@ftisindia/create-app 0.1.6 → 0.3.0

package/template/src/modules/forms/application/services/forms-files.service.ts

@@ -1,7 +1,9 @@
-import { createHash, randomUUID } from 'node:crypto';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import {
   BadRequestException,
-  ConflictException,
+  ConflictException,
+  HttpException,
+  HttpStatus,
   Injectable,
   NotFoundException,
   PayloadTooLargeException,
@@ -12,7 +14,12 @@ import {
   acceptSatisfied,
   walkFields,
 } from '@ftisindia/form-builder';
-import type { FieldDef, FormDefinitionRecord, UploadedFileRecord } from '@ftisindia/form-builder';
+import type {
+  FieldDef,
+  FormDefinitionRecord,
+  OrgFormsPolicy,
+  UploadedFileRecord,
+} from '@ftisindia/form-builder';
 import { AuthenticatedUser } from '../../../auth/types/authenticated-user';
 import { RequestContextService } from '../../../request-context/application/services/request-context.service';
 import { UploadFileQueryDto } from '../../dto/upload-file-query.dto';
@@ -23,15 +30,20 @@ import { LocalDiskStorageAdapter } from '../../infrastructure/storage/local-disk
 import { FormsSettingsReader } from './forms-settings-reader.service';
 
 const sniffer = new DefaultMagicByteSniffer();
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+type UploadedMultipartFile = {
+  originalname: string;
+  size: number;
+  buffer: Buffer;
+};
 
 /**
- * Upload-before-submit (design doc §10): bytes are stored here, the form
- * submission later carries only the file id. Every trust decision is
- * server-side — MIME type is sniffed from content (never the client header),
- * size is enforced against both the field's and the org's caps, sha256 is
- * computed, and the record is bound to uploader AND org (two-factor
- * ownership). Files start TEMPORARY; submit-time linking promotes to LINKED;
- * the GC sweeps the rest after the TTL.
+ * Upload-before-submit (design doc section 10): bytes are stored here, the form
+ * submission later carries only the file id. Authenticated uploads bind to the
+ * user id; public uploads bind to an anonymous claim token returned once by the
+ * public upload endpoint. Submit-time linking re-checks the same ownership or
+ * token claim before promoting the file to LINKED.
  */
 @Injectable()
 export class FormsFilesService {
@@ -48,24 +60,90 @@ export class FormsFilesService {
     orgId: string,
     formKey: string,
     query: UploadFileQueryDto,
-    file: { originalname: string; size: number; buffer: Buffer } | undefined,
+    file: UploadedMultipartFile | undefined,
     user: AuthenticatedUser,
   ) {
     this.requestContext.assertOrgScope(orgId);
+    this.assertUploadRequest(query, file);
+
+    const definition = await this.resolveTargetDefinition(orgId, formKey, query);
+    const field = this.requireFileField(definition, query.field);
+    const policy = await this.settings.policyFor(orgId);
+    const record = await this.storeUpload(orgId, field, file, policy, {
+      ownerId: user.id,
+    });
+
+    return this.toResponse(record);
+  }
+
+  async uploadPublic(
+    orgId: string,
+    formKey: string,
+    query: UploadFileQueryDto,
+    file: UploadedMultipartFile | undefined,
+  ) {
+    this.requestContext.merge({ orgId });
+    this.assertUploadRequest(query, file);
+    if (query.submissionId) {
+      throw new BadRequestException('Public uploads cannot target draft submissions.');
+    }
+
+    const definition = await this.resolvePublicDefinition(orgId, formKey, query);
+    const field = this.requireFileField(definition, query.field);
+    const policy = await this.settings.policyFor(orgId);
+    await this.enforcePublicUploadCap(orgId, policy);
+
+    const uploadToken = randomBytes(32).toString('base64url');
+    const record = await this.storeUpload(orgId, field, file, policy, {
+      ownerId: null,
+      claimTokenHash: createHash('sha256').update(uploadToken).digest('hex'),
+      uploadedIp: this.requestContext.getIpAddress() ?? null,
+    });
+
+    return { ...this.toResponse(record), uploadToken };
+  }
+
+  async getMeta(orgId: string, fileId: string) {
+    this.requestContext.assertOrgScope(orgId);
+    const record = await this.files.findById(orgId, fileId);
+    if (!record) {
+      throw new NotFoundException('File was not found.');
+    }
+    return this.toResponse(record);
+  }
+
+  /** Storage keys never leave the server. */
+  private toResponse(record: UploadedFileRecord) {
+    return {
+      fileId: record.id,
+      originalName: record.originalName,
+      mimeType: record.mimeType,
+      size: record.size,
+      checksum: record.checksum,
+      status: record.status,
+      createdAt: record.createdAt,
+    };
+  }
+
+  private assertUploadRequest(
+    query: UploadFileQueryDto,
+    file: UploadedMultipartFile | undefined,
+  ): asserts file is UploadedMultipartFile {
     if (!file || !file.buffer || file.size === 0) {
       throw new BadRequestException('A non-empty file is required (multipart field "file").');
     }
     if (!query.field) {
       throw new BadRequestException('The "field" query parameter is required.');
     }
+  }
 
-    const definition = await this.resolveTargetDefinition(orgId, formKey, query);
-    const field = this.findFileField(definition.schema.fields, query.field);
-    if (!field) {
-      throw new NotFoundException(`Form has no file field named "${query.field}".`);
-    }
-
-    const policy = await this.settings.policyFor(orgId);
+  private async storeUpload(
+    orgId: string,
+    field: FieldDef,
+    file: UploadedMultipartFile,
+    policy: OrgFormsPolicy,
+    ownership: { ownerId: string | null; claimTokenHash?: string; uploadedIp?: string | null },
+  ) {
     const capMb = Math.min(field.maxSizeMb ?? Infinity, policy.maxFileSizeMb ?? Infinity);
     if (Number.isFinite(capMb) && file.size > capMb * 1024 * 1024) {
       throw new PayloadTooLargeException(`File exceeds the ${capMb} MB limit for this field.`);
@@ -84,39 +162,38 @@ export class FormsFilesService {
     const checksum = createHash('sha256').update(file.buffer).digest('hex');
     const storageKey = `${orgId}/${randomUUID()}`;
     await this.storage.put(storageKey, file.buffer);
-    const record = await this.files.create({
+    return this.files.create({
       storageKey,
       originalName: file.originalname,
       mimeType: sniffed.mimeType,
       size: file.size,
       checksum,
-      ownerId: user.id,
+      ownerId: ownership.ownerId,
+      claimTokenHash: ownership.claimTokenHash ?? null,
+      uploadedIp: ownership.uploadedIp ?? null,
       orgId,
       status: 'TEMPORARY',
     });
-    return this.toResponse(record);
   }
 
-  async getMeta(orgId: string, fileId: string) {
-    this.requestContext.assertOrgScope(orgId);
-    const record = await this.files.findById(orgId, fileId);
-    if (!record) {
-      throw new NotFoundException('File was not found.');
+  private async enforcePublicUploadCap(orgId: string, policy: OrgFormsPolicy): Promise<void> {
+    const cap = policy.maxPublicUploadsPerIpPerDay;
+    const ipAddress = this.requestContext.getIpAddress();
+    if (!cap || cap <= 0 || !ipAddress) {
+      return;
     }
-    return this.toResponse(record);
-  }
 
-  /** Storage keys never leave the server. */
-  private toResponse(record: UploadedFileRecord) {
-    return {
-      fileId: record.id,
-      originalName: record.originalName,
-      mimeType: record.mimeType,
-      size: record.size,
-      checksum: record.checksum,
-      status: record.status,
-      createdAt: record.createdAt,
-    };
+    const count = await this.files.countPublicUploadsByIpSince(
+      orgId,
+      ipAddress,
+      new Date(Date.now() - DAY_MS),
+    );
+    if (count >= cap) {
+      throw new HttpException(
+        'Public upload limit reached. Please try again later.',
+        HttpStatus.TOO_MANY_REQUESTS,
+      );
+    }
   }
 
   private async resolveTargetDefinition(
@@ -152,6 +229,33 @@ export class FormsFilesService {
     return record;
   }
 
+  private async resolvePublicDefinition(
+    orgId: string,
+    formKey: string,
+    query: UploadFileQueryDto,
+  ): Promise<FormDefinitionRecord> {
+    const record =
+      query.version !== undefined
+        ? await this.definitions.findByKeyVersion(orgId, formKey, query.version)
+        : await this.definitions.findLatest(orgId, formKey, 'PUBLISHED');
+    if (
+      !record ||
+      record.status !== 'PUBLISHED' ||
+      (record.schema.settings?.access ?? 'private') !== 'public'
+    ) {
+      throw new NotFoundException('Form was not found.');
+    }
+    return record;
+  }
+
+  private requireFileField(definition: FormDefinitionRecord, name: string): FieldDef {
+    const field = this.findFileField(definition.schema.fields, name);
+    if (!field) {
+      throw new NotFoundException(`Form has no file field named "${name}".`);
+    }
+    return field;
+  }
+
   private findFileField(fields: FieldDef[], name: string): FieldDef | undefined {
     let found: FieldDef | undefined;
     walkFields(fields, (field) => {

package/template/src/modules/forms/application/services/forms-public.service.ts

@@ -38,7 +38,8 @@ export class FormsPublicService {
           formKey,
           version: dto.version,
           data: dto.data,
-          public: true,
+          public: true,
+          uploadTokens: dto.uploadTokens,
           captchaToken: dto.captchaToken,
         },
         this.formsContext,

package/template/src/modules/forms/application/services/forms-settings-reader.service.ts

@@ -9,7 +9,8 @@ const FORMS_SETTING_KEYS = [
   'forms.maxFileSizeMb',
   'forms.enableRuleIteration',
   'forms.virusScanRequired',
-  'forms.maxSubmissionsPerIpPerDay',
+  'forms.maxSubmissionsPerIpPerDay',
+  'forms.maxPublicUploadsPerIpPerDay',
   'forms.webhookAllowedHosts',
 ] as const;
 
@@ -18,7 +19,7 @@ const FORMS_SETTING_KEYS = [
  * setting definitions' defaults for unset keys (the SettingsService 404s on
  * unset keys, which is wrong for policy reads). The result feeds every
  * engine call that takes an OrgFormsPolicy — dangerous-action gating, rule
- * iteration, file caps, public-submission caps.
+ * iteration, file caps, public submission/upload caps.
  */
 @Injectable()
 export class FormsSettingsReader {
@@ -45,7 +46,8 @@ export class FormsSettingsReader {
       enableRuleIteration: read<boolean>('forms.enableRuleIteration'),
       maxFileSizeMb: read<number>('forms.maxFileSizeMb'),
       virusScanRequired: read<boolean>('forms.virusScanRequired'),
-      maxSubmissionsPerIpPerDay: read<number>('forms.maxSubmissionsPerIpPerDay'),
+      maxSubmissionsPerIpPerDay: read<number>('forms.maxSubmissionsPerIpPerDay'),
+      maxPublicUploadsPerIpPerDay: read<number>('forms.maxPublicUploadsPerIpPerDay'),
       webhookAllowedHosts: read<string[]>('forms.webhookAllowedHosts'),
       captchaConfigured: this.captcha != null,
     };

package/template/src/modules/forms/application/services/handlers/webhook-delivery.transport.ts

@@ -0,0 +1,319 @@
+import { lookup as dnsLookup } from 'node:dns/promises';
+import * as http from 'node:http';
+import * as https from 'node:https';
+import { isIP } from 'node:net';
+
+interface LookupAddress {
+  address: string;
+  family: 4 | 6;
+}
+
+interface WebhookDeliveryOptions {
+  headers: Record<string, string>;
+  body: string;
+  timeoutMs: number;
+  lookup?: typeof dnsLookup;
+}
+
+interface WebhookDeliveryResponse {
+  status: number;
+  statusText: string;
+}
+
+const DEFAULT_HTTPS_PORT = 443;
+const DEFAULT_HTTP_PORT = 80;
+
+export async function deliverWebhookRequest(
+  rawUrl: string,
+  options: WebhookDeliveryOptions,
+): Promise<WebhookDeliveryResponse> {
+  const url = parseWebhookUrl(rawUrl);
+  const endpoint = await resolveWebhookEndpoint(url, options.lookup ?? dnsLookup);
+
+  return sendPinnedRequest(url, endpoint, options);
+}
+
+function parseWebhookUrl(rawUrl: string): URL {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error('Webhook URL is invalid.');
+  }
+
+  if (url.username || url.password) {
+    throw new Error('Webhook URL must not include credentials.');
+  }
+
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+    throw new Error('Webhook URL must use http or https.');
+  }
+
+  return url;
+}
+
+async function resolveWebhookEndpoint(url: URL, lookup: typeof dnsLookup): Promise<LookupAddress> {
+  const hostname = normalizeHostname(url.hostname);
+  const literalFamily = isIP(hostname);
+  const addresses: LookupAddress[] =
+    literalFamily === 0
+      ? (await lookup(hostname, { all: true, verbatim: false })).map((entry) => ({
+          address: entry.address,
+          family: entry.family === 6 ? 6 : 4,
+        }))
+      : [{ address: hostname, family: literalFamily as 4 | 6 }];
+
+  if (addresses.length === 0) {
+    throw new Error('Webhook hostname did not resolve to an address.');
+  }
+
+  const normalized = addresses.map((entry) => ({
+    address: normalizeHostname(entry.address),
+    family: entry.family,
+  }));
+  const allowLocalNetwork = process.env.NODE_ENV !== 'production';
+  const unsafe = normalized.filter((entry) => isReservedAddress(entry.address));
+
+  if (!allowLocalNetwork && unsafe.length > 0) {
+    throw new Error(
+      `Webhook destination resolves to a private or reserved address (${unsafe[0]!.address}).`,
+    );
+  }
+
+  if (url.protocol === 'http:') {
+    if (!allowLocalNetwork) {
+      throw new Error('Webhook http destinations are allowed only outside production.');
+    }
+    if (normalized.some((entry) => !isLoopbackAddress(entry.address))) {
+      throw new Error('Webhook http destinations must resolve only to loopback addresses.');
+    }
+  }
+
+  return normalized[0]!;
+}
+
+function sendPinnedRequest(
+  url: URL,
+  endpoint: LookupAddress,
+  options: WebhookDeliveryOptions,
+): Promise<WebhookDeliveryResponse> {
+  const transport = url.protocol === 'https:' ? https : http;
+  const requestOptions: https.RequestOptions = {
+    protocol: url.protocol,
+    hostname: endpoint.address,
+    family: endpoint.family,
+    port: url.port ? Number(url.port) : defaultPort(url),
+    method: 'POST',
+    path: `${url.pathname}${url.search}`,
+    headers: { ...options.headers, host: url.host },
+    timeout: options.timeoutMs,
+  };
+
+  const servername = normalizeHostname(url.hostname);
+  if (url.protocol === 'https:' && isIP(servername) === 0) {
+    requestOptions.servername = servername;
+  }
+
+  return new Promise((resolve, reject) => {
+    const req = transport.request(requestOptions, (res) => {
+      const status = res.statusCode ?? 0;
+      const statusText = res.statusMessage ?? '';
+      res.resume();
+      res.once('end', () => resolve({ status, statusText }));
+    });
+
+    req.once('timeout', () => {
+      req.destroy(new Error('Webhook request timed out.'));
+    });
+    req.once('error', reject);
+    req.end(options.body);
+  });
+}
+
+function defaultPort(url: URL): number {
+  return url.protocol === 'https:' ? DEFAULT_HTTPS_PORT : DEFAULT_HTTP_PORT;
+}
+
+function normalizeHostname(hostname: string): string {
+  return hostname.replace(/^\[/u, '').replace(/\]$/u, '').toLowerCase();
+}
+
+function isLoopbackAddress(address: string): boolean {
+  const family = isIP(address);
+  if (family === 4) {
+    const value = ipv4ToNumber(address);
+    return value !== null && inIpv4Range(value, '127.0.0.0', 8);
+  }
+
+  if (family === 6) {
+    const value = ipv6ToBigInt(address);
+    return value === 1n;
+  }
+
+  return false;
+}
+
+function isReservedAddress(address: string): boolean {
+  const family = isIP(address);
+  if (family === 4) {
+    const value = ipv4ToNumber(address);
+    if (value === null) {
+      return true;
+    }
+
+    return IPV4_RESERVED_RANGES.some(([base, prefix]) => inIpv4Range(value, base, prefix));
+  }
+
+  if (family === 6) {
+    return isReservedIpv6(address);
+  }
+
+  return true;
+}
+
+const IPV4_RESERVED_RANGES: Array<[base: string, prefix: number]> = [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.0.2.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['198.51.100.0', 24],
+  ['203.0.113.0', 24],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+];
+
+function ipv4ToNumber(address: string): number | null {
+  const parts = address.split('.');
+  if (parts.length !== 4) {
+    return null;
+  }
+
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d+$/u.test(part)) {
+      return null;
+    }
+    const byte = Number(part);
+    if (byte < 0 || byte > 255) {
+      return null;
+    }
+    value = (value << 8) + byte;
+  }
+
+  return value >>> 0;
+}
+
+function inIpv4Range(value: number, base: string, prefix: number): boolean {
+  const baseValue = ipv4ToNumber(base);
+  if (baseValue === null) {
+    return false;
+  }
+
+  const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+  return (value & mask) === (baseValue & mask);
+}
+
+function isReservedIpv6(address: string): boolean {
+  const value = ipv6ToBigInt(address);
+  if (value === null) {
+    return true;
+  }
+
+  const mappedIpv4 = ipv4MappedAddress(value);
+  if (mappedIpv4 !== null) {
+    return IPV4_RESERVED_RANGES.some(([base, prefix]) => inIpv4Range(mappedIpv4, base, prefix));
+  }
+
+  return IPV6_RESERVED_RANGES.some(([base, prefix]) => inIpv6Range(value, base, prefix));
+}
+
+const IPV6_RESERVED_RANGES: Array<[base: string, prefix: number]> = [
+  ['::', 128],
+  ['::1', 128],
+  ['::', 8],
+  ['64:ff9b::', 96],
+  ['100::', 64],
+  ['2001:2::', 48],
+  ['2001:10::', 28],
+  ['2001:db8::', 32],
+  ['2002::', 16],
+  ['fc00::', 7],
+  ['fe80::', 10],
+  ['ff00::', 8],
+];
+
+function ipv4MappedAddress(value: bigint): number | null {
+  const mappedPrefix = 0xffffn << 32n;
+  const prefix = value >> 32n;
+  if (prefix !== mappedPrefix >> 32n) {
+    return null;
+  }
+
+  return Number(value & 0xffffffffn);
+}
+
+function inIpv6Range(value: bigint, base: string, prefix: number): boolean {
+  const baseValue = ipv6ToBigInt(base);
+  if (baseValue === null) {
+    return false;
+  }
+
+  const mask = prefix === 0 ? 0n : ((1n << BigInt(prefix)) - 1n) << BigInt(128 - prefix);
+  return (value & mask) === (baseValue & mask);
+}
+
+function ipv6ToBigInt(address: string): bigint | null {
+  let normalized = address.toLowerCase();
+  const zoneIndex = normalized.indexOf('%');
+  if (zoneIndex !== -1) {
+    normalized = normalized.slice(0, zoneIndex);
+  }
+
+  if (normalized.includes('.')) {
+    const lastColon = normalized.lastIndexOf(':');
+    const embedded = ipv4ToNumber(normalized.slice(lastColon + 1));
+    if (lastColon === -1 || embedded === null) {
+      return null;
+    }
+    const high = ((embedded >>> 16) & 0xffff).toString(16);
+    const low = (embedded & 0xffff).toString(16);
+    normalized = `${normalized.slice(0, lastColon)}:${high}:${low}`;
+  }
+
+  const halves = normalized.split('::');
+  if (halves.length > 2) {
+    return null;
+  }
+
+  const head = splitIpv6Half(halves[0] ?? '');
+  const tail = splitIpv6Half(halves[1] ?? '');
+  const missing = halves.length === 2 ? 8 - head.length - tail.length : 0;
+  if (missing < 0 || (halves.length === 1 && head.length !== 8)) {
+    return null;
+  }
+
+  const parts = [...head, ...Array.from({ length: missing }, () => '0'), ...tail];
+  if (parts.length !== 8) {
+    return null;
+  }
+
+  let value = 0n;
+  for (const part of parts) {
+    if (!/^[\da-f]{1,4}$/u.test(part)) {
+      return null;
+    }
+    value = (value << 16n) + BigInt(Number.parseInt(part, 16));
+  }
+
+  return value;
+}
+
+function splitIpv6Half(half: string): string[] {
+  return half.length === 0 ? [] : half.split(':');
+}