@cedarjs/uploads 8.0.0-canary.3402 → 8.0.0-canary.3403

package/dist/profiles.d.ts

@@ -15,7 +15,11 @@ export interface UploadProfile {
     target: string;
     /**
      * MIME types the profile accepts. Exact types (`image/png`) and wildcard
-     * subtypes (`image/*`) are supported.
+     * subtypes (`image/*`) are supported, and either spelling of an aliased
+     * type (`image/jpeg` or `image/jpg`) matches both. When files are checked
+     * by their bytes (`verifyContentType`, on by default), types that can carry
+     * script, such as `image/svg+xml` or `text/html`, are only accepted when
+     * listed exactly; see `SCRIPTABLE_CONTENT_TYPES`.
      */
     allowedMimeTypes: string[];
     /** Largest file the profile accepts, in bytes. */
@@ -43,7 +47,9 @@ export declare function resolveProfile(profiles: UploadProfiles, name: string):
 /**
  * Whether `mimeType` matches one of `allowed`. Matching is case-insensitive
  * and ignores parameters such as `; charset=utf-8`. An entry of `image/*`
- * matches every `image/` subtype.
+ * matches every `image/` subtype. Aliases in `CONTENT_TYPE_ALIASES` are the
+ * same type, so `image/jpg` matches an entry of `image/jpeg` and the other
+ * way round.
  */
 export declare function isMimeTypeAllowed(allowed: string[], mimeType: string): boolean;
 //# sourceMappingURL=profiles.d.ts.map

package/dist/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAIxD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAE3C,2CAA2C;AAC3C,eAAO,MAAM,+BAA+B,EAAE,oBAA2B,CAAA;AAEzE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,oBAAoB,CAAA;CACjC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE1D,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,EAAE,MAAM,CAAA;CACb;AAiCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,cAAc,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAM7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,GACX,qBAAqB,CAavB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,WAoBpE"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAKxD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAc,CAAA;AAE3C,2CAA2C;AAC3C,eAAO,MAAM,+BAA+B,EAAE,oBAA2B,CAAA;AAEzE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,oBAAoB,CAAA;CACjC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE1D,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,EAAE,MAAM,CAAA;CACb;AAiCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,cAAc,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAM7E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,GACX,qBAAqB,CAavB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,WAoBpE"}

package/dist/profiles.js

@@ -1,3 +1,4 @@
+import { canonicalContentType } from "./contentTypes.js";
 import { UploadError } from "./errors.js";
 const DB_MAX_FILE_SIZE = 1024 * 1024;
 const DEFAULT_UPLOAD_TOKEN_EXPIRES_IN = "5m";
@@ -44,8 +45,8 @@ function resolveProfile(profiles, name) {
   return { ...profile, name };
 }
 function isMimeTypeAllowed(allowed, mimeType) {
-  const normalized = mimeType.split(";")[0].trim().toLowerCase();
-  if (!normalized) {
+  const type = canonicalContentType(mimeType);
+  if (!type) {
     return false;
   }
   return allowed.some((entry) => {
@@ -54,9 +55,9 @@ function isMimeTypeAllowed(allowed, mimeType) {
       return true;
     }
     if (pattern.endsWith("/*")) {
-      return normalized.startsWith(pattern.slice(0, -1));
+      return type.startsWith(pattern.slice(0, -1));
     }
-    return pattern === normalized;
+    return canonicalContentType(pattern) === type;
   });
 }
 export {

package/dist/providers/s3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/providers/s3.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CAwHzE"}
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/providers/s3.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CA4IzE"}

package/dist/providers/s3.js

@@ -45,6 +45,22 @@ function createS3Provider(opts) {
       }
       return Buffer.from(await res.Body.transformToByteArray());
     },
+    async readRange(key, { offset, length }) {
+      if (length <= 0) {
+        return Buffer.alloc(0);
+      }
+      const res = await client.send(
+        new GetObjectCommand({
+          Bucket: bucket,
+          Key: fullKey(key),
+          Range: `bytes=${offset}-${offset + length - 1}`
+        })
+      );
+      if (!res.Body) {
+        return Buffer.alloc(0);
+      }
+      return Buffer.from(await res.Body.transformToByteArray());
+    },
     async readStream(key) {
       const res = await client.send(
         new GetObjectCommand({ Bucket: bucket, Key: fullKey(key) })

package/dist/services.d.ts

@@ -40,6 +40,16 @@ export interface CreatePresignedUploadOptions {
     /** The validated token, as attached to context by `@requireUploadToken`. */
     tokenPayload: UploadTokenPayload;
     input: CreatePresignedUploadInput;
+    /**
+     * Holds the declared type to the rules `acceptedContentType()` applies to
+     * a type it can't check by bytes: no wildcard types, and types that can
+     * carry script (`SCRIPTABLE_CONTENT_TYPES`) only when the profile lists
+     * them exactly. Pair it with `verifyContentType` on `confirmUpload` (and
+     * the S3 webhook), which checks the bytes against the declared type.
+     * Defaults to `true`; `false` checks the declared type with
+     * `isMimeTypeAllowed()` only.
+     */
+    verifyContentType?: boolean;
 }
 export interface PresignedUploadResponse {
     uploadId: string;
@@ -52,19 +62,27 @@ export interface PresignedUploadResponse {
  * a presigned URL the client PUTs the bytes to. This is what the generated
  * `createPresignedUploadUrl` resolver calls.
  */
-export declare function createPresignedUpload({ db, targets, tokenPayload, input, }: CreatePresignedUploadOptions): Promise<PresignedUploadResponse>;
+export declare function createPresignedUpload({ db, targets, tokenPayload, input, verifyContentType, }: CreatePresignedUploadOptions): Promise<PresignedUploadResponse>;
 export interface ConfirmUploadOptions {
     db: UploadDatabase;
     targets: StorageTargets;
     uploadId: string;
     currentUser: UploadActor | null | undefined;
+    /**
+     * Checks the object's bytes against the type the client declared for it
+     * when it asked for the upload URL, with a ranged read of its head (and of
+     * its tail for ZIPs), and records the canonical spelling of that type. A
+     * mismatch fails the row and deletes the object. Defaults to `true`.
+     */
+    verifyContentType?: boolean;
 }
 /**
  * Client-side confirmation of a direct upload. Verifies that the object
- * exists in storage and that its size matches what the token authorized,
- * then flips the row `pending` to `completed`. On a size mismatch the row is
- * claimed `failed` and the object deleted. Only the user (and organization)
- * the upload was issued to can confirm it.
+ * exists in storage, that its size matches what the token authorized, and
+ * (with `verifyContentType`, the default) that its bytes are the type the
+ * client declared, then flips the row `pending` to `completed`. On a
+ * mismatch the row is claimed `failed` and the object deleted. Only the user
+ * (and organization) the upload was issued to can confirm it.
  */
-export declare function confirmUpload({ db, targets, uploadId, currentUser, }: ConfirmUploadOptions): Promise<UploadRecord>;
+export declare function confirmUpload({ db, targets, uploadId, currentUser, verifyContentType, }: ConfirmUploadOptions): Promise<UploadRecord>;
 //# sourceMappingURL=services.d.ts.map

package/dist/services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,KAAK,EAEV,cAAc,EACd,cAAc,EACd,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,cAAc,CAAA;IACxB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3C,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,OAAO,EAAE,WAAW,EACpB,MAAM,EACN,WAAW,EACX,cAAc,GACf,EAAE,uBAAuB,GAAG,mBAAmB,CA+B/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,4EAA4E;IAC5E,YAAY,EAAE,kBAAkB,CAAA;IAChC,KAAK,EAAE,0BAA0B,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAUD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,EAAE,EACF,OAAO,EACP,YAAY,EACZ,KAAK,GACN,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkCjE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;CAC5C;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAClC,EAAE,EACF,OAAO,EACP,QAAQ,EACR,WAAW,GACZ,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CAoE9C"}
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,KAAK,EAGV,cAAc,EACd,cAAc,EACd,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,cAAc,CAAA;IACxB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3C,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,OAAO,EAAE,WAAW,EACpB,MAAM,EACN,WAAW,EACX,cAAc,GACf,EAAE,uBAAuB,GAAG,mBAAmB,CA+B/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,4EAA4E;IAC5E,YAAY,EAAE,kBAAkB,CAAA;IAChC,KAAK,EAAE,0BAA0B,CAAA;IACjC;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAUD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,EAAE,EACF,OAAO,EACP,YAAY,EACZ,KAAK,EACL,iBAAwB,GACzB,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAiDjE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAqBD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,EAClC,EAAE,EACF,OAAO,EACP,QAAQ,EACR,WAAW,EACX,iBAAwB,GACzB,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CA4F9C"}

package/dist/services.js

@@ -1,3 +1,4 @@
+import { isClaimedContentTypeAllowed } from "./detectContentType.js";
 import { UploadError } from "./errors.js";
 import { generateStorageKey } from "./keys.js";
 import {
@@ -8,6 +9,7 @@ import {
 import { resolveProfile } from "./profiles.js";
 import { resolveTarget } from "./targets.js";
 import { createUploadToken } from "./uploadToken.js";
+import { verifyStoredContentType } from "./verifyStoredContentType.js";
 function issueUploadToken({
   profiles,
   profile: profileName,
@@ -54,10 +56,20 @@ async function createPresignedUpload({
   db,
   targets,
   tokenPayload,
-  input
+  input,
+  verifyContentType = true
 }) {
   const size = toBigInt(input.size, "file size");
   assertTokenAllowsFile(tokenPayload, { contentType: input.contentType, size });
+  if (verifyContentType && !isClaimedContentTypeAllowed(
+    tokenPayload.allowedMimeTypes,
+    input.contentType
+  )) {
+    throw new UploadError(
+      "MIME_TYPE_NOT_ALLOWED",
+      `File type '${input.contentType}' is not allowed for upload profile '${tokenPayload.profile}'. Types that can carry script must be listed exactly, not through a wildcard.`
+    );
+  }
   const target = resolveTarget(targets, tokenPayload.target);
   const storageKey = generateStorageKey(input.contentType);
   const upload = await createPendingUpload({
@@ -80,11 +92,21 @@ async function createPresignedUpload({
   }
   return { uploadId: upload.id, ...presigned };
 }
+async function failUpload(db, target, upload) {
+  const { count } = await db.upload.updateMany({
+    where: { id: upload.id, status: "pending" },
+    data: { status: "failed" }
+  });
+  if (count === 1) {
+    await target.delete(upload.storageKey);
+  }
+}
 async function confirmUpload({
   db,
   targets,
   uploadId,
-  currentUser
+  currentUser,
+  verifyContentType = true
 }) {
   const upload = await db.upload.findFirst({
     where: { id: uploadId },
@@ -102,22 +124,35 @@ async function confirmUpload({
     throw new UploadError("NOT_IN_STORAGE", "Upload not found in storage.");
   }
   const actualSize = await target.getObjectSize(upload.storageKey);
+  const storedUpload = { ...upload, storageKey: upload.storageKey };
   if (actualSize === null || BigInt(actualSize) !== upload.size) {
-    const { count: count2 } = await db.upload.updateMany({
-      where: { id: uploadId, status: "pending" },
-      data: { status: "failed" }
-    });
-    if (count2 === 1) {
-      await target.delete(upload.storageKey);
-    }
+    await failUpload(db, target, storedUpload);
     throw new UploadError(
       "SIZE_MISMATCH",
       `Uploaded object is ${actualSize ?? "of unknown"} bytes but ${upload.size} bytes were authorized.`
     );
   }
+  let mimeType = upload.mimeType;
+  if (verifyContentType) {
+    const verified = await verifyStoredContentType(target, upload.storageKey, {
+      size: actualSize,
+      declaredType: upload.mimeType
+    });
+    if (!verified) {
+      await failUpload(db, target, storedUpload);
+      throw new UploadError(
+        "MIME_TYPE_NOT_ALLOWED",
+        `Uploaded file is not of the type '${upload.mimeType}' it was declared as, so it was deleted.`
+      );
+    }
+    mimeType = verified;
+  }
   const { count } = await db.upload.updateMany({
     where: { id: uploadId, status: "pending" },
-    data: { status: "completed" }
+    data: {
+      status: "completed",
+      ...mimeType !== upload.mimeType ? { mimeType } : {}
+    }
   });
   const confirmed = await db.upload.findFirst({
     where: { id: uploadId },

package/dist/types.d.ts

@@ -63,6 +63,7 @@ export interface UploadWhere {
 export interface UploadUpdateData {
     status?: UploadStatus;
     size?: bigint;
+    mimeType?: string;
     storageKey?: string | null;
 }
 /**
@@ -157,6 +158,15 @@ export interface StorageProvider {
     }): Promise<void>;
     /** Read the whole object into memory. */
     read(key: string): Promise<Buffer>;
+    /**
+     * Read `length` bytes starting at `offset` (fewer when the object ends
+     * first). Optional; checking a direct upload's content type falls back to
+     * `read()` when a provider does not implement it.
+     */
+    readRange?(key: string, range: {
+        offset: number;
+        length: number;
+    }): Promise<Buffer>;
     /**
      * Stream the object. Optional; the serve route falls back to `read()` when
      * a provider does not implement it.

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE7D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAA;AAExD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAG1B,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAA;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;IACrC,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/D,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACzE,iBAAiB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACzE,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAC1B,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QACzB,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;QACvC,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC3B,UAAU,CAAC,IAAI,EAAE;QACf,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,EAAE,gBAAgB,CAAA;KACvB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9B,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9D,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrD;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,cAAc,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,uBAAuB;IAC7D,YAAY,CAAC,CAAC,EACZ,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/C,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,cAAc,CAAA;KAAE,GAC5C,OAAO,CAAC,CAAC,CAAC,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;OAIG;IACH,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAElC,+BAA+B;IAC/B,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,yCAAyC;IACzC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElC;;;OAGG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE3C,2DAA2D;IAC3D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAElC,iCAAiC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAErC;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAElD;;;OAGG;IACH,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB;;;OAGG;IACH,qBAAqB,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B;;;OAGG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;AAE5D,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE7D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAA;AAExD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAG1B,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAA;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;IACrC,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/D,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACzE,iBAAiB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACzE,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAC1B,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QACzB,OAAO,CAAC,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;QACvC,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC3B,UAAU,CAAC,IAAI,EAAE;QACf,KAAK,EAAE,WAAW,CAAA;QAClB,IAAI,EAAE,gBAAgB,CAAA;KACvB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9B,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9D,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrD;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,cAAc,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,uBAAuB;IAC7D,YAAY,CAAC,CAAC,EACZ,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/C,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,cAAc,CAAA;KAAE,GAC5C,OAAO,CAAC,CAAC,CAAC,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;OAIG;IACH,YAAY,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAElC,+BAA+B;IAC/B,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,yCAAyC;IACzC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElC;;;;OAIG;IACH,SAAS,CAAC,CACR,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB;;;OAGG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE3C,2DAA2D;IAC3D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAElC,iCAAiC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAErC;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAElD;;;OAGG;IACH,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB;;;OAGG;IACH,qBAAqB,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B;;;OAGG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;AAE5D,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB"}

package/dist/verifyStoredContentType.d.ts

@@ -0,0 +1,19 @@
+import type { StorageProvider } from './types.js';
+/**
+ * Checks an object that was uploaded straight to storage against the type
+ * the client declared for it when it asked for the upload URL. The declared
+ * type was checked against the upload profile then, and is the
+ * `Content-Type` the object was stored with, so the bytes must be that type
+ * (or an alias of it). Reads the first `DETECT_CONTENT_TYPE_BYTES`, plus the
+ * last `DETECT_CONTENT_TYPE_TAIL_BYTES` when the head is a ZIP, plus the
+ * start of the ZIP's central directory when that begins before the tail
+ * (at most `MAX_ZIP_DIRECTORY_BYTES`).
+ *
+ * Returns the canonical type to record, or `null` when the bytes aren't the
+ * declared type.
+ */
+export declare function verifyStoredContentType(target: StorageProvider, key: string, { size, declaredType }: {
+    size: number;
+    declaredType: string;
+}): Promise<string | null>;
+//# sourceMappingURL=verifyStoredContentType.d.ts.map

package/dist/verifyStoredContentType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyStoredContentType.d.ts","sourceRoot":"","sources":["../src/verifyStoredContentType.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAmBjD;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,EACX,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsCxB"}

package/dist/verifyStoredContentType.js

@@ -0,0 +1,41 @@
+import {
+  acceptedContentType,
+  DETECT_CONTENT_TYPE_BYTES,
+  DETECT_CONTENT_TYPE_TAIL_BYTES,
+  findZipCentralDirectory
+} from "./detectContentType.js";
+const ZIP_LOCAL_HEADER = [80, 75, 3, 4];
+async function readRange(target, key, offset, length) {
+  if (target.readRange) {
+    return target.readRange(key, { offset, length });
+  }
+  return (await target.read(key)).subarray(offset, offset + length);
+}
+async function verifyStoredContentType(target, key, { size, declaredType }) {
+  const headLength = Math.min(size, DETECT_CONTENT_TYPE_BYTES);
+  const head = await readRange(target, key, 0, headLength);
+  let tail;
+  const isZip = ZIP_LOCAL_HEADER.every((byte, i) => head[i] === byte);
+  if (isZip && size > head.length) {
+    const tailLength = Math.min(size, DETECT_CONTENT_TYPE_TAIL_BYTES);
+    const tailStart = size - tailLength;
+    tail = await readRange(target, key, tailStart, tailLength);
+    const directory = findZipCentralDirectory(tail);
+    if (directory && directory.offset < tailStart && directory.offset + directory.size > tailStart) {
+      const missing = await readRange(
+        target,
+        key,
+        directory.offset,
+        tailStart - directory.offset
+      );
+      const joined = new Uint8Array(missing.length + tail.length);
+      joined.set(missing);
+      joined.set(tail, missing.length);
+      tail = joined;
+    }
+  }
+  return acceptedContentType(head, [declaredType], declaredType, { tail });
+}
+export {
+  verifyStoredContentType
+};

package/dist/webhooks/s3.d.ts

@@ -17,21 +17,30 @@ export interface S3Event {
     Records: S3EventRecord[];
 }
 export type S3EventOutcome = 'completed' | 'failed' | 'ignored' | 'not-found' | 'no-target';
+export interface ProcessS3EventRecordOptions {
+    db: UploadDatabase;
+    targets: StorageTargets;
+    /**
+     * Checks the object's bytes against the type declared when the upload URL
+     * was issued, as `confirmUpload` does. Defaults to `true`.
+     */
+    verifyContentType?: boolean;
+}
 /**
  * Settles the `pending` row for one `s3:ObjectCreated:*` record. The row is
  * matched on target plus storage key, the object's size is compared with
- * the size authorized at presign time, and the row is flipped `pending` to
- * `completed` (or claimed `failed` and the object deleted on a mismatch).
- * Both transitions are conditional, so a duplicate notification or a row
- * the cleanup job already claimed is left alone.
+ * the size authorized at presign time and, with `verifyContentType` (the
+ * default), its bytes with the type declared then, and the row is flipped
+ * `pending` to `completed` (or claimed `failed` and the object deleted on a
+ * mismatch). Both transitions are conditional, so a duplicate notification
+ * or a row the cleanup job already claimed is left alone.
  */
-export declare function processS3EventRecord(record: S3EventRecord, { db, targets }: {
-    db: UploadDatabase;
-    targets: StorageTargets;
-}): Promise<S3EventOutcome>;
+export declare function processS3EventRecord(record: S3EventRecord, { db, targets, verifyContentType }: ProcessS3EventRecordOptions): Promise<S3EventOutcome>;
 export interface S3WebhookOptions {
     db: UploadDatabase;
     targets: StorageTargets;
+    /** See `ProcessS3EventRecordOptions`. Defaults to `true`. */
+    verifyContentType?: boolean;
     /** The trusted SNS topic. Messages from any other topic are rejected. */
     topicArn: string;
     fetchCertificate?: FetchCertificate;

package/dist/webhooks/s3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/webhooks/s3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAQjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE;QACF,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACxB,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACvC,CAAA;CACF;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAsBD,MAAM,MAAM,cAAc,GACxB,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAA;AAkChE;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;IAAE,EAAE,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAC/D,OAAO,CAAC,cAAc,CAAC,CAoDzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,cAAc,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;IAC7E,QAAQ,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CA+D1B"}
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/webhooks/s3.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AASjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE;QACF,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACxB,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACvC,CAAA;CACF;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAsBD,MAAM,MAAM,cAAc,GACxB,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAA;AAkChE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAwB,EAAE,EAAE,2BAA2B,GACrE,OAAO,CAAC,cAAc,CAAC,CA2EzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,cAAc,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;IAC7E,QAAQ,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CA+D1B"}

package/dist/webhooks/s3.js

@@ -1,4 +1,5 @@
 import { UploadError } from "../errors.js";
+import { verifyStoredContentType } from "../verifyStoredContentType.js";
 import {
   assertTrustedSnsUrl,
   isSnsMessage,
@@ -28,7 +29,7 @@ function matchTarget(targets, bucket, key) {
   }
   return best ? { name: best.name, storageKey: key.slice(best.keyPrefix.length) } : null;
 }
-async function processS3EventRecord(record, { db, targets }) {
+async function processS3EventRecord(record, { db, targets, verifyContentType = true }) {
   if (!record.eventName.startsWith("ObjectCreated")) {
     return "ignored";
   }
@@ -51,7 +52,7 @@ async function processS3EventRecord(record, { db, targets }) {
   const target = targets[match.name];
   const reportedSize = record.s3.object.size;
   const actualSize = typeof reportedSize === "number" ? reportedSize : await target.getObjectSize(match.storageKey);
-  if (actualSize === null || BigInt(actualSize) !== upload.size) {
+  const fail = async () => {
     const { count: count2 } = await db.upload.updateMany({
       where: { id: upload.id, status: "pending" },
       data: { status: "failed" }
@@ -60,10 +61,28 @@ async function processS3EventRecord(record, { db, targets }) {
       await target.delete(match.storageKey);
     }
     return "failed";
+  };
+  if (actualSize === null || BigInt(actualSize) !== upload.size) {
+    return fail();
+  }
+  let mimeType = upload.mimeType;
+  if (verifyContentType) {
+    const verified = await verifyStoredContentType(target, match.storageKey, {
+      size: actualSize,
+      declaredType: upload.mimeType
+    });
+    if (!verified) {
+      return fail();
+    }
+    mimeType = verified;
   }
   const { count } = await db.upload.updateMany({
     where: { id: upload.id, status: "pending" },
-    data: { status: "completed", size: BigInt(actualSize) }
+    data: {
+      status: "completed",
+      size: BigInt(actualSize),
+      ...mimeType !== upload.mimeType ? { mimeType } : {}
+    }
   });
   return count === 1 ? "completed" : "ignored";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/uploads",
-  "version": "8.0.0-canary.3402",
+  "version": "8.0.0-canary.3403",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -43,9 +43,9 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "8.0.0-canary.3402",
-    "@cedarjs/context": "8.0.0-canary.3402",
-    "@cedarjs/graphql-server": "8.0.0-canary.3402",
+    "@cedarjs/api": "8.0.0-canary.3403",
+    "@cedarjs/context": "8.0.0-canary.3403",
+    "@cedarjs/graphql-server": "8.0.0-canary.3403",
     "@fastify/multipart": "9.4.0",
     "graphql": "16.14.2",
     "mime-types": "2.1.35"
@@ -55,8 +55,8 @@
     "@arethetypeswrong/cli": "0.18.5",
     "@aws-sdk/client-s3": "3.1148.0",
     "@aws-sdk/s3-request-presigner": "3.1148.0",
-    "@cedarjs/framework-tools": "8.0.0-canary.3402",
-    "@cedarjs/web": "8.0.0-canary.3402",
+    "@cedarjs/framework-tools": "8.0.0-canary.3403",
+    "@cedarjs/web": "8.0.0-canary.3403",
     "@prisma/adapter-better-sqlite3": "7.10.0",
     "@prisma/client": "7.10.0",
     "@testing-library/dom": "10.4.2",
@@ -90,7 +90,7 @@
     "@apollo/client": "4.3.3",
     "@aws-sdk/client-s3": "^3.0.0",
     "@aws-sdk/s3-request-presigner": "^3.0.0",
-    "@cedarjs/web": "8.0.0-canary.3402",
+    "@cedarjs/web": "8.0.0-canary.3403",
     "@uppy/aws-s3": "^6.0.0",
     "@uppy/core": "^6.0.0",
     "@uppy/dashboard": "^6.0.0",