@everystack/storage 0.2.0 → 0.2.1

package/LICENSE

@@ -16,7 +16,7 @@ A commercial license is available for organizations that cannot or do not
 wish to comply with the AGPL-3.0 terms. Commercial licenses are issued
 exclusively by Scalable Technology, Inc.
 
-For commercial licensing inquiries, contact: licensing@scalabletechnology.com
+For commercial licensing inquiries, contact: licensing@scalable.technology
 
                     GNU AFFERO GENERAL PUBLIC LICENSE
                        Version 3, 19 November 2007

package/README.md

@@ -267,4 +267,8 @@ Part of [everystack](https://github.com/scalable-technology/everystack) — a se
 
 ## License
 
-MIT
+[AGPL-3.0-only](https://www.gnu.org/licenses/agpl-3.0.html) © Scalable Technology, Inc.
+
+A commercial license is available for organizations that cannot or do not wish to
+comply with the AGPL-3.0 terms. For commercial licensing, contact
+licensing@scalable.technology.

package/package.json

@@ -1,8 +1,18 @@
 {
   "name": "@everystack/storage",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "File uploads via S3 + CloudFront CDN with presigned URLs",
   "license": "AGPL-3.0-only",
+  "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scalable-technology/everystack.git",
+    "directory": "packages/storage"
+  },
+  "homepage": "https://github.com/scalable-technology/everystack#readme",
+  "bugs": {
+    "url": "https://github.com/scalable-technology/everystack/issues"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -29,8 +39,8 @@
     }
   },
   "peerDependencies": {
-    "@aws-sdk/client-s3": "3.1045.0",
-    "@aws-sdk/s3-request-presigner": "3.1045.0",
+    "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/s3-request-presigner": "3.1053.0",
     "@everystack/server": ">=0.1.0",
     "drizzle-orm": "0.41.0",
     "react": "19.2.6",
@@ -54,8 +64,8 @@
     }
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "3.1045.0",
-    "@aws-sdk/s3-request-presigner": "3.1045.0",
+    "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/s3-request-presigner": "3.1053.0",
     "@testing-library/react-native": "13.3.3",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",
@@ -66,7 +76,7 @@
     "react-test-renderer": "19.2.6",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/server": "0.2.0"
+    "@everystack/server": "0.2.23"
   },
   "scripts": {
     "test": "jest",

package/src/handler/index.ts

@@ -14,12 +14,34 @@ async function computeSha256(data: ArrayBuffer | Buffer | Uint8Array): Promise<s
     .join('');
 }
 
+// Postgres identifier rule — the only value interpolated into SET ROLE. The role is set by
+// server config, never user input, but validate defensively against injection.
+const ROLE_NAME = /^[a-z_][a-z0-9_]*$/;
+
 export function createStorageHandler(options: StorageHandlerOptions): (request: Request) => Promise<Response> {
   const basePath = options.basePath || '';
   const { db, storage, auth, validation, publishJob } = options;
   const allowUnauthenticated = options.allowUnauthenticated === true;
   const keyGenerator = options.keyGenerator || defaultKeyGenerator;
   const bucket = options.bucket || 'default';
+  const role = options.role;
+  if (role && !ROLE_NAME.test(role)) {
+    throw new Error(`Invalid role name: ${role}`);
+  }
+
+  /**
+   * Run `fn` against the connection — directly when no role is configured, or inside a
+   * SET LOCAL ROLE transaction when one is (the least-privilege API path: dist.blobs is
+   * reachable only via the admin policy). Per-user ownership is still enforced in the handler.
+   */
+  async function scope(fn: (db: any) => any): Promise<any> {
+    if (!role) return fn(db);
+    return db.transaction(async (tx: any) => {
+      await tx.execute(sql.raw(`SET LOCAL ROLE ${role}`));
+      await tx.execute(sql`SELECT set_config('request.jwt.claims', ${JSON.stringify({ role })}, true)`);
+      return fn(tx);
+    });
+  }
 
   function json(data: unknown, status: number = 200): Response {
     return new Response(JSON.stringify(data), {
@@ -121,8 +143,8 @@ export function createStorageHandler(options: StorageHandlerOptions): (request:
       // Compute content hash for dedup
       const sha256 = await computeSha256(buffer);
 
-      // Write metadata to DB
-      const result = await db
+      // Write metadata to DB (as the configured role; dist.blobs is admin-policy gated).
+      const result = await scope((d) => d
         .insert(blobs)
         .values({
           type: 'original',
@@ -136,7 +158,7 @@ export function createStorageHandler(options: StorageHandlerOptions): (request:
             userId: (user.sub as string) || null,
           },
         })
-        .returning({ id: blobs.id });
+        .returning({ id: blobs.id }));
 
       const uploadId = result[0].id;
 
@@ -180,15 +202,13 @@ export function createStorageHandler(options: StorageHandlerOptions): (request:
       const limit = Math.min(Math.max(1, parsedLimit || 50), maxLimit);
       const offset = url.searchParams.has('offset') ? Math.max(0, parseInt(url.searchParams.get('offset')!, 10) || 0) : 0;
 
-      let query = db.select().from(blobs);
-
-      if (user.sub) {
-        query = query.where(sql`${blobs.metadata}->>'userId' = ${user.sub}`);
-      }
-
-      query = query.orderBy(sql`${blobs.createdAt} DESC`).limit(limit).offset(offset);
-
-      const result = await query;
+      const result = await scope((d) => {
+        let query = d.select().from(blobs);
+        if (user.sub) {
+          query = query.where(sql`${blobs.metadata}->>'userId' = ${user.sub}`);
+        }
+        return query.orderBy(sql`${blobs.createdAt} DESC`).limit(limit).offset(offset);
+      });
       return json(result);
     }
 
@@ -198,10 +218,10 @@ export function createStorageHandler(options: StorageHandlerOptions): (request:
       const user = await verifyAuth(request);
       if (!user) return json({ error: 'Unauthorized' }, 401);
 
-      const result = await db
+      const result = await scope((d) => d
         .select()
         .from(blobs)
-        .where(sql`${blobs.id} = ${uploadMatch[1]}`);
+        .where(sql`${blobs.id} = ${uploadMatch[1]}`));
 
       if (!result[0]) return json({ error: 'Upload not found' }, 404);
 
@@ -220,10 +240,10 @@ export function createStorageHandler(options: StorageHandlerOptions): (request:
       const user = await verifyAuth(request);
       if (!user) return json({ error: 'Unauthorized' }, 401);
 
-      const result = await db
+      const result = await scope((d) => d
         .select()
         .from(blobs)
-        .where(sql`${blobs.id} = ${deleteMatch[1]}`);
+        .where(sql`${blobs.id} = ${deleteMatch[1]}`));
 
       if (!result[0]) return json({ error: 'Upload not found' }, 404);
 
@@ -234,7 +254,7 @@ export function createStorageHandler(options: StorageHandlerOptions): (request:
       }
 
       await storage.delete(result[0].s3Key!);
-      await db.delete(blobs).where(sql`${blobs.id} = ${deleteMatch[1]}`);
+      await scope((d) => d.delete(blobs).where(sql`${blobs.id} = ${deleteMatch[1]}`));
 
       return json({ ok: true });
     }

package/src/plugin.ts

@@ -20,6 +20,12 @@ export interface StoragePluginOptions {
   basePath?: string;
   /** Presigned URL expiry in seconds (default: 3600) */
   presignedUrlExpiry?: number;
+  /**
+   * Postgres role for the dist.blobs access (e.g. 'admin' on the least-privilege API
+   * connection, so the handler reaches dist.blobs under the admin policy). Unset = run on the
+   * bound connection (single-credential / owner apps).
+   */
+  role?: string;
 }
 
 export function storagePlugin(options: StoragePluginOptions): Plugin {
@@ -44,6 +50,7 @@ export function storagePlugin(options: StoragePluginOptions): Plugin {
       validation: options.validation,
       publishJob: ctx.publishJob,
       presignedUrlExpiry: options.presignedUrlExpiry,
+      role: options.role,
     });
 
     return {

package/src/types.ts

@@ -51,4 +51,13 @@ export interface StorageHandlerOptions {
   presignedUrlExpiry?: number;
   /** Maximum value for ?limit= on listing endpoints. Default: 1000. */
   maxLimit?: number;
+  /**
+   * Postgres role to run the dist.blobs access as. On the least-privilege API connection
+   * (`authenticator`) set this to `admin` so the handler reaches dist.blobs under the admin
+   * policy; the per-user ownership check stays in the handler (metadata.userId === sub). Unset
+   * = run directly on the bound connection (single-credential / owner apps). When set, each DB
+   * operation runs inside a transaction with SET LOCAL ROLE (transaction-scoped, resets on
+   * return).
+   */
+  role?: string;
 }