@axium/storage 0.2.0 → 0.2.2

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 import { type Schema } from '@axium/server/database';
-import type { ExpressionBuilder, Generated, Selectable } from 'kysely';
+import type { Generated, Selectable } from 'kysely';
 import type { StorageItemMetadata, StorageLimits, StorageUsage } from './common.js';
 import './polyfills.js';
 declare module '@axium/server/database' {
@@ -53,15 +53,12 @@ declare module '@axium/server/config' {
 export interface StorageItem extends StorageItemMetadata {
     data: Uint8Array<ArrayBufferLike>;
 }
-export declare function parseItem<T extends Record<string, unknown> = Record<string, unknown>>(item: Selectable<Schema['storage']> & {
-    hash: string;
-}): StorageItemMetadata<T>;
+export declare function parseItem<T extends Record<string, unknown> = Record<string, unknown>>(item: Selectable<Schema['storage']>): StorageItemMetadata<T>;
 /**
  * Returns the current usage of the storage for a user in bytes.
  */
 export declare function currentUsage(userId: string): Promise<StorageUsage>;
 export declare function get<T extends Record<string, unknown> = Record<string, unknown>>(itemId: string): Promise<StorageItemMetadata<T>>;
-export declare function withEncodedHash(eb: ExpressionBuilder<Schema, 'storage'>): import("kysely").AliasedExpression<string, "hash">;
 export type ExternalLimitHandler = (userId?: string) => StorageLimits | Promise<StorageLimits>;
 /**
  * Define the handler to get limits for a user externally.

package/dist/server.js

@@ -1,8 +1,9 @@
-import { getSessionAndUser } from '@axium/server/auth';
+import { Permission } from '@axium/core/access';
+import { checkAuthForItem, checkAuthForUser, getSessionAndUser } from '@axium/server/auth';
 import { addConfigDefaults, config } from '@axium/server/config';
 import { connect, database, expectedTypes } from '@axium/server/database';
 import { dirs } from '@axium/server/io';
-import { checkAuth, getToken, parseBody, withError } from '@axium/server/requests';
+import { getToken, parseBody, withError } from '@axium/server/requests';
 import { addRoute } from '@axium/server/routes';
 import { error } from '@sveltejs/kit';
 import { createHash } from 'node:crypto';
@@ -52,6 +53,7 @@ export function parseItem(item) {
         ...item,
         metadata: item.metadata,
         dataURL: `/raw/storage/${item.id}`,
+        hash: item.hash.toHex(),
     };
 }
 /**
@@ -73,13 +75,10 @@ export async function get(itemId) {
         .selectFrom('storage')
         .where('id', '=', itemId)
         .selectAll()
-        .select(withEncodedHash)
+        .$narrowType()
         .executeTakeFirstOrThrow();
     return parseItem(result);
 }
-export function withEncodedHash(eb) {
-    return eb.fn('encode', ['hash', eb.val('hex')]).as('hash');
-}
 let _getLimits = null;
 /**
  * Define the handler to get limits for a user externally.
@@ -102,21 +101,15 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const itemId = event.params.id;
-        const item = await get(itemId);
-        if (!item)
-            error(404, 'Item not found');
-        await checkAuth(event, item.userId);
-        return item;
+        const { item } = await checkAuthForItem(event, 'storage', itemId, Permission.Read);
+        return parseItem(item);
     },
     async PATCH(event) {
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const itemId = event.params.id;
         const body = await parseBody(event, StorageItemUpdate);
-        const item = await get(itemId);
-        if (!item)
-            error(404, 'Item not found');
-        await checkAuth(event, item.userId);
+        await checkAuthForItem(event, 'storage', itemId, Permission.Manage);
         const values = {};
         if ('publicPermission' in body)
             values.publicPermission = body.publicPermission;
@@ -133,7 +126,6 @@ addRoute({
             .where('id', '=', itemId)
             .set(values)
             .returningAll()
-            .returning(withEncodedHash)
             .executeTakeFirstOrThrow()
             .catch(withError('Could not update item')));
     },
@@ -141,10 +133,8 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const itemId = event.params.id;
-        const item = await get(itemId);
-        if (!item)
-            error(404, 'Item not found');
-        await checkAuth(event, item.userId);
+        const auth = await checkAuthForItem(event, 'storage', itemId, Permission.Manage);
+        const item = parseItem(auth.item);
         await database
             .deleteFrom('storage')
             .where('id', '=', itemId)
@@ -168,10 +158,7 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const itemId = event.params.id;
-        const item = await get(itemId);
-        if (!item)
-            error(404, 'Item not found');
-        await checkAuth(event, item.userId);
+        const { item } = await checkAuthForItem(event, 'storage', itemId, Permission.Read);
         if (item.type != 'inode/directory')
             error(409, 'Item is not a directory');
         const items = await database
@@ -179,7 +166,6 @@ addRoute({
             .where('parentId', '=', itemId)
             .where('trashedAt', '!=', null)
             .selectAll()
-            .select(withEncodedHash)
             .execute();
         return items.map(parseItem);
     },
@@ -228,7 +214,6 @@ addRoute({
             .insertInto('storage')
             .values({ userId: userId, hash, name, size, type, immutable: useCAS, parentId })
             .returningAll()
-            .returning(withEncodedHash)
             .executeTakeFirstOrThrow()
             .catch(withError('Could not create item'));
         const path = join(config.storage.data, result.id);
@@ -257,10 +242,7 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const itemId = event.params.id;
-        const item = await get(itemId);
-        if (!item)
-            error(404, 'Item not found');
-        await checkAuth(event, item.userId);
+        const { item } = await checkAuthForItem(event, 'storage', itemId, Permission.Read);
         if (item.trashedAt)
             error(410, 'Trashed items can not be downloaded');
         const content = new Uint8Array(readFileSync(join(config.storage.data, item.id)));
@@ -275,16 +257,11 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const itemId = event.params.id;
-        const item = await get(itemId);
-        if (!item)
-            error(404, 'Item not found');
-        const { accessor } = await checkAuth(event, item.userId);
+        const { item } = await checkAuthForItem(event, 'storage', itemId, Permission.Edit);
         if (item.immutable)
             error(403, 'Item is immutable');
         if (item.trashedAt)
             error(410, 'Trashed items can not be changed');
-        if (item.userId != accessor.id)
-            error(403, 'Item editing is restricted to the owner');
         const type = event.request.headers.get('content-type') || 'application/octet-stream';
         // @todo: add this to the audit log
         if (type != item.type)
@@ -308,7 +285,6 @@ addRoute({
             .where('id', '=', itemId)
             .set({ size, modifiedAt: new Date(), hash })
             .returningAll()
-            .returning(withEncodedHash)
             .executeTakeFirstOrThrow()
             .catch(withError('Could not update item'));
         await writeFile(join(config.storage.data, result.id), content).catch(withError('Could not write'));
@@ -322,7 +298,7 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const userId = event.params.id;
-        await checkAuth(event, userId);
+        await checkAuthForUser(event, userId);
         const [usage, limits] = await Promise.all([currentUsage(userId), getLimits(userId)]).catch(withError('Could not fetch data'));
         return { usage, limits };
     },
@@ -330,9 +306,9 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const userId = event.params.id;
-        await checkAuth(event, userId);
+        await checkAuthForUser(event, userId);
         const [items, usage, limits] = await Promise.all([
-            database.selectFrom('storage').where('userId', '=', userId).selectAll().select(withEncodedHash).execute(),
+            database.selectFrom('storage').where('userId', '=', userId).selectAll().execute(),
             currentUsage(userId),
             getLimits(userId),
         ]).catch(withError('Could not fetch data'));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/storage",
-	"version": "0.2.0",
+	"version": "0.2.2",
 	"author": "James Prevett <axium@jamespre.dev> (https://jamespre.dev)",
 	"description": "User file storage for Axium",
 	"funding": {
@@ -33,7 +33,7 @@
 	"peerDependencies": {
 		"@axium/client": ">=0.1.0",
 		"@axium/core": ">=0.5.0",
-		"@axium/server": ">=0.17.0",
+		"@axium/server": ">=0.18.0",
 		"@sveltejs/kit": "^2.23.0",
 		"utilium": "^2.3.8"
 	},