRead and
-        // truncated fields being set only after reading the full file stream.
-        const maxSizeBytes = (0, utils_1.sizeInBytes)(fileConfig.maxSize);
-        if (data.file.truncated ||
-            (maxSizeBytes > 0 && data.file.bytesRead > maxSizeBytes)) {
-            await this._storage.delete(fileName);
-            throw new errors_1.HttpError(`File size exceeded limit of ${maxSizeBytes} bytes`, 400);
-        }
-        try {
-            // Check if a resource already has a file for a single file property and
-            // delete it after successfully creating the new one.
-            let existingFile = null;
-            if (!fileConfig.array) {
-                const resourceWithFile = await client.findFirst({
-                    where: { id: resource.id },
-                    include: { [data.fieldname]: true }
-                });
-                existingFile = resourceWithFile[data.fieldname];
-            }
-            const result = await client.update({
-                where: { id: resource.id },
-                data: {
-                    [data.fieldname]: {
-                        create: createFile
-                    }
-                },
-                include: { [data.fieldname]: true }
-            });
-            if (existingFile !== null) {
-                await this.deleteSafe(existingFile.name);
-            }
-            let file = result[data.fieldname];
-            if ((0, common_1.isArray)(result[data.fieldname])) {
-                file = result[data.fieldname].find((f) => f.name === createFile.name);
-            }
-            file.url = (0, utils_1.buildFileUrl)(file);
-            common_1.logger.debug({ file }, 'File saved');
-            return file;
-        }
-        catch (e) {
-            await this.deleteSafe(fileName);
-            throw new errors_1.HttpError(`File create error`, 500, e);
-        }
+            encoding: data.encoding,
+            stream: data.file,
+            bytesRead: () => data.file.bytesRead,
+            truncated: () => data.file.truncated
+        }, resource, client);
+    }
+    /**
+     * Saves an in-memory file to storage and associates it with a file field of a specific resource. Behaves exactly like
+     * {@link saveFile}, except the content is taken from a buffer instead of a multipart upload, which makes it usable
+     * outside a file upload request, for an avatar downloaded from an OAuth2 provider or an image the application
+     * generates itself.
+     *
+     * @param {string} fieldName The file field of the resource the file is saved to.
+     * @param {FileBuffer} file The file content, along with its original name and media type.
+     * @param {Resource} resource The resource object with which the file is being associated.
+     * @param {ResourceClient} client The database client responsible for handling the resource.
+     * @return {Promise<File>} A promise that resolves to the saved file object or rejects with an error if the operation
+     * fails.
+     * @throws {HttpError} Throws an error if file validation, storage, or resource association fails.
+     */
+    async saveBuffer(fieldName, file, resource, client) {
+        const size = file.size ?? file.data.length;
+        return this.saveContent({
+            fieldName,
+            fileName: file.name,
+            mimeType: file.mimeType,
+            encoding: file.encoding ?? '7bit',
+            stream: node_stream_1.Readable.from(file.data),
+            bytesRead: () => size,
+            truncated: () => false
+        }, resource, client);
     }
     /**
      * Saves files received as an asynchronous iterable of multipart data.
@@ -293,7 +191,7 @@ class FileService {
     async deleteFile(fileName, fieldName, resource, client) {
         const currentUser = (0, security_1.currentAuthUser)();
         const file = await this.findByName(fileName);
-        if (file.resourceId !== resource.id ||
+        if (file.resourceId !== String(resource.id) ||
             file.resourceName !== client.name ||
             file.resourceField !== fieldName) {
             throw new errors_1.HttpError(`File does not belong to a '${client.name}' resource`, 403);
@@ -360,10 +258,12 @@ class FileService {
      * setting (or set to `'keep'`) are left untouched.
      *
      * @param {string} resourceName - The resource model name.
-     * @param {number} resourceId - The ID of the deleted resource.
+     * @param {ResourceId} id - The ID of the deleted resource.
      * @return {Promise<File[]>} A promise that resolves to the list of successfully deleted files.
      */
-    async deleteResourceFiles(resourceName, resourceId) {
+    async deleteResourceFiles(resourceName, id) {
+        // Owning ids are stored as text, whatever the model primary key type is
+        const resourceId = String(id);
         const resourceModel = (0, context_1.injectModel)(resourceName, false);
         if (!resourceModel) {
             return [];
@@ -405,6 +305,158 @@ class FileService {
         return deletedFiles;
     }
     /** @internal */
+    async saveContent(data, resource, client) {
+        const identity = (0, security_1.currentAuthUser)();
+        // Checked against the model rather than the resource object, so a file field
+        // kept out of the resource output is still writable
+        const fileConfig = this.getFileConfig(client.name, data.fieldName);
+        if (!fileConfig) {
+            throw new errors_1.HttpError(`File field '${data.fieldName}' does not exist on resource '${client.name}'`, 400);
+        }
+        const policy = this.getFilePolicy(client.name, data.fieldName);
+        if (!(0, utils_1.isValidMimeType)(data.mimeType, fileConfig.mimeType)) {
+            throw new errors_1.HttpError(`Unsupported media file type: ${data.mimeType}`, 400);
+        }
+        if (fileConfig.array) {
+            const fileCount = await this.fileCount(data.fieldName, client.name, String(resource.id));
+            if (fileConfig.maxCount && fileConfig.maxCount < fileCount + 1) {
+                throw new errors_1.HttpError(`Maximum number of files allowed: ${fileConfig.maxCount}`, 400);
+            }
+        }
+        let pattern;
+        if ((0, common_1.isFunction)(fileConfig.namePattern)) {
+            pattern = fileConfig.namePattern({
+                fieldName: data.fieldName,
+                fileName: data.fileName,
+                encoding: data.encoding,
+                mimeType: data.mimeType,
+                bytesRead: data.bytesRead(),
+                truncated: data.truncated()
+            }, resource);
+        }
+        else {
+            pattern = fileConfig.namePattern;
+        }
+        let generatedName = (0, utils_1.generateFileName)(data.fileName, pattern, {
+            resourceField: data.fieldName,
+            resourceName: client.name,
+            resourceId: resource.id,
+            userId: identity?.id,
+            userEmail: identity?.email
+        });
+        // The generated name may come from a name pattern configured as a function,
+        // which cannot be validated on startup, so it is checked here as well.
+        this.assertPathNotReserved(generatedName);
+        let nameRegenCount = 0;
+        while (await this._storage.exists(generatedName)) {
+            nameRegenCount++;
+            if (nameRegenCount === 10) {
+                throw new errors_1.HttpError('Unable to generate unique file name', 500);
+            }
+            const hash = (0, common_1.generateToken)('bytes');
+            const nameParts = generatedName.split('.');
+            if (nameParts.length > 1) {
+                const ext = nameParts.pop();
+                const base = nameParts.join('.');
+                generatedName = `${base}-${hash}.${ext}`;
+            }
+            else {
+                generatedName = `${nameParts[0]}-${hash}`;
+            }
+        }
+        const createFile = {
+            name: generatedName,
+            originalName: data.fileName,
+            mimeType: data.mimeType,
+            sizeBytes: data.bytesRead(),
+            resourceField: data.fieldName,
+            resourceName: client.name,
+            resourceId: String(resource.id),
+            createdById: identity?.id
+        };
+        if (identity &&
+            policy.canCreate?.(identity, resource, createFile) === false) {
+            throw new errors_1.HttpError('Creating file is forbidden', 403);
+        }
+        let fileStream = data.stream;
+        if ((0, utils_1.isProcessableImage)(data.mimeType)) {
+            fileStream = (0, utils_1.processImage)(data.stream, data.mimeType, fileConfig.image);
+        }
+        // Tee the stream so the checksum and the stored size are calculated over the
+        // exact bytes written to storage in a single pass, without buffering the file.
+        let storedBytes = 0;
+        const storageStream = new node_stream_1.Transform({
+            transform(chunk, _encoding, callback) {
+                storedBytes += chunk.length;
+                callback(null, chunk);
+            }
+        });
+        const checksumStream = new node_stream_1.PassThrough();
+        fileStream.pipe(storageStream);
+        fileStream.pipe(checksumStream);
+        // pipe() does not forward source errors to destinations, so both branches
+        // must be destroyed manually to avoid hanging on a failed upload stream.
+        fileStream.on('error', (e) => {
+            common_1.logger.error(e, 'Error calculating file checksum');
+            storageStream.destroy(e);
+            checksumStream.destroy(e);
+        });
+        const [fileName, checksum] = await Promise.all([
+            this._storage.store(generatedName, storageStream),
+            (0, common_1.makeHash)(checksumStream)
+        ]);
+        if (!fileName) {
+            throw new errors_1.HttpError('Error saving file to storage', 500);
+        }
+        createFile.name = fileName;
+        createFile.checksum = checksum;
+        // The size of the content in storage, which is the processed one for images
+        createFile.sizeBytes = storedBytes;
+        // The size limit applies to the received content, whose read size and
+        // truncation flag are only known once the stream has been consumed.
+        const maxSizeBytes = (0, utils_1.sizeInBytes)(fileConfig.maxSize);
+        if (data.truncated() ||
+            (maxSizeBytes > 0 && data.bytesRead() > maxSizeBytes)) {
+            await this._storage.delete(fileName);
+            throw new errors_1.HttpError(`File size exceeded limit of ${maxSizeBytes} bytes`, 400);
+        }
+        try {
+            // Check if a resource already has a file for a single file property and
+            // delete it after successfully creating the new one.
+            let existingFile = null;
+            if (!fileConfig.array) {
+                const resourceWithFile = await client.findFirst({
+                    where: { id: resource.id },
+                    include: { [data.fieldName]: true }
+                });
+                existingFile = resourceWithFile[data.fieldName];
+            }
+            const result = await client.update({
+                where: { id: resource.id },
+                data: {
+                    [data.fieldName]: {
+                        create: createFile
+                    }
+                },
+                include: { [data.fieldName]: true }
+            });
+            if (existingFile !== null) {
+                await this.deleteSafe(existingFile.name);
+            }
+            let file = result[data.fieldName];
+            if ((0, common_1.isArray)(result[data.fieldName])) {
+                file = result[data.fieldName].find((f) => f.name === createFile.name);
+            }
+            file.url = (0, utils_1.buildFileUrl)(file);
+            common_1.logger.debug({ file }, 'File saved');
+            return file;
+        }
+        catch (e) {
+            await this.deleteSafe(fileName);
+            throw new errors_1.HttpError(`File create error`, 500, e);
+        }
+    }
+    /** @internal */
     assertPathNotReserved(fileName) {
         const reservedPath = (0, common_1.findReservedStoragePath)(fileName, common_1.config.STORAGE_RESERVED_PATHS);
         if (reservedPath !== null) {
@@ -444,13 +496,14 @@ class FileService {
             throw new errors_1.HttpError(`File count read error`, 500, e);
         }
     }
-    /** @internal */
+    /** Returns undefined when the model has no such file field configured.
+     * @internal */
     getFileConfig(resourceName, resourceField) {
         if (!resourceName || !resourceField) {
-            return {};
+            return undefined;
         }
-        const config = (0, context_1.injectModel)(resourceName, false)?.config.files?.[resourceField] ?? {};
-        return { ...config };
+        const config = (0, context_1.injectModel)(resourceName, false)?.config.files?.[resourceField];
+        return config ? { ...config } : undefined;
     }
     /** @internal */
     getFilePolicy(resourceName, resourceField) {

package/storage/resources/file/model.js

@@ -52,9 +52,11 @@ exports.default = (0, factory_1.createModel)({
             required: false,
             hidden: true
         },
+        // Polymorphic reference without a foreign key, stored as text so a file can
+        // belong to a resource with either primary key type
         resourceId: {
-            type: 'int',
-            minimum: 1,
+            type: 'string',
+            maxLength: 36,
             required: false,
             hidden: true
         }

package/types/auth.d.ts

@@ -1,10 +1,11 @@
 import { FastifyRequest } from 'fastify';
-import { AuthScope, AuthSource, AuthUser } from '@appweaver/common';
+import { AuthScope, AuthSource, AuthUser, ResourceId } from '@appweaver/common';
+import { FileBuffer } from './storage';
 export type JwtPayload = {
     scope: AuthScope;
     source: AuthSource;
     username: string;
-    sub: number;
+    sub: ResourceId;
     iat: number;
 };
 export type AuthTokens = {
@@ -14,25 +15,22 @@ export type AuthTokens = {
     refreshExpiresIn: number;
 };
 export type AuthOTTData = {
-    authUserId: number;
+    authUserId: ResourceId;
     authSource: AuthSource;
     providerAccountId?: string;
     scope?: string;
     passwordRequired?: boolean;
 };
 export type TwoFactorAuthData = {
-    authUserId: number;
+    authUserId: ResourceId;
     codeHash: string;
     purpose: string;
 };
 export type OAuth2StateData = {
     redirectToUrl: string;
 };
-export type AvatarFile = {
-    name: string;
-    mimeType: string;
+export type AvatarFile = FileBuffer & {
     size: number;
-    data: Buffer;
 };
 export type UserInfo = {
     id: string;
@@ -62,4 +60,6 @@ export type UserAdditionalData = {
     avatarFile?: AvatarFile;
 };
 export type RegistrationDataFn<T = any> = (source: AuthSource, email: string, password?: string, additionalData?: Partial<UserAdditionalData>) => T | Promise<T>;
+export type RegistrationFilesFn = (source: AuthSource, additionalData?: Partial<UserAdditionalData>) => RegistrationFiles | Promise<RegistrationFiles>;
+export type RegistrationFiles = Record<string, FileBuffer | null | undefined>;
 export type CheckOAuth2UserFn = (source: AuthSource, userInfo: UserInfo, authUser: AuthUser | null) => void | string | Error | Promise<void | string | Error>;

package/types/generated.d.ts

@@ -1,4 +1,4 @@
-import { AggregateSelect, QueryFilter, QuerySort } from '@appweaver/common';
+import { AggregateSelect, IResourceService, QueryFilter, QuerySort } from '@appweaver/common';
 export type ApiKey = {
     id: number;
     key: string;
@@ -66,6 +66,7 @@ export type ApiKeyRelationInput = {
 export type ApiKeyQuery = QueryFilter<ApiKey>;
 export type ApiKeySort = QuerySort<ApiKeyMultiple>;
 export type ApiKeyAggregate = AggregateSelect<ApiKey>;
+export type ApiKeyResourceService = IResourceService<ApiKey, ApiKeyMultiple, ApiKeyCreate, ApiKeyUpdate, ApiKeyQuery>;
 export type ConnectedAccount = {
     id: number;
     provider: string;
@@ -128,6 +129,7 @@ export type ConnectedAccountRelationInput = {
 export type ConnectedAccountQuery = QueryFilter<ConnectedAccount>;
 export type ConnectedAccountSort = QuerySort<ConnectedAccountMultiple>;
 export type ConnectedAccountAggregate = AggregateSelect<ConnectedAccount>;
+export type ConnectedAccountResourceService = IResourceService<ConnectedAccount, ConnectedAccountMultiple, ConnectedAccountCreate, ConnectedAccountUpdate, ConnectedAccountQuery>;
 export type OneTimeToken = {
     id: number;
     tokenHash: string;
@@ -190,6 +192,7 @@ export type OneTimeTokenRelationInput = {
 export type OneTimeTokenQuery = QueryFilter<OneTimeToken>;
 export type OneTimeTokenSort = QuerySort<OneTimeTokenMultiple>;
 export type OneTimeTokenAggregate = AggregateSelect<OneTimeToken>;
+export type OneTimeTokenResourceService = IResourceService<OneTimeToken, OneTimeTokenMultiple, OneTimeTokenCreate, OneTimeTokenUpdate, OneTimeTokenQuery>;
 export type Permission = {
     id: number;
     name: string;
@@ -225,6 +228,7 @@ export type PermissionRelationInput = {
 export type PermissionQuery = QueryFilter<Permission>;
 export type PermissionSort = QuerySort<PermissionMultiple>;
 export type PermissionAggregate = AggregateSelect<Permission>;
+export type PermissionResourceService = IResourceService<Permission, PermissionMultiple, PermissionCreate, PermissionUpdate, PermissionQuery>;
 export type Role = {
     id: number;
     name: string;
@@ -269,6 +273,7 @@ export type RoleRelationInput = {
 export type RoleQuery = QueryFilter<Role>;
 export type RoleSort = QuerySort<RoleMultiple>;
 export type RoleAggregate = AggregateSelect<Role>;
+export type RoleResourceService = IResourceService<Role, RoleMultiple, RoleCreate, RoleUpdate, RoleQuery>;
 export type File = {
     id: number;
     name: string;
@@ -280,7 +285,7 @@ export type File = {
     description?: string | null;
     resourceField?: string | null;
     resourceName?: string | null;
-    resourceId?: number | null;
+    resourceId?: string | null;
     url: string;
     updatedAt: Date;
     createdAt: Date;
@@ -364,3 +369,4 @@ export type FileRelationInput = {
 export type FileQuery = QueryFilter<File>;
 export type FileSort = QuerySort<FileMultiple>;
 export type FileAggregate = AggregateSelect<File>;
+export type FileResourceService = IResourceService<File, FileMultiple, FileCreate, FileUpdate, FileQuery>;

package/types/index.d.ts

@@ -2,3 +2,4 @@ export * from './application-context';
 export * from './auth';
 export * from './generated';
 export * from './server';
+export * from './storage';

package/types/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./application-context"), exports);
 __exportStar(require("./auth"), exports);
 __exportStar(require("./generated"), exports);
 __exportStar(require("./server"), exports);
+__exportStar(require("./storage"), exports);

package/types/storage.d.ts

@@ -0,0 +1,16 @@
+/**
+ * An in-memory file, used to store a file that was not received as a multipart upload, such as an avatar downloaded
+ * from an OAuth2 provider or an image generated by the application itself.
+ */
+export type FileBuffer = {
+    /** The original file name, used to derive the stored name and its extension. */
+    name: string;
+    /** The media type of the content, checked against the `mimeType` of the file field. */
+    mimeType: string;
+    /** The file content. */
+    data: Buffer;
+    /** The content size in bytes checked against the size limit of the file field, defaults to the data buffer length. */
+    size?: number;
+    /** The content encoding, defaults to `7bit`. */
+    encoding?: string;
+};

package/types/storage.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/utils/index.d.ts

@@ -1,5 +1,6 @@
 export * from './export-util';
 export * from './file-util';
 export * from './image-util';
+export * from './model-util';
 export * from './schema-util';
 export * from './virtual-util';

package/utils/index.js

@@ -17,5 +17,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./export-util"), exports);
 __exportStar(require("./file-util"), exports);
 __exportStar(require("./image-util"), exports);
+__exportStar(require("./model-util"), exports);
 __exportStar(require("./schema-util"), exports);
 __exportStar(require("./virtual-util"), exports);

package/utils/model-util.d.ts

@@ -0,0 +1,12 @@
+import { ResourceModel } from '@appweaver/common';
+/**
+ * Validates that the default value of every scalar and virtual field satisfies
+ * the constraints declared on that same field. A default outside its own
+ * constraints produces records that do not match the output schema of their
+ * model, which only surfaces once the model is nested in a nullable relation,
+ * where the response serializer validates it before picking a schema branch.
+ *
+ * @param {Record<string, ResourceModel>} models - All loaded models keyed by name.
+ * @throws {Error} When any default value violates the constraints of its field.
+ */
+export declare function validateScalarDefaults(models: Record<string, ResourceModel>): void;