@axium/storage 0.7.10 → 0.8.0

package/dist/server/raw.js

@@ -0,0 +1,163 @@
+import { Permission } from '@axium/core';
+import { audit } from '@axium/server/audit';
+import { checkAuthForItem, getSessionAndUser } from '@axium/server/auth';
+import { config } from '@axium/server/config';
+import { database } from '@axium/server/database';
+import { error, getToken, withError } from '@axium/server/requests';
+import { addRoute } from '@axium/server/routes';
+import { createHash } from 'node:crypto';
+import { linkSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path/posix';
+import * as z from 'zod';
+import '../polyfills.js';
+import { defaultCASMime, getLimits } from './config.js';
+import { currentUsage, parseItem } from './db.js';
+addRoute({
+    path: '/raw/storage',
+    async PUT(request) {
+        if (!config.storage.enabled)
+            error(503, 'User storage is disabled');
+        const token = getToken(request);
+        if (!token)
+            error(401, 'Missing session token');
+        const { userId } = await getSessionAndUser(token).catch(withError('Invalid session token', 401));
+        const [usage, limits] = await Promise.all([currentUsage(userId), getLimits(userId)]).catch(withError('Could not fetch usage and/or limits'));
+        const name = request.headers.get('x-name');
+        if (!name)
+            error(400, 'Missing name header');
+        if (name.length > 255)
+            error(400, 'Name is too long');
+        const maybeParentId = request.headers.get('x-parent');
+        const parentId = maybeParentId
+            ? await z
+                .uuid()
+                .parseAsync(maybeParentId)
+                .catch(() => error(400, 'Invalid parent ID'))
+            : null;
+        if (parentId)
+            await checkAuthForItem(request, 'storage', parentId, Permission.Edit);
+        const size = Number(request.headers.get('content-length'));
+        if (Number.isNaN(size))
+            error(411, 'Missing or invalid content length header');
+        if (limits.user_items && usage.items >= limits.user_items)
+            error(409, 'Too many items');
+        if (limits.user_size && (usage.bytes + size) / 1_000_000 >= limits.user_size)
+            error(413, 'Not enough space');
+        if (limits.item_size && size > limits.item_size * 1_000_000)
+            error(413, 'File size exceeds maximum size');
+        const content = await request.bytes();
+        if (content.byteLength > size) {
+            await audit('storage_size_mismatch', userId, { item: null });
+            error(400, 'Content length does not match size header');
+        }
+        const type = request.headers.get('content-type') || 'application/octet-stream';
+        const isDirectory = type == 'inode/directory';
+        if (isDirectory && size > 0)
+            error(400, 'Directories can not have content');
+        const useCAS = config.storage.cas.enabled &&
+            !isDirectory &&
+            (defaultCASMime.some(pattern => pattern.test(type)) || config.storage.cas.include.some(mime => type.match(mime)));
+        const hash = isDirectory ? null : createHash('BLAKE2b512').update(content).digest();
+        const tx = await database.startTransaction().execute();
+        try {
+            const item = parseItem(await tx
+                .insertInto('storage')
+                .values({ userId, hash, name, size, type, immutable: useCAS, parentId })
+                .returningAll()
+                .executeTakeFirstOrThrow());
+            const path = join(config.storage.data, item.id);
+            if (!useCAS) {
+                if (!isDirectory)
+                    writeFileSync(path, content);
+                await tx.commit().execute();
+                return item;
+            }
+            const existing = await tx
+                .selectFrom('storage')
+                .select('id')
+                .where('hash', '=', hash)
+                .where('id', '!=', item.id)
+                .limit(1)
+                .executeTakeFirst();
+            if (!existing) {
+                if (!isDirectory)
+                    writeFileSync(path, content);
+                await tx.commit().execute();
+                return item;
+            }
+            linkSync(join(config.storage.data, existing.id), path);
+            await tx.commit().execute();
+            return item;
+        }
+        catch (error) {
+            await tx.rollback().execute();
+            throw withError('Could not create item', 500)(error);
+        }
+    },
+});
+addRoute({
+    path: '/raw/storage/:id',
+    params: { id: z.uuid() },
+    async GET(request, params) {
+        if (!config.storage.enabled)
+            error(503, 'User storage is disabled');
+        const itemId = params.id;
+        const { item } = await checkAuthForItem(request, 'storage', itemId, Permission.Read);
+        if (item.trashedAt)
+            error(410, 'Trashed items can not be downloaded');
+        const content = new Uint8Array(readFileSync(join(config.storage.data, item.id)));
+        return new Response(content, {
+            headers: {
+                'Content-Type': item.type,
+                'Content-Disposition': `attachment; filename="${item.name}"`,
+            },
+        });
+    },
+    async POST(request, params) {
+        if (!config.storage.enabled)
+            error(503, 'User storage is disabled');
+        const itemId = params.id;
+        const { item, session } = await checkAuthForItem(request, 'storage', itemId, Permission.Edit);
+        if (item.immutable)
+            error(405, 'Item is immutable');
+        if (item.type == 'inode/directory')
+            error(409, 'Directories do not have content');
+        if (item.trashedAt)
+            error(410, 'Trashed items can not be changed');
+        const type = request.headers.get('content-type') || 'application/octet-stream';
+        if (type != item.type) {
+            await audit('storage_type_mismatch', session?.userId, { item: item.id });
+            error(400, 'Content type does not match existing item type');
+        }
+        const size = Number(request.headers.get('content-length'));
+        if (Number.isNaN(size))
+            error(411, 'Missing or invalid content length header');
+        const [usage, limits] = await Promise.all([currentUsage(item.userId), getLimits(item.userId)]).catch(withError('Could not fetch usage and/or limits'));
+        if (limits.user_size && (usage.bytes + size - item.size) / 1_000_000 >= limits.user_size)
+            error(413, 'Not enough space');
+        if (limits.item_size && size > limits.item_size * 1_000_000)
+            error(413, 'File size exceeds maximum size');
+        const content = await request.bytes();
+        if (content.byteLength > size) {
+            await audit('storage_size_mismatch', session?.userId, { item: item.id });
+            error(400, 'Actual content length does not match header');
+        }
+        const hash = createHash('BLAKE2b512').update(content).digest();
+        const tx = await database.startTransaction().execute();
+        try {
+            const result = await tx
+                .updateTable('storage')
+                .where('id', '=', itemId)
+                .set({ size, modifiedAt: new Date(), hash })
+                .returningAll()
+                .executeTakeFirstOrThrow();
+            writeFileSync(join(config.storage.data, result.id), content);
+            await tx.commit().execute();
+            return parseItem(result);
+        }
+        catch (error) {
+            await tx.rollback().execute();
+            throw withError('Could not update item', 500)(error);
+        }
+    },
+});

package/lib/List.svelte

@@ -53,7 +53,7 @@
 			onclick={async () => {
 				if (item.type != 'inode/directory') {
 					// @todo get preview
-				} else if (appMode) goto('/files/' + item.id);
+				} else if (appMode) location.href = '/files/' + item.id;
 				else items = await getDirectoryMetadata(item.id);
 			}}
 		>

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/storage",
-	"version": "0.7.10",
+	"version": "0.8.0",
 	"author": "James Prevett <axium@jamespre.dev>",
 	"description": "User file storage for Axium",
 	"funding": {
@@ -21,6 +21,7 @@
 	"types": "dist/index.d.ts",
 	"exports": {
 		".": "./dist/index.js",
+		"./client": "./dist/client/index.js",
 		"./*": "./dist/*.js",
 		"./sidebar": "./lib/sidebar.svelte.js",
 		"./components": "./lib/index.js",
@@ -37,20 +38,26 @@
 		"build": "tsc"
 	},
 	"peerDependencies": {
-		"@axium/client": ">=0.5.0",
-		"@axium/core": ">=0.8.0",
-		"@axium/server": ">=0.25.0",
+		"@axium/client": ">=0.6.0",
+		"@axium/core": ">=0.9.0",
+		"@axium/server": ">=0.26.0",
 		"@sveltejs/kit": "^2.27.3",
 		"utilium": "^2.3.8"
 	},
 	"dependencies": {
-		"blakejs": "^1.2.1",
 		"zod": "^4.0.5"
 	},
 	"axium": {
-		"http_handler": "./build/handler.js",
-		"hooks": "./dist/hooks.js",
-		"routes": "./routes",
+		"server": {
+			"http_handler": "./build/handler.js",
+			"hooks": "./dist/server/hooks.js",
+			"routes": "./routes",
+			"cli": "./dist/server/cli.js"
+		},
+		"client": {
+			"cli": "./dist/client/cli.js",
+			"hooks": "./dist/client/hooks.js"
+		},
 		"apps": [
 			{
 				"id": "files",

package/routes/files/[id]/+page.svelte

@@ -25,11 +25,15 @@
 		<Icon i="trash-can-undo" /> Restore
 	</button>
 {:else if item.type == 'inode/directory'}
-	<a href="/files{item.parentId ? '/' + item.parentId : ''}">
-		<button class="icon-text">
-			<Icon i="folder-arrow-up" /> Back
-		</button>
-	</a>
+	<button
+		class="icon-text"
+		onclick={e => {
+			e.preventDefault();
+			location.href = '/files' + (item.parentId ? '/' + item.parentId : '');
+		}}
+	>
+		<Icon i="folder-arrow-up" /> Back
+	</button>
 	<StorageList appMode bind:items />
 	<StorageAdd parentId={item.id} onadd={item => items.push(item)} />
 {:else}

package/dist/server.js

@@ -1,412 +0,0 @@
-import { Permission, Severity } from '@axium/core';
-import { addEvent, audit } from '@axium/server/audit';
-import { checkAuthForItem, checkAuthForUser, getSessionAndUser } from '@axium/server/auth';
-import { addConfigDefaults, config } from '@axium/server/config';
-import { database, expectedTypes } from '@axium/server/database';
-import { dirs } from '@axium/server/io';
-import { error, getToken, parseBody, withError } from '@axium/server/requests';
-import { addRoute } from '@axium/server/routes';
-import { createHash } from 'node:crypto';
-import { linkSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path/posix';
-import * as z from 'zod';
-import { StorageItemUpdate } from './common.js';
-import './polyfills.js';
-expectedTypes.storage = {
-    createdAt: { type: 'timestamptz', required: true, hasDefault: true },
-    hash: { type: 'bytea' },
-    id: { type: 'uuid', required: true, hasDefault: true },
-    immutable: { type: 'bool', required: true },
-    modifiedAt: { type: 'timestamptz', required: true, hasDefault: true },
-    name: { type: 'text' },
-    parentId: { type: 'uuid' },
-    size: { type: 'int4', required: true },
-    trashedAt: { type: 'timestamptz' },
-    type: { type: 'text', required: true },
-    userId: { type: 'uuid', required: true },
-    publicPermission: { type: 'int4', required: true, hasDefault: true },
-    metadata: { type: 'jsonb', required: true, hasDefault: true },
-};
-const defaultCASMime = [/video\/.*/, /audio\/.*/];
-addConfigDefaults({
-    storage: {
-        enabled: true,
-        app_enabled: true,
-        data: dirs.at(-1) + '/storage',
-        trash_duration: 30,
-        limits: {
-            user_size: 1000,
-            item_size: 100,
-            user_items: 10_000,
-        },
-        cas: {
-            enabled: true,
-            include: [],
-            exclude: [],
-        },
-    },
-});
-addEvent({ source: '@axium/storage', name: 'storage_type_mismatch', severity: Severity.Warning, tags: ['mimetype'] });
-addEvent({ source: '@axium/storage', name: 'storage_size_mismatch', severity: Severity.Warning, tags: [] });
-export function parseItem(item) {
-    return {
-        ...item,
-        dataURL: `/raw/storage/${item.id}`,
-        hash: item.hash?.toHex?.(),
-    };
-}
-/**
- * Returns the current usage of the storage for a user in bytes.
- */
-export async function currentUsage(userId) {
-    const result = await database
-        .selectFrom('storage')
-        .where('userId', '=', userId)
-        .select(eb => eb.fn.countAll().as('items'))
-        .select(eb => eb.fn.sum('size').as('bytes'))
-        .executeTakeFirstOrThrow();
-    result.bytes = Number(result.bytes || 0);
-    result.items = Number(result.items);
-    return result;
-}
-export async function get(itemId) {
-    const result = await database
-        .selectFrom('storage')
-        .where('id', '=', itemId)
-        .selectAll()
-        .$narrowType()
-        .executeTakeFirstOrThrow();
-    return parseItem(result);
-}
-let _getLimits = null;
-/**
- * Define the handler to get limits for a user externally.
- */
-export function useLimits(handler) {
-    _getLimits = handler;
-}
-export async function getLimits(userId) {
-    try {
-        return await _getLimits(userId);
-    }
-    catch {
-        return config.storage.limits;
-    }
-}
-export async function* getRecursive(id) {
-    const items = await database.selectFrom('storage').where('parentId', '=', id).selectAll().execute();
-    for (const item of items) {
-        if (item.type != 'inode/directory')
-            yield item.id;
-        else
-            yield* getRecursive(item.id);
-    }
-}
-export async function deleteRecursive(itemId, deleteSelf) {
-    const toDelete = await Array.fromAsync(getRecursive(itemId)).catch(withError('Could not get items to delete'));
-    if (deleteSelf)
-        toDelete.push(itemId);
-    await database.deleteFrom('storage').where('id', '=', itemId).returningAll().execute().catch(withError('Could not delete item'));
-    for (const id of toDelete)
-        unlinkSync(join(config.storage.data, id));
-}
-addRoute({
-    path: '/api/storage/item/:id',
-    params: { id: z.uuid() },
-    async GET(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const itemId = params.id;
-        const { item } = await checkAuthForItem(request, 'storage', itemId, Permission.Read);
-        return parseItem(item);
-    },
-    async PATCH(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const itemId = params.id;
-        const body = await parseBody(request, StorageItemUpdate);
-        await checkAuthForItem(request, 'storage', itemId, Permission.Manage);
-        const values = {};
-        if ('publicPermission' in body)
-            values.publicPermission = body.publicPermission;
-        if ('trash' in body)
-            values.trashedAt = body.trash ? new Date() : null;
-        if ('owner' in body)
-            values.userId = body.owner;
-        if ('name' in body)
-            values.name = body.name;
-        if (!Object.keys(values).length)
-            error(400, 'No valid fields to update');
-        return parseItem(await database
-            .updateTable('storage')
-            .where('id', '=', itemId)
-            .set(values)
-            .returningAll()
-            .executeTakeFirstOrThrow()
-            .catch(withError('Could not update item')));
-    },
-    async DELETE(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const itemId = params.id;
-        const auth = await checkAuthForItem(request, 'storage', itemId, Permission.Manage);
-        const item = parseItem(auth.item);
-        await deleteRecursive(itemId, item.type != 'inode/directory');
-        return item;
-    },
-});
-addRoute({
-    path: '/api/storage/directory/:id',
-    params: { id: z.uuid() },
-    async GET(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const itemId = params.id;
-        const { item } = await checkAuthForItem(request, 'storage', itemId, Permission.Read);
-        if (item.type != 'inode/directory')
-            error(409, 'Item is not a directory');
-        const items = await database
-            .selectFrom('storage')
-            .where('parentId', '=', itemId)
-            .where('trashedAt', 'is', null)
-            .selectAll()
-            .execute();
-        return items.map(parseItem);
-    },
-});
-addRoute({
-    path: '/raw/storage',
-    async PUT(request) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const token = getToken(request);
-        if (!token)
-            error(401, 'Missing session token');
-        const { userId } = await getSessionAndUser(token).catch(withError('Invalid session token', 401));
-        const [usage, limits] = await Promise.all([currentUsage(userId), getLimits(userId)]).catch(withError('Could not fetch usage and/or limits'));
-        const name = request.headers.get('x-name');
-        if (!name)
-            error(400, 'Missing name header');
-        if (name.length > 255)
-            error(400, 'Name is too long');
-        const maybeParentId = request.headers.get('x-parent');
-        const parentId = maybeParentId
-            ? await z
-                .uuid()
-                .parseAsync(maybeParentId)
-                .catch(() => error(400, 'Invalid parent ID'))
-            : null;
-        if (parentId)
-            await checkAuthForItem(request, 'storage', parentId, Permission.Edit);
-        const size = Number(request.headers.get('content-length'));
-        if (Number.isNaN(size))
-            error(411, 'Missing or invalid content length header');
-        if (limits.user_items && usage.items >= limits.user_items)
-            error(409, 'Too many items');
-        if (limits.user_size && (usage.bytes + size) / 1_000_000 >= limits.user_size)
-            error(413, 'Not enough space');
-        if (limits.item_size && size > limits.item_size * 1_000_000)
-            error(413, 'File size exceeds maximum size');
-        const content = await request.bytes();
-        if (content.byteLength > size) {
-            await audit('storage_size_mismatch', userId, { item: null });
-            error(400, 'Content length does not match size header');
-        }
-        const type = request.headers.get('content-type') || 'application/octet-stream';
-        const isDirectory = type == 'inode/directory';
-        if (isDirectory && size > 0)
-            error(400, 'Directories can not have content');
-        const useCAS = config.storage.cas.enabled &&
-            !isDirectory &&
-            (defaultCASMime.some(pattern => pattern.test(type)) || config.storage.cas.include.some(mime => type.match(mime)));
-        const hash = isDirectory ? null : createHash('BLAKE2b512').update(content).digest();
-        const tx = await database.startTransaction().execute();
-        try {
-            const item = parseItem(await tx
-                .insertInto('storage')
-                .values({ userId, hash, name, size, type, immutable: useCAS, parentId })
-                .returningAll()
-                .executeTakeFirstOrThrow());
-            const path = join(config.storage.data, item.id);
-            if (!useCAS) {
-                if (!isDirectory)
-                    writeFileSync(path, content);
-                await tx.commit().execute();
-                return item;
-            }
-            const existing = await tx
-                .selectFrom('storage')
-                .select('id')
-                .where('hash', '=', hash)
-                .where('id', '!=', item.id)
-                .limit(1)
-                .executeTakeFirst();
-            if (!existing) {
-                if (!isDirectory)
-                    writeFileSync(path, content);
-                await tx.commit().execute();
-                return item;
-            }
-            linkSync(join(config.storage.data, existing.id), path);
-            await tx.commit().execute();
-            return item;
-        }
-        catch (error) {
-            await tx.rollback().execute();
-            throw withError('Could not create item', 500)(error);
-        }
-    },
-});
-addRoute({
-    path: '/raw/storage/:id',
-    params: { id: z.uuid() },
-    async GET(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const itemId = params.id;
-        const { item } = await checkAuthForItem(request, 'storage', itemId, Permission.Read);
-        if (item.trashedAt)
-            error(410, 'Trashed items can not be downloaded');
-        const content = new Uint8Array(readFileSync(join(config.storage.data, item.id)));
-        return new Response(content, {
-            headers: {
-                'Content-Type': item.type,
-                'Content-Disposition': `attachment; filename="${item.name}"`,
-            },
-        });
-    },
-    async POST(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const itemId = params.id;
-        const { item, session } = await checkAuthForItem(request, 'storage', itemId, Permission.Edit);
-        if (item.immutable)
-            error(405, 'Item is immutable');
-        if (item.type == 'inode/directory')
-            error(409, 'Directories do not have content');
-        if (item.trashedAt)
-            error(410, 'Trashed items can not be changed');
-        const type = request.headers.get('content-type') || 'application/octet-stream';
-        if (type != item.type) {
-            await audit('storage_type_mismatch', session?.userId, { item: item.id });
-            error(400, 'Content type does not match existing item type');
-        }
-        const size = Number(request.headers.get('content-length'));
-        if (Number.isNaN(size))
-            error(411, 'Missing or invalid content length header');
-        const [usage, limits] = await Promise.all([currentUsage(item.userId), getLimits(item.userId)]).catch(withError('Could not fetch usage and/or limits'));
-        if (limits.user_size && (usage.bytes + size - item.size) / 1_000_000 >= limits.user_size)
-            error(413, 'Not enough space');
-        if (limits.item_size && size > limits.item_size * 1_000_000)
-            error(413, 'File size exceeds maximum size');
-        const content = await request.bytes();
-        if (content.byteLength > size) {
-            await audit('storage_size_mismatch', session?.userId, { item: item.id });
-            error(400, 'Actual content length does not match header');
-        }
-        const hash = createHash('BLAKE2b512').update(content).digest();
-        const tx = await database.startTransaction().execute();
-        try {
-            const result = await tx
-                .updateTable('storage')
-                .where('id', '=', itemId)
-                .set({ size, modifiedAt: new Date(), hash })
-                .returningAll()
-                .executeTakeFirstOrThrow();
-            writeFileSync(join(config.storage.data, result.id), content);
-            await tx.commit().execute();
-            return parseItem(result);
-        }
-        catch (error) {
-            await tx.rollback().execute();
-            throw withError('Could not update item', 500)(error);
-        }
-    },
-});
-addRoute({
-    path: '/api/users/:id/storage',
-    params: { id: z.uuid() },
-    async OPTIONS(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const userId = params.id;
-        await checkAuthForUser(request, userId);
-        const [usage, limits] = await Promise.all([currentUsage(userId), getLimits(userId)]).catch(withError('Could not fetch data'));
-        return { usage, limits };
-    },
-    async GET(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const userId = params.id;
-        await checkAuthForUser(request, userId);
-        const [items, usage, limits] = await Promise.all([
-            database.selectFrom('storage').where('userId', '=', userId).where('trashedAt', 'is', null).selectAll().execute(),
-            currentUsage(userId),
-            getLimits(userId),
-        ]).catch(withError('Could not fetch data'));
-        return { usage, limits, items: items.map(parseItem) };
-    },
-});
-addRoute({
-    path: '/api/users/:id/storage/root',
-    params: { id: z.uuid() },
-    async GET(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const userId = params.id;
-        await checkAuthForUser(request, userId);
-        const items = await database
-            .selectFrom('storage')
-            .where('userId', '=', userId)
-            .where('trashedAt', 'is', null)
-            .where('parentId', 'is', null)
-            .selectAll()
-            .execute()
-            .catch(withError('Could not get storage items'));
-        return items.map(parseItem);
-    },
-});
-function existsInACL(column, userId) {
-    return (eb) => eb.exists(eb
-        .selectFrom('acl.storage')
-        .whereRef('itemId', '=', `item.${column}`)
-        .where('userId', '=', userId)
-        .where('permission', '!=', Permission.None));
-}
-addRoute({
-    path: '/api/users/:id/storage/shared',
-    params: { id: z.uuid() },
-    async GET(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const userId = params.id;
-        await checkAuthForUser(request, userId);
-        const items = await database
-            .selectFrom('storage as item')
-            .selectAll('item')
-            .where('trashedAt', 'is', null)
-            .where(existsInACL('id', userId))
-            .where(eb => eb.not(existsInACL('parentId', userId)))
-            .execute()
-            .catch(withError('Could not get storage items'));
-        return items.map(parseItem);
-    },
-});
-addRoute({
-    path: '/api/users/:id/storage/trash',
-    params: { id: z.uuid() },
-    async GET(request, params) {
-        if (!config.storage.enabled)
-            error(503, 'User storage is disabled');
-        const userId = params.id;
-        await checkAuthForUser(request, userId);
-        const items = await database
-            .selectFrom('storage')
-            .where('userId', '=', userId)
-            .where('trashedAt', 'is not', null)
-            .selectAll()
-            .execute()
-            .catch(withError('Could not get trash'));
-        return items.map(parseItem);
-    },
-});