@igstack/app-catalog-backend-core 6.3.0 → 6.4.0

package/src/generated/prisma/models.ts

@@ -17,7 +17,8 @@ export type * from './models/DbGroup'
 export type * from './models/DbGroupMembership'
 export type * from './models/DbApprovalMethod'
 export type * from './models/DbResource'
-export type * from './models/DbComment'
+export type * from './models/DbFeedback'
+export type * from './models/DbFeedbackAttachment'
 export type * from './models/DbAppTagDefinition'
 export type * from './models/DbAsset'
 export type * from './models/Source'

package/src/index.ts

@@ -27,14 +27,29 @@ export { registerAuthRoutes } from './modules/auth/registerAuthRoutes'
 export { createAuthRouter, type AuthRouter } from './modules/auth/authRouter'
 
 // Comments
-// CommentView is part of the router's inferred type, so it has to be nameable
+// FeedbackView is part of the router's inferred type, so it has to be nameable
 // from outside the package or every consumer's `useTRPC` becomes unportable.
-export { createCommentsRouter } from './modules/comments/commentsRouter'
+export { createFeedbackRouter } from './modules/feedback/feedbackRouter'
 export {
   EDIT_WINDOW_MS,
+  MAX_ATTACHMENTS,
   MAX_BODY_LENGTH,
-  type CommentView,
-} from './modules/comments/service'
+  MAX_SUBJECT_LENGTH,
+  type FeedbackList,
+  type FeedbackView,
+} from './modules/feedback/service'
+// The identity every surface shares — rows store `hash`, clients may hold `publicId`,
+// and `visitorFromSeed` is how a test or a dev session becomes a chosen visitor.
+export {
+  publicIdFromHash,
+  resolveActor,
+  resolveVisitor,
+  visitorFromSeed,
+  VISITOR_COOKIE,
+  type Actor,
+  type ActorKind,
+  type Visitor,
+} from './modules/visitor/visitorIdentity'
 
 // Icon management
 export {
@@ -60,6 +75,11 @@ export {
   type ScreenshotRestControllerConfig,
 } from './modules/assets/screenshotRestController'
 
+export {
+  registerFeedbackAttachmentController,
+  type FeedbackAttachmentControllerConfig,
+} from './modules/feedback/feedbackAttachmentController'
+
 export { syncAssets, type SyncAssetsConfig } from './modules/assets/syncAssets'
 
 // App Catalog utilities

package/src/middleware/createAcMiddleware.ts

@@ -12,7 +12,7 @@ import { createTrpcRouter } from '../server/controller'
 import { createAcTrpcContext } from '../server/acTrpcContext'
 import { createAuth } from '../modules/auth/auth'
 import { createMockUserFromDevConfig } from '../modules/auth/devMockUserUtils'
-import { resolveVisitor } from '../modules/comments/visitorIdentity'
+import { resolveActor } from '../modules/visitor/visitorIdentity'
 
 export async function createAcMiddleware(
   options: AcMiddlewareOptions,
@@ -82,8 +82,9 @@ export async function createAcMiddleware(
       user,
       isAdmin,
       // Issued here, on every request, so the cookie already exists by the time
-      // someone writes a comment.
-      visitor: resolveVisitor(req, res),
+      // someone sends feedback. Falls back to the anonymous browser when there is no
+      // signed-in user, which today is always.
+      actor: resolveActor(req, res, user?.id ?? null),
     })
   }
 

package/src/middleware/featureRegistry.ts

@@ -8,6 +8,7 @@ import type {
 import { registerIconRestController } from '../modules/icons/iconRestController'
 import { registerAssetRestController } from '../modules/assets/assetRestController'
 import { registerScreenshotRestController } from '../modules/assets/screenshotRestController'
+import { registerFeedbackAttachmentController } from '../modules/feedback/feedbackAttachmentController'
 import { createMockSessionResponse } from '../modules/auth/devMockUserUtils'
 import { getCookie } from '../utils/cookies'
 
@@ -132,6 +133,12 @@ export function registerFeatures(
     basePath: `${basePath}/screenshots`,
   })
 
+  // Images on a correction request. Kept off the asset endpoints on purpose — these
+  // are visitor uploads and must not share a namespace with published artwork.
+  registerFeedbackAttachmentController(router, {
+    basePath: `${basePath}/feedback-attachments`,
+  })
+
   // Optional toggleable features
   const toggles = options.features || {}
 

package/src/modules/appCatalog/service.ts

@@ -205,6 +205,7 @@ function rowToResource(row: ResourceRowWithSourceRefs): Resource {
     urlIssues,
     tiers,
     quickJumps,
+    childrenLabel: row.childrenLabel ?? undefined,
     // Fields from former SubResource
     parentSlug: row.parentSlug ?? undefined,
     tier: row.tier ?? undefined,

package/src/modules/feedback/feedbackAttachmentController.ts

@@ -0,0 +1,248 @@
+import type { Request, RequestHandler, Response, Router } from 'express'
+import multer from 'multer'
+import sharp from 'sharp'
+import { getDbClient } from '../../db'
+import {
+  isNotModified,
+  setRevalidatingCacheHeaders,
+} from '../assets/assetCache'
+import { generateChecksum } from '../assets/assetUtils'
+import { resolveActor } from '../visitor/visitorIdentity'
+import { MAX_ATTACHMENTS } from './service'
+
+/** Long edge, in pixels. A correction request needs a readable screenshot, not a print. */
+const MAX_EDGE = 2000
+
+/** Per upload. Generous for a screenshot; multer rejects above it before we decode. */
+const MAX_UPLOAD_BYTES = 8 * 1024 * 1024
+
+/** Uploads one browser may make per window, and the window. */
+const RATE_LIMIT = 20
+const RATE_WINDOW_MS = 60 * 60 * 1000
+
+/** Orphans older than this are swept — see the sweep below. */
+const ORPHAN_MAX_AGE_MS = 24 * 60 * 60 * 1000
+
+/**
+ * Everything is re-encoded to this one format, so the bytes we store are always
+ * produced by our own encoder from decoded pixels. That is the actual defence: it
+ * drops EXIF, colour profiles, trailing data and anything polyglot that a
+ * content-type header would have happily waved through.
+ */
+const STORED_MIME = 'image/webp'
+
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: MAX_UPLOAD_BYTES, files: MAX_ATTACHMENTS },
+})
+
+/**
+ * Multer's own errors, answered as JSON.
+ *
+ * Handed straight to express they reach the default error page — an HTML stack trace
+ * carrying absolute server paths, from an endpoint any passer-by can POST to. The
+ * limits are also the first thing a person hits by accident, so they deserve a
+ * sentence rather than a 500.
+ */
+const acceptImages: RequestHandler = (req, res, next) => {
+  upload.array('image', MAX_ATTACHMENTS)(req, res, (err: unknown) => {
+    if (err instanceof multer.MulterError) {
+      const message =
+        err.code === 'LIMIT_FILE_COUNT'
+          ? `Up to ${MAX_ATTACHMENTS} images`
+          : err.code === 'LIMIT_FILE_SIZE'
+            ? `Each image must be under ${MAX_UPLOAD_BYTES / 1024 / 1024}MB`
+            : err.code === 'LIMIT_UNEXPECTED_FILE'
+              ? 'Unexpected upload field'
+              : 'Could not read the upload'
+      res.status(400).json({ error: message })
+      return
+    }
+    if (err) {
+      console.error('Error reading feedback attachment upload:', err)
+      res.status(500).json({ error: 'Failed to upload image' })
+      return
+    }
+    next()
+  })
+}
+
+/**
+ * ponytail: in-memory window, so the budget is per process rather than per browser
+ * across a replica set. Move to a shared store if this ever runs more than one
+ * replica and the abuse is real; for a form behind the office network it is enough
+ * to stop a script, which is all it is for.
+ */
+const recentUploads = new Map<string, number[]>()
+
+function overRateLimit(actorHash: string): boolean {
+  const now = Date.now()
+  const kept = (recentUploads.get(actorHash) ?? []).filter(
+    (at) => now - at < RATE_WINDOW_MS,
+  )
+  if (kept.length >= RATE_LIMIT) {
+    recentUploads.set(actorHash, kept)
+    return true
+  }
+  kept.push(now)
+  recentUploads.set(actorHash, kept)
+  return false
+}
+
+/**
+ * Delete images nobody ever submitted. Opportunistic rather than scheduled: an
+ * abandoned form is the only thing that creates them, so the cheapest place to notice
+ * is the next upload, and there is no cron to own.
+ */
+async function sweepOrphans(): Promise<void> {
+  try {
+    await getDbClient().dbFeedbackAttachment.deleteMany({
+      where: {
+        feedbackId: null,
+        createdAt: { lt: new Date(Date.now() - ORPHAN_MAX_AGE_MS) },
+      },
+    })
+  } catch (error) {
+    // A failed sweep must never fail the upload that triggered it.
+    console.error('Error sweeping orphaned feedback attachments:', error)
+  }
+}
+
+export interface FeedbackAttachmentControllerConfig {
+  /** Base path for the endpoints (e.g. '/api/feedback-attachments'). */
+  basePath: string
+}
+
+/**
+ * Upload and retrieval for the images on a correction request.
+ *
+ * These are deliberately NOT `DbAsset`: that table's `name` is unique and holds
+ * published catalog artwork, so letting a passing visitor write into it would mean
+ * untrusted uploads sharing a namespace with the icons the catalog serves.
+ *
+ * Endpoints:
+ * - POST {basePath}/upload - up to MAX_ATTACHMENTS images (multipart, field `image`)
+ * - GET  {basePath}/:id    - the stored image
+ */
+export function registerFeedbackAttachmentController(
+  router: Router,
+  config: FeedbackAttachmentControllerConfig,
+): void {
+  const { basePath } = config
+
+  router.post(
+    `${basePath}/upload`,
+    acceptImages,
+    async (req: Request, res: Response) => {
+      try {
+        // Same identity the feedback row gets, and it issues the cookie if this is
+        // the visitor's first request — so an upload can be the first thing they do.
+        const actor = resolveActor(req, res)
+        if (!actor) {
+          res.status(412).json({ error: 'Uploading needs cookies enabled' })
+          return
+        }
+
+        const files = Array.isArray(req.files) ? req.files : []
+        if (files.length === 0) {
+          res.status(400).json({ error: 'No image uploaded' })
+          return
+        }
+        if (overRateLimit(actor.hash)) {
+          res.status(429).json({ error: 'Too many uploads, try again later' })
+          return
+        }
+
+        const prisma = getDbClient()
+        const ids: string[] = []
+
+        for (const file of files) {
+          // The declared content type is never consulted. Decoding is the check:
+          // if sharp cannot read it as an image, it is not one, whatever the
+          // header claimed.
+          let content: Buffer
+          let width: number | undefined
+          let height: number | undefined
+          try {
+            const out = await sharp(file.buffer, { failOn: 'error' })
+              .rotate() // Apply EXIF orientation BEFORE the metadata is dropped.
+              .resize({
+                width: MAX_EDGE,
+                height: MAX_EDGE,
+                fit: 'inside',
+                withoutEnlargement: true,
+              })
+              .webp({ quality: 82 })
+              .toBuffer({ resolveWithObject: true })
+            content = out.data
+            width = out.info.width
+            height = out.info.height
+          } catch {
+            res
+              .status(400)
+              .json({ error: `Not a readable image: ${file.originalname}` })
+            return
+          }
+
+          const row = await prisma.dbFeedbackAttachment.create({
+            data: {
+              authorHash: actor.hash,
+              // Prisma's Bytes wants a plain view; sharp hands back a Buffer whose
+              // backing store it will not accept as-is.
+              content: new Uint8Array(content),
+              mimeType: STORED_MIME,
+              fileSize: content.byteLength,
+              checksum: generateChecksum(content),
+              width,
+              height,
+              // Kept for a maintainer to read, never used as a path or a key.
+              originalFilename: file.originalname.slice(0, 200),
+            },
+            select: { id: true },
+          })
+          ids.push(row.id)
+        }
+
+        void sweepOrphans()
+        res.status(201).json({ ids })
+      } catch (error) {
+        console.error('Error uploading feedback attachment:', error)
+        res.status(500).json({ error: 'Failed to upload image' })
+      }
+    },
+  )
+
+  router.get(`${basePath}/:id`, async (req: Request, res: Response) => {
+    try {
+      const attachment = await getDbClient().dbFeedbackAttachment.findUnique({
+        where: { id: req.params['id'] ?? '' },
+        select: {
+          content: true,
+          mimeType: true,
+          checksum: true,
+          originalFilename: true,
+        },
+      })
+      if (!attachment) {
+        res.status(404).json({ error: 'Image not found' })
+        return
+      }
+
+      const etag = setRevalidatingCacheHeaders(res, attachment.checksum)
+      if (isNotModified(req, etag)) {
+        res.status(304).end()
+        return
+      }
+
+      res.setHeader('Content-Type', attachment.mimeType)
+      // Never inline-rendered as a document and never sniffed into one: this is the
+      // one place the catalog serves bytes a stranger supplied.
+      res.setHeader('X-Content-Type-Options', 'nosniff')
+      res.setHeader('Content-Disposition', 'inline')
+      res.send(Buffer.from(attachment.content))
+    } catch (error) {
+      console.error('Error fetching feedback attachment:', error)
+      res.status(500).json({ error: 'Failed to fetch image' })
+    }
+  })
+}

package/src/modules/feedback/feedbackRouter.ts

@@ -0,0 +1,102 @@
+import { TRPCError } from '@trpc/server'
+import { z } from 'zod'
+import { publicProcedure, router } from '../../server/trpcSetup'
+import type { Actor } from '../visitor/visitorIdentity'
+import {
+  FeedbackError,
+  MAX_ATTACHMENTS,
+  MAX_BODY_LENGTH,
+  MAX_SUBJECT_LENGTH,
+  addFeedback,
+  dismissFeedback,
+  editFeedback,
+  listFeedback,
+  listMyFeedback,
+} from './service'
+
+/**
+ * Writing needs a visitor token, and the token is issued on the request that reads the
+ * list — so by the time anyone can click Send, the cookie exists. A missing one here
+ * means cookies are blocked, which no error code describes well; PRECONDITION_FAILED at
+ * least separates it from a permission problem.
+ */
+function requireActor(actor: Actor | null): Actor {
+  if (!actor) {
+    throw new TRPCError({
+      code: 'PRECONDITION_FAILED',
+      message: 'Sending this needs cookies enabled',
+    })
+  }
+  return actor
+}
+
+const REASON_CODES = {
+  'not-found': 'NOT_FOUND',
+  'not-author': 'FORBIDDEN',
+  'window-closed': 'FORBIDDEN',
+  'already-reviewed': 'FORBIDDEN',
+  empty: 'BAD_REQUEST',
+  'too-many-attachments': 'BAD_REQUEST',
+} as const
+
+async function mapErrors<T>(work: () => Promise<T>): Promise<T> {
+  try {
+    return await work()
+  } catch (error) {
+    if (error instanceof FeedbackError) {
+      throw new TRPCError({
+        code: REASON_CODES[error.reason],
+        message: error.message,
+      })
+    }
+    throw error
+  }
+}
+
+export function createFeedbackRouter() {
+  return router({
+    /** One entry's thread, plus its unreviewed count so the badge needs no second call. */
+    list: publicProcedure
+      .input(z.object({ resourceSlug: z.string() }))
+      .query(({ input, ctx }) => listFeedback(input.resourceSlug, ctx.actor)),
+
+    /** Everything this browser filed, for the tracker. Empty means render no button. */
+    mine: publicProcedure.query(({ ctx }) => listMyFeedback(ctx.actor)),
+
+    add: publicProcedure
+      .input(
+        z
+          .object({
+            resourceSlug: z.string().optional(),
+            subject: z.string().max(MAX_SUBJECT_LENGTH).optional(),
+            // Both optional on purpose: a bare flag with no words and no image is the
+            // cheapest signal a passing visitor can send, and still worth having.
+            body: z.string().max(MAX_BODY_LENGTH).optional(),
+            attachmentIds: z.array(z.string()).max(MAX_ATTACHMENTS).optional(),
+          })
+          .refine((v) => !!v.resourceSlug || !!v.subject?.trim(), {
+            message: 'Needs either an entry or a subject',
+          }),
+      )
+      .mutation(({ input, ctx }) =>
+        mapErrors(() => addFeedback(input, requireActor(ctx.actor))),
+      ),
+
+    edit: publicProcedure
+      .input(
+        z.object({ id: z.string(), body: z.string().max(MAX_BODY_LENGTH) }),
+      )
+      .mutation(({ input, ctx }) =>
+        mapErrors(() =>
+          editFeedback(input.id, input.body, requireActor(ctx.actor)),
+        ),
+      ),
+
+    /** Withdraw your own, for as long as nobody has reviewed it. */
+    dismiss: publicProcedure
+      .input(z.object({ id: z.string() }))
+      .mutation(({ input, ctx }) =>
+        mapErrors(() => dismissFeedback(input.id, requireActor(ctx.actor))),
+      ),
+  })
+}