@jokerized/decksmith 0.1.0 → 0.1.2

package/dist/server/upload.js

@@ -1,232 +0,0 @@
-import { posix, sep } from "node:path";
-import { unzipSync } from "fflate";
-const MAX_UPLOAD_BYTES = 20 * 1024 * 1024;
-const ZIP_LIMITS = {
-  maxEntries: 500,
-  maxTotalBytes: 200 * 1024 * 1024,
-  maxEntryBytes: 64 * 1024 * 1024
-};
-const MARKDOWN_EXTS = [".md", ".markdown", ".txt"];
-class UploadError extends Error {
-  hint;
-  status;
-  constructor(message, hint, status = 400) {
-    super(message);
-    this.name = "UploadError";
-    this.hint = hint;
-    this.status = status;
-  }
-}
-const GRACE = 4;
-function readBody(req, limit = MAX_UPLOAD_BYTES) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let size = 0;
-    let refused = false;
-    req.on("data", (chunk) => {
-      size += chunk.length;
-      if (refused) {
-        if (size > limit * GRACE) req.destroy();
-        return;
-      }
-      if (size > limit) {
-        refused = true;
-        chunks.length = 0;
-        reject(
-          new UploadError(
-            `Upload is larger than ${Math.round(limit / 1024 / 1024)} MB.`,
-            "Send the markdown on its own, or a zip holding only the document and the figures it cites.",
-            413
-          )
-        );
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => {
-      if (!refused) resolve(Buffer.concat(chunks));
-    });
-    req.on("error", (err) => {
-      if (!refused) reject(err);
-    });
-  });
-}
-async function parseMultipart(body, contentType) {
-  if (!/^multipart\/form-data\s*;/i.test(contentType)) {
-    throw new UploadError(
-      "This endpoint takes a multipart/form-data upload.",
-      'Post a form with a "file" part holding the document, e.g. `curl -F file=@paper.md`.',
-      415
-    );
-  }
-  let form;
-  try {
-    const view = new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
-    form = await new Response(view, { headers: { "content-type": contentType } }).formData();
-  } catch {
-    throw new UploadError(
-      "The multipart body could not be parsed.",
-      "Let your HTTP client set the Content-Type and boundary rather than writing them by hand."
-    );
-  }
-  const fields = {};
-  let file;
-  form.forEach((value, key) => {
-    if (typeof value === "string") {
-      fields[key] = value;
-      return;
-    }
-    if (key === "file") file = value;
-  });
-  if (!file) {
-    throw new UploadError(
-      'The upload has no "file" part.',
-      'Name the document part "file" \u2014 .md, .markdown, .txt, or a .zip containing one.'
-    );
-  }
-  if (file.size === 0) {
-    throw new UploadError(
-      `"${file.name || "the uploaded file"}" is empty.`,
-      "Check the path you gave your client; an empty part usually means the file was not found."
-    );
-  }
-  return {
-    filename: file.name || "upload",
-    bytes: new Uint8Array(await file.arrayBuffer()),
-    fields
-  };
-}
-function looksLikeZip(bytes) {
-  return bytes.length >= 4 && bytes[0] === 80 && bytes[1] === 75;
-}
-function safeEntryPath(name) {
-  if (name.includes("\0")) return null;
-  const segments = name.replace(/\\/g, "/").split("/");
-  if (/^[a-zA-Z]:/.test(name) || name.startsWith("/") || name.startsWith("\\")) return null;
-  const kept = [];
-  for (const segment of segments) {
-    if (segment === "" || segment === ".") continue;
-    if (segment === "..") return null;
-    kept.push(segment);
-  }
-  if (kept.length === 0) return null;
-  const path = kept.join("/");
-  if (path.length > 512 || kept.some((s) => s.length > 200)) return null;
-  return path;
-}
-function insideRoot(root, joined) {
-  return joined === root || joined.startsWith(root.endsWith(sep) ? root : root + sep);
-}
-function readZip(bytes, limits = ZIP_LIMITS) {
-  const seen = [];
-  try {
-    unzipSync(bytes, {
-      filter: (f) => {
-        seen.push({ name: f.name, originalSize: f.originalSize });
-        return false;
-      }
-    });
-  } catch {
-    throw new UploadError(
-      "That file starts like a zip but could not be read as one.",
-      "Re-create the archive \u2014 a truncated download and a renamed .rar both look like this."
-    );
-  }
-  const warnings = [];
-  const approved = /* @__PURE__ */ new Map();
-  let total = 0;
-  for (const entry of seen) {
-    if (entry.name.endsWith("/")) continue;
-    if (isNoise(entry.name)) continue;
-    const safe = safeEntryPath(entry.name);
-    if (safe === null) {
-      throw new UploadError(
-        `The archive contains an entry that tries to escape its directory: "${entry.name}".`,
-        "Re-zip from inside the folder so every path is relative and none of them start with / or contain .."
-      );
-    }
-    if (entry.originalSize > limits.maxEntryBytes) {
-      throw new UploadError(
-        `"${entry.name}" unpacks to ${mb(entry.originalSize)}, over the ${mb(limits.maxEntryBytes)} per-file limit.`,
-        "Leave the large file out; a deck reads the document and its figures, not the dataset."
-      );
-    }
-    total += entry.originalSize;
-    if (total > limits.maxTotalBytes) {
-      throw new UploadError(
-        `The archive unpacks to more than ${mb(limits.maxTotalBytes)}.`,
-        "Send only the document and the figures it cites."
-      );
-    }
-    if (approved.size >= limits.maxEntries) {
-      throw new UploadError(
-        `The archive holds more than ${limits.maxEntries} files.`,
-        "Send only the document and the figures it cites."
-      );
-    }
-    approved.set(entry.name, safe);
-  }
-  if (approved.size === 0) {
-    throw new UploadError(
-      "The archive is empty.",
-      "Zip the folder that holds your markdown, not an empty one."
-    );
-  }
-  const raw = unzipSync(bytes, { filter: (f) => approved.has(f.name) });
-  const files = {};
-  let actual = 0;
-  for (const [name, safe] of approved) {
-    const data = raw[name];
-    if (!data) continue;
-    actual += data.length;
-    if (actual > limits.maxTotalBytes) {
-      throw new UploadError(
-        `The archive unpacks to more than ${mb(limits.maxTotalBytes)}.`,
-        "Send only the document and the figures it cites."
-      );
-    }
-    if (files[safe]) warnings.push(`two entries both unpack to ${safe}; kept the last`);
-    files[safe] = data;
-  }
-  return { files, warnings };
-}
-function pickMarkdown(files) {
-  const candidates = Object.keys(files).filter(
-    (p) => MARKDOWN_EXTS.includes(posix.extname(p).toLowerCase())
-  );
-  if (candidates.length === 0) {
-    throw new UploadError(
-      `The archive has no ${MARKDOWN_EXTS.join(", ")} file in it.`,
-      "DeckSmith reads a markdown document. Add the .md next to your figures and zip the folder again."
-    );
-  }
-  const rank = (p) => {
-    const base = posix.basename(p).toLowerCase();
-    const named = /^(readme|index|main|paper|analysis)\./.test(base) ? 0 : 1;
-    return [p.split("/").length, named, p];
-  };
-  return candidates.sort((a, b) => {
-    const [da, na, pa] = rank(a);
-    const [db, nb, pb] = rank(b);
-    return da - db || na - nb || pa.localeCompare(pb);
-  })[0];
-}
-function isNoise(name) {
-  return name.startsWith("__MACOSX/") || name.includes("/__MACOSX/") || posix.basename(name) === ".DS_Store" || posix.basename(name) === "Thumbs.db";
-}
-function mb(bytes) {
-  return `${Math.round(bytes / 1024 / 1024)} MB`;
-}
-export {
-  MARKDOWN_EXTS,
-  MAX_UPLOAD_BYTES,
-  UploadError,
-  ZIP_LIMITS,
-  insideRoot,
-  looksLikeZip,
-  parseMultipart,
-  pickMarkdown,
-  readBody,
-  readZip,
-  safeEntryPath
-};