@btst/stack 2.10.0 → 2.11.1

package/dist/shared/{stack.BXxrFL9R.d.ts → stack.qta0-CPq.d.ts}

@@ -1,7 +1,7 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { QueryClient } from '@tanstack/react-query';
 import { createApiClient } from '@btst/stack/plugins/client';
-import { P as Post, T as Tag, c as createPostSchema, u as updatePostSchema, S as SerializedPost, a as SerializedTag } from './stack.BWp0hcm9.js';
+import { P as Post, T as Tag, c as createPostSchema, u as updatePostSchema, S as SerializedPost, a as SerializedTag } from './stack.Sod_PZhB.js';
 import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
 import { DBAdapter } from '@btst/db';
 import * as better_call from 'better-call';
@@ -236,6 +236,12 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
             title: string;
             content: string;
             excerpt: string;
+            slug?: string | undefined;
+            published?: boolean | undefined;
+            publishedAt?: unknown;
+            createdAt?: unknown;
+            updatedAt?: unknown;
+            image?: string | undefined;
             tags?: ({
                 name: string;
             } | {
@@ -243,16 +249,16 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 name: string;
                 slug: string;
             })[] | undefined;
+        }, {
+            title: string;
+            content: string;
+            excerpt: string;
             slug?: string | undefined;
             published?: boolean | undefined;
             publishedAt?: unknown;
             createdAt?: unknown;
             updatedAt?: unknown;
             image?: string | undefined;
-        }, {
-            title: string;
-            content: string;
-            excerpt: string;
             tags?: ({
                 name: string;
             } | {
@@ -260,12 +266,6 @@ declare const blogBackendPlugin: (hooks?: BlogBackendHooks) => _btst_stack_plugi
                 name: string;
                 slug: string;
             })[] | undefined;
-            slug?: string | undefined;
-            published?: boolean | undefined;
-            publishedAt?: unknown;
-            createdAt?: unknown;
-            updatedAt?: unknown;
-            image?: string | undefined;
         }>;
     }, Post>;
     readonly updatePost: better_call.StrictEndpoint<"/posts/:id", {} & {

package/dist/shared/{stack.BinHXe1r.d.cts → stack.vVFh38aS.d.cts}

@@ -1,9 +1,10 @@
 import * as _btst_stack_plugins_api from '@btst/stack/plugins/api';
-import { a as StorageAdapter, b as S3UploadToken } from './stack.DO6vOGQG.cjs';
-import { c as AssetListResult, l as listAssets, a as listFolders, A as AssetListParams } from './stack.CAni8dnD.cjs';
+import { S as StorageAdapter, b as S3UploadToken } from './stack.lkebw2nj.cjs';
+import { d as AssetListResult, l as listAssets, a as listFolders, A as AssetListParams } from './stack.jU2iG86n.cjs';
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { A as Asset, F as Folder } from './stack.CLcnSF_b.cjs';
+import { A as Asset, F as Folder } from './stack.BMlLOMED.cjs';
+import { DBAdapter } from '@btst/db';
 
 declare const AssetListQuerySchema: z.ZodObject<{
     folderId: z.ZodOptional<z.ZodString>;
@@ -21,6 +22,75 @@ declare const createFolderSchema: z.ZodObject<{
     parentId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 
+/**
+ * Input for creating a new asset record.
+ */
+interface CreateAssetInput {
+    filename: string;
+    originalName: string;
+    mimeType: string;
+    size: number;
+    url: string;
+    folderId?: string;
+    alt?: string;
+    tenantId?: string;
+}
+/**
+ * Input for updating an existing asset record.
+ */
+interface UpdateAssetInput {
+    alt?: string;
+    folderId?: string | null;
+}
+/**
+ * Input for creating a new folder.
+ */
+interface CreateFolderInput {
+    name: string;
+    parentId?: string;
+    tenantId?: string;
+}
+/**
+ * Create an asset record in the database.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks (e.g. `onBeforeUpload`) are called.
+ * The caller is responsible for any access-control checks before invoking this function.
+ */
+declare function createAsset(adapter: DBAdapter, input: CreateAssetInput): Promise<Asset>;
+/**
+ * Update an asset's `alt` text or `folderId`.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function updateAsset(adapter: DBAdapter, id: string, input: UpdateAssetInput): Promise<Asset | null>;
+/**
+ * Delete an asset record from the database by its ID.
+ * Does NOT delete the underlying file — the caller must do that via the storage adapter.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function deleteAsset(adapter: DBAdapter, id: string): Promise<void>;
+/**
+ * Create a folder record in the database.
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function createFolder(adapter: DBAdapter, input: CreateFolderInput): Promise<Folder>;
+/**
+ * Delete a folder record from the database by its ID.
+ * Child folders are cascade-deleted automatically. Throws if the folder or
+ * any of its descendants contain assets (which have associated storage files
+ * that must be deleted via the storage adapter first).
+ * Pure DB function — no authorization hooks, no HTTP context.
+ *
+ * @remarks **Security:** No authorization hooks are called.
+ */
+declare function deleteFolder(adapter: DBAdapter, id: string): Promise<void>;
+
 /**
  * Context passed to media API hooks.
  */
@@ -124,6 +194,23 @@ interface MediaBackendConfig {
      * Optional lifecycle hooks for the media backend plugin.
      */
     hooks?: MediaBackendHooks;
+    /**
+     * Optional function to resolve a tenant ID from the incoming request context.
+     *
+     * When provided, all asset and folder list/create operations through the HTTP
+     * API are automatically scoped to the returned tenant ID:
+     * - GET /media/assets  →  filters results to the resolved tenant
+     * - POST /media/assets →  tags the created asset with the resolved tenant
+     * - POST /media/upload →  tags the uploaded asset with the resolved tenant
+     * - GET /media/folders →  filters results to the resolved tenant
+     * - POST /media/folders → tags the created folder with the resolved tenant
+     *
+     * When absent, no tenant filtering is applied (existing behaviour).
+     *
+     * Returning `null` or `undefined` means "no tenant" for this request —
+     * the operation proceeds without tenant scoping (useful for super-admin routes).
+     */
+    resolveTenantId?: (context: MediaApiContext) => Promise<string | null | undefined> | string | null | undefined;
 }
 /**
  * Media backend plugin.
@@ -253,8 +340,12 @@ declare const mediaBackendPlugin: (config: MediaBackendConfig) => _btst_stack_pl
 }, {
     listAssets: (params?: Parameters<typeof listAssets>[1]) => Promise<AssetListResult>;
     getAssetById: (id: string) => Promise<Asset | null>;
+    createAsset: (input: Parameters<typeof createAsset>[1]) => Promise<Asset>;
+    updateAsset: (id: string, input: Parameters<typeof updateAsset>[2]) => Promise<Asset | null>;
     listFolders: (params?: Parameters<typeof listFolders>[1]) => Promise<Folder[]>;
     getFolderById: (id: string) => Promise<Folder | null>;
+    getFolderByName: (name: string, parentId?: string | null, tenantId?: string) => Promise<Folder | null>;
+    createFolder: (input: Parameters<typeof createFolder>[1]) => Promise<Folder>;
 }>;
 type MediaApiRouter = ReturnType<ReturnType<typeof mediaBackendPlugin>["routes"]>;
 
@@ -282,5 +373,5 @@ declare const MEDIA_QUERY_KEYS: {
     foldersList: (parentId?: string | null) => readonly ["media", "folders", "list", string];
 };
 
-export { MEDIA_QUERY_KEYS as a, assetListDiscriminator as b, mediaBackendPlugin as m };
-export type { AssetListDiscriminator as A, MediaApiRouter as M, MediaApiContext as c, MediaBackendHooks as d, MediaBackendConfig as e };
+export { MEDIA_QUERY_KEYS as M, createFolder as a, deleteFolder as b, createAsset as c, deleteAsset as d, assetListDiscriminator as f, mediaBackendPlugin as m, updateAsset as u };
+export type { AssetListDiscriminator as A, CreateAssetInput as C, UpdateAssetInput as U, CreateFolderInput as e, MediaApiContext as g, MediaBackendHooks as h, MediaBackendConfig as i, MediaApiRouter as j };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btst/stack",
-  "version": "2.10.0",
+  "version": "2.11.1",
   "description": "A composable, plugin-based library for building full-stack applications.",
   "repository": {
     "type": "git",
@@ -424,6 +424,16 @@
         "default": "./dist/plugins/media/api/index.cjs"
       }
     },
+    "./plugins/media/api/adapters/local": {
+      "import": {
+        "types": "./dist/plugins/media/api/adapters/local.d.ts",
+        "default": "./dist/plugins/media/api/adapters/local.mjs"
+      },
+      "require": {
+        "types": "./dist/plugins/media/api/adapters/local.d.cts",
+        "default": "./dist/plugins/media/api/adapters/local.cjs"
+      }
+    },
     "./plugins/media/api/adapters/s3": {
       "import": {
         "types": "./dist/plugins/media/api/adapters/s3.d.ts",
@@ -684,6 +694,9 @@
       "plugins/media/api": [
         "./dist/plugins/media/api/index.d.ts"
       ],
+      "plugins/media/api/adapters/local": [
+        "./dist/plugins/media/api/adapters/local.d.ts"
+      ],
       "plugins/media/api/adapters/s3": [
         "./dist/plugins/media/api/adapters/s3.d.ts"
       ],

package/src/plugins/media/__tests__/getters.test.ts

@@ -8,6 +8,7 @@ import {
 	getAssetById,
 	listFolders,
 	getFolderById,
+	getFolderByName,
 } from "../api/getters";
 
 const createTestAdapter = (): Adapter => {
@@ -162,6 +163,30 @@ describe("media getters", () => {
 			expect(photoResult.items[0]!.filename).toBe("holiday-photo.jpg");
 		});
 
+		it("filters assets by tenantId", async () => {
+			await adapter.create({
+				model: "mediaAsset",
+				data: makeAsset({
+					filename: "tenant-a.jpg",
+					url: "https://example.com/a.jpg",
+				}),
+			});
+			const assetB = await adapter.create<{ id: string }>({
+				model: "mediaAsset",
+				data: {
+					...makeAsset({
+						filename: "tenant-b.jpg",
+						url: "https://example.com/b.jpg",
+					}),
+					tenantId: "tenant-b",
+				},
+			});
+
+			const result = await listAssets(adapter, { tenantId: "tenant-b" });
+			expect(result.items).toHaveLength(1);
+			expect(result.items[0]!.id).toBe(assetB.id);
+		});
+
 		it("paginates results with limit and offset", async () => {
 			for (let i = 0; i < 5; i++) {
 				await adapter.create({
@@ -231,6 +256,24 @@ describe("media getters", () => {
 			expect(result[1]!.name).toBe("Zeta");
 		});
 
+		it("filters folders by tenantId", async () => {
+			await adapter.create({
+				model: "mediaFolder",
+				data: makeFolder({ name: "No Tenant" }),
+			});
+			const tenantFolder = await adapter.create<{ id: string }>({
+				model: "mediaFolder",
+				data: {
+					...makeFolder({ name: "Tenant Folder" }),
+					tenantId: "tenant-x",
+				},
+			});
+
+			const result = await listFolders(adapter, { tenantId: "tenant-x" });
+			expect(result).toHaveLength(1);
+			expect(result[0]!.id).toBe(tenantFolder.id);
+		});
+
 		it("filters folders by parentId", async () => {
 			const root = await adapter.create<{ id: string }>({
 				model: "mediaFolder",
@@ -271,4 +314,116 @@ describe("media getters", () => {
 			expect(result!.name).toBe("Test Folder");
 		});
 	});
+
+	// ── getFolderByName ───────────────────────────────────────────────────────
+
+	describe("getFolderByName", () => {
+		it("returns null when no folder exists", async () => {
+			const result = await getFolderByName(adapter, "nonexistent");
+			expect(result).toBeNull();
+		});
+
+		it("finds a root-level folder by name with no parentId constraint", async () => {
+			await adapter.create({
+				model: "mediaFolder",
+				data: makeFolder({ name: "blog-gen-profile-1" }),
+			});
+
+			const result = await getFolderByName(adapter, "blog-gen-profile-1");
+			expect(result).not.toBeNull();
+			expect(result!.name).toBe("blog-gen-profile-1");
+		});
+
+		it("returns null when name matches but parentId does not", async () => {
+			const parent = await adapter.create<{ id: string }>({
+				model: "mediaFolder",
+				data: makeFolder({ name: "Parent" }),
+			});
+			await adapter.create({
+				model: "mediaFolder",
+				data: makeFolder({ name: "Child", parentId: parent.id }),
+			});
+
+			// Search for "Child" scoped to a different (non-existent) parent.
+			const result = await getFolderByName(adapter, "Child", "wrong-parent-id");
+			expect(result).toBeNull();
+		});
+
+		it("scopes lookup to root-level folders when parentId is null", async () => {
+			// Explicitly store parentId as null (mirrors how SQL adapters persist root folders).
+			const rootFolder = await adapter.create<{ id: string }>({
+				model: "mediaFolder",
+				data: { ...makeFolder({ name: "Images" }), parentId: null },
+			});
+			// A nested folder with the same name.
+			await adapter.create({
+				model: "mediaFolder",
+				data: makeFolder({ name: "Images", parentId: rootFolder.id }),
+			});
+
+			// Only the root-level "Images" (parentId = null) should be returned.
+			const result = await getFolderByName(adapter, "Images", null);
+			expect(result).not.toBeNull();
+			expect(result!.id).toBe(rootFolder.id);
+		});
+
+		it("finds a child folder scoped to the correct parentId", async () => {
+			const parentA = await adapter.create<{ id: string }>({
+				model: "mediaFolder",
+				data: makeFolder({ name: "Parent A" }),
+			});
+			const parentB = await adapter.create<{ id: string }>({
+				model: "mediaFolder",
+				data: makeFolder({ name: "Parent B" }),
+			});
+			const childOfA = await adapter.create<{ id: string }>({
+				model: "mediaFolder",
+				data: makeFolder({ name: "Child", parentId: parentA.id }),
+			});
+			await adapter.create({
+				model: "mediaFolder",
+				data: makeFolder({ name: "Child", parentId: parentB.id }),
+			});
+
+			const result = await getFolderByName(adapter, "Child", parentA.id);
+			expect(result).not.toBeNull();
+			expect(result!.id).toBe(childOfA.id);
+		});
+
+		it("filters by tenantId when provided", async () => {
+			await adapter.create({
+				model: "mediaFolder",
+				data: { ...makeFolder({ name: "blog-gen-abc" }), tenantId: "tenant-1" },
+			});
+			const folderT2 = await adapter.create<{ id: string }>({
+				model: "mediaFolder",
+				data: { ...makeFolder({ name: "blog-gen-abc" }), tenantId: "tenant-2" },
+			});
+
+			// Same name, different tenant — should only return the matching one.
+			const result = await getFolderByName(
+				adapter,
+				"blog-gen-abc",
+				undefined,
+				"tenant-2",
+			);
+			expect(result).not.toBeNull();
+			expect(result!.id).toBe(folderT2.id);
+		});
+
+		it("returns null when tenantId does not match", async () => {
+			await adapter.create({
+				model: "mediaFolder",
+				data: { ...makeFolder({ name: "blog-gen-xyz" }), tenantId: "tenant-1" },
+			});
+
+			const result = await getFolderByName(
+				adapter,
+				"blog-gen-xyz",
+				undefined,
+				"tenant-999",
+			);
+			expect(result).toBeNull();
+		});
+	});
 });

package/src/plugins/media/__tests__/mutations.test.ts

@@ -59,6 +59,21 @@ describe("media mutations", () => {
 			expect(asset.alt).toBe("A beautiful photo");
 		});
 
+		it("persists tenantId when provided", async () => {
+			const asset = await createAsset(adapter, {
+				...assetInput,
+				tenantId: "profile-abc",
+			});
+
+			expect(asset.tenantId).toBe("profile-abc");
+		});
+
+		it("leaves tenantId absent when not provided", async () => {
+			const asset = await createAsset(adapter, assetInput);
+
+			expect(asset.tenantId == null).toBe(true);
+		});
+
 		it("creates multiple independent assets", async () => {
 			await createAsset(adapter, {
 				...assetInput,
@@ -194,6 +209,21 @@ describe("media mutations", () => {
 			expect(folder.createdAt).toBeInstanceOf(Date);
 		});
 
+		it("persists tenantId when provided", async () => {
+			const folder = await createFolder(adapter, {
+				name: "Tenant Folder",
+				tenantId: "profile-xyz",
+			});
+
+			expect(folder.tenantId).toBe("profile-xyz");
+		});
+
+		it("leaves tenantId absent when not provided", async () => {
+			const folder = await createFolder(adapter, { name: "No Tenant" });
+
+			expect(folder.tenantId == null).toBe(true);
+		});
+
 		it("creates a nested folder with parentId", async () => {
 			const parent = await createFolder(adapter, { name: "Root" });
 			const child = await createFolder(adapter, {

package/src/plugins/media/__tests__/storage-adapters.test.ts

@@ -145,6 +145,17 @@ describe("localAdapter", () => {
 		const adapter = localAdapter();
 		expect(adapter.type).toBe("local");
 	});
+
+	it("throws when a URL contains a path traversal sequence", async () => {
+		const uploadDir = await makeTmpDir();
+		const adapter = localAdapter({ uploadDir, publicPath: "/uploads" });
+
+		// Simulate a tampered URL that would resolve outside uploadDir after decoding.
+		const maliciousUrl = "/uploads/..%2F..%2Fetc%2Fpasswd";
+		await expect(adapter.delete(maliciousUrl)).rejects.toThrow(
+			"Refusing to delete file outside upload directory",
+		);
+	});
 });
 
 // ── S3 adapter ────────────────────────────────────────────────────────────────

package/src/plugins/media/api/adapters/local.ts

@@ -1,6 +1,6 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import * as crypto from "node:crypto";
+import * as fs from "fs/promises";
+import * as path from "path";
+import * as crypto from "crypto";
 import type { DirectStorageAdapter, UploadOptions } from "../storage-adapter";
 
 export interface LocalStorageAdapterOptions {
@@ -66,7 +66,16 @@ export function localAdapter(
 			if (!encodedFilename) return;
 			const filename = decodeURIComponent(encodedFilename);
 
-			const filePath = path.join(uploadDir, filename);
+			const resolvedUploadDir = path.resolve(uploadDir);
+			const filePath = path.join(resolvedUploadDir, filename);
+
+			// Guard against path traversal: reject any path that escapes uploadDir.
+			if (!filePath.startsWith(resolvedUploadDir + path.sep)) {
+				throw new Error(
+					`Refusing to delete file outside upload directory: ${filePath}`,
+				);
+			}
+
 			try {
 				await fs.unlink(filePath);
 			} catch (err: unknown) {

package/src/plugins/media/api/getters.ts

@@ -10,6 +10,7 @@ export interface AssetListParams {
 	query?: string;
 	offset?: number;
 	limit?: number;
+	tenantId?: string;
 }
 
 /**
@@ -27,6 +28,7 @@ export interface AssetListResult {
  */
 export interface FolderListParams {
 	parentId?: string | null;
+	tenantId?: string;
 }
 
 /**
@@ -64,6 +66,14 @@ export async function listAssets(
 		});
 	}
 
+	if (query.tenantId !== undefined) {
+		whereConditions.push({
+			field: "tenantId",
+			value: query.tenantId,
+			operator: "eq" as const,
+		});
+	}
+
 	const needsInMemoryFilter = !!query.query;
 	const dbWhere = whereConditions.length > 0 ? whereConditions : undefined;
 
@@ -136,22 +146,31 @@ export async function listFolders(
 	adapter: Adapter,
 	params?: FolderListParams,
 ): Promise<Folder[]> {
-	// Only add a where clause when parentId is explicitly provided as a string.
-	// Passing undefined (or no params) returns all folders unfiltered.
-	const where =
-		params?.parentId !== undefined
-			? [
-					{
-						field: "parentId",
-						value: params.parentId,
-						operator: "eq" as const,
-					},
-				]
-			: undefined;
+	const whereConditions: Array<{
+		field: string;
+		value: string | null;
+		operator: "eq";
+	}> = [];
+
+	if (params?.parentId !== undefined) {
+		whereConditions.push({
+			field: "parentId",
+			value: params.parentId,
+			operator: "eq" as const,
+		});
+	}
+
+	if (params?.tenantId !== undefined) {
+		whereConditions.push({
+			field: "tenantId",
+			value: params.tenantId,
+			operator: "eq" as const,
+		});
+	}
 
 	return adapter.findMany<Folder>({
 		model: "mediaFolder",
-		where,
+		where: whereConditions.length > 0 ? whereConditions : undefined,
 		sortBy: { field: "name", direction: "asc" },
 	});
 }
@@ -172,3 +191,35 @@ export async function getFolderById(
 		where: [{ field: "id", value: id, operator: "eq" as const }],
 	});
 }
+
+/**
+ * Find a single folder by name, optionally scoped to a specific parent and/or tenant.
+ * Pass `null` for `parentId` to search only root-level folders.
+ * Pass `undefined` for `parentId` to search regardless of parent.
+ * Returns `null` if no matching folder is found.
+ *
+ * Pure DB function — no hooks, no HTTP context.
+ * The caller is responsible for any access-control checks.
+ */
+export async function getFolderByName(
+	adapter: Adapter,
+	name: string,
+	parentId?: string | null,
+	tenantId?: string,
+): Promise<Folder | null> {
+	const where: Array<{
+		field: string;
+		value: string | null;
+		operator: "eq";
+	}> = [{ field: "name", value: name, operator: "eq" as const }];
+
+	if (parentId !== undefined) {
+		where.push({ field: "parentId", value: parentId, operator: "eq" as const });
+	}
+
+	if (tenantId !== undefined) {
+		where.push({ field: "tenantId", value: tenantId, operator: "eq" as const });
+	}
+
+	return adapter.findOne<Folder>({ model: "mediaFolder", where });
+}

package/src/plugins/media/api/index.ts

@@ -5,6 +5,7 @@ export {
 	getAssetById,
 	listFolders,
 	getFolderById,
+	getFolderByName,
 	type AssetListParams,
 	type AssetListResult,
 	type FolderListParams,
@@ -25,11 +26,6 @@ export { serializeAsset, serializeFolder } from "./serializers";
 
 export { MEDIA_QUERY_KEYS, assetListDiscriminator } from "./query-key-defs";
 
-export {
-	localAdapter,
-	type LocalStorageAdapterOptions,
-} from "./adapters/local";
-
 export type {
 	StorageAdapter,
 	DirectStorageAdapter,

package/src/plugins/media/api/mutations.ts

@@ -12,6 +12,7 @@ export interface CreateAssetInput {
 	url: string;
 	folderId?: string;
 	alt?: string;
+	tenantId?: string;
 }
 
 /**
@@ -28,6 +29,7 @@ export interface UpdateAssetInput {
 export interface CreateFolderInput {
 	name: string;
 	parentId?: string;
+	tenantId?: string;
 }
 
 /**
@@ -51,6 +53,7 @@ export async function createAsset(
 			url: input.url,
 			folderId: input.folderId,
 			alt: input.alt,
+			tenantId: input.tenantId,
 			createdAt: new Date(),
 		},
 	});
@@ -114,6 +117,7 @@ export async function createFolder(
 		data: {
 			name: input.name,
 			parentId: input.parentId,
+			tenantId: input.tenantId,
 			createdAt: new Date(),
 		},
 	});