@astram/guard 0.13.0 → 0.14.0

package/dist/storage/storage.providers.js

@@ -0,0 +1,104 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STORAGE_EXPORTS = void 0;
+exports.storageProviders = storageProviders;
+/**
+ * `ShieldModule` providers for the `storage` option (FILE_STORAGE SPEC §6):
+ * - `SHIELD_OBJECT_STORE`: the given `ObjectStore`, an `S3ObjectStore` built from
+ *   `OBJECT_STORAGE_*` (`'env'`; `null` when `OBJECT_STORAGE_BUCKET` is unset), or `null` when
+ *   the option is absent (the `makeAuditSinkProvider` null-binding pattern; callers answer 501).
+ * - `SHIELD_FILE_INGEST`: core `createFileIngest` over `NodeSha256Digest`, with the `xlsx`
+ *   profile (its cap set from `OBJECT_STORAGE_MAX_BYTES` under `'env'`). Always bound.
+ * - `ObjectStoreBootCheck`: registered only when the option is given (fail-closed ping at boot).
+ *
+ * `S3ObjectStore` (and so `@aws-sdk/client-s3`) is loaded lazily, only for `'env'` with a bucket.
+ */
+const node_crypto_1 = require("node:crypto");
+const core_1 = require("@astram/core");
+const app_config_js_1 = require("../config/app-config.js");
+const boot_secrets_js_1 = require("../secrets/boot-secrets.js");
+const shield_tokens_js_1 = require("../module/shield-tokens.js");
+const node_sha256_digest_js_1 = require("./node-sha256-digest.js");
+const object_store_boot_check_js_1 = require("./object-store-boot-check.js");
+/** The tokens `ShieldModule` exports app-wide for the storage option. */
+exports.STORAGE_EXPORTS = [shield_tokens_js_1.SHIELD_OBJECT_STORE, shield_tokens_js_1.SHIELD_FILE_INGEST];
+const STORE_METHODS = ['put', 'get', 'head', 'delete', 'ping'];
+/** Build the storage providers for one `ShieldModule` registration (see the file header). */
+function storageProviders(storage) {
+    if (storage !== undefined && storage !== 'env') {
+        const s = storage;
+        if (STORE_METHODS.some((m) => typeof s?.[m] !== 'function')) {
+            throw new Error("ShieldModule: `storage` must be an ObjectStore (put/get/head/delete/ping) or 'env'");
+        }
+    }
+    const configToken = Symbol('SHIELD_OBJECT_STORAGE_CONFIG');
+    return [
+        {
+            provide: configToken,
+            useFactory: () => storage === 'env'
+                ? ((0, app_config_js_1.loadObjectStorageConfig)(process.env, {
+                    resolvedFromSecretRef: boot_secrets_js_1.wasResolvedFromSecretRef,
+                }) ?? null)
+                : null,
+        },
+        {
+            provide: shield_tokens_js_1.SHIELD_OBJECT_STORE,
+            useFactory: async (config) => {
+                if (storage === undefined)
+                    return null;
+                if (storage !== 'env')
+                    return storage;
+                if (config === null)
+                    return null;
+                const { S3ObjectStore } = await Promise.resolve().then(() => __importStar(require('./s3-object-store.js')));
+                return new S3ObjectStore(config);
+            },
+            inject: [configToken],
+        },
+        {
+            provide: shield_tokens_js_1.SHIELD_FILE_INGEST,
+            useFactory: (config) => (0, core_1.createFileIngest)({
+                digest: new node_sha256_digest_js_1.NodeSha256Digest(),
+                newId: node_crypto_1.randomUUID,
+                profiles: {
+                    xlsx: config ? { ...core_1.XLSX_PROFILE, maxBytes: config.maxBytes } : core_1.XLSX_PROFILE,
+                },
+            }),
+            inject: [configToken],
+        },
+        ...(storage !== undefined ? [object_store_boot_check_js_1.ObjectStoreBootCheck] : []),
+    ];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -32,21 +32,29 @@
     "access": "public"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "3.1142.0",
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.5.4",
-    "@astram/core": "1.5.0",
-    "@astram/engine": "0.6.0"
+    "@astram/core": "1.6.0",
+    "@astram/engine": "0.7.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
     "@nestjs/core": "^11",
+    "@nestjs/platform-express": "^11",
     "reflect-metadata": "^0.2",
     "rxjs": "^7"
   },
+  "peerDependenciesMeta": {
+    "@nestjs/platform-express": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
+    "@nestjs/platform-express": "^11.0.0",
     "@nestjs/testing": "^11.0.0",
     "@types/node": "^22.0.0",
     "@types/supertest": "^6.0.2",