@arcote.tech/arc-files 0.7.26 → 0.7.28

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@arcote.tech/arc-files",
   "type": "module",
-  "version": "0.7.26",
+  "version": "0.7.28",
   "private": false,
   "description": "Generic file upload fragment for Arc framework — S3 presigned upload + provider file_id binding",
   "main": "./src/index.ts",
@@ -10,9 +10,9 @@
     "type-check": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@arcote.tech/arc": "^0.7.26",
-    "@arcote.tech/arc-ds": "^0.7.26",
-    "@arcote.tech/platform": "^0.7.26",
+    "@arcote.tech/arc": "^0.7.28",
+    "@arcote.tech/arc-ds": "^0.7.28",
+    "@arcote.tech/platform": "^0.7.28",
     "@aws-sdk/client-s3": "^3.658.0",
     "@aws-sdk/s3-request-presigner": "^3.658.0",
     "lucide-react": ">=0.400.0",

package/src/aggregates/file.ts

@@ -8,6 +8,7 @@ import {
   string,
   type ArcAggregateElement,
   type ArcId,
+  type ArcRawShape,
 } from "@arcote.tech/arc";
 import type { S3Bridge } from "../s3/s3-client";
 import type { FileProviderName } from "../types";
@@ -51,9 +52,20 @@ export function createFileTypeAggregate<const Data extends FileTypeData>(
   const metadataShape = data.metadata;
   const fullShape = mergeUnsafe(builtInFields, metadataShape);
 
-  // `requestUpload` params zawiera built-in (name, mime, size) + WSZYSTKIE
-  // custom metadata fields — consumer dostarcza je przy uploadzie (np.
-  // accountId, opcjonalnie workspaceId).
+  // `requestUpload` params = built-in (name, mime, size) + custom metadata,
+  // ale metadata są OPCJONALNE. Pola scope (accountId itd.) są wyprowadzane
+  // autorytatywnie z aktywnego tokena server-side (patrz handler niżej), więc
+  // klient nie musi — i nie powinien — ich wysyłać. Consumer może pominąć
+  // wartość pochodzącą z tokena; serwer i tak ją nadpisze wartością z tokena.
+  const optionalMetadata: ArcRawShape = {};
+  for (const [key, element] of Object.entries(metadataShape)) {
+    // `validate(undefined) === false` → element już jest opcjonalny
+    // (ArcOptional), nie owijaj ponownie (ArcOptional nie ma `.optional()`).
+    const alreadyOptional = (element as any).validate?.(undefined) === false;
+    optionalMetadata[key] = alreadyOptional
+      ? element
+      : (element as any).optional();
+  }
   const requestUploadParams = mergeUnsafe(
     {
       _id: fileId,
@@ -61,7 +73,7 @@ export function createFileTypeAggregate<const Data extends FileTypeData>(
       mime: string(),
       size: number(),
     },
-    metadataShape,
+    optionalMetadata,
   );
 
   // `fileRequested` event payload = `requestUploadParams` + s3 fields
@@ -142,6 +154,27 @@ export function createFileTypeAggregate<const Data extends FileTypeData>(
               const s3Key = `${data.name}/${p._id}/${p.name}`;
               const uploadUrl = await s3.presignUpload(s3Key, p.name && p.mime);
 
+              // Pola scope (accountId itd.) bierzemy AUTORYTATYWNIE z aktywnego
+              // tokena — nigdy z params klienta. `protection.check(tokenPayload)`
+              // zwraca dokładnie mapowanie token→metadata (`{accountId: p.accountId}`),
+              // to samo, którego arc-core używa do restrykcji scope. Zapobiega
+              // podszyciu pod cudze accountId i znosi wymóg wysyłania go przez
+              // klienta (który przed załadowaniem `me` słał undefined → padała
+              // walidacja wejścia).
+              const auth = (ctx as any).$auth as
+                | { params: any; tokenName: string }
+                | undefined;
+              const derived: Record<string, any> = {};
+              if (auth?.tokenName) {
+                for (const protection of data.protections) {
+                  if ((protection.token as any).name !== auth.tokenName) continue;
+                  const restriction = protection.check(auth.params);
+                  if (restriction && typeof restriction === "object") {
+                    Object.assign(derived, restriction);
+                  }
+                }
+              }
+
               const payload: Record<string, any> = {
                 _id: p._id,
                 name: p.name,
@@ -151,7 +184,7 @@ export function createFileTypeAggregate<const Data extends FileTypeData>(
                 s3Key,
               };
               for (const key of Object.keys(metadataShape)) {
-                payload[key] = p[key];
+                payload[key] = key in derived ? derived[key] : p[key];
               }
               await (ctx as any).fileRequested.emit(payload);
 

package/src/file-type-builder.ts

@@ -2,8 +2,10 @@
 import type {
   ArcId,
   ArcRawShape,
+  ArcRawShapeType,
   ArcTokenAny,
   Merge,
+  ViewProtectionFn,
 } from "@arcote.tech/arc";
 import { createFileTypeAggregate } from "./aggregates/file";
 import type { S3Bridge } from "./s3/s3-client";
@@ -17,9 +19,24 @@ export interface FileTypeProtection {
   token: ArcTokenAny;
   // `params` is the decoded token payload; user-provided check returns
   // a where-clause restriction (`{field: value}`) or `false` to deny.
-  check: (params: any) => Record<string, unknown> | false;
+  // Typowane tym samym `ViewProtectionFn` co `aggregate.protectBy` — payload
+  // tokena inferowany z `token` (zero `any` po stronie konsumenta).
+  check: ViewProtectionFn;
 }
 
+/**
+ * Ctx handlera custom mutation (`.withMutation()`). Auto-generowany emitter
+ * `<name>Performed` jest TYPOWANY (łapie literówkę w nazwie eventu). Reszta
+ * ctx (`modify`/`$query`/`set`/`findOne`) pozostaje permisywna — pełne
+ * otypowanie blokuje limit instancjacji TS na rosnących tuple
+ * Events/MutateMethods (ten sam powód co `aggAny: any` w `aggregates/file.ts`).
+ */
+export type FileMutationContext<N extends string> = {
+  [K in `${N}Performed`]: {
+    emit: (payload: Record<string, unknown>) => Promise<void>;
+  };
+} & Record<string, any>;
+
 /**
  * Custom mutation rejestrowana przez `.withMutation()`. Builder generuje
  * dedicated event `<name>Performed` + mutation method z params. Handler
@@ -95,10 +112,7 @@ export class ArcFileTypeBuilder<
    * tokena. Każdy `.protectedBy()` dodaje jeden entry do listy; przy
    * `.build()` builder iteruje i woła `aggregate.protectBy()` per entry.
    */
-  protectedBy<T extends ArcTokenAny>(
-    token: T,
-    check: (params: any) => Record<string, unknown> | false,
-  ) {
+  protectedBy<T extends ArcTokenAny>(token: T, check: ViewProtectionFn<T>) {
     type NewProtections = [
       ...Data["protections"],
       { token: T; check: typeof check },
@@ -126,7 +140,10 @@ export class ArcFileTypeBuilder<
   withMutation<const N extends string, const P extends ArcRawShape>(
     name: N,
     params: P,
-    handler: (ctx: any, params: any) => Promise<void>,
+    handler: (
+      ctx: FileMutationContext<N>,
+      params: { _id: string } & ArcRawShapeType<P>,
+    ) => Promise<void>,
   ) {
     type NewMutations = [
       ...Data["mutations"],