@lenne.tech/nest-server 11.33.0 → 11.34.0

package/src/core/modules/hub/services/core-hub-db.service.ts

@@ -3,11 +3,26 @@ import { InjectConnection } from '@nestjs/mongoose';
 import * as mongo from 'mongodb';
 import { Connection, Types } from 'mongoose';
 
+import { ConfigService } from '../../../common/services/config.service';
+import { CoreS3Service } from '../../../common/services/core-s3.service';
 import { ModelRegistry } from '../../../common/services/model-registry.service';
+import {
+  DEFAULT_FILESYSTEM_DIR,
+  FILESYSTEM_FILES_COLLECTION,
+  FilesystemFileHelper,
+} from '../../file/filesystem-file.helper';
+import { S3_FILES_COLLECTION, S3FileHelper } from '../../file/s3-file.helper';
 import { HubActionMessage } from '../hub-action-messages';
 import { HUB_CONFIG } from '../hub.constants';
 import { buildErDiagram, HubModelDescriptor, HubModelField } from '../helpers/hub-mermaid.helper';
-import { HubDbData, HubFilesData, HubModelsData, HubUnavailable } from '../interfaces/hub-panels.interface';
+import {
+  HubDbData,
+  HubFilesData,
+  HubFileStore,
+  HubFileStoreSummary,
+  HubModelsData,
+  HubUnavailable,
+} from '../interfaces/hub-panels.interface';
 import { ResolvedHubConfig } from '../interfaces/hub-config.interface';
 
 /**
@@ -23,6 +38,10 @@ export class CoreHubDbService {
   constructor(
     @Inject(HUB_CONFIG) protected readonly config: ResolvedHubConfig,
     @Optional() @InjectConnection() protected readonly connection?: Connection,
+    // Provided and exported globally by `CoreModule`, but INERT without an `s3` config — so it is
+    // optional here for the same reason it is everywhere else: a project that uses no S3 must not
+    // be forced to install `@aws-sdk/client-s3` to open the Hub.
+    @Optional() protected readonly s3Service?: CoreS3Service,
   ) {}
 
   /** Database + per-collection statistics. */
@@ -85,10 +104,21 @@ export class CoreHubDbService {
   }
 
   /**
-   * Delete a GridFS file by id. When `expectedFilename` is given it must match the stored filename
-   * (the type-to-confirm keyword). Returns the filename; throws when not found or the name mismatches.
+   * Delete a file by id, from WHICHEVER store actually holds it.
+   *
+   * When `expectedFilename` is given it must match the stored filename (the type-to-confirm
+   * keyword). Returns the filename and the store it came from; throws when not found, when the name
+   * mismatches, or when the owning store cannot be reached.
+   *
+   * This used to delete from GridFS only, which meant an S3- or filesystem-backed file could not be
+   * removed from the Hub at all — the lookup answered `File not found.` for a file plainly sitting
+   * in the bucket.
    */
-  async deleteFile(id: string, expectedFilename?: string, bucket = 'fs'): Promise<{ filename: string; id: string }> {
+  async deleteFile(
+    id: string,
+    expectedFilename?: string,
+    bucket = 'fs',
+  ): Promise<{ filename: string; id: string; store: HubFileStore }> {
     const db = this.connection?.db;
     if (!db) {
       throw new Error(HubActionMessage.mongoUnavailable);
@@ -97,46 +127,140 @@ export class CoreHubDbService {
       throw new Error(HubActionMessage.invalidFileId);
     }
     const objectId = new Types.ObjectId(id);
-    const [doc] = await db.collection(`${bucket}.files`).find({ _id: objectId }, { limit: 1 }).toArray();
-    if (!doc) {
+
+    // Same probe order as `CoreFileService.deleteFile()`: S3, then filesystem, then GridFS as the
+    // fallthrough. Keeping the two in step matters — a Hub that resolved a file differently from the
+    // service would delete a different file than the one it displayed.
+    let store: HubFileStore | undefined;
+    let doc: any;
+    for (const candidate of this.fileStores(bucket)) {
+      const [found] = await db.collection(candidate.collection).find({ _id: objectId }, { limit: 1 }).toArray();
+      if (found) {
+        doc = found;
+        store = candidate.store;
+        break;
+      }
+    }
+    if (!doc || !store) {
       throw new Error(HubActionMessage.fileNotFound);
     }
     if (expectedFilename !== undefined && expectedFilename !== doc.filename) {
       throw new Error(HubActionMessage.confirmationFilenameMismatch);
     }
-    const gridFs = new mongo.GridFSBucket(db as unknown as mongo.Db, { bucketName: bucket });
-    await gridFs.delete(objectId as unknown as mongo.ObjectId);
-    return { filename: doc.filename, id };
+
+    switch (store) {
+      case 'filesystem': {
+        await FilesystemFileHelper.deleteFile(this.filesystemDir, db.collection(FILESYSTEM_FILES_COLLECTION), objectId);
+        break;
+      }
+      case 's3': {
+        // Refuse rather than half-delete — see HubActionMessage.s3Unavailable.
+        if (!this.s3Service?.enabled) {
+          throw new Error(HubActionMessage.s3Unavailable);
+        }
+        await S3FileHelper.deleteFile(this.s3Service, db.collection(S3_FILES_COLLECTION), objectId);
+        break;
+      }
+      default: {
+        const gridFs = new mongo.GridFSBucket(db as unknown as mongo.Db, { bucketName: bucket });
+        await gridFs.delete(objectId as unknown as mongo.ObjectId);
+      }
+    }
+
+    return { filename: doc.filename, id, store };
   }
 
-  /** GridFS file inventory for the given bucket (default `fs`). */
+  /**
+   * File inventory across ALL THREE metadata stores.
+   *
+   * Metadata always lives in MongoDB whichever store holds the bytes (`fs.files` / `s3-files` /
+   * `filesystem-files`), so one connection can see everything — which is exactly what
+   * `CoreFileService.findFileInfo()` does, and what this panel now mirrors.
+   *
+   * It used to read `fs.files` alone. Under `file.storage: 's3'` or `'filesystem'` that made the
+   * panel report **0 files** — not "this panel does not cover your driver", but a confident wrong
+   * answer, in the one tool an operator opens BECAUSE they are unsure. Someone checking whether an
+   * upload landed would have concluded it had not.
+   *
+   * Paging over a merge is the trap here: taking `skip`/`limit` from each store and concatenating
+   * returns the wrong ROWS, not merely the wrong order (the same defect `sortMergedFileInfo()` was
+   * fixed for). So each store yields its newest `skip + limit`, the union is re-sorted, and only
+   * then is the window cut — which is correct because the global newest `skip + limit` rows are
+   * necessarily contained in the per-store newest `skip + limit`.
+   *
+   * READS NEVER CREATE A COLLECTION: `find()` and `countDocuments()` on an absent collection answer
+   * empty. A GridFS-only deployment therefore does not grow an empty `s3-files` from the Hub merely
+   * looking at it — the same rule `ensureFilenameIndex()` follows on the write path.
+   */
   async getFiles(bucket = 'fs', skip = 0, limit = 100): Promise<HubFilesData | HubUnavailable> {
     const db = this.connection?.db;
     if (!db) {
       return { available: false, hint: 'No MongoDB connection is available.' };
     }
-    const filesCollection = `${bucket}.files`;
-    try {
-      const cursor = db
-        .collection(filesCollection)
-        .find({}, { limit: Math.min(limit, 500), skip, sort: { uploadDate: -1 } });
-      const docs = await cursor.toArray();
-      const total = await db.collection(filesCollection).countDocuments();
-      return {
-        bucket,
-        files: docs.map((doc) => ({
-          contentType: doc.contentType ?? doc.metadata?.contentType,
-          filename: doc.filename,
-          id: String(doc._id),
-          length: doc.length ?? 0,
-          uploadDate: doc.uploadDate ? new Date(doc.uploadDate).toISOString() : undefined,
-        })),
-        total,
-      };
-    } catch (error) {
-      this.logger.warn(`Failed to list GridFS files: ${error instanceof Error ? error.message : String(error)}`);
-      return { available: false, hint: `No GridFS bucket "${bucket}" or it is empty.` };
+
+    const safeSkip = Math.max(0, skip);
+    const safeLimit = Math.min(Math.max(1, limit), 500);
+    // Per-store window: enough to guarantee the merged page is complete, capped so a huge `skip`
+    // cannot turn one panel poll into an unbounded read.
+    const window = Math.min(safeSkip + safeLimit, 1000);
+
+    const stores: HubFileStoreSummary[] = [];
+    const rows: HubFilesData['files'] = [];
+
+    for (const source of this.fileStores(bucket)) {
+      try {
+        const docs = await db
+          .collection(source.collection)
+          .find({}, { limit: window, sort: { uploadDate: -1 } })
+          .toArray();
+        const count = await db.collection(source.collection).countDocuments();
+        stores.push({ collection: source.collection, count, store: source.store });
+        for (const doc of docs) {
+          rows.push({
+            contentType: doc.contentType ?? doc.metadata?.contentType,
+            filename: doc.filename,
+            id: String(doc._id),
+            length: doc.length ?? 0,
+            store: source.store,
+            uploadDate: doc.uploadDate ? new Date(doc.uploadDate).toISOString() : undefined,
+          });
+        }
+      } catch (error) {
+        // One unreadable store must not blank the panel: the other two still hold real answers, and
+        // an operator is better served by "two stores listed, this one errored" than by nothing.
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.warn(`Failed to list files in ${source.collection}: ${message}`);
+        stores.push({ collection: source.collection, count: 0, error: message, store: source.store });
+      }
     }
+
+    rows.sort((a, b) => (b.uploadDate ?? '').localeCompare(a.uploadDate ?? ''));
+
+    return {
+      bucket,
+      files: rows.slice(safeSkip, safeSkip + safeLimit),
+      stores,
+      total: stores.reduce((sum, entry) => sum + entry.count, 0),
+    };
+  }
+
+  /** Directory used by the `'filesystem'` driver — resolved exactly as `CoreFileService` does. */
+  protected get filesystemDir(): string {
+    return ConfigService.configFastButReadOnly?.file?.storageDir || DEFAULT_FILESYSTEM_DIR;
+  }
+
+  /**
+   * The three metadata stores, in the order both this service and `CoreFileService` probe them.
+   *
+   * GridFS is last because it is the fallthrough: its collection name depends on the bucket, and a
+   * document there carries no `storage` marker to identify it by.
+   */
+  protected fileStores(bucket: string): { collection: string; store: HubFileStore }[] {
+    return [
+      { collection: S3_FILES_COLLECTION, store: 's3' },
+      { collection: FILESYSTEM_FILES_COLLECTION, store: 'filesystem' },
+      { collection: `${bucket}.files`, store: 'gridfs' },
+    ];
   }
 
   /** Model inventory + a Mermaid ER diagram derived from the registered Mongoose schemas. */

package/src/server/modules/file/file.controller.ts

@@ -72,7 +72,11 @@ export class FileController extends CoreFileController {
   @Get('info/:id')
   @Roles(RoleEnum.ADMIN)
   async getFileInfo(@Param('id') id: string) {
-    return await this.fileService.getFileInfo(id);
+    // `force`: this route is @Roles(ADMIN) — the guard has already decided, and an overridden
+    // checkRights() must not be asked to re-derive that from an absent user. "No currentUser"
+    // is also what an anonymous request looks like, so a rule that reads it as "internal call"
+    // fails open; saying `force: true` states the intent instead of hiding it in an omission.
+    return await this.fileService.getFileInfo(id, { force: true });
   }
 
   /**
@@ -85,6 +89,7 @@ export class FileController extends CoreFileController {
       throw new BadRequestException('Missing ID');
     }
 
-    return await this.fileService.deleteFile(id);
+    // `force`: @Roles(ADMIN) above is the whole gate for this endpoint — see getFileInfo().
+    return await this.fileService.deleteFile(id, { force: true });
   }
 }

package/src/server/modules/file/file.resolver.ts

@@ -28,7 +28,10 @@ export class FileResolver {
   @Query(() => FileInfo, { nullable: true })
   @Roles(RoleEnum.ADMIN)
   async getFileInfo(@Args({ name: 'filename', type: () => String }) filename: string) {
-    return await this.fileService.getFileInfoByName(filename);
+    // `force`: @Roles(ADMIN) is the whole gate for this admin API. Omitting options instead
+    // would leave an overridden checkRights() to guess "internal call" from an absent user —
+    // indistinguishable from an anonymous request, and therefore the wrong thing to allow on.
+    return await this.fileService.getFileInfoByName(filename, { force: true });
   }
 
   // ===========================================================================
@@ -41,7 +44,8 @@ export class FileResolver {
   @Mutation(() => FileInfo)
   @Roles(RoleEnum.ADMIN)
   async deleteFile(@Args({ name: 'filename', type: () => String }) filename: string) {
-    return await this.fileService.deleteFileByName(filename);
+    // `force`: @Roles(ADMIN) is the whole gate here — see getFileInfo().
+    return await this.fileService.deleteFileByName(filename, { force: true });
   }
 
   /**

package/src/server/modules/file/file.service.ts

@@ -2,9 +2,12 @@ import { Injectable, Optional } from '@nestjs/common';
 import { InjectConnection } from '@nestjs/mongoose';
 import { Connection } from 'mongoose';
 
+import { RoleEnum } from '../../../core/common/enums/role.enum';
 import { ConfigService } from '../../../core/common/services/config.service';
 import { CoreS3Service } from '../../../core/common/services/core-s3.service';
-import { CoreFileService } from '../../../core/modules/file/core-file.service';
+import { CoreFileInfo } from '../../../core/modules/file/core-file-info.model';
+import { CoreFileService, FileInputCheckType } from '../../../core/modules/file/core-file.service';
+import { FileServiceOptions } from '../../../core/modules/file/interfaces/file-service-options.interface';
 
 /**
  * File service
@@ -20,42 +23,102 @@ export class FileService extends CoreFileService {
   }
 
   /**
-   * Duplicate file by name
+   * Duplicate file by name.
+   *
+   * Delegates instead of reaching into `this.files` directly. The direct GridFS
+   * pipe this used to be was wrong in four separate ways, and every one of them
+   * is the kind of thing a consuming project copies out of here:
+   *
+   * - it only ever worked on the GridFS driver — under `file.storage: 's3'` or
+   *   `'filesystem'` the source is simply not in the bucket;
+   * - it bypassed `checkRights()` entirely, so the owner rule below did not apply
+   *   to a duplicate at all;
+   * - it returned the write stream without awaiting it, so the caller was told the
+   *   copy existed while it was still being written;
+   * - neither stream carried an error handler, and an unhandled stream `'error'`
+   *   takes the whole process down.
+   *
+   * `duplicateByName()` answers all four. Forward the caller's context so the
+   * duplicate is COVERED by the ownership rule rather than exempt from it.
    */
-  async duplicate(fileName: string, newName: string): Promise<any> {
-    return this.files.openDownloadStreamByName(fileName).pipe(this.files.openUploadStream(newName));
+  async duplicate(fileName: string, newName: string, serviceOptions?: FileServiceOptions): Promise<CoreFileInfo> {
+    return this.duplicateByName(fileName, newName, serviceOptions);
   }
 
   /**
-   * NOTE — where the per-file rule would go.
-   *
-   * This reference server deliberately does NOT override `checkRights()`. With
-   * `file.downloadRoles` at its default `[ADMIN]`, the roles guard answers before
-   * the service is reached, so an owner rule here could never fire — and a rule
-   * that cannot fire is worse than none, because it reads as protection.
-   *
-   * The pairing only becomes useful once the coarse gate is widened. A project
-   * that wants "signed-in users may fetch THEIR OWN files" sets
-   * `file: { downloadRoles: [RoleEnum.S_USER] }` and then overrides:
-   *
-   * ```typescript
-   * protected override async checkRights(input, options) {
-   *   if (options?.force || options?.checkInputType !== 'id') {
-   *     return true;   // writes and filename reads stay on the role gate
-   *   }
-   *   if (!options.currentUser) {
-   *     return true;   // system-internal call: the guard already decided
-   *   }
-   *   if (options.currentUser.hasRole?.([RoleEnum.ADMIN])) {
-   *     return true;
-   *   }
-   *   const raw = await this.getRawFileInfo(input);
-   *   return !!raw?.metadata?.ownerId && String(raw.metadata.ownerId) === String(options.currentUser.id);
-   * }
-   * ```
-   *
-   * `AvatarController` already writes the `metadata.ownerId` such a rule reads,
-   * so enabling it in a downstream project is a config change plus this method.
-   * See `src/core/modules/file/README.md` § Access control.
+   * Per-file authorization for the two inherited download routes.
+   *
+   * THIS IS DELIBERATELY EXECUTED CODE, NOT AN ILLUSTRATION. It used to be a
+   * commented-out `@example` here, on the reasoning that `file.downloadRoles`
+   * defaults to `[ADMIN]`, the roles guard therefore answers before the service
+   * is reached, and a rule that cannot fire is worse than none. The reasoning was
+   * locally sound and globally harmful: a comment is never compiled, never
+   * type-checked and never run, so nothing in this repository exercised the
+   * `Core*` inheritance seam that every consuming project depends on — and a
+   * `deleteFileByName()` bug that dropped `serviceOptions` on the way to its
+   * inner lookup shipped green through 2777 tests, to be found downstream hours
+   * after release. The commented example was itself wrong (it allowed on a
+   * missing `currentUser`), and it was copied verbatim.
+   *
+   * The tension is resolved the other way round now: `config.env.ts` widens the
+   * coarse gate to `[RoleEnum.S_USER]` in every environment, which is what real
+   * projects do, so the rule below actually runs on every download this server
+   * serves.
+   *
+   * The rule: ADMIN sees everything; everyone else sees only files whose
+   * `metadata.ownerId` is their own id. `AvatarController` writes that metadata
+   * at upload time. A file with NO owner recorded — the admin uploads via
+   * `/files/upload` and the GraphQL mutations, and TUS uploads, which carry
+   * `tusUploadId` but no owner — is therefore ADMIN-only.
+   *
+   * Two properties worth knowing:
+   *
+   * - **A refusal answers 404, not 403.** That is the framework's doing, not
+   *   this method's: returning `false` makes the caller answer as if the file
+   *   did not exist, because a 403 would confirm that the id names a real file
+   *   and turn the endpoint into an existence oracle.
+   * - **A missing `currentUser` DENIES.** This is the one part that is easy to
+   *   get backwards. "No user in context" is NOT "system-internal call" — it is
+   *   also exactly what an ANONYMOUS request looks like. Today the coarse gate
+   *   turns those away before this hook runs, so an `if (!options.currentUser)
+   *   return true` shortcut looks harmless; widen `downloadRoles` to
+   *   `S_EVERYONE` and the same branch hands every file to everyone, so the
+   *   ownership rule evaporates precisely when it starts to matter. Genuinely
+   *   internal callers say so instead: `FileController` / `FileResolver` pass
+   *   `{ force: true }` because their `@Roles(ADMIN)` already decided, and
+   *   `AvatarController` passes the real `{ currentUser }` so its cleanup delete
+   *   is COVERED by this rule rather than exempt from it.
+   *
+   * BOTH the `id` and the `filename` branch are covered. Covering only `id` is
+   * enough while bytes are streamed, because the filename route resolves an id
+   * and checks it again — but not once `s3.presignedDownloads` is enabled, where
+   * the filename route authorizes on the by-name lookup alone and then redirects.
+   * The by-name half is also where the shipped `deleteFileByName()` bug lived.
+   *
+   * See `src/core/modules/file/README.md` § Access control, and
+   * `tests/file-ownership.e2e-spec.ts` for the end-to-end contract test.
    */
+  protected override async checkRights(
+    input: any,
+    options?: FileServiceOptions & { checkInputType: FileInputCheckType },
+  ): Promise<boolean> {
+    // Writes, list queries and forced (system) calls stay on the coarse role gate.
+    if (options?.force || (options?.checkInputType !== 'filename' && options?.checkInputType !== 'id')) {
+      return true;
+    }
+
+    if (options.currentUser?.hasRole?.([RoleEnum.ADMIN])) {
+      return true;
+    }
+
+    // The RAW document on purpose: the public getFileInfo() runs prepareOutput(), which
+    // strips `metadata` — the very field this decision rests on.
+    const raw =
+      options.checkInputType === 'id' ? await this.getRawFileInfo(input) : await this.getRawFileInfoByName(input);
+
+    // Fails closed on a missing user: `String(undefined)` can never equal a real owner id.
+    // Requiring `metadata.ownerId` to be PRESENT is load-bearing too — without it an
+    // owner-less file would compare `String(undefined)` against `String(undefined)` and match.
+    return !!raw?.metadata?.ownerId && String(raw.metadata.ownerId) === String(options.currentUser?.id);
+  }
 }

package/src/server/modules/user/avatar.controller.ts

@@ -55,9 +55,16 @@ export class AvatarController {
     // Drop the replaced file. A failure here must not fail the upload: the new avatar
     // is already stored and referenced, so an orphaned object is a cleanup concern,
     // not a request error.
+    //
+    // `{ currentUser: user }`, not an empty context: the uploader IS in scope here, so a
+    // per-file rule in FileService.checkRights() should COVER this delete (the previous
+    // avatar is their own file) rather than be exempted from it. Passing nothing would ask
+    // the rule to infer "internal call" from an absent user — which is also what an
+    // anonymous request looks like, and is exactly the shortcut that makes an ownership
+    // rule evaporate once `file.downloadRoles` is widened.
     if (previousAvatar) {
       try {
-        await this.fileService.deleteFile(previousAvatar);
+        await this.fileService.deleteFile(previousAvatar, { currentUser: user });
       } catch (error) {
         this.logger.warn(
           `Could not remove previous avatar ${previousAvatar}: ${error instanceof Error ? error.message : 'Unknown error'}`,