@cosmicdrift/kumiko-framework 0.387.0 → 0.389.0

package/dist/files/file-routes.js

@@ -9,16 +9,17 @@ import { createProjectingTenantDb } from "../db/tenant-db.js";
 import { createDerivativesContext, resolveFieldVariant, resolveRenderer, } from "../derivatives/index.js";
 import { isAnonymousSessionUser, SYSTEM_USER_ID } from "../engine/system-user.js";
 import { isFileField, isUuid, } from "../engine/types/index.js";
+import { createFailOpenReporter, respondRateLimited } from "../rate-limit/middleware.js";
 import { listActionFormFileFields, mayUseActionForm } from "./action-form-upload.js";
 import { buildContentDispositionHeader } from "./content-disposition.js";
 import { DEFAULT_MAX_UPLOAD_SIZE, getFileRefExecutor, storeFileAsFileRef, } from "./create-file-ref.js";
-import { createFileContext } from "./file-handle.js";
+import { createFileContext, createTenantFileContext } from "./file-handle.js";
 import { fileRefEntity } from "./file-ref-entity.js";
 import { fileRefsTable } from "./file-ref-table.js";
-import { RecordWriteDecisions } from "./record-write-check.js";
+import { isStoredRecordLocked, RecordWriteDecisions, } from "./record-write-check.js";
 import { neutralFileNameForMimeType } from "./resolve-content-type.js";
 import { parseMaxSize, resolveServedContentType } from "./types.js";
-import { createFileUploadLedger } from "./upload-ledger.js";
+import { withUploadLedger } from "./upload-ledger.js";
 // Exactly the httpStatus values declared by KumikoError subclasses across packages/*.
 const ERROR_STATUSES = [400, 401, 403, 404, 409, 422, 429, 500, 503, 504];
 export function deleteFailureResponseFor(error) {
@@ -31,6 +32,8 @@ const DEFAULT_PRIVILEGED_ROLES = ["Admin", "SystemAdmin"];
 // credential (see "Signed-URL default expiry" in core-files.md).
 const SIGNED_URL_DEFAULT_EXPIRY_SECONDS = 15 * 60;
 const MAX_BATCH_META_IDS = 100;
+const META_BATCH_IDS_PER_WINDOW = 1_000;
+const META_BATCH_WINDOW_SECONDS = 60;
 // Each detail() read decrypts through the KMS pool; a bounded chunk keeps one batch from hogging it.
 const BATCH_META_CONCURRENCY = 10;
 // Default guard: on attached files, allow the uploader or a privileged role,
@@ -101,7 +104,12 @@ export function readFilesRouteOptions(registry) {
     return {};
 }
 export function createFileRoutes(options) {
-    const { db } = options;
+    const { db, metaBatchRateLimitResolver } = options;
+    const reportMetaBatchLimiterFailOpen = createFailOpenReporter("files-meta-batch");
+    // Plain resolvers (not built via withFileProviderResolver) get the ledger on the route's own root connection.
+    const resolveProvider = options.resolveProvider.uploadLedgerFor
+        ? options.resolveProvider
+        : withUploadLedger(options.resolveProvider, db);
     const privilegedRoles = options.privilegedRoles ?? DEFAULT_PRIVILEGED_ROLES;
     const guard = options.accessGuard ??
         createDefaultGuard(privilegedRoles, options.canReadRecord, options.unclaimedUploadReaders ?? []);
@@ -200,19 +208,23 @@ export function createFileRoutes(options) {
             }
         }
         const data = new Uint8Array(await file.arrayBuffer());
-        const storageProvider = await options.resolveProvider(user.tenantId);
-        const uploadLedger = createFileUploadLedger(db, user.tenantId);
+        const files = createTenantFileContext(resolveProvider, user.tenantId);
+        const { registry } = options;
+        const isAttachTargetLocked = registry !== undefined && entityType !== undefined && entityId !== undefined
+            ? (rowDb) => isStoredRecordLocked({ registry, db: rowDb, entityType, entityId })
+            : undefined;
         const outcome = await storeFileAsFileRef({
             user,
             tenantDb: tenantDbFor(user.tenantId),
             rowInOwnTransaction: true,
             registry: options.registry,
             defaultMaxUploadSize: options.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE,
-            writeBytes: async (key, bytes, mimeType) => {
-                await uploadLedger.record(key);
-                await storageProvider.write(key, bytes, mimeType);
+            writeBytes: (key, bytes, mimeType) => files.writeUploadBytes(key, bytes, mimeType),
+            deleteBytes: async (key) => {
+                await files.ref(key).delete();
+                await files.forgetUploadBytes(key);
             },
-            deleteBytes: (key) => storageProvider.delete(key),
+            ...(isAttachTargetLocked ? { isAttachTargetLocked } : {}),
         }, {
             fileName: file.name,
             declaredMimeType: file.type,
@@ -224,6 +236,9 @@ export function createFileRoutes(options) {
         });
         if (outcome.kind === "rejected")
             return c.json({ error: outcome.error }, 400);
+        if (outcome.kind === "target-locked") {
+            return c.json({ error: "record_locked: the record is locked" }, 409);
+        }
         if (outcome.kind === "failed")
             return c.json({ error: "upload_failed" }, 500);
         return c.json(outcome.fileRef, 201);
@@ -237,6 +252,21 @@ export function createFileRoutes(options) {
         const ids = [...new Set((c.req.query("ids") ?? "").split(",").filter((id) => isUuid(id)))];
         if (ids.length > MAX_BATCH_META_IDS)
             return c.json({ error: "too_many_ids" }, 400);
+        if (metaBatchRateLimitResolver && ids.length > 0) {
+            const bucket = `files-meta:${user.tenantId}:${user.id}`;
+            try {
+                const decision = await metaBatchRateLimitResolver.check(bucket, {
+                    limit: META_BATCH_IDS_PER_WINDOW,
+                    windowSeconds: META_BATCH_WINDOW_SECONDS,
+                    cost: ids.length,
+                });
+                if (!decision.allowed)
+                    return respondRateLimited(c, decision, bucket);
+            }
+            catch (e) {
+                reportMetaBatchLimiterFailOpen(e);
+            }
+        }
         const files = [];
         for (let start = 0; start < ids.length; start += BATCH_META_CONCURRENCY) {
             const chunk = ids.slice(start, start + BATCH_META_CONCURRENCY);

package/dist/files/provider-resolver.d.ts

@@ -56,5 +56,6 @@ export type FileProviderResolverDeps = {
     readonly secrets?: SecretsContext;
     readonly db?: DbConnection | TenantDb;
     readonly cacheSync?: CacheSyncBus;
+    readonly now?: () => Temporal.Instant;
 };
 export declare function makeFileProviderResolver(deps: FileProviderResolverDeps): FileProviderResolver;

package/dist/files/provider-resolver.js

@@ -119,5 +119,5 @@ export function makeFileProviderResolver(deps) {
         cache.set(tenantId, built);
         return built;
     };
-    return deps.db ? withUploadLedger(resolveProvider, deps.db) : resolveProvider;
+    return deps.db ? withUploadLedger(resolveProvider, deps.db, deps.now) : resolveProvider;
 }

package/dist/files/record-write-check.d.ts

@@ -20,3 +20,9 @@ export declare function createRecordWriteCheck(args: {
     readonly canReadRecord: RecordReadCheck;
     readonly tenantDbFor: (tenantId: TenantId) => TenantDb;
 }): RecordWriteCheck;
+export declare function isStoredRecordLocked(args: {
+    readonly registry: Registry;
+    readonly db: TenantDb;
+    readonly entityType: string;
+    readonly entityId: string;
+}): Promise<boolean>;

package/dist/files/record-write-check.js

@@ -62,3 +62,16 @@ export function createRecordWriteCheck(args) {
         return RecordWriteDecisions.writable;
     };
 }
+// The stored row, read through the given db so a transaction sees the lock state it commits against.
+export async function isStoredRecordLocked(args) {
+    const { registry, db, entityType, entityId } = args;
+    const entity = registry.getEntity(entityType);
+    const table = findImplicitEntityTable(registry, entityType);
+    if (!entity || !table || entity.lockedWhen === undefined)
+        return false;
+    const row = await db.fetchOne(table, {
+        id: entityId,
+        ...(entity.softDelete === true && { isDeleted: false }),
+    });
+    return row !== undefined && isRecordLocked(entity.lockedWhen, row);
+}

package/dist/files/resolve-content-type.js

@@ -46,6 +46,49 @@ const NON_XML_ROOT_ELEMENTS = new Set([
     "article",
     "font",
     "center",
+    "form",
+    "iframe",
+    "input",
+    "button",
+    "nav",
+    "header",
+    "footer",
+    "main",
+    "pre",
+    "code",
+    "b",
+    "i",
+    "strong",
+    "em",
+    "label",
+    "textarea",
+    "select",
+    "fieldset",
+    "legend",
+    "tr",
+    "td",
+    "th",
+    "thead",
+    "tbody",
+    "tfoot",
+    "object",
+    "embed",
+    "video",
+    "audio",
+    "canvas",
+    "math",
+    "picture",
+    "figure",
+    "figcaption",
+    "blockquote",
+    "dl",
+    "dt",
+    "dd",
+    "aside",
+    "details",
+    "summary",
+    "dialog",
+    "noscript",
 ]);
 const ROOT_ELEMENT_PATTERN = /^<(?:[A-Za-z_][\w.-]*:)?([A-Za-z_][\w.-]*)/;
 const EXTENSION_FALLBACK = {

package/dist/files/upload-ledger.d.ts

@@ -5,6 +5,6 @@ import type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { DbConnection } from "../db/connection.ts";
 import { type TenantDb } from "../db/tenant-db.ts";
 export declare const fileUploadLedgerTable: WritableTable;
-export declare function createFileUploadLedger(db: DbConnection | TenantDb, tenantId: TenantId): FileUploadLedger;
-export declare function withUploadLedger(resolver: (tenantId: TenantId) => Promise<FileStorageProvider>, db: DbConnection | TenantDb): FileProviderResolver;
+export declare function createFileUploadLedger(db: DbConnection | TenantDb, tenantId: TenantId, now?: () => Temporal.Instant): FileUploadLedger;
+export declare function withUploadLedger(resolver: (tenantId: TenantId) => Promise<FileStorageProvider>, db: DbConnection | TenantDb, now?: () => Temporal.Instant): FileProviderResolver;
 export declare function takeUploadLedgerEntry(txDb: TenantDb, storageKey: string): Promise<boolean>;

package/dist/files/upload-ledger.js

@@ -1,6 +1,8 @@
 import { defineUnmanagedTable } from "../db/entity-table-meta.js";
+import { runnerCanBeginTransaction } from "../db/query.js";
 import { createTenantDb } from "../db/tenant-db.js";
 import { tenantDbRunner } from "../db/tenant-db-runner.js";
+import { InternalError } from "../errors/index.js";
 const CREATED_AT_INDEX = "store_file_upload_ledger_created_at_idx";
 // One row per upload whose bytes are in storage but whose fileRef row is not committed yet. The
 // commit path deletes it inside the transaction that creates the fileRef; the sweep finds the
@@ -19,15 +21,20 @@ function isTenantDb(db) {
 }
 // The ledger writes on a connection of its own, never on a handler transaction: a rollback of the
 // handler must not take the row with it, or the bytes it uploaded would be unfindable.
-export function createFileUploadLedger(db, tenantId) {
+export function createFileUploadLedger(db, tenantId, now = () => Temporal.Now.instant()) {
     const runner = isTenantDb(db) ? tenantDbRunner(db) : db;
+    if (!runnerCanBeginTransaction(runner)) {
+        throw new InternalError({
+            message: "createFileUploadLedger: the connection is already inside a transaction; the ledger row would roll back with it and the uploaded bytes become unfindable",
+        });
+    }
     const ledgerDb = createTenantDb({ db: runner, tenantId });
     return {
         record: async (storageKey) => {
             await ledgerDb.insertOne(fileUploadLedgerTable, {
                 storageKey,
                 tenantId,
-                createdAt: Temporal.Now.instant(),
+                createdAt: now(),
             });
         },
         forget: async (storageKey) => {
@@ -35,9 +42,9 @@ export function createFileUploadLedger(db, tenantId) {
         },
     };
 }
-export function withUploadLedger(resolver, db) {
+export function withUploadLedger(resolver, db, now) {
     return Object.assign(resolver, {
-        uploadLedgerFor: (tenantId) => createFileUploadLedger(db, tenantId),
+        uploadLedgerFor: (tenantId) => createFileUploadLedger(db, tenantId, now),
     });
 }
 // Runs inside the transaction that creates the fileRef row. False means no ledger row was left to