@araminix/platform 1.0.0 → 1.7.0

package/dist/src/server/Endpoint.js

@@ -2,20 +2,36 @@ import { logger, trimSlash, uuid, wrap, WsCloseCodes } from '@araminix/lib';
 import axios from 'axios';
 import cookieParser from 'cookie-parser';
 import expressCore from 'express';
+import { ipKeyGenerator, rateLimit } from 'express-rate-limit';
 import expressWs from 'express-ws';
 import fs from 'fs';
 import multer from 'multer';
 import path from 'path';
-import { logMiddleware, MinioService } from '../utils/index.js';
+import { logMiddleware, MimeToExtension, MinioService } from '../utils/index.js';
 import { GoogleData } from './AuthProvider.js';
 import EndpointController from './EndpointController.js';
 function validateToken(req, res, next) {
     if (!req.token || !req.info) {
         res.status(401).send({ message: 'Unauthorized' }).end();
+        return;
     }
-    else {
-        next();
+    const isMutation = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method.toUpperCase());
+    const isCookieAuth = Boolean(req.signedCookies?.token && !req.header('x-token'));
+    if (isMutation && isCookieAuth) {
+        const contentType = req.headers['content-type'];
+        const hasJson = Boolean(req.is('application/json') || (typeof contentType === 'string' && contentType.toLowerCase().includes('application/json')));
+        const hasCustomHeader = Boolean(req.header('x-requested-with') || req.header('x-csrf-token'));
+        if (!hasJson && !hasCustomHeader) {
+            res.status(403)
+                .json({
+                error: 'Forbidden: Content-Type: application/json or custom header (e.g. X-Requested-With) required for cookie-authenticated requests',
+                message: 'Forbidden',
+            })
+                .end();
+            return;
+        }
     }
+    next();
 }
 export default class Endpoint {
     authProvider;
@@ -26,12 +42,18 @@ export default class Endpoint {
     sessionTtl;
     uploadDir;
     minio;
+    maxUploadBytes;
+    uploadAllowlist;
+    googleClientIds;
+    allowedOrigins;
+    authRateLimit;
+    authRateLimiter;
     express;
     server;
     connections = new Map();
     endpoints = new Map();
     COOKIE_OPTIONS;
-    constructor({ authProvider, port = 3000, mount, version, cookieSecret = uuid(), sessionTtl = 3600 * 24, uploadDir, minio = undefined }) {
+    constructor({ authProvider, port = 3000, mount, version, cookieSecret = uuid(), sessionTtl = 3600 * 24, uploadDir, minio = undefined, cookieOptions, maxUploadBytes = 20 * 1024 * 1024, uploadAllowlist, googleClientIds, allowedOrigins, authRateLimit, }) {
         this.authProvider = authProvider;
         this.port = port;
         this.mount = mount ? `/${trimSlash(mount)}` : '';
@@ -40,10 +62,78 @@ export default class Endpoint {
         this.sessionTtl = sessionTtl;
         this.uploadDir = uploadDir;
         this.minio = minio;
-        this.COOKIE_OPTIONS = { signed: true, httpOnly: false, maxAge: this.sessionTtl * 1000 };
-        this.express = expressWs(expressCore()).app;
+        this.maxUploadBytes = maxUploadBytes;
+        this.uploadAllowlist = uploadAllowlist;
+        this.googleClientIds = googleClientIds;
+        this.allowedOrigins = allowedOrigins;
+        this.authRateLimit = authRateLimit;
+        const rateLimitEnabled = this.authRateLimit !== false;
+        if (rateLimitEnabled) {
+            const customConfig = typeof this.authRateLimit === 'object' ? this.authRateLimit : {};
+            this.authRateLimiter = rateLimit({
+                windowMs: customConfig.windowMs ?? 15 * 60 * 1000,
+                limit: customConfig.limit ?? customConfig.max ?? 100,
+                standardHeaders: true,
+                legacyHeaders: false,
+                validate: { xForwardedForHeader: false, default: false },
+                message: customConfig.message ?? {
+                    message: 'Too many authentication attempts, please try again later.',
+                    error: 'Too many requests',
+                },
+                keyGenerator: customConfig.keyGenerator ??
+                    ((req) => {
+                        const rawIp = req.ip || req.socket?.remoteAddress || req.headers['x-forwarded-for'] || '127.0.0.1';
+                        const ip = ipKeyGenerator(typeof rawIp === 'string' ? rawIp : Array.isArray(rawIp) ? rawIp[0] : '127.0.0.1');
+                        const account = req.body?.accountName || req.body?.username || req.body?.email || req.body?.account || req.body?.old_token || '';
+                        return account ? `${ip}:${account}` : ip;
+                    }),
+                ...customConfig,
+            });
+        }
+        else {
+            this.authRateLimiter = (_req, _res, next) => next();
+        }
+        this.COOKIE_OPTIONS = {
+            signed: true,
+            httpOnly: true,
+            secure: true,
+            sameSite: 'lax',
+            path: '/',
+            maxAge: this.sessionTtl * 1000,
+            ...cookieOptions,
+        };
+        const wsOptions = {
+            verifyClient: (info, cb) => {
+                const origin = info.origin || info.req?.headers?.origin || info.req?.headers?.['sec-websocket-origin'];
+                const allowed = this.checkOrigin(origin);
+                if (allowed) {
+                    return cb(true);
+                }
+                return cb(false, 403, 'Forbidden');
+            },
+        };
+        this.express = expressWs(expressCore(), undefined, { wsOptions }).app;
         this.init();
     }
+    checkOrigin(origin) {
+        if (!origin) {
+            return true;
+        }
+        if (!this.allowedOrigins || this.allowedOrigins.length === 0) {
+            return false;
+        }
+        if (this.allowedOrigins.includes('*')) {
+            return true;
+        }
+        const normalized = origin.trim().toLowerCase().replace(/\/+$/, '');
+        return this.allowedOrigins.some((allowed) => {
+            return allowed.trim().toLowerCase().replace(/\/+$/, '') === normalized;
+        });
+    }
+    isOriginAllowed(req) {
+        const origin = req.headers?.origin || req.headers?.['sec-websocket-origin'];
+        return this.checkOrigin(origin);
+    }
     init() {
         this.express.use(cookieParser(this.cookieSecret));
         this.express.use(expressCore.json());
@@ -100,47 +190,105 @@ export default class Endpoint {
         });
     }
     initWs() {
+        /**
+         * @deprecated Use /ws/:endpoint/:arg with cookie or x-token header instead.
+         */
         this.express.ws(`${this.mount}/ws-token/:token/:endpoint/:arg`, async (ws, req) => {
-            const token = String(req.params.token);
-            const endpointName = String(req.params.endpoint);
-            const arg = String(req.params.arg ?? '');
-            const result = await this.authProvider.getInfo(token);
-            if (result.isErr()) {
-                ws.close(WsCloseCodes.Unauthorized);
-                return;
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                const token = String(req.params.token);
+                const endpointName = String(req.params.endpoint);
+                const arg = String(req.params.arg ?? '');
+                const result = await this.authProvider.getInfo(token);
+                if (result.isErr()) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const clientInfo = result.unwrap();
+                await this.handle(token, clientInfo, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws-token/:token/:endpoint/:arg:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
             }
-            const clientInfo = result.unwrap();
-            await this.handle(token, clientInfo, endpointName, arg, ws);
         });
+        /**
+         * @deprecated Use /ws/:endpoint with cookie or x-token header instead.
+         */
         this.express.ws(`${this.mount}/ws-token/:token/:endpoint`, async (ws, req) => {
-            const token = String(req.params.token);
-            const endpointName = String(req.params.endpoint);
-            const arg = '';
-            const result = await this.authProvider.getInfo(token);
-            if (result.isErr()) {
-                ws.close(WsCloseCodes.Unauthorized);
-                return;
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                const token = String(req.params.token);
+                const endpointName = String(req.params.endpoint);
+                const arg = '';
+                const result = await this.authProvider.getInfo(token);
+                if (result.isErr()) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const info = result.unwrap();
+                await this.handle(token, info, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws-token/:token/:endpoint:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
             }
-            const info = result.unwrap();
-            await this.handle(token, info, endpointName, arg, ws);
         });
         this.express.ws(`${this.mount}/ws/:endpoint/:arg`, async (ws, req) => {
-            if (!req.info || !req.token) {
-                ws.close(WsCloseCodes.Unauthorized);
-                return;
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                if (!req.info || !req.token) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const arg = String(req.params.arg ?? '');
+                const endpointName = String(req.params.endpoint);
+                await this.handle(req.token, req.info, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws/:endpoint/:arg:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
             }
-            const arg = String(req.params.arg ?? '');
-            const endpointName = String(req.params.endpoint);
-            await this.handle(req.token, req.info, endpointName, arg, ws);
         });
         this.express.ws(`${this.mount}/ws/:endpoint`, async (ws, req) => {
-            if (!req.info || !req.token) {
-                ws.close(WsCloseCodes.Unauthorized);
-                return;
+            try {
+                if (!this.isOriginAllowed(req)) {
+                    ws.close(WsCloseCodes.Denied);
+                    return;
+                }
+                if (!req.info || !req.token) {
+                    ws.close(WsCloseCodes.Unauthorized);
+                    return;
+                }
+                const arg = '';
+                const endpointName = String(req.params.endpoint);
+                await this.handle(req.token, req.info, endpointName, arg, ws);
+            }
+            catch (err) {
+                logger.error('Unhandled rejection in /ws/:endpoint:', err);
+                try {
+                    ws.close(WsCloseCodes.InternalError);
+                }
+                catch { }
             }
-            const arg = '';
-            const endpointName = String(req.params.endpoint);
-            await this.handle(req.token, req.info, endpointName, arg, ws);
         });
     }
     initAuth() {
@@ -150,7 +298,7 @@ export default class Endpoint {
         this.express.get(`${this.mount}/version`, (_req, res) => {
             res.status(200).json({ version: this.version }).end();
         });
-        this.express.post(`${this.mount}/auth`, async (req, res) => {
+        this.express.post(`${this.mount}/auth`, this.authRateLimiter, async (req, res) => {
             const result = await this.authProvider.auth(req.body);
             if (result.isErr()) {
                 logger.error('API Auth - Login Error: ', result.e);
@@ -165,28 +313,76 @@ export default class Endpoint {
                 res.cookie('token', authResponse, this.COOKIE_OPTIONS).status(200).end();
             }
         });
-        this.express.post(`${this.mount}/gauth`, async (req, res) => {
-            const access_token = req.body.access_token;
-            if (!access_token) {
+        // TODO (D6): Long-term improvement - have frontend send Google ID token and verify using google-auth-library
+        this.express.post(`${this.mount}/gauth`, this.authRateLimiter, async (req, res) => {
+            if (!this.googleClientIds || this.googleClientIds.length === 0) {
+                logger.error('Google Auth Error: "googleClientIds" is not configured on Endpoint.');
+                res.status(503).send({ message: 'Google authentication is not configured on this server.' }).end();
+                return;
+            }
+            const access_token = req.body?.access_token;
+            if (!access_token || typeof access_token !== 'string') {
                 logger.error('Google Auth Validation Error: "access_token" is required in body.');
                 res.status(422).send({ message: '"access_token" is required in body.' }).end();
                 return;
             }
-            const result = await wrap(axios.get(`https://www.googleapis.com/oauth2/v1/userinfo?access_token=${access_token}`, {
+            const tokenInfoResult = await wrap(axios.get(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(access_token)}`, {
+                timeout: 10000,
+            }));
+            if (tokenInfoResult.isErr()) {
+                logger.error('Google Auth Token Info Error: ', tokenInfoResult.e);
+                res.status(401).send({ error: tokenInfoResult.e }).end();
+                return;
+            }
+            const tokenInfoResponse = tokenInfoResult.unwrap();
+            if (tokenInfoResponse.status !== 200 || !tokenInfoResponse.data) {
+                logger.error('Google Auth Token Info Status not 200: ', tokenInfoResponse.data);
+                res.status(401).send({ error: tokenInfoResponse.data }).end();
+                return;
+            }
+            const tokenData = tokenInfoResponse.data;
+            const isAudValid = typeof tokenData.aud === 'string' && this.googleClientIds.includes(tokenData.aud);
+            const isAzpValid = typeof tokenData.azp === 'string' && this.googleClientIds.includes(tokenData.azp);
+            const isClientAuthorized = isAudValid || isAzpValid;
+            const isEmailVerified = tokenData.email_verified === 'true' || tokenData.email_verified === true;
+            if (!isClientAuthorized || !isEmailVerified) {
+                logger.error('Google Auth Token Verification Failed: token not issued for configured client or email not verified.', {
+                    aud: tokenData.aud,
+                    azp: tokenData.azp,
+                    email_verified: tokenData.email_verified,
+                });
+                res.status(401).send({ error: 'Unauthorized Google token: client ID mismatch or email not verified.' }).end();
+                return;
+            }
+            const userInfoResult = await wrap(axios.get('https://www.googleapis.com/oauth2/v1/userinfo', {
                 headers: { Authorization: `Bearer ${access_token}`, Accept: 'application/json' },
+                timeout: 10000,
             }));
-            if (result.isErr()) {
-                logger.error('Google Auth API Error: ', result.e);
-                res.status(401).send({ error: result.e }).end();
+            if (userInfoResult.isErr()) {
+                logger.error('Google Auth API Error: ', userInfoResult.e);
+                res.status(401).send({ error: userInfoResult.e }).end();
                 return;
             }
-            const authResponse = result.unwrap();
+            const authResponse = userInfoResult.unwrap();
             if (authResponse.status !== 200) {
                 logger.error('Google Auth Status not 200: ', authResponse.data);
                 res.status(401).send({ error: authResponse.data }).end();
                 return;
             }
             const googleData = authResponse.data;
+            if (googleData?.verified_email === false) {
+                logger.error('Google Auth UserInfo Verification Error: email is not verified.', googleData);
+                res.status(401).send({ error: 'Google email is not verified.' }).end();
+                return;
+            }
+            if (tokenData.email && googleData?.email && tokenData.email.toLowerCase() !== googleData.email.toLowerCase()) {
+                logger.error('Google Auth Verification Error: tokeninfo email does not match userinfo email.', {
+                    tokenEmail: tokenData.email,
+                    userEmail: googleData.email,
+                });
+                res.status(401).send({ error: 'Google token email does not match userinfo.' }).end();
+                return;
+            }
             if (GoogleData.is(googleData)) {
                 const authRes = await this.authProvider.googleAuth(googleData);
                 if (authRes.isErr()) {
@@ -211,9 +407,9 @@ export default class Endpoint {
                 await this.authProvider.destroy(req.token);
                 this.deauth(req.info, req.token);
             }
-            res.clearCookie('token').status(200).send({ success: true }).end();
+            res.clearCookie('token', this.COOKIE_OPTIONS).status(200).send({ success: true }).end();
         });
-        this.express.put(`${this.mount}/auth/refresh`, async (req, res) => {
+        this.express.put(`${this.mount}/auth/refresh`, this.authRateLimiter, async (req, res) => {
             const result = await this.authProvider.refreshToken(req.body.old_token);
             if (result.isErr()) {
                 logger.error('API Auth - Refresh Token Error: ', result.e);
@@ -224,7 +420,17 @@ export default class Endpoint {
             res.cookie('token', token, this.COOKIE_OPTIONS).status(200).end();
         });
     }
+    sanitizeFilename(originalName) {
+        const base = path
+            .basename(originalName)
+            .replace(/[/\\]/g, '')
+            .replace(/[\x00-\x1f\x7f-\x9f]/g, '')
+            .trim();
+        const safe = base === '.' || base === '..' || base === '' ? 'upload' : base;
+        return safe.slice(0, 255);
+    }
     initMulter(uploadDir) {
+        const sanitize = (name) => this.sanitizeFilename(name);
         const storage = multer.diskStorage({
             destination: function (_req, file, cb) {
                 const id = uuid();
@@ -234,11 +440,67 @@ export default class Endpoint {
                 cb(null, dir);
             },
             filename: function (_req, file, cb) {
+                file.originalname = sanitize(file.originalname || '');
                 cb(null, file.originalname);
             },
         });
-        const upload = multer({ storage: storage });
-        this.express.post(`${this.mount}/file`, validateToken, upload.single('file'), (req, res) => {
+        const fileFilter = (_req, file, cb) => {
+            if (this.uploadAllowlist) {
+                const { extensions, mimetypes } = this.uploadAllowlist;
+                const safeName = sanitize(file.originalname || '');
+                const ext = path.extname(safeName).toLowerCase().replace(/^\./, '');
+                const mime = (file.mimetype || '').toLowerCase();
+                if (extensions && extensions.length > 0) {
+                    const normalizedExts = extensions.map((e) => e.toLowerCase().replace(/^\./, ''));
+                    if (!normalizedExts.includes(ext)) {
+                        const err = new Error('File extension not allowed');
+                        err.statusCode = 415;
+                        cb(err);
+                        return;
+                    }
+                }
+                if (mimetypes && mimetypes.length > 0) {
+                    const normalizedMimes = mimetypes.map((m) => m.toLowerCase());
+                    if (!normalizedMimes.includes(mime)) {
+                        const err = new Error('MIME type not allowed');
+                        err.statusCode = 415;
+                        cb(err);
+                        return;
+                    }
+                }
+            }
+            cb(null, true);
+        };
+        const upload = multer({
+            storage: storage,
+            limits: {
+                fileSize: this.maxUploadBytes,
+                files: 1,
+            },
+            fileFilter,
+        });
+        this.express.post(`${this.mount}/file`, validateToken, (req, res, next) => {
+            upload.single('file')(req, res, (err) => {
+                if (err) {
+                    if (err instanceof multer.MulterError) {
+                        if (err.code === 'LIMIT_FILE_SIZE') {
+                            res.status(413).json({ error: `File exceeds maximum allowed size of ${this.maxUploadBytes} bytes` });
+                            return;
+                        }
+                        res.status(400).json({ error: err.message });
+                        return;
+                    }
+                    const status = err.statusCode || 400;
+                    res.status(status).json({ error: err.message || 'Upload error' });
+                    return;
+                }
+                if (!req.file) {
+                    res.status(400).json({ error: 'No file uploaded' });
+                    return;
+                }
+                next();
+            });
+        }, (req, res) => {
             const { originalname, size, mimetype, id } = req.file;
             const fileInfo = {
                 name: originalname,
@@ -248,7 +510,12 @@ export default class Endpoint {
                 userId: req.info?.id ?? '',
             };
             const infoPath = path.join(uploadDir, fileInfo.id, 'index.json');
-            fs.writeFile(infoPath, JSON.stringify(fileInfo), () => {
+            fs.writeFile(infoPath, JSON.stringify(fileInfo), (err) => {
+                if (err) {
+                    logger.error('Failed to write file metadata:', err);
+                    res.status(500).json({ error: 'Failed to save file metadata' }).end();
+                    return;
+                }
                 res.status(200).json(fileInfo).end();
             });
         });
@@ -260,12 +527,35 @@ export default class Endpoint {
                     res.status(404).end();
                 }
                 else {
-                    const info = JSON.parse(data.toString());
-                    res.redirect(302, `${req.baseUrl}${req.path}/${info.name}`);
+                    try {
+                        const info = JSON.parse(data.toString());
+                        if (!info || typeof info.name !== 'string') {
+                            res.status(404).end();
+                            return;
+                        }
+                        const safeName = encodeURIComponent(path.basename(info.name));
+                        if (!safeName) {
+                            res.status(404).end();
+                            return;
+                        }
+                        res.redirect(302, `${req.baseUrl}${req.path}/${safeName}`);
+                    }
+                    catch (parseErr) {
+                        logger.error('Corrupt index.json for fileId:', fileId, parseErr);
+                        res.status(404).end();
+                    }
                 }
             });
         });
-        this.express.use(`${this.mount}/file/`, validateToken, expressCore.static(this.uploadDir));
+        this.express.use(`${this.mount}/file/`, validateToken, expressCore.static(this.uploadDir, {
+            index: false,
+            dotfiles: 'deny',
+            setHeaders: (res) => {
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('Content-Disposition', 'attachment');
+                res.setHeader('Content-Security-Policy', "default-src 'none'; sandbox");
+            },
+        }));
     }
     init2FA() {
         this.express.post(`${this.mount}/2fa/request`, validateToken, async (req, res) => {
@@ -282,6 +572,14 @@ export default class Endpoint {
                 res.status(500).send({ error }).end();
             }
         });
+        /**
+         * Enables 2FA for the authenticated user.
+         *
+         * SECURITY REQUIREMENT:
+         * The AuthProvider implementation MUST verify that the `secret` in the request body
+         * matches the secret that the server issued in `request2FA` for this user, rather than
+         * blindly accepting an arbitrary secret provided by the client.
+         */
         this.express.post(`${this.mount}/2fa/enable`, validateToken, async (req, res) => {
             try {
                 const { code, secret } = req.body;
@@ -305,7 +603,7 @@ export default class Endpoint {
                 res.status(500).send({ error }).end();
             }
         });
-        this.express.post(`${this.mount}/2fa/verify`, async (req, res) => {
+        this.express.post(`${this.mount}/2fa/verify`, this.authRateLimiter, async (req, res) => {
             try {
                 const { accountName, code, uuid: uuidCode } = req.body;
                 if (!accountName || !code || !uuidCode) {
@@ -332,7 +630,9 @@ export default class Endpoint {
         });
         this.express.delete(`${this.mount}/2fa/disable`, validateToken, async (req, res) => {
             try {
-                const result = await this.authProvider.disable2FA(req.info?.id ?? '');
+                const rawCode = req.body?.code ?? req.query?.code;
+                const code = rawCode !== undefined && rawCode !== null ? String(rawCode) : undefined;
+                const result = await this.authProvider.disable2FA(req.info?.id ?? '', code);
                 if (result.isErr()) {
                     logger.error('API Auth - 2FA Disable Error: ', result.e);
                     res.status(401).send({ error: result.e }).end();
@@ -348,32 +648,127 @@ export default class Endpoint {
     initMinio(minio) {
         const minioService = new MinioService(minio);
         this.express.post(`${this.mount}/attachments/upload`, validateToken, async (req, res) => {
-            const { attachmentId, mimetype, fileName } = req.body;
-            if (!attachmentId || !mimetype || !fileName) {
-                res.status(400).send({ message: 'attachmentId, mimetype, and fileName are required.' }).end();
-                return;
+            try {
+                if (!req.info?.id) {
+                    res.status(401).send({ message: 'Unauthorized' }).end();
+                    return;
+                }
+                const { mimetype, fileName } = req.body || {};
+                if (!mimetype || typeof mimetype !== 'string' || !fileName || typeof fileName !== 'string') {
+                    res.status(400).send({ message: 'mimetype and fileName are required strings.' }).end();
+                    return;
+                }
+                const decodedFileName = (() => {
+                    try {
+                        return decodeURIComponent(fileName);
+                    }
+                    catch {
+                        return fileName;
+                    }
+                })();
+                if (fileName.includes('..') ||
+                    fileName.startsWith('/') ||
+                    fileName.startsWith('\\') ||
+                    decodedFileName.includes('..') ||
+                    decodedFileName.startsWith('/') ||
+                    decodedFileName.startsWith('\\')) {
+                    res.status(400).send({ message: 'Invalid fileName: path traversal and leading slash are not allowed.' }).end();
+                    return;
+                }
+                let ext = path.extname(fileName).replace(/^\./, '').trim().toLowerCase();
+                if (!ext && mimetype) {
+                    const mimeExt = MimeToExtension[mimetype];
+                    if (mimeExt && mimeExt !== '*') {
+                        ext = mimeExt.toLowerCase();
+                    }
+                }
+                if (ext && !/^[a-zA-Z0-9]+$/.test(ext)) {
+                    ext = '';
+                }
+                const userId = req.info.id;
+                const fileId = uuid();
+                const key = ext ? `${userId}/${fileId}.${ext}` : `${userId}/${fileId}`;
+                const urlResult = await minioService.presignedPutObject(mimetype, key);
+                if (urlResult.isErr()) {
+                    logger.error('Error on Upload Request API: ', urlResult.e);
+                    res.status(500).send({ error: urlResult.e }).end();
+                    return;
+                }
+                const url = urlResult.unwrap();
+                res.status(200).json({ url, key, attachmentId: key }).end();
             }
-            const minioFileName = `${req.info?.id}/${fileName}`;
-            const urlResult = await minioService.presignedPutObject(mimetype, minioFileName);
-            if (urlResult.isErr()) {
-                logger.error('Error on Upload Request API: ', urlResult.e);
-                res.status(500).send(urlResult.e).end();
-                return;
+            catch (error) {
+                logger.error('Error on Upload Request API: ', error);
+                res.status(500).send({ error }).end();
             }
-            const url = urlResult.unwrap();
-            res.status(200).json({ url }).end();
         });
-        this.express.get(`${this.mount}/attachments/:attachmentId`, validateToken, async (req, res) => {
+        const handleGetAttachment = async (req, res) => {
             try {
-                const attachmentId = String(req.params.attachmentId);
-                const fileURL = await minioService.presignedGetObject(attachmentId);
+                if (!req.info?.id) {
+                    res.status(401).send({ message: 'Unauthorized' }).end();
+                    return;
+                }
+                let attachmentId = '';
+                if (req.params.userId && req.params.fileName) {
+                    attachmentId = `${req.params.userId}/${req.params.fileName}`;
+                }
+                else if (req.params.attachmentId) {
+                    attachmentId = String(req.params.attachmentId);
+                }
+                if (!attachmentId) {
+                    res.status(400).send({ message: 'attachmentId is required.' }).end();
+                    return;
+                }
+                const decoded = (() => {
+                    try {
+                        return decodeURIComponent(attachmentId);
+                    }
+                    catch {
+                        return attachmentId;
+                    }
+                })();
+                if (attachmentId.includes('..') ||
+                    attachmentId.startsWith('/') ||
+                    attachmentId.startsWith('\\') ||
+                    decoded.includes('..') ||
+                    decoded.startsWith('/') ||
+                    decoded.startsWith('\\')) {
+                    res.status(400).send({ message: 'Invalid attachmentId: path traversal and leading slash are not allowed.' }).end();
+                    return;
+                }
+                const userId = req.info.id;
+                let objectKey;
+                if (attachmentId.startsWith(`${userId}/`)) {
+                    objectKey = attachmentId;
+                }
+                else if (!attachmentId.includes('/')) {
+                    objectKey = `${userId}/${attachmentId}`;
+                }
+                else {
+                    logger.error(`IDOR attempt or unauthorized attachment access denied for user '${userId}': ${attachmentId}`);
+                    res.status(403).send({ message: 'Forbidden: access to attachment denied.' }).end();
+                    return;
+                }
+                if (objectKey === `${userId}/` || objectKey.endsWith('/')) {
+                    res.status(400).send({ message: 'Invalid attachmentId: file name cannot be empty.' }).end();
+                    return;
+                }
+                const fileURLResult = await minioService.presignedGetObject(objectKey);
+                if (fileURLResult.isErr()) {
+                    logger.error('Error on Get File API: ', fileURLResult.e);
+                    res.status(500).send({ error: fileURLResult.e }).end();
+                    return;
+                }
+                const fileURL = fileURLResult.unwrap();
                 res.status(200).json({ fileURL }).end();
             }
             catch (error) {
                 logger.error('Error on Get File API: ', error);
-                res.status(500).send(error).end();
+                res.status(500).send({ error }).end();
             }
-        });
+        };
+        this.express.get(`${this.mount}/attachments/:attachmentId`, validateToken, handleGetAttachment);
+        this.express.get(`${this.mount}/attachments/:userId/:fileName`, validateToken, handleGetAttachment);
     }
     initMobileRequests() {
         this.express.post(`${this.mount}/mobile/:module/:action`, validateToken, async (req, res) => {