@cedarjs/uploads 7.0.0-canary.3114

package/dist/fastify/plugin.js

@@ -0,0 +1,241 @@
+import fastifyMultipart from "@fastify/multipart";
+import { deleteFile } from "../deleteFile.js";
+import { UploadError } from "../errors.js";
+import { generateStorageKey, trimTrailingSlashes } from "../keys.js";
+import {
+  assertOwnership,
+  assertTokenAllowsFile,
+  createPendingUpload
+} from "../pending.js";
+import { serializeUpload } from "../serialize.js";
+import {
+  SERVE_ROUTE_PATH,
+  SERVE_TOKEN_PARAM,
+  verifyServeToken
+} from "../serveToken.js";
+import { resolveTarget } from "../targets.js";
+import { UPLOAD_TOKEN_HEADER, verifyUploadToken } from "../uploadToken.js";
+import { handleS3Webhook } from "../webhooks/s3.js";
+const FIVE_HUNDRED_MB = 500 * 1024 * 1024;
+const MULTIPART_ENVELOPE_ALLOWANCE = 64 * 1024;
+const ACTIVE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "image/svg+xml",
+  "text/xml",
+  "application/xml",
+  "text/javascript",
+  "application/javascript",
+  "application/ecmascript",
+  "text/ecmascript",
+  "application/pdf"
+]);
+function sendError(reply, e) {
+  if (e instanceof UploadError) {
+    return reply.code(e.statusCode).send({ error: { code: e.code, message: e.message } });
+  }
+  throw e;
+}
+function headerValue(req, name) {
+  const value = req.headers[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+function isActiveContent(mimeType) {
+  return ACTIVE_CONTENT_TYPES.has(mimeType.split(";")[0].trim().toLowerCase());
+}
+function contentDispositionHeader(disposition, filename) {
+  const ascii = filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+  const encoded = encodeURIComponent(filename);
+  return `${disposition}; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}
+async function cedarUploadsPlugin(fastify, options) {
+  const {
+    tokenSecret,
+    targets,
+    db,
+    prefix = "/upload",
+    bodyLimit = FIVE_HUNDRED_MB,
+    authenticate,
+    s3Webhook,
+    serveCacheControl = "private, max-age=3600"
+  } = options;
+  if (!tokenSecret) {
+    throw new UploadError(
+      "CONFIGURATION",
+      "cedarUploadsPlugin needs a `tokenSecret`. Set UPLOAD_TOKEN_SECRET in .env (generate one with `yarn cedar generate secret`)."
+    );
+  }
+  const base = trimTrailingSlashes(prefix);
+  await fastify.register(fastifyMultipart, {
+    throwFileSizeLimit: true,
+    limits: { fileSize: bodyLimit }
+  });
+  const verifyRequestToken = async (req) => {
+    const payload = verifyUploadToken(headerValue(req, UPLOAD_TOKEN_HEADER), {
+      secret: tokenSecret
+    });
+    if (authenticate) {
+      const user = await authenticate(req);
+      assertOwnership(
+        {
+          userId: payload.sub,
+          organizationId: payload.organizationId ?? null
+        },
+        user,
+        "this upload token"
+      );
+    }
+    return payload;
+  };
+  fastify.post(`${base}/fs`, { bodyLimit }, async (req, reply) => {
+    const stored = [];
+    try {
+      const payload = await verifyRequestToken(req);
+      const target = resolveTarget(targets, payload.target);
+      if (target.providerType === "db") {
+        throw new UploadError(
+          "NOT_SUPPORTED",
+          `Upload profile '${payload.profile}' stores files inline in the database. Send them as base64 through GraphQL instead.`
+        );
+      }
+      const requestBound = payload.maxFiles * payload.maxFileSize + MULTIPART_ENVELOPE_ALLOWANCE;
+      const contentLength = Number(headerValue(req, "content-length"));
+      if (Number.isFinite(contentLength) && contentLength > requestBound) {
+        throw new UploadError(
+          "FILE_TOO_LARGE",
+          `Request body of ${contentLength} bytes exceeds what upload profile '${payload.profile}' allows.`
+        );
+      }
+      if (!req.isMultipart()) {
+        throw new UploadError(
+          "NOT_SUPPORTED",
+          "Upload requests must be multipart/form-data."
+        );
+      }
+      for await (const part of req.parts({
+        limits: { fileSize: payload.maxFileSize, files: payload.maxFiles }
+      })) {
+        if (part.type !== "file") {
+          continue;
+        }
+        assertTokenAllowsFile(payload, { contentType: part.mimetype, size: 0n });
+        let data;
+        try {
+          data = await part.toBuffer();
+        } catch (e) {
+          if (typeof e === "object" && e !== null && "code" in e && e.code === "FST_REQ_FILE_TOO_LARGE") {
+            throw new UploadError(
+              "FILE_TOO_LARGE",
+              `File '${part.filename}' exceeds the ${payload.maxFileSize} byte limit for upload profile '${payload.profile}'.`
+            );
+          }
+          throw e;
+        }
+        const size = BigInt(data.byteLength);
+        assertTokenAllowsFile(payload, { contentType: part.mimetype, size });
+        const storageKey = generateStorageKey(part.mimetype);
+        const upload = await createPendingUpload({
+          db,
+          payload,
+          filename: part.filename,
+          mimeType: part.mimetype,
+          size,
+          storageKey
+        });
+        stored.push({ target: payload.target, upload });
+        await target.write(storageKey, data, { contentType: part.mimetype });
+        const { count } = await db.upload.updateMany({
+          where: { id: upload.id, status: "pending" },
+          data: { status: "completed" }
+        });
+        if (count !== 1) {
+          throw new UploadError(
+            "NOT_PENDING",
+            `Upload ${upload.id} was settled before its bytes were written.`
+          );
+        }
+      }
+      if (stored.length === 0) {
+        throw new UploadError("NOT_SUPPORTED", "No file was included.");
+      }
+      return reply.code(201).send({
+        uploads: stored.map(
+          ({ upload }) => serializeUpload({ ...upload, status: "completed" })
+        )
+      });
+    } catch (e) {
+      for (const { target, upload } of stored) {
+        await deleteFile(resolveTarget(targets, target), {
+          db,
+          upload
+        }).catch(() => void 0);
+      }
+      return sendError(reply, e);
+    }
+  });
+  fastify.get(
+    `${base}${SERVE_ROUTE_PATH}`,
+    async (req, reply) => {
+      try {
+        const {
+          target: targetName,
+          key,
+          disposition: requested
+        } = verifyServeToken(req.query[SERVE_TOKEN_PARAM], {
+          secret: tokenSecret
+        });
+        const target = resolveTarget(targets, targetName);
+        const upload = await db.upload.findFirst({
+          where: { target: targetName, storageKey: key, status: "completed" },
+          omit: { data: true }
+        });
+        if (!upload) {
+          throw new UploadError("NOT_FOUND", "File not found.");
+        }
+        const etag = `"${upload.id}-${upload.updatedAt.getTime()}"`;
+        if (headerValue(req, "if-none-match") === etag) {
+          return reply.code(304).send();
+        }
+        let body;
+        try {
+          body = target.readStream ? await target.readStream(key) : await target.read(key);
+        } catch (e) {
+          throw new UploadError("NOT_FOUND", "File not found.", e);
+        }
+        const disposition = isActiveContent(upload.mimeType) ? "attachment" : requested;
+        return reply.code(200).header("Content-Type", upload.mimeType).header("Content-Length", upload.size.toString()).header(
+          "Content-Disposition",
+          contentDispositionHeader(disposition, upload.filename)
+        ).header("X-Content-Type-Options", "nosniff").header("Cache-Control", serveCacheControl).header("ETag", etag).send(body);
+      } catch (e) {
+        return sendError(reply, e);
+      }
+    }
+  );
+  if (s3Webhook) {
+    fastify.addContentTypeParser(
+      ["text/plain", "application/json"],
+      { parseAs: "string" },
+      (_req, body, done) => done(null, body)
+    );
+    fastify.post(`${base}/webhook/s3`, async (req, reply) => {
+      try {
+        const body = typeof req.body === "string" ? req.body : JSON.stringify(req.body);
+        const result = await handleS3Webhook(body, {
+          db,
+          targets,
+          topicArn: s3Webhook.topicArn,
+          fetchCertificate: s3Webhook.fetchCertificate,
+          fetch: s3Webhook.fetch
+        });
+        return reply.code(200).send(result);
+      } catch (e) {
+        return sendError(reply, e);
+      }
+    });
+  }
+  fastify.get(`${base}/health`, async () => ({ ok: true }));
+}
+export {
+  cedarUploadsPlugin
+};

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+export * from './types.js';
+export { UploadError } from './errors.js';
+export type { UploadErrorCode } from './errors.js';
+export { defineStorageTargets, resolveTarget } from './targets.js';
+export { DB_MAX_FILE_SIZE, DEFAULT_UPLOAD_TOKEN_EXPIRES_IN, defineUploadProfiles, isMimeTypeAllowed, resolveProfile, } from './profiles.js';
+export type { ResolvedUploadProfile, UploadProfile, UploadProfiles, } from './profiles.js';
+export { createFsProvider } from './providers/fs.js';
+export type { FsProviderOptions } from './providers/fs.js';
+export { createDbProvider } from './providers/db.js';
+export { generateStorageKey } from './keys.js';
+export { storeFile } from './storeFile.js';
+export type { StoreFileOptions } from './storeFile.js';
+export { deleteFile } from './deleteFile.js';
+export type { DeleteFileOptions } from './deleteFile.js';
+export { cleanupStaleUploads } from './cleanupStaleUploads.js';
+export type { CleanupStaleUploadsOptions, CleanupStaleUploadsResult, } from './cleanupStaleUploads.js';
+export { createUploadToken, UPLOAD_TOKEN_HEADER, UPLOAD_TOKEN_PURPOSE, verifyUploadToken, } from './uploadToken.js';
+export type { CreateUploadTokenOptions, UploadTokenPayload, } from './uploadToken.js';
+export { createServeToken, SERVE_TOKEN_PURPOSE, verifyServeToken, } from './serveToken.js';
+export type { ServeTokenPayload } from './serveToken.js';
+export { serializeUpload, toDataUri } from './serialize.js';
+export { confirmUpload, createPresignedUpload, issueUploadToken, } from './services.js';
+export type { ConfirmUploadOptions, CreatePresignedUploadInput, CreatePresignedUploadOptions, IssueUploadTokenOptions, PresignedUploadResponse, UploadActor, UploadTokenResponse, } from './services.js';
+export { createRequireUploadTokenDirective, createWithDataUriDirective, createWithSignedUrlDirective, getUploadTokenPayload, requireUploadTokenSchema, UPLOAD_TOKEN_CONTEXT_KEY, withDataUriSchema, withSignedUrlSchema, } from './directives.js';
+export type { RequireUploadTokenDirectiveOptions, UploadUrlDirectiveOptions, WithSignedUrlDirectiveOptions, } from './directives.js';
+export { createUploadAuthenticator } from './authenticator.js';
+export type { CreateUploadAuthenticatorOptions, UploadAuthenticator, UploadRequestUser, } from './authenticator.js';
+export { cedarUploadsPlugin } from './fastify/plugin.js';
+export type { UploadPluginOptions } from './fastify/plugin.js';
+export { handleS3Webhook, processS3EventRecord } from './webhooks/s3.js';
+export type { S3Event, S3EventOutcome, S3EventRecord, S3WebhookOptions, S3WebhookResult, } from './webhooks/s3.js';
+export { verifySnsMessage } from './webhooks/sns.js';
+export type { SnsMessage } from './webhooks/sns.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAClE,OAAO,EACL,gBAAgB,EAChB,+BAA+B,EAC/B,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,WAAW,EACX,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,YAAY,EACV,gCAAgC,EAChC,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACxE,YAAY,EACV,OAAO,EACP,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,eAAe,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -0,0 +1,88 @@
+export * from "./types.js";
+import { UploadError } from "./errors.js";
+import { defineStorageTargets, resolveTarget } from "./targets.js";
+import {
+  DB_MAX_FILE_SIZE,
+  DEFAULT_UPLOAD_TOKEN_EXPIRES_IN,
+  defineUploadProfiles,
+  isMimeTypeAllowed,
+  resolveProfile
+} from "./profiles.js";
+import { createFsProvider } from "./providers/fs.js";
+import { createDbProvider } from "./providers/db.js";
+import { generateStorageKey } from "./keys.js";
+import { storeFile } from "./storeFile.js";
+import { deleteFile } from "./deleteFile.js";
+import { cleanupStaleUploads } from "./cleanupStaleUploads.js";
+import {
+  createUploadToken,
+  UPLOAD_TOKEN_HEADER,
+  UPLOAD_TOKEN_PURPOSE,
+  verifyUploadToken
+} from "./uploadToken.js";
+import {
+  createServeToken,
+  SERVE_TOKEN_PURPOSE,
+  verifyServeToken
+} from "./serveToken.js";
+import { serializeUpload, toDataUri } from "./serialize.js";
+import {
+  confirmUpload,
+  createPresignedUpload,
+  issueUploadToken
+} from "./services.js";
+import {
+  createRequireUploadTokenDirective,
+  createWithDataUriDirective,
+  createWithSignedUrlDirective,
+  getUploadTokenPayload,
+  requireUploadTokenSchema,
+  UPLOAD_TOKEN_CONTEXT_KEY,
+  withDataUriSchema,
+  withSignedUrlSchema
+} from "./directives.js";
+import { createUploadAuthenticator } from "./authenticator.js";
+import { cedarUploadsPlugin } from "./fastify/plugin.js";
+import { handleS3Webhook, processS3EventRecord } from "./webhooks/s3.js";
+import { verifySnsMessage } from "./webhooks/sns.js";
+export {
+  DB_MAX_FILE_SIZE,
+  DEFAULT_UPLOAD_TOKEN_EXPIRES_IN,
+  SERVE_TOKEN_PURPOSE,
+  UPLOAD_TOKEN_CONTEXT_KEY,
+  UPLOAD_TOKEN_HEADER,
+  UPLOAD_TOKEN_PURPOSE,
+  UploadError,
+  cedarUploadsPlugin,
+  cleanupStaleUploads,
+  confirmUpload,
+  createDbProvider,
+  createFsProvider,
+  createPresignedUpload,
+  createRequireUploadTokenDirective,
+  createServeToken,
+  createUploadAuthenticator,
+  createUploadToken,
+  createWithDataUriDirective,
+  createWithSignedUrlDirective,
+  defineStorageTargets,
+  defineUploadProfiles,
+  deleteFile,
+  generateStorageKey,
+  getUploadTokenPayload,
+  handleS3Webhook,
+  isMimeTypeAllowed,
+  issueUploadToken,
+  processS3EventRecord,
+  requireUploadTokenSchema,
+  resolveProfile,
+  resolveTarget,
+  serializeUpload,
+  storeFile,
+  toDataUri,
+  verifyServeToken,
+  verifySnsMessage,
+  verifyUploadToken,
+  withDataUriSchema,
+  withSignedUrlSchema
+};

package/dist/keys.d.ts

@@ -0,0 +1,18 @@
+/**
+ * A fresh storage key: a random id plus the extension that matches
+ * `mimeType`, when one is known. Keys never derive from the client's
+ * filename.
+ */
+export declare function generateStorageKey(mimeType: string): string;
+/**
+ * Rejects keys that could escape a provider's root: path separators, `..`,
+ * leading dots, and anything outside a conservative character set. Providers
+ * that map keys onto a filesystem call this before touching disk.
+ */
+export declare function assertSafeKey(key: string): void;
+/**
+ * Removes trailing slashes without a regex, which keeps the trim linear on
+ * any input.
+ */
+export declare function trimTrailingSlashes(value: string): string;
+//# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI3D;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,QAIxC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQzD"}

package/dist/keys.js

@@ -0,0 +1,25 @@
+import { randomUUID } from "node:crypto";
+import mime from "mime-types";
+import { UploadError } from "./errors.js";
+function generateStorageKey(mimeType) {
+  const ext = mime.extension(mimeType.split(";")[0].trim());
+  return ext ? `${randomUUID()}.${ext}` : randomUUID();
+}
+const SAFE_KEY = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function assertSafeKey(key) {
+  if (!SAFE_KEY.test(key) || key.includes("..")) {
+    throw new UploadError("INVALID_KEY", `Invalid storage key '${key}'.`);
+  }
+}
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+export {
+  assertSafeKey,
+  generateStorageKey,
+  trimTrailingSlashes
+};

package/dist/pending.d.ts

@@ -0,0 +1,39 @@
+import type { UploadDatabase, UploadRecord } from './types.js';
+import type { UploadTokenPayload } from './uploadToken.js';
+/**
+ * Checks one file against the constraints signed into an upload token.
+ * Throws `MIME_TYPE_NOT_ALLOWED` or `FILE_TOO_LARGE`.
+ */
+export declare function assertTokenAllowsFile(payload: UploadTokenPayload, file: {
+    contentType: string;
+    size: bigint;
+}): void;
+export interface CreatePendingUploadOptions {
+    db: UploadDatabase;
+    payload: UploadTokenPayload;
+    filename: string;
+    mimeType: string;
+    size: bigint;
+    storageKey: string;
+}
+/**
+ * Creates a `pending` row for a token, enforcing the token's `maxFiles`
+ * across every request that uses it. The count and the insert run in one
+ * serializable transaction keyed on `tokenId`, so concurrent requests sharing
+ * a token cannot exceed the limit. A transaction the database rejects for
+ * conflicting with a concurrent one is retried a bounded number of times.
+ */
+export declare function createPendingUpload({ db, payload, filename, mimeType, size, storageKey, }: CreatePendingUploadOptions): Promise<UploadRecord>;
+/**
+ * Enforces that the user (and, in multi-tenant apps, the organization) a
+ * token or row belongs to is the one acting on it. `null` identity on the
+ * row means "unowned" and passes.
+ */
+export declare function assertOwnership(owner: {
+    userId: string | null;
+    organizationId: string | null;
+}, actor: {
+    id: string | number;
+    organizationId?: string | null;
+} | null | undefined, what: string): void;
+//# sourceMappingURL=pending.d.ts.map

package/dist/pending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.d.ts","sourceRoot":"","sources":["../src/pending.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,QAqB5C;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,kBAAkB,CAAA;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB;AAiBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,EAAE,EACF,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,UAAU,GACX,EAAE,0BAA0B,GAAG,OAAO,CAAC,YAAY,CAAC,CA+CpD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC/D,KAAK,EACH;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC5E,IAAI,EAAE,MAAM,QAmBb"}

package/dist/pending.js

@@ -0,0 +1,94 @@
+import { UploadError } from "./errors.js";
+import { isMimeTypeAllowed } from "./profiles.js";
+function assertTokenAllowsFile(payload, file) {
+  if (!isMimeTypeAllowed(payload.allowedMimeTypes, file.contentType)) {
+    throw new UploadError(
+      "MIME_TYPE_NOT_ALLOWED",
+      `File type '${file.contentType}' is not allowed for upload profile '${payload.profile}'.`
+    );
+  }
+  if (file.size < 0n) {
+    throw new UploadError("FILE_TOO_LARGE", "File size must not be negative.");
+  }
+  if (file.size > BigInt(payload.maxFileSize)) {
+    throw new UploadError(
+      "FILE_TOO_LARGE",
+      `File is ${file.size} bytes, which exceeds the ${payload.maxFileSize} byte limit for upload profile '${payload.profile}'.`
+    );
+  }
+}
+const SERIALIZATION_CONFLICT = "P2034";
+const MAX_ATTEMPTS = 3;
+function isSerializationConflict(e) {
+  return typeof e === "object" && e !== null && "code" in e && e.code === SERIALIZATION_CONFLICT;
+}
+async function createPendingUpload({
+  db,
+  payload,
+  filename,
+  mimeType,
+  size,
+  storageKey
+}) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      return await db.$transaction(
+        async (tx) => {
+          const existing = await tx.upload.count({
+            where: { tokenId: payload.jti }
+          });
+          if (existing >= payload.maxFiles) {
+            throw new UploadError(
+              "TOO_MANY_FILES",
+              `This upload token has already been used for ${existing} of its ${payload.maxFiles} allowed files.`
+            );
+          }
+          return tx.upload.create({
+            data: {
+              target: payload.target,
+              status: "pending",
+              filename,
+              mimeType,
+              size,
+              storageKey,
+              userId: payload.sub,
+              tokenId: payload.jti,
+              organizationId: payload.organizationId ?? null
+            }
+          });
+        },
+        { isolationLevel: "Serializable" }
+      );
+    } catch (e) {
+      if (!isSerializationConflict(e)) {
+        throw e;
+      }
+      if (attempt >= MAX_ATTEMPTS) {
+        throw new UploadError(
+          "TOO_MANY_FILES",
+          "Too many concurrent uploads for this token. Try again.",
+          e
+        );
+      }
+    }
+  }
+}
+function assertOwnership(owner, actor, what) {
+  if (!actor) {
+    throw new UploadError(
+      "UNAUTHENTICATED",
+      `You must be logged in to ${what}.`
+    );
+  }
+  if (owner.userId && owner.userId !== String(actor.id)) {
+    throw new UploadError("FORBIDDEN", `You don't have access to ${what}.`);
+  }
+  if (owner.organizationId && owner.organizationId !== (actor.organizationId ?? null)) {
+    throw new UploadError("FORBIDDEN", `You don't have access to ${what}.`);
+  }
+}
+export {
+  assertOwnership,
+  assertTokenAllowsFile,
+  createPendingUpload
+};

package/dist/profiles.d.ts

@@ -0,0 +1,49 @@
+import type { SignedTokenExpiresIn } from '@cedarjs/api';
+/**
+ * Default size cap for files stored inline in the database. The DB path
+ * buffers base64 through GraphQL, so it is only for small files.
+ */
+export declare const DB_MAX_FILE_SIZE: number;
+/** Default lifetime of an upload token. */
+export declare const DEFAULT_UPLOAD_TOKEN_EXPIRES_IN: SignedTokenExpiresIn;
+/**
+ * Server-defined constraints for one kind of upload. The client names a
+ * profile; the server owns what that profile allows.
+ */
+export interface UploadProfile {
+    /** Name of the storage target files uploaded under this profile land on. */
+    target: string;
+    /**
+     * MIME types the profile accepts. Exact types (`image/png`) and wildcard
+     * subtypes (`image/*`) are supported.
+     */
+    allowedMimeTypes: string[];
+    /** Largest file the profile accepts, in bytes. */
+    maxFileSize: number;
+    /** Most files one token may create, across every request that uses it. */
+    maxFiles: number;
+    /** Lifetime of tokens issued for this profile. Defaults to five minutes. */
+    expiresIn?: SignedTokenExpiresIn;
+}
+export type UploadProfiles = Record<string, UploadProfile>;
+export interface ResolvedUploadProfile extends UploadProfile {
+    name: string;
+}
+/**
+ * Validates and returns the app's upload profiles. Returns the same object,
+ * typed, so `profiles.avatar` works for direct access.
+ */
+export declare function defineUploadProfiles<T extends UploadProfiles>(profiles: T): T;
+/**
+ * Looks a profile up by name, throwing an `UploadError` with code
+ * `UNKNOWN_PROFILE` when it is missing. Unknown names are a client error, so
+ * the message does not list the configured profiles.
+ */
+export declare function resolveProfile(profiles: UploadProfiles, name: string): ResolvedUploadProfile;
+/**
+ * Whether `mimeType` matches one of `allowed`. Matching is case-insensitive
+ * and ignores parameters such as `; charset=utf-8`. An entry of `image/*`
+ * matches every `image/` subtype.
+ */
+export declare function isMimeTypeAllowed(allowed: string[], mimeType: string): boolean;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAIxD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAE3C,2CAA2C;AAC3C,eAAO,MAAM,+BAA+B,EAAE,oBAA2B,CAAA;AAEzE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,oBAAoB,CAAA;CACjC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE1D,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,EAAE,MAAM,CAAA;CACb;AAiCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,cAAc,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAM7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,GACX,qBAAqB,CAavB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,WAoBpE"}

package/dist/profiles.js

@@ -0,0 +1,68 @@
+import { UploadError } from "./errors.js";
+const DB_MAX_FILE_SIZE = 1024 * 1024;
+const DEFAULT_UPLOAD_TOKEN_EXPIRES_IN = "5m";
+function validateProfile(name, profile) {
+  if (!profile.target) {
+    throw new UploadError(
+      "CONFIGURATION",
+      `Upload profile '${name}' needs a \`target\`.`
+    );
+  }
+  if (!profile.allowedMimeTypes?.length) {
+    throw new UploadError(
+      "CONFIGURATION",
+      `Upload profile '${name}' needs at least one entry in \`allowedMimeTypes\`.`
+    );
+  }
+  if (!(profile.maxFileSize > 0)) {
+    throw new UploadError(
+      "CONFIGURATION",
+      `Upload profile '${name}' needs a positive \`maxFileSize\`.`
+    );
+  }
+  if (!Number.isInteger(profile.maxFiles) || profile.maxFiles < 1) {
+    throw new UploadError(
+      "CONFIGURATION",
+      `Upload profile '${name}' needs \`maxFiles\` of at least 1.`
+    );
+  }
+}
+function defineUploadProfiles(profiles) {
+  for (const [name, profile] of Object.entries(profiles)) {
+    validateProfile(name, profile);
+  }
+  return profiles;
+}
+function resolveProfile(profiles, name) {
+  const profile = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
+  if (!profile) {
+    throw new UploadError(
+      "UNKNOWN_PROFILE",
+      `Unknown upload profile '${name}'.`
+    );
+  }
+  return { ...profile, name };
+}
+function isMimeTypeAllowed(allowed, mimeType) {
+  const normalized = mimeType.split(";")[0].trim().toLowerCase();
+  if (!normalized) {
+    return false;
+  }
+  return allowed.some((entry) => {
+    const pattern = entry.trim().toLowerCase();
+    if (pattern === "*/*") {
+      return true;
+    }
+    if (pattern.endsWith("/*")) {
+      return normalized.startsWith(pattern.slice(0, -1));
+    }
+    return pattern === normalized;
+  });
+}
+export {
+  DB_MAX_FILE_SIZE,
+  DEFAULT_UPLOAD_TOKEN_EXPIRES_IN,
+  defineUploadProfiles,
+  isMimeTypeAllowed,
+  resolveProfile
+};