@formancy/server 0.2.0 → 0.4.0

package/dist/{file-collector-WWc-eo8h.mjs → file-collector-CGSJAtGO.mjs}

@@ -1,7 +1,7 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, healthOf, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, replayDelivery, resolveForm, resumeDraft, saveDraft, screenUpload, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
 import Fastify from "fastify";
 import rateLimit from "@fastify/rate-limit";
-import { auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, healthOf, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, replayDelivery, resolveForm, resumeDraft, saveDraft, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
 import { hash, verify } from "@node-rs/argon2";
 import { SignJWT, jwtVerify } from "jose";
 import { and, desc, eq, inArray, lt, lte, max, ne } from "drizzle-orm";
@@ -10,6 +10,216 @@ import { integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-c
 import { createReadStream } from "node:fs";
 import { mkdir, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
+//#region src/routes/files.ts
+/**
+* A form's files: offering one, receiving its bytes, and serving it back.
+*
+* One route family per plugin, the seam `app.ts`'s size budget names. It moved when
+* scanning an upload's bytes needed lines that file had no room for.
+*/
+async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }) {
+	const { storage } = deps;
+	const submissionLimit = limit;
+	/**
+	* Ask where to put a file.
+	*
+	* Refusing here, before a byte is sent, is the difference between rejecting
+	* a 2 GB upload and receiving one first. The reply carries the id the
+	* submission will reference and the URL to PUT the bytes to.
+	*/
+	app.post("/f/:path/files", { config: { rateLimit: {
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({
+			error: "uploads_unavailable",
+			message: "This deployment has no file store configured, so it cannot accept uploads."
+		});
+		const { path } = request.params;
+		const resolved = await resolveForm(deps, path);
+		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const form = await storage.getFormByPath(path);
+		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const actor = await actorOf(request);
+		const origin = request.headers.origin;
+		const body = request.body ?? {};
+		const field = typeof body.field === "string" ? body.field : void 0;
+		const name = typeof body.name === "string" ? body.name : void 0;
+		const size = typeof body.size === "number" ? body.size : void 0;
+		const contentType = typeof body.contentType === "string" ? body.contentType : "application/octet-stream";
+		if (field === void 0 || name === void 0 || size === void 0) return reply.code(400).send({
+			error: "invalid_request",
+			message: "Send the field, the name and the size of the file you want to upload."
+		});
+		if (size > maxFileBytes) return reply.code(413).send({
+			error: "too_large",
+			message: `This deployment accepts files up to ${String(maxFileBytes)} bytes.`
+		});
+		const outcome = await offerUpload({
+			storage,
+			now: () => /* @__PURE__ */ new Date(),
+			newId: () => randomUUID()
+		}, {
+			schema: resolved.schema,
+			form,
+			actor: actor === void 0 ? "anonymous" : "authenticated",
+			origin: typeof origin === "string" ? origin : void 0,
+			field,
+			name,
+			size,
+			contentType
+		});
+		if (!outcome.ok) {
+			const status = outcome.reason === "not_allowed" ? 403 : outcome.reason === "too_large" ? 413 : 400;
+			return reply.code(status).send({ error: outcome.reason });
+		}
+		return reply.code(201).send({
+			id: outcome.file.id,
+			name: outcome.file.name,
+			size: outcome.file.size,
+			contentType: outcome.file.contentType,
+			storageKey: outcome.file.storageKey,
+			uploadUrl: `/f/${encodeURIComponent(path)}/files/${outcome.file.id}`
+		});
+	});
+	/** Receive the bytes for a file that was offered. */
+	app.put("/f/:path/files/:id", async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
+		const { path, id } = request.params;
+		const form = await storage.getFormByPath(path);
+		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const file = await storage.getFile(id);
+		if (file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
+		if (file.state !== "offered") return reply.code(409).send({ error: "already_uploaded" });
+		const bytes = request.body;
+		if (!Buffer.isBuffer(bytes)) return reply.code(400).send({ error: "no_body" });
+		if (bytes.byteLength > maxFileBytes) return reply.code(413).send({ error: "too_large" });
+		if (bytes.byteLength !== file.size) return reply.code(400).send({
+			error: "size_mismatch",
+			message: `This upload was offered as ${String(file.size)} bytes and ${String(bytes.byteLength)} arrived.`
+		});
+		const screened = await screenUpload(deps.scanner, file, bytes);
+		if (!screened.ok) {
+			if (screened.reason === "refused") {
+				request.log.warn({
+					file: file.id,
+					finding: screened.finding
+				}, "upload refused by the scanner");
+				return reply.code(422).send({
+					error: "refused_by_scanner",
+					message: `This file was refused by the deployment's virus scanner (${screened.finding}).`
+				});
+			}
+			request.log.error({
+				file: file.id,
+				cause: screened.cause
+			}, "the scanner could not be asked");
+			return reply.code(503).send({
+				error: "scanner_unavailable",
+				message: "This file could not be scanned just now, so it was not kept. Try again."
+			});
+		}
+		await fileStore.put(file.storageKey, bytes);
+		await storage.updateFile({
+			...file,
+			state: "stored"
+		});
+		return reply.code(204).send();
+	});
+	/**
+	* Serve a file back.
+	*
+	* Always as an attachment, never inline, and `nosniff` alongside it. Stored
+	* cross-site scripting through an uploaded HTML or SVG file is the most
+	* commonly exploited vulnerability in this product category, and the real
+	* answer is a separate hostname — which a single-container deployment does
+	* not have. Forcing a download is the accommodation, and it is the one place
+	* this deployment model genuinely costs something.
+	*/
+	app.get("/f/:path/files/:id", async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
+		const { path, id } = request.params;
+		if (await actorOf(request) === void 0) return reply.code(401).send({ error: "unauthenticated" });
+		const form = await storage.getFormByPath(path);
+		const file = await storage.getFile(id);
+		if (form === void 0 || file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
+		const stream = await fileStore.open(file.storageKey);
+		if (stream === void 0) return reply.code(404).send({ error: "unknown_file" });
+		return reply.header("content-type", "application/octet-stream").header("x-content-type-options", "nosniff").header("content-security-policy", "default-src 'none'; sandbox").header("content-disposition", `attachment; filename="${file.name.replace(/["\r\n]/g, "")}"`).send(stream);
+	});
+}
+//#endregion
+//#region src/headers.ts
+/**
+* The header a client declares what it was looking at with.
+*
+* One name, read by the submission route and by the publish plugin: a
+* submission says which version it rendered, and a publish says which version it
+* opened. Two spellings of one header is a bug nobody sees until a client sends
+* the other one.
+*/
+const SCHEMA_HASH_HEADER = "x-formancy-schema-hash";
+//#endregion
+//#region src/routes/publish.ts
+/**
+* Publishing a form, as a plugin of its own.
+*
+* One route family per plugin, which is Fastify's own unit and what `app.ts`'s
+* size budget named as the seam. It moved when the budget refused the next thing
+* added to it rather than letting the number drift.
+*/
+async function publishRoutes(app, { deps, requires }) {
+	app.post("/forms", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.path !== "string" || body.path === "" || body.schema === void 0) return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { path, schema }."
+		});
+		const basedOn = request.headers[SCHEMA_HASH_HEADER];
+		const outcome = await publishForm(deps, {
+			path: body.path,
+			schema: body.schema,
+			actor: request.actor,
+			...typeof basedOn === "string" && basedOn !== "" ? { basedOnSchemaHash: basedOn } : {}
+		});
+		if (!outcome.ok) switch (outcome.kind) {
+			case "invalid_schema": return reply.code(422).send({
+				error: outcome.kind,
+				errors: outcome.errors
+			});
+			case "unsafe_pattern": return reply.code(422).send({
+				error: outcome.kind,
+				patterns: outcome.patterns
+			});
+			case "invalid_logic": return reply.code(422).send({
+				error: outcome.kind,
+				message: outcome.message
+			});
+			case "unknown_options_source": return reply.code(422).send({
+				error: outcome.kind,
+				sources: outcome.sources
+			});
+			case "already_published": return reply.code(409).send({
+				error: outcome.kind,
+				version: outcome.version
+			});
+			case "version_changed": return reply.code(409).send({
+				error: "FORM_VERSION_CHANGED",
+				current: outcome.current === void 0 ? void 0 : {
+					version: outcome.current.version,
+					schemaHash: outcome.current.schemaHash,
+					schema: outcome.current.schema
+				}
+			});
+		}
+		return reply.code(201).send({
+			version: outcome.version,
+			schemaHash: outcome.schemaHash,
+			...outcome.warnings.length > 0 ? { warnings: outcome.warnings } : {}
+		});
+	});
+}
+//#endregion
 //#region src/auth-runtime.ts
 /**
 * The real cryptography, confined to the composition root: argon2id for
@@ -67,7 +277,6 @@ function createSessionTokens(secret) {
 }
 //#endregion
 //#region src/app.ts
-const SCHEMA_HASH_HEADER = "x-formancy-schema-hash";
 /** Base64 JSON, the shape an ALTCHA client already produces. */
 const CHALLENGE_HEADER = "x-formancy-challenge";
 /** Proves the bearer started this draft. Lower-case: Fastify normalises. */
@@ -121,6 +330,7 @@ async function createApp(storage, options) {
 		nowIso: () => (/* @__PURE__ */ new Date()).toISOString(),
 		draftSecret: options.authSecret,
 		...options.optionsSources === void 0 ? {} : { optionsSources: options.optionsSources },
+		...options.scanner === void 0 ? {} : { scanner: options.scanner },
 		capabilities: {
 			now: () => Date.now(),
 			today: () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
@@ -261,39 +471,9 @@ async function createApp(storage, options) {
 			secret: outcome.secret
 		});
 	});
-	app.post("/forms", { preHandler: requires("form.publish") }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.path !== "string" || body.path === "" || body.schema === void 0) return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { path, schema }."
-		});
-		const outcome = await publishForm(deps, {
-			path: body.path,
-			schema: body.schema,
-			actor: request.actor
-		});
-		if (!outcome.ok) switch (outcome.kind) {
-			case "invalid_schema": return reply.code(422).send({
-				error: outcome.kind,
-				errors: outcome.errors
-			});
-			case "unsafe_pattern": return reply.code(422).send({
-				error: outcome.kind,
-				patterns: outcome.patterns
-			});
-			case "invalid_logic": return reply.code(422).send({
-				error: outcome.kind,
-				message: outcome.message
-			});
-			case "unknown_options_source": return reply.code(422).send({
-				error: outcome.kind,
-				sources: outcome.sources
-			});
-		}
-		return reply.code(201).send({
-			version: outcome.version,
-			schemaHash: outcome.schemaHash
-		});
+	await app.register(publishRoutes, {
+		deps,
+		requires
 	});
 	app.put("/f/:path/access", { preHandler: requires("form.publish") }, async (request, reply) => {
 		const { path } = request.params;
@@ -548,111 +728,12 @@ async function createApp(storage, options) {
 		if (resumed === void 0) return reply.code(404).send({ error: "unknown_draft" });
 		return reply.send(resumed);
 	});
-	/**
-	* Ask where to put a file.
-	*
-	* Refusing here, before a byte is sent, is the difference between rejecting
-	* a 2 GB upload and receiving one first. The reply carries the id the
-	* submission will reference and the URL to PUT the bytes to.
-	*/
-	app.post("/f/:path/files", { config: { rateLimit: {
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		if (fileStore === void 0) return reply.code(501).send({
-			error: "uploads_unavailable",
-			message: "This deployment has no file store configured, so it cannot accept uploads."
-		});
-		const { path } = request.params;
-		const resolved = await resolveForm(deps, path);
-		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
-		const form = await storage.getFormByPath(path);
-		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
-		const actor = await actorOf(request);
-		const origin = request.headers.origin;
-		const body = request.body ?? {};
-		const field = typeof body.field === "string" ? body.field : void 0;
-		const name = typeof body.name === "string" ? body.name : void 0;
-		const size = typeof body.size === "number" ? body.size : void 0;
-		const contentType = typeof body.contentType === "string" ? body.contentType : "application/octet-stream";
-		if (field === void 0 || name === void 0 || size === void 0) return reply.code(400).send({
-			error: "invalid_request",
-			message: "Send the field, the name and the size of the file you want to upload."
-		});
-		if (size > maxFileBytes) return reply.code(413).send({
-			error: "too_large",
-			message: `This deployment accepts files up to ${String(maxFileBytes)} bytes.`
-		});
-		const outcome = await offerUpload({
-			storage,
-			now: () => /* @__PURE__ */ new Date(),
-			newId: () => randomUUID()
-		}, {
-			schema: resolved.schema,
-			form,
-			actor: actor === void 0 ? "anonymous" : "authenticated",
-			origin: typeof origin === "string" ? origin : void 0,
-			field,
-			name,
-			size,
-			contentType
-		});
-		if (!outcome.ok) {
-			const status = outcome.reason === "not_allowed" ? 403 : outcome.reason === "too_large" ? 413 : 400;
-			return reply.code(status).send({ error: outcome.reason });
-		}
-		return reply.code(201).send({
-			id: outcome.file.id,
-			name: outcome.file.name,
-			size: outcome.file.size,
-			contentType: outcome.file.contentType,
-			storageKey: outcome.file.storageKey,
-			uploadUrl: `/f/${encodeURIComponent(path)}/files/${outcome.file.id}`
-		});
-	});
-	/** Receive the bytes for a file that was offered. */
-	app.put("/f/:path/files/:id", async (request, reply) => {
-		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
-		const { path, id } = request.params;
-		const form = await storage.getFormByPath(path);
-		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
-		const file = await storage.getFile(id);
-		if (file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
-		if (file.state !== "offered") return reply.code(409).send({ error: "already_uploaded" });
-		const bytes = request.body;
-		if (!Buffer.isBuffer(bytes)) return reply.code(400).send({ error: "no_body" });
-		if (bytes.byteLength > maxFileBytes) return reply.code(413).send({ error: "too_large" });
-		if (bytes.byteLength !== file.size) return reply.code(400).send({
-			error: "size_mismatch",
-			message: `This upload was offered as ${String(file.size)} bytes and ${String(bytes.byteLength)} arrived.`
-		});
-		await fileStore.put(file.storageKey, bytes);
-		await storage.updateFile({
-			...file,
-			state: "stored"
-		});
-		return reply.code(204).send();
-	});
-	/**
-	* Serve a file back.
-	*
-	* Always as an attachment, never inline, and `nosniff` alongside it. Stored
-	* cross-site scripting through an uploaded HTML or SVG file is the most
-	* commonly exploited vulnerability in this product category, and the real
-	* answer is a separate hostname — which a single-container deployment does
-	* not have. Forcing a download is the accommodation, and it is the one place
-	* this deployment model genuinely costs something.
-	*/
-	app.get("/f/:path/files/:id", async (request, reply) => {
-		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
-		const { path, id } = request.params;
-		if (await actorOf(request) === void 0) return reply.code(401).send({ error: "unauthenticated" });
-		const form = await storage.getFormByPath(path);
-		const file = await storage.getFile(id);
-		if (form === void 0 || file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
-		const stream = await fileStore.open(file.storageKey);
-		if (stream === void 0) return reply.code(404).send({ error: "unknown_file" });
-		return reply.header("content-type", "application/octet-stream").header("x-content-type-options", "nosniff").header("content-security-policy", "default-src 'none'; sandbox").header("content-disposition", `attachment; filename="${file.name.replace(/["\r\n]/g, "")}"`).send(stream);
+	await app.register(fileRoutes, {
+		deps,
+		fileStore,
+		maxFileBytes,
+		limit: submissionLimit,
+		actorOf
 	});
 	app.post("/f/:path/submissions", { config: { rateLimit: {
 		max: submissionLimit.max,
@@ -1459,6 +1540,6 @@ function startFileCollector(storage, store, options = {}) {
 	} };
 }
 //#endregion
-export { bootstrapSchema as a, createPostgresStorage as i, createLocalFileStore as n, SCHEMA_HASH_HEADER as o, sha256 as r, createApp as s, startFileCollector as t };
+export { bootstrapSchema as a, createPostgresStorage as i, createLocalFileStore as n, createApp as o, sha256 as r, SCHEMA_HASH_HEADER as s, startFileCollector as t };
 
-//# sourceMappingURL=file-collector-WWc-eo8h.mjs.map
+//# sourceMappingURL=file-collector-CGSJAtGO.mjs.map