@beechcms/core 0.6.7 → 0.8.0

package/dist/engine/validation/richtext-sanitizer.js

@@ -9,11 +9,12 @@ const ALLOWED_RICHTEXT_NODE_TYPES = new Set([
     'listItem', 'codeBlock', 'horizontalRule', 'hardBreak', 'image',
     'table', 'tableRow', 'tableHeader', 'tableCell',
     'inlineMath', 'blockMath', // Mathematics extension
+    'taskList', 'taskItem',
 ]);
 /** Allowlisted TipTap mark `type` values. */
 const ALLOWED_RICHTEXT_MARK_TYPES = new Set([
     'bold', 'italic', 'strike', 'code', 'link', 'highlight',
-    'superscript', 'subscript', 'textStyle',
+    'superscript', 'subscript', 'textStyle', 'underline',
 ]);
 /** Keys that may carry URLs inside a node/mark attrs. */
 const URL_LIKE_RICHTEXT_KEYS = new Set(['href', 'src']);

package/dist/index.d.ts

@@ -14,7 +14,6 @@ export * from './engine/seeds.js';
 export * from './engine/engine.js';
 export * from './engine/validation/index.js';
 export * from './content/richtext/richtext.js';
-export * from './content/richtext/richtext-render.js';
 export * from './content/slug-utils.js';
 export * from './content/content.repository.js';
 export * from './common/hooks.js';
@@ -28,6 +27,13 @@ export * from './auth/token-service.js';
 export * from './auth/user.repository.js';
 export * from './auth/session.repository.js';
 export * from './auth/password-reset-token.repository.js';
+export * from './oauth/scopes.js';
+export * from './oauth/pkce.js';
+export * from './oauth/role-guard.js';
+export * from './oauth/client.repository.js';
+export * from './oauth/authorization-code.repository.js';
+export * from './oauth/token.repository.js';
+export * from './oauth/consent.repository.js';
 export * from './rate-limit/rate-limiter.js';
 export * from './observability/activity-logger.js';
 export * from './observability/activity-log.repository.js';
@@ -36,6 +42,8 @@ export * from './notifications/notification.repository.js';
 export * from './notifications/notification-service.js';
 export * from './widget/widget.repository.js';
 export * from './search/search.repository.js';
+export * from './search/vector-extractor.js';
+export * from './search/vector.repository.js';
 export * from './content/content-scan.repository.js';
 export * from './common/clock.js';
 export * from './common/id-generator.js';
@@ -69,4 +77,11 @@ export * from './dashboard-layout/kanban/kanban.js';
 export * from './dashboard-layout/view-authorization.js';
 export * from './dashboard-layout/kanban/kanban-position.repository.js';
 export * from './common/email.provider.js';
+export * from './media/magic-bytes.js';
+export * from './security/time-trap.js';
+export * from './antivirus/antivirus.interface.js';
+export * from './antivirus/virustotal-antivirus.provider.js';
+export * from './antivirus/noop-antivirus.provider.js';
+export * from './rate-limit/token-bucket-rate-limiter.js';
+export * from './security/time-trap-token.repository.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,uCAAuC,CAAA;AACrD,cAAc,yBAAyB,CAAA;AACvC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sCAAsC,CAAA;AACpD,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,+CAA+C,CAAA;AAC7D,cAAc,mDAAmD,CAAA;AACjE,cAAc,gCAAgC,CAAA;AAC9C,cAAc,2BAA2B,CAAA;AACzC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,kCAAkC,CAAA;AAChD,cAAc,uBAAuB,CAAA;AACrC,cAAc,wCAAwC,CAAA;AACtD,cAAc,mCAAmC,CAAA;AACjD,cAAc,mCAAmC,CAAA;AACjD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,0CAA0C,CAAA;AACxD,cAAc,wCAAwC,CAAA;AACtD,cAAc,wCAAwC,CAAA;AACtD,cAAc,6CAA6C,CAAA;AAC3D,cAAc,mDAAmD,CAAA;AACjE,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,sBAAsB,CAAA;AACpC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kCAAkC,CAAA;AAChD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,qCAAqC,CAAA;AACnD,cAAc,0CAA0C,CAAA;AACxD,cAAc,yDAAyD,CAAA;AACvE,cAAc,4BAA4B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,gCAAgC,CAAA;AAE9C,cAAc,yBAAyB,CAAA;AACvC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,2BAA2B,CAAA;AACzC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2CAA2C,CAAA;AACzD,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,0CAA0C,CAAA;AACxD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,yCAAyC,CAAA;AACvD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sCAAsC,CAAA;AACpD,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oCAAoC,CAAA;AAClD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,+CAA+C,CAAA;AAC7D,cAAc,mDAAmD,CAAA;AACjE,cAAc,gCAAgC,CAAA;AAC9C,cAAc,2BAA2B,CAAA;AACzC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,kCAAkC,CAAA;AAChD,cAAc,uBAAuB,CAAA;AACrC,cAAc,wCAAwC,CAAA;AACtD,cAAc,mCAAmC,CAAA;AACjD,cAAc,mCAAmC,CAAA;AACjD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,0CAA0C,CAAA;AACxD,cAAc,wCAAwC,CAAA;AACtD,cAAc,wCAAwC,CAAA;AACtD,cAAc,6CAA6C,CAAA;AAC3D,cAAc,mDAAmD,CAAA;AACjE,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,sBAAsB,CAAA;AACpC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kCAAkC,CAAA;AAChD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,qCAAqC,CAAA;AACnD,cAAc,0CAA0C,CAAA;AACxD,cAAc,yDAAyD,CAAA;AACvE,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,oCAAoC,CAAA;AAClD,cAAc,8CAA8C,CAAA;AAC5D,cAAc,wCAAwC,CAAA;AACtD,cAAc,2CAA2C,CAAA;AACzD,cAAc,0CAA0C,CAAA"}

package/dist/index.js

@@ -16,7 +16,6 @@ export * from './engine/seeds.js';
 export * from './engine/engine.js';
 export * from './engine/validation/index.js';
 export * from './content/richtext/richtext.js';
-export * from './content/richtext/richtext-render.js';
 export * from './content/slug-utils.js';
 export * from './content/content.repository.js';
 export * from './common/hooks.js';
@@ -30,6 +29,13 @@ export * from './auth/token-service.js';
 export * from './auth/user.repository.js';
 export * from './auth/session.repository.js';
 export * from './auth/password-reset-token.repository.js';
+export * from './oauth/scopes.js';
+export * from './oauth/pkce.js';
+export * from './oauth/role-guard.js';
+export * from './oauth/client.repository.js';
+export * from './oauth/authorization-code.repository.js';
+export * from './oauth/token.repository.js';
+export * from './oauth/consent.repository.js';
 export * from './rate-limit/rate-limiter.js';
 export * from './observability/activity-logger.js';
 export * from './observability/activity-log.repository.js';
@@ -38,6 +44,8 @@ export * from './notifications/notification.repository.js';
 export * from './notifications/notification-service.js';
 export * from './widget/widget.repository.js';
 export * from './search/search.repository.js';
+export * from './search/vector-extractor.js';
+export * from './search/vector.repository.js';
 export * from './content/content-scan.repository.js';
 export * from './common/clock.js';
 export * from './common/id-generator.js';
@@ -71,3 +79,10 @@ export * from './dashboard-layout/kanban/kanban.js';
 export * from './dashboard-layout/view-authorization.js';
 export * from './dashboard-layout/kanban/kanban-position.repository.js';
 export * from './common/email.provider.js';
+export * from './media/magic-bytes.js';
+export * from './security/time-trap.js';
+export * from './antivirus/antivirus.interface.js';
+export * from './antivirus/virustotal-antivirus.provider.js';
+export * from './antivirus/noop-antivirus.provider.js';
+export * from './rate-limit/token-bucket-rate-limiter.js';
+export * from './security/time-trap-token.repository.js';

package/dist/media/file-types.d.ts

@@ -1,13 +1,107 @@
+/**
+ * File acceptance filter categories used by branch schemas and forms.
+ */
 export type FileAccept = 'image' | 'document' | 'any';
-export declare const IMAGE_EXTENSIONS: Set<string>;
-export declare const BLOCKED_IMAGE_EXTENSIONS: Set<string>;
-export declare const DOCUMENT_EXTENSIONS: Set<string>;
-export declare const ARCHIVE_EXTENSIONS: Set<string>;
-export declare const IMAGE_MIME_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "image/avif", "image/bmp", "image/x-icon", "image/vnd.microsoft.icon"];
-export declare const BLOCKED_IMAGE_MIME_TYPES: readonly ["image/svg+xml", "image/svg"];
-export declare const DOCUMENT_MIME_TYPES: readonly ["application/pdf", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/vnd.ms-powerpoint", "application/vnd.openxmlformats-officedocument.presentationml.presentation", "text/plain", "text/csv", "text/markdown"];
-export declare const ARCHIVE_MIME_TYPES: readonly ["application/zip", "application/x-zip-compressed", "application/x-7z-compressed", "application/x-tar", "application/gzip", "application/json"];
+/**
+ * High-level categorization of supported file types.
+ */
+export type FileCategory = 'image' | 'document' | 'archive';
+/**
+ * Definition of a supported file format in BeechCMS, including MIME types,
+ * binary classification, and binary signature verification rules.
+ */
+export interface FileTypeDefinition {
+    /** File extension without leading dot (e.g. 'jpg', 'png', 'pdf'). */
+    readonly extension: string;
+    /** Canonical primary MIME type (e.g. 'image/jpeg'). */
+    readonly primaryMime: string;
+    /** All valid MIME types associated with this format. */
+    readonly mimeTypes: readonly string[];
+    /** High-level file category. */
+    readonly category: FileCategory;
+    /** Whether the file is a binary format requiring magic byte signature validation. */
+    readonly isBinary: boolean;
+    /** Expected magic bytes prefix if the format uses a static prefix. */
+    readonly magicBytes?: readonly number[];
+    /** Custom signature matching function for formats with complex, variable, or offset headers. */
+    readonly matchSignature?: (bytes: Uint8Array) => boolean;
+}
+/**
+ * Checks whether a byte buffer starts with a specified byte prefix.
+ *
+ * @param bytes - The byte buffer to inspect.
+ * @param prefix - The sequence of bytes to match against.
+ * @returns True if the buffer starts with the given prefix, false otherwise.
+ */
+export declare function matchBytePrefix(bytes: Uint8Array, prefix: readonly number[]): boolean;
+/**
+ * Evaluates whether the given byte buffer matches the binary signature of a file definition.
+ *
+ * @param def - The file type definition to check against.
+ * @param bytes - The raw byte buffer to inspect.
+ * @returns True if the bytes match the definition's signature rules, false otherwise.
+ */
+export declare function matchesFileSignature(def: FileTypeDefinition, bytes: Uint8Array): boolean;
+/**
+ * Single source of truth registry for all supported file types in BeechCMS.
+ */
+export declare const SUPPORTED_FILE_TYPES: Record<string, FileTypeDefinition>;
+/**
+ * SVG is intentionally blocked from general file upload as it can embed executable scripts
+ * creating a stored XSS vulnerability when served directly to browsers.
+ */
+export declare const BLOCKED_IMAGE_EXTENSIONS: ReadonlySet<string>;
+/**
+ * Blocked MIME types associated with unsafe image formats.
+ */
+export declare const BLOCKED_IMAGE_MIME_TYPES: readonly string[];
+/** Set of supported image file extensions. */
+export declare const IMAGE_EXTENSIONS: ReadonlySet<string>;
+/** Set of supported document file extensions. */
+export declare const DOCUMENT_EXTENSIONS: ReadonlySet<string>;
+/** Set of supported archive file extensions. */
+export declare const ARCHIVE_EXTENSIONS: ReadonlySet<string>;
+/** List of supported image MIME types. */
+export declare const IMAGE_MIME_TYPES: readonly string[];
+/** List of supported document MIME types. */
+export declare const DOCUMENT_MIME_TYPES: readonly string[];
+/** List of supported archive MIME types. */
+export declare const ARCHIVE_MIME_TYPES: readonly string[];
+/**
+ * Look up a supported file type definition by its extension.
+ *
+ * @param ext - The extension string with or without leading dot.
+ * @returns The matching FileTypeDefinition, or undefined if unsupported.
+ */
+export declare function getFileTypeByExtension(ext: string | null | undefined): FileTypeDefinition | undefined;
+/**
+ * Look up a supported file type definition by its declared MIME type.
+ *
+ * @param mime - The MIME string (e.g. 'image/png' or 'image/jpeg; charset=utf-8').
+ * @returns The matching FileTypeDefinition, or undefined if unsupported.
+ */
+export declare function getFileTypeByMime(mime: string | null | undefined): FileTypeDefinition | undefined;
+/**
+ * Extracts a lowercase file extension from a URL string or query parameters.
+ *
+ * @param url - The URL string to parse.
+ * @returns The extracted extension, or null if none was found.
+ */
 export declare function extensionFromUrl(url: string): string | null;
-export declare function isExtensionAccepted(ext: string | null, accept: FileAccept): boolean;
+/**
+ * Checks whether a given file extension satisfies an acceptance policy ('image' | 'document' | 'any').
+ *
+ * @param ext - The file extension.
+ * @param accept - The acceptance mode.
+ * @returns True if accepted, false otherwise.
+ */
+export declare function isExtensionAccepted(ext: string | null | undefined, accept: FileAccept): boolean;
+/**
+ * Checks whether a given MIME type satisfies an acceptance policy ('image' | 'document' | 'any').
+ *
+ * @param mime - The declared MIME string.
+ * @param accept - The acceptance mode.
+ * @returns True if accepted, false otherwise.
+ */
 export declare function isMimeAccepted(mime: string, accept: FileAccept): boolean;
 //# sourceMappingURL=file-types.d.ts.map

package/dist/media/file-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-types.d.ts","sourceRoot":"","sources":["../../src/media/file-types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAA;AAKrD,eAAO,MAAM,gBAAgB,aAAuE,CAAA;AACpG,eAAO,MAAM,wBAAwB,aAA2B,CAAA;AAChE,eAAO,MAAM,mBAAmB,aAAoF,CAAA;AACpH,eAAO,MAAM,kBAAkB,aAA8C,CAAA;AAI7E,eAAO,MAAM,gBAAgB,wIASnB,CAAA;AAGV,eAAO,MAAM,wBAAwB,yCAA0C,CAAA;AAC/E,eAAO,MAAM,mBAAmB,yXAWtB,CAAA;AACV,eAAO,MAAM,kBAAkB,0JAOrB,CAAA;AAEV,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAOnF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAcxE"}
+{"version":3,"file":"file-types.d.ts","sourceRoot":"","sources":["../../src/media/file-types.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAA;AAErD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;AAE3D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,gGAAgG;IAChG,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAA;CACzD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMrF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAKxF;AA6CD;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAgMnE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAA4B,CAAA;AAErF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAmC,CAAA;AAIzF,8CAA8C;AAC9C,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAEhD,CAAA;AAED,iDAAiD;AACjD,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAA;AAED,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAElD,CAAA;AAED,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAE7C,CAAA;AAED,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAEhD,CAAA;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAE/C,CAAA;AAMD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAIrG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAMjG;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAO/F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CASxE"}

package/dist/media/file-types.js

@@ -1,47 +1,322 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) 2024–2026 Flavio De Musso
-// SVG is intentionally excluded: SVG can embed <script> tags and is rendered
-// inline by browsers when served as image/svg+xml on a same-origin route,
-// creating a stored XSS vector (see security audit finding #4).
-export const IMAGE_EXTENSIONS = new Set(['jpg', 'jpeg', 'png', 'gif', 'webp', 'avif', 'bmp', 'ico']);
+/**
+ * Checks whether a byte buffer starts with a specified byte prefix.
+ *
+ * @param bytes - The byte buffer to inspect.
+ * @param prefix - The sequence of bytes to match against.
+ * @returns True if the buffer starts with the given prefix, false otherwise.
+ */
+export function matchBytePrefix(bytes, prefix) {
+    if (bytes.length < prefix.length)
+        return false;
+    for (let i = 0; i < prefix.length; i++) {
+        if (bytes[i] !== prefix[i])
+            return false;
+    }
+    return true;
+}
+/**
+ * Evaluates whether the given byte buffer matches the binary signature of a file definition.
+ *
+ * @param def - The file type definition to check against.
+ * @param bytes - The raw byte buffer to inspect.
+ * @returns True if the bytes match the definition's signature rules, false otherwise.
+ */
+export function matchesFileSignature(def, bytes) {
+    if (!def.isBinary)
+        return true;
+    if (def.matchSignature)
+        return def.matchSignature(bytes);
+    if (def.magicBytes)
+        return matchBytePrefix(bytes, def.magicBytes);
+    return false;
+}
+/** OLE Compound File Binary Format (CFBF) header used by legacy MS Office files (.doc, .xls, .ppt). */
+const OLE_MAGIC = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
+/** Matcher for OLE CFBF binary files. */
+function matchOleSignature(bytes) {
+    return matchBytePrefix(bytes, OLE_MAGIC);
+}
+/** Standard ZIP header matcher used by .zip and Office OpenXML (.docx, .xlsx, .pptx). */
+function matchZipSignature(bytes) {
+    if (bytes.length < 4)
+        return false;
+    return ((bytes[0] === 0x50 && bytes[1] === 0x4B && bytes[2] === 0x03 && bytes[3] === 0x04) || // standard zip
+        (bytes[0] === 0x50 && bytes[1] === 0x4B && bytes[2] === 0x05 && bytes[3] === 0x06) || // empty zip
+        (bytes[0] === 0x50 && bytes[1] === 0x4B && bytes[2] === 0x07 && bytes[3] === 0x08) // spanned zip
+    );
+}
+/** Common shared definition for JPEG files. */
+const JPEG_DEFINITION = {
+    primaryMime: 'image/jpeg',
+    mimeTypes: ['image/jpeg', 'image/jpg'],
+    category: 'image',
+    isBinary: true,
+    magicBytes: [0xFF, 0xD8, 0xFF],
+};
+/** Common shared definition for legacy MS Office files. */
+const OLE_DOCUMENT_DEFINITION = {
+    category: 'document',
+    isBinary: true,
+    magicBytes: [...OLE_MAGIC],
+    matchSignature: matchOleSignature,
+};
+/** Common shared definition for OpenXML Office files. */
+const OPENXML_DOCUMENT_DEFINITION = {
+    category: 'document',
+    isBinary: true,
+    magicBytes: [0x50, 0x4B, 0x03, 0x04],
+    matchSignature: matchZipSignature,
+};
+/**
+ * Single source of truth registry for all supported file types in BeechCMS.
+ */
+export const SUPPORTED_FILE_TYPES = {
+    // --- IMAGES ---
+    jpg: {
+        extension: 'jpg',
+        ...JPEG_DEFINITION,
+    },
+    jpeg: {
+        extension: 'jpeg',
+        ...JPEG_DEFINITION,
+    },
+    png: {
+        extension: 'png',
+        primaryMime: 'image/png',
+        mimeTypes: ['image/png'],
+        category: 'image',
+        isBinary: true,
+        magicBytes: [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A],
+    },
+    gif: {
+        extension: 'gif',
+        primaryMime: 'image/gif',
+        mimeTypes: ['image/gif'],
+        category: 'image',
+        isBinary: true,
+        magicBytes: [0x47, 0x49, 0x46, 0x38],
+        matchSignature: (bytes) => bytes.length >= 6 &&
+            bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38 &&
+            (bytes[4] === 0x37 || bytes[4] === 0x39) && bytes[5] === 0x61,
+    },
+    webp: {
+        extension: 'webp',
+        primaryMime: 'image/webp',
+        mimeTypes: ['image/webp'],
+        category: 'image',
+        isBinary: true,
+        magicBytes: [0x52, 0x49, 0x46, 0x46],
+        matchSignature: (bytes) => bytes.length >= 12 &&
+            bytes[0] === 0x52 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x46 &&
+            bytes[8] === 0x57 && bytes[9] === 0x45 && bytes[10] === 0x42 && bytes[11] === 0x50,
+    },
+    avif: {
+        extension: 'avif',
+        primaryMime: 'image/avif',
+        mimeTypes: ['image/avif'],
+        category: 'image',
+        isBinary: true,
+        magicBytes: [0x66, 0x74, 0x79, 0x70],
+        matchSignature: (bytes) => {
+            if (bytes.length < 12)
+                return false;
+            // Check for 'ftyp' at offset 4
+            const isFtyp = bytes[4] === 0x66 && bytes[5] === 0x74 && bytes[6] === 0x79 && bytes[7] === 0x70;
+            if (!isFtyp)
+                return false;
+            // Brand check: 'avif', 'avis', 'mif1', 'msf1'
+            const brand = String.fromCharCode(bytes[8], bytes[9], bytes[10], bytes[11]);
+            return brand === 'avif' || brand === 'avis' || brand === 'mif1' || brand === 'msf1';
+        },
+    },
+    bmp: {
+        extension: 'bmp',
+        primaryMime: 'image/bmp',
+        mimeTypes: ['image/bmp'],
+        category: 'image',
+        isBinary: true,
+        magicBytes: [0x42, 0x4D],
+    },
+    ico: {
+        extension: 'ico',
+        primaryMime: 'image/x-icon',
+        mimeTypes: ['image/x-icon', 'image/vnd.microsoft.icon'],
+        category: 'image',
+        isBinary: true,
+        magicBytes: [0x00, 0x00, 0x01, 0x00],
+    },
+    // --- DOCUMENTS ---
+    pdf: {
+        extension: 'pdf',
+        primaryMime: 'application/pdf',
+        mimeTypes: ['application/pdf'],
+        category: 'document',
+        isBinary: true,
+        magicBytes: [0x25, 0x50, 0x44, 0x46],
+    },
+    docx: {
+        extension: 'docx',
+        primaryMime: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        mimeTypes: ['application/vnd.openxmlformats-officedocument.wordprocessingml.document'],
+        ...OPENXML_DOCUMENT_DEFINITION,
+    },
+    doc: {
+        extension: 'doc',
+        primaryMime: 'application/msword',
+        mimeTypes: ['application/msword'],
+        ...OLE_DOCUMENT_DEFINITION,
+    },
+    xlsx: {
+        extension: 'xlsx',
+        primaryMime: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        mimeTypes: ['application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'],
+        ...OPENXML_DOCUMENT_DEFINITION,
+    },
+    xls: {
+        extension: 'xls',
+        primaryMime: 'application/vnd.ms-excel',
+        mimeTypes: ['application/vnd.ms-excel'],
+        ...OLE_DOCUMENT_DEFINITION,
+    },
+    pptx: {
+        extension: 'pptx',
+        primaryMime: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        mimeTypes: ['application/vnd.openxmlformats-officedocument.presentationml.presentation'],
+        ...OPENXML_DOCUMENT_DEFINITION,
+    },
+    ppt: {
+        extension: 'ppt',
+        primaryMime: 'application/vnd.ms-powerpoint',
+        mimeTypes: ['application/vnd.ms-powerpoint'],
+        ...OLE_DOCUMENT_DEFINITION,
+    },
+    txt: {
+        extension: 'txt',
+        primaryMime: 'text/plain',
+        mimeTypes: ['text/plain'],
+        category: 'document',
+        isBinary: false,
+    },
+    csv: {
+        extension: 'csv',
+        primaryMime: 'text/csv',
+        mimeTypes: ['text/csv'],
+        category: 'document',
+        isBinary: false,
+    },
+    md: {
+        extension: 'md',
+        primaryMime: 'text/markdown',
+        mimeTypes: ['text/markdown'],
+        category: 'document',
+        isBinary: false,
+    },
+    // --- ARCHIVES & DATA ---
+    zip: {
+        extension: 'zip',
+        primaryMime: 'application/zip',
+        mimeTypes: ['application/zip', 'application/x-zip-compressed'],
+        category: 'archive',
+        isBinary: true,
+        magicBytes: [0x50, 0x4B, 0x03, 0x04],
+        matchSignature: matchZipSignature,
+    },
+    '7z': {
+        extension: '7z',
+        primaryMime: 'application/x-7z-compressed',
+        mimeTypes: ['application/x-7z-compressed'],
+        category: 'archive',
+        isBinary: true,
+        magicBytes: [0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C],
+    },
+    tar: {
+        extension: 'tar',
+        primaryMime: 'application/x-tar',
+        mimeTypes: ['application/x-tar'],
+        category: 'archive',
+        isBinary: true,
+        magicBytes: [0x75, 0x73, 0x74, 0x61, 0x72], // 'ustar'
+        matchSignature: (bytes) => {
+            if (bytes.length < 512)
+                return false;
+            // Check for POSIX 'ustar' at offset 257
+            return (bytes[257] === 0x75 && bytes[258] === 0x73 && bytes[259] === 0x74 &&
+                bytes[260] === 0x61 && bytes[261] === 0x72);
+        },
+    },
+    gz: {
+        extension: 'gz',
+        primaryMime: 'application/gzip',
+        mimeTypes: ['application/gzip'],
+        category: 'archive',
+        isBinary: true,
+        magicBytes: [0x1F, 0x8B],
+    },
+    json: {
+        extension: 'json',
+        primaryMime: 'application/json',
+        mimeTypes: ['application/json'],
+        category: 'archive',
+        isBinary: false,
+    },
+};
+/**
+ * SVG is intentionally blocked from general file upload as it can embed executable scripts
+ * creating a stored XSS vulnerability when served directly to browsers.
+ */
 export const BLOCKED_IMAGE_EXTENSIONS = new Set(['svg', 'svgz']);
-export const DOCUMENT_EXTENSIONS = new Set(['pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'txt', 'csv', 'md']);
-export const ARCHIVE_EXTENSIONS = new Set(['zip', '7z', 'tar', 'gz', 'json']);
-// Explicitly enumerate safe image MIME types instead of using the wildcard
-// `image/*` prefix, which would permit `image/svg+xml` and other XSS vectors.
-export const IMAGE_MIME_TYPES = [
-    'image/jpeg',
-    'image/png',
-    'image/gif',
-    'image/webp',
-    'image/avif',
-    'image/bmp',
-    'image/x-icon',
-    'image/vnd.microsoft.icon',
-];
-// Blocked image MIME types — listed explicitly so upload code can reject them
-// with a clear error rather than a generic "file type not allowed".
+/**
+ * Blocked MIME types associated with unsafe image formats.
+ */
 export const BLOCKED_IMAGE_MIME_TYPES = ['image/svg+xml', 'image/svg'];
-export const DOCUMENT_MIME_TYPES = [
-    'application/pdf',
-    'application/msword',
-    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-    'application/vnd.ms-excel',
-    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-    'application/vnd.ms-powerpoint',
-    'application/vnd.openxmlformats-officedocument.presentationml.presentation',
-    'text/plain',
-    'text/csv',
-    'text/markdown',
-];
-export const ARCHIVE_MIME_TYPES = [
-    'application/zip',
-    'application/x-zip-compressed',
-    'application/x-7z-compressed',
-    'application/x-tar',
-    'application/gzip',
-    'application/json',
-];
+const BLOCKED_IMAGE_MIME_SET = new Set(BLOCKED_IMAGE_MIME_TYPES);
+/** Set of supported image file extensions. */
+export const IMAGE_EXTENSIONS = new Set(Object.values(SUPPORTED_FILE_TYPES).filter((def) => def.category === 'image').map((def) => def.extension));
+/** Set of supported document file extensions. */
+export const DOCUMENT_EXTENSIONS = new Set(Object.values(SUPPORTED_FILE_TYPES).filter((def) => def.category === 'document').map((def) => def.extension));
+/** Set of supported archive file extensions. */
+export const ARCHIVE_EXTENSIONS = new Set(Object.values(SUPPORTED_FILE_TYPES).filter((def) => def.category === 'archive').map((def) => def.extension));
+/** List of supported image MIME types. */
+export const IMAGE_MIME_TYPES = Array.from(new Set(Object.values(SUPPORTED_FILE_TYPES).filter((def) => def.category === 'image').flatMap((def) => def.mimeTypes)));
+/** List of supported document MIME types. */
+export const DOCUMENT_MIME_TYPES = Array.from(new Set(Object.values(SUPPORTED_FILE_TYPES).filter((def) => def.category === 'document').flatMap((def) => def.mimeTypes)));
+/** List of supported archive MIME types. */
+export const ARCHIVE_MIME_TYPES = Array.from(new Set(Object.values(SUPPORTED_FILE_TYPES).filter((def) => def.category === 'archive').flatMap((def) => def.mimeTypes)));
+const IMAGE_MIME_SET = new Set(IMAGE_MIME_TYPES);
+const DOCUMENT_MIME_SET = new Set(DOCUMENT_MIME_TYPES);
+const ARCHIVE_MIME_SET = new Set(ARCHIVE_MIME_TYPES);
+/**
+ * Look up a supported file type definition by its extension.
+ *
+ * @param ext - The extension string with or without leading dot.
+ * @returns The matching FileTypeDefinition, or undefined if unsupported.
+ */
+export function getFileTypeByExtension(ext) {
+    if (!ext)
+        return undefined;
+    const normalised = ext.replace(/^\./, '').toLowerCase().trim();
+    return SUPPORTED_FILE_TYPES[normalised];
+}
+/**
+ * Look up a supported file type definition by its declared MIME type.
+ *
+ * @param mime - The MIME string (e.g. 'image/png' or 'image/jpeg; charset=utf-8').
+ * @returns The matching FileTypeDefinition, or undefined if unsupported.
+ */
+export function getFileTypeByMime(mime) {
+    if (!mime)
+        return undefined;
+    const normalised = mime.split(';')[0].trim().toLowerCase();
+    return Object.values(SUPPORTED_FILE_TYPES).find((def) => def.mimeTypes.some((m) => m.toLowerCase() === normalised));
+}
+/**
+ * Extracts a lowercase file extension from a URL string or query parameters.
+ *
+ * @param url - The URL string to parse.
+ * @returns The extracted extension, or null if none was found.
+ */
 export function extensionFromUrl(url) {
     try {
         const parsed = new URL(url);
@@ -50,9 +325,9 @@ export function extensionFromUrl(url) {
         if (dot >= 0 && dot < path.length - 1) {
             return path.slice(dot + 1).toLowerCase();
         }
-        const fm = parsed.searchParams.get('fm') || parsed.searchParams.get('format') || parsed.searchParams.get('ext');
-        if (fm && /^[a-z0-9]+$/i.test(fm)) {
-            return fm.toLowerCase();
+        const param = parsed.searchParams.get('fm') || parsed.searchParams.get('format') || parsed.searchParams.get('ext');
+        if (param && /^[a-z0-9]+$/i.test(param)) {
+            return param.toLowerCase();
         }
         return null;
     }
@@ -60,6 +335,13 @@ export function extensionFromUrl(url) {
         return null;
     }
 }
+/**
+ * Checks whether a given file extension satisfies an acceptance policy ('image' | 'document' | 'any').
+ *
+ * @param ext - The file extension.
+ * @param accept - The acceptance mode.
+ * @returns True if accepted, false otherwise.
+ */
 export function isExtensionAccepted(ext, accept) {
     if (accept === 'any')
         return true;
@@ -73,21 +355,23 @@ export function isExtensionAccepted(ext, accept) {
         return DOCUMENT_EXTENSIONS.has(ext);
     return false;
 }
+/**
+ * Checks whether a given MIME type satisfies an acceptance policy ('image' | 'document' | 'any').
+ *
+ * @param mime - The declared MIME string.
+ * @param accept - The acceptance mode.
+ * @returns True if accepted, false otherwise.
+ */
 export function isMimeAccepted(mime, accept) {
-    // Normalise: strip parameters (e.g. "image/jpeg; charset=utf-8" → "image/jpeg")
     const normalised = mime.split(';')[0].trim().toLowerCase();
-    // Unconditionally reject SVG regardless of accept mode — SVG can carry
-    // embedded scripts and is rendered by browsers when served inline.
-    if (BLOCKED_IMAGE_MIME_TYPES.includes(normalised))
+    if (BLOCKED_IMAGE_MIME_SET.has(normalised))
         return false;
     if (accept === 'any') {
-        return IMAGE_MIME_TYPES.includes(normalised)
-            || DOCUMENT_MIME_TYPES.includes(normalised)
-            || ARCHIVE_MIME_TYPES.includes(normalised);
+        return IMAGE_MIME_SET.has(normalised) || DOCUMENT_MIME_SET.has(normalised) || ARCHIVE_MIME_SET.has(normalised);
     }
     if (accept === 'image')
-        return IMAGE_MIME_TYPES.includes(normalised);
+        return IMAGE_MIME_SET.has(normalised);
     if (accept === 'document')
-        return DOCUMENT_MIME_TYPES.includes(normalised);
+        return DOCUMENT_MIME_SET.has(normalised);
     return false;
 }