@axium/storage 0.6.2 → 0.6.4

package/dist/plugin.js

@@ -7,7 +7,7 @@ import { sql } from 'kysely';
 import pkg from '../package.json' with { type: 'json' };
 import './common.js';
 import './server.js';
-import { App } from '@axium/server/apps';
+import { addApp } from '@axium/server/apps';
 async function statusText() {
     const { storage: items } = await count('storage');
     const { size } = await database
@@ -61,10 +61,11 @@ async function clean(opt) {
         .executeTakeFirstOrThrow()
         .then(done);
 }
-new App({
+addApp({
     id: 'files',
     name: 'Files',
     version: pkg.version,
+    icon: 'folders',
 });
 export default {
     ...pkg,

package/dist/server.d.ts

@@ -54,6 +54,19 @@ declare module '@axium/server/config' {
         };
     }
 }
+declare module '@axium/server/audit' {
+    interface $EventTypes {
+        storage_type_mismatch: {
+            /** The ID of the target item */
+            item: string;
+        };
+        /** Mismatch between the actual size of an upload and the size reported in the header */
+        storage_size_mismatch: {
+            /** ID of the target item, null for new uploads */
+            item: string | null;
+        };
+    }
+}
 export interface StorageItem extends StorageItemMetadata {
     data: Uint8Array<ArrayBufferLike>;
 }

package/dist/server.js

@@ -1,5 +1,5 @@
-/* eslint-disable @typescript-eslint/unbound-method */
 import { Permission } from '@axium/core/access';
+import { addEvent, audit, Severity } from '@axium/server/audit';
 import { checkAuthForItem, checkAuthForUser, getSessionAndUser } from '@axium/server/auth';
 import { addConfigDefaults, config } from '@axium/server/config';
 import { database, expectedTypes } from '@axium/server/database';
@@ -27,6 +27,8 @@ expectedTypes.storage = {
     publicPermission: { type: 'int4', required: true, hasDefault: true },
     metadata: { type: 'jsonb', required: true, hasDefault: true },
 };
+addEvent({ source: '@axium/storage', name: 'storage_type_mismatch', severity: Severity.Warning, tags: ['mimetype'] });
+addEvent({ source: '@axium/storage', name: 'storage_size_mismatch', severity: Severity.Warning, tags: [] });
 const defaultCASMime = [/video\/.*/, /audio\/.*/];
 addConfigDefaults({
     storage: {
@@ -197,9 +199,10 @@ addRoute({
         if (size > limits.item_size * 1_000_000)
             error(413, 'File size exceeds maximum size');
         const content = await event.request.bytes();
-        // @todo: add this to the audit log
-        if (content.byteLength > size)
+        if (content.byteLength > size) {
+            await audit('storage_size_mismatch', userId, { item: null });
             error(400, 'Content length does not match size header');
+        }
         const type = event.request.headers.get('content-type') || 'application/octet-stream';
         const isDirectory = type == 'inode/directory';
         if (isDirectory && size > 0)
@@ -267,7 +270,7 @@ addRoute({
         if (!config.storage.enabled)
             error(503, 'User storage is disabled');
         const itemId = event.params.id;
-        const { item } = await checkAuthForItem(event, 'storage', itemId, Permission.Edit);
+        const { item, session } = await checkAuthForItem(event, 'storage', itemId, Permission.Edit);
         if (item.immutable)
             error(405, 'Item is immutable');
         if (item.type == 'inode/directory')
@@ -275,9 +278,10 @@ addRoute({
         if (item.trashedAt)
             error(410, 'Trashed items can not be changed');
         const type = event.request.headers.get('content-type') || 'application/octet-stream';
-        // @todo: add this to the audit log
-        if (type != item.type)
+        if (type != item.type) {
+            await audit('storage_type_mismatch', session?.userId, { item: item.id });
             error(400, 'Content type does not match existing item type');
+        }
         const size = Number(event.request.headers.get('content-length'));
         if (Number.isNaN(size))
             error(411, 'Missing or invalid content length header');
@@ -287,9 +291,10 @@ addRoute({
         if (size > limits.item_size * 1_000_000)
             error(413, 'File size exceeds maximum size');
         const content = await event.request.bytes();
-        // @todo: add this to the audit log
-        if (content.byteLength > size)
-            error(400, 'Content length does not match size header');
+        if (content.byteLength > size) {
+            await audit('storage_size_mismatch', session?.userId, { item: item.id });
+            error(400, 'Actual content length does not match header');
+        }
         const hash = createHash('BLAKE2b512').update(content).digest();
         const tx = await database.startTransaction().execute();
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/storage",
-	"version": "0.6.2",
+	"version": "0.6.4",
 	"author": "James Prevett <axium@jamespre.dev> (https://jamespre.dev)",
 	"description": "User file storage for Axium",
 	"funding": {
@@ -39,8 +39,8 @@
 	},
 	"peerDependencies": {
 		"@axium/client": ">=0.1.0",
-		"@axium/core": ">=0.5.0",
-		"@axium/server": ">=0.20.2",
+		"@axium/core": ">=0.5.4",
+		"@axium/server": ">=0.22.0",
 		"@sveltejs/kit": "^2.27.3",
 		"utilium": "^2.3.8"
 	},