@ditojs/server 2.89.0 → 2.91.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ditojs/server",
-  "version": "2.89.0",
+  "version": "2.91.0",
   "type": "module",
   "description": "Dito.js Server – Dito.js is a declarative and modern web framework, based on Objection.js, Koa.js and Vue.js",
   "repository": "https://github.com/ditojs/dito/tree/main/packages/server",
@@ -25,10 +25,10 @@
     "node >= 18"
   ],
   "dependencies": {
-    "@ditojs/admin": "^2.89.0",
-    "@ditojs/build": "^2.89.0",
-    "@ditojs/router": "^2.89.0",
-    "@ditojs/utils": "^2.89.0",
+    "@ditojs/admin": "^2.91.0",
+    "@ditojs/build": "^2.91.0",
+    "@ditojs/router": "^2.91.0",
+    "@ditojs/utils": "^2.91.0",
     "@koa/cors": "^5.0.0",
     "@koa/etag": "^5.0.2",
     "@koa/multer": "^4.0.0",
@@ -90,5 +90,5 @@
     "objection": "^3.1.5",
     "typescript": "^5.9.3"
   },
-  "gitHead": "9978921be041dd74026e5c8cc4e889f4ff3303c7"
+  "gitHead": "cc64039676a475376ae68b11ad1760dde5fe789c"
 }

package/src/app/Application.js

@@ -1007,9 +1007,6 @@ export class Application extends Koa {
                 }
               }
               const importedFile = await storage.addFile(file, data)
-              // Sign the imported foreign file so it passes verification when
-              // createAssets() triggers $parseJson() → convertAssetFile().
-              storage.signAssetFile(importedFile)
               await this.createAssets(storage, [importedFile], 0, transaction)
               importedFiles.push(importedFile)
               // Merge back the changed file properties into the actual file

package/src/mixins/AssetMixin.js

@@ -66,13 +66,11 @@ export const AssetMixin = mixin(
       }
 
       // @override
-      $parseJson(json, { trusted = false } = {}) {
+      $parseJson(json) {
         const { file, storage } = json
         // Convert `AssetMixin#file` to an `AssetFile` instance:
         if (file && storage) {
-          this.constructor.app
-            .getStorage(storage)
-            ?.convertAssetFile(file, { trusted })
+          this.constructor.app.getStorage(storage)?.convertAssetFile(file)
         }
         return json
       }

package/src/models/Model.js

@@ -609,11 +609,11 @@ export class Model extends objection.Model {
     }
     // Also run through normal $parseJson(), for handling of `Date` and
     // `AssetFile`.
-    return this.$parseJson(json, { trusted: true })
+    return this.$parseJson(json)
   }
 
   // @override
-  $parseJson(json, { trusted = false } = {}) {
+  $parseJson(json) {
     const { constructor } = this
     for (const key of constructor.dateAttributes) {
       const date = json[key]
@@ -634,7 +634,7 @@ export class Model extends objection.Model {
               if (isArray(data)) {
                 data.forEach(convertToAssetFiles)
               } else {
-                storage.convertAssetFile(data, { trusted })
+                storage.convertAssetFile(data)
               }
             }
           }

package/src/storage/AssetFile.js

@@ -58,8 +58,6 @@ export class AssetFile {
   }
 
   static convert(object, storage) {
-    // Signature must never be persisted.
-    delete object.signature
     Object.setPrototypeOf(object, AssetFile.prototype)
     setHiddenProperty(object, SYMBOL_STORAGE, storage)
   }

package/src/storage/Storage.js

@@ -1,13 +1,11 @@
 import path from 'path'
 import { URL } from 'url'
-import crypto from 'crypto'
 import multer from '@koa/multer'
 import picomatch from 'picomatch'
 import { PassThrough } from 'stream'
 import { readMediaAttributes } from 'leather'
 import { hyphenate, toPromiseCallback } from '@ditojs/utils'
 import { AssetFile } from './AssetFile.js'
-import { AssetError } from '../errors/AssetError.js'
 import { resolveFileUrl } from '../utils/asset.js'
 
 const storageClasses = {}
@@ -82,18 +80,7 @@ export class Storage {
     )
   }
 
-  convertAssetFile(file, { trusted = false } = {}) {
-    if (!trusted) {
-      if (this.isImportSourceAllowed(file.url)) {
-        this.signAssetFile(file)
-      } else if (!this.verifyAssetFile(file)) {
-        throw new AssetError(
-          `Invalid asset signature for file '${
-            file.name ?? file.key
-          }'`
-        )
-      }
-    }
+  convertAssetFile(file) {
     AssetFile.convert(file, this)
   }
 
@@ -107,8 +94,7 @@ export class Storage {
       url: this._getFileUrl(storageFile),
       // In case `config.readDimensions` is set:
       width: storageFile.width,
-      height: storageFile.height,
-      signature: this._signAssetKey(storageFile.key)
+      height: storageFile.height
     }
   }
 
@@ -122,7 +108,7 @@ export class Storage {
     file.url = this._getFileUrl(file)
     // TODO: Support `config.readDimensions`, but this can only be done once
     // there are separate storage instances per model assets config!
-    this.convertAssetFile(file, { trusted: true })
+    this.convertAssetFile(file)
     return file
   }
 
@@ -146,34 +132,6 @@ export class Storage {
     return this._getFileUrl(file)
   }
 
-  signAssetFile(file) {
-    file.signature = this._signAssetKey(file.key)
-  }
-
-  verifyAssetFile(file) {
-    if (file) {
-      const expected = this._signAssetKey(file.key)
-      try {
-        return crypto.timingSafeEqual(
-          Buffer.from(expected, 'hex'),
-          Buffer.from(file.signature, 'hex')
-        )
-      } catch {}
-    }
-    return false
-  }
-
-  _signAssetKey(key) {
-    const secret = (
-      this.app.keys?.[0] ??
-      (Storage._fallbackSecret ??= crypto.randomBytes(32))
-    )
-    return crypto
-      .createHmac('sha256', secret)
-      .update(key)
-      .digest('hex')
-  }
-
   _getUrl(...parts) {
     return this.url
       ? new URL(path.posix.join(...parts), this.url).toString()

package/src/utils/asset.js

@@ -1,7 +1,7 @@
 import path from 'path'
 
 export function resolveFileUrl(url) {
-  return url.startsWith('file://')
+  return url?.startsWith('file://')
     ? `file://${path.resolve(url.slice(7))}`
     : url
 }

package/src/storage/Storage.test.js

@@ -1,58 +0,0 @@
-import { Storage } from './Storage.js'
-
-function createStorage(keys = ['test-secret']) {
-  const app = { keys }
-  return new Storage(app, { name: 'test' })
-}
-
-function simulateUpload(storage, key, originalname) {
-  return storage.convertStorageFile({
-    key,
-    originalname,
-    mimetype: 'image/png',
-    size: 2048
-  })
-}
-
-describe('Storage: asset key signature verification', () => {
-  it('preserves the key through a full upload-then-save cycle', () => {
-    const storage = createStorage()
-    const uploaded = simulateUpload(storage, 'real-key.png', 'photo.png')
-    const fromClient = { ...uploaded }
-    storage.convertAssetFile(fromClient, { trusted: false })
-    expect(fromClient.key).toBe('real-key.png')
-  })
-
-  it('throws when a forged key is submitted', () => {
-    const storage = createStorage()
-    const file = { key: 'victim-key.png', name: 'photo.png' }
-    expect(() => {
-      storage.convertAssetFile(file, { trusted: false })
-    }).toThrow('Invalid asset signature')
-  })
-
-  it('throws when a valid signature is paired with a swapped key', () => {
-    const storage = createStorage()
-    const uploaded = simulateUpload(storage, 'legit.png', 'legit.png')
-    const forged = { ...uploaded, key: 'victim-file.png' }
-    expect(() => {
-      storage.convertAssetFile(forged, { trusted: false })
-    }).toThrow('Invalid asset signature')
-  })
-
-  it('does not throw when addFile() converts a server-created file', async () => {
-    const storage = createStorage()
-    const file = { key: 'imported.png', name: 'import.png' }
-    const data = Buffer.from('fake-image-data')
-    await storage.addFile(file, data)
-    expect(file.key).toBe('imported.png')
-  })
-
-  it('strips signature after conversion', () => {
-    const storage = createStorage()
-    const uploaded = simulateUpload(storage, 'upload.png', 'photo.png')
-    const fromClient = { ...uploaded }
-    storage.convertAssetFile(fromClient, { trusted: false })
-    expect('signature' in fromClient).toBe(false)
-  })
-})