@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/upload.ts

@@ -1,187 +1,198 @@
-/**
- * Media Engine: upload e servizio file gestiti tramite BeechBucket e Repository.
- * 
- * Astrae lo storage (R2/S3) e il database (D1) per garantire scalabilità
- * e facilità di sviluppo locale.
- */
-import { Hono } from 'hono'
-import { AppEnv } from './types'
-
-/** Prefissi MIME consentiti (immagini e PDF) */
-const ALLOWED_MIME_PREFIXES = ['image/', 'application/pdf']
-
-/** Dimensione massima file: 5 MB */
-const MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024
-
-type FileLike = {
-  name: string
-  type: string
-  size: number
-  arrayBuffer: () => Promise<ArrayBuffer>
-}
-
-function isFileLike(value: unknown): value is FileLike {
-  if (!value || typeof value === 'string') return false
-  const v = value as Record<string, unknown>
-  return (
-    typeof v.name === 'string' &&
-    typeof v.type === 'string' &&
-    typeof v.size === 'number' &&
-    typeof v.arrayBuffer === 'function'
-  )
-}
-
-/** Sanitizza il nome file */
-function sanitizeFilename(name: string): string {
-  const base = name.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 100)
-  return base || 'file'
-}
-
-/** Genera chiave univoca (timestamp-sanitized-name) */
-function generateObjectKey(originalName: string): string {
-  const timestamp = Math.floor(Date.now() / 1000)
-  const sanitized = sanitizeFilename(originalName)
-  return `${timestamp}-${sanitized}`
-}
-
-/**
- * Elimina oggetti dallo storage e tracciamento dal DB.
- */
-export async function deleteR2Objects(
-  c: { var: { bucket: any, mediaRepository: any, systemStatsRepository: any } },
-  objectKeys: string[]
-): Promise<void> {
-  const { bucket, mediaRepository, systemStatsRepository } = c.var
-
-  for (const key of objectKeys) {
-    try {
-      const media = await mediaRepository.getByKey(key)
-      const size = media?.size_bytes ?? 0
-
-      await bucket.delete(key)
-      await mediaRepository.untrack(key)
-
-      if (size > 0) {
-        await systemStatsRepository.decrementStorage(size)
-      }
-    } catch (err) {
-      console.warn(`Failed to delete media object: ${key}`, err)
-    }
-  }
-}
-
-export const uploadRoutes = new Hono<AppEnv>()
-
-/** POST /upload - Carica file su BeechBucket */
-uploadRoutes.post('/upload', async (c) => {
-  try {
-    const bucket = c.var.bucket
-    const mediaRepo = c.var.mediaRepository
-    const statsRepo = c.var.systemStatsRepository
-
-    const contentType = c.req.header('Content-Type') ?? ''
-    if (!contentType.includes('multipart/form-data')) {
-      return c.json({ error: 'Content-Type must be multipart/form-data' }, 400)
-    }
-
-    const formData = await c.req.formData()
-    const fileEntry = formData.get('file')
-
-    if (!isFileLike(fileEntry)) {
-      return c.json({ error: 'No file provided. Use field name "file"' }, 400)
-    }
-    const file = fileEntry
-
-    const mimeOk = ALLOWED_MIME_PREFIXES.some((prefix) => file.type.startsWith(prefix))
-    if (!mimeOk) {
-      return c.json({ error: 'File type not allowed. Allowed: images and PDF' }, 400)
-    }
-
-    if (file.size > MAX_FILE_SIZE_BYTES) {
-      return c.json({ error: 'File too large. Max 5MB' }, 400)
-    }
-
-    const objectKey = generateObjectKey(file.name)
-    const body = await file.arrayBuffer()
-
-    // 1. Upload allo storage
-    await bucket.put(objectKey, body, { contentType: file.type })
-
-    // 2. Aggiorna DB e Stats (in background se possibile)
-    const uploadedBy = c.var.jwtPayload?.sub ?? ''
-    const trackOperation = (async () => {
-      try {
-        await statsRepo.incrementStorage(file.size)
-        await mediaRepo.trackUpload({
-          key: objectKey,
-          filename: file.name,
-          mime_type: file.type,
-          size_bytes: file.size,
-          uploaded_by: uploadedBy
-        })
-      } catch (err) {
-        console.error('Failed to update DB tracking for upload:', err)
-      }
-    })()
-
-    try {
-      c.executionCtx.waitUntil(trackOperation)
-    } catch {
-      await trackOperation
-    }
-
-    const publicUrl = bucket.getUrl(objectKey)
-
-    const jwtPayload = c.get('jwtPayload')
-    if (jwtPayload) {
-      c.get('activityLogger').log({
-        action: 'upload',
-        entityType: 'media',
-        entityId: objectKey,
-        details: { name: file.name, size: file.size, type: file.type },
-        actor: {
-          id: jwtPayload.sub,
-          email: jwtPayload.email ?? 'unknown',
-          name: jwtPayload.name ?? null,
-        },
-      })
-    }
-
-    return c.json({ url: publicUrl }, 200)
-  } catch (err) {
-    console.error('Upload error:', err)
-    return c.json({ error: 'Upload failed' }, 500)
-  }
-})
-
-/** DELETE /upload/:key - Elimina un file */
-uploadRoutes.delete('/upload/:key', async (c) => {
-  const key = c.req.param('key')
-  if (!key) return c.json({ error: 'Missing key' }, 400)
-
-  await deleteR2Objects(c, [decodeURIComponent(key)])
-  return c.json({ success: true }, 200)
-})
-
-/**
- * Serve un file dallo storage.
- */
-export async function serveMediaHandler(c: any): Promise<Response> {
-  const key = c.req.param('key')
-  if (!key) return new Response('Missing key', { status: 400 })
-
-  const bucket = c.var.bucket
-  try {
-    const object = await bucket.get(decodeURIComponent(key))
-    if (!object) return new Response('Not found', { status: 404 })
-
-    const headers = new Headers()
-    headers.set('Content-Type', object.contentType ?? 'application/octet-stream')
-    headers.set('Cache-Control', 'public, max-age=31536000, immutable')
-
-    return new Response(object.body, { status: 200, headers })
-  } catch (err) {
-    console.error(`[serveMediaHandler] Error serving file ${key}:`, err)
-    return new Response('Internal error', { status: 500 })
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/**
+ * Media Engine — Single-path presigned uploads.
+ * Il Worker non riceve mai i bytes: agisce solo da gatekeeper (auth, validazione, firma).
+ */
+import { Hono } from 'hono'
+import { isMimeAccepted } from '@beechcms/core'
+import { AppEnv } from './types'
+
+const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024
+const ABSOLUTE_MAX_UPLOAD_BYTES = 500 * 1024 * 1024
+const PRESIGN_TTL_SECONDS = 900
+
+function resolveMaxUploadBytes(env: { MAX_UPLOAD_BYTES?: string }): number {
+  const raw = env.MAX_UPLOAD_BYTES
+  if (!raw) return DEFAULT_MAX_UPLOAD_BYTES
+  const parsed = Number.parseInt(raw, 10)
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_UPLOAD_BYTES
+  return Math.min(parsed, ABSOLUTE_MAX_UPLOAD_BYTES)
+}
+
+function sanitizeFilename(name: string): string {
+  const base = name.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 100)
+  return base || 'file'
+}
+
+function generateObjectKey(originalName: string): string {
+  const timestamp = Math.floor(Date.now() / 1000)
+  return `${timestamp}-${sanitizeFilename(originalName)}`
+}
+
+export async function deleteR2Objects(
+  c: { var: { bucket: any, mediaRepository: any, systemStatsRepository: any } },
+  objectKeys: string[]
+): Promise<void> {
+  const { bucket, mediaRepository, systemStatsRepository } = c.var
+  for (const key of objectKeys) {
+    const media = await mediaRepository.getByKey(key).catch(() => null)
+    const size = media?.size_bytes ?? 0
+    try {
+      await bucket.delete(key)
+    } catch (err) {
+      console.warn(`Failed to delete storage object: ${key}`, err)
+    }
+    try {
+      await mediaRepository.untrack(key)
+      if (size > 0) await systemStatsRepository.decrementStorage(size)
+    } catch (err) {
+      console.warn(`Failed to untrack media object: ${key}`, err)
+    }
+  }
+}
+
+export const uploadRoutes = new Hono<AppEnv>()
+
+/** POST /upload/presign — Richiede URL firmata per upload diretto a R2. */
+uploadRoutes.post('/upload/presign', async (c) => {
+  let body: { filename?: unknown, mimeType?: unknown, sizeBytes?: unknown }
+  try { body = await c.req.json() } catch { return c.json({ error: 'Invalid JSON body' }, 400) }
+
+  const { filename, mimeType, sizeBytes } = body
+  if (typeof filename !== 'string' || !filename.trim()) return c.json({ error: 'filename is required' }, 400)
+  if (typeof mimeType !== 'string' || !mimeType.trim()) return c.json({ error: 'mimeType is required' }, 400)
+  if (typeof sizeBytes !== 'number' || !Number.isFinite(sizeBytes) || sizeBytes <= 0) {
+    return c.json({ error: 'sizeBytes must be a positive number' }, 400)
+  }
+
+  const maxBytes = resolveMaxUploadBytes(c.env)
+  if (sizeBytes > maxBytes) return c.json({ error: `File too large. Max ${maxBytes} bytes` }, 400)
+  if (!isMimeAccepted(mimeType, 'any')) return c.json({ error: 'File type not allowed' }, 400)
+
+  const key = generateObjectKey(filename)
+  const uploadUrl = await c.var.bucket.presignPut(key, {
+    expiresIn: PRESIGN_TTL_SECONDS,
+    contentType: mimeType,
+    contentLength: sizeBytes,
+  })
+
+  return c.json({ uploadUrl, key, expiresIn: PRESIGN_TTL_SECONDS }, 200)
+})
+
+/** POST /upload/confirm — Verifica l'oggetto su R2 e registra metadati. Idempotente sul key. */
+uploadRoutes.post('/upload/confirm', async (c) => {
+  const { bucket, mediaRepository: mediaRepo, systemStatsRepository: statsRepo } = c.var
+
+  let body: { key?: unknown }
+  try { body = await c.req.json() } catch { return c.json({ error: 'Invalid JSON body' }, 400) }
+  const { key } = body
+  if (typeof key !== 'string' || !key.trim()) return c.json({ error: 'key is required' }, 400)
+
+  const existing = await mediaRepo.getByKey(key)
+  if (existing) return c.json({ url: bucket.getUrl(key) }, 200)
+
+  const head = await bucket.head(key)
+  if (!head) return c.json({ error: 'Object not found in storage' }, 404)
+
+  const uploadedBy = c.var.jwtPayload?.sub ?? ''
+  const size = head.size ?? 0
+  const mime = head.contentType ?? 'application/octet-stream'
+  const filename = key.replace(/^\d+-/, '') || key
+
+  await statsRepo.incrementStorage(size)
+  await mediaRepo.trackUpload({
+    key,
+    filename,
+    mime_type: mime,
+    size_bytes: size,
+    uploaded_by: uploadedBy,
+  })
+
+  const jwtPayload = c.get('jwtPayload')
+  if (jwtPayload) {
+    c.get('activityLogger').log({
+      action: 'upload',
+      entityType: 'media',
+      entityId: key,
+      details: { name: filename, size, type: mime },
+      actor: {
+        id: jwtPayload.sub,
+        email: jwtPayload.email ?? 'unknown',
+        name: [jwtPayload.name, jwtPayload.surname].filter(Boolean).join(' ') || null,
+      },
+    })
+  }
+
+  return c.json({ url: bucket.getUrl(key) }, 200)
+})
+
+/** GET /upload/download-url/:key — URL firmata di lettura per asset privati. */
+uploadRoutes.get('/upload/download-url/:key', async (c) => {
+  const key = decodeURIComponent(c.req.param('key') ?? '')
+  if (!key) return c.json({ error: 'Missing key' }, 400)
+
+  const head = await c.var.bucket.head(key)
+  if (!head) return c.json({ error: 'Object not found' }, 404)
+
+  const downloadUrl = await c.var.bucket.presignGet(key, { expiresIn: PRESIGN_TTL_SECONDS })
+  return c.json({ downloadUrl, expiresIn: PRESIGN_TTL_SECONDS }, 200)
+})
+
+/** DELETE /upload/:key — Invariato. */
+uploadRoutes.delete('/upload/:key', async (c) => {
+  const key = c.req.param('key')
+  if (!key) return c.json({ error: 'Missing key' }, 400)
+  await deleteR2Objects(c, [decodeURIComponent(key)])
+  return c.json({ success: true }, 200)
+})
+
+// MIME types that browsers can render as active content — must be served as
+// attachments to prevent stored-XSS via same-origin script execution.
+const FORCE_DOWNLOAD_MIME_PREFIXES = [
+  'image/svg',       // image/svg+xml, image/svg
+  'text/',           // text/html, text/xml, text/javascript, …
+  'application/xml',
+  'application/xhtml',
+  'application/javascript',
+  'application/x-javascript',
+]
+
+function isActiveMimeType(mime: string): boolean {
+  const lower = mime.toLowerCase()
+  return FORCE_DOWNLOAD_MIME_PREFIXES.some((prefix) => lower.startsWith(prefix))
+}
+
+/** Serve un file dallo storage (usato dalla rotta pubblica /api/media/:key). */
+export async function serveMediaHandler(c: any): Promise<Response> {
+  const key = c.req.param('key')
+  if (!key) return new Response('Missing key', { status: 400 })
+  try {
+    const object = await c.var.bucket.get(decodeURIComponent(key))
+    if (!object) return new Response('Not found', { status: 404 })
+    const headers = new Headers()
+    const originalMime = object.contentType ?? 'application/octet-stream'
+
+    // Defense-in-depth: force attachment + opaque MIME for SVG and other
+    // active content types so browsers cannot render them inline even if a
+    // legacy object pre-dates the upload-time block in file-types.ts.
+    if (isActiveMimeType(originalMime)) {
+      headers.set('Content-Type', 'application/octet-stream')
+      headers.set('Content-Disposition', 'attachment')
+    } else {
+      headers.set('Content-Type', originalMime)
+    }
+
+    // Restrictive CSP on all media responses — even raster images don't need
+    // scripts or frames, and this prevents future regressions.
+    headers.set('Content-Security-Policy', "default-src 'none'; sandbox")
+    headers.set('X-Content-Type-Options', 'nosniff')
+    headers.set('Cache-Control', 'public, max-age=31536000, immutable')
+    return new Response(object.body, { status: 200, headers })
+  } catch (err) {
+    console.error(`[serveMediaHandler] Error serving file ${key}:`, err)
+    return new Response('Internal error', { status: 500 })
+  }
+}

package/src/widget.test.ts

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect, vi } from 'vitest'
+import { Hono } from 'hono'
+import type { Seed, IWidgetRepository, DistributionSlice } from '@beechcms/core'
+import { widgetApp } from './widget'
+import type { Env, Variables } from './types'
+
+const seed: Seed = {
+  slug: 'posts',
+  label: 'Post',
+  displayNameAlias: 'title',
+  branches: [
+    { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
+    { id: 'br_02', alias: 'status_alias', type: 'text', label: 'Status' },
+  ],
+}
+
+function makeRepoStub(distributionResult: DistributionSlice[] | Error = []): IWidgetRepository {
+  return {
+    aggregate: vi.fn(),
+    growth: vi.fn(),
+    leaderboard: vi.fn(),
+    list: vi.fn(),
+    timeseries: vi.fn(),
+    distribution: vi.fn(async () => {
+      if (distributionResult instanceof Error) throw distributionResult
+      return distributionResult
+    }),
+  } as unknown as IWidgetRepository
+}
+
+function buildApp(opts: { repo?: IWidgetRepository; seeds?: Record<string, Seed> } = {}) {
+  const repo = opts.repo ?? makeRepoStub()
+  const seeds = opts.seeds ?? { posts: seed }
+  const app = new Hono<{ Bindings: Env; Variables: Variables }>()
+  app.use('*', async (c, next) => {
+    c.set('widgetRepository', repo)
+    c.set('getSeed', (slug: string) => seeds[slug] ?? null)
+    await next()
+  })
+  app.route('/', widgetApp)
+  return { app, repo }
+}
+
+describe('GET /distribution/:seed', () => {
+  it('returns 200 with slices on the happy path', async () => {
+    const repo = makeRepoStub([{ label: 'published', value: 5 }])
+    const { app } = buildApp({ repo })
+    const res = await app.request('/distribution/posts?column=status_alias')
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ slices: [{ label: 'published', value: 5 }] })
+    expect(repo.distribution).toHaveBeenCalledWith(seed, 'status_alias', 'all', 8)
+  })
+
+  it('returns 404 for an unknown seed', async () => {
+    const { app } = buildApp()
+    const res = await app.request('/distribution/ghost?column=status_alias')
+    expect(res.status).toBe(404)
+  })
+
+  it('returns 400 when column is missing', async () => {
+    const { app } = buildApp()
+    const res = await app.request('/distribution/posts')
+    expect(res.status).toBe(400)
+  })
+
+  it('returns 400 problem+json for an unsafe column', async () => {
+    const repo = makeRepoStub(new Error('UNSAFE_COLUMN'))
+    const { app } = buildApp({ repo })
+    const res = await app.request('/distribution/posts?column=evil')
+    expect(res.status).toBe(400)
+    const body = await res.json() as { detail: string }
+    expect(body.detail).toContain('Invalid column reference')
+  })
+
+  it('bounds limit to the maximum and applies window', async () => {
+    const repo = makeRepoStub([])
+    const { app } = buildApp({ repo })
+    await app.request('/distribution/posts?column=status_alias&window=week&limit=999')
+    expect(repo.distribution).toHaveBeenCalledWith(seed, 'status_alias', 'week', 24)
+  })
+})