@jmruthers/pace-core 0.5.189 → 0.5.191

package/src/utils/storage/helpers.ts

@@ -18,33 +18,37 @@ import { createLogger } from '../core/logger';
 const log = createLogger('StorageHelpers');
 
 /**
- * Generate a file path based on organization-first structure
+ * Generate a file path based on organization-first or user-first structure
+ * - If orgId is provided: {orgId}/{folder}/filename
+ * - If userId is provided (and orgId is not): users/{userId}/{folder}/filename
  */
 export function generateFilePath(options: StorageUploadOptions, fileName: string): string {
-  const { orgId, isPublic = false, customPath } = options;
+  const { orgId, userId, isPublic = false, customPath } = options;
   
-  
-  // Validate required orgId
-  if (!orgId) {
-    throw new Error('orgId is required for file path generation');
+  // Validate that either orgId or userId is provided
+  if (!orgId && !userId) {
+    throw new Error('Either orgId or userId is required for file path generation');
   }
   
+  // Determine base path: organisation-based or user-based
+  const basePath = orgId ? orgId : `users/${userId}`;
+  
   if (isPublic) {
-    // Public files go to {orgId}/{folder}/filename
+    // Public files go to {basePath}/{folder}/filename
     if (customPath) {
-      return `${orgId}/${customPath}/${fileName}`;
+      return `${basePath}/${customPath}/${fileName}`;
     }
-    return `${orgId}/public/${fileName}`;
+    return `${basePath}/public/${fileName}`;
   }
   
-  // Organization-first structure: {orgId}/{folder}/filename
+  // Organization-first or user-first structure: {basePath}/{folder}/filename
   if (customPath) {
-    return `${orgId}/${customPath}/${fileName}`;
+    return `${basePath}/${customPath}/${fileName}`;
   }
   
   // Use customPath if available, otherwise default to files
   const pathFolder = customPath || 'files';
-  return `${orgId}/${pathFolder}/${fileName}`;
+  return `${basePath}/${pathFolder}/${fileName}`;
 }
 
 /**
@@ -86,7 +90,8 @@ export async function extractFileMetadata(
   const metadata: StorageFileMetadata = {
     mimeType: file.type,
     size: file.size,
-    orgId: options.orgId,
+    ...(options.orgId && { orgId: options.orgId }),
+    ...(options.userId && { userId: options.userId }),
     appName: options.appName || 'pace-core',
     uploadedBy,
     uploadedAt: new Date().toISOString(),
@@ -608,8 +613,14 @@ export async function listFiles(
     // Select bucket based on isPublic flag (default to private files bucket)
     const bucketName = getBucketName(options.isPublic || false);
     
-    // Organization-first structure: {orgId}/{category}/
-    const pathPrefix = `${options.orgId}/`;
+    // Validate that either orgId or userId is provided
+    if (!options.orgId && !options.userId) {
+      throw new Error('Either orgId or userId is required for listing files');
+    }
+    
+    // Organization-first or user-first structure
+    const basePath = options.orgId ? options.orgId : `users/${options.userId}`;
+    const pathPrefix = `${basePath}/`;
     const searchPath = options.pathPrefix ? `${pathPrefix}${options.pathPrefix}` : pathPrefix;
 
     const { data, error } = await supabase.storage
@@ -634,7 +645,8 @@ export async function listFiles(
       metadata: {
         mimeType: item.metadata?.mimetype || 'application/octet-stream',
         size: item.metadata?.size || 0,
-        orgId: options.orgId,
+        ...(options.orgId && { orgId: options.orgId }),
+        ...(options.userId && { userId: options.userId }),
         appName: options.appName,
         uploadedBy: 'unknown',
         uploadedAt: item.created_at || new Date().toISOString(),
@@ -716,13 +728,20 @@ export async function downloadFile(
 export async function archiveFile(
   supabase: SupabaseClient,
   path: string,
-  options: { appName: string; orgId: string; isPublic?: boolean }
+  options: { appName: string; orgId?: string; userId?: string; isPublic?: boolean }
 ): Promise<{ success: boolean; error?: string }> {
   try {
     const bucketName = getBucketName(options.isPublic || false);
     
-    // Generate archived path for organization-first structure
-    const archivedPath = path.replace(`${options.orgId}/`, `archived/${options.orgId}/`);
+    // Generate archived path for organization-first or user-first structure
+    let archivedPath: string;
+    if (options.orgId) {
+      archivedPath = path.replace(`${options.orgId}/`, `archived/${options.orgId}/`);
+    } else if (options.userId) {
+      archivedPath = path.replace(`users/${options.userId}/`, `archived/users/${options.userId}/`);
+    } else {
+      throw new Error('Either orgId or userId is required for archiving files');
+    }
     
     // Copy file to archived location
     const { error: copyError } = await supabase.storage

package/src/utils/storage/types.ts

@@ -5,13 +5,15 @@
 export interface StorageUploadOptions {
   /** The app name from rbac_apps */
   appName: string;
-  /** Organisation ID for scoping */
-  orgId: string;
+  /** Organisation ID for scoping (required if userId not provided) */
+  orgId?: string;
+  /** User ID for user-scoped files (required if orgId not provided) */
+  userId?: string;
   /** Whether the file should be publicly accessible */
   isPublic?: boolean;
   /** Optional tags for categorisation */
   tags?: string[];
-  /** Optional custom path within the app/org structure */
+  /** Optional custom path within the app/org/user structure */
   customPath?: string;
   /** Optional metadata to store with the file */
   metadata?: Record<string, any>;
@@ -23,7 +25,8 @@ export interface StorageFileMetadata {
   width?: number;
   height?: number;
   hash?: string;
-  orgId: string;
+  orgId?: string;
+  userId?: string;
   appName: string;
   uploadedBy: string;
   uploadedAt: string;
@@ -43,8 +46,10 @@ export interface StorageUploadResult {
 export interface StorageUrlOptions {
   /** The app name from rbac_apps */
   appName: string;
-  /** Organisation ID for scoping */
-  orgId: string;
+  /** Organisation ID for scoping (required if userId not provided) */
+  orgId?: string;
+  /** User ID for user-scoped files (required if orgId not provided) */
+  userId?: string;
   /** Expiry time in seconds for signed URLs (default: 3600) */
   expiresIn?: number;
 }
@@ -52,8 +57,10 @@ export interface StorageUrlOptions {
 export interface StorageListOptions {
   /** The app name from rbac_apps */
   appName: string;
-  /** Organisation ID for scoping */
-  orgId: string;
+  /** Organisation ID for scoping (required if userId not provided) */
+  orgId?: string;
+  /** User ID for user-scoped files (required if orgId not provided) */
+  userId?: string;
   /** Optional path prefix to filter by */
   pathPrefix?: string;
   /** Optional tags to filter by */

package/src/utils/validation/__tests__/csrf.test.ts

@@ -0,0 +1,105 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import {
+  csrfManager,
+  generateCSRFToken,
+  validateCSRFToken,
+  getCSRFToken,
+} from '../csrf';
+import { secureStorage } from '../../security/secureStorage';
+
+const getTokenCache = () => (csrfManager as unknown as { tokenCache: Map<string, unknown> }).tokenCache;
+
+describe('csrf protection', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+    localStorage.clear();
+    const cache = getTokenCache();
+    cache?.clear();
+  });
+
+  it('generates secure tokens and persists them', async () => {
+    const setItemSpy = vi.spyOn(secureStorage, 'setItem').mockResolvedValue();
+    const token = await generateCSRFToken('session-1');
+
+    expect(token).toMatch(/^[a-f0-9]{64}$/);
+    expect(setItemSpy).toHaveBeenCalledWith(
+      'csrf_tokens',
+      expect.stringContaining('session-1'),
+      { encrypt: true, expiry: expect.any(Number) }
+    );
+
+    const cache = getTokenCache();
+    expect(cache.get(token)).toMatchObject({ sessionId: 'session-1', used: false });
+  });
+
+  it('validates tokens only once and marks them as used', async () => {
+    vi.spyOn(secureStorage, 'setItem').mockResolvedValue();
+    const token = await generateCSRFToken('session-2');
+
+    await expect(validateCSRFToken(token, 'session-2')).resolves.toBe(true);
+    await expect(validateCSRFToken(token, 'session-2')).resolves.toBe(false);
+
+    const cache = getTokenCache();
+    expect((cache.get(token) as any).used).toBe(true);
+  });
+
+  it('rejects expired tokens and persists cleanup', async () => {
+    const persistSpy = vi.spyOn(secureStorage, 'setItem').mockResolvedValue();
+    const cache = getTokenCache();
+
+    cache.set('expired-token', {
+      token: 'expired-token',
+      sessionId: 'expired-session',
+      timestamp: Date.now() - 31 * 60 * 1000,
+      used: false,
+    });
+
+    const result = await validateCSRFToken('expired-token', 'expired-session');
+    expect(result).toBe(false);
+    expect(cache.has('expired-token')).toBe(false);
+    expect(persistSpy).toHaveBeenCalled();
+  });
+
+  it('loads stored tokens when cache is empty and returns current token', async () => {
+    const now = Date.now();
+    vi.spyOn(secureStorage, 'getItem').mockResolvedValue(
+      JSON.stringify([
+        [
+          'valid-token',
+          { token: 'valid-token', sessionId: 'session-load', timestamp: now, used: false },
+        ],
+        [
+          'stale-token',
+          { token: 'stale-token', sessionId: 'session-load', timestamp: now - 40 * 60 * 1000, used: false },
+        ],
+      ])
+    );
+    const persistSpy = vi.spyOn(secureStorage, 'setItem').mockResolvedValue();
+
+    const token = await getCSRFToken('session-load');
+
+    expect(token).toBe('valid-token');
+    expect(persistSpy).toHaveBeenCalled();
+  });
+
+  it('returns false for invalid or mismatched tokens', async () => {
+    vi.spyOn(secureStorage, 'getItem').mockResolvedValue(null);
+    await expect(validateCSRFToken('unknown', 'session-x')).resolves.toBe(false);
+
+    vi.spyOn(secureStorage, 'setItem').mockResolvedValue();
+    const token = await generateCSRFToken('session-y');
+    await expect(validateCSRFToken(token, 'other-session')).resolves.toBe(false);
+  });
+
+  it('fails gracefully when token generation throws', async () => {
+    const randomSpy = vi
+      .spyOn(globalThis.crypto, 'getRandomValues')
+      .mockImplementation(() => {
+        throw new Error('no entropy');
+      });
+
+    await expect(generateCSRFToken('session-error')).rejects.toThrow('CSRF token generation failed');
+    expect(randomSpy).toHaveBeenCalled();
+  });
+});

package/src/utils/validation/__tests__/sqlInjectionProtection.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect, vi } from 'vitest';
+import {
+  buildSafeQueryParams,
+  detectSQLInjection,
+  escapeLikeQuery,
+  sanitizeFilters,
+  sanitizeSearchQuery,
+  searchQuerySchema,
+  sqlIdentifierSchema,
+  orderBySchema,
+  limitOffsetSchema,
+} from '../sqlInjectionProtection';
+
+describe('sqlInjectionProtection', () => {
+  it('sanitizes search queries by stripping dangerous characters and trimming length', () => {
+    const longQuery = `${'DROP TABLE users; '.repeat(40)}'%evil`;
+    const sanitized = sanitizeSearchQuery(longQuery);
+
+    expect(sanitized.includes('DROP')).toBe(true);
+    expect(sanitized).not.toContain("'");
+    expect(sanitized).not.toContain('%');
+    expect(sanitized.length).toBeLessThanOrEqual(500);
+  });
+
+  it('validates search query schema and transforms input', () => {
+    const parsed = searchQuerySchema.parse('   abc   ');
+    expect(parsed).toBe('abc');
+    expect(() => searchQuerySchema.parse('SELECT * FROM users')).toThrow('Invalid characters detected in search query');
+  });
+
+  it('validates identifiers and ordering formats', () => {
+    expect(sqlIdentifierSchema.parse('valid_name')).toBe('valid_name');
+    expect(() => sqlIdentifierSchema.parse('SELECT')).toThrow('Identifier cannot be a reserved SQL keyword');
+    expect(orderBySchema.parse('created_at DESC')).toBe('created_at DESC');
+    expect(() => orderBySchema.parse('invalid order by')).toThrow('Invalid order by format');
+  });
+
+  it('validates numeric limit and offset values', () => {
+    expect(limitOffsetSchema.parse(25)).toBe(25);
+    expect(() => limitOffsetSchema.parse(-1)).toThrow('Must be non-negative');
+    expect(() => limitOffsetSchema.parse(10000)).toThrow('Limit too large');
+  });
+
+  it('escapes like queries safely', () => {
+    expect(escapeLikeQuery('100% match_')).toBe('100\\% match\\_');
+  });
+
+  it('sanitizes filters and omits invalid keys while logging', () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const sanitized = sanitizeFilters({
+      valid: 'abc',
+      '1invalid': 'DROP TABLE',
+      numbers: [1, 'two', '3;DELETE'],
+      malicious: "UNION SELECT password",
+    });
+
+    expect(sanitized.valid).toBe('abc');
+    expect(sanitized).not.toHaveProperty('1invalid');
+    expect(sanitized.malicious).toBeUndefined();
+    expect(sanitized.numbers).toEqual([1, 'two', '3DELETE']);
+    expect(warnSpy).toHaveBeenCalled();
+  });
+
+  it('builds safe query params only including validated parts', () => {
+    const safe = buildSafeQueryParams({
+      select: 'id, name, DROP',
+      filters: { id: 1, unsafe: 'UNION SELECT *' },
+      orderBy: 'created_at DESC',
+      limit: 25,
+      offset: 5,
+      search: " ';DROP",
+    });
+
+    expect(safe.select).toBe('id, name');
+    expect(safe.filters).toEqual({ id: 1 });
+    expect(safe.orderBy).toBe('created_at DESC');
+    expect(safe.limit).toBe(25);
+    expect(safe.offset).toBe(5);
+    expect(safe.search).toBeUndefined();
+  });
+
+  it('detects SQL injection patterns with risk levels', () => {
+    const injection = detectSQLInjection("'; UNION SELECT password FROM users --");
+    expect(injection.isSuspicious).toBe(true);
+    expect(injection.riskLevel).toBe('critical');
+    expect(injection.patterns.length).toBeGreaterThan(0);
+
+    const benign = detectSQLInjection('12345');
+    expect(benign.isSuspicious).toBe(false);
+    expect(benign.riskLevel).toBe('low');
+  });
+});

package/src/vite-env.d.ts

@@ -9,8 +9,8 @@ interface ImportMetaEnv {
   // Add other environment variables as needed
   readonly VITE_APP_NAME?: string
   readonly VITE_SUPABASE_URL?: string
-  // Accepts both legacy anon keys and modern publishable keys (sb_publishable_...)
-  readonly VITE_SUPABASE_ANON_KEY?: string
+  // Publishable key (sb_publishable_...)
+  readonly VITE_SUPABASE_PUBLISHABLE_KEY?: string
 }
 
 interface ImportMeta {