@corgelabs/corge 0.0.1 → 1.0.0

package/dist/files/service.d.ts

@@ -0,0 +1,27 @@
+import type { Bucket } from '@google-cloud/storage';
+import type { DbRole } from '../config';
+import { type DbListOptions, type EntryId, type PaginatedList, type SelectModel } from '../db';
+import type { Core } from '../index';
+import { type FileBody, type FileRef, type SignedDownloadUrlResult, type SignedUploadInput, type SignedUploadUrlResult } from './schema';
+export declare class FilesService {
+    #private;
+    constructor(coreClient: Core);
+    bucket: (isDev?: boolean) => Bucket;
+    canAccess: (ref: string, userId?: EntryId, role?: DbRole) => boolean;
+    upload: (file: FileBody, userId?: EntryId) => Promise<{
+        ref: FileRef;
+    }>;
+    getSignedUploadUrl: (rawInput: SignedUploadInput, userId?: EntryId, expiresInMs?: number) => Promise<SignedUploadUrlResult>;
+    getSignedDownloadUrl: (ref: FileRef, expiresInMs?: number) => Promise<SignedDownloadUrlResult>;
+    download: (ref: FileRef) => Promise<Buffer>;
+    get: (ref: FileRef) => Promise<FileBody>;
+    list: (options?: DbListOptions<SelectModel<'file'>>) => Promise<PaginatedList<SelectModel<'file'>>>;
+    delete: (ref: FileRef) => Promise<{
+        ref: FileRef;
+        deleted: true;
+    }>;
+    hardDelete: (ref: FileRef) => Promise<{
+        ref: FileRef;
+    }>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/files/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/files/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,OAAO,CAAA;AACd,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,OAAO,EAEZ,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAGjB,qBAAa,YAAY;;IAGvB,YAAY,UAAU,EAAE,IAAI,EAE3B;IAED,MAAM,WAAW,OAAO,KAA0B,MAAM,CAA+B;IAEvF,SAAS,QACF,MAAM,WACH,OAAO,SACT,MAAM,KACX,OAAO,CAAoC;IAM9C,MAAM,SACE,QAAQ,WACN,OAAO,KACd,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC,CAiE3B;IA2BD,kBAAkB,aACN,iBAAiB,WACnB,OAAO,2BAEd,OAAO,CAAC,qBAAqB,CAAC,CAehC;IAED,oBAAoB,QAAe,OAAO,2BAA8B,OAAO,CAAC,uBAAuB,CAAC,CAUvG;IAED,QAAQ,QAAe,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,CAO/C;IAED,GAAG,QAAe,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAa5C;IAED,IAAI,aAAoB,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAG,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAIpG;IAEJ,MAAM,QAAe,OAAO,KAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAKtE;IAED,UAAU,QAAe,OAAO,KAAG,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC,CA4B3D;CACF"}

package/dist/files/service.js

@@ -0,0 +1,175 @@
+import { createHash } from 'node:crypto';
+import { entryId } from '../db';
+import { fileBody, fileRef, signedUploadInput } from './schema';
+import { canAccessFile } from './utils';
+export class FilesService {
+    #core;
+    constructor(coreClient) {
+        this.#core = coreClient;
+    }
+    bucket = (isDev = this.#core.env.isDev) => this.#core.db.bucket(isDev);
+    canAccess = (ref, userId = this.#core.userId, role = this.#core.role) => canAccessFile(userId, ref, role);
+    #assertAccess = (ref) => {
+        if (!this.canAccess(ref))
+            this.#core.errors.httpError(403, 'Forbidden: file access denied', 'FORBIDDEN');
+    };
+    upload = async (file, userId = this.#core.userId || this.#core.config.auth.adminUserId) => {
+        entryId.parse(userId);
+        fileBody.parse(file);
+        const shaSum = createHash('sha256').update(file.bytes).digest('hex').slice(0, 24);
+        const ref = fileRef.parse(`${userId}_${shaSum}`);
+        const existing = await this.#core.db.read('file', ref, true, { bypassRbac: true });
+        const step = this.#core.step;
+        if (!existing) {
+            await step('upload-storage', async () => {
+                await this.#core.internals.resilience.acquireLimit('storage');
+                await this.bucket().file(ref).save(Buffer.from(file.bytes), {
+                    resumable: false,
+                    contentType: file.type,
+                    metadata: {
+                        cacheControl: 'private, max-age=31536000, immutable',
+                        metadata: { fileName: file.name, userId, shaSum }
+                    }
+                });
+            }, {
+                rollback: async () => {
+                    await this.#core.internals.resilience.acquireLimit('storage');
+                    await this.bucket().file(ref).delete({ ignoreNotFound: true });
+                }
+            });
+        }
+        await step('upload-meta', async () => {
+            if (!existing) {
+                await this.#core.db.create('file', {
+                    id: ref,
+                    shaSum,
+                    fileName: file.name,
+                    contentType: file.type,
+                    size: file.bytes.byteLength,
+                    userId,
+                    scan: null,
+                    scanError: null,
+                    deleted: false
+                }, { bypassRbac: true });
+            }
+            else if (existing.deleted) {
+                await this.#core.db.update('file', ref, { deleted: false, fileName: file.name }, { bypassRbac: true });
+            }
+        }, {
+            rollback: async () => {
+                if (!existing)
+                    await this.#core.db.hardDelete('file', ref, { bypassRbac: true }).catch(() => { });
+                else if (existing.deleted) {
+                    await this.#core.db.update('file', ref, { deleted: true }, { bypassRbac: true }).catch(() => { });
+                }
+            }
+        });
+        return { ref };
+    };
+    #signGcsUrl = async (ref, action, expiresMs, contentType) => {
+        await this.#core.internals.resilience.acquireLimit('storage');
+        const bucket = this.bucket();
+        try {
+            const [signed] = await bucket.file(ref).getSignedUrl({
+                version: 'v4',
+                action,
+                expires: expiresMs,
+                ...(contentType ? { contentType } : {})
+            });
+            return signed;
+        }
+        catch (err) {
+            if (!this.#core.env.isDev && Boolean(process.env.K_SERVICE)) {
+                return this.#core.errors.httpError(502, 'Failed to generate signed file URL', 'GCS_SIGN_FAILED');
+            }
+            const query = action === 'write' ? `uploadType=media&expires=${expiresMs}` : `alt=media&expires=${expiresMs}`;
+            return `https://storage.googleapis.com/${bucket.name}/${encodeURIComponent(ref)}?${query}`;
+        }
+    };
+    getSignedUploadUrl = async (rawInput, userId = this.#core.userId || this.#core.config.auth.adminUserId, expiresInMs = 15 * 60_000) => {
+        entryId.parse(userId);
+        const input = signedUploadInput.parse(rawInput);
+        const shaSum = input.sha256.toLowerCase().slice(0, 24);
+        const ref = fileRef.parse(`${userId}_${shaSum}`);
+        const existing = await this.#core.db.read('file', ref, true, { bypassRbac: true });
+        const expiresMs = Date.now() + Math.max(60_000, expiresInMs);
+        const expiresAt = new Date(expiresMs).toISOString();
+        if (existing && !existing.deleted) {
+            return { ref, url: '', expiresAt, deduplicated: true };
+        }
+        const url = await this.#signGcsUrl(ref, 'write', expiresMs, input.type);
+        return { ref, url, expiresAt, deduplicated: false };
+    };
+    getSignedDownloadUrl = async (ref, expiresInMs = 15 * 60_000) => {
+        fileRef.parse(ref);
+        this.#assertAccess(ref);
+        const doc = await this.#core.db.read('file', ref, false, { bypassRbac: true });
+        if (!doc)
+            this.#core.errors.httpError(404, `File not found: ${ref}`, 'NOT_FOUND');
+        const expiresMs = Date.now() + Math.max(60_000, expiresInMs);
+        const expiresAt = new Date(expiresMs).toISOString();
+        const url = await this.#signGcsUrl(ref, 'read', expiresMs);
+        return { ref, url, expiresAt };
+    };
+    download = async (ref) => {
+        await this.#core.internals.resilience.acquireLimit('storage');
+        try {
+            return (await this.bucket().file(ref).download())[0];
+        }
+        catch {
+            throw new Error(`File not found: ${ref}`);
+        }
+    };
+    get = async (ref) => {
+        fileRef.parse(ref);
+        this.#assertAccess(ref);
+        const [bytes, doc] = await Promise.all([
+            this.download(ref),
+            this.#core.db.read('file', ref, false, { bypassRbac: true })
+        ]);
+        if (!doc)
+            throw new Error(`File not found: ${ref}`);
+        return fileBody.parse({
+            bytes,
+            name: doc.fileName || ref,
+            type: doc.contentType || 'application/pdf'
+        });
+    };
+    list = async (options) => this.#core.db.list('file', {
+        ...(this.#core.userId && this.#core.role !== 'admin' ? { userId: this.#core.userId } : {}),
+        ...options
+    });
+    delete = async (ref) => {
+        fileRef.parse(ref);
+        this.#assertAccess(ref);
+        await this.#core.db.delete('file', ref, { bypassRbac: true });
+        return { ref, deleted: true };
+    };
+    hardDelete = async (ref) => {
+        fileRef.parse(ref);
+        this.#assertAccess(ref);
+        const step = this.#core.step;
+        await step('hard-delete-file', async () => {
+            const prev = await this.#core.db.read('file', ref, true, { bypassRbac: true });
+            await this.#core.db.hardDelete('file', ref, { bypassRbac: true });
+            return prev ?? null;
+        }, {
+            rollback: async (prev) => {
+                if (!prev)
+                    return;
+                await this.#core.db
+                    .firestore()
+                    .collection('file')
+                    .doc(ref)
+                    .set({
+                    ...prev,
+                    createdAt: prev.createdAt ? new Date(prev.createdAt) : new Date(),
+                    updatedAt: new Date()
+                })
+                    .catch(() => { });
+            }
+        });
+        return { ref };
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/files/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/files/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EACL,OAAO,EAKR,MAAM,OAAO,CAAA;AAEd,OAAO,EACL,QAAQ,EACR,OAAO,EACP,iBAAiB,EAOlB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAEvC,MAAM,OAAO,YAAY;IACd,KAAK,CAAM;IAEpB,YAAY,UAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAA;IACzB,CAAC;IAED,MAAM,GAAG,CAAC,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEvF,SAAS,GAAG,CACV,GAAW,EACX,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,EACnC,IAAI,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,EACrB,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAE9C,aAAa,GAAG,CAAC,GAAY,EAAQ,EAAE;QACrC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,+BAA+B,EAAE,WAAW,CAAC,CAAA;IAC1G,CAAC,CAAA;IAED,MAAM,GAAG,KAAK,EACZ,IAAc,EACd,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAC9C,EAAE;QAC7B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrB,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACpB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACjF,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;QAE5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CACR,gBAAgB,EAChB,KAAK,IAAI,EAAE;gBACT,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;gBAC7D,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAC1D,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI,CAAC,IAAI;oBACtB,QAAQ,EAAE;wBACR,YAAY,EAAE,sCAAsC;wBACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;qBAClD;iBACF,CAAC,CAAA;YACJ,CAAC,EACD;gBACE,QAAQ,EAAE,KAAK,IAAI,EAAE;oBACnB,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;oBAC7D,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;gBAChE,CAAC;aACF,CACF,CAAA;QACH,CAAC;QAED,MAAM,IAAI,CACR,aAAa,EACb,KAAK,IAAI,EAAE;YACT,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CACxB,MAAM,EACN;oBACE,EAAE,EAAE,GAAG;oBACP,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,WAAW,EAAE,IAAI,CAAC,IAAI;oBACtB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;oBAC3B,MAAM;oBACN,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,KAAK;iBACf,EACD,EAAE,UAAU,EAAE,IAAI,EAAE,CACrB,CAAA;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YACxG,CAAC;QACH,CAAC,EACD;YACE,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACnB,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;qBAC3F,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClG,CAAC;YACH,CAAC;SACF,CACF,CAAA;QAED,OAAO,EAAE,GAAG,EAAE,CAAA;IAChB,CAAC,CAAA;IAED,WAAW,GAAG,KAAK,EACjB,GAAY,EACZ,MAAwB,EACxB,SAAiB,EACjB,WAAsB,EACL,EAAE;QACnB,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;gBACnD,OAAO,EAAE,IAAI;gBACb,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAA;YACF,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,oCAAoC,EAAE,iBAAiB,CAAC,CAAA;YAClG,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC,CAAC,qBAAqB,SAAS,EAAE,CAAA;YAC7G,OAAO,kCAAkC,MAAM,CAAC,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAA;QAC5F,CAAC;IACH,CAAC,CAAA;IAED,kBAAkB,GAAG,KAAK,EACxB,QAA2B,EAC3B,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EACzE,WAAW,GAAG,EAAE,GAAG,MAAM,EACO,EAAE;QAClC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrB,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC5D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;QAEnD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;QACxD,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACvE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACrD,CAAC,CAAA;IAED,oBAAoB,GAAG,KAAK,EAAE,GAAY,EAAE,WAAW,GAAG,EAAE,GAAG,MAAM,EAAoC,EAAE;QACzG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9E,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,mBAAmB,GAAG,EAAE,EAAE,WAAW,CAAC,CAAA;QAEjF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC5D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;QACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QAC1D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IAChC,CAAC,CAAA;IAED,QAAQ,GAAG,KAAK,EAAE,GAAY,EAAmB,EAAE;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;QAC7D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAA;IAED,GAAG,GAAG,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC9C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SAC7D,CAAC,CAAA;QACF,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,QAAQ,CAAC,KAAK,CAAC;YACpB,KAAK;YACL,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG;YACzB,IAAI,EAAG,GAAG,CAAC,WAAwB,IAAI,iBAAiB;SACzD,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,GAAG,KAAK,EAAE,OAA4C,EAA+C,EAAE,CACzG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;QACzB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,OAAO;KACX,CAAC,CAAA;IAEJ,MAAM,GAAG,KAAK,EAAE,GAAY,EAA4C,EAAE;QACxE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC/B,CAAC,CAAA;IAED,UAAU,GAAG,KAAK,EAAE,GAAY,EAA6B,EAAE;QAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;QAC5B,MAAM,IAAI,CACR,kBAAkB,EAClB,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9E,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YACjE,OAAO,IAAI,IAAI,IAAI,CAAA;QACrB,CAAC,EACD;YACE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,CAAC,IAAI;oBAAE,OAAM;gBACjB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE;qBAChB,SAAS,EAAE;qBACX,UAAU,CAAC,MAAM,CAAC;qBAClB,GAAG,CAAC,GAAG,CAAC;qBACR,GAAG,CAAC;oBACH,GAAG,IAAI;oBACP,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE;oBACjE,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACpB,CAAC;SACF,CACF,CAAA;QACD,OAAO,EAAE,GAAG,EAAE,CAAA;IAChB,CAAC,CAAA;CACF"}

package/dist/files/utils.d.ts

@@ -0,0 +1,3 @@
+export declare const canAccessFile: (userId: string, ref: string, role?: string) => boolean;
+export declare const hasValidMagicBytes: (type: string, bytes: Uint8Array) => boolean;
+//# sourceMappingURL=utils.d.ts.map

package/dist/files/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/files/utils.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,aAAa,WAAY,MAAM,OAAO,MAAM,SAAS,MAAM,KAAG,OAGT,CAAA;AAElE,eAAO,MAAM,kBAAkB,SAAU,MAAM,SAAS,UAAU,KAAG,OAoEpE,CAAA"}

package/dist/files/utils.js

@@ -0,0 +1,63 @@
+import { CORE_CONFIG } from '../config';
+import { fileRef } from '../db';
+export const canAccessFile = (userId, ref, role) => role === 'admin' ||
+    userId === CORE_CONFIG.auth.adminUserId ||
+    (fileRef.safeParse(ref).success && ref.slice(0, -25) === userId);
+export const hasValidMagicBytes = (type, bytes) => {
+    switch (type) {
+        case 'application/pdf':
+            return (bytes.byteLength >= 5 &&
+                bytes[0] === 0x25 &&
+                bytes[1] === 0x50 &&
+                bytes[2] === 0x44 &&
+                bytes[3] === 0x46 &&
+                bytes[4] === 0x2d);
+        case 'image/png':
+            return (bytes.byteLength >= 8 &&
+                bytes[0] === 0x89 &&
+                bytes[1] === 0x50 &&
+                bytes[2] === 0x4e &&
+                bytes[3] === 0x47 &&
+                bytes[4] === 0x0d &&
+                bytes[5] === 0x0a &&
+                bytes[6] === 0x1a &&
+                bytes[7] === 0x0a);
+        case 'image/jpeg':
+            return bytes.byteLength >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff;
+        case 'image/webp':
+            return (bytes.byteLength >= 12 &&
+                bytes[0] === 0x52 &&
+                bytes[1] === 0x49 &&
+                bytes[2] === 0x46 &&
+                bytes[3] === 0x46 &&
+                bytes[8] === 0x57 &&
+                bytes[9] === 0x45 &&
+                bytes[10] === 0x42 &&
+                bytes[11] === 0x50);
+        case 'image/gif':
+            return (bytes.byteLength >= 6 &&
+                bytes[0] === 0x47 &&
+                bytes[1] === 0x49 &&
+                bytes[2] === 0x46 &&
+                bytes[3] === 0x38 &&
+                (bytes[4] === 0x37 || bytes[4] === 0x39) &&
+                bytes[5] === 0x61);
+        case 'image/bmp':
+            return bytes.byteLength >= 2 && bytes[0] === 0x42 && bytes[1] === 0x4d;
+        case 'image/tiff':
+            return (bytes.byteLength >= 4 &&
+                ((bytes[0] === 0x49 && bytes[1] === 0x49 && bytes[2] === 0x2a && bytes[3] === 0x00) ||
+                    (bytes[0] === 0x4d && bytes[1] === 0x4d && bytes[2] === 0x00 && bytes[3] === 0x2a)));
+        case 'image/avif':
+            return (bytes.byteLength >= 12 &&
+                bytes[4] === 0x66 &&
+                bytes[5] === 0x74 &&
+                bytes[6] === 0x79 &&
+                bytes[7] === 0x70 &&
+                ((bytes[8] === 0x61 && bytes[9] === 0x76 && bytes[10] === 0x69 && (bytes[11] === 0x66 || bytes[11] === 0x73)) ||
+                    (bytes[8] === 0x6d && bytes[9] === 0x69 && bytes[10] === 0x66 && bytes[11] === 0x31)));
+        default:
+            return false;
+    }
+};
+//# sourceMappingURL=utils.js.map

package/dist/files/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/files/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAE/B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,IAAa,EAAW,EAAE,CACnF,IAAI,KAAK,OAAO;IAChB,MAAM,KAAK,WAAW,CAAC,IAAI,CAAC,WAAW;IACvC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,CAAA;AAElE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,KAAiB,EAAW,EAAE;IAC7E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,CACL,KAAK,CAAC,UAAU,IAAI,CAAC;gBACrB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAClB,CAAA;QACH,KAAK,WAAW;YACd,OAAO,CACL,KAAK,CAAC,UAAU,IAAI,CAAC;gBACrB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAClB,CAAA;QACH,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;QAC7F,KAAK,YAAY;YACf,OAAO,CACL,KAAK,CAAC,UAAU,IAAI,EAAE;gBACtB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI;gBAClB,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CACnB,CAAA;QACH,KAAK,WAAW;YACd,OAAO,CACL,KAAK,CAAC,UAAU,IAAI,CAAC;gBACrB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBACxC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAClB,CAAA;QACH,KAAK,WAAW;YACd,OAAO,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;QACxE,KAAK,YAAY;YACf,OAAO,CACL,KAAK,CAAC,UAAU,IAAI,CAAC;gBACrB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;oBACjF,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CACtF,CAAA;QACH,KAAK,YAAY;YACf,OAAO,CACL,KAAK,CAAC,UAAU,IAAI,EAAE;gBACtB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;oBAC3G,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CACxF,CAAA;QACH;YACE,OAAO,KAAK,CAAA;IAChB,CAAC;AACH,CAAC,CAAA"}