@axium/server 0.42.1 → 0.43.1

package/dist/api/images.d.ts

@@ -1,11 +1,6 @@
-export interface ImageUploadConfig {
-    enabled: boolean;
-    /** Max size in KB */
-    max_size: number;
-    /** Max pixels per dimension */
-    max_length: number;
-}
-export declare function checkImageUpload(request: Request, cfg: ImageUploadConfig, userId: string): Promise<{
+import { type ImageUploadConfig } from '../config.js';
+export interface PreparedImageUpload {
     data: Uint8Array<ArrayBuffer>;
     type: string;
-}>;
+}
+export declare function prepareImageUpload(request: Request, cfg: ImageUploadConfig, userId: string): Promise<PreparedImageUpload>;

package/dist/api/images.js

@@ -1,32 +1,13 @@
+import { debug } from 'ioium';
 import { sql } from 'kysely';
-import { warn } from 'ioium/node';
-import { execSync } from 'node:child_process';
+import sharp from 'sharp';
 import * as z from 'zod';
 import { checkAuthForUser } from '../auth.js';
 import { config } from '../config.js';
 import { database as db } from '../database.js';
 import { error, withError } from '../requests.js';
 import { addRoute } from '../routes.js';
-let imageSize;
-try {
-    const mod = await import('image-size');
-    imageSize = mod.imageSize;
-}
-catch {
-    try {
-        // Fall back to `identify` from ImageMagick
-        execSync('command -v identify');
-        imageSize = function identifyImageSize(input) {
-            const stdout = execSync('identify -ping -format "%w %h" -', { input, timeout: 1000 });
-            const [width, height] = stdout.toString().trim().split(' ').map(Number);
-            return { width, height };
-        };
-    }
-    catch {
-        warn('Can not determine profile picture dimensions because neither image-size or ImageMagick is available');
-    }
-}
-export async function checkImageUpload(request, cfg, userId) {
+export async function prepareImageUpload(request, cfg, userId) {
     const { enabled, max_size, max_length } = cfg;
     if (!enabled)
         error(503, 'Image uploads are disabled');
@@ -36,20 +17,29 @@ export async function checkImageUpload(request, cfg, userId) {
         error(400, 'Missing Content-Type header');
     if (!type.startsWith('image/'))
         error(415, 'Only image files are allowed');
-    const size = Number(request.headers.get('content-length'));
-    if (!Number.isSafeInteger(size))
+    const contentLength = Number(request.headers.get('content-length'));
+    if (!Number.isSafeInteger(contentLength))
         error(400, 'Invalid Content-Length header');
-    if (max_size && size / 1000 > max_size)
-        error(413, `Image must be smaller than ${max_size} KB`);
-    const data = await request.bytes();
-    if (data.byteLength != size)
+    const rawData = await request.bytes();
+    if (rawData.byteLength != contentLength)
         error(400, 'Content-Length does not match actual data size');
-    const { width, height } = imageSize?.(data) || { width: 0, height: 0 };
-    if (imageSize && (!width || !height))
+    const { data, info } = await sharp(rawData)
+        .autoOrient()
+        .timeout({ seconds: 10 })
+        .resize({ width: max_length, height: max_length, fit: 'cover', withoutEnlargement: true })
+        .toBuffer({ resolveWithObject: true });
+    const { width, height, size } = info;
+    if (!width || !height)
         error(400, 'Invalid image dimensions');
-    if (max_length && (width > max_length || height > max_length))
+    debug(`Prepared image upload: ${Math.round(size / 1000)}KB @ ${width}x${height}`);
+    if (max_size && size / 1000 > max_size)
+        error(413, `Image must be smaller than ${max_size} KB (got ${Math.round(size / 1000)} KB)`);
+    if (max_length && (width > max_length || height > max_length)) {
         error(413, `Image must be smaller than ${max_length}x${max_length} pixels`);
-    return { data, type };
+    }
+    if (!(data.buffer instanceof ArrayBuffer))
+        error(500, 'Unexpectedly got a shared buffer from sharp.');
+    return { data: data, type };
 }
 addRoute({
     path: '/raw/pfp/:id',
@@ -101,7 +91,7 @@ addRoute({
         });
     },
     async POST(request, { id: userId }) {
-        const { data, type } = await checkImageUpload(request, config.user_pfp, userId);
+        const { data, type } = await prepareImageUpload(request, config.user_pfp, userId);
         const { isInsert } = await db
             .insertInto('profile_pictures')
             .values({ userId, data, type })

package/dist/auth.js

@@ -181,7 +181,7 @@ export async function authSessionForItem(itemType, itemId, permissions, session,
  * This will fetch the item, ACLs, users, and the authenticating session.
  */
 export async function authRequestForItem(request, itemType, itemId, permissions, recursive = false) {
-    let session = null;
+    let session;
     try {
         const token = getToken(request, false);
         if (!token)

package/dist/config.d.ts

@@ -1,5 +1,12 @@
 import { type DeepRequired } from 'utilium';
 import * as z from 'zod';
+export declare const ImageUploadConfig: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    max_size: z.ZodNumber;
+    max_length: z.ZodInt;
+}, z.core.$strip>;
+export interface ImageUploadConfig extends z.infer<typeof ImageUploadConfig> {
+}
 export declare const Config: z.ZodObject<{
     admin_api: z.ZodOptional<z.ZodBoolean>;
     allow_new_users: z.ZodOptional<z.ZodBoolean>;
@@ -45,7 +52,7 @@ export declare const Config: z.ZodObject<{
     user_pfp: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
         max_size: z.ZodOptional<z.ZodNumber>;
-        max_length: z.ZodOptional<z.ZodNumber>;
+        max_length: z.ZodOptional<z.ZodInt>;
     }, z.core.$loose>>;
     verifications: z.ZodOptional<z.ZodObject<{
         timeout: z.ZodOptional<z.ZodNumber>;
@@ -127,7 +134,7 @@ export declare const ConfigFile: z.ZodObject<{
     user_pfp: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
         max_size: z.ZodOptional<z.ZodNumber>;
-        max_length: z.ZodOptional<z.ZodNumber>;
+        max_length: z.ZodOptional<z.ZodInt>;
     }, z.core.$loose>>>;
     verifications: z.ZodOptional<z.ZodOptional<z.ZodObject<{
         timeout: z.ZodOptional<z.ZodNumber>;

package/dist/config.js

@@ -9,6 +9,14 @@ import * as z from 'zod';
 import { dirs, logger, systemDir } from './io.js';
 import { _duplicateStateWarnings, _unique } from './state.js';
 const audit_severity_levels = ['emergency', 'alert', 'critical', 'error', 'warning', 'notice', 'info', 'debug'];
+export const ImageUploadConfig = z.object({
+    /** Whether images can be uploaded */
+    enabled: z.boolean(),
+    /** Max image size in KB. Set to zero for no limit */
+    max_size: z.number().min(0),
+    /** Max dimensions on a side. Set to zero for no limit */
+    max_length: z.int().min(0),
+});
 export const Config = z
     .looseObject({
     /** Whether /api/admin is enabled */
@@ -63,16 +71,8 @@ export const Config = z
     show_duplicate_state: z.boolean(),
     /** Who can use the user discovery API. For example, setting to `admin` means regular users need to type a full email in the ACL dialog and won't be shown results */
     user_discovery: z.literal(['disabled', 'admin', 'user', 'public']),
-    user_pfp: z
-        .looseObject({
-        /** Whether user's can upload custom profile pictures */
-        enabled: z.boolean(),
-        /** Max PFP size in KB. Set to zero for no limit */
-        max_size: z.number().min(0),
-        /** Max dimensions on a side. Set to zero for no limit */
-        max_length: z.number().min(0),
-    })
-        .partial(),
+    /** Configuration for user profile pictures */
+    user_pfp: ImageUploadConfig.loose().partial(),
     verifications: z
         .looseObject({
         /** In minutes */
@@ -143,7 +143,7 @@ export const defaultConfig = {
     user_pfp: {
         enabled: true,
         max_size: 500,
-        max_length: 2000,
+        max_length: 750,
     },
     verifications: {
         timeout: 60,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/server",
-	"version": "0.42.1",
+	"version": "0.43.1",
 	"author": "James Prevett <axium@jamespre.dev>",
 	"funding": {
 		"type": "individual",
@@ -62,6 +62,7 @@
 		"ioium": "^0.1.0",
 		"logzen": "^0.7.0",
 		"pg": "^8.14.1",
+		"sharp": "^0.34.5",
 		"svelte": "^5.36.0"
 	},
 	"devDependencies": {
@@ -69,7 +70,6 @@
 		"vite-plugin-mkcert": "^1.17.8"
 	},
 	"optionalDependencies": {
-		"image-size": "^2.0.2",
 		"ua-parser-js": "^2.0.9"
 	}
 }

package/routes/account/+page.svelte

@@ -3,7 +3,7 @@
 	import { ClipboardCopy, FormDialog, Icon, Logout, Popover, SessionList, UserPFP, ZodForm } from '@axium/client/components';
 	import '@axium/client/styles/account';
 	import { createPasskey, deletePasskey, deleteUser, sendVerificationEmail, updatePasskey, updateUser } from '@axium/client/user';
-	import { preferenceLabels, Preferences } from '@axium/core/preferences';
+	import { Preferences } from '@axium/core/preferences';
 	import type { PageProps } from './$types';
 	import { toast, toastStatus } from '@axium/client/toast';
 	import { contextMenu } from '@axium/client/attachments';
@@ -221,7 +221,6 @@
 			bind:rootValue={user.preferences}
 			idPrefix="preferences"
 			schema={Preferences}
-			labels={preferenceLabels}
 			updateValue={(preferences: Preferences) => fetchAPI('PATCH', 'users/:id', { preferences }, user.id)}
 		/>
 	</div>

package/routes/admin/users/[id]/+page.svelte

@@ -3,7 +3,7 @@
 	import { ClipboardCopy, FormDialog, Icon, SessionList, UserPFP, ZodForm, ZodInput } from '@axium/client/components';
 	import { toast } from '@axium/client/toast';
 	import '@axium/client/styles/account';
-	import { preferenceLabels, Preferences, User } from '@axium/core';
+	import { Preferences, User } from '@axium/core';
 	import { formatDateRange } from '@axium/core/format';
 
 	const { data } = $props();
@@ -134,7 +134,6 @@
 	<ZodForm
 		bind:rootValue={user.preferences}
 		schema={Preferences}
-		labels={preferenceLabels}
 		updateValue={(preferences: Preferences) => fetchAPI('PATCH', 'users/:id', { preferences }, user.id)}
 	/>
 </div>

package/schemas/config.json

@@ -158,8 +158,9 @@
                     "minimum": 0
                 },
                 "max_length": {
-                    "type": "number",
-                    "minimum": 0
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 9007199254740991
                 }
             },
             "additionalProperties": {}