@lupinum/nuxt-pdf 0.3.0

package/dist/runtime/server/assets/resolve-asset.js

@@ -0,0 +1,482 @@
+import { Buffer } from "node:buffer";
+import { readFile, realpath, stat } from "node:fs/promises";
+import {
+  extname,
+  isAbsolute,
+  relative,
+  resolve,
+  sep
+} from "node:path";
+import { PDF_PRIMITIVES } from "../../authoring.js";
+import {
+  PDF_ASSET_ERROR_CODES,
+  PdfAssetError
+} from "./errors.js";
+import {
+  createRemoteRequestState,
+  fetchRemoteResource,
+  matchesAllowlist,
+  redactUrl
+} from "./remote.js";
+import {
+  DEFAULT_PDF_MAX_IMAGE_BYTES,
+  DEFAULT_PDF_MAX_IMAGE_PIXELS,
+  DEFAULT_PDF_RENDER_LIMITS,
+  createRenderLimits
+} from "../render-limits.js";
+export {
+  PDF_ASSET_ERROR_CODES,
+  PdfAssetError
+} from "./errors.js";
+const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+const fail = (code, message, cause) => {
+  throw new PdfAssetError(code, message, { cause });
+};
+const blocked = (message) => fail(PDF_ASSET_ERROR_CODES.Blocked, message);
+const invalid = (message, cause) => fail(PDF_ASSET_ERROR_CODES.Invalid, message, cause);
+const limitExceeded = (maxBytes) => fail(
+  PDF_ASSET_ERROR_CODES.LimitExceeded,
+  `The PDF image exceeds the ${maxBytes}-byte source limit.`
+);
+const imageLimitExceeded = (message) => fail(PDF_ASSET_ERROR_CODES.LimitExceeded, message);
+const resolveMaxBytes = (value) => {
+  const maxBytes = value ?? DEFAULT_PDF_MAX_IMAGE_BYTES;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    invalid("The PDF image byte limit must be a positive safe integer.");
+  }
+  return maxBytes;
+};
+const canonicalAssetKey = (source) => {
+  if (!source || source.includes("\0")) {
+    invalid("The PDF image path is invalid.");
+  }
+  const slashPath = source.replaceAll("\\", "/");
+  const hasScheme = /^[a-z][a-z\d+.-]*:/i.test(slashPath);
+  const isWindowsAbsolute = /^[a-z]:\//i.test(slashPath);
+  if (hasScheme || isAbsolute(source) || isWindowsAbsolute || slashPath.startsWith("/")) {
+    blocked("PDF images must use a relative local asset path.");
+  }
+  const segments = slashPath.split("/");
+  if (segments.includes("..")) {
+    blocked("Parent-directory traversal is blocked for PDF images.");
+  }
+  const key = segments.filter((segment) => segment && segment !== ".").join("/");
+  if (!key) {
+    invalid("The PDF image path is invalid.");
+  }
+  return key;
+};
+const formatFromExtension = (key) => {
+  const extension = extname(key).toLowerCase();
+  if (extension === ".png") return "png";
+  if (extension === ".jpg" || extension === ".jpeg") return "jpg";
+  return invalid("PDF images must be PNG or JPEG files.");
+};
+const claimedFormat = (value) => {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") {
+    return invalid("The PDF image format is invalid.");
+  }
+  const normalized = value.toLowerCase();
+  if (normalized === "png") return "png";
+  if (normalized === "jpg" || normalized === "jpeg") return "jpg";
+  return invalid("PDF images must use the PNG or JPEG format.");
+};
+const asBuffer = (value) => {
+  if (Buffer.isBuffer(value)) return Buffer.from(value);
+  if (value instanceof Uint8Array) return Buffer.from(value);
+  if (value instanceof ArrayBuffer) return Buffer.from(new Uint8Array(value));
+  return void 0;
+};
+const PNG_SIGNATURE = Buffer.from([
+  137,
+  80,
+  78,
+  71,
+  13,
+  10,
+  26,
+  10
+]);
+const inspectPng = (data) => {
+  if (data.byteLength < 33 || !data.subarray(0, 8).equals(PNG_SIGNATURE)) {
+    return void 0;
+  }
+  let height = 0;
+  let offset = 8;
+  let sawHeader = false;
+  let sawImageData = false;
+  let width = 0;
+  while (offset + 12 <= data.byteLength) {
+    const length = data.readUInt32BE(offset);
+    const end = offset + 12 + length;
+    if (end > data.byteLength) return void 0;
+    const type = data.toString("ascii", offset + 4, offset + 8);
+    if (!sawHeader) {
+      if (type !== "IHDR" || length !== 13) return void 0;
+      width = data.readUInt32BE(offset + 8);
+      height = data.readUInt32BE(offset + 12);
+      if (width < 1 || height < 1) return void 0;
+      const bitDepth = data[offset + 16];
+      const colorType = data[offset + 17];
+      const validDepths = colorType === 0 ? [1, 2, 4, 8, 16] : colorType === 2 ? [8, 16] : colorType === 3 ? [1, 2, 4, 8] : colorType === 4 || colorType === 6 ? [8, 16] : [];
+      if (bitDepth === void 0 || !validDepths.includes(bitDepth) || data[offset + 18] !== 0 || data[offset + 19] !== 0 || data[offset + 20] !== 0 && data[offset + 20] !== 1) return void 0;
+      sawHeader = true;
+    } else if (type === "IHDR") return void 0;
+    if (type === "IDAT") sawImageData = true;
+    offset = end;
+    if (type === "IEND") {
+      return length === 0 && sawImageData && offset === data.byteLength ? { height, width } : void 0;
+    }
+  }
+  return void 0;
+};
+const hasJpegSignature = (data) => {
+  if (data.byteLength < 4 || data[0] !== 255 || data[1] !== 216 || data[2] !== 255) {
+    return false;
+  }
+  return data[data.byteLength - 2] === 255 && data[data.byteLength - 1] === 217;
+};
+const isJpegStartOfFrame = (marker) => marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker);
+const inspectJpeg = (data) => {
+  if (!hasJpegSignature(data)) return void 0;
+  let dimensions;
+  let offset = 2;
+  while (offset + 2 < data.byteLength) {
+    while (offset < data.byteLength && data[offset] === 255) offset += 1;
+    const marker = data[offset];
+    offset += 1;
+    if (marker === void 0 || marker === 217) break;
+    if (marker === 218) return dimensions;
+    if (marker === 216 || marker >= 208 && marker <= 215) continue;
+    if (offset + 2 > data.byteLength) return void 0;
+    const length = data.readUInt16BE(offset);
+    if (length < 2 || offset + length > data.byteLength) return void 0;
+    if (isJpegStartOfFrame(marker)) {
+      if (length < 7) return void 0;
+      const height = data.readUInt16BE(offset + 3);
+      const width = data.readUInt16BE(offset + 5);
+      if (width < 1 || height < 1) return void 0;
+      dimensions = { height, width };
+    }
+    offset += length;
+  }
+  return void 0;
+};
+const inspectImage = (data) => {
+  const png = inspectPng(data);
+  if (png) return { ...png, format: "png" };
+  const jpeg = inspectJpeg(data);
+  if (jpeg) return { ...jpeg, format: "jpg" };
+  return void 0;
+};
+const validateImageBytes = (value, maxBytes, expectedFormat, maxPixels = DEFAULT_PDF_MAX_IMAGE_PIXELS) => {
+  const data = asBuffer(value);
+  if (!data) {
+    return invalid("The PDF image source does not contain bytes.");
+  }
+  if (data.byteLength > maxBytes) return limitExceeded(maxBytes);
+  const inspected = inspectImage(data);
+  if (!inspected || expectedFormat && inspected.format !== expectedFormat) {
+    return invalid(
+      "The PDF image structure, file extension, and declared format must agree."
+    );
+  }
+  const pixels = inspected.width * inspected.height;
+  if (!Number.isSafeInteger(pixels) || pixels > maxPixels) {
+    return imageLimitExceeded(
+      `The PDF image has ${pixels} decoded pixels, exceeding pdf.limits.maxImagePixels (${maxPixels}).`
+    );
+  }
+  return Object.freeze({ data, ...inspected, pixels });
+};
+const canonicalRoots = async (roots) => {
+  if (!Array.isArray(roots) || roots.length === 0) {
+    return blocked("At least one local PDF asset root must be configured.");
+  }
+  const result = [];
+  for (const root of roots) {
+    if (typeof root !== "string" || !isAbsolute(root)) {
+      return invalid("Configured PDF asset roots must be absolute paths.");
+    }
+    try {
+      const canonicalRoot = await realpath(root);
+      const rootStat = await stat(canonicalRoot);
+      if (!rootStat.isDirectory()) {
+        return invalid("A configured PDF asset root is not a directory.");
+      }
+      if (!result.includes(canonicalRoot)) result.push(canonicalRoot);
+    } catch (error) {
+      if (error instanceof PdfAssetError) throw error;
+      return invalid(
+        "A configured PDF asset root cannot be read.",
+        error
+      );
+    }
+  }
+  return result;
+};
+const isInsideRoot = (root, candidate) => {
+  const relativePath = relative(root, candidate);
+  return relativePath !== "" && relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+};
+const isMissingFileError = (error) => {
+  if (!(error instanceof Error) || !("code" in error)) return false;
+  return error.code === "ENOENT" || error.code === "ENOTDIR";
+};
+export const loadPdfImageAsset = async (relativePath, options) => {
+  const key = canonicalAssetKey(relativePath);
+  const expectedFormat = formatFromExtension(key);
+  const maxBytes = resolveMaxBytes(options.maxBytes);
+  const maxPixels = options.maxPixels ?? DEFAULT_PDF_MAX_IMAGE_PIXELS;
+  const roots = await canonicalRoots(options.roots);
+  for (const root of roots) {
+    let candidate;
+    try {
+      candidate = await realpath(resolve(root, ...key.split("/")));
+    } catch (error) {
+      if (isMissingFileError(error)) continue;
+      return invalid("The local PDF image cannot be resolved.", error);
+    }
+    if (!isInsideRoot(root, candidate)) {
+      return blocked(
+        "The local PDF image resolves outside its configured asset root."
+      );
+    }
+    let fileStat;
+    try {
+      fileStat = await stat(candidate);
+    } catch (error) {
+      return invalid("The local PDF image cannot be inspected.", error);
+    }
+    if (!fileStat.isFile()) {
+      return invalid("The local PDF image is not a regular file.");
+    }
+    if (fileStat.size > maxBytes) return limitExceeded(maxBytes);
+    try {
+      const image = validateImageBytes(
+        await readFile(candidate),
+        maxBytes,
+        expectedFormat,
+        maxPixels
+      );
+      return Object.freeze({ key, ...image });
+    } catch (error) {
+      if (error instanceof PdfAssetError) throw error;
+      return invalid("The local PDF image cannot be read.", error);
+    }
+  }
+  return invalid(
+    "The local PDF image was not found in a configured asset root."
+  );
+};
+const resolveLocalImage = (source, assets, maxBytes, maxPixels, declaredFormat) => {
+  const key = canonicalAssetKey(source);
+  const pathFormat = formatFromExtension(key);
+  const sourceFormat = claimedFormat(declaredFormat);
+  if (sourceFormat && sourceFormat !== pathFormat) {
+    return invalid("The PDF image path and declared format must agree.");
+  }
+  if (!hasOwn(assets, key)) {
+    return invalid(
+      "The local PDF image was not included in the generated asset map."
+    );
+  }
+  const asset = assets[key];
+  if (!asset || typeof asset !== "object") {
+    return invalid("The generated PDF image asset is invalid.");
+  }
+  const assetFormat = claimedFormat(asset.format);
+  if (!assetFormat || assetFormat !== pathFormat) {
+    return invalid(
+      "The generated PDF image format does not match its asset key."
+    );
+  }
+  return validateImageBytes(asset.data, maxBytes, assetFormat, maxPixels);
+};
+const isRemoteCandidate = (source) => /^https?:/i.test(source);
+const imageResolutionCacheKey = (source) => {
+  if (typeof source === "string") return `string\0${source}`;
+  if (!source || typeof source !== "object") return source;
+  const record = source;
+  if (typeof record.uri === "string") {
+    return isRemoteCandidate(record.uri) ? `remote\0${record.uri}` : `local\0${record.uri}\0${String(record.format ?? "")}`;
+  }
+  return source;
+};
+const resolveRemoteImage = async (url, remote, remoteState, inflight, maxBytes, maxPixels) => {
+  if (!remote) {
+    return blocked(
+      `Remote PDF image fetching is disabled. Set pdf.remote.allow to fetch "${redactUrl(url)}".`
+    );
+  }
+  if (!matchesAllowlist(url, remote)) {
+    return blocked(
+      `The PDF image "${redactUrl(url)}" is not permitted by pdf.remote.allow.`
+    );
+  }
+  const bytes = await fetchRemoteResource(url, {
+    policy: remote,
+    maxBytes,
+    state: remoteState,
+    inflight
+  });
+  return validateImageBytes(bytes, maxBytes, void 0, maxPixels);
+};
+const resolveImageSource = async (source, assets, maxBytes, maxPixels, remote, remoteState, inflight) => {
+  if (typeof source === "function") {
+    return blocked("Dynamic PDF image source functions are blocked.");
+  }
+  if (typeof source === "string") {
+    return isRemoteCandidate(source) ? resolveRemoteImage(source, remote, remoteState, inflight, maxBytes, maxPixels) : resolveLocalImage(source, assets, maxBytes, maxPixels);
+  }
+  const bytes = asBuffer(source);
+  if (bytes) return validateImageBytes(bytes, maxBytes, void 0, maxPixels);
+  if (!source || typeof source !== "object") {
+    return invalid("The PDF image source is invalid.");
+  }
+  const record = source;
+  if (typeof record.then === "function") {
+    return blocked("Asynchronous PDF image sources are blocked.");
+  }
+  if (hasOwn(record, "uri")) {
+    if (typeof record.uri !== "string") {
+      return invalid("The PDF image URI is invalid.");
+    }
+    if (isRemoteCandidate(record.uri)) {
+      if (Object.keys(record).some((key) => key !== "uri")) {
+        return blocked("PDF image request options are blocked for remote assets.");
+      }
+      return resolveRemoteImage(
+        record.uri,
+        remote,
+        remoteState,
+        inflight,
+        maxBytes,
+        maxPixels
+      );
+    }
+    const allowedKeys = /* @__PURE__ */ new Set(["format", "uri"]);
+    if (Object.keys(record).some((key) => !allowedKeys.has(key))) {
+      return blocked("PDF image request options are blocked for local assets.");
+    }
+    return resolveLocalImage(
+      record.uri,
+      assets,
+      maxBytes,
+      maxPixels,
+      record.format
+    );
+  }
+  if (hasOwn(record, "data")) {
+    const format = claimedFormat(record.format);
+    if (!format) {
+      return invalid("A byte-backed PDF image source must declare its format.");
+    }
+    return validateImageBytes(record.data, maxBytes, format, maxPixels);
+  }
+  return invalid(
+    "The PDF image source must be bytes or a bundled local path."
+  );
+};
+const resolveImageBuffer = (source, assets, limits, remote, remoteState, inflight, resolved, budget) => {
+  const key = imageResolutionCacheKey(source);
+  const existing = resolved.get(key);
+  if (existing) return existing;
+  const promise = resolveImageSource(
+    source,
+    assets,
+    limits.maxImageBytes,
+    limits.maxImagePixels,
+    remote,
+    remoteState,
+    inflight
+  ).then((image) => {
+    budget.bytes += image.data.byteLength;
+    if (budget.bytes > limits.maxTotalImageBytes) {
+      return imageLimitExceeded(
+        `PDF image sources exceed pdf.limits.maxTotalImageBytes (${limits.maxTotalImageBytes}).`
+      );
+    }
+    budget.pixels += image.pixels;
+    if (budget.pixels > limits.maxTotalImagePixels) {
+      return imageLimitExceeded(
+        `PDF images exceed pdf.limits.maxTotalImagePixels (${limits.maxTotalImagePixels}).`
+      );
+    }
+    return image.data;
+  });
+  resolved.set(key, promise);
+  return promise;
+};
+const collectImageNodes = (document) => {
+  const images = [];
+  const pending = [document];
+  while (pending.length > 0) {
+    const node = pending.pop();
+    if (node.type === PDF_PRIMITIVES.Image) images.push(node);
+    for (let index = node.children.length - 1; index >= 0; index -= 1) {
+      const child = node.children[index];
+      if (child && child.type !== PDF_PRIMITIVES.TextInstance) {
+        pending.push(child);
+      }
+    }
+  }
+  return images;
+};
+export const createPdfImageResolutionState = (limits) => ({
+  budget: { bytes: 0, pixels: 0 },
+  inflight: /* @__PURE__ */ new Map(),
+  remote: createRemoteRequestState(limits),
+  resolved: /* @__PURE__ */ new Map()
+});
+export const resolvePdfImageAssets = async (document, options) => {
+  const limits = options.limits ?? createRenderLimits({
+    ...DEFAULT_PDF_RENDER_LIMITS
+  });
+  if (!options.assets || typeof options.assets !== "object") {
+    return invalid("A generated PDF image asset map is required.");
+  }
+  const state = options.state ?? createPdfImageResolutionState(limits);
+  const targets = [];
+  for (const node of collectImageNodes(document)) {
+    if (hasOwn(node.props, "srcSet") && node.props.srcSet !== void 0) {
+      return blocked("PDF image srcSet sources are blocked.");
+    }
+    const hasSrc = hasOwn(node.props, "src") && node.props.src !== void 0;
+    const hasSource = hasOwn(node.props, "source") && node.props.source !== void 0;
+    if (hasSrc === hasSource) {
+      return invalid("Each PDF image must have exactly one src or source prop.");
+    }
+    targets.push({ node, prop: hasSrc ? "src" : "source" });
+  }
+  if (targets.length > limits.maxImages) {
+    return imageLimitExceeded(
+      `PDF mounted ${targets.length} images, exceeding pdf.limits.maxImages (${limits.maxImages}).`
+    );
+  }
+  let resolved;
+  try {
+    resolved = await Promise.all(targets.map(
+      (target) => resolveImageBuffer(
+        target.node.props[target.prop],
+        options.assets,
+        limits,
+        options.remote,
+        state.remote,
+        state.inflight,
+        state.resolved,
+        state.budget
+      )
+    ));
+  } catch (error) {
+    limits.abortController.abort(error);
+    throw error;
+  }
+  targets.forEach((target, index) => {
+    const data = resolved[index];
+    target.node.props[target.prop] = data;
+    state.resolved.set(data, Promise.resolve(data));
+  });
+  return document;
+};