@depup/payload 3.79.1-depup.0

package/dist/uploads/mimeTypeValidator.spec.js

@@ -0,0 +1,84 @@
+import { describe, it, expect } from 'vitest';
+import { mimeTypeValidator } from './mimeTypeValidator';
+const options = {
+    siblingData: {
+        filename: 'file.xyz'
+    }
+};
+describe('mimeTypeValidator', ()=>{
+    it('should validate single mimeType', ()=>{
+        const mimeTypes = [
+            'image/png'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('image/png', options)).toBe(true);
+    });
+    it('should validate multiple mimeTypes', ()=>{
+        const mimeTypes = [
+            'image/png',
+            'application/pdf'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('image/png', options)).toBe(true);
+        expect(validate('application/pdf', options)).toBe(true);
+    });
+    it('should validate using wildcard', ()=>{
+        const mimeTypes = [
+            'image/*'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('image/png', options)).toBe(true);
+        expect(validate('image/gif', options)).toBe(true);
+    });
+    it('should validate multiple wildcards', ()=>{
+        const mimeTypes = [
+            'image/*',
+            'audio/*'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('image/png', options)).toBe(true);
+        expect(validate('audio/mpeg', options)).toBe(true);
+    });
+    it('should not validate when unmatched', ()=>{
+        const mimeTypes = [
+            'image/png'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('audio/mpeg', options)).toBe("Invalid file type: 'audio/mpeg'");
+    });
+    it('should not validate when unmatched - multiple mimeTypes', ()=>{
+        const mimeTypes = [
+            'image/png',
+            'application/pdf'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('audio/mpeg', options)).toBe("Invalid file type: 'audio/mpeg'");
+    });
+    it('should not validate using wildcard - unmatched', ()=>{
+        const mimeTypes = [
+            'image/*'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('audio/mpeg', options)).toBe("Invalid file type: 'audio/mpeg'");
+    });
+    it('should not validate multiple wildcards - unmatched', ()=>{
+        const mimeTypes = [
+            'image/*',
+            'audio/*'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        expect(validate('video/mp4', options)).toBe("Invalid file type: 'video/mp4'");
+        expect(validate('application/pdf', options)).toBe("Invalid file type: 'application/pdf'");
+    });
+    it('should not error when mimeType is missing', ()=>{
+        const mimeTypes = [
+            'image/*',
+            'application/pdf'
+        ];
+        const validate = mimeTypeValidator(mimeTypes);
+        let value;
+        expect(validate(value, options)).toBe('Invalid file type');
+    });
+});
+
+//# sourceMappingURL=mimeTypeValidator.spec.js.map

package/dist/uploads/mimeTypeValidator.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/mimeTypeValidator.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport type { ValidateOptions } from '../fields/config/types'\n\nimport { mimeTypeValidator } from './mimeTypeValidator'\n\nconst options = { siblingData: { filename: 'file.xyz' } } as ValidateOptions<\n  undefined,\n  undefined,\n  undefined\n>\n\ndescribe('mimeTypeValidator', () => {\n  it('should validate single mimeType', () => {\n    const mimeTypes = ['image/png']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('image/png', options)).toBe(true)\n  })\n\n  it('should validate multiple mimeTypes', () => {\n    const mimeTypes = ['image/png', 'application/pdf']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('image/png', options)).toBe(true)\n    expect(validate('application/pdf', options)).toBe(true)\n  })\n\n  it('should validate using wildcard', () => {\n    const mimeTypes = ['image/*']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('image/png', options)).toBe(true)\n    expect(validate('image/gif', options)).toBe(true)\n  })\n\n  it('should validate multiple wildcards', () => {\n    const mimeTypes = ['image/*', 'audio/*']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('image/png', options)).toBe(true)\n    expect(validate('audio/mpeg', options)).toBe(true)\n  })\n\n  it('should not validate when unmatched', () => {\n    const mimeTypes = ['image/png']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('audio/mpeg', options)).toBe(\"Invalid file type: 'audio/mpeg'\")\n  })\n\n  it('should not validate when unmatched - multiple mimeTypes', () => {\n    const mimeTypes = ['image/png', 'application/pdf']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('audio/mpeg', options)).toBe(\"Invalid file type: 'audio/mpeg'\")\n  })\n\n  it('should not validate using wildcard - unmatched', () => {\n    const mimeTypes = ['image/*']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('audio/mpeg', options)).toBe(\"Invalid file type: 'audio/mpeg'\")\n  })\n\n  it('should not validate multiple wildcards - unmatched', () => {\n    const mimeTypes = ['image/*', 'audio/*']\n    const validate = mimeTypeValidator(mimeTypes)\n    expect(validate('video/mp4', options)).toBe(\"Invalid file type: 'video/mp4'\")\n    expect(validate('application/pdf', options)).toBe(\"Invalid file type: 'application/pdf'\")\n  })\n\n  it('should not error when mimeType is missing', () => {\n    const mimeTypes = ['image/*', 'application/pdf']\n    const validate = mimeTypeValidator(mimeTypes)\n    let value\n    expect(validate(value, options)).toBe('Invalid file type')\n  })\n})\n"],"names":["describe","it","expect","mimeTypeValidator","options","siblingData","filename","mimeTypes","validate","toBe","value"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAG7C,SAASC,iBAAiB,QAAQ,sBAAqB;AAEvD,MAAMC,UAAU;IAAEC,aAAa;QAAEC,UAAU;IAAW;AAAE;AAMxDN,SAAS,qBAAqB;IAC5BC,GAAG,mCAAmC;QACpC,MAAMM,YAAY;YAAC;SAAY;QAC/B,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,aAAaJ,UAAUK,IAAI,CAAC;IAC9C;IAEAR,GAAG,sCAAsC;QACvC,MAAMM,YAAY;YAAC;YAAa;SAAkB;QAClD,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,aAAaJ,UAAUK,IAAI,CAAC;QAC5CP,OAAOM,SAAS,mBAAmBJ,UAAUK,IAAI,CAAC;IACpD;IAEAR,GAAG,kCAAkC;QACnC,MAAMM,YAAY;YAAC;SAAU;QAC7B,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,aAAaJ,UAAUK,IAAI,CAAC;QAC5CP,OAAOM,SAAS,aAAaJ,UAAUK,IAAI,CAAC;IAC9C;IAEAR,GAAG,sCAAsC;QACvC,MAAMM,YAAY;YAAC;YAAW;SAAU;QACxC,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,aAAaJ,UAAUK,IAAI,CAAC;QAC5CP,OAAOM,SAAS,cAAcJ,UAAUK,IAAI,CAAC;IAC/C;IAEAR,GAAG,sCAAsC;QACvC,MAAMM,YAAY;YAAC;SAAY;QAC/B,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,cAAcJ,UAAUK,IAAI,CAAC;IAC/C;IAEAR,GAAG,2DAA2D;QAC5D,MAAMM,YAAY;YAAC;YAAa;SAAkB;QAClD,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,cAAcJ,UAAUK,IAAI,CAAC;IAC/C;IAEAR,GAAG,kDAAkD;QACnD,MAAMM,YAAY;YAAC;SAAU;QAC7B,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,cAAcJ,UAAUK,IAAI,CAAC;IAC/C;IAEAR,GAAG,sDAAsD;QACvD,MAAMM,YAAY;YAAC;YAAW;SAAU;QACxC,MAAMC,WAAWL,kBAAkBI;QACnCL,OAAOM,SAAS,aAAaJ,UAAUK,IAAI,CAAC;QAC5CP,OAAOM,SAAS,mBAAmBJ,UAAUK,IAAI,CAAC;IACpD;IAEAR,GAAG,6CAA6C;QAC9C,MAAMM,YAAY;YAAC;YAAW;SAAkB;QAChD,MAAMC,WAAWL,kBAAkBI;QACnC,IAAIG;QACJR,OAAOM,SAASE,OAAON,UAAUK,IAAI,CAAC;IACxC;AACF"}

package/dist/uploads/optionallyAppendMetadata.d.ts

@@ -0,0 +1,12 @@
+import type { Sharp, Metadata as SharpMetadata } from 'sharp';
+import type { PayloadRequest } from '../types/index.js';
+export type WithMetadata = ((options: {
+    metadata: SharpMetadata;
+    req: PayloadRequest;
+}) => Promise<boolean>) | boolean;
+export declare function optionallyAppendMetadata({ req, sharpFile, withMetadata, }: {
+    req: PayloadRequest;
+    sharpFile: Sharp;
+    withMetadata: WithMetadata;
+}): Promise<Sharp>;
+//# sourceMappingURL=optionallyAppendMetadata.d.ts.map

package/dist/uploads/optionallyAppendMetadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optionallyAppendMetadata.d.ts","sourceRoot":"","sources":["../../src/uploads/optionallyAppendMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,OAAO,CAAA;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,MAAM,MAAM,YAAY,GACpB,CAAC,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GACjF,OAAO,CAAA;AAEX,wBAAsB,wBAAwB,CAAC,EAC7C,GAAG,EACH,SAAS,EACT,YAAY,GACb,EAAE;IACD,GAAG,EAAE,cAAc,CAAA;IACnB,SAAS,EAAE,KAAK,CAAA;IAChB,YAAY,EAAE,YAAY,CAAA;CAC3B,GAAG,OAAO,CAAC,KAAK,CAAC,CAcjB"}

package/dist/uploads/optionallyAppendMetadata.js

@@ -0,0 +1,17 @@
+export async function optionallyAppendMetadata({ req, sharpFile, withMetadata }) {
+    const metadata = await sharpFile.metadata();
+    if (withMetadata === true) {
+        return sharpFile.withMetadata();
+    } else if (typeof withMetadata === 'function') {
+        const useMetadata = await withMetadata({
+            metadata,
+            req
+        });
+        if (useMetadata) {
+            return sharpFile.withMetadata();
+        }
+    }
+    return sharpFile;
+}
+
+//# sourceMappingURL=optionallyAppendMetadata.js.map

package/dist/uploads/optionallyAppendMetadata.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/optionallyAppendMetadata.ts"],"sourcesContent":["import type { Sharp, Metadata as SharpMetadata } from 'sharp'\n\nimport type { PayloadRequest } from '../types/index.js'\n\nexport type WithMetadata =\n  | ((options: { metadata: SharpMetadata; req: PayloadRequest }) => Promise<boolean>)\n  | boolean\n\nexport async function optionallyAppendMetadata({\n  req,\n  sharpFile,\n  withMetadata,\n}: {\n  req: PayloadRequest\n  sharpFile: Sharp\n  withMetadata: WithMetadata\n}): Promise<Sharp> {\n  const metadata = await sharpFile.metadata()\n\n  if (withMetadata === true) {\n    return sharpFile.withMetadata()\n  } else if (typeof withMetadata === 'function') {\n    const useMetadata = await withMetadata({ metadata, req })\n\n    if (useMetadata) {\n      return sharpFile.withMetadata()\n    }\n  }\n\n  return sharpFile\n}\n"],"names":["optionallyAppendMetadata","req","sharpFile","withMetadata","metadata","useMetadata"],"mappings":"AAQA,OAAO,eAAeA,yBAAyB,EAC7CC,GAAG,EACHC,SAAS,EACTC,YAAY,EAKb;IACC,MAAMC,WAAW,MAAMF,UAAUE,QAAQ;IAEzC,IAAID,iBAAiB,MAAM;QACzB,OAAOD,UAAUC,YAAY;IAC/B,OAAO,IAAI,OAAOA,iBAAiB,YAAY;QAC7C,MAAME,cAAc,MAAMF,aAAa;YAAEC;YAAUH;QAAI;QAEvD,IAAII,aAAa;YACf,OAAOH,UAAUC,YAAY;QAC/B;IACF;IAEA,OAAOD;AACT"}

package/dist/uploads/parseRangeHeader.d.ts

@@ -0,0 +1,24 @@
+export type ByteRange = {
+    end: number;
+    start: number;
+};
+export type ParseRangeResult = {
+    range: ByteRange;
+    type: 'partial';
+} | {
+    range: null;
+    type: 'full';
+} | {
+    range: null;
+    type: 'invalid';
+};
+/**
+ * Parses HTTP Range header according to RFC 7233
+ *
+ * @returns Result object indicating whether to serve full file, partial content, or invalid range
+ */
+export declare function parseRangeHeader({ fileSize, rangeHeader, }: {
+    fileSize: number;
+    rangeHeader: null | string;
+}): ParseRangeResult;
+//# sourceMappingURL=parseRangeHeader.d.ts.map

package/dist/uploads/parseRangeHeader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseRangeHeader.d.ts","sourceRoot":"","sources":["../../src/uploads/parseRangeHeader.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAEpC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,WAAW,GACZ,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,IAAI,GAAG,MAAM,CAAA;CAC3B,GAAG,gBAAgB,CAgCnB"}

package/dist/uploads/parseRangeHeader.js

@@ -0,0 +1,46 @@
+import parseRange from 'range-parser';
+/**
+ * Parses HTTP Range header according to RFC 7233
+ *
+ * @returns Result object indicating whether to serve full file, partial content, or invalid range
+ */ export function parseRangeHeader({ fileSize, rangeHeader }) {
+    // No Range header - serve full file
+    if (!rangeHeader) {
+        return {
+            type: 'full',
+            range: null
+        };
+    }
+    const result = parseRange(fileSize, rangeHeader);
+    // Invalid range syntax or unsatisfiable range
+    if (result === -1 || result === -2) {
+        return {
+            type: 'invalid',
+            range: null
+        };
+    }
+    // Must be bytes range type
+    if (result.type !== 'bytes' || result.length === 0) {
+        return {
+            type: 'invalid',
+            range: null
+        };
+    }
+    // Multi-range requests: use first range only (standard simplification)
+    const range = result[0];
+    if (!range) {
+        return {
+            type: 'invalid',
+            range: null
+        };
+    }
+    return {
+        type: 'partial',
+        range: {
+            end: range.end,
+            start: range.start
+        }
+    };
+}
+
+//# sourceMappingURL=parseRangeHeader.js.map

package/dist/uploads/parseRangeHeader.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/parseRangeHeader.ts"],"sourcesContent":["import parseRange from 'range-parser'\n\nexport type ByteRange = {\n  end: number\n  start: number\n}\n\nexport type ParseRangeResult =\n  | { range: ByteRange; type: 'partial' }\n  | { range: null; type: 'full' }\n  | { range: null; type: 'invalid' }\n\n/**\n * Parses HTTP Range header according to RFC 7233\n *\n * @returns Result object indicating whether to serve full file, partial content, or invalid range\n */\nexport function parseRangeHeader({\n  fileSize,\n  rangeHeader,\n}: {\n  fileSize: number\n  rangeHeader: null | string\n}): ParseRangeResult {\n  // No Range header - serve full file\n  if (!rangeHeader) {\n    return { type: 'full', range: null }\n  }\n\n  const result = parseRange(fileSize, rangeHeader)\n\n  // Invalid range syntax or unsatisfiable range\n  if (result === -1 || result === -2) {\n    return { type: 'invalid', range: null }\n  }\n\n  // Must be bytes range type\n  if (result.type !== 'bytes' || result.length === 0) {\n    return { type: 'invalid', range: null }\n  }\n\n  // Multi-range requests: use first range only (standard simplification)\n  const range = result[0]\n\n  if (!range) {\n    return { type: 'invalid', range: null }\n  }\n\n  return {\n    type: 'partial',\n    range: {\n      end: range.end,\n      start: range.start,\n    },\n  }\n}\n"],"names":["parseRange","parseRangeHeader","fileSize","rangeHeader","type","range","result","length","end","start"],"mappings":"AAAA,OAAOA,gBAAgB,eAAc;AAYrC;;;;CAIC,GACD,OAAO,SAASC,iBAAiB,EAC/BC,QAAQ,EACRC,WAAW,EAIZ;IACC,oCAAoC;IACpC,IAAI,CAACA,aAAa;QAChB,OAAO;YAAEC,MAAM;YAAQC,OAAO;QAAK;IACrC;IAEA,MAAMC,SAASN,WAAWE,UAAUC;IAEpC,8CAA8C;IAC9C,IAAIG,WAAW,CAAC,KAAKA,WAAW,CAAC,GAAG;QAClC,OAAO;YAAEF,MAAM;YAAWC,OAAO;QAAK;IACxC;IAEA,2BAA2B;IAC3B,IAAIC,OAAOF,IAAI,KAAK,WAAWE,OAAOC,MAAM,KAAK,GAAG;QAClD,OAAO;YAAEH,MAAM;YAAWC,OAAO;QAAK;IACxC;IAEA,uEAAuE;IACvE,MAAMA,QAAQC,MAAM,CAAC,EAAE;IAEvB,IAAI,CAACD,OAAO;QACV,OAAO;YAAED,MAAM;YAAWC,OAAO;QAAK;IACxC;IAEA,OAAO;QACLD,MAAM;QACNC,OAAO;YACLG,KAAKH,MAAMG,GAAG;YACdC,OAAOJ,MAAMI,KAAK;QACpB;IACF;AACF"}

package/dist/uploads/safeFetch.d.ts

@@ -0,0 +1,17 @@
+import { lookup } from 'dns';
+import { fetch as undiciFetch } from 'undici';
+/**
+ * @internal this is used to mock the IP `lookup` function in integration tests
+ */
+export declare const _internal_safeFetchGlobal: {
+    lookup: typeof lookup;
+};
+/**
+ * A "safe" version of undici's fetch that prevents SSRF attacks.
+ *
+ * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.
+ * - Validates domain names by resolving them to IP addresses and checking if they're safe.
+ * - Undici was used because it supported interceptors as well as "credentials: include". Native fetch
+ */
+export declare const safeFetch: (input: import("undici").RequestInfo, init?: import("undici").RequestInit | undefined) => Promise<Response>;
+//# sourceMappingURL=safeFetch.d.ts.map

package/dist/uploads/safeFetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeFetch.d.ts","sourceRoot":"","sources":["../../src/uploads/safeFetch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEpD;;GAEG;AACH,eAAO,MAAM,yBAAyB;;CAErC,CAAA;AAgDD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,4FAAoD,OAAO,CAAC,QAAQ,CA4CzF,CAAA"}

package/dist/uploads/safeFetch.js

@@ -0,0 +1,101 @@
+import { lookup } from 'dns';
+import ipaddr from 'ipaddr.js';
+import { Agent, fetch as undiciFetch } from 'undici';
+/**
+ * @internal this is used to mock the IP `lookup` function in integration tests
+ */ export const _internal_safeFetchGlobal = {
+    lookup
+};
+const isSafeIp = (ip)=>{
+    try {
+        if (!ip) {
+            return false;
+        }
+        if (!ipaddr.isValid(ip)) {
+            return false;
+        }
+        const parsedIpAddress = ipaddr.parse(ip);
+        const range = parsedIpAddress.range();
+        if (range !== 'unicast') {
+            return false // Private IP Range
+            ;
+        }
+    } catch (ignore) {
+        return false;
+    }
+    return true;
+};
+const ssrfFilterInterceptor = (hostname, options, callback)=>{
+    _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family)=>{
+        if (err) {
+            callback(err, address, family);
+        } else {
+            let ips = [];
+            if (Array.isArray(address)) {
+                ips = address.map((a)=>a.address);
+            } else {
+                ips = [
+                    address
+                ];
+            }
+            if (ips.some((ip)=>!isSafeIp(ip))) {
+                callback(new Error(`Blocked unsafe attempt to ${hostname}`), address, family);
+                return;
+            }
+            callback(null, address, family);
+        }
+    });
+};
+const safeDispatcher = new Agent({
+    connect: {
+        lookup: ssrfFilterInterceptor
+    }
+});
+/**
+ * A "safe" version of undici's fetch that prevents SSRF attacks.
+ *
+ * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.
+ * - Validates domain names by resolving them to IP addresses and checking if they're safe.
+ * - Undici was used because it supported interceptors as well as "credentials: include". Native fetch
+ */ export const safeFetch = async (...args)=>{
+    const [unverifiedUrl, options] = args;
+    try {
+        const url = new URL(unverifiedUrl);
+        let hostname = url.hostname;
+        // Strip brackets from IPv6 addresses (e.g., "[::1]" => "::1")
+        if (hostname.startsWith('[') && hostname.endsWith(']')) {
+            hostname = hostname.slice(1, -1);
+        }
+        if (ipaddr.isValid(hostname)) {
+            if (!isSafeIp(hostname)) {
+                throw new Error(`Blocked unsafe attempt to ${hostname}`);
+            }
+        }
+        return await undiciFetch(url, {
+            ...options,
+            dispatcher: safeDispatcher,
+            redirect: 'manual'
+        });
+    } catch (error) {
+        if (error instanceof Error) {
+            if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {
+                // Errors thrown from within interceptors always have 'fetch error' as the message
+                // The desired message we want to bubble up is in the cause
+                throw new Error(error.cause.message);
+            } else {
+                let stringifiedUrl = undefined;
+                if (typeof unverifiedUrl === 'string') {
+                    stringifiedUrl = unverifiedUrl;
+                } else if (unverifiedUrl instanceof URL) {
+                    stringifiedUrl = unverifiedUrl.toString();
+                } else if (unverifiedUrl instanceof Request) {
+                    stringifiedUrl = unverifiedUrl.url;
+                }
+                throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`);
+            }
+        }
+        throw error;
+    }
+};
+
+//# sourceMappingURL=safeFetch.js.map

package/dist/uploads/safeFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/safeFetch.ts"],"sourcesContent":["import type { LookupFunction } from 'net'\n\nimport { lookup } from 'dns'\nimport ipaddr from 'ipaddr.js'\nimport { Agent, fetch as undiciFetch } from 'undici'\n\n/**\n * @internal this is used to mock the IP `lookup` function in integration tests\n */\nexport const _internal_safeFetchGlobal = {\n  lookup,\n}\n\nconst isSafeIp = (ip: string) => {\n  try {\n    if (!ip) {\n      return false\n    }\n\n    if (!ipaddr.isValid(ip)) {\n      return false\n    }\n\n    const parsedIpAddress = ipaddr.parse(ip)\n    const range = parsedIpAddress.range()\n    if (range !== 'unicast') {\n      return false // Private IP Range\n    }\n  } catch (ignore) {\n    return false\n  }\n  return true\n}\n\nconst ssrfFilterInterceptor: LookupFunction = (hostname, options, callback) => {\n  _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      let ips = [] as string[]\n      if (Array.isArray(address)) {\n        ips = address.map((a) => a.address)\n      } else {\n        ips = [address]\n      }\n\n      if (ips.some((ip) => !isSafeIp(ip))) {\n        callback(new Error(`Blocked unsafe attempt to ${hostname}`), address, family)\n        return\n      }\n\n      callback(null, address, family)\n    }\n  })\n}\n\nconst safeDispatcher = new Agent({\n  connect: { lookup: ssrfFilterInterceptor },\n})\n/**\n * A \"safe\" version of undici's fetch that prevents SSRF attacks.\n *\n * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.\n * - Validates domain names by resolving them to IP addresses and checking if they're safe.\n * - Undici was used because it supported interceptors as well as \"credentials: include\". Native fetch\n */\nexport const safeFetch = async (...args: Parameters<typeof undiciFetch>): Promise<Response> => {\n  const [unverifiedUrl, options] = args\n\n  try {\n    const url = new URL(unverifiedUrl)\n\n    let hostname = url.hostname\n\n    // Strip brackets from IPv6 addresses (e.g., \"[::1]\" => \"::1\")\n    if (hostname.startsWith('[') && hostname.endsWith(']')) {\n      hostname = hostname.slice(1, -1)\n    }\n\n    if (ipaddr.isValid(hostname)) {\n      if (!isSafeIp(hostname)) {\n        throw new Error(`Blocked unsafe attempt to ${hostname}`)\n      }\n    }\n    return (await undiciFetch(url, {\n      ...options,\n      dispatcher: safeDispatcher,\n      redirect: 'manual', // Prevent automatic redirects\n    })) as unknown as Response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {\n        // Errors thrown from within interceptors always have 'fetch error' as the message\n        // The desired message we want to bubble up is in the cause\n        throw new Error(error.cause.message)\n      } else {\n        let stringifiedUrl: string | undefined = undefined\n        if (typeof unverifiedUrl === 'string') {\n          stringifiedUrl = unverifiedUrl\n        } else if (unverifiedUrl instanceof URL) {\n          stringifiedUrl = unverifiedUrl.toString()\n        } else if (unverifiedUrl instanceof Request) {\n          stringifiedUrl = unverifiedUrl.url\n        }\n\n        throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`)\n      }\n    }\n    throw error\n  }\n}\n"],"names":["lookup","ipaddr","Agent","fetch","undiciFetch","_internal_safeFetchGlobal","isSafeIp","ip","isValid","parsedIpAddress","parse","range","ignore","ssrfFilterInterceptor","hostname","options","callback","err","address","family","ips","Array","isArray","map","a","some","Error","safeDispatcher","connect","safeFetch","args","unverifiedUrl","url","URL","startsWith","endsWith","slice","dispatcher","redirect","error","cause","message","includes","stringifiedUrl","undefined","toString","Request"],"mappings":"AAEA,SAASA,MAAM,QAAQ,MAAK;AAC5B,OAAOC,YAAY,YAAW;AAC9B,SAASC,KAAK,EAAEC,SAASC,WAAW,QAAQ,SAAQ;AAEpD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IACvCL;AACF,EAAC;AAED,MAAMM,WAAW,CAACC;IAChB,IAAI;QACF,IAAI,CAACA,IAAI;YACP,OAAO;QACT;QAEA,IAAI,CAACN,OAAOO,OAAO,CAACD,KAAK;YACvB,OAAO;QACT;QAEA,MAAME,kBAAkBR,OAAOS,KAAK,CAACH;QACrC,MAAMI,QAAQF,gBAAgBE,KAAK;QACnC,IAAIA,UAAU,WAAW;YACvB,OAAO,MAAM,mBAAmB;;QAClC;IACF,EAAE,OAAOC,QAAQ;QACf,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAMC,wBAAwC,CAACC,UAAUC,SAASC;IAChEX,0BAA0BL,MAAM,CAACc,UAAUC,SAAS,CAACE,KAAKC,SAASC;QACjE,IAAIF,KAAK;YACPD,SAASC,KAAKC,SAASC;QACzB,OAAO;YACL,IAAIC,MAAM,EAAE;YACZ,IAAIC,MAAMC,OAAO,CAACJ,UAAU;gBAC1BE,MAAMF,QAAQK,GAAG,CAAC,CAACC,IAAMA,EAAEN,OAAO;YACpC,OAAO;gBACLE,MAAM;oBAACF;iBAAQ;YACjB;YAEA,IAAIE,IAAIK,IAAI,CAAC,CAAClB,KAAO,CAACD,SAASC,MAAM;gBACnCS,SAAS,IAAIU,MAAM,CAAC,0BAA0B,EAAEZ,UAAU,GAAGI,SAASC;gBACtE;YACF;YAEAH,SAAS,MAAME,SAASC;QAC1B;IACF;AACF;AAEA,MAAMQ,iBAAiB,IAAIzB,MAAM;IAC/B0B,SAAS;QAAE5B,QAAQa;IAAsB;AAC3C;AACA;;;;;;CAMC,GACD,OAAO,MAAMgB,YAAY,OAAO,GAAGC;IACjC,MAAM,CAACC,eAAehB,QAAQ,GAAGe;IAEjC,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIF;QAEpB,IAAIjB,WAAWkB,IAAIlB,QAAQ;QAE3B,8DAA8D;QAC9D,IAAIA,SAASoB,UAAU,CAAC,QAAQpB,SAASqB,QAAQ,CAAC,MAAM;YACtDrB,WAAWA,SAASsB,KAAK,CAAC,GAAG,CAAC;QAChC;QAEA,IAAInC,OAAOO,OAAO,CAACM,WAAW;YAC5B,IAAI,CAACR,SAASQ,WAAW;gBACvB,MAAM,IAAIY,MAAM,CAAC,0BAA0B,EAAEZ,UAAU;YACzD;QACF;QACA,OAAQ,MAAMV,YAAY4B,KAAK;YAC7B,GAAGjB,OAAO;YACVsB,YAAYV;YACZW,UAAU;QACZ;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBb,OAAO;YAC1B,IAAIa,MAAMC,KAAK,YAAYd,SAASa,MAAMC,KAAK,CAACC,OAAO,CAACC,QAAQ,CAAC,WAAW;gBAC1E,kFAAkF;gBAClF,2DAA2D;gBAC3D,MAAM,IAAIhB,MAAMa,MAAMC,KAAK,CAACC,OAAO;YACrC,OAAO;gBACL,IAAIE,iBAAqCC;gBACzC,IAAI,OAAOb,kBAAkB,UAAU;oBACrCY,iBAAiBZ;gBACnB,OAAO,IAAIA,yBAAyBE,KAAK;oBACvCU,iBAAiBZ,cAAcc,QAAQ;gBACzC,OAAO,IAAId,yBAAyBe,SAAS;oBAC3CH,iBAAiBZ,cAAcC,GAAG;gBACpC;gBAEA,MAAM,IAAIN,MAAM,CAAC,qBAAqB,EAAEiB,eAAe,EAAE,EAAEJ,MAAME,OAAO,EAAE;YAC5E;QACF;QACA,MAAMF;IACR;AACF,EAAC"}

package/dist/uploads/saveBufferToFile.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Save buffer data to a file.
+ * @param {Buffer} buffer - buffer to save to a file.
+ * @param {string} filePath - path to a file.
+ */
+export declare const saveBufferToFile: (buffer: Buffer, filePath: string) => Promise<void>;
+//# sourceMappingURL=saveBufferToFile.d.ts.map

package/dist/uploads/saveBufferToFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saveBufferToFile.d.ts","sourceRoot":"","sources":["../../src/uploads/saveBufferToFile.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,WAAkB,MAAM,YAAY,MAAM,KAAG,OAAO,CAAC,IAAI,CAUrF,CAAA"}

package/dist/uploads/saveBufferToFile.js

@@ -0,0 +1,19 @@
+import fs from 'fs/promises';
+import { Readable } from 'stream';
+/**
+ * Save buffer data to a file.
+ * @param {Buffer} buffer - buffer to save to a file.
+ * @param {string} filePath - path to a file.
+ */ export const saveBufferToFile = async (buffer, filePath)=>{
+    // Setup readable stream from buffer.
+    let streamData = buffer;
+    const readStream = new Readable();
+    readStream._read = ()=>{
+        readStream.push(streamData);
+        streamData = null;
+    };
+    // Setup file system writable stream.
+    return await fs.writeFile(filePath, buffer);
+};
+
+//# sourceMappingURL=saveBufferToFile.js.map

package/dist/uploads/saveBufferToFile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/saveBufferToFile.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport { Readable } from 'stream'\n\n/**\n * Save buffer data to a file.\n * @param {Buffer} buffer - buffer to save to a file.\n * @param {string} filePath - path to a file.\n */\nexport const saveBufferToFile = async (buffer: Buffer, filePath: string): Promise<void> => {\n  // Setup readable stream from buffer.\n  let streamData = buffer\n  const readStream = new Readable()\n  readStream._read = () => {\n    readStream.push(streamData)\n    streamData = null!\n  }\n  // Setup file system writable stream.\n  return await fs.writeFile(filePath, buffer)\n}\n"],"names":["fs","Readable","saveBufferToFile","buffer","filePath","streamData","readStream","_read","push","writeFile"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,SAASC,QAAQ,QAAQ,SAAQ;AAEjC;;;;CAIC,GACD,OAAO,MAAMC,mBAAmB,OAAOC,QAAgBC;IACrD,qCAAqC;IACrC,IAAIC,aAAaF;IACjB,MAAMG,aAAa,IAAIL;IACvBK,WAAWC,KAAK,GAAG;QACjBD,WAAWE,IAAI,CAACH;QAChBA,aAAa;IACf;IACA,qCAAqC;IACrC,OAAO,MAAML,GAAGS,SAAS,CAACL,UAAUD;AACtC,EAAC"}

package/dist/uploads/tempFile.d.ts

@@ -0,0 +1,7 @@
+type Options = {
+    extension?: string;
+    name?: string;
+};
+export declare const temporaryFileTask: (callback: (temporaryPath: string) => Promise<any>, options?: Options) => Promise<any>;
+export {};
+//# sourceMappingURL=tempFile.d.ts.map

package/dist/uploads/tempFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tempFile.d.ts","sourceRoot":"","sources":["../../src/uploads/tempFile.ts"],"names":[],"mappings":"AAaA,KAAK,OAAO,GAAG;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,eAAO,MAAM,iBAAiB,aAClB,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,YACxC,OAAO,iBAIjB,CAAA"}

package/dist/uploads/tempFile.js

@@ -0,0 +1,39 @@
+import fs from 'fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { v4 as uuid } from 'uuid';
+async function runTask(temporaryPath, callback) {
+    try {
+        return await callback(temporaryPath);
+    } finally{
+        await fs.rm(temporaryPath, {
+            force: true,
+            maxRetries: 2,
+            recursive: true
+        });
+    }
+}
+export const temporaryFileTask = async (callback, options = {})=>{
+    const filePath = await temporaryFile(options);
+    return runTask(filePath, callback);
+};
+async function temporaryFile(options) {
+    if (options.name) {
+        if (options.extension !== undefined && options.extension !== null) {
+            throw new Error('The `name` and `extension` options are mutually exclusive');
+        }
+        return path.join(await temporaryDirectory(), options.name);
+    }
+    return await getPath() + (options.extension === undefined || options.extension === null ? '' : '.' + options.extension.replace(/^\./, ''));
+}
+async function temporaryDirectory({ prefix = '' } = {}) {
+    const directory = await getPath(prefix);
+    await fs.mkdir(directory);
+    return directory;
+}
+async function getPath(prefix = '') {
+    const temporaryDirectory = await fs.realpath(os.tmpdir());
+    return path.join(temporaryDirectory, prefix + uuid());
+}
+
+//# sourceMappingURL=tempFile.js.map

package/dist/uploads/tempFile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/tempFile.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { v4 as uuid } from 'uuid'\n\nasync function runTask(temporaryPath: string, callback: (temporaryPath: string) => Promise<any>) {\n  try {\n    return await callback(temporaryPath)\n  } finally {\n    await fs.rm(temporaryPath, { force: true, maxRetries: 2, recursive: true })\n  }\n}\n\ntype Options = {\n  extension?: string\n  name?: string\n}\n\nexport const temporaryFileTask = async (\n  callback: (temporaryPath: string) => Promise<any>,\n  options: Options = {},\n) => {\n  const filePath = await temporaryFile(options)\n  return runTask(filePath, callback)\n}\n\nasync function temporaryFile(options: Options) {\n  if (options.name) {\n    if (options.extension !== undefined && options.extension !== null) {\n      throw new Error('The `name` and `extension` options are mutually exclusive')\n    }\n\n    return path.join(await temporaryDirectory(), options.name)\n  }\n\n  return (\n    (await getPath()) +\n    (options.extension === undefined || options.extension === null\n      ? ''\n      : '.' + options.extension.replace(/^\\./, ''))\n  )\n}\n\nasync function temporaryDirectory({ prefix = '' } = {}) {\n  const directory = await getPath(prefix)\n  await fs.mkdir(directory)\n  return directory\n}\n\nasync function getPath(prefix = ''): Promise<string> {\n  const temporaryDirectory = await fs.realpath(os.tmpdir())\n  return path.join(temporaryDirectory, prefix + uuid())\n}\n"],"names":["fs","os","path","v4","uuid","runTask","temporaryPath","callback","rm","force","maxRetries","recursive","temporaryFileTask","options","filePath","temporaryFile","name","extension","undefined","Error","join","temporaryDirectory","getPath","replace","prefix","directory","mkdir","realpath","tmpdir"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,QAAQ,UAAS;AACxB,OAAOC,UAAU,YAAW;AAC5B,SAASC,MAAMC,IAAI,QAAQ,OAAM;AAEjC,eAAeC,QAAQC,aAAqB,EAAEC,QAAiD;IAC7F,IAAI;QACF,OAAO,MAAMA,SAASD;IACxB,SAAU;QACR,MAAMN,GAAGQ,EAAE,CAACF,eAAe;YAAEG,OAAO;YAAMC,YAAY;YAAGC,WAAW;QAAK;IAC3E;AACF;AAOA,OAAO,MAAMC,oBAAoB,OAC/BL,UACAM,UAAmB,CAAC,CAAC;IAErB,MAAMC,WAAW,MAAMC,cAAcF;IACrC,OAAOR,QAAQS,UAAUP;AAC3B,EAAC;AAED,eAAeQ,cAAcF,OAAgB;IAC3C,IAAIA,QAAQG,IAAI,EAAE;QAChB,IAAIH,QAAQI,SAAS,KAAKC,aAAaL,QAAQI,SAAS,KAAK,MAAM;YACjE,MAAM,IAAIE,MAAM;QAClB;QAEA,OAAOjB,KAAKkB,IAAI,CAAC,MAAMC,sBAAsBR,QAAQG,IAAI;IAC3D;IAEA,OACE,AAAC,MAAMM,YACNT,CAAAA,QAAQI,SAAS,KAAKC,aAAaL,QAAQI,SAAS,KAAK,OACtD,KACA,MAAMJ,QAAQI,SAAS,CAACM,OAAO,CAAC,OAAO,GAAE;AAEjD;AAEA,eAAeF,mBAAmB,EAAEG,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IACpD,MAAMC,YAAY,MAAMH,QAAQE;IAChC,MAAMxB,GAAG0B,KAAK,CAACD;IACf,OAAOA;AACT;AAEA,eAAeH,QAAQE,SAAS,EAAE;IAChC,MAAMH,qBAAqB,MAAMrB,GAAG2B,QAAQ,CAAC1B,GAAG2B,MAAM;IACtD,OAAO1B,KAAKkB,IAAI,CAACC,oBAAoBG,SAASpB;AAChD"}