@flusys/nestjs-storage 1.1.0-beta → 2.0.0-rc.0

package/cjs/providers/local-provider.js

@@ -80,6 +80,29 @@ function _interop_require_wildcard(obj, nodeInterop) {
 }
 let LocalProvider = class LocalProvider {
     /**
+   * SECURITY: Validates that a target path does not escape the base directory
+   * Prevents path traversal attacks using ../ sequences
+   * @throws Error if path traversal is detected
+   */ validatePathWithinBase(targetPath) {
+        const normalizedBasePath = _path.resolve(this.basePath);
+        const normalizedTargetPath = _path.resolve(targetPath);
+        if (!normalizedTargetPath.startsWith(normalizedBasePath + _path.sep) && normalizedTargetPath !== normalizedBasePath) {
+            this.logger.warn(`Path traversal attempt detected: ${targetPath}`);
+            throw new Error('Invalid path: Path traversal attempt detected');
+        }
+    }
+    /**
+   * SECURITY: Validates file key format to prevent malicious input
+   * @throws Error if key contains suspicious patterns
+   */ validateKeyFormat(key) {
+        if (!key || typeof key !== 'string' || key.trim().length === 0) {
+            throw new Error('Invalid file key: empty or invalid');
+        }
+        if (key.includes('\0')) {
+            throw new Error('Invalid file key: contains null bytes');
+        }
+    }
+    /**
    * Initialize Local File System provider with configuration
    * @param config.basePath - Base path for file storage (default: './uploads')
    * @param config.baseUrl - Optional base URL for generating file URLs
@@ -112,7 +135,11 @@ let LocalProvider = class LocalProvider {
         }
         // Build file path
         const folderPath = options.folderPath ? _path.join(this.basePath, options.folderPath) : this.basePath;
+        // SECURITY: Validate path does not escape base directory
+        this.validatePathWithinBase(folderPath);
         const filePath = _path.join(folderPath, fileName);
+        // SECURITY: Double-check final file path
+        this.validatePathWithinBase(filePath);
         // Ensure directory exists
         await _promises.mkdir(folderPath, {
             recursive: true
@@ -135,14 +162,20 @@ let LocalProvider = class LocalProvider {
     }
     async deleteFile(key) {
         try {
+            // SECURITY: Validate key format first
+            this.validateKeyFormat(key);
             // Key now includes the basePath, resolve from cwd
             let filePath = _path.resolve(key);
+            // SECURITY: Validate resolved path is within base directory
+            this.validatePathWithinBase(filePath);
             // Check if file exists at the resolved path
             try {
                 await _promises.access(filePath);
             } catch  {
                 // Fallback: try with basePath prefix (for old keys without basePath)
                 const fallbackPath = _path.join(this.basePath, key);
+                // SECURITY: Validate fallback path as well
+                this.validatePathWithinBase(fallbackPath);
                 try {
                     await _promises.access(fallbackPath);
                     filePath = fallbackPath;
@@ -155,7 +188,11 @@ let LocalProvider = class LocalProvider {
             }
             await _promises.unlink(filePath);
             this.logger.log(`Deleted file from local storage: ${key}`);
-        } catch (_error) {
+        } catch (error) {
+            // Re-throw security errors
+            if (error instanceof Error && error.message.includes('Invalid')) {
+                throw error;
+            }
             this.logger.warn(`Failed to delete file from local storage: ${key}`);
         }
     }
@@ -182,36 +219,6 @@ let LocalProvider = class LocalProvider {
             return false;
         }
     }
-    /**
-   * Get the absolute path for a file key
-   * Key now includes basePath, so resolve from cwd
-   */ getAbsolutePath(key) {
-        return _path.resolve(key);
-    }
-    /**
-   * Check if a file exists
-   */ async fileExists(key) {
-        try {
-            // Key now includes basePath, resolve from cwd
-            const filePath = _path.resolve(key);
-            await _promises.access(filePath);
-            return true;
-        } catch  {
-            return false;
-        }
-    }
-    /**
-   * Get file stats
-   */ async getFileStats(key) {
-        // Key now includes basePath, resolve from cwd
-        const filePath = _path.resolve(key);
-        const stats = await _promises.stat(filePath);
-        return {
-            size: stats.size,
-            createdAt: stats.birthtime,
-            modifiedAt: stats.mtime
-        };
-    }
     constructor(){
         _define_property(this, "logger", new _common.Logger(LocalProvider.name));
         _define_property(this, "basePath", '');

package/cjs/providers/s3-provider.optional.js

@@ -1,17 +1,6 @@
 /**
- * OPTIONAL S3 Provider
- *
- * This provider requires @aws-sdk packages to be installed.
- * Only import this if you need AWS S3 storage.
- *
- * Installation:
- * npm install @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner
- *
- * Usage:
- * import { S3Provider } from '@flusys/nestjs-storage/providers/s3-provider.optional';
- * import { StorageProviderRegistry, FileLocationEnum } from '@flusys/nestjs-storage';
- *
- * StorageProviderRegistry.register(FileLocationEnum.AWS, S3Provider);
+ * Optional AWS S3 Storage Provider
+ * Requires: npm install @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner
  */ "use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
@@ -22,9 +11,9 @@ Object.defineProperty(exports, "S3Provider", {
         return S3Provider;
     }
 });
-const _imagecompressorutil = require("../utils/image-compressor.util");
 const _common = require("@nestjs/common");
 const _uuid = require("uuid");
+const _imagecompressorutil = require("../utils/image-compressor.util");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -80,26 +69,22 @@ function _interop_require_wildcard(obj, nodeInterop) {
     return newObj;
 }
 let S3Provider = class S3Provider {
-    /**
-   * Initialize S3 provider with configuration
-   */ async initialize(config) {
+    async initialize(config) {
         try {
-            // Dynamic import - only loads AWS SDK if this provider is used
             const { S3Client } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("@aws-sdk/client-s3")));
             this.region = config.region;
             this.bucketName = config.bucket;
             this.s3 = new S3Client({
                 region: config.region,
+                endpoint: config.endpoint,
                 credentials: config.accessKeyId && config.secretAccessKey ? {
                     accessKeyId: config.accessKeyId,
                     secretAccessKey: config.secretAccessKey
-                } : undefined,
-                endpoint: config.endpoint
+                } : undefined
             });
             this.logger.log(`S3 Provider initialized: region=${config.region}, bucket=${config.bucket}`);
-        } catch (_error) {
-            this.logger.error('Failed to initialize S3Provider. Make sure @aws-sdk packages are installed.');
-            throw new Error('AWS SDK not found. Install it with: npm install @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner');
+        } catch  {
+            throw new Error('AWS SDK not found. Install: npm install @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner');
         }
     }
     async uploadFile(file, options) {
@@ -107,7 +92,6 @@ let S3Provider = class S3Provider {
         let processedBuffer = file.buffer;
         let contentType = file.mimetype;
         const fileName = `${(0, _uuid.v4)()}-${file.originalname}`;
-        // Compress image if needed
         if (options.compress && file.mimetype.startsWith('image/')) {
             const result = await _imagecompressorutil.ImageCompressor.compress(file.buffer, file.mimetype, {
                 maxWidth: options.maxWidth,
@@ -119,7 +103,7 @@ let S3Provider = class S3Provider {
             contentType = result.format;
         }
         const key = options.folderPath ? `${options.folderPath}/${fileName}` : fileName;
-        const upload = new Upload({
+        await new Upload({
             client: this.s3,
             params: {
                 Bucket: this.bucketName,
@@ -127,8 +111,7 @@ let S3Provider = class S3Provider {
                 Body: processedBuffer,
                 ContentType: contentType
             }
-        });
-        await upload.done();
+        }).done();
         return {
             name: fileName,
             key,
@@ -141,44 +124,40 @@ let S3Provider = class S3Provider {
     }
     async deleteFile(key) {
         const { DeleteObjectCommand } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("@aws-sdk/client-s3")));
-        const command = new DeleteObjectCommand({
+        await this.s3.send(new DeleteObjectCommand({
             Bucket: this.bucketName,
             Key: key
-        });
-        await this.s3.send(command);
+        }));
         this.logger.log(`Deleted file from S3: ${key}`);
     }
     async deleteMultipleFiles(keys) {
         const { DeleteObjectsCommand } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("@aws-sdk/client-s3")));
-        const command = new DeleteObjectsCommand({
+        await this.s3.send(new DeleteObjectsCommand({
             Bucket: this.bucketName,
             Delete: {
                 Objects: keys.map((key)=>({
                         Key: key
                     }))
             }
-        });
-        await this.s3.send(command);
+        }));
         this.logger.log(`Deleted ${keys.length} files from S3`);
     }
     async generatePresignedUrl(key, expiresInSeconds = 3600) {
         const { GetObjectCommand } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("@aws-sdk/client-s3")));
         const { getSignedUrl } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("@aws-sdk/s3-request-presigner")));
-        const command = new GetObjectCommand({
+        return getSignedUrl(this.s3, new GetObjectCommand({
             Bucket: this.bucketName,
             Key: key
-        });
-        return getSignedUrl(this.s3, command, {
+        }), {
             expiresIn: expiresInSeconds
         });
     }
     async healthCheck() {
         try {
             const { HeadBucketCommand } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("@aws-sdk/client-s3")));
-            const command = new HeadBucketCommand({
+            await this.s3.send(new HeadBucketCommand({
                 Bucket: this.bucketName
-            });
-            await this.s3.send(command);
+            }));
             return true;
         } catch  {
             return false;
@@ -186,7 +165,7 @@ let S3Provider = class S3Provider {
     }
     constructor(){
         _define_property(this, "logger", new _common.Logger(S3Provider.name));
-        _define_property(this, "s3", void 0); // S3Client - typed as any to avoid import
+        _define_property(this, "s3", void 0);
         _define_property(this, "bucketName", '');
         _define_property(this, "region", '');
     }

package/cjs/providers/storage-factory.service.js

@@ -8,10 +8,10 @@ Object.defineProperty(exports, "StorageFactoryService", {
         return StorageFactoryService;
     }
 });
-const _storageproviderregistry = require("./storage-provider.registry");
 const _common = require("@nestjs/common");
 const _crypto = /*#__PURE__*/ _interop_require_wildcard(require("crypto"));
-const _config = require("../config");
+const _services = require("../services");
+const _storageproviderregistry = require("./storage-provider.registry");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -81,131 +81,86 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let StorageFactoryService = class StorageFactoryService {
-    /**
-   * Generate a stable cache key for provider configuration
-   * Uses SHA256 hash to handle complex config objects consistently
-   */ generateCacheKey(config) {
-        // Sort keys for consistent ordering, then hash
-        const configString = JSON.stringify(config.config, Object.keys(config.config || {}).sort());
-        const configHash = _crypto.createHash('sha256').update(configString).digest('hex').substring(0, 16);
-        return `${config.provider}-${configHash}`;
-    }
-    /**
-   * Create a storage provider instance based on configuration
-   * Uses lazy loading - provider is only instantiated when requested
-   */ async createProvider(config) {
-        const providerKey = this.generateCacheKey(config);
-        // Check cache first
-        if (this.providerCache.has(providerKey)) {
-            return this.providerCache.get(providerKey);
-        }
-        // Get provider class from registry
+    async createProvider(config) {
+        const cacheKey = this.generateCacheKey(config);
+        const cached = this.cache.get(cacheKey);
+        if (cached) return cached;
         const ProviderClass = _storageproviderregistry.StorageProviderRegistry.get(config.provider);
         if (!ProviderClass) {
-            throw new _common.NotFoundException(`Storage provider '${config.provider}' is not registered. ` + `Available providers: ${_storageproviderregistry.StorageProviderRegistry.getAll().join(', ')}`);
+            throw new _common.NotFoundException(`Storage provider '${config.provider}' not registered. Available: ${_storageproviderregistry.StorageProviderRegistry.getAll().join(', ')}`);
         }
-        // Instantiate provider
         try {
             const instance = new ProviderClass();
-            // Initialize if method exists
-            if ('initialize' in instance && typeof instance.initialize === 'function') {
-                // For local provider, inject appUrl as fallback for baseUrl
-                let initConfig = config.config;
-                if (config.provider === 'local' && !config.config?.baseUrl) {
-                    const appUrl = this.storageConfigService.getAppUrl();
-                    if (appUrl) {
-                        initConfig = {
-                            ...config.config,
-                            baseUrl: appUrl
-                        };
-                        this.logger.debug(`Using appUrl from config as baseUrl: ${appUrl}`);
-                    }
-                }
-                await instance.initialize(initConfig);
-            }
-            // Cache the instance
-            this.providerCache.set(providerKey, instance);
-            this.logger.log(`Created storage provider: ${config.provider} (key: ${providerKey})`);
+            await this.initializeProvider(instance, config);
+            this.cache.set(cacheKey, instance);
+            this.logger.log(`Created provider: ${config.provider} (${cacheKey})`);
             return instance;
         } catch (error) {
-            this.logger.error(`Failed to create provider ${config.provider}:`, error);
-            // Preserve original error message for better debugging
-            const originalMessage = error?.message || 'Unknown error';
-            throw new Error(`Failed to initialize storage provider '${config.provider}': ${originalMessage}`);
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            throw new Error(`Failed to initialize '${config.provider}': ${message}`);
         }
     }
-    /**
-   * Get provider by name (creates with default config if not cached)
-   */ async getProvider(providerName) {
-        const cachedKey = Array.from(this.providerCache.keys()).find((key)=>key.startsWith(providerName));
-        if (cachedKey) {
-            return this.providerCache.get(cachedKey);
-        }
-        // Create with empty config
+    async getProvider(providerName) {
+        const cachedKey = Array.from(this.cache.keys()).find((k)=>k.startsWith(providerName));
+        if (cachedKey) return this.cache.get(cachedKey);
         return this.createProvider({
             provider: providerName,
             config: {}
         });
     }
-    /**
-   * Clear cached providers
-   */ clearCache() {
-        this.providerCache.clear();
+    getLocalProviderBasePath() {
+        const localKey = Array.from(this.cache.keys()).find((k)=>k.startsWith('local'));
+        const provider = localKey ? this.cache.get(localKey) : null;
+        return provider && 'basePath' in provider ? provider.basePath : null;
     }
-    /**
-   * Check if a provider is available
-   */ isProviderAvailable(providerName) {
-        return _storageproviderregistry.StorageProviderRegistry.has(providerName);
+    clearCache() {
+        this.cache.clear();
     }
-    /**
-   * Get list of available providers
-   */ getAvailableProviders() {
-        return _storageproviderregistry.StorageProviderRegistry.getAll();
+    async onModuleDestroy() {
+        this.logger.log('Cleaning up storage providers...');
+        const closePromises = Array.from(this.cache.entries()).filter(([, p])=>'close' in p && typeof p.close === 'function').map(([key, p])=>p.close().then(()=>this.logger.debug(`Closed: ${key}`)).catch((e)=>this.logger.warn(`Failed to close ${key}: ${e.message}`)));
+        await Promise.allSettled(closePromises);
+        this.cache.clear();
+        this.logger.log('Storage provider cleanup complete');
     }
-    /**
-   * Get the basePath from cached local provider
-   * Returns null if no local provider is cached
-   */ getLocalProviderBasePath() {
-        // Find cached local provider
-        const localKey = Array.from(this.providerCache.keys()).find((key)=>key.startsWith('local'));
-        if (localKey) {
-            const provider = this.providerCache.get(localKey);
-            if (provider && 'basePath' in provider) {
-                return provider.basePath;
-            }
-        }
-        return null;
+    // ─── Private Helpers ──────────────────────────────────────────────────────────
+    generateCacheKey(config) {
+        const sortedKeys = Object.keys(config.config || {}).sort();
+        const hash = _crypto.createHash('sha256').update(JSON.stringify(config.config, sortedKeys)).digest('hex').substring(0, 16);
+        return `${config.provider}-${hash}`;
     }
-    /**
-   * Cleanup all cached provider connections on module destroy
-   * Ensures SFTP connections and other resources are properly released
-   */ async onModuleDestroy() {
-        this.logger.log('Cleaning up storage provider connections...');
-        const closePromises = [];
-        for (const [key, provider] of this.providerCache.entries()){
-            // Check if provider has a close method (e.g., SFTP)
-            if ('close' in provider && typeof provider.close === 'function') {
-                closePromises.push(provider.close().then(()=>this.logger.debug(`Closed provider: ${key}`)).catch((err)=>this.logger.warn(`Failed to close provider ${key}: ${err.message}`)));
+    async initializeProvider(instance, config) {
+        if (!('initialize' in instance) || typeof instance.initialize !== 'function') {
+            return;
+        }
+        let initConfig = config.config;
+        // Inject appUrl as baseUrl fallback for local provider
+        if (config.provider === 'local' && !config.config?.baseUrl) {
+            const appUrl = this.configService.getAppUrl();
+            if (appUrl) {
+                initConfig = {
+                    ...config.config,
+                    baseUrl: appUrl
+                };
+                this.logger.debug(`Using appUrl as baseUrl: ${appUrl}`);
             }
         }
-        await Promise.allSettled(closePromises);
-        this.providerCache.clear();
-        this.logger.log('Storage provider cleanup complete');
+        await instance.initialize(initConfig);
     }
-    constructor(storageConfigService){
-        _define_property(this, "storageConfigService", void 0);
+    constructor(configService){
+        _define_property(this, "configService", void 0);
         _define_property(this, "logger", void 0);
-        _define_property(this, "providerCache", void 0);
-        this.storageConfigService = storageConfigService;
+        _define_property(this, "cache", void 0);
+        this.configService = configService;
         this.logger = new _common.Logger(StorageFactoryService.name);
-        this.providerCache = new Map();
+        this.cache = new Map();
     }
 };
 StorageFactoryService = _ts_decorate([
     (0, _common.Injectable)(),
-    _ts_param(0, (0, _common.Inject)(_config.StorageConfigService)),
+    _ts_param(0, (0, _common.Inject)(_services.StorageConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _config.StorageConfigService === "undefined" ? Object : _config.StorageConfigService
+        typeof _services.StorageConfigService === "undefined" ? Object : _services.StorageConfigService
     ])
 ], StorageFactoryService);

package/cjs/providers/storage-provider.registry.js

@@ -22,29 +22,19 @@ function _define_property(obj, key, value) {
     return obj;
 }
 let StorageProviderRegistry = class StorageProviderRegistry {
-    /**
-   * Register a storage provider
-   */ static register(providerName, providerClass) {
-        this.providers.set(providerName.toLowerCase(), providerClass);
+    static register(name, providerClass) {
+        this.providers.set(name.toLowerCase(), providerClass);
     }
-    /**
-   * Get a registered provider class
-   */ static get(providerName) {
-        return this.providers.get(providerName.toLowerCase());
+    static get(name) {
+        return this.providers.get(name.toLowerCase());
     }
-    /**
-   * Check if a provider is registered
-   */ static has(providerName) {
-        return this.providers.has(providerName.toLowerCase());
+    static has(name) {
+        return this.providers.has(name.toLowerCase());
     }
-    /**
-   * Get all registered provider names
-   */ static getAll() {
+    static getAll() {
         return Array.from(this.providers.keys());
     }
-    /**
-   * Clear all providers (useful for testing)
-   */ static clear() {
+    static clear() {
         this.providers.clear();
     }
 };