@lacrous/omnicloud 0.2.16 → 0.2.18

package/dist/index.d.cts

@@ -930,6 +930,8 @@ interface UploadOperationRecord {
     telegramMessageId: number | null;
     sha256: string | null;
     size: number | null;
+    /** Digest of the original request (name, folder, target, content). Replays must match it. */
+    requestFingerprint: string | null;
     fileId: string | null;
     error: string | null;
     createdAt: Date;
@@ -943,6 +945,7 @@ interface UploadOperationRepository {
     create(input: {
         userId: string;
         operationId: string;
+        requestFingerprint?: string | null;
     }): Promise<UploadOperationRecord>;
     /**
      * Atomically moves an operation from `from` to `to` if, and only if, it is

package/dist/index.d.ts

@@ -930,6 +930,8 @@ interface UploadOperationRecord {
     telegramMessageId: number | null;
     sha256: string | null;
     size: number | null;
+    /** Digest of the original request (name, folder, target, content). Replays must match it. */
+    requestFingerprint: string | null;
     fileId: string | null;
     error: string | null;
     createdAt: Date;
@@ -943,6 +945,7 @@ interface UploadOperationRepository {
     create(input: {
         userId: string;
         operationId: string;
+        requestFingerprint?: string | null;
     }): Promise<UploadOperationRecord>;
     /**
      * Atomically moves an operation from `from` to `to` if, and only if, it is

package/dist/index.js

@@ -1414,6 +1414,20 @@ function sanitizeFileName(name) {
   return cleaned.slice(0, 255);
 }
 
+// ../core/src/utils/request-fingerprint.ts
+import { createHash as createHash4 } from "crypto";
+function uploadRequestFingerprint(input) {
+  const contentHash = input.spooled?.sha256 ?? sha256Hex(input.data ?? Buffer.alloc(0));
+  const canonical = JSON.stringify({
+    name: sanitizeFileName(input.name),
+    folderId: input.folderId ?? null,
+    replaceFileId: input.replaceFileId ?? null,
+    contentHash,
+    size: input.spooled?.size ?? input.data?.byteLength ?? 0
+  });
+  return createHash4("sha256").update(canonical).digest("hex");
+}
+
 // ../core/src/services/file-service.ts
 var FileService = class {
   constructor(files, folders, engineFor, activity = noopActivityRecorder, operations = null, log = null) {
@@ -1452,7 +1466,13 @@ var FileService = class {
     if (!isValidOperationId(operationId)) {
       throw new ValidationError("Invalid upload operation id");
     }
+    const fingerprint = uploadRequestFingerprint(input);
     let op = await operations.findByOperationId(userId, operationId);
+    if (op?.requestFingerprint && op.requestFingerprint !== fingerprint) {
+      throw new ConflictError(
+        "This upload key was already used for a different file. Use a new key for a new upload."
+      );
+    }
     if (op?.status === "COMPLETED" && op.fileId) {
       return this.get(userId, op.fileId);
     }
@@ -1461,7 +1481,7 @@ var FileService = class {
     }
     if (!op) {
       try {
-        op = await operations.create({ userId, operationId });
+        op = await operations.create({ userId, operationId, requestFingerprint: fingerprint });
       } catch (error) {
         if (!(error instanceof OperationAlreadyExistsError)) throw error;
         const outcome = await this.followWinner(userId, input, operationId, operations);
@@ -2571,7 +2591,7 @@ var RecentService = class {
 };
 
 // ../core/src/utils/spool.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { createWriteStream } from "fs";
 import { mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";