@critical-path/core 0.34.0 → 0.36.0

package/src/engine/index.ts

@@ -97,7 +97,7 @@ import { validateCustomFieldValues, validateCustomFieldDefinitions } from '../do
 import { detectDependencyCycle, CircularDependencyError } from '../domain/graph.js';
 import { ValidationError, NotFoundError, ForbiddenError } from '../domain/errors.js';
 import { WebhookDispatcher, assertWebhookUrl } from '../webhooks/dispatcher.js';
-import { buildStorageKey } from '../storage/file-storage.js';
+import { buildStorageKey, normalizeUploadData } from '../storage/file-storage.js';
 import { generateWebhookSecret } from '../webhooks/signature.js';
 import type { DomainEvent } from '../domain/events.js';
 import { calculateCPM, type CPMOptions } from '../domain/cpm.js';
@@ -1595,6 +1595,7 @@ export class CriticalPathEngine {
     input: Omit<Attachment, 'id' | 'createdAt' | 'updatedAt' | 'uploaderId'> & { uploaderId?: string }
   ): Promise<Attachment> {
     await this.requireAttachmentCreate(input);
+    this.assertUploadAllowed(input.mimeType, input.sizeBytes);
     if (this.actor) await this.assertStorageKeyBelongs(input);
     const attachment: Omit<Attachment, 'id' | 'createdAt' | 'updatedAt'> = this.actor
       ? { ...input, uploaderId: this.actor.userId, uploaderType: this.actor.actorType ?? 'user' }
@@ -1676,9 +1677,13 @@ export class CriticalPathEngine {
       throw new ValidationError('Attachments must reference a project, task or comment.');
     }
 
+    // Decode once so limits apply to the real byte size, then hand the bytes to the adapter.
+    const data = normalizeUploadData(input.data, input.encoding, input.mimeType);
+    this.assertUploadAllowed(input.mimeType || 'application/octet-stream', data.byteLength);
+
     const uploadResult = await this.fileStorage.upload({
       filename: input.filename,
-      data: input.data,
+      data,
       mimeType: input.mimeType,
       pathPrefix: projectId && (this.actor || !input.pathPrefix) ? `projects/${projectId}` : input.pathPrefix
     });
@@ -1747,6 +1752,7 @@ export class CriticalPathEngine {
       throw new Error('Presigned uploads are not supported by the configured FileStorageAdapter.');
     }
     if (!options.projectId) throw new ValidationError('projectId is required for presigned uploads.');
+    this.assertUploadAllowed(options.contentType ?? 'application/octet-stream');
     if (this.enforcing) {
       await this.requireProjectAccess('attachment.create', options.projectId);
     } else if (!(await this.store.getProject(options.projectId))) {
@@ -1759,6 +1765,23 @@ export class CriticalPathEngine {
     });
   }
 
+  /** Enforces `config.uploads` (MIME allow-list with `type/*` wildcards, and maximum size). */
+  private assertUploadAllowed(mimeType: string, sizeBytes?: number): void {
+    const limits = this.config.uploads;
+    if (!limits) return;
+    if (limits.maxBytes !== undefined && sizeBytes !== undefined && sizeBytes > limits.maxBytes) {
+      throw new ValidationError(`File is ${sizeBytes} bytes; the maximum is ${limits.maxBytes} bytes.`);
+    }
+    if (limits.allowedMimeTypes) {
+      const type = mimeType.split(';')[0].trim().toLowerCase();
+      const allowed = limits.allowedMimeTypes.some((pattern) => {
+        const p = pattern.toLowerCase();
+        return p.endsWith('/*') ? type.startsWith(p.slice(0, -1)) : type === p;
+      });
+      if (!allowed) throw new ValidationError(`File type "${type}" is not allowed.`);
+    }
+  }
+
   /**
    * A caller-supplied `storageKey` must live under the attachment's project prefix, because
    * deleting the attachment deletes that file: otherwise anyone could register, then delete,

package/src/storage/upload-limits.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect } from 'vitest';
+import { CriticalPathEngine, InMemoryFileStore, ValidationError } from '../index.js';
+
+async function setup() {
+  const engine = new CriticalPathEngine({
+    fileStorage: new InMemoryFileStore(),
+    uploads: { maxBytes: 10, allowedMimeTypes: ['image/*', 'application/pdf'] }
+  });
+  const project = await engine.createProject({ name: 'Limits' });
+  return { engine, project };
+}
+
+describe('upload limits', () => {
+  it('enforces the decoded size of direct uploads', async () => {
+    const { engine, project } = await setup();
+    await expect(
+      engine.uploadAttachmentFile({ projectId: project.id, filename: 'ok.png', mimeType: 'image/png', data: new Uint8Array(10), uploaderId: 'u' })
+    ).resolves.toMatchObject({ sizeBytes: 10 });
+    // 16 base64 characters decode to 12 bytes
+    await expect(
+      engine.uploadAttachmentFile({ projectId: project.id, filename: 'big.png', mimeType: 'image/png', data: 'AAAAAAAAAAAAAAAA', encoding: 'base64', uploaderId: 'u' })
+    ).rejects.toThrow(/maximum is 10 bytes/);
+  });
+
+  it('allows MIME types by exact match or wildcard', async () => {
+    const { engine, project } = await setup();
+    const upload = (mimeType: string) =>
+      engine.uploadAttachmentFile({ projectId: project.id, filename: 'f', mimeType, data: new Uint8Array(1), uploaderId: 'u' });
+    await expect(upload('image/webp')).resolves.toBeDefined();
+    await expect(upload('application/pdf; charset=binary')).resolves.toBeDefined();
+    await expect(upload('text/html')).rejects.toThrow(ValidationError);
+  });
+
+  it('applies to presigned uploads and registered attachments', async () => {
+    const { engine, project } = await setup();
+    await expect(engine.getPresignedAttachmentUploadUrl({ projectId: project.id, filename: 'x.html', contentType: 'text/html' })).rejects.toThrow(/not allowed/);
+    await expect(
+      engine.createAttachment({ projectId: project.id, filename: 'x', url: 'https://e.com/x', mimeType: 'image/png', sizeBytes: 11, uploaderId: 'u' })
+    ).rejects.toThrow(/maximum/);
+  });
+});

package/src/store/firebase.ts

@@ -56,14 +56,14 @@ export class InMemoryFirestoreMock implements FirestoreDBInterface {
             return {
               exists: !!data,
               id: docId,
-              data: () => data
+              data: () => structuredClone(data)
             };
           },
           async set(data: any, options?: { merge?: boolean }) {
             if (options?.merge && colMap.has(docId)) {
-              colMap.set(docId, { ...colMap.get(docId), ...data });
+              colMap.set(docId, structuredClone({ ...colMap.get(docId), ...data }));
             } else {
-              colMap.set(docId, data);
+              colMap.set(docId, structuredClone(data));
             }
           },
           async delete() {
@@ -74,7 +74,7 @@ export class InMemoryFirestoreMock implements FirestoreDBInterface {
       async get() {
         const docs = Array.from(colMap.entries()).map(([id, data]) => ({
           id,
-          data: () => data
+          data: () => structuredClone(data)
         }));
         return { docs };
       },
@@ -88,7 +88,7 @@ export class InMemoryFirestoreMock implements FirestoreDBInterface {
               })
               .map(([id, data]) => ({
                 id,
-                data: () => data
+                data: () => structuredClone(data)
               }));
             return { docs };
           }

package/src/store/index.ts

@@ -148,6 +148,10 @@ export interface StorageAdapter
     DependencyRepository,
     WebhookRepository {}
 
+/**
+ * Map-backed store for development and tests. Reads and writes are deep-copied, so it behaves
+ * like a database: returned records can be mutated freely without affecting stored state.
+ */
 export class InMemoryStore implements StorageAdapter {
   private projects = new Map<string, Project>();
   private workflows = new Map<string, Workflow>();
@@ -163,6 +167,19 @@ export class InMemoryStore implements StorageAdapter {
   private dependencies = new Map<string, TaskDependency>();
   private webhooks = new Map<string, Webhook>();
 
+  constructor() {
+    // Hand out copies: callers mutating a returned record (or an input they keep using) must not
+    // change what is stored, matching the database-backed adapters. Internal calls between
+    // methods use the unwrapped instance, so each call clones only at the boundary.
+    return new Proxy(this, {
+      get(target, property, receiver) {
+        const value = Reflect.get(target, property, receiver);
+        if (typeof value !== 'function' || property === 'constructor') return value;
+        return async (...args: unknown[]) => structuredClone(await value.apply(target, structuredClone(args)));
+      }
+    });
+  }
+
   async getProjects(): Promise<Project[]> {
     return Array.from(this.projects.values());
   }

package/src/testing/conformance.ts

@@ -140,6 +140,24 @@ export function runStorageAdapterConformance({ name, createStore, describe, it,
       expect(updated.parentId === null).toBe(false);
     });
 
+    it('returns copies, so mutating results or reused inputs does not change stored records', async () => {
+      const store = await createStore();
+      const project = await store.createProject({ name: 'P' });
+      const input = { projectId: project.id, title: 'Original', status: 'todo', priority: 'medium', tags: ['a'] };
+      const created = await store.createTask(input);
+
+      input.tags.push('mutated-input');
+      input.title = 'Mutated input';
+      const fetched = (await store.getTask(created.id))!;
+      fetched.tags!.push('mutated-result');
+      fetched.title = 'Mutated result';
+      (await store.getTasks(project.id))[0].title = 'Mutated list';
+
+      const stored = await store.getTask(created.id);
+      expect(stored?.title).toBe('Original');
+      expect(stored?.tags).toEqual(['a']);
+    });
+
     it('follows the not-found contract', async () => {
       const store = await createStore();
       expect(await store.getProject('missing')).toBeNull();

package/src/types/index.ts

@@ -378,6 +378,16 @@ export interface UploadFileInput {
   encoding?: 'base64' | 'utf-8' | 'binary';
 }
 
+export interface UploadLimits {
+  /** Largest accepted upload in bytes. Applies to direct uploads and declared `sizeBytes`. */
+  maxBytes?: number;
+  /**
+   * Accepted MIME types; entries may end in `/*` (e.g. `image/*`). Applies to uploads, presigned
+   * uploads and registered attachments. Default: any type.
+   */
+  allowedMimeTypes?: string[];
+}
+
 export interface UploadFileResult {
   storageKey: string;
   url: string;
@@ -542,6 +552,8 @@ export interface CriticalPathConfig {
   plugins?: CriticalPathPlugin[];
   /** Static webhooks (not stored or editable through the API). */
   webhooks?: Omit<Webhook, 'id' | 'createdAt'>[];
+  /** Limits applied to attachment uploads, presigned uploads and attachment registration. */
+  uploads?: UploadLimits;
   /** Delivery behaviour: queue, timeouts, retries, private URL policy, failure callbacks. */
   webhookDelivery?: import('../webhooks/dispatcher.js').WebhookDeliveryOptions;
   defaultSchedule?: WorkSchedule;

package/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/deliverables.test.ts","./src/index.test.ts","./src/index.ts","./src/status.test.ts","./src/task-state.test.ts","./src/use-case-validation.test.ts","./src/domain/authorization.ts","./src/domain/calendar.test.ts","./src/domain/calendar.ts","./src/domain/cpm.test.ts","./src/domain/cpm.ts","./src/domain/custom-fields.ts","./src/domain/ddd.test.ts","./src/domain/entities.ts","./src/domain/errors.ts","./src/domain/events.ts","./src/domain/graph.ts","./src/domain/index.ts","./src/domain/ladder.test.ts","./src/domain/ladder.ts","./src/domain/metrics.test.ts","./src/domain/metrics.ts","./src/domain/task-duration.test.ts","./src/domain/workload.test.ts","./src/domain/workload.ts","./src/engine/actor.test.ts","./src/engine/authorization.test.ts","./src/engine/cascade.test.ts","./src/engine/config.test.ts","./src/engine/entity-events.test.ts","./src/engine/index.ts","./src/plugins/index.ts","./src/plugins/plugins.test.ts","./src/schemas/index.ts","./src/schemas/schemas.test.ts","./src/storage/file-storage.ts","./src/storage/firebase-storage.ts","./src/storage/index.ts","./src/storage/s3.ts","./src/storage/storage.test.ts","./src/store/conformance.test.ts","./src/store/firebase.test.ts","./src/store/firebase.ts","./src/store/index.ts","./src/store/query.test.ts","./src/store/query.ts","./src/store/sqlite.test.ts","./src/store/sqlite.ts","./src/testing/conformance.ts","./src/testing/index.ts","./src/types/index.ts","./src/utils/fractional-index.test.ts","./src/utils/fractional-index.ts","./src/utils/index.ts","./src/utils/key.test.ts","./src/utils/key.ts","./src/utils/mentions.test.ts","./src/utils/mentions.ts","./src/utils/status.ts","./src/utils/workflow.ts","./src/webhooks/dispatcher.ts","./src/webhooks/index.ts","./src/webhooks/signature.ts","./src/webhooks/webhooks.test.ts"],"version":"5.9.3"}
+{"root":["./src/deliverables.test.ts","./src/index.test.ts","./src/index.ts","./src/status.test.ts","./src/task-state.test.ts","./src/use-case-validation.test.ts","./src/domain/authorization.ts","./src/domain/calendar.test.ts","./src/domain/calendar.ts","./src/domain/cpm.test.ts","./src/domain/cpm.ts","./src/domain/custom-fields.ts","./src/domain/ddd.test.ts","./src/domain/entities.ts","./src/domain/errors.ts","./src/domain/events.ts","./src/domain/graph.ts","./src/domain/index.ts","./src/domain/ladder.test.ts","./src/domain/ladder.ts","./src/domain/metrics.test.ts","./src/domain/metrics.ts","./src/domain/task-duration.test.ts","./src/domain/workload.test.ts","./src/domain/workload.ts","./src/engine/actor.test.ts","./src/engine/authorization.test.ts","./src/engine/cascade.test.ts","./src/engine/config.test.ts","./src/engine/entity-events.test.ts","./src/engine/index.ts","./src/plugins/index.ts","./src/plugins/plugins.test.ts","./src/schemas/index.ts","./src/schemas/schemas.test.ts","./src/storage/file-storage.ts","./src/storage/firebase-storage.ts","./src/storage/index.ts","./src/storage/s3.ts","./src/storage/storage.test.ts","./src/storage/upload-limits.test.ts","./src/store/conformance.test.ts","./src/store/firebase.test.ts","./src/store/firebase.ts","./src/store/index.ts","./src/store/query.test.ts","./src/store/query.ts","./src/store/sqlite.test.ts","./src/store/sqlite.ts","./src/testing/conformance.ts","./src/testing/index.ts","./src/types/index.ts","./src/utils/fractional-index.test.ts","./src/utils/fractional-index.ts","./src/utils/index.ts","./src/utils/key.test.ts","./src/utils/key.ts","./src/utils/mentions.test.ts","./src/utils/mentions.ts","./src/utils/status.ts","./src/utils/workflow.ts","./src/webhooks/dispatcher.ts","./src/webhooks/index.ts","./src/webhooks/signature.ts","./src/webhooks/webhooks.test.ts"],"version":"5.9.3"}