@cedarjs/uploads 7.0.1-next.314 → 7.0.1-next.466

package/dist/web/hooks/useFsUpload.js

@@ -12,7 +12,8 @@ function useFsUpload({
   onUploadComplete,
   onUploadError
 }) {
-  const { requestToken, getToken, constraints } = useUploadToken({ profile });
+  const { requestToken, acquireToken, hasUsableToken, constraints } = useUploadToken({ profile });
+  const fileTokens = useRef(/* @__PURE__ */ new Map());
   const endpointRef = useRef(endpoint ?? defaultEndpoint());
   useEffect(() => {
     endpointRef.current = endpoint ?? defaultEndpoint();
@@ -22,7 +23,7 @@ function useFsUpload({
       provider: "fs",
       constraints,
       endpoint: () => endpointRef.current,
-      getUploadToken: getToken
+      getUploadToken: (file) => fileTokens.current.get(file.id) ?? null
     }),
     constraints,
     { onUploadComplete, onUploadError }
@@ -33,24 +34,35 @@ function useFsUpload({
       return;
     }
     const onFileAdded = () => {
-      if (!getToken()) {
+      if (!hasUsableToken()) {
         requestToken().catch((e) => {
           onUploadError?.(e instanceof Error ? e : new Error(String(e)));
         });
       }
     };
-    const ensureToken = async () => {
-      if (!getToken()) {
-        await requestToken();
+    const assignTokens = async (fileIDs) => {
+      if (fileIDs.length === 0) {
+        return;
+      }
+      const token = await acquireToken(fileIDs.length);
+      for (const fileID of fileIDs) {
+        fileTokens.current.set(fileID, token);
+      }
+    };
+    const onFileRemoved = (file) => {
+      if (file) {
+        fileTokens.current.delete(file.id);
       }
     };
     uppy.on("file-added", onFileAdded);
-    uppy.addPreProcessor(ensureToken);
+    uppy.on("file-removed", onFileRemoved);
+    uppy.addPreProcessor(assignTokens);
     return () => {
       uppy.off("file-added", onFileAdded);
-      uppy.removePreProcessor(ensureToken);
+      uppy.off("file-removed", onFileRemoved);
+      uppy.removePreProcessor(assignTokens);
     };
-  }, [uppy, getToken, requestToken, onUploadError]);
+  }, [uppy, acquireToken, hasUsableToken, requestToken, onUploadError]);
   return { ...upload, requestToken };
 }
 export {

package/dist/web/hooks/useS3Upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useS3Upload.d.ts","sourceRoot":"","sources":["../../../src/web/hooks/useS3Upload.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAE/E,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG;IACjD,yEAAyE;IACzE,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAC1B,OAAO,EACP,OAAc,EACd,gBAAgB,EAChB,aAAa,GACd,EAAE,kBAAkB,GAAG,iBAAiB,CAwHxC"}
+{"version":3,"file":"useS3Upload.d.ts","sourceRoot":"","sources":["../../../src/web/hooks/useS3Upload.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAE/E,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG;IACjD,yEAAyE;IACzE,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAC1B,OAAO,EACP,OAAc,EACd,gBAAgB,EAChB,aAAa,GACd,EAAE,kBAAkB,GAAG,iBAAiB,CAiIxC"}

package/dist/web/hooks/useS3Upload.js

@@ -10,12 +10,12 @@ function useS3Upload({
   onUploadComplete,
   onUploadError
 }) {
-  const { requestToken, getToken, constraints } = useUploadToken({ profile });
+  const { requestToken, acquireToken, hasUsableToken, constraints } = useUploadToken({ profile });
   const [createPresignedUploadUrl] = useMutation(CREATE_PRESIGNED_UPLOAD_URL);
   const [confirmUpload] = useMutation(CONFIRM_UPLOAD);
   const getUploadParameters = useCallback(
     async (file) => {
-      const uploadToken = getToken() ?? await requestToken();
+      const uploadToken = await acquireToken();
       const result = await createPresignedUploadUrl({
         variables: {
           input: {
@@ -32,7 +32,7 @@ function useS3Upload({
       }
       return data;
     },
-    [createPresignedUploadUrl, getToken, requestToken]
+    [createPresignedUploadUrl, acquireToken]
   );
   const getUploadParametersRef = useRef(getUploadParameters);
   useEffect(() => {
@@ -53,7 +53,7 @@ function useS3Upload({
       return;
     }
     const onFileAdded = () => {
-      if (!getToken()) {
+      if (!hasUsableToken()) {
         requestToken().catch((e) => {
           onUploadError?.(e instanceof Error ? e : new Error(String(e)));
         });
@@ -91,7 +91,14 @@ function useS3Upload({
       uppy.off("file-added", onFileAdded);
       uppy.removePostProcessor(confirmAll);
     };
-  }, [uppy, confirm, confirmUpload, getToken, requestToken, onUploadError]);
+  }, [
+    uppy,
+    confirm,
+    confirmUpload,
+    hasUsableToken,
+    requestToken,
+    onUploadError
+  ]);
   return { ...upload, requestToken };
 }
 export {

package/dist/web/hooks/useUploadToken.d.ts

@@ -10,6 +10,19 @@ export interface UseUploadTokenResult {
      * in-flight request.
      */
     requestToken: () => Promise<string>;
+    /**
+     * Resolves with a token that can still create `fileCount` files (default
+     * 1) and counts them against it. Reuses the current token while it has
+     * files left and is not about to expire, and fetches a fresh one
+     * otherwise. Call it once per file (or once per batch, with the batch
+     * size) right before the token is sent.
+     */
+    acquireToken: (fileCount?: number) => Promise<string>;
+    /**
+     * Whether the current token is unexpired and has at least one file left,
+     * so the next `acquireToken()` call can resolve without a request.
+     */
+    hasUsableToken: () => boolean;
     /**
      * Returns the most recently fetched token, or `null`, without triggering
      * a render. Meant for event handlers and Uppy callbacks.
@@ -25,10 +38,23 @@ export interface UseUploadTokenResult {
     loading: boolean;
     error: ErrorLike | undefined;
 }
+/**
+ * Reads the lifetime (`exp - iat`, in milliseconds) from a signed token's
+ * claims without verifying it. The lifetime is anchored to the client's
+ * clock when the token is requested, so clock skew between browser and server
+ * does not matter. Returns `null` for a token whose claims cannot be read.
+ */
+export declare function readTokenLifetimeMs(token: string): number | null;
 /**
  * Fetches upload tokens for a profile from the `requestUploadToken` query.
  * Tokens expire, so the query runs with `fetchPolicy: 'no-cache'` and only
- * when `requestToken()` is called, never on mount.
+ * when a token is needed, never on mount.
+ *
+ * A token expires and can only create `maxFiles` files, so the hook tracks
+ * both for the current token. `acquireToken()` hands the token out only
+ * while it has files left and is not about to expire, and fetches a fresh
+ * one otherwise, which lets one mounted component upload any number of
+ * times.
  */
 export declare function useUploadToken({ profile, }: UseUploadTokenOptions): UseUploadTokenResult;
 //# sourceMappingURL=useUploadToken.d.ts.map

package/dist/web/hooks/useUploadToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useUploadToken.d.ts","sourceRoot":"","sources":["../../../src/web/hooks/useUploadToken.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAI/C,OAAO,KAAK,EAGV,iBAAiB,EAClB,MAAM,eAAe,CAAA;AAEtB,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC;;;OAGG;IACH,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;IAC7B,kDAAkD;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;OAGG;IACH,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,SAAS,GAAG,SAAS,CAAA;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,GACR,EAAE,qBAAqB,GAAG,oBAAoB,CA4E9C"}
+{"version":3,"file":"useUploadToken.d.ts","sourceRoot":"","sources":["../../../src/web/hooks/useUploadToken.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAI/C,OAAO,KAAK,EAGV,iBAAiB,EAClB,MAAM,eAAe,CAAA;AAEtB,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACrD;;;OAGG;IACH,cAAc,EAAE,MAAM,OAAO,CAAA;IAC7B;;;OAGG;IACH,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;IAC7B,kDAAkD;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;OAGG;IACH,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,SAAS,GAAG,SAAS,CAAA;CAC7B;AA+BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BhE;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,GACR,EAAE,qBAAqB,GAAG,oBAAoB,CAoH9C"}

package/dist/web/hooks/useUploadToken.js

@@ -1,6 +1,45 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useLazyQuery } from "@apollo/client/react";
 import { REQUEST_UPLOAD_TOKEN } from "../graphql.js";
+const EXPIRY_MARGIN_MS = 3e4;
+function decodeBase64Url(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(
+    base64.length + (4 - base64.length % 4) % 4,
+    "="
+  );
+  return atob(padded);
+}
+function readTokenLifetimeMs(token) {
+  const [, claims] = token.split(".");
+  if (!claims) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(decodeBase64Url(claims));
+    if (typeof parsed === "object" && parsed !== null && "exp" in parsed && "iat" in parsed && typeof parsed.exp === "number" && typeof parsed.iat === "number" && parsed.exp > parsed.iat) {
+      return (parsed.exp - parsed.iat) * 1e3;
+    }
+  } catch {
+  }
+  return null;
+}
+function expiresAtFor(token, requestedAt) {
+  const lifetime = readTokenLifetimeMs(token);
+  if (lifetime === null) {
+    return null;
+  }
+  return requestedAt + lifetime - Math.min(EXPIRY_MARGIN_MS, lifetime / 2);
+}
+function canCreate(state, fileCount) {
+  if (!state) {
+    return false;
+  }
+  if (state.expiresAt !== null && Date.now() >= state.expiresAt) {
+    return false;
+  }
+  return state.used === 0 || state.used + fileCount <= state.maxFiles;
+}
 function useUploadToken({
   profile
 }) {
@@ -23,6 +62,7 @@ function useUploadToken({
     }
     const requestedProfile = profile;
     const request = (async () => {
+      const requestedAt = Date.now();
       const result = await execute({ variables: { profile: requestedProfile } });
       if (requestedProfile !== profileRef.current) {
         throw new Error(
@@ -36,7 +76,12 @@ function useUploadToken({
       if (!data) {
         throw new Error("The upload token query returned no data.");
       }
-      tokenRef.current = data.token;
+      tokenRef.current = {
+        token: data.token,
+        maxFiles: data.maxFiles,
+        used: 0,
+        expiresAt: expiresAtFor(data.token, requestedAt)
+      };
       setToken(data.token);
       setConstraints({
         allowedMimeTypes: data.allowedMimeTypes,
@@ -52,9 +97,33 @@ function useUploadToken({
     inFlight.current = request;
     return request;
   }, [execute, profile]);
-  const getToken = useCallback(() => tokenRef.current, []);
-  return { requestToken, getToken, token, constraints, loading, error };
+  const acquireToken = useCallback(
+    async (fileCount = 1) => {
+      for (; ; ) {
+        const current = tokenRef.current;
+        if (current && canCreate(current, fileCount)) {
+          current.used += fileCount;
+          return current.token;
+        }
+        await requestToken();
+      }
+    },
+    [requestToken]
+  );
+  const hasUsableToken = useCallback(() => canCreate(tokenRef.current, 1), []);
+  const getToken = useCallback(() => tokenRef.current?.token ?? null, []);
+  return {
+    requestToken,
+    acquireToken,
+    hasUsableToken,
+    getToken,
+    token,
+    constraints,
+    loading,
+    error
+  };
 }
 export {
+  readTokenLifetimeMs,
   useUploadToken
 };

package/dist/web/hooks/useUppyUpload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useUppyUpload.d.ts","sourceRoot":"","sources":["../../../src/web/hooks/useUppyUpload.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAiB,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,CAAA;IAChD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;IACtB,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,EAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,EACrC,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,mBAAmB,GACvD,gBAAgB,CAoGlB"}
+{"version":3,"file":"useUppyUpload.d.ts","sourceRoot":"","sources":["../../../src/web/hooks/useUppyUpload.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAiB,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,CAAA;IAChD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;IACtB,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,EAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,EACrC,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,mBAAmB,GACvD,gBAAgB,CA8FlB"}

package/dist/web/hooks/useUppyUpload.js

@@ -1,5 +1,5 @@
 import { useEffect, useRef, useState } from "react";
-import { getCedarUploadId } from "../createUppy.js";
+import { applyUploadConstraints, getCedarUploadId } from "../createUppy.js";
 function useUppyUpload(create, constraints, { onUploadComplete, onUploadError }) {
   const [uppy, setUppy] = useState(null);
   const [completedUploads, setCompletedUploads] = useState([]);
@@ -33,13 +33,7 @@ function useUppyUpload(create, constraints, { onUploadComplete, onUploadError })
     if (!uppy || !constraints) {
       return;
     }
-    uppy.setOptions({
-      restrictions: {
-        allowedFileTypes: constraints.allowedMimeTypes,
-        maxFileSize: constraints.maxFileSize,
-        maxNumberOfFiles: constraints.maxFiles
-      }
-    });
+    applyUploadConstraints(uppy, constraints);
   }, [uppy, constraints]);
   useEffect(() => {
     if (!uppy) {

package/dist/webhooks/s3.d.ts

@@ -17,21 +17,30 @@ export interface S3Event {
     Records: S3EventRecord[];
 }
 export type S3EventOutcome = 'completed' | 'failed' | 'ignored' | 'not-found' | 'no-target';
+export interface ProcessS3EventRecordOptions {
+    db: UploadDatabase;
+    targets: StorageTargets;
+    /**
+     * Checks the object's bytes against the type declared when the upload URL
+     * was issued, as `confirmUpload` does. Defaults to `true`.
+     */
+    verifyContentType?: boolean;
+}
 /**
  * Settles the `pending` row for one `s3:ObjectCreated:*` record. The row is
  * matched on target plus storage key, the object's size is compared with
- * the size authorized at presign time, and the row is flipped `pending` to
- * `completed` (or claimed `failed` and the object deleted on a mismatch).
- * Both transitions are conditional, so a duplicate notification or a row
- * the cleanup job already claimed is left alone.
+ * the size authorized at presign time and, with `verifyContentType` (the
+ * default), its bytes with the type declared then, and the row is flipped
+ * `pending` to `completed` (or claimed `failed` and the object deleted on a
+ * mismatch). Both transitions are conditional, so a duplicate notification
+ * or a row the cleanup job already claimed is left alone.
  */
-export declare function processS3EventRecord(record: S3EventRecord, { db, targets }: {
-    db: UploadDatabase;
-    targets: StorageTargets;
-}): Promise<S3EventOutcome>;
+export declare function processS3EventRecord(record: S3EventRecord, { db, targets, verifyContentType }: ProcessS3EventRecordOptions): Promise<S3EventOutcome>;
 export interface S3WebhookOptions {
     db: UploadDatabase;
     targets: StorageTargets;
+    /** See `ProcessS3EventRecordOptions`. Defaults to `true`. */
+    verifyContentType?: boolean;
     /** The trusted SNS topic. Messages from any other topic are rejected. */
     topicArn: string;
     fetchCertificate?: FetchCertificate;

package/dist/webhooks/s3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/webhooks/s3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAQjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE;QACF,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACxB,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACvC,CAAA;CACF;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAsBD,MAAM,MAAM,cAAc,GACxB,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAA;AAkChE;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;IAAE,EAAE,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAC/D,OAAO,CAAC,cAAc,CAAC,CAoDzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,cAAc,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;IAC7E,QAAQ,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CA+D1B"}
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/webhooks/s3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AASjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE;QACF,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACxB,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACvC,CAAA;CACF;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAsBD,MAAM,MAAM,cAAc,GACxB,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAA;AAkChE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAwB,EAAE,EAAE,2BAA2B,GACrE,OAAO,CAAC,cAAc,CAAC,CA2EzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,cAAc,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;IAC7E,QAAQ,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CA+D1B"}

package/dist/webhooks/s3.js

@@ -1,4 +1,5 @@
 import { UploadError } from "../errors.js";
+import { verifyStoredContentType } from "../verifyStoredContentType.js";
 import {
   assertTrustedSnsUrl,
   isSnsMessage,
@@ -28,7 +29,7 @@ function matchTarget(targets, bucket, key) {
   }
   return best ? { name: best.name, storageKey: key.slice(best.keyPrefix.length) } : null;
 }
-async function processS3EventRecord(record, { db, targets }) {
+async function processS3EventRecord(record, { db, targets, verifyContentType = true }) {
   if (!record.eventName.startsWith("ObjectCreated")) {
     return "ignored";
   }
@@ -51,7 +52,7 @@ async function processS3EventRecord(record, { db, targets }) {
   const target = targets[match.name];
   const reportedSize = record.s3.object.size;
   const actualSize = typeof reportedSize === "number" ? reportedSize : await target.getObjectSize(match.storageKey);
-  if (actualSize === null || BigInt(actualSize) !== upload.size) {
+  const fail = async () => {
     const { count: count2 } = await db.upload.updateMany({
       where: { id: upload.id, status: "pending" },
       data: { status: "failed" }
@@ -60,10 +61,28 @@ async function processS3EventRecord(record, { db, targets }) {
       await target.delete(match.storageKey);
     }
     return "failed";
+  };
+  if (actualSize === null || BigInt(actualSize) !== upload.size) {
+    return fail();
+  }
+  let mimeType = upload.mimeType;
+  if (verifyContentType) {
+    const verified = await verifyStoredContentType(target, match.storageKey, {
+      size: actualSize,
+      declaredType: upload.mimeType
+    });
+    if (!verified) {
+      return fail();
+    }
+    mimeType = verified;
   }
   const { count } = await db.upload.updateMany({
     where: { id: upload.id, status: "pending" },
-    data: { status: "completed", size: BigInt(actualSize) }
+    data: {
+      status: "completed",
+      size: BigInt(actualSize),
+      ...mimeType !== upload.mimeType ? { mimeType } : {}
+    }
   });
   return count === 1 ? "completed" : "ignored";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/uploads",
-  "version": "7.0.1-next.314",
+  "version": "7.0.1-next.466",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -43,43 +43,43 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "7.0.1-next.314",
-    "@cedarjs/context": "7.0.1-next.314",
-    "@cedarjs/graphql-server": "7.0.1-next.314",
+    "@cedarjs/api": "7.0.1-next.466",
+    "@cedarjs/context": "7.0.1-next.466",
+    "@cedarjs/graphql-server": "7.0.1-next.466",
     "@fastify/multipart": "9.4.0",
     "graphql": "16.14.2",
     "mime-types": "2.1.35"
   },
   "devDependencies": {
-    "@apollo/client": "4.3.1",
+    "@apollo/client": "4.3.3",
     "@arethetypeswrong/cli": "0.18.5",
-    "@aws-sdk/client-s3": "3.1139.0",
-    "@aws-sdk/s3-request-presigner": "3.1139.0",
-    "@cedarjs/framework-tools": "7.0.1-next.314",
-    "@cedarjs/web": "7.0.1-next.314",
+    "@aws-sdk/client-s3": "3.1149.0",
+    "@aws-sdk/s3-request-presigner": "3.1149.0",
+    "@cedarjs/framework-tools": "7.0.1-next.466",
+    "@cedarjs/web": "7.0.1-next.466",
     "@prisma/adapter-better-sqlite3": "7.10.0",
     "@prisma/client": "7.10.0",
     "@testing-library/dom": "10.4.2",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.3",
-    "@types/aws-lambda": "8.10.163",
+    "@types/aws-lambda": "8.10.164",
     "@types/better-sqlite3": "7.6.13",
     "@types/mime-types": "2.1.4",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
-    "@uppy/aws-s3": "6.1.0",
-    "@uppy/core": "6.0.1",
-    "@uppy/dashboard": "6.0.0",
+    "@uppy/aws-s3": "6.2.2",
+    "@uppy/core": "6.2.0",
+    "@uppy/dashboard": "6.0.1",
     "@uppy/drag-drop": "6.0.0",
     "@uppy/react": "6.0.0",
-    "@uppy/xhr-upload": "6.0.0",
+    "@uppy/xhr-upload": "6.0.1",
     "better-sqlite3": "12.11.1",
-    "concurrently": "9.2.4",
+    "concurrently": "9.2.5",
     "esbuild": "0.28.2",
     "fastify": "5.12.5",
     "jsdom": "27.4.0",
     "prisma": "7.10.0",
-    "publint": "0.3.24",
+    "publint": "0.3.25",
     "react": "19.3.0",
     "react-dom": "19.3.0",
     "typescript": "5.9.3",
@@ -87,10 +87,10 @@
     "zx": "8.8.5"
   },
   "peerDependencies": {
-    "@apollo/client": "4.3.1",
+    "@apollo/client": "4.3.3",
     "@aws-sdk/client-s3": "^3.0.0",
     "@aws-sdk/s3-request-presigner": "^3.0.0",
-    "@cedarjs/web": "7.0.1-next.314",
+    "@cedarjs/web": "7.0.1-next.466",
     "@uppy/aws-s3": "^6.0.0",
     "@uppy/core": "^6.0.0",
     "@uppy/dashboard": "^6.0.0",