@kywi-software/core 0.7.1 → 0.8.0

package/dist/api/__tests__/media-routes-patch.test.js

@@ -1,153 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { Router } from '../router.js';
-import { registerMediaRoutes } from '../media-routes.js';
-import { SignJWT } from 'jose';
-// ── Mocks ─────────────────────────────────────────────────────────────────────
-let mockMedia = {};
-vi.mock('../../db/media-queries.js', () => ({
-    listMedia: vi.fn(),
-    getMediaById: vi.fn((_db, id) => Promise.resolve(mockMedia[id] ?? null)),
-    createMediaRecord: vi.fn(),
-    softDeleteMedia: vi.fn(),
-    restoreMedia: vi.fn(),
-    permanentDeleteMedia: vi.fn(),
-    updateMediaMetadata: vi.fn((db, id, data) => {
-        const item = mockMedia[id];
-        if (!item)
-            return Promise.resolve(null);
-        const updated = { ...item, ...data };
-        mockMedia[id] = updated;
-        return Promise.resolve(updated);
-    }),
-}));
-vi.mock('../../db/site-queries.js', () => ({
-    resolveSiteId: vi.fn(async (_db, idOrSlug) => idOrSlug),
-}));
-vi.mock('../../media/image-processor.js', () => ({
-    isImage: vi.fn((m) => m.startsWith('image/')),
-    processImageVariants: vi.fn().mockResolvedValue({}),
-    getImageMetadata: vi.fn().mockResolvedValue(null),
-}));
-// Item-level media routes resolve the request site now (F2c-J09-G4); id-based mocks
-// ignore siteId, so resolveSiteId only needs a truthy return.
-vi.mock('../../db/site-queries.js', () => ({
-    resolveSiteId: vi.fn(async (_db, idOrSlug) => idOrSlug),
-}));
-// ── Helpers ───────────────────────────────────────────────────────────────────
-const TEST_SECRET = 'test-secret-that-is-at-least-32-chars-long!!';
-async function makeToken(payload = {}) {
-    const key = new TextEncoder().encode(TEST_SECRET);
-    return new SignJWT({ sub: 'user-1', role: 'editor', ...payload })
-        .setProtectedHeader({ alg: 'HS256' })
-        .setIssuedAt()
-        .setExpirationTime('1h')
-        .sign(key);
-}
-function makeStorage() {
-    return {
-        write: vi.fn().mockResolvedValue(undefined),
-        read: vi.fn().mockResolvedValue(Buffer.from('data')),
-        delete: vi.fn().mockResolvedValue(undefined),
-        exists: vi.fn().mockResolvedValue(false),
-    };
-}
-const mockConfig = {
-    mode: 'coupled',
-    db: { provider: 'postgresql', url: 'postgres://localhost/test' },
-    auth: { secret: TEST_SECRET, providers: ['credentials'] },
-    sites: [{ id: 'default', name: 'Test', domain: 'localhost', defaultLocale: 'en', theme: 'default' }],
-    contentTypes: [],
-    plugins: [],
-    modules: [],
-    themes: [],
-    cache: { provider: 'memory' },
-    media: { provider: 'local', localPath: '/tmp/media', maxUploadSizeMb: 10 },
-    email: { provider: 'console', from: 'test@test.com' },
-};
-// ── Tests ─────────────────────────────────────────────────────────────────────
-describe('PATCH /media/:id', () => {
-    let router;
-    let storage;
-    beforeEach(() => {
-        router = new Router();
-        storage = makeStorage();
-        mockMedia = {
-            'media-1': {
-                id: 'media-1',
-                siteId: 'default',
-                filename: 'photo.jpg',
-                originalFilename: 'photo.jpg',
-                mimeType: 'image/jpeg',
-                fileSize: 1024,
-                storageKey: 'default/media-1/photo.jpg',
-                altText: null,
-                caption: null,
-                tags: null,
-            },
-        };
-        registerMediaRoutes(router, {
-            config: mockConfig,
-            db: {},
-            authSecret: TEST_SECRET,
-            storage,
-        });
-    });
-    it('requires authentication', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-1', {
-            method: 'PATCH',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ altText: 'A photo' }),
-        }), ['media', 'media-1']);
-        expect(res.status).toBe(401);
-    });
-    it('returns 404 for nonexistent media', async () => {
-        const token = await makeToken();
-        const res = await router.handle(new Request('http://localhost/api/v1/media/nonexistent', {
-            method: 'PATCH',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${token}`,
-            },
-            body: JSON.stringify({ altText: 'A photo' }),
-        }), ['media', 'nonexistent']);
-        expect(res.status).toBe(404);
-    });
-    it('updates altText, caption, and tags', async () => {
-        const token = await makeToken();
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-1', {
-            method: 'PATCH',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${token}`,
-            },
-            body: JSON.stringify({
-                altText: 'A scenic photo',
-                caption: 'Taken at sunset',
-                tags: ['landscape', 'sunset'],
-            }),
-        }), ['media', 'media-1']);
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.data.altText).toBe('A scenic photo');
-        expect(body.data.caption).toBe('Taken at sunset');
-        expect(body.data.tags).toEqual(['landscape', 'sunset']);
-    });
-    it('GET returns the updated metadata after PATCH', async () => {
-        const token = await makeToken();
-        // First PATCH
-        await router.handle(new Request('http://localhost/api/v1/media/media-1', {
-            method: 'PATCH',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${token}`,
-            },
-            body: JSON.stringify({ altText: 'Updated alt' }),
-        }), ['media', 'media-1']);
-        // Then GET
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-1'), ['media', 'media-1']);
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.data.altText).toBe('Updated alt');
-    });
-});
-//# sourceMappingURL=media-routes-patch.test.js.map

package/dist/api/__tests__/media-routes-patch.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-patch.test.js","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-patch.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,iFAAiF;AAEjF,IAAI,SAAS,GAAwB,EAAE,CAAA;AAEvC,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;IAClB,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACrF,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC1B,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC7B,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAO,EAAE,EAAU,EAAE,IAAS,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAA;QACpC,SAAS,CAAC,EAAE,CAAC,GAAG,OAAO,CAAA;QACvB,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC,CAAC;CACH,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC;CACzE,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrD,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACnD,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC,CAAA;AAEH,oFAAoF;AACpF,8DAA8D;AAC9D,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC;CACzE,CAAC,CAAC,CAAA;AAEH,iFAAiF;AAEjF,MAAM,WAAW,GAAG,8CAA8C,CAAA;AAElE,KAAK,UAAU,SAAS,CAAC,UAAmC,EAAE;IAC5D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACjD,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;SAC9D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC3C,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC5C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;KACzC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,GAAe;IAC7B,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE;IACzD,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACpG,YAAY,EAAE,EAAE;IAChB,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC7B,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE;IAC1E,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE;CACtD,CAAA;AAED,iFAAiF;AAEjF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAI,MAAc,CAAA;IAClB,IAAI,OAAwB,CAAA;IAE5B,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,IAAI,MAAM,EAAE,CAAA;QACrB,OAAO,GAAG,WAAW,EAAE,CAAA;QAEvB,SAAS,GAAG;YACV,SAAS,EAAE;gBACT,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,WAAW;gBACrB,gBAAgB,EAAE,WAAW;gBAC7B,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,2BAA2B;gBACvC,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,IAAI;aACX;SACF,CAAA;QAED,mBAAmB,CAAC,MAAM,EAAE;YAC1B,MAAM,EAAE,UAAU;YAClB,EAAE,EAAE,EAAS;YACb,UAAU,EAAE,WAAW;YACvB,OAAO;SACR,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,uCAAuC,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;SAC7C,CAAC,EACF,CAAC,OAAO,EAAE,SAAS,CAAC,CACrB,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;SAC7C,CAAC,EACF,CAAC,OAAO,EAAE,aAAa,CAAC,CACzB,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,uCAAuC,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,gBAAgB;gBACzB,OAAO,EAAE,iBAAiB;gBAC1B,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;aAC9B,CAAC;SACH,CAAC,EACF,CAAC,OAAO,EAAE,SAAS,CAAC,CACrB,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;QAE/B,cAAc;QACd,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,OAAO,CAAC,uCAAuC,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;SACjD,CAAC,EACF,CAAC,OAAO,EAAE,SAAS,CAAC,CACrB,CAAA;QAED,WAAW;QACX,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,uCAAuC,CAAC,EACpD,CAAC,OAAO,EAAE,SAAS,CAAC,CACrB,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/__tests__/media-routes-site-resolution.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=media-routes-site-resolution.test.d.ts.map

package/dist/api/__tests__/media-routes-site-resolution.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-site-resolution.test.d.ts","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-site-resolution.test.ts"],"names":[],"mappings":""}

package/dist/api/__tests__/media-routes-site-resolution.test.js

@@ -1,76 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { Router } from '../router.js';
-import { registerMediaRoutes } from '../media-routes.js';
-import { listMedia } from '../../db/media-queries.js';
-// listMedia is asserted against; resolveSiteId maps the config slug to a DB UUID.
-vi.mock('../../db/media-queries.js', () => ({
-    listMedia: vi.fn().mockResolvedValue([]),
-    getMediaById: vi.fn(),
-    createMediaRecord: vi.fn(),
-    softDeleteMedia: vi.fn(),
-    restoreMedia: vi.fn(),
-    permanentDeleteMedia: vi.fn(),
-    updateMediaMetadata: vi.fn(),
-}));
-vi.mock('../../db/site-queries.js', () => ({
-    resolveSiteId: vi.fn(async (_db, idOrSlug) => {
-        if (idOrSlug === 'default')
-            return 'site-uuid-123';
-        return idOrSlug;
-    }),
-}));
-const TEST_SECRET = 'test-secret-that-is-at-least-32-chars-long!!';
-const mockConfig = {
-    mode: 'coupled',
-    db: { provider: 'postgresql', url: 'postgres://localhost/test' },
-    auth: { secret: TEST_SECRET, providers: ['credentials'] },
-    sites: [{ id: 'default', name: 'Test', domain: 'localhost', defaultLocale: 'en', theme: 'default' }],
-    contentTypes: [],
-    plugins: [],
-    modules: [],
-    themes: [],
-    cache: { provider: 'memory' },
-    media: { provider: 'local', localPath: '/tmp/media', maxUploadSizeMb: 10 },
-    email: { provider: 'console', from: 'test@test.com' },
-};
-function makeStorage() {
-    return {
-        write: vi.fn().mockResolvedValue(undefined),
-        read: vi.fn().mockResolvedValue(Buffer.from('x')),
-        delete: vi.fn().mockResolvedValue(undefined),
-        exists: vi.fn().mockResolvedValue(true),
-    };
-}
-describe('GET /media — site id resolution', () => {
-    let router;
-    beforeEach(() => {
-        vi.clearAllMocks();
-        router = new Router();
-        registerMediaRoutes(router, {
-            config: mockConfig,
-            db: {},
-            authSecret: TEST_SECRET,
-            storage: makeStorage(),
-        });
-    });
-    it('resolves the default config slug to a DB UUID before querying', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media'), ['media']);
-        expect(res.status).toBe(200);
-        expect(listMedia).toHaveBeenCalledWith(expect.anything(), 'site-uuid-123');
-    });
-    it('passes an explicit siteId query param through resolution', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media?siteId=abc-uuid'), ['media']);
-        expect(res.status).toBe(200);
-        expect(listMedia).toHaveBeenCalledWith(expect.anything(), 'abc-uuid');
-    });
-    it('returns an empty list (not an error) when the site cannot be resolved', async () => {
-        const { resolveSiteId } = await import('../../db/site-queries.js');
-        resolveSiteId.mockResolvedValueOnce(null);
-        const res = await router.handle(new Request('http://localhost/api/v1/media?siteId=missing'), ['media']);
-        expect(res.status).toBe(200);
-        const body = await res.json();
-        expect(body.data).toEqual([]);
-        expect(listMedia).not.toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=media-routes-site-resolution.test.js.map

package/dist/api/__tests__/media-routes-site-resolution.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-site-resolution.test.js","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-site-resolution.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,kFAAkF;AAClF,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC1B,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC7B,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC7B,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,EAAE;QAC5D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,eAAe,CAAA;QAClD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC;CACH,CAAC,CAAC,CAAA;AAEH,MAAM,WAAW,GAAG,8CAA8C,CAAA;AAElE,MAAM,UAAU,GAAe;IAC7B,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE;IACzD,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACpG,YAAY,EAAE,EAAE;IAChB,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC7B,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE;IAC1E,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE;CAC7B,CAAA;AAE1B,SAAS,WAAW;IAClB,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC3C,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC5C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;KACxC,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAI,MAAc,CAAA;IAElB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;QAClB,MAAM,GAAG,IAAI,MAAM,EAAE,CAAA;QACrB,mBAAmB,CAAC,MAAM,EAAE;YAC1B,MAAM,EAAE,UAAU;YAClB,EAAE,EAAE,EAAS;YACb,UAAU,EAAE,WAAW;YACvB,OAAO,EAAE,WAAW,EAAE;SACvB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,+BAA+B,CAAC,EAC5C,CAAC,OAAO,CAAC,CACV,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,+CAA+C,CAAC,EAC5D,CAAC,OAAO,CAAC,CACV,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CACjE;QAAC,aAAqB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,8CAA8C,CAAC,EAC3D,CAAC,OAAO,CAAC,CACV,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7B,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/__tests__/media-routes-site-scope.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=media-routes-site-scope.test.d.ts.map

package/dist/api/__tests__/media-routes-site-scope.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-site-scope.test.d.ts","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-site-scope.test.ts"],"names":[],"mappings":""}

package/dist/api/__tests__/media-routes-site-scope.test.js

@@ -1,119 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { Router } from '../router.js';
-import { registerMediaRoutes } from '../media-routes.js';
-import { SignJWT } from 'jose';
-import { getMediaById, softDeleteMedia, updateMediaMetadata } from '../../db/media-queries.js';
-// F2c-J09-G4 (SECURITY): item-level media routes must scope by the request's
-// site. Without a siteId predicate an authenticated admin could address another
-// site's media by UUID. These tests mock the query layer with a siteId-AWARE
-// implementation so a route that fails to thread the resolved siteId (or threads
-// the wrong one) surfaces as a cross-site leak.
-// A single media row owned by Site A (DB uuid 'site-a-uuid').
-const SITE_A_MEDIA = {
-    id: 'media-a',
-    siteId: 'site-a-uuid',
-    filename: 'a.jpg',
-    originalFilename: 'a.jpg',
-    mimeType: 'image/jpeg',
-    fileSize: 10,
-    storageKey: 'site-a-uuid/media-a/a.jpg',
-    altText: null,
-    caption: null,
-    tags: null,
-};
-vi.mock('../../db/media-queries.js', () => {
-    // Site-aware by-id: return the row only when the requested siteId matches, or
-    // when no siteId scope was supplied (undefined) — mirrors the real predicate.
-    const scoped = (id, siteId) => {
-        if (id !== SITE_A_MEDIA.id)
-            return null;
-        if (siteId !== undefined && siteId !== SITE_A_MEDIA.siteId)
-            return null;
-        return SITE_A_MEDIA;
-    };
-    return {
-        listMedia: vi.fn().mockResolvedValue([]),
-        getMediaById: vi.fn((_db, id, siteId) => Promise.resolve(scoped(id, siteId))),
-        createMediaRecord: vi.fn(),
-        softDeleteMedia: vi.fn((_db, id, siteId) => Promise.resolve(scoped(id, siteId) !== null)),
-        restoreMedia: vi.fn((_db, id, siteId) => Promise.resolve(scoped(id, siteId) !== null)),
-        permanentDeleteMedia: vi.fn((_db, id, siteId) => Promise.resolve(scoped(id, siteId) ? { storageKey: SITE_A_MEDIA.storageKey } : null)),
-        updateMediaMetadata: vi.fn((_db, id, data, siteId) => Promise.resolve(scoped(id, siteId) ? { ...SITE_A_MEDIA, ...data } : null)),
-    };
-});
-vi.mock('../../db/media-reference-queries.js', () => ({
-    findMediaReferences: vi.fn().mockResolvedValue([]),
-}));
-// resolveSiteId maps the config slug 'default' → Site A's UUID; passes UUIDs through.
-vi.mock('../../db/site-queries.js', () => ({
-    resolveSiteId: vi.fn(async (_db, idOrSlug) => idOrSlug === 'default' ? 'site-a-uuid' : idOrSlug),
-}));
-const TEST_SECRET = 'test-secret-that-is-at-least-32-chars-long!!';
-async function token(role = 'siteAdmin') {
-    const key = new TextEncoder().encode(TEST_SECRET);
-    return new SignJWT({ sub: 'u1', role })
-        .setProtectedHeader({ alg: 'HS256' }).setIssuedAt().setExpirationTime('1h').sign(key);
-}
-function storage() {
-    return {
-        write: vi.fn().mockResolvedValue(undefined),
-        read: vi.fn().mockResolvedValue(Buffer.from('x')),
-        delete: vi.fn().mockResolvedValue(undefined),
-        exists: vi.fn().mockResolvedValue(true),
-    };
-}
-const config = {
-    mode: 'coupled',
-    db: { provider: 'postgresql', url: 'postgres://localhost/test' },
-    auth: { secret: TEST_SECRET, providers: ['credentials'] },
-    sites: [{ id: 'default', name: 'A', domain: 'localhost', defaultLocale: 'en', theme: 'default' }],
-    contentTypes: [], plugins: [], modules: [], themes: [],
-    cache: { provider: 'memory' },
-    media: { provider: 'local', localPath: '/tmp/media', maxUploadSizeMb: 10 },
-    email: { provider: 'console', from: 't@t.com' },
-};
-describe('media item routes — cross-site addressing is blocked (F2c-J09-G4)', () => {
-    let router;
-    beforeEach(() => {
-        vi.clearAllMocks();
-        router = new Router();
-        registerMediaRoutes(router, { config, db: {}, authSecret: TEST_SECRET, storage: storage() });
-    });
-    it('GET /media/:id in the owning site returns the row and threads the resolved siteId', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-a?siteId=default'), ['media', 'media-a']);
-        expect(res.status).toBe(200);
-        expect(getMediaById).toHaveBeenCalledWith(expect.anything(), 'media-a', 'site-a-uuid');
-    });
-    it('GET /media/:id scoped to a DIFFERENT site returns 404 (no cross-site read)', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-a?siteId=site-b-uuid'), ['media', 'media-a']);
-        expect(res.status).toBe(404);
-        expect(getMediaById).toHaveBeenCalledWith(expect.anything(), 'media-a', 'site-b-uuid');
-    });
-    it('PATCH /media/:id scoped to a different site returns 404 (no cross-site write)', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-a?siteId=site-b-uuid', {
-            method: 'PATCH',
-            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${await token()}` },
-            body: JSON.stringify({ altText: 'hacked' }),
-        }), ['media', 'media-a']);
-        expect(res.status).toBe(404);
-        expect(updateMediaMetadata).toHaveBeenCalledWith(expect.anything(), 'media-a', expect.anything(), 'site-b-uuid');
-    });
-    it('DELETE /media/:id scoped to a different site returns 404 (no cross-site delete)', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-a?siteId=site-b-uuid', {
-            method: 'DELETE',
-            headers: { Authorization: `Bearer ${await token()}` },
-        }), ['media', 'media-a']);
-        expect(res.status).toBe(404);
-        // The soft-delete query is never reached because the existence guard 404s first.
-        expect(softDeleteMedia).not.toHaveBeenCalled();
-    });
-    it('PATCH /media/:id in the owning site succeeds', async () => {
-        const res = await router.handle(new Request('http://localhost/api/v1/media/media-a?siteId=default', {
-            method: 'PATCH',
-            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${await token()}` },
-            body: JSON.stringify({ altText: 'ok' }),
-        }), ['media', 'media-a']);
-        expect(res.status).toBe(200);
-    });
-});
-//# sourceMappingURL=media-routes-site-scope.test.js.map

package/dist/api/__tests__/media-routes-site-scope.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-site-scope.test.js","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-site-scope.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAE9F,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,iFAAiF;AACjF,gDAAgD;AAEhD,8DAA8D;AAC9D,MAAM,YAAY,GAAG;IACnB,EAAE,EAAE,SAAS;IACb,MAAM,EAAE,aAAa;IACrB,QAAQ,EAAE,OAAO;IACjB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,2BAA2B;IACvC,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAA;AAED,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACxC,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,MAAe,EAAE,EAAE;QAC7C,IAAI,EAAE,KAAK,YAAY,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACvC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACvE,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IACD,OAAO;QACL,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,EAAU,EAAE,MAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACnG,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;QAC1B,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,EAAU,EAAE,MAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/G,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,EAAU,EAAE,MAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAC5G,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,EAAU,EAAE,MAAe,EAAE,EAAE,CACpE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvF,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,EAAU,EAAE,IAAS,EAAE,MAAe,EAAE,EAAE,CAC9E,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KAC7E,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,EAAE,CAAC,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;CACnD,CAAC,CAAC,CAAA;AAEH,sFAAsF;AACtF,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,EAAE,CAC5D,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;CACrD,CAAC,CAAC,CAAA;AAEH,MAAM,WAAW,GAAG,8CAA8C,CAAA;AAElE,KAAK,UAAU,KAAK,CAAC,IAAI,GAAG,WAAW;IACrC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACjD,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACpC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,OAAO;IACd,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC3C,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC5C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;KACxC,CAAA;AACH,CAAC;AAED,MAAM,MAAM,GAAe;IACzB,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE;IACzD,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACjG,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;IACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC7B,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE;IAC1E,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;CACvB,CAAA;AAE1B,QAAQ,CAAC,mEAAmE,EAAE,GAAG,EAAE;IACjF,IAAI,MAAc,CAAA;IAClB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;QAClB,MAAM,GAAG,IAAI,MAAM,EAAE,CAAA;QACrB,mBAAmB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAS,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,sDAAsD,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QAC5F,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,0DAA0D,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QAChG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,0DAA0D,EAAE;YACtE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,KAAK,EAAE,EAAE,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;SAC5C,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAA;IAClH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,0DAA0D,EAAE;YACtE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,KAAK,EAAE,EAAE,EAAE;SACtD,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,iFAAiF;QACjF,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,KAAK,EAAE,EAAE,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/__tests__/media-routes-upload-allowlist.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=media-routes-upload-allowlist.test.d.ts.map

package/dist/api/__tests__/media-routes-upload-allowlist.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-upload-allowlist.test.d.ts","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-upload-allowlist.test.ts"],"names":[],"mappings":""}

package/dist/api/__tests__/media-routes-upload-allowlist.test.js

@@ -1,88 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { Router } from '../router.js';
-import { registerMediaRoutes } from '../media-routes.js';
-import { SignJWT } from 'jose';
-vi.mock('../../db/media-queries.js', () => ({
-    listMedia: vi.fn().mockResolvedValue([]),
-    getMediaById: vi.fn(),
-    createMediaRecord: vi.fn((_db, rec) => Promise.resolve({ id: 'new-media', ...rec })),
-    softDeleteMedia: vi.fn(),
-    restoreMedia: vi.fn(),
-    permanentDeleteMedia: vi.fn(),
-    updateMediaMetadata: vi.fn(),
-}));
-vi.mock('../../db/site-queries.js', () => ({
-    resolveSiteId: vi.fn().mockResolvedValue('site-uuid'),
-}));
-// Non-image types skip the processor; images resolve cleanly here.
-vi.mock('../../media/image-processor.js', () => ({
-    isImage: vi.fn((m) => m.startsWith('image/')),
-    getImageMetadata: vi.fn().mockResolvedValue({ width: 10, height: 10 }),
-    processImageVariants: vi.fn().mockResolvedValue({}),
-}));
-const TEST_SECRET = 'test-secret-that-is-at-least-32-chars-long!!';
-async function token() {
-    const key = new TextEncoder().encode(TEST_SECRET);
-    return new SignJWT({ sub: 'user-1', role: 'editor' }).setProtectedHeader({ alg: 'HS256' }).setIssuedAt().setExpirationTime('1h').sign(key);
-}
-function makeStorage() {
-    const writes = [];
-    return {
-        write: vi.fn((k) => { writes.push(k); return Promise.resolve(); }),
-        read: vi.fn().mockResolvedValue(Buffer.from('x')),
-        delete: vi.fn().mockResolvedValue(undefined),
-        exists: vi.fn().mockResolvedValue(false),
-        writes,
-    };
-}
-const config = {
-    mode: 'coupled',
-    db: { provider: 'postgresql', url: 'postgres://localhost/test' },
-    auth: { secret: TEST_SECRET, providers: ['credentials'] },
-    sites: [{ id: 'default', name: 'Test', domain: 'localhost', defaultLocale: 'en', theme: 'default' }],
-    contentTypes: [], plugins: [], modules: [], themes: [], cache: { provider: 'memory' },
-    media: { provider: 'local', localPath: '/tmp/m', maxUploadSizeMb: 25 },
-};
-async function upload(router, filename, mime, storage) {
-    return router.handle(new Request('http://localhost/api/v1/media?siteId=default', {
-        method: 'POST',
-        headers: { 'content-type': mime, 'x-filename': filename, authorization: `Bearer ${await token()}` },
-        body: Buffer.from('payload'),
-    }), ['media']);
-}
-describe('POST /media — upload allowlist (GAP-08-E)', () => {
-    let router;
-    let storage;
-    beforeEach(() => {
-        router = new Router();
-        storage = makeStorage();
-        registerMediaRoutes(router, { config, db: {}, authSecret: TEST_SECRET, storage });
-    });
-    it('accepts an allowed image', async () => {
-        const res = await upload(router, 'photo.png', 'image/png', storage);
-        expect(res.status).toBe(201);
-    });
-    it('accepts an allowed PDF', async () => {
-        const res = await upload(router, 'report.pdf', 'application/pdf', storage);
-        expect(res.status).toBe(201);
-    });
-    it('rejects an executable with a 400 and does not write to storage', async () => {
-        const res = await upload(router, 'malware.exe', 'application/octet-stream', storage);
-        expect(res.status).toBe(400);
-        const body = (await res.json());
-        expect(body.error.message).toMatch(/not allowed/i);
-        expect(storage.writes).toHaveLength(0); // rejected before any storage write
-    });
-    it('rejects a SPOOFED extension: .jpg name carrying an executable MIME', async () => {
-        const res = await upload(router, 'totally-a-photo.jpg', 'application/x-msdownload', storage);
-        expect(res.status).toBe(400);
-        const body = (await res.json());
-        expect(body.error.message).toMatch(/type .* is not allowed/i);
-        expect(storage.writes).toHaveLength(0);
-    });
-    it('rejects a .php script even when the MIME is spoofed to image/png', async () => {
-        const res = await upload(router, 'shell.php', 'image/png', storage);
-        expect(res.status).toBe(400);
-    });
-});
-//# sourceMappingURL=media-routes-upload-allowlist.test.js.map

package/dist/api/__tests__/media-routes-upload-allowlist.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-upload-allowlist.test.js","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-upload-allowlist.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,GAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9F,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC7B,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC7B,CAAC,CAAC,CAAA;AACH,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;CACtD,CAAC,CAAC,CAAA;AACH,mEAAmE;AACnE,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrD,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC,CAAA;AAEH,MAAM,WAAW,GAAG,8CAA8C,CAAA;AAElE,KAAK,UAAU,KAAK;IAClB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACjD,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5I,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC;QACzE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC5C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACxC,MAAM;KACmC,CAAA;AAC7C,CAAC;AAED,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE;IACzD,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACpG,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACrF,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE;CAC9C,CAAA;AAE1B,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAY,EAAE,OAAwB;IAC5F,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,OAAO,CAAC,8CAA8C,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,MAAM,KAAK,EAAE,EAAE,EAAE;QACnG,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;KAC7B,CAAC,EACF,CAAC,OAAO,CAAC,CACV,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,IAAI,MAAc,CAAA;IAClB,IAAI,OAA+C,CAAA;IAEnD,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,IAAI,MAAM,EAAE,CAAA;QACrB,OAAO,GAAG,WAAW,EAAE,CAAA;QACvB,mBAAmB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAS,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACnE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;QAC1E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAA;QACpF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;QAClD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA,CAAC,oCAAoC;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAA;QAC5F,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;QAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;QACnE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/__tests__/media-routes-upload-robustness.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=media-routes-upload-robustness.test.d.ts.map

package/dist/api/__tests__/media-routes-upload-robustness.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-upload-robustness.test.d.ts","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-upload-robustness.test.ts"],"names":[],"mappings":""}

package/dist/api/__tests__/media-routes-upload-robustness.test.js

@@ -1,88 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { Router } from '../router.js';
-import { registerMediaRoutes } from '../media-routes.js';
-import { SignJWT } from 'jose';
-// Media/site DB layer is mocked; this suite exercises the upload route's
-// image-processing error handling only.
-vi.mock('../../db/media-queries.js', () => ({
-    listMedia: vi.fn().mockResolvedValue([]),
-    getMediaById: vi.fn(),
-    createMediaRecord: vi.fn((_db, rec) => Promise.resolve({ id: 'new-media', ...rec })),
-    softDeleteMedia: vi.fn(),
-    restoreMedia: vi.fn(),
-    permanentDeleteMedia: vi.fn(),
-    updateMediaMetadata: vi.fn(),
-}));
-vi.mock('../../db/site-queries.js', () => ({
-    resolveSiteId: vi.fn().mockResolvedValue('site-uuid'),
-}));
-// isImage → true for image/*; the image probe THROWS to simulate a corrupt or
-// truncated image (e.g. a body clipped by an upstream 10MB body-size limit).
-vi.mock('../../media/image-processor.js', () => ({
-    isImage: vi.fn((m) => m.startsWith('image/')),
-    getImageMetadata: vi.fn().mockRejectedValue(new Error('Input buffer contains unsupported image format')),
-    processImageVariants: vi.fn().mockRejectedValue(new Error('Input buffer contains unsupported image format')),
-}));
-const TEST_SECRET = 'test-secret-that-is-at-least-32-chars-long!!';
-async function makeToken(payload = {}) {
-    const key = new TextEncoder().encode(TEST_SECRET);
-    return new SignJWT({ sub: 'user-1', role: 'editor', ...payload })
-        .setProtectedHeader({ alg: 'HS256' })
-        .setIssuedAt()
-        .setExpirationTime('1h')
-        .sign(key);
-}
-function makeStorage() {
-    const deleted = [];
-    return {
-        write: vi.fn().mockResolvedValue(undefined),
-        read: vi.fn().mockResolvedValue(Buffer.from('data')),
-        delete: vi.fn((key) => { deleted.push(key); return Promise.resolve(); }),
-        exists: vi.fn().mockResolvedValue(false),
-        deleted,
-    };
-}
-const mockConfig = {
-    mode: 'coupled',
-    db: { provider: 'postgresql', url: 'postgres://localhost/test' },
-    auth: { secret: TEST_SECRET, providers: ['credentials'] },
-    sites: [{ id: 'default', name: 'Test', domain: 'localhost', defaultLocale: 'en', theme: 'default' }],
-    contentTypes: [],
-    plugins: [],
-    modules: [],
-    themes: [],
-    cache: { provider: 'memory' },
-    media: { provider: 'local', localPath: '/tmp/media', maxUploadSizeMb: 25, imageSizes: { thumbnail: { width: 320, height: 320, fit: 'cover' } } },
-    email: { provider: 'console', from: 'test@test.com' },
-};
-describe('POST /media — image-processing robustness', () => {
-    let router;
-    let storage;
-    beforeEach(() => {
-        router = new Router();
-        storage = makeStorage();
-        registerMediaRoutes(router, { config: mockConfig, db: {}, authSecret: TEST_SECRET, storage });
-    });
-    it('returns 400 (not 500) when the declared image is unreadable', async () => {
-        const token = await makeToken();
-        const res = await router.handle(new Request('http://localhost/api/v1/media?siteId=default', {
-            method: 'POST',
-            headers: { 'content-type': 'image/png', 'x-filename': 'corrupt.png', authorization: `Bearer ${token}` },
-            body: Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00, 0x00]), // truncated PNG signature
-        }), ['media']);
-        expect(res.status).toBe(400);
-        const body = (await res.json());
-        expect(body.error.message).toMatch(/corrupt|unsupported/i);
-    });
-    it('rolls back the stored original when image processing fails', async () => {
-        const token = await makeToken();
-        await router.handle(new Request('http://localhost/api/v1/media?siteId=default', {
-            method: 'POST',
-            headers: { 'content-type': 'image/png', 'x-filename': 'corrupt.png', authorization: `Bearer ${token}` },
-            body: Buffer.from([0x89, 0x50, 0x4e, 0x47]),
-        }), ['media']);
-        // The original write must have been rolled back so no orphan file is left.
-        expect(storage.deleted.length).toBeGreaterThan(0);
-    });
-});
-//# sourceMappingURL=media-routes-upload-robustness.test.js.map

package/dist/api/__tests__/media-routes-upload-robustness.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"media-routes-upload-robustness.test.js","sourceRoot":"","sources":["../../../src/api/__tests__/media-routes-upload-robustness.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,yEAAyE;AACzE,wCAAwC;AACxC,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAQ,EAAE,GAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9F,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC7B,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC7B,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;CACtD,CAAC,CAAC,CAAA;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrD,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACxG,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;CAC7G,CAAC,CAAC,CAAA;AAEH,MAAM,WAAW,GAAG,8CAA8C,CAAA;AAElE,KAAK,UAAU,SAAS,CAAC,UAAmC,EAAE;IAC5D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACjD,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;SAC9D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC3C,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAW,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC;QAC/E,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACxC,OAAO;KACmC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,GAAe;IAC7B,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE;IACzD,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACpG,YAAY,EAAE,EAAE;IAChB,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC7B,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;IAChJ,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE;CAC7B,CAAA;AAE1B,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,IAAI,MAAc,CAAA;IAClB,IAAI,OAAgD,CAAA;IAEpD,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,IAAI,MAAM,EAAE,CAAA;QACrB,OAAO,GAAG,WAAW,EAAE,CAAA;QACvB,mBAAmB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAS,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAC7B,IAAI,OAAO,CAAC,8CAA8C,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACvG,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,0BAA0B;SACpF,CAAC,EACF,CAAC,OAAO,CAAC,CACV,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;QAC/B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,OAAO,CAAC,8CAA8C,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACvG,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;SAC5C,CAAC,EACF,CAAC,OAAO,CAAC,CACV,CAAA;QACD,2EAA2E;QAC3E,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/__tests__/mfa-routes.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=mfa-routes.test.d.ts.map

package/dist/api/__tests__/mfa-routes.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mfa-routes.test.d.ts","sourceRoot":"","sources":["../../../src/api/__tests__/mfa-routes.test.ts"],"names":[],"mappings":""}