@everystack/server 0.2.2 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "publishConfig": {
@@ -59,8 +59,8 @@
     "lint": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@aws-sdk/client-s3": "3.1045.0",
-    "@aws-sdk/s3-request-presigner": "3.1045.0",
+    "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/s3-request-presigner": "3.1053.0",
     "@everystack/auth": ">=0.1.0",
     "@everystack/cli": ">=0.1.0",
     "drizzle-orm": "0.41.0",

package/src/image.ts

@@ -104,8 +104,11 @@ export function parseParams(query: Record<string, string | undefined>): Transfor
     const h = parseInt(query.h, 10);
     if (h > 0 && h <= MAX_DIMENSION) params.h = h;
   }
-  if (query.fit && VALID_FITS.includes(query.fit as any)) {
-    params.fit = query.fit as TransformParams['fit'];
+  if (query.fit) {
+    const fit = query.fit === 'crop' ? 'cover' : query.fit;
+    if (VALID_FITS.includes(fit as any)) {
+      params.fit = fit as TransformParams['fit'];
+    }
   }
   if (query.fm && VALID_FORMATS.includes(query.fm as any)) {
     params.fm = query.fm as TransformParams['fm'];
@@ -151,11 +154,12 @@ export async function processImage(
 
   // Resize
   if (params.w || params.h) {
+    const fit = params.fit || 'cover';
     pipeline = pipeline.resize({
       width: params.w,
       height: params.h,
-      fit: params.fit || 'cover',
-      withoutEnlargement: true,
+      fit,
+      withoutEnlargement: fit !== 'cover' && fit !== 'fill',
     });
   }
 
@@ -197,10 +201,17 @@ export function createImageHandler(
       const path = event.rawPath;
       const key = path.replace(new RegExp(`^${pathPrefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`), '');
 
+      // Error responses must never be cached by CloudFront — stale 500s
+      // are invisible and hard to debug.
+      const errorHeaders = {
+        'Content-Type': 'application/json',
+        'Cache-Control': 'no-store',
+      };
+
       if (!key) {
         return {
           statusCode: 400,
-          headers: { 'Content-Type': 'application/json' },
+          headers: errorHeaders,
           body: JSON.stringify({ error: 'Missing image key' }),
         };
       }
@@ -209,7 +220,7 @@ export function createImageHandler(
       if (key.includes('..') || key.startsWith('/')) {
         return {
           statusCode: 403,
-          headers: { 'Content-Type': 'application/json' },
+          headers: errorHeaders,
           body: JSON.stringify({ error: 'Forbidden' }),
         };
       }
@@ -220,7 +231,7 @@ export function createImageHandler(
         if (!allowed) {
           return {
             statusCode: 403,
-            headers: { 'Content-Type': 'application/json' },
+            headers: errorHeaders,
             body: JSON.stringify({ error: 'Forbidden' }),
           };
         }
@@ -268,6 +279,7 @@ export function createImageHandler(
 
       // --- Fetch original from S3 for processing ---
       let originalData: Buffer;
+      let originalContentType: string | undefined;
       try {
         const result = await client.send(
           new GetObjectCommand({ Bucket: bucket, Key: key })
@@ -275,25 +287,81 @@ export function createImageHandler(
         if (!result.Body) {
           return {
             statusCode: 404,
-            headers: { 'Content-Type': 'application/json' },
+            headers: errorHeaders,
             body: JSON.stringify({ error: 'Image not found' }),
           };
         }
+        originalContentType = result.ContentType || undefined;
         const bytes = await result.Body.transformToByteArray();
         originalData = Buffer.from(bytes);
       } catch (error: any) {
         if (isNotFound(error)) {
           return {
             statusCode: 404,
-            headers: { 'Content-Type': 'application/json' },
+            headers: errorHeaders,
             body: JSON.stringify({ error: 'Image not found' }),
           };
         }
         throw error;
       }
 
-      // Process with Sharp
-      const processed = await processImage(originalData, params);
+      // Detect actual image format from magic bytes — content types from
+      // user uploads are frequently wrong (e.g. application/x-www-form-urlencoded
+      // on a 19 MB JPEG).  Trust the bytes, not the metadata.
+      const sharp = (await import('sharp')).default;
+      let detectedFormat: string | undefined;
+      try {
+        const meta = await sharp(originalData).metadata();
+        detectedFormat = meta.format; // jpeg, png, webp, gif, tiff, heif, etc.
+      } catch {
+        // Sharp can't parse it — not an image
+      }
+
+      if (!detectedFormat) {
+        // Not an image — pass through non-image files (fonts, CSS, etc.)
+        // Lambda responses are capped at 6 MB. Base64 inflates ~33%.
+        const MAX_PASSTHROUGH = 4_500_000; // ~4.5 MB raw → ~6 MB base64
+        if (originalData.length > MAX_PASSTHROUGH) {
+          log('warn', 'File too large for passthrough', {
+            key, size: originalData.length, contentType: originalContentType,
+          });
+          return {
+            statusCode: 413,
+            headers: errorHeaders,
+            body: JSON.stringify({ error: 'File too large' }),
+          };
+        }
+        return {
+          statusCode: 200,
+          headers: {
+            'Content-Type': originalContentType || 'application/octet-stream',
+            ...cacheHeaders,
+          },
+          body: originalData.toString('base64'),
+          isBase64Encoded: true,
+        };
+      }
+
+      // No transform params — serve original image as-is (EXIF-corrected webp)
+      const hasTransforms = params.w || params.h || params.fit || params.fm || params.q;
+
+      // Process with Sharp — catch decode failures (e.g. HEIC without libheif)
+      let processed: { data: Buffer; contentType: string };
+      try {
+        processed = hasTransforms
+          ? await processImage(originalData, params)
+          : await processImage(originalData, { fm: 'webp', q: 80 });
+      } catch (sharpError) {
+        log('error', 'Sharp processing failed', {
+          key, format: detectedFormat, contentType: originalContentType,
+          error: String(sharpError),
+        });
+        return {
+          statusCode: 422,
+          headers: errorHeaders,
+          body: JSON.stringify({ error: 'Unsupported image format' }),
+        };
+      }
 
       // --- Write rendered image to S3 cache (fire-and-forget) ---
       if (useCache && s3CacheKey) {
@@ -325,7 +393,7 @@ export function createImageHandler(
       log('error', 'Image processing error', { error: String(error), path: event.rawPath });
       return {
         statusCode: 500,
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
         body: JSON.stringify({ error: 'Image processing failed' }),
       };
     }