@easy-cms/core 0.40.0 → 0.41.0

package/dist/index.d.ts

@@ -1047,6 +1047,17 @@ declare class MediaFolders {
         id: ID;
         private: boolean;
     }[]>;
+    /**
+     * The privacy each folder of a subtree would have after a change to its top folder: made
+     * private or public, moved, or (as `private: false`) deleted with its contents moving up.
+     */
+    privacyAfter(id: ID, change: {
+        private?: boolean;
+        parent?: ID | null;
+    }): Promise<{
+        id: ID;
+        private: boolean;
+    }[]>;
     /**
      * The folder with this key (`folder: 'banners'` on upload fields), made at the top level when
      * there is none yet.
@@ -1103,6 +1114,28 @@ interface StorageAdapter {
      * (`<api>/media/file/<key>`), as the local adapter does.
      */
     url?(key: string): string | undefined;
+    /**
+     * Lets a browser send a file straight to the storage (large files, past a host's request
+     * limit): where to send it and how. The URL must work for `expiresIn` seconds and accept at
+     * most `size` bytes. Without it, files are uploaded through the server.
+     */
+    uploadURL?(key: string, options: {
+        contentType: string;
+        size: number;
+        expiresIn: number;
+    }): Promise<DirectUpload>;
+    /**
+     * The first `bytes` of a file and its whole size, without reading it all (to check a file
+     * uploaded straight to the storage); `null` when there is no such file. Default: `get`.
+     */
+    getStart?(key: string, bytes: number): Promise<StoredFile | null>;
+}
+/** Where and how a browser sends a file straight to the storage (`StorageAdapter.uploadURL`). */
+interface DirectUpload {
+    readonly url: string;
+    readonly method: 'PUT' | 'POST';
+    /** Headers to send with the file. */
+    readonly headers: Readonly<Record<string, string>>;
 }
 interface LocalStorageOptions {
     /** Directory, relative to the project root. Default `uploads`. */
@@ -1254,6 +1287,32 @@ declare class EasyCMS<C extends Config = Config> {
         data: Uint8Array;
         name: string;
     }, data?: Record<string, unknown>, options?: DepthOptions): Promise<MediaDocument>;
+    /**
+     * Starts an upload straight to the storage, for files too large to send through the server
+     * (`POST <api>/media/uploads`): checks who uploads what where, as `upload()` does, and returns
+     * a signed ticket and where to send the file. `upload` is `null` when the storage can't take
+     * files directly: send it to `upload()` instead. Then `completeUpload(ticket)`.
+     */
+    createUpload(file: {
+        name: string;
+        size: number;
+        type?: string;
+    }, data?: Record<string, unknown>, options?: AccessOptions): Promise<{
+        ticket: string;
+        upload: DirectUpload | null;
+    }>;
+    /**
+     * Finishes an upload made with `createUpload()` (`POST <api>/media/uploads/complete`): checks
+     * the file in the storage like any upload (its size, and its type from its contents), then
+     * makes its media document. A file that fails is deleted.
+     */
+    completeUpload(ticket: string, options?: DepthOptions): Promise<MediaDocument>;
+    /** Who may upload, and into which folder: `upload()` and direct uploads. */
+    private checkUpload;
+    /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
+    private sign;
+    /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
+    private verify;
     /**
      * Downloads a file from an `http(s)` link and uploads it like `upload()`. Private network
      * addresses are refused unless `upload.fromURL.allowPrivate`. Calls on behalf of a user (the
@@ -1307,6 +1366,11 @@ declare class EasyCMS<C extends Config = Config> {
     private relocate;
     /** A folder's name, parent and permissions; private only with somewhere private to keep files. */
     private validateFolder;
+    /**
+     * Refuses a change that would move more than 200 files between storages in one request: they
+     * are copied one by one, which could outlast a serverless function.
+     */
+    private checkMoveLimit;
     /** After a folder became private or public (or moved): its files follow, in every subfolder. */
     private settlePrivacy;
     /** Files at the top level are public. */
@@ -3231,4 +3295,4 @@ declare function validateConfig(config: Config): ConfigIssue[];
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinMediaFoldersCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIME_GROUPS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, expandMimeTypes, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinMediaFoldersCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DirectUpload, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIME_GROUPS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, expandMimeTypes, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };

package/dist/index.js

@@ -1095,6 +1095,12 @@ function imageDimensions(data, type) {
   }
   return void 0;
 }
+function typeFromName(name) {
+  const extension = /\.([a-z0-9]+)$/i.exec(name)?.[1]?.toLowerCase();
+  if (!extension) return void 0;
+  if (extension === "jpeg") return "image/jpeg";
+  return Object.entries(EXTENSIONS).find(([, ext]) => ext === extension)?.[0];
+}
 function storageKey(originalName, type, random2) {
   const name = originalName.split(/[\\/]/).pop() ?? "";
   const base = name.replace(/(?<=.)\.[^.]*$/, "").normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
@@ -5460,6 +5466,21 @@ var MediaFolders = class {
     const rows = await this.fresh();
     return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
   }
+  /**
+   * The privacy each folder of a subtree would have after a change to its top folder: made
+   * private or public, moved, or (as `private: false`) deleted with its contents moving up.
+   */
+  async privacyAfter(id, change) {
+    const rows = new Map(await this.fresh());
+    const row = rows.get(String(id));
+    if (!row) return [];
+    rows.set(String(id), {
+      ...row,
+      ...change.private !== void 0 ? { private: change.private } : {},
+      ...change.parent !== void 0 ? { parent: change.parent } : {}
+    });
+    return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
+  }
   /**
    * The folder with this key (`folder: 'banners'` on upload fields), made at the top level when
    * there is none yet.
@@ -6059,12 +6080,7 @@ var EasyCMS = class {
   async upload(file, data = {}, options = {}) {
     const config = this.collection(MEDIA);
     const guard = guardOf(options);
-    if (guard.enforce) {
-      await this.checkGrant(guard, { collection: MEDIA }, "create");
-      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
-      if (allowed2 !== true) throw deny(guard.user);
-      await this.folders.checkTarget(guard.user, MEDIA, folderOf(MEDIA, data));
-    }
+    await this.checkUpload(guard, data, folderOf(MEDIA, data));
     const { maxFileSize, mimeTypes, imageSizes } = this.config.upload;
     if (file.data.byteLength > maxFileSize) {
       throw new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`);
@@ -6121,6 +6137,150 @@ var EasyCMS = class {
       throw error;
     }
   }
+  /**
+   * Starts an upload straight to the storage, for files too large to send through the server
+   * (`POST <api>/media/uploads`): checks who uploads what where, as `upload()` does, and returns
+   * a signed ticket and where to send the file. `upload` is `null` when the storage can't take
+   * files directly: send it to `upload()` instead. Then `completeUpload(ticket)`.
+   */
+  async createUpload(file, data = {}, options = {}) {
+    const guard = guardOf(options);
+    const folder = folderOf(MEDIA, data);
+    await this.checkUpload(guard, data, folder);
+    const { maxFileSize, mimeTypes } = this.config.upload;
+    const size = Number(file.size);
+    if (!Number.isInteger(size) || size <= 0)
+      throw new ValidationError(MEDIA, [{ field: "size", message: "must be the size in bytes" }]);
+    if (size > maxFileSize)
+      throw new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`);
+    const name = String(file.name ?? "").slice(0, 255);
+    const type = typeFromName(name) ?? file.type ?? "";
+    if (!EXTENSIONS[type] || !mimeAllowed(type, mimeTypes))
+      throw new ValidationError(MEDIA, [
+        {
+          field: "file",
+          message: `file type ${type || "unknown"} is not allowed (allowed: ${mimeTypes.join(", ")})`
+        }
+      ]);
+    const isPrivate = await this.folders.isPrivate(folder);
+    const storage = this.storageFor(isPrivate);
+    const key2 = withPrivacy(storageKey(name, type, randomBytes5(4).toString("hex")), isPrivate);
+    const upload = storage.uploadURL ? await storage.uploadURL(key2, { contentType: type, size, expiresIn: UPLOAD_URL_SECONDS }) : null;
+    const ticket = this.sign("upload", {
+      key: key2,
+      private: isPrivate,
+      name,
+      size,
+      type,
+      user: guard.user?.id ?? null,
+      expires: Math.floor(Date.now() / 1e3) + UPLOAD_TICKET_SECONDS,
+      data
+    });
+    return { ticket, upload };
+  }
+  /**
+   * Finishes an upload made with `createUpload()` (`POST <api>/media/uploads/complete`): checks
+   * the file in the storage like any upload (its size, and its type from its contents), then
+   * makes its media document. A file that fails is deleted.
+   */
+  async completeUpload(ticket, options = {}) {
+    const guard = guardOf(options);
+    const t = this.verify("upload", ticket);
+    if (!t || t.expires < Date.now() / 1e3)
+      throw new ValidationError(MEDIA, [
+        { field: "ticket", message: "is not valid or has expired" }
+      ]);
+    if (guard.enforce && String(guard.user?.id ?? null) !== String(t.user)) throw deny(guard.user);
+    await this.checkUpload(guard, t.data, folderOf(MEDIA, t.data));
+    if (await this.db.count({ collection: MEDIA, where: { filename: { equals: t.key } } }) > 0)
+      throw new ValidationError(MEDIA, [{ field: "ticket", message: "was used already" }]);
+    const storage = this.storageFor(t.private);
+    const start = storage.getStart ? await storage.getStart(t.key, SNIFF_BYTES) : await storage.get(t.key);
+    if (!start) throw new ValidationError(MEDIA, [{ field: "file", message: "was not uploaded" }]);
+    const refuse = async (message2) => {
+      await storage.delete(t.key).catch(() => {
+      });
+      throw new ValidationError(MEDIA, [{ field: "file", message: message2 }]);
+    };
+    if (start.size !== t.size) await refuse(`is ${start.size} bytes, not the ${t.size} announced`);
+    if (start.size > this.config.upload.maxFileSize)
+      await refuse(`is larger than ${this.config.upload.maxFileSize} bytes`);
+    const mimeType = sniffMimeType(start.body.subarray(0, SNIFF_BYTES), t.name);
+    if (mimeType !== t.type)
+      await refuse(`contains ${mimeType ?? "an unknown type"}, not ${t.type}`);
+    const stored = [];
+    try {
+      let dimensions;
+      let sizes = {};
+      if (t.type.startsWith("image/")) {
+        const whole = await storage.get(t.key);
+        if (whole) {
+          dimensions = imageDimensions(whole.body, t.type);
+          sizes = await this.resizeImage(
+            whole.body,
+            t.type,
+            t.key,
+            this.config.upload.imageSizes,
+            stored,
+            storage
+          );
+        }
+      }
+      const doc = await this.createDocument(
+        this.collection(MEDIA),
+        {
+          ...t.data,
+          ...this.folders.enabled ? { private: t.private } : {},
+          filename: t.key,
+          originalName: t.name,
+          mimeType: t.type,
+          filesize: start.size,
+          width: dimensions?.width ?? null,
+          height: dimensions?.height ?? null,
+          sizes
+        },
+        { ...options, overrideAccess: true },
+        guard
+      );
+      return doc;
+    } catch (error) {
+      for (const key2 of [t.key, ...stored]) await storage.delete(key2).catch(() => {
+      });
+      throw error;
+    }
+  }
+  /** Who may upload, and into which folder: `upload()` and direct uploads. */
+  async checkUpload(guard, data, folder) {
+    if (!guard.enforce) return;
+    await this.checkGrant(guard, { collection: MEDIA }, "create");
+    const allowed2 = await evaluateAccess(this.collection(MEDIA).access?.create, {
+      user: guard.user,
+      data
+    });
+    if (allowed2 !== true) throw deny(guard.user);
+    await this.folders.checkTarget(guard.user, MEDIA, folder);
+  }
+  /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
+  sign(purpose, value) {
+    const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
+    const mac = createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    return `${payload}.${mac.digest("base64url")}`;
+  }
+  /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
+  verify(purpose, token) {
+    const [payload, signature] = String(token).split(".");
+    if (!payload || !signature) return void 0;
+    const expected = Buffer.from(
+      createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
+    );
+    const given = Buffer.from(signature);
+    if (expected.length !== given.length || !timingSafeEqual4(expected, given)) return void 0;
+    try {
+      return JSON.parse(Buffer.from(payload, "base64url").toString());
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Downloads a file from an `http(s)` link and uploads it like `upload()`. Private network
    * addresses are refused unless `upload.fromURL.allowPrivate`. Calls on behalf of a user (the
@@ -6299,6 +6459,28 @@ var EasyCMS = class {
         }
       ]);
   }
+  /**
+   * Refuses a change that would move more than 200 files between storages in one request: they
+   * are copied one by one, which could outlast a serverless function.
+   */
+  async checkMoveLimit(folders) {
+    let count = 0;
+    for (const f of folders)
+      count += await this.db.count({
+        collection: MEDIA,
+        where: andWhere(
+          { folder: { equals: f.id } },
+          f.private ? PUBLIC_FILES : { private: { equals: true } }
+        )
+      });
+    if (count > MAX_FILES_TO_MOVE)
+      throw new ValidationError(MEDIA_FOLDERS, [
+        {
+          field: "private",
+          message: `${count} files would move between public and private storage; move at most ${MAX_FILES_TO_MOVE} at a time (folder by folder)`
+        }
+      ]);
+  }
   /** After a folder became private or public (or moved): its files follow, in every subfolder. */
   async settlePrivacy(folder) {
     for (const f of await this.folders.subtree(folder))
@@ -6603,7 +6785,16 @@ var EasyCMS = class {
     }
     if (config.slug === USERS) await this.guardLastAdmin(parsed, existing, prepared);
     if (password !== void 0) prepared.passwordHash = await hashPassword(password);
-    if (collection2 === MEDIA_FOLDERS) await this.validateFolder(prepared, parsed);
+    if (collection2 === MEDIA_FOLDERS) {
+      await this.validateFolder(prepared, parsed);
+      if (prepared.private !== existing.private || String(prepared.parent ?? null) !== String(existing.parent ?? null))
+        await this.checkMoveLimit(
+          await this.folders.privacyAfter(parsed, {
+            private: prepared.private === true,
+            parent: prepared.parent ?? null
+          })
+        );
+    }
     let moved;
     if (collection2 === MEDIA && this.folders.enabled) {
       const toPrivate = await this.folders.isPrivate(folderOf(MEDIA, prepared));
@@ -6665,7 +6856,10 @@ var EasyCMS = class {
       await this.auth.revokeSessions(parsed);
       await this.auth.sso.forget(parsed);
     }
-    if (collection2 === MEDIA_FOLDERS) await this.folders.release(existing);
+    if (collection2 === MEDIA_FOLDERS) {
+      await this.checkMoveLimit(await this.folders.privacyAfter(parsed, { private: false }));
+      await this.folders.release(existing);
+    }
     await this.db.delete({ collection: collection2, id: parsed });
     if (collection2 === MEDIA_FOLDERS) {
       this.folders.invalidate();
@@ -7838,6 +8032,10 @@ function folderOf(collection2, data) {
   return value === void 0 || value === "" ? null : value;
 }
 var MAX_LINK = 7 * 24 * 60 * 60;
+var UPLOAD_URL_SECONDS = 15 * 60;
+var UPLOAD_TICKET_SECONDS = 24 * 60 * 60;
+var SNIFF_BYTES = 64 * 1024;
+var MAX_FILES_TO_MOVE = 200;
 function durationSeconds(value) {
   const match = typeof value === "string" ? /^(\d+)\s*([smhd])$/.exec(value.trim()) : null;
   const seconds = typeof value === "number" ? value : match ? Number(match[1]) * { s: 1, m: 60, h: 3600, d: 86400 }[match[2]] : Number.NaN;
@@ -8339,7 +8537,7 @@ function folderIds(cms) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.40.0" : "0.0.0-dev";
+var VERSION = true ? "0.41.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -9064,6 +9262,30 @@ async function route(cms, ctx, method, segments, options) {
     if (method !== "GET" && method !== "HEAD") throw methodNotAllowed(ctx, "GET, HEAD");
     return { body: await servePrivateFile(cms, ctx, third, method === "HEAD") };
   }
+  if (first === MEDIA && second === "uploads" && segments.length <= 3) {
+    if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+    const body = await readJson(ctx.request);
+    if (third === "complete" && segments.length === 3) {
+      if (typeof body.ticket !== "string" || body.ticket === "")
+        throw new ValidationError(MEDIA, [{ field: "ticket", message: "is required" }]);
+      return {
+        status: 201,
+        body: await cms.completeUpload(body.ticket, { ...access, ...parseDepth(ctx.url) })
+      };
+    }
+    if (third !== void 0) throw new HttpError("Not found", 404);
+    const { name, size, type, ...data } = body;
+    if (typeof name !== "string" || name === "")
+      throw new ValidationError(MEDIA, [{ field: "name", message: "is required" }]);
+    return {
+      status: 201,
+      body: await cms.createUpload(
+        { name, size: Number(size), ...typeof type === "string" ? { type } : {} },
+        data,
+        access
+      )
+    };
+  }
   if (first === MEDIA && second === void 0 && method === "POST") {
     if ((ctx.request.headers.get("content-type") ?? "").toLowerCase().startsWith("application/json")) {
       const { url, ...data2 } = await readJson(ctx.request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",