@araminix/platform 0.0.0-stage → 1.7.0

package/dist/src/server/Endpoint.js

@@ -0,0 +1,809 @@
+import { logger, trimSlash, uuid, wrap, WsCloseCodes } from '@araminix/lib';
+import axios from 'axios';
+import cookieParser from 'cookie-parser';
+import expressCore from 'express';
+import { ipKeyGenerator, rateLimit } from 'express-rate-limit';
+import expressWs from 'express-ws';
+import fs from 'fs';
+import multer from 'multer';
+import path from 'path';
+import { logMiddleware, MimeToExtension, MinioService } from '../utils/index.js';
+import { GoogleData } from './AuthProvider.js';
+import EndpointController from './EndpointController.js';
+function validateToken(req, res, next) {
+    if (!req.token || !req.info) {
+        res.status(401).send({ message: 'Unauthorized' }).end();
+        return;
+    }
+    const isMutation = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method.toUpperCase());
+    const isCookieAuth = Boolean(req.signedCookies?.token && !req.header('x-token'));
+    if (isMutation && isCookieAuth) {
+        const contentType = req.headers['content-type'];
+        const hasJson = Boolean(req.is('application/json') || (typeof contentType === 'string' && contentType.toLowerCase().includes('application/json')));
+        const hasCustomHeader = Boolean(req.header('x-requested-with') || req.header('x-csrf-token'));
+        if (!hasJson && !hasCustomHeader) {
+            res.status(403)
+                .json({
+                error: 'Forbidden: Content-Type: application/json or custom header (e.g. X-Requested-With) required for cookie-authenticated requests',
+                message: 'Forbidden',
+            })
+                .end();
+            return;
+        }
+    }
+    next();
+}
+export default class Endpoint {
+    authProvider;
+    port;
+    mount;
+    version;
+    cookieSecret;
+    sessionTtl;
+    uploadDir;
+    minio;
+    maxUploadBytes;
+    uploadAllowlist;
+    googleClientIds;
+    allowedOrigins;
+    authRateLimit;
+    authRateLimiter;
+    express;
+    server;
+    connections = new Map();
+    endpoints = new Map();
+    COOKIE_OPTIONS;
+    constructor({ authProvider, port = 3000, mount, version, cookieSecret = uuid(), sessionTtl = 3600 * 24, uploadDir, minio = undefined, cookieOptions, maxUploadBytes = 20 * 1024 * 1024, uploadAllowlist, googleClientIds, allowedOrigins, authRateLimit, }) {
+        this.authProvider = authProvider;
+        this.port = port;
+        this.mount = mount ? `/${trimSlash(mount)}` : '';
+        this.version = version ?? '0.0.0';
+        this.cookieSecret = cookieSecret;
+        this.sessionTtl = sessionTtl;
+        this.uploadDir = uploadDir;
+        this.minio = minio;
+        this.maxUploadBytes = maxUploadBytes;
+        this.uploadAllowlist = uploadAllowlist;
+        this.googleClientIds = googleClientIds;
+        this.allowedOrigins = allowedOrigins;
+        this.authRateLimit = authRateLimit;
+        const rateLimitEnabled = this.authRateLimit !== false;
+        if (rateLimitEnabled) {
+            const customConfig = typeof this.authRateLimit === 'object' ? this.authRateLimit : {};
+            this.authRateLimiter = rateLimit({
+                windowMs: customConfig.windowMs ?? 15 * 60 * 1000,
+                limit: customConfig.limit ?? customConfig.max ?? 100,
+                standardHeaders: true,
+                legacyHeaders: false,
+                validate: { xForwardedForHeader: false, default: false },
+                message: customConfig.message ?? {
+                    message: 'Too many authentication attempts, please try again later.',
+                    error: 'Too many requests',
+                },
+                keyGenerator: customConfig.keyGenerator ??
+                    ((req) => {
+                        const rawIp = req.ip || req.socket?.remoteAddress || req.headers['x-forwarded-for'] || '127.0.0.1';
+                        const ip = ipKeyGenerator(typeof rawIp === 'string' ? rawIp : Array.isArray(rawIp) ? rawIp[0] : '127.0.0.1');
+                        const account = req.body?.accountName || req.body?.username || req.body?.email || req.body?.account || req.body?.old_token || '';
+                        return account ? `${ip}:${account}` : ip;
+                    }),
+                ...customConfig,
+            });
+        }
+        else {
+            this.authRateLimiter = (_req, _res, next) => next();
+        }
+        this.COOKIE_OPTIONS = {
+            signed: true,
+            httpOnly: true,
+            secure: true,
+            sameSite: 'lax',
+            path: '/',
+            maxAge: this.sessionTtl * 1000,
+            ...cookieOptions,
+        };
+        const wsOptions = {
+            verifyClient: (info, cb) => {
+                const origin = info.origin || info.req?.headers?.origin || info.req?.headers?.['sec-websocket-origin'];
+                const allowed = this.checkOrigin(origin);
+                if (allowed) {
+                    return cb(true);
+                }
+                return cb(false, 403, 'Forbidden');
+            },
+        };
+        this.express = expressWs(expressCore(), undefined, { wsOptions }).app;
+        this.init();
+    }
+    checkOrigin(origin) {
+        if (!origin) {
+            return true;
+        }
+        if (!this.allowedOrigins || this.allowedOrigins.length === 0) {
+            return false;
+        }
+        if (this.allowedOrigins.includes('*')) {
+            return true;
+        }
+        const normalized = origin.trim().toLowerCase().replace(/\/+$/, '');
+        return this.allowedOrigins.some((allowed) => {
+            return allowed.trim().toLowerCase().replace(/\/+$/, '') === normalized;
+        });
+    }
+    isOriginAllowed(req) {
+        const origin = req.headers?.origin || req.headers?.['sec-websocket-origin'];
+        return this.checkOrigin(origin);
+    }
+    init() {
+        this.express.use(cookieParser(this.cookieSecret));
+        this.express.use(expressCore.json());
+        this.express.use(logMiddleware);
+        this.initMiddleware();
+        this.initWs();
+        this.initAuth();
+        if (this.uploadDir) {
+            this.initMulter(this.uploadDir);
+        }
+        if (this.minio) {
+            this.initMinio(this.minio);
+        }
+        this.init2FA();
+        this.initMobileRequests();
+        return this.express;
+    }
+    declare(name) {
+        if (!this.endpoints.has(name)) {
+            const endpointController = new EndpointController();
+            this.endpoints.set(name, endpointController);
+        }
+    }
+    acquire(name) {
+        logger.trace(`Endpoint - acquire name: ${name}`);
+        this.declare(name);
+        return this.endpoints.get(name).acquire();
+    }
+    async handle(token, info, endpointName, arg, ws) {
+        const endpoint = this.endpoints.get(endpointName);
+        if (!endpoint) {
+            ws.close(WsCloseCodes.NotFound);
+            return;
+        }
+        await endpoint.connect(ws, token, info, arg);
+    }
+    deauth(info, token) {
+        this.endpoints.forEach((endpoint) => {
+            endpoint.deauthUser(info, token);
+        });
+    }
+    initMiddleware() {
+        this.express.use(async (req, _res, next) => {
+            const cookieToken = req.signedCookies?.token;
+            const headerToken = req.header('x-token');
+            req.token = cookieToken ? cookieToken : headerToken ? headerToken : undefined;
+            if (req.token) {
+                const result = await this.authProvider.getInfo(req.token);
+                if (result.isOk()) {
+                    req.info = result.unwrap();
+                }
+            }
+            return next();
+        });
+    }
+    initWs() {
+        /**
+         * @deprecated Use /ws/:endpoint/:arg with cookie or x-token header instead.
+         */
+        this.express.ws(`${this.mount}/ws-token/:token/:endpoint/:arg`, async (ws, req) => {
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                const token = String(req.params.token);
+                const endpointName = String(req.params.endpoint);
+                const arg = String(req.params.arg ?? '');
+                const result = await this.authProvider.getInfo(token);
+                if (result.isErr()) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const clientInfo = result.unwrap();
+                await this.handle(token, clientInfo, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws-token/:token/:endpoint/:arg:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
+            }
+        });
+        /**
+         * @deprecated Use /ws/:endpoint with cookie or x-token header instead.
+         */
+        this.express.ws(`${this.mount}/ws-token/:token/:endpoint`, async (ws, req) => {
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                const token = String(req.params.token);
+                const endpointName = String(req.params.endpoint);
+                const arg = '';
+                const result = await this.authProvider.getInfo(token);
+                if (result.isErr()) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const info = result.unwrap();
+                await this.handle(token, info, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws-token/:token/:endpoint:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
+            }
+        });
+        this.express.ws(`${this.mount}/ws/:endpoint/:arg`, async (ws, req) => {
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                if (!req.info || !req.token) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const arg = String(req.params.arg ?? '');
+                const endpointName = String(req.params.endpoint);
+                await this.handle(req.token, req.info, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws/:endpoint/:arg:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
+            }
+        });
+        this.express.ws(`${this.mount}/ws/:endpoint`, async (ws, req) => {
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                if (!req.info || !req.token) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const arg = '';
+                const endpointName = String(req.params.endpoint);
+                await this.handle(req.token, req.info, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws/:endpoint:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
+            }
+        });
+    }
+    initAuth() {
+        this.express.get(`${this.mount}/health`, (_req, res) => {
+            res.status(200).send('200!').end();
+        });
+        this.express.get(`${this.mount}/version`, (_req, res) => {
+            res.status(200).json({ version: this.version }).end();
+        });
+        this.express.post(`${this.mount}/auth`, this.authRateLimiter, async (req, res) => {
+            const result = await this.authProvider.auth(req.body);
+            if (result.isErr()) {
+                logger.error('API Auth - Login Error: ', result.e);
+                res.status(401).send({ error: result.e }).end();
+                return;
+            }
+            const authResponse = result.unwrap();
+            if (typeof authResponse === 'object') {
+                res.status(200).send(authResponse).end();
+            }
+            else {
+                res.cookie('token', authResponse, this.COOKIE_OPTIONS).status(200).end();
+            }
+        });
+        // TODO (D6): Long-term improvement - have frontend send Google ID token and verify using google-auth-library
+        this.express.post(`${this.mount}/gauth`, this.authRateLimiter, async (req, res) => {
+            if (!this.googleClientIds || this.googleClientIds.length === 0) {
+                logger.error('Google Auth Error: "googleClientIds" is not configured on Endpoint.');
+                res.status(503).send({ message: 'Google authentication is not configured on this server.' }).end();
+                return;
+            }
+            const access_token = req.body?.access_token;
+            if (!access_token || typeof access_token !== 'string') {
+                logger.error('Google Auth Validation Error: "access_token" is required in body.');
+                res.status(422).send({ message: '"access_token" is required in body.' }).end();
+                return;
+            }
+            const tokenInfoResult = await wrap(axios.get(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(access_token)}`, {
+                timeout: 10000,
+            }));
+            if (tokenInfoResult.isErr()) {
+                logger.error('Google Auth Token Info Error: ', tokenInfoResult.e);
+                res.status(401).send({ error: tokenInfoResult.e }).end();
+                return;
+            }
+            const tokenInfoResponse = tokenInfoResult.unwrap();
+            if (tokenInfoResponse.status !== 200 || !tokenInfoResponse.data) {
+                logger.error('Google Auth Token Info Status not 200: ', tokenInfoResponse.data);
+                res.status(401).send({ error: tokenInfoResponse.data }).end();
+                return;
+            }
+            const tokenData = tokenInfoResponse.data;
+            const isAudValid = typeof tokenData.aud === 'string' && this.googleClientIds.includes(tokenData.aud);
+            const isAzpValid = typeof tokenData.azp === 'string' && this.googleClientIds.includes(tokenData.azp);
+            const isClientAuthorized = isAudValid || isAzpValid;
+            const isEmailVerified = tokenData.email_verified === 'true' || tokenData.email_verified === true;
+            if (!isClientAuthorized || !isEmailVerified) {
+                logger.error('Google Auth Token Verification Failed: token not issued for configured client or email not verified.', {
+                    aud: tokenData.aud,
+                    azp: tokenData.azp,
+                    email_verified: tokenData.email_verified,
+                });
+                res.status(401).send({ error: 'Unauthorized Google token: client ID mismatch or email not verified.' }).end();
+                return;
+            }
+            const userInfoResult = await wrap(axios.get('https://www.googleapis.com/oauth2/v1/userinfo', {
+                headers: { Authorization: `Bearer ${access_token}`, Accept: 'application/json' },
+                timeout: 10000,
+            }));
+            if (userInfoResult.isErr()) {
+                logger.error('Google Auth API Error: ', userInfoResult.e);
+                res.status(401).send({ error: userInfoResult.e }).end();
+                return;
+            }
+            const authResponse = userInfoResult.unwrap();
+            if (authResponse.status !== 200) {
+                logger.error('Google Auth Status not 200: ', authResponse.data);
+                res.status(401).send({ error: authResponse.data }).end();
+                return;
+            }
+            const googleData = authResponse.data;
+            if (googleData?.verified_email === false) {
+                logger.error('Google Auth UserInfo Verification Error: email is not verified.', googleData);
+                res.status(401).send({ error: 'Google email is not verified.' }).end();
+                return;
+            }
+            if (tokenData.email && googleData?.email && tokenData.email.toLowerCase() !== googleData.email.toLowerCase()) {
+                logger.error('Google Auth Verification Error: tokeninfo email does not match userinfo email.', {
+                    tokenEmail: tokenData.email,
+                    userEmail: googleData.email,
+                });
+                res.status(401).send({ error: 'Google token email does not match userinfo.' }).end();
+                return;
+            }
+            if (GoogleData.is(googleData)) {
+                const authRes = await this.authProvider.googleAuth(googleData);
+                if (authRes.isErr()) {
+                    logger.error('Google Auth Provider Error: ', authRes.e);
+                    res.status(401).send({ error: authRes.e }).end();
+                    return;
+                }
+                const response = authRes.unwrap();
+                if (typeof response === 'object') {
+                    res.status(200).send(response).end();
+                    return;
+                }
+                res.cookie('token', response, this.COOKIE_OPTIONS).status(200).end();
+            }
+            else {
+                logger.error('Google Data Read Error: ', googleData);
+                res.status(500).end();
+            }
+        });
+        this.express.delete(`${this.mount}/auth`, async (req, res) => {
+            if (req.token && req.info) {
+                await this.authProvider.destroy(req.token);
+                this.deauth(req.info, req.token);
+            }
+            res.clearCookie('token', this.COOKIE_OPTIONS).status(200).send({ success: true }).end();
+        });
+        this.express.put(`${this.mount}/auth/refresh`, this.authRateLimiter, async (req, res) => {
+            const result = await this.authProvider.refreshToken(req.body.old_token);
+            if (result.isErr()) {
+                logger.error('API Auth - Refresh Token Error: ', result.e);
+                res.status(401).send({ error: result.e }).end();
+                return;
+            }
+            const token = result.unwrap();
+            res.cookie('token', token, this.COOKIE_OPTIONS).status(200).end();
+        });
+    }
+    sanitizeFilename(originalName) {
+        const base = path
+            .basename(originalName)
+            .replace(/[/\\]/g, '')
+            .replace(/[\x00-\x1f\x7f-\x9f]/g, '')
+            .trim();
+        const safe = base === '.' || base === '..' || base === '' ? 'upload' : base;
+        return safe.slice(0, 255);
+    }
+    initMulter(uploadDir) {
+        const sanitize = (name) => this.sanitizeFilename(name);
+        const storage = multer.diskStorage({
+            destination: function (_req, file, cb) {
+                const id = uuid();
+                const dir = path.join(uploadDir, id);
+                fs.mkdirSync(dir, { recursive: true });
+                file.id = id;
+                cb(null, dir);
+            },
+            filename: function (_req, file, cb) {
+                file.originalname = sanitize(file.originalname || '');
+                cb(null, file.originalname);
+            },
+        });
+        const fileFilter = (_req, file, cb) => {
+            if (this.uploadAllowlist) {
+                const { extensions, mimetypes } = this.uploadAllowlist;
+                const safeName = sanitize(file.originalname || '');
+                const ext = path.extname(safeName).toLowerCase().replace(/^\./, '');
+                const mime = (file.mimetype || '').toLowerCase();
+                if (extensions && extensions.length > 0) {
+                    const normalizedExts = extensions.map((e) => e.toLowerCase().replace(/^\./, ''));
+                    if (!normalizedExts.includes(ext)) {
+                        const err = new Error('File extension not allowed');
+                        err.statusCode = 415;
+                        cb(err);
+                        return;
+                    }
+                }
+                if (mimetypes && mimetypes.length > 0) {
+                    const normalizedMimes = mimetypes.map((m) => m.toLowerCase());
+                    if (!normalizedMimes.includes(mime)) {
+                        const err = new Error('MIME type not allowed');
+                        err.statusCode = 415;
+                        cb(err);
+                        return;
+                    }
+                }
+            }
+            cb(null, true);
+        };
+        const upload = multer({
+            storage: storage,
+            limits: {
+                fileSize: this.maxUploadBytes,
+                files: 1,
+            },
+            fileFilter,
+        });
+        this.express.post(`${this.mount}/file`, validateToken, (req, res, next) => {
+            upload.single('file')(req, res, (err) => {
+                if (err) {
+                    if (err instanceof multer.MulterError) {
+                        if (err.code === 'LIMIT_FILE_SIZE') {
+                            res.status(413).json({ error: `File exceeds maximum allowed size of ${this.maxUploadBytes} bytes` });
+                            return;
+                        }
+                        res.status(400).json({ error: err.message });
+                        return;
+                    }
+                    const status = err.statusCode || 400;
+                    res.status(status).json({ error: err.message || 'Upload error' });
+                    return;
+                }
+                if (!req.file) {
+                    res.status(400).json({ error: 'No file uploaded' });
+                    return;
+                }
+                next();
+            });
+        }, (req, res) => {
+            const { originalname, size, mimetype, id } = req.file;
+            const fileInfo = {
+                name: originalname,
+                size,
+                mimetype,
+                id,
+                userId: req.info?.id ?? '',
+            };
+            const infoPath = path.join(uploadDir, fileInfo.id, 'index.json');
+            fs.writeFile(infoPath, JSON.stringify(fileInfo), (err) => {
+                if (err) {
+                    logger.error('Failed to write file metadata:', err);
+                    res.status(500).json({ error: 'Failed to save file metadata' }).end();
+                    return;
+                }
+                res.status(200).json(fileInfo).end();
+            });
+        });
+        this.express.get(`${this.mount}/file/:fileId`, validateToken, (req, res) => {
+            const fileId = String(req.params.fileId);
+            const dir = path.join(uploadDir, fileId);
+            fs.readFile(path.join(dir, 'index.json'), (err, data) => {
+                if (err) {
+                    res.status(404).end();
+                }
+                else {
+                    try {
+                        const info = JSON.parse(data.toString());
+                        if (!info || typeof info.name !== 'string') {
+                            res.status(404).end();
+                            return;
+                        }
+                        const safeName = encodeURIComponent(path.basename(info.name));
+                        if (!safeName) {
+                            res.status(404).end();
+                            return;
+                        }
+                        res.redirect(302, `${req.baseUrl}${req.path}/${safeName}`);
+                    }
+                    catch (parseErr) {
+                        logger.error('Corrupt index.json for fileId:', fileId, parseErr);
+                        res.status(404).end();
+                    }
+                }
+            });
+        });
+        this.express.use(`${this.mount}/file/`, validateToken, expressCore.static(this.uploadDir, {
+            index: false,
+            dotfiles: 'deny',
+            setHeaders: (res) => {
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('Content-Disposition', 'attachment');
+                res.setHeader('Content-Security-Policy', "default-src 'none'; sandbox");
+            },
+        }));
+    }
+    init2FA() {
+        this.express.post(`${this.mount}/2fa/request`, validateToken, async (req, res) => {
+            try {
+                const result = await this.authProvider.request2FA(req.info?.id ?? '');
+                if (!result.isOk()) {
+                    logger.error('API Auth - 2FA Request Error: ', result.e);
+                    res.status(401).send({ error: result.e }).end();
+                    return;
+                }
+                res.status(200).send({ url: result.v }).end();
+            }
+            catch (error) {
+                res.status(500).send({ error }).end();
+            }
+        });
+        /**
+         * Enables 2FA for the authenticated user.
+         *
+         * SECURITY REQUIREMENT:
+         * The AuthProvider implementation MUST verify that the `secret` in the request body
+         * matches the secret that the server issued in `request2FA` for this user, rather than
+         * blindly accepting an arbitrary secret provided by the client.
+         */
+        this.express.post(`${this.mount}/2fa/enable`, validateToken, async (req, res) => {
+            try {
+                const { code, secret } = req.body;
+                if (!code) {
+                    res.status(400).send({ message: '2FA code is required' }).end();
+                    return;
+                }
+                if (!secret) {
+                    res.status(400).send({ message: '2FA secret is required' }).end();
+                    return;
+                }
+                const result = await this.authProvider.enable2FA(req.info?.id ?? '', secret, code);
+                if (!result.isOk()) {
+                    logger.error('API Auth - 2FA Enable Error: ', result.e);
+                    res.status(401).send({ error: result.e }).end();
+                    return;
+                }
+                res.status(200).send({ success: result.v }).end();
+            }
+            catch (error) {
+                res.status(500).send({ error }).end();
+            }
+        });
+        this.express.post(`${this.mount}/2fa/verify`, this.authRateLimiter, async (req, res) => {
+            try {
+                const { accountName, code, uuid: uuidCode } = req.body;
+                if (!accountName || !code || !uuidCode) {
+                    res.status(400).send({ message: 'AccountName, code, and uuid are required.' }).end();
+                    return;
+                }
+                const result = await this.authProvider.verify2FA(accountName, code, uuidCode);
+                if (result.isErr()) {
+                    logger.error('API Auth - 2FA Verify Error: ', result.e);
+                    res.status(401).send({ error: result.e }).end();
+                    return;
+                }
+                const verifyResponse = result.unwrap();
+                if (typeof verifyResponse === 'boolean') {
+                    res.status(200).send({ success: verifyResponse }).end();
+                }
+                else {
+                    res.cookie('token', verifyResponse, this.COOKIE_OPTIONS).status(200).end();
+                }
+            }
+            catch (error) {
+                res.status(500).send({ error }).end();
+            }
+        });
+        this.express.delete(`${this.mount}/2fa/disable`, validateToken, async (req, res) => {
+            try {
+                const rawCode = req.body?.code ?? req.query?.code;
+                const code = rawCode !== undefined && rawCode !== null ? String(rawCode) : undefined;
+                const result = await this.authProvider.disable2FA(req.info?.id ?? '', code);
+                if (result.isErr()) {
+                    logger.error('API Auth - 2FA Disable Error: ', result.e);
+                    res.status(401).send({ error: result.e }).end();
+                    return;
+                }
+                res.status(200).send({ success: result.unwrap() }).end();
+            }
+            catch (error) {
+                res.status(500).send({ error }).end();
+            }
+        });
+    }
+    initMinio(minio) {
+        const minioService = new MinioService(minio);
+        this.express.post(`${this.mount}/attachments/upload`, validateToken, async (req, res) => {
+            try {
+                if (!req.info?.id) {
+                    res.status(401).send({ message: 'Unauthorized' }).end();
+                    return;
+                }
+                const { mimetype, fileName } = req.body || {};
+                if (!mimetype || typeof mimetype !== 'string' || !fileName || typeof fileName !== 'string') {
+                    res.status(400).send({ message: 'mimetype and fileName are required strings.' }).end();
+                    return;
+                }
+                const decodedFileName = (() => {
+                    try {
+                        return decodeURIComponent(fileName);
+                    }
+                    catch {
+                        return fileName;
+                    }
+                })();
+                if (fileName.includes('..') ||
+                    fileName.startsWith('/') ||
+                    fileName.startsWith('\\') ||
+                    decodedFileName.includes('..') ||
+                    decodedFileName.startsWith('/') ||
+                    decodedFileName.startsWith('\\')) {
+                    res.status(400).send({ message: 'Invalid fileName: path traversal and leading slash are not allowed.' }).end();
+                    return;
+                }
+                let ext = path.extname(fileName).replace(/^\./, '').trim().toLowerCase();
+                if (!ext && mimetype) {
+                    const mimeExt = MimeToExtension[mimetype];
+                    if (mimeExt && mimeExt !== '*') {
+                        ext = mimeExt.toLowerCase();
+                    }
+                }
+                if (ext && !/^[a-zA-Z0-9]+$/.test(ext)) {
+                    ext = '';
+                }
+                const userId = req.info.id;
+                const fileId = uuid();
+                const key = ext ? `${userId}/${fileId}.${ext}` : `${userId}/${fileId}`;
+                const urlResult = await minioService.presignedPutObject(mimetype, key);
+                if (urlResult.isErr()) {
+                    logger.error('Error on Upload Request API: ', urlResult.e);
+                    res.status(500).send({ error: urlResult.e }).end();
+                    return;
+                }
+                const url = urlResult.unwrap();
+                res.status(200).json({ url, key, attachmentId: key }).end();
+            }
+            catch (error) {
+                logger.error('Error on Upload Request API: ', error);
+                res.status(500).send({ error }).end();
+            }
+        });
+        const handleGetAttachment = async (req, res) => {
+            try {
+                if (!req.info?.id) {
+                    res.status(401).send({ message: 'Unauthorized' }).end();
+                    return;
+                }
+                let attachmentId = '';
+                if (req.params.userId && req.params.fileName) {
+                    attachmentId = `${req.params.userId}/${req.params.fileName}`;
+                }
+                else if (req.params.attachmentId) {
+                    attachmentId = String(req.params.attachmentId);
+                }
+                if (!attachmentId) {
+                    res.status(400).send({ message: 'attachmentId is required.' }).end();
+                    return;
+                }
+                const decoded = (() => {
+                    try {
+                        return decodeURIComponent(attachmentId);
+                    }
+                    catch {
+                        return attachmentId;
+                    }
+                })();
+                if (attachmentId.includes('..') ||
+                    attachmentId.startsWith('/') ||
+                    attachmentId.startsWith('\\') ||
+                    decoded.includes('..') ||
+                    decoded.startsWith('/') ||
+                    decoded.startsWith('\\')) {
+                    res.status(400).send({ message: 'Invalid attachmentId: path traversal and leading slash are not allowed.' }).end();
+                    return;
+                }
+                const userId = req.info.id;
+                let objectKey;
+                if (attachmentId.startsWith(`${userId}/`)) {
+                    objectKey = attachmentId;
+                }
+                else if (!attachmentId.includes('/')) {
+                    objectKey = `${userId}/${attachmentId}`;
+                }
+                else {
+                    logger.error(`IDOR attempt or unauthorized attachment access denied for user '${userId}': ${attachmentId}`);
+                    res.status(403).send({ message: 'Forbidden: access to attachment denied.' }).end();
+                    return;
+                }
+                if (objectKey === `${userId}/` || objectKey.endsWith('/')) {
+                    res.status(400).send({ message: 'Invalid attachmentId: file name cannot be empty.' }).end();
+                    return;
+                }
+                const fileURLResult = await minioService.presignedGetObject(objectKey);
+                if (fileURLResult.isErr()) {
+                    logger.error('Error on Get File API: ', fileURLResult.e);
+                    res.status(500).send({ error: fileURLResult.e }).end();
+                    return;
+                }
+                const fileURL = fileURLResult.unwrap();
+                res.status(200).json({ fileURL }).end();
+            }
+            catch (error) {
+                logger.error('Error on Get File API: ', error);
+                res.status(500).send({ error }).end();
+            }
+        };
+        this.express.get(`${this.mount}/attachments/:attachmentId`, validateToken, handleGetAttachment);
+        this.express.get(`${this.mount}/attachments/:userId/:fileName`, validateToken, handleGetAttachment);
+    }
+    initMobileRequests() {
+        this.express.post(`${this.mount}/mobile/:module/:action`, validateToken, async (req, res) => {
+            try {
+                const moduleName = String(req.params.module);
+                const action = String(req.params.action);
+                if (!moduleName || !action) {
+                    res.status(400).send({ error: 'Module and action are both required.' }).end();
+                    return;
+                }
+                const result = await this.authProvider.mobileRequests({
+                    module: moduleName,
+                    action: action,
+                    userId: req.info?.id ?? '',
+                    data: req.body,
+                });
+                if (result.status !== 200) {
+                    logger.error('API Auth - Mobile Request Error: ', result.error);
+                }
+                res.status(result.status).send(result).end();
+            }
+            catch (error) {
+                res.status(500).send({ error }).end();
+            }
+        });
+    }
+    open() {
+        if (!this.server) {
+            this.server = this.express.listen(this.port);
+        }
+    }
+    close() {
+        if (this.server) {
+            this.server.close();
+        }
+    }
+}
+//# sourceMappingURL=Endpoint.js.map