@beechcms/api 0.6.0-preview.2 → 0.6.0-preview.4

package/src/shared/storage/s3-bucket.ts

@@ -1,195 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { S3Client, PutObjectCommand, GetObjectCommand, DeleteObjectCommand, HeadObjectCommand, ListObjectsV2Command } from '@aws-sdk/client-s3'
-import { getSignedUrl } from '@aws-sdk/s3-request-presigner'
-import { BeechBucket, PutBucketOptions, GetBucketResult, PresignOptions } from '@beechcms/core'
-
-/**
- * Implementation of BeechBucket using S3-compatible API (AWS SDK).
- * Used for production when connecting to R2 or any other S3 provider via HTTP.
- */
-export class S3Bucket implements BeechBucket {
-  private client: S3Client
-  private bucketName: string
-  private baseUrl: string
-
-  private cdnUrl: string | null
-
-  constructor(config: {
-    endpoint: string,
-    accessKeyId: string,
-    secretAccessKey: string,
-    bucketName: string,
-    baseUrl: string,
-    cdnUrl?: string,
-  }) {
-    // requestChecksumCalculation/responseChecksumValidation exist at runtime in AWS SDK v3
-    // but are not yet in the TypeScript types for this version. Casting via unknown to pass them
-    // through: without them the SDK adds x-amz-checksum-crc32 to presigned URLs, which causes
-    // R2 to reject PUT requests when the CRC32 of the uploaded file doesn't match.
-    this.client = new S3Client({
-      region: 'auto',
-      endpoint: config.endpoint,
-      credentials: {
-        accessKeyId: config.accessKeyId,
-        secretAccessKey: config.secretAccessKey,
-      },
-      forcePathStyle: true,
-      requestChecksumCalculation: 'when_required',
-      responseChecksumValidation: 'when_required',
-    } as unknown as import('@aws-sdk/client-s3').S3ClientConfig)
-    this.bucketName = config.bucketName
-    this.baseUrl = config.baseUrl
-    this.cdnUrl = config.cdnUrl ?? null
-  }
-
-  async put(key: string, body: ArrayBuffer | Uint8Array | ReadableStream, options?: PutBucketOptions): Promise<void> {
-    const command = new PutObjectCommand({
-      Bucket: this.bucketName,
-      Key: key,
-      Body: body instanceof ReadableStream ? await this.streamToUint8Array(body) : new Uint8Array(body as ArrayBuffer),
-      ContentType: options?.contentType,
-      Metadata: options?.metadata
-    })
-    await this.client.send(command)
-  }
-
-  private async streamToUint8Array(stream: ReadableStream): Promise<Uint8Array> {
-    const reader = stream.getReader()
-    const chunks: Uint8Array[] = []
-    let totalLength = 0
-    while (true) {
-      const { done, value } = await reader.read()
-      if (done) break
-      chunks.push(value)
-      totalLength += value.length
-    }
-    const result = new Uint8Array(totalLength)
-    let offset = 0
-    for (const chunk of chunks) {
-      result.set(chunk, offset)
-      offset += chunk.length
-    }
-    return result
-  }
-
-  async get(key: string): Promise<GetBucketResult | null> {
-    try {
-      const command = new GetObjectCommand({
-        Bucket: this.bucketName,
-        Key: key
-      })
-      const response = await this.client.send(command)
-      
-      if (!response.Body) return null
-
-      const rawBody = response.Body as any
-      const body: ReadableStream = typeof rawBody.transformToWebStream === 'function'
-        ? rawBody.transformToWebStream()
-        : rawBody as ReadableStream
-
-      return {
-        body,
-        contentType: response.ContentType,
-        size: response.ContentLength ?? 0,
-        metadata: response.Metadata
-      }
-    } catch (err: any) {
-      if (err.name === 'NoSuchKey' || err.name === 'NotFound' || err.message === 'NoSuchKey') {
-        return null
-      }
-      // Rethrow other errors (AccessDenied, Timeout, etc.)
-      throw err
-    }
-  }
-
-  async delete(key: string): Promise<void> {
-    const command = new DeleteObjectCommand({
-      Bucket: this.bucketName,
-      Key: key
-    })
-    await this.client.send(command)
-  }
-
-  async head(key: string): Promise<{ size: number; contentType?: string; metadata?: Record<string, string> } | null> {
-    try {
-      const command = new HeadObjectCommand({
-        Bucket: this.bucketName,
-        Key: key
-      })
-      const response = await this.client.send(command)
-      return {
-        size: response.ContentLength ?? 0,
-        contentType: response.ContentType,
-        metadata: response.Metadata
-      }
-    } catch (err: any) {
-      if (err.name === 'NoSuchKey' || err.name === 'NotFound') return null
-      throw err
-    }
-  }
-
-  getUrl(key: string): string {
-    if (this.cdnUrl) {
-      return `${this.cdnUrl}/${encodeURIComponent(key)}`
-    }
-    return `${this.baseUrl}/api/media/${encodeURIComponent(key)}`
-  }
-
-  async getTotalSize(): Promise<number> {
-    let total = 0
-    let token: string | undefined
-    do {
-      const command = new ListObjectsV2Command({
-        Bucket: this.bucketName,
-        ContinuationToken: token
-      })
-      const response = await this.client.send(command)
-      for (const obj of response.Contents ?? []) {
-        total += obj.Size ?? 0
-      }
-      token = response.NextContinuationToken
-    } while (token)
-    return total
-  }
-
-  async presignPut(key: string, options: PresignOptions): Promise<string> {
-    // ContentLength intentionally excluded: including it adds content-length to
-    // X-Amz-SignedHeaders, requiring the uploading client to send an exact
-    // Content-Length header. Some fetch implementations omit it, causing MinIO/R2
-    // to reject the PUT with 400. Size validation already happened server-side.
-    const command = new PutObjectCommand({
-      Bucket: this.bucketName,
-      Key: key,
-      ContentType: options.contentType,
-    })
-    return getSignedUrl(this.client, command, { expiresIn: options.expiresIn })
-  }
-
-  async presignGet(key: string, options: PresignOptions): Promise<string> {
-    const command = new GetObjectCommand({
-      Bucket: this.bucketName,
-      Key: key,
-    })
-    return getSignedUrl(this.client, command, { expiresIn: options.expiresIn })
-  }
-
-  async list(options?: { prefix?: string; limit?: number; cursor?: string }): Promise<{ objects: Array<{ key: string; size: number }>; cursor?: string }> {
-    const command = new ListObjectsV2Command({
-      Bucket: this.bucketName,
-      Prefix: options?.prefix,
-      MaxKeys: options?.limit,
-      ContinuationToken: options?.cursor
-    })
-    const response = await this.client.send(command)
-    return {
-      objects: (response.Contents ?? []).map(obj => ({
-        key: obj.Key ?? '',
-        size: obj.Size ?? 0
-      })),
-      cursor: response.NextContinuationToken
-    }
-  }
-}

package/src/shared/storage-utils.ts

@@ -1,40 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { S3Client, ListObjectsV2Command, ListObjectsV2CommandOutput } from '@aws-sdk/client-s3'
-
-/**
- * Calcola la dimensione totale occupata in un bucket R2 (in byte).
- * Nota: esegue una scansione completa del bucket. Per bucket molto grandi 
- * andrebbe implementata una cache o usato Cloudflare Logpush/Analytics.
- */
-export async function getBucketSize(client: S3Client, bucketName: string): Promise<number> {
-  let totalSize = 0
-  let isTruncatedFlag = true
-  let continuationToken: string | undefined = undefined
-
-  try {
-    while (isTruncatedFlag) {
-      const command: ListObjectsV2Command = new ListObjectsV2Command({
-        Bucket: bucketName,
-        ContinuationToken: continuationToken,
-      })
-
-      const response: ListObjectsV2CommandOutput = await client.send(command)
-
-      if (response.Contents) {
-        for (const obj of response.Contents) {
-          totalSize += obj.Size ?? 0
-        }
-      }
-
-      isTruncatedFlag = response.IsTruncated ?? false
-      continuationToken = response.NextContinuationToken
-    }
-    return totalSize
-  } catch (err) {
-    console.error('Error calculating bucket size:', err)
-    throw new Error('Failed to calculate bucket size. Check your R2/S3 credentials and endpoint.')
-  }
-}

package/src/shared/system-stats.repository.d1.test.ts

@@ -1,58 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import { D1SystemStatsRepository } from './system-stats.repository.d1'
-
-function makeMockDb(firstResult: unknown = null) {
-  const runMock = vi.fn().mockResolvedValue({ success: true })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  // bind() returns the same statement interface for chained calls.
-  // The statement also exposes first() directly for queries without bind (e.g. getStorageUsage).
-  const bindMock = vi.fn(() => ({ run: runMock, first: firstMock }))
-  const stmt = { bind: bindMock, run: runMock, first: firstMock }
-  const prepareMock = vi.fn(() => stmt)
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
-}
-
-describe('D1SystemStatsRepository', () => {
-  describe('incrementStorage', () => {
-    it('calls UPDATE system_stats with the byte count', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1SystemStatsRepository(db).incrementStorage(512)
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE system_stats'))
-      expect(bindMock).toHaveBeenCalledWith(512)
-    })
-  })
-
-  describe('decrementStorage', () => {
-    it('calls UPDATE system_stats with MAX(0, ...) and the byte count', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1SystemStatsRepository(db).decrementStorage(256)
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('MAX(0'))
-      expect(bindMock).toHaveBeenCalledWith(256)
-    })
-  })
-
-  describe('setStorage', () => {
-    it('calls UPDATE system_stats with the stringified byte count', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1SystemStatsRepository(db).setStorage(1024)
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE system_stats'))
-      expect(bindMock).toHaveBeenCalledWith('1024')
-    })
-  })
-
-  describe('getStorageUsage', () => {
-    it('parses and returns the integer value from D1', async () => {
-      const { db } = makeMockDb({ value: '2048' })
-      expect(await new D1SystemStatsRepository(db).getStorageUsage()).toBe(2048)
-    })
-
-    it('returns 0 when D1 returns null (stat not initialised)', async () => {
-      const { db } = makeMockDb(null)
-      expect(await new D1SystemStatsRepository(db).getStorageUsage()).toBe(0)
-    })
-  })
-})

package/src/shared/system-stats.repository.d1.ts

@@ -1,48 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { SystemStatsRepository } from '@beechcms/core'
-
-/**
- * Implementation of SystemStatsRepository using Cloudflare D1.
- * Manages global system statistics such as total storage usage.
- */
-export class D1SystemStatsRepository implements SystemStatsRepository {
-  constructor(private database: D1Database) {}
-
-  /**
-   * Increments the total storage usage count.
-   */
-  async incrementStorage(byteCount: number): Promise<void> {
-    await this.database.prepare(
-      "UPDATE system_stats SET value = CAST(value AS INTEGER) + ? WHERE id = 'total_storage_bytes'"
-    ).bind(byteCount).run()
-  }
-
-  /**
-   * Decrements the total storage usage count, ensuring it doesn't fall below zero.
-   */
-  async decrementStorage(byteCount: number): Promise<void> {
-    await this.database.prepare(
-      "UPDATE system_stats SET value = MAX(0, CAST(value AS INTEGER) - ?) WHERE id = 'total_storage_bytes'"
-    ).bind(byteCount).run()
-  }
-
-  /**
-   * Sets the total storage usage count to a specific value.
-   */
-  async setStorage(byteCount: number): Promise<void> {
-    await this.database.prepare(
-      "UPDATE system_stats SET value = ? WHERE id = 'total_storage_bytes'"
-    ).bind(String(byteCount)).run()
-  }
-
-  /**
-   * Retrieves the current total storage usage in bytes.
-   */
-  async getStorageUsage(): Promise<number> {
-    const statsRecordResult = await this.database.prepare("SELECT value FROM system_stats WHERE id = 'total_storage_bytes'").first<{ value: string }>()
-    return statsRecordResult ? Number.parseInt(statsRecordResult.value, 10) : 0
-  }
-}

package/src/types.ts

@@ -1,90 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository, IHashProvider, ITokenService, IUserRepository, ISessionRepository, IPasswordResetTokenRepository, IActivityLogger, IActivityLogRepository, INotificationRepository, INotificationService, IWidgetRepository, ISearchRepository, IAnalyticsRepository, IContentScanRepository, ISeedRegistry, IClock, IIdGenerator, IAutomationRunner, IAutomationRepository, IScheduler, BackrefMap, ISiteSettingsRepository, IDemoDataRepository, JwtClaims, ISeedLayoutRepository, ISeedRepository, ISchemaMutator, IDashboardLayoutRepository } from '@beechcms/core'
-import type { IRateLimiterRegistry } from './middleware/rate-limit.middleware'
-import type { ISetupChecklistRepository } from './shared/d1-setup-checklist.repository'
-
-export interface Env {
-  DB: D1Database
-  JWT_SECRET: string
-  JWT_ISSUER?: string
-  JWT_AUDIENCE?: string
-  R2_ACCESS_KEY_ID?: string
-  R2_SECRET_ACCESS_KEY?: string
-  R2_ENDPOINT?: string
-  R2_BUCKET_NAME?: string
-  LOGIN_RATE_LIMITER?: RateLimit
-  REFRESH_RATE_LIMITER?: RateLimit
-  PUBLIC_READ_RATE_LIMITER?: RateLimit
-  PUBLIC_WRITE_RATE_LIMITER?: RateLimit
-  CORS_ORIGINS?: string
-  PUBLIC_READ_API_KEY?: string
-  PUBLIC_WRITE_API_KEY?: string
-  PUBLIC_PUBLISHED_ONLY?: string
-  PUBLIC_IDEMPOTENCY_TTL_SECONDS?: string
-  MEDIA_BASE_URL?: string
-  MEDIA_CDN_URL?: string
-  MAX_UPLOAD_BYTES?: string
-  RESEND_API_KEY?: string
-  EMAIL_API_KEY?: string
-  APP_URL?: string
-  EMAIL_FROM?: string
-  EMAIL_PROVIDER?: string
-  SMTP_HOST?: string
-  SMTP_PORT?: string
-  WEBHOOK_TESTER_URL?: string
-  FORGOT_PASSWORD_RATE_LIMITER?: RateLimit
-  RESET_PASSWORD_RATE_LIMITER?: RateLimit
-  ENV?: string
-  DATE_FORMAT?: string
-  ASSETS?: Fetcher
-  QSTASH_TOKEN?: string
-  QSTASH_URL?: string
-  /** Public base URL the worker is reachable at, used by QStash to call back the webhook (e.g. an ngrok tunnel in dev). Falls back to APP_URL. */
-  QSTASH_CALLBACK_URL?: string
-  QSTASH_CURRENT_SIGNING_KEY?: string
-  QSTASH_NEXT_SIGNING_KEY?: string
-}
-
-export interface Variables {
-  jwtPayload: JwtClaims
-  getSeed: (slug: string) => Seed | null
-  seedRegistry: ISeedRegistry
-  repository: ContentRepository
-  idempotencyRepository: IdempotencyRepository
-  bucket: BeechBucket
-  mediaRepository: MediaRepository
-  systemStatsRepository: SystemStatsRepository
-  hashProvider: IHashProvider
-  tokenService: ITokenService
-  userRepository: IUserRepository
-  sessionRepository: ISessionRepository
-  passwordResetTokenRepository: IPasswordResetTokenRepository
-  rateLimiters: IRateLimiterRegistry
-  activityLogger: IActivityLogger
-  activityLogRepository: IActivityLogRepository
-  notificationRepository: INotificationRepository
-  notificationService: INotificationService
-  widgetRepository: IWidgetRepository
-  searchRepository: ISearchRepository
-  analyticsRepository: IAnalyticsRepository
-  contentScanRepository: IContentScanRepository
-  clock: IClock
-  idGenerator: IIdGenerator
-  automationRepository: IAutomationRepository
-  automationRunner: IAutomationRunner
-  scheduler: IScheduler
-  backrefMap: BackrefMap
-  siteSettingsRepository: ISiteSettingsRepository
-  demoDataRepository: IDemoDataRepository
-  setupChecklistRepository: ISetupChecklistRepository
-  seedLayoutRepository: ISeedLayoutRepository
-  seedRepository: ISeedRepository
-  schemaMutator: ISchemaMutator
-  dashboardLayoutRepository: IDashboardLayoutRepository
-}
-
-export type AppEnv = { Bindings: Env; Variables: Variables }

package/src/upload.ts

@@ -1,198 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/**
- * Media Engine — Single-path presigned uploads.
- * Il Worker non riceve mai i bytes: agisce solo da gatekeeper (auth, validazione, firma).
- */
-import { Hono } from 'hono'
-import { isMimeAccepted } from '@beechcms/core'
-import { AppEnv } from './types'
-
-const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024
-const ABSOLUTE_MAX_UPLOAD_BYTES = 500 * 1024 * 1024
-const PRESIGN_TTL_SECONDS = 900
-
-function resolveMaxUploadBytes(env: { MAX_UPLOAD_BYTES?: string }): number {
-  const raw = env.MAX_UPLOAD_BYTES
-  if (!raw) return DEFAULT_MAX_UPLOAD_BYTES
-  const parsed = Number.parseInt(raw, 10)
-  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_UPLOAD_BYTES
-  return Math.min(parsed, ABSOLUTE_MAX_UPLOAD_BYTES)
-}
-
-function sanitizeFilename(name: string): string {
-  const base = name.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 100)
-  return base || 'file'
-}
-
-function generateObjectKey(originalName: string): string {
-  const timestamp = Math.floor(Date.now() / 1000)
-  return `${timestamp}-${sanitizeFilename(originalName)}`
-}
-
-export async function deleteR2Objects(
-  c: { var: { bucket: any, mediaRepository: any, systemStatsRepository: any } },
-  objectKeys: string[]
-): Promise<void> {
-  const { bucket, mediaRepository, systemStatsRepository } = c.var
-  for (const key of objectKeys) {
-    const media = await mediaRepository.getByKey(key).catch(() => null)
-    const size = media?.size_bytes ?? 0
-    try {
-      await bucket.delete(key)
-    } catch (err) {
-      console.warn(`Failed to delete storage object: ${key}`, err)
-    }
-    try {
-      await mediaRepository.untrack(key)
-      if (size > 0) await systemStatsRepository.decrementStorage(size)
-    } catch (err) {
-      console.warn(`Failed to untrack media object: ${key}`, err)
-    }
-  }
-}
-
-export const uploadRoutes = new Hono<AppEnv>()
-
-/** POST /upload/presign — Richiede URL firmata per upload diretto a R2. */
-uploadRoutes.post('/upload/presign', async (c) => {
-  let body: { filename?: unknown, mimeType?: unknown, sizeBytes?: unknown }
-  try { body = await c.req.json() } catch { return c.json({ error: 'Invalid JSON body' }, 400) }
-
-  const { filename, mimeType, sizeBytes } = body
-  if (typeof filename !== 'string' || !filename.trim()) return c.json({ error: 'filename is required' }, 400)
-  if (typeof mimeType !== 'string' || !mimeType.trim()) return c.json({ error: 'mimeType is required' }, 400)
-  if (typeof sizeBytes !== 'number' || !Number.isFinite(sizeBytes) || sizeBytes <= 0) {
-    return c.json({ error: 'sizeBytes must be a positive number' }, 400)
-  }
-
-  const maxBytes = resolveMaxUploadBytes(c.env)
-  if (sizeBytes > maxBytes) return c.json({ error: `File too large. Max ${maxBytes} bytes` }, 400)
-  if (!isMimeAccepted(mimeType, 'any')) return c.json({ error: 'File type not allowed' }, 400)
-
-  const key = generateObjectKey(filename)
-  const uploadUrl = await c.var.bucket.presignPut(key, {
-    expiresIn: PRESIGN_TTL_SECONDS,
-    contentType: mimeType,
-    contentLength: sizeBytes,
-  })
-
-  return c.json({ uploadUrl, key, expiresIn: PRESIGN_TTL_SECONDS }, 200)
-})
-
-/** POST /upload/confirm — Verifica l'oggetto su R2 e registra metadati. Idempotente sul key. */
-uploadRoutes.post('/upload/confirm', async (c) => {
-  const { bucket, mediaRepository: mediaRepo, systemStatsRepository: statsRepo } = c.var
-
-  let body: { key?: unknown }
-  try { body = await c.req.json() } catch { return c.json({ error: 'Invalid JSON body' }, 400) }
-  const { key } = body
-  if (typeof key !== 'string' || !key.trim()) return c.json({ error: 'key is required' }, 400)
-
-  const existing = await mediaRepo.getByKey(key)
-  if (existing) return c.json({ url: bucket.getUrl(key) }, 200)
-
-  const head = await bucket.head(key)
-  if (!head) return c.json({ error: 'Object not found in storage' }, 404)
-
-  const uploadedBy = c.var.jwtPayload?.sub ?? ''
-  const size = head.size ?? 0
-  const mime = head.contentType ?? 'application/octet-stream'
-  const filename = key.replace(/^\d+-/, '') || key
-
-  await statsRepo.incrementStorage(size)
-  await mediaRepo.trackUpload({
-    key,
-    filename,
-    mime_type: mime,
-    size_bytes: size,
-    uploaded_by: uploadedBy,
-  })
-
-  const jwtPayload = c.get('jwtPayload')
-  if (jwtPayload) {
-    c.get('activityLogger').log({
-      action: 'upload',
-      entityType: 'media',
-      entityId: key,
-      details: { name: filename, size, type: mime },
-      actor: {
-        id: jwtPayload.sub,
-        email: jwtPayload.email ?? 'unknown',
-        name: [jwtPayload.name, jwtPayload.surname].filter(Boolean).join(' ') || null,
-      },
-    })
-  }
-
-  return c.json({ url: bucket.getUrl(key) }, 200)
-})
-
-/** GET /upload/download-url/:key — URL firmata di lettura per asset privati. */
-uploadRoutes.get('/upload/download-url/:key', async (c) => {
-  const key = decodeURIComponent(c.req.param('key') ?? '')
-  if (!key) return c.json({ error: 'Missing key' }, 400)
-
-  const head = await c.var.bucket.head(key)
-  if (!head) return c.json({ error: 'Object not found' }, 404)
-
-  const downloadUrl = await c.var.bucket.presignGet(key, { expiresIn: PRESIGN_TTL_SECONDS })
-  return c.json({ downloadUrl, expiresIn: PRESIGN_TTL_SECONDS }, 200)
-})
-
-/** DELETE /upload/:key — Invariato. */
-uploadRoutes.delete('/upload/:key', async (c) => {
-  const key = c.req.param('key')
-  if (!key) return c.json({ error: 'Missing key' }, 400)
-  await deleteR2Objects(c, [decodeURIComponent(key)])
-  return c.json({ success: true }, 200)
-})
-
-// MIME types that browsers can render as active content — must be served as
-// attachments to prevent stored-XSS via same-origin script execution.
-const FORCE_DOWNLOAD_MIME_PREFIXES = [
-  'image/svg',       // image/svg+xml, image/svg
-  'text/',           // text/html, text/xml, text/javascript, …
-  'application/xml',
-  'application/xhtml',
-  'application/javascript',
-  'application/x-javascript',
-]
-
-function isActiveMimeType(mime: string): boolean {
-  const lower = mime.toLowerCase()
-  return FORCE_DOWNLOAD_MIME_PREFIXES.some((prefix) => lower.startsWith(prefix))
-}
-
-/** Serve un file dallo storage (usato dalla rotta pubblica /api/media/:key). */
-export async function serveMediaHandler(c: any): Promise<Response> {
-  const key = c.req.param('key')
-  if (!key) return new Response('Missing key', { status: 400 })
-  try {
-    const object = await c.var.bucket.get(decodeURIComponent(key))
-    if (!object) return new Response('Not found', { status: 404 })
-    const headers = new Headers()
-    const originalMime = object.contentType ?? 'application/octet-stream'
-
-    // Defense-in-depth: force attachment + opaque MIME for SVG and other
-    // active content types so browsers cannot render them inline even if a
-    // legacy object pre-dates the upload-time block in file-types.ts.
-    if (isActiveMimeType(originalMime)) {
-      headers.set('Content-Type', 'application/octet-stream')
-      headers.set('Content-Disposition', 'attachment')
-    } else {
-      headers.set('Content-Type', originalMime)
-    }
-
-    // Restrictive CSP on all media responses — even raster images don't need
-    // scripts or frames, and this prevents future regressions.
-    headers.set('Content-Security-Policy', "default-src 'none'; sandbox")
-    headers.set('X-Content-Type-Options', 'nosniff')
-    headers.set('Cache-Control', 'public, max-age=31536000, immutable')
-    return new Response(object.body, { status: 200, headers })
-  } catch (err) {
-    console.error(`[serveMediaHandler] Error serving file ${key}:`, err)
-    return new Response('Internal error', { status: 500 })
-  }
-}