@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.4

package/dist/sharing/user-data.js

@@ -0,0 +1,185 @@
+"use strict";
+// =============================================================================
+// The sharing slice's user-owned data and model ownership (issue #728)
+// =============================================================================
+//
+// Pure data for the app's two registries (the reference app registers them in
+// `prisma/ownership/*.manifest.ts`, with the platform's entries), plus the
+// purge rule for a user's group memberships.
+//
+//   GroupMember.userId                      OWNER: purge deletes the row (Cascade); export includes it
+//   GroupMember.addedById                   ACTOR: SetNull
+//   GroupInvite.invitedById / acceptedById  ACTOR: purge sets null (SetNull)
+//   Group.createdById                       ACTOR: purge sets null (SetNull)
+//   Grant.granteeUserId                     OWNER: purge deletes the row (Cascade); export includes it (#729)
+//   Grant.grantedById / revokedById         ACTOR: purge sets null (SetNull)
+//
+// THE LAST-ADMIN RULE ON PURGE (`GroupMembershipPurge.purgeUser`): before the
+// user's memberships go, every group where they were the only `admin` gets a
+// new one, the longest-standing remaining member. A group left with no member
+// at all is deleted when it owns nothing (the group-owned-resource registry),
+// otherwise kept for the organization's `groups:admin` holders, and the Doctor
+// check `sharing.groups.orphaned` lists it.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupMembershipPurge = exports.SHARING_MODEL_OWNERSHIP = exports.SHARING_USER_OWNED_MODELS = void 0;
+const common_1 = require("@nestjs/common");
+const sharing_tx_1 = require("./data/sharing-tx");
+const group_roles_1 = require("./group-roles");
+const ownership_1 = require("./ownership");
+const ports_1 = require("./ports");
+const principal_groups_provider_1 = require("./principal-groups.provider");
+/**
+ * The slice's models with a foreign key to `User`, for the app's
+ * user-owned-data registry (`registerUserOwnedModels`).
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.SHARING_USER_OWNED_MODELS = [
+    {
+        model: 'GroupMember',
+        ownerField: 'userId',
+        actorFields: ['addedById'],
+        purge: 'delete',
+        export: 'include',
+        rationale: "The user's membership of a group and their role in it. It means nothing without the user; the export lists the groups they belong to. Who added them is only recorded.",
+    },
+    {
+        model: 'GroupInvite',
+        actorFields: ['invitedById', 'acceptedById'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'An invitation of an address to a group; it records who sent it and who accepted it, neither of whom owns it.',
+    },
+    {
+        model: 'Group',
+        actorFields: ['createdById'],
+        purge: 'detach',
+        export: 'exclude',
+        rationale: 'A group belongs to its members and its organization, not to the user who created it; the creator is only recorded.',
+    },
+    {
+        model: 'Grant',
+        ownerField: 'granteeUserId',
+        actorFields: ['grantedById', 'revokedById'],
+        purge: 'delete',
+        export: 'include',
+        exportOmit: ['linkTokenHash', 'linkTokenCiphertext'],
+        rationale: "A record shared with the user: it means nothing without them, and the export lists what was shared with them. Who shared or revoked it is only recorded; a link grant's token never leaves the server.",
+    },
+];
+/**
+ * The slice's models in the model ownership registry
+ * (`registerModelOwnership`): all four are `org` tables.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.SHARING_MODEL_OWNERSHIP = [
+    {
+        model: 'Group',
+        kind: 'org',
+        rationale: 'A sharing group lives inside one organization (spec decision D6: a group is never a tenant).',
+    },
+    {
+        model: 'GroupMember',
+        kind: 'org',
+        rationale: "A group membership. Carries the group's org_id (a policy cannot join through its parent) and a composite foreign key (group_id, org_id) to the group.",
+    },
+    {
+        model: 'GroupInvite',
+        kind: 'org',
+        rationale: "An invitation to a group, holding the invitee's address; composite foreign key (group_id, org_id) to the group.",
+    },
+    {
+        model: 'Grant',
+        kind: 'org',
+        rationale: "A share of one record inside its organization (#729); a group grantee is reached through the composite foreign key (grantee_group_id, org_id) to the group.",
+    },
+];
+/**
+ * Removes one user from every group, keeping each group administrable.
+ * System work (reason `purge`): it crosses organizations.
+ *
+ * @stability experimental
+ */
+let GroupMembershipPurge = class GroupMembershipPurge {
+    data;
+    principalGroups;
+    constructor(data, principalGroups) {
+        this.data = data;
+        this.principalGroups = principalGroups;
+    }
+    /**
+     * Purges `userId`'s group data: promotes a successor admin where needed,
+     * deletes the memberships, deletes emptied groups that own nothing, and
+     * nulls the actor columns. Call it from the app's user purge BEFORE the
+     * user row is deleted (the cascade would skip the last-admin rule).
+     *
+     * @param userId - the user being purged.
+     * @returns what changed.
+     */
+    async purgeUser(userId) {
+        const summary = { membershipsRemoved: 0, adminsPromoted: 0, groupsDeleted: 0, groupsOrphaned: 0 };
+        const affected = new Set([userId]);
+        await this.data.runAsSystem('purge', async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            const memberships = await tx.groupMember.findMany({ where: { userId }, orderBy: { createdAt: 'asc' } });
+            for (const membership of memberships) {
+                const { groupId } = membership;
+                await tx.$queryRaw `SELECT id FROM groups WHERE id = ${groupId}::uuid FOR UPDATE`;
+                const others = await tx.groupMember.findMany({
+                    where: { groupId, userId: { not: userId } },
+                    select: { userId: true, role: true },
+                    orderBy: [{ createdAt: 'asc' }, { id: 'asc' }],
+                });
+                for (const other of others)
+                    affected.add(other.userId);
+                if (others.length === 0) {
+                    let owned = 0;
+                    for (const def of ownership_1.groupOwnedResourceRegistry.list())
+                        owned += await def.countOwnedByGroup(groupId, raw);
+                    if (owned === 0) {
+                        await tx.group.delete({ where: { id: groupId } });
+                        summary.groupsDeleted += 1;
+                        summary.membershipsRemoved += 1;
+                        continue;
+                    }
+                    summary.groupsOrphaned += 1;
+                }
+                else if ((0, group_roles_1.groupRoleCan)(membership.role, 'manage') && !others.some((other) => (0, group_roles_1.groupRoleCan)(other.role, 'manage'))) {
+                    await tx.groupMember.update({ where: { groupId_userId: { groupId, userId: others[0].userId } }, data: { role: 'admin' } });
+                    summary.adminsPromoted += 1;
+                }
+                await tx.groupMember.delete({ where: { groupId_userId: { groupId, userId } } });
+                summary.membershipsRemoved += 1;
+            }
+            await tx.groupMember.updateMany({ where: { addedById: userId }, data: { addedById: null } });
+            await tx.groupInvite.updateMany({ where: { invitedById: userId }, data: { invitedById: null } });
+            await tx.groupInvite.updateMany({ where: { acceptedById: userId }, data: { acceptedById: null } });
+            await tx.group.updateMany({ where: { createdById: userId }, data: { createdById: null } });
+        });
+        this.principalGroups.invalidateUsers([...affected]);
+        return summary;
+    }
+};
+exports.GroupMembershipPurge = GroupMembershipPurge;
+exports.GroupMembershipPurge = GroupMembershipPurge = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.SHARING_DATA)),
+    __metadata("design:paramtypes", [Object, principal_groups_provider_1.PrincipalGroupsProvider])
+], GroupMembershipPurge);
+//# sourceMappingURL=user-data.js.map

package/dist/sharing/user-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-data.js","sourceRoot":"","sources":["../../src/sharing/user-data.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,6CAA6C;AAC7C,EAAE;AACF,uGAAuG;AACvG,2DAA2D;AAC3D,6EAA6E;AAC7E,6EAA6E;AAC7E,8GAA8G;AAC9G,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,4CAA4C;AAC5C,gFAAgF;;;;;;;;;;;;;;;AAEhF,2CAAoD;AAGpD,kDAAqE;AACrE,+CAA6C;AAC7C,2CAAyD;AACzD,mCAA6D;AAC7D,2EAAsE;AAEtE;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAoF;IACxH;QACE,KAAK,EAAE,aAAa;QACpB,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,CAAC,WAAW,CAAC;QAC1B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EACP,wKAAwK;KAC3K;IACD;QACE,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC;QAC5C,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,8GAA8G;KAC1H;IACD;QACE,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,CAAC,aAAa,CAAC;QAC5B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,oHAAoH;KAChI;IACD;QACE,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;QAC3C,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;QACpD,SAAS,EACP,wMAAwM;KAC3M;CACF,CAAC;AAEF;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAoF;IACtH;QACE,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,8FAA8F;KAC1G;IACD;QACE,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,KAAK;QACX,SAAS,EACP,uJAAuJ;KAC1J;IACD;QACE,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,iHAAiH;KAC7H;IACD;QACE,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,SAAS,EACP,6JAA6J;KAChK;CACF,CAAC;AAkBF;;;;;GAKG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEU;IACtB;IAFnB,YACyC,IAAqB,EAC3C,eAAwC;QADlB,SAAI,GAAJ,IAAI,CAAiB;QAC3C,oBAAe,GAAf,eAAe,CAAyB;IACxD,CAAC;IAEJ;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,OAAO,GAAsB,EAAE,kBAAkB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QACrH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAE3C,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAExG,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;gBAC/B,MAAM,EAAE,CAAC,SAAS,CAAA,oCAAoC,OAAO,mBAAmB,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAA0C;oBACpF,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;oBAC3C,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;oBACpC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;iBAC/C,CAAC,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,MAAM;oBAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAEvD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,IAAI,KAAK,GAAG,CAAC,CAAC;oBACd,KAAK,MAAM,GAAG,IAAI,sCAA0B,CAAC,IAAI,EAAE;wBAAE,KAAK,IAAI,MAAM,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACxG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;wBAChB,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;wBAClD,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;wBAC3B,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC;wBAChC,SAAS;oBACX,CAAC;oBACD,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC9B,CAAC;qBAAM,IAAI,IAAA,0BAAY,EAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,0BAAY,EAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;oBAClH,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC5H,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBAED,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBAChF,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7F,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACjG,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACnG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA7DY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,oBAAY,CAAC,CAAA;6CACa,mDAAuB;GAHhD,oBAAoB,CA6DhC"}

package/dist/storage/config/doctor/egress/storage.egress.contributor.d.ts

@@ -0,0 +1,28 @@
+import { OnModuleInit } from '@nestjs/common';
+import { EgressContributor, EgressDependency, EgressRegistry } from '../../../../doctor/index';
+import { StorageConfigAdminService } from '../../storage-config-admin.service';
+/**
+ * `storage.s3` (#773): the object store. Direction `both`: the API reads and
+ * writes it, and presigned URLs send the BROWSER to the same host for uploads
+ * and downloads.
+ *
+ * Reads `StorageConfigAdminService.describeForAdmin()`, the admin view, whose
+ * secrets are known only as "set", and asks the ACTIVE DRIVER which hosts it
+ * calls (`egressHosts`): the S3 family answers with the endpoint a client is
+ * pointed at (R2's derived endpoint included, or AWS's regional host
+ * `s3.<region>.amazonaws.com`), a driver an app registers with its own. NOT
+ * `StorageConfigService.resolveActiveConfig()`, which decrypts the secrets. A
+ * driver with no hosts (a local filesystem) contributes no row.
+ *
+ * @stability experimental
+ */
+export declare class StorageEgressContributor implements EgressContributor, OnModuleInit {
+    private readonly egress;
+    private readonly storageAdmin;
+    readonly id = "storage";
+    constructor(egress: EgressRegistry, storageAdmin: StorageConfigAdminService);
+    /** Self-registration with the Doctor's registry. */
+    onModuleInit(): void;
+    describe(): Promise<EgressDependency[]>;
+}
+//# sourceMappingURL=storage.egress.contributor.d.ts.map

package/dist/storage/config/doctor/egress/storage.egress.contributor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.egress.contributor.d.ts","sourceRoot":"","sources":["../../../../../src/storage/config/doctor/egress/storage.egress.contributor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EAEf,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAG/E;;;;;;;;;;;;;;GAcG;AACH,qBACa,wBAAyB,YAAW,iBAAiB,EAAE,YAAY;IAI5E,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAJ/B,QAAQ,CAAC,EAAE,aAAa;gBAGL,MAAM,EAAE,cAAc,EACtB,YAAY,EAAE,yBAAyB;IAG1D,oDAAoD;IACpD,YAAY,IAAI,IAAI;IAId,QAAQ,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAwB9C"}

package/dist/storage/config/doctor/egress/storage.egress.contributor.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageEgressContributor = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../../doctor/index");
+const storage_1 = require("@marinoscar/platform-contract/storage");
+const storage_driver_1 = require("../../../drivers/storage-driver");
+const storage_config_admin_service_1 = require("../../storage-config-admin.service");
+const storage_not_configured_error_1 = require("../../storage-not-configured.error");
+/**
+ * `storage.s3` (#773): the object store. Direction `both`: the API reads and
+ * writes it, and presigned URLs send the BROWSER to the same host for uploads
+ * and downloads.
+ *
+ * Reads `StorageConfigAdminService.describeForAdmin()`, the admin view, whose
+ * secrets are known only as "set", and asks the ACTIVE DRIVER which hosts it
+ * calls (`egressHosts`): the S3 family answers with the endpoint a client is
+ * pointed at (R2's derived endpoint included, or AWS's regional host
+ * `s3.<region>.amazonaws.com`), a driver an app registers with its own. NOT
+ * `StorageConfigService.resolveActiveConfig()`, which decrypts the secrets. A
+ * driver with no hosts (a local filesystem) contributes no row.
+ *
+ * @stability experimental
+ */
+let StorageEgressContributor = class StorageEgressContributor {
+    egress;
+    storageAdmin;
+    id = 'storage';
+    constructor(egress, storageAdmin) {
+        this.egress = egress;
+        this.storageAdmin = storageAdmin;
+    }
+    /** Self-registration with the Doctor's registry. */
+    onModuleInit() {
+        this.egress.register(this);
+    }
+    async describe() {
+        const view = await this.storageAdmin.describeForAdmin();
+        const driver = (0, storage_driver_1.getStorageDriver)(view.provider);
+        const hosts = driver?.egressHosts?.(view.drivers[view.provider] ?? {}) ?? [];
+        // A driver that calls nowhere (the filesystem) has nothing to list; one that
+        // is no longer registered has no hosts to name either.
+        if (hosts.length === 0)
+            return [];
+        return [
+            (0, index_1.egressDependency)({
+                // The id the S3 family has always had; another driver gets its own.
+                id: storage_1.BUILTIN_STORAGE_PROVIDER_KINDS.includes(view.provider) ? 'storage.s3' : `storage.${view.provider}`,
+                // The driver's label without its parenthetical hint ("S3-compatible (MinIO, ...)" is "S3-compatible" here).
+                capability: `Object storage (${(driver?.label ?? view.provider).replace(/\s*\(.*\)\s*$/, '')})`,
+                direction: 'both',
+                enabled: view.configured,
+                required: false,
+                hosts: [...hosts],
+                degradation: 'File uploads, downloads, profile pictures and database backups fail',
+                settingsPath: storage_not_configured_error_1.STORAGE_SETTINGS_PATH,
+            }),
+        ];
+    }
+};
+exports.StorageEgressContributor = StorageEgressContributor;
+exports.StorageEgressContributor = StorageEgressContributor = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.EgressRegistry,
+        storage_config_admin_service_1.StorageConfigAdminService])
+], StorageEgressContributor);
+//# sourceMappingURL=storage.egress.contributor.js.map

package/dist/storage/config/doctor/egress/storage.egress.contributor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.egress.contributor.js","sourceRoot":"","sources":["../../../../../src/storage/config/doctor/egress/storage.egress.contributor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA0D;AAE1D,oDAKkC;AAElC,mEAAuF;AAEvF,oEAAmE;AACnE,qFAA+E;AAC/E,qFAA2E;AAE3E;;;;;;;;;;;;;;GAcG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAIhB;IACA;IAJV,EAAE,GAAG,SAAS,CAAC;IAExB,YACmB,MAAsB,EACtB,YAAuC;QADvC,WAAM,GAAN,MAAM,CAAgB;QACtB,iBAAY,GAAZ,YAAY,CAA2B;IACvD,CAAC;IAEJ,oDAAoD;IACpD,YAAY;QACV,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,IAAA,iCAAgB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAE7E,6EAA6E;QAC7E,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAElC,OAAO;YACL,IAAA,wBAAgB,EAAC;gBACf,oEAAoE;gBACpE,EAAE,EAAG,wCAAoD,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;gBAC7H,4GAA4G;gBAC5G,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,GAAG;gBAC/F,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,IAAI,CAAC,UAAU;gBACxB,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;gBACjB,WAAW,EAAE,qEAAqE;gBAClF,YAAY,EAAE,oDAAqB;aACpC,CAAC;SACH,CAAC;IACJ,CAAC;CACF,CAAA;AArCY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAKgB,sBAAc;QACR,wDAAyB;GAL/C,wBAAwB,CAqCpC"}

package/dist/storage/config/doctor/storage-bucket.doctor-check.d.ts

@@ -0,0 +1,47 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+import { StorageProvider } from '../../providers/storage-provider.interface';
+/**
+ * A key nothing ever writes. `exists()` on it is a single `HeadObject`: it
+ * proves the endpoint answers and the credential is accepted, and it writes
+ * nothing.
+ *
+ * ⚠ READ-ONLY BY DESIGN, and therefore weaker than the settings page's "Test
+ * connection" (`StorageConnectionTestService`), which round-trips a probe
+ * object and audits the attempt. A `HeadObject` on a missing key can answer
+ * `404` whether or not the BUCKET exists, so a pass here means "the store
+ * answered without refusing us", not "uploads will work". The remedy on every
+ * failure points at the full test for exactly that reason.
+ *
+ * @stability experimental
+ */
+export declare const STORAGE_DOCTOR_PROBE_KEY = ".doctor/read-only-probe-never-written";
+/**
+ * The `storage.bucket` check's verdict for a probe error.
+ *
+ * @param error - what the read-only probe threw.
+ * @returns the check outcome (a missing key is a pass; access and network failures are not).
+ *
+ * @stability experimental
+ */
+export declare function decideStorageProbeError(error: unknown): DoctorCheckOutcome;
+/**
+ * `storage` / `storage.bucket` — the configured store answers a read.
+ *
+ * @stability experimental
+ */
+export declare class StorageBucketDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly storage;
+    readonly id = "storage.bucket";
+    readonly category = "storage";
+    readonly label = "Object storage reachability";
+    readonly settingsPath = "/admin/settings/storage";
+    readonly dependsOn: string[];
+    constructor(registry: DoctorCheckRegistry, storage: StorageProvider);
+    /** Self-registration with the Doctor's registry. */
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=storage-bucket.doctor-check.d.ts.map

package/dist/storage/config/doctor/storage-bucket.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-bucket.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/storage/config/doctor/storage-bucket.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAoB,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAU/F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA0D1E;AAED;;;;GAIG;AACH,qBACa,wBAAyB,YAAW,WAAW,EAAE,YAAY;IAQtE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpD,QAAQ,CAAC,EAAE,oBAAoB;IAC/B,QAAQ,CAAC,QAAQ,aAAa;IAC9B,QAAQ,CAAC,KAAK,iCAAiC;IAC/C,QAAQ,CAAC,YAAY,6BAAyB;IAC9C,QAAQ,CAAC,SAAS,WAAsB;gBAGrB,QAAQ,EAAE,mBAAmB,EACH,OAAO,EAAE,eAAe;IAGrE,oDAAoD;IACpD,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAgBzC"}

package/dist/storage/config/doctor/storage-bucket.doctor-check.js

@@ -0,0 +1,141 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageBucketDoctorCheck = exports.STORAGE_DOCTOR_PROBE_KEY = void 0;
+exports.decideStorageProbeError = decideStorageProbeError;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../doctor/index");
+const storage_provider_interface_1 = require("../../providers/storage-provider.interface");
+const s3_probe_support_1 = require("../../drivers/s3/s3-probe.support");
+const storage_not_configured_error_1 = require("../storage-not-configured.error");
+/**
+ * A key nothing ever writes. `exists()` on it is a single `HeadObject`: it
+ * proves the endpoint answers and the credential is accepted, and it writes
+ * nothing.
+ *
+ * ⚠ READ-ONLY BY DESIGN, and therefore weaker than the settings page's "Test
+ * connection" (`StorageConnectionTestService`), which round-trips a probe
+ * object and audits the attempt. A `HeadObject` on a missing key can answer
+ * `404` whether or not the BUCKET exists, so a pass here means "the store
+ * answered without refusing us", not "uploads will work". The remedy on every
+ * failure points at the full test for exactly that reason.
+ *
+ * @stability experimental
+ */
+exports.STORAGE_DOCTOR_PROBE_KEY = '.doctor/read-only-probe-never-written';
+/**
+ * The `storage.bucket` check's verdict for a probe error.
+ *
+ * @param error - what the read-only probe threw.
+ * @returns the check outcome (a missing key is a pass; access and network failures are not).
+ *
+ * @stability experimental
+ */
+function decideStorageProbeError(error) {
+    // No secret is passed for redaction: the probe never holds one — the SDK
+    // error message carries the request, not the credential.
+    const described = (0, s3_probe_support_1.describeStorageError)(error, null);
+    const base = { error: described.message, data: { httpStatus: described.status, code: described.code || null } };
+    const fullTest = `Run "Test connection" at ${storage_not_configured_error_1.STORAGE_SETTINGS_PATH} for a full diagnosis.`;
+    if (described.unreachable) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: 'The object storage endpoint did not answer',
+            remedy: `Check the endpoint URL and that the API can reach it (DNS, firewall, TLS). ${fullTest}`,
+        };
+    }
+    if (s3_probe_support_1.CREDENTIAL_REJECTION_CODES.has(described.code)) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: `The object store rejected the credential (${described.code})`,
+            remedy: `Re-enter the access key id and secret access key at ${storage_not_configured_error_1.STORAGE_SETTINGS_PATH}.`,
+        };
+    }
+    if (s3_probe_support_1.BUCKET_MISSING_CODES.has(described.code)) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: 'The configured bucket does not exist at this endpoint',
+            remedy: `Create the bucket, or correct its name and region at ${storage_not_configured_error_1.STORAGE_SETTINGS_PATH}.`,
+        };
+    }
+    if (s3_probe_support_1.BUCKET_REGION_CODES.has(described.code)) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: `The bucket is in a different region than configured (${described.code})`,
+            remedy: `Correct the region at ${storage_not_configured_error_1.STORAGE_SETTINGS_PATH}.`,
+        };
+    }
+    if (s3_probe_support_1.BUCKET_FORBIDDEN_CODES.has(described.code)) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: `The credential may not read the bucket (${described.code})`,
+            remedy: `Grant the key s3:GetObject and s3:ListBucket on the bucket. ${fullTest}`,
+        };
+    }
+    return {
+        ...base,
+        status: 'fail',
+        detail: `The object store answered with an error${described.code ? ` (${described.code})` : ''}`,
+        remedy: fullTest,
+    };
+}
+/**
+ * `storage` / `storage.bucket` — the configured store answers a read.
+ *
+ * @stability experimental
+ */
+let StorageBucketDoctorCheck = class StorageBucketDoctorCheck {
+    registry;
+    storage;
+    id = 'storage.bucket';
+    category = 'storage';
+    label = 'Object storage reachability';
+    settingsPath = storage_not_configured_error_1.STORAGE_SETTINGS_PATH;
+    dependsOn = ['storage.config'];
+    constructor(registry, storage) {
+        this.registry = registry;
+        this.storage = storage;
+    }
+    /** Self-registration with the Doctor's registry. */
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        const started = Date.now();
+        try {
+            await this.storage.exists(exports.STORAGE_DOCTOR_PROBE_KEY);
+            const latencyMs = Date.now() - started;
+            return {
+                status: 'pass',
+                detail: `The object store answered a read in ${latencyMs} ms`,
+                data: { latencyMs },
+            };
+        }
+        catch (error) {
+            return decideStorageProbeError(error);
+        }
+    }
+};
+exports.StorageBucketDoctorCheck = StorageBucketDoctorCheck;
+exports.StorageBucketDoctorCheck = StorageBucketDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(storage_provider_interface_1.STORAGE_PROVIDER)),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry, Object])
+], StorageBucketDoctorCheck);
+//# sourceMappingURL=storage-bucket.doctor-check.js.map

package/dist/storage/config/doctor/storage-bucket.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-bucket.doctor-check.js","sourceRoot":"","sources":["../../../../src/storage/config/doctor/storage-bucket.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAsCA,0DA0DC;AAhGD,2CAAkE;AAGlE,iDAA4D;AAC5D,2FAA+F;AAC/F,wEAM2C;AAC3C,kFAAwE;AAExE;;;;;;;;;;;;;GAaG;AACU,QAAA,wBAAwB,GAAG,uCAAuC,CAAC;AAEhF;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,KAAc;IACpD,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAA,uCAAoB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;IAChH,MAAM,QAAQ,GAAG,4BAA4B,oDAAqB,wBAAwB,CAAC;IAE3F,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4CAA4C;YACpD,MAAM,EAAE,8EAA8E,QAAQ,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,IAAI,6CAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,6CAA6C,SAAS,CAAC,IAAI,GAAG;YACtE,MAAM,EAAE,uDAAuD,oDAAqB,GAAG;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,uCAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,uDAAuD;YAC/D,MAAM,EAAE,wDAAwD,oDAAqB,GAAG;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,sCAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,wDAAwD,SAAS,CAAC,IAAI,GAAG;YACjF,MAAM,EAAE,yBAAyB,oDAAqB,GAAG;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,yCAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2CAA2C,SAAS,CAAC,IAAI,GAAG;YACpE,MAAM,EAAE,+DAA+D,QAAQ,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,0CAA0C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChG,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAQhB;IAC0B;IARpC,EAAE,GAAG,gBAAgB,CAAC;IACtB,QAAQ,GAAG,SAAS,CAAC;IACrB,KAAK,GAAG,6BAA6B,CAAC;IACtC,YAAY,GAAG,oDAAqB,CAAC;IACrC,SAAS,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAExC,YACmB,QAA6B,EACH,OAAwB;QADlD,aAAQ,GAAR,QAAQ,CAAqB;QACH,YAAO,GAAP,OAAO,CAAiB;IAClE,CAAC;IAEJ,oDAAoD;IACpD,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gCAAwB,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YAEvC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,uCAAuC,SAAS,KAAK;gBAC7D,IAAI,EAAE,EAAE,SAAS,EAAE;aACpB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;CACF,CAAA;AAjCY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAUR,WAAA,IAAA,eAAM,EAAC,6CAAgB,CAAC,CAAA;qCADE,2BAAmB;GARrC,wBAAwB,CAiCpC"}

package/dist/storage/config/doctor/storage-config.doctor-check.d.ts

@@ -0,0 +1,31 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+import type { StorageConfigResolution } from '../storage-config';
+import { StorageConfigService } from '../storage-config.service';
+/**
+ * Pure: judges a resolution. Reports the provider, bucket and region (the
+ * settings page shows all three to the same audience) and the NAMES of missing
+ * fields — never the access key id or the secret.
+ *
+ * @stability experimental
+ */
+export declare function decideStorageConfig(resolution: StorageConfigResolution): DoctorCheckOutcome;
+/**
+ * `storage` / `storage.config` — the active object-storage configuration is complete.
+ *
+ * @stability experimental
+ */
+export declare class StorageConfigDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly storageConfig;
+    readonly id = "storage.config";
+    readonly category = "storage";
+    readonly label = "Object storage configuration";
+    readonly settingsPath = "/admin/settings/storage";
+    constructor(registry: DoctorCheckRegistry, storageConfig: StorageConfigService);
+    /** Self-registration with the Doctor's registry. */
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=storage-config.doctor-check.d.ts.map

package/dist/storage/config/doctor/storage-config.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/storage/config/doctor/storage-config.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGjE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,uBAAuB,GAAG,kBAAkB,CAiB3F;AAED;;;;GAIG;AACH,qBACa,wBAAyB,YAAW,WAAW,EAAE,YAAY;IAOtE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,QAAQ,CAAC,EAAE,oBAAoB;IAC/B,QAAQ,CAAC,QAAQ,aAAa;IAC9B,QAAQ,CAAC,KAAK,kCAAkC;IAChD,QAAQ,CAAC,YAAY,6BAAyB;gBAG3B,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,EAAE,oBAAoB;IAGtD,oDAAoD;IACpD,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAczC"}

package/dist/storage/config/doctor/storage-config.doctor-check.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageConfigDoctorCheck = void 0;
+exports.decideStorageConfig = decideStorageConfig;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../doctor/index");
+const storage_config_service_1 = require("../storage-config.service");
+const storage_not_configured_error_1 = require("../storage-not-configured.error");
+/**
+ * Pure: judges a resolution. Reports the provider, bucket and region (the
+ * settings page shows all three to the same audience) and the NAMES of missing
+ * fields — never the access key id or the secret.
+ *
+ * @stability experimental
+ */
+function decideStorageConfig(resolution) {
+    if (!resolution.configured) {
+        return {
+            status: 'fail',
+            detail: `Object storage is not configured (${resolution.provider}; missing: ${resolution.missing.join(', ')})`,
+            remedy: `Complete the object storage settings at ${storage_not_configured_error_1.STORAGE_SETTINGS_PATH}; uploads, profile images and backups need them.`,
+            data: { provider: resolution.provider, missing: resolution.missing.join(',') },
+        };
+    }
+    const { provider, bucket, region } = resolution.config;
+    return {
+        status: 'pass',
+        detail: region ? `${provider} bucket "${bucket}" in ${region}` : `${provider} bucket "${bucket}"`,
+        data: { provider, bucket, region },
+    };
+}
+/**
+ * `storage` / `storage.config` — the active object-storage configuration is complete.
+ *
+ * @stability experimental
+ */
+let StorageConfigDoctorCheck = class StorageConfigDoctorCheck {
+    registry;
+    storageConfig;
+    id = 'storage.config';
+    category = 'storage';
+    label = 'Object storage configuration';
+    settingsPath = storage_not_configured_error_1.STORAGE_SETTINGS_PATH;
+    constructor(registry, storageConfig) {
+        this.registry = registry;
+        this.storageConfig = storageConfig;
+    }
+    /** Self-registration with the Doctor's registry. */
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        try {
+            return decideStorageConfig(await this.storageConfig.resolve({ fresh: true }));
+        }
+        catch (error) {
+            return {
+                status: 'fail',
+                detail: 'The object storage configuration could not be read',
+                remedy: `Check SECRETS_ENCRYPTION_KEY is the key the storage credential was saved with, then re-save ` +
+                    `the credential at ${storage_not_configured_error_1.STORAGE_SETTINGS_PATH}.`,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+};
+exports.StorageConfigDoctorCheck = StorageConfigDoctorCheck;
+exports.StorageConfigDoctorCheck = StorageConfigDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        storage_config_service_1.StorageConfigService])
+], StorageConfigDoctorCheck);
+//# sourceMappingURL=storage-config.doctor-check.js.map

package/dist/storage/config/doctor/storage-config.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.doctor-check.js","sourceRoot":"","sources":["../../../../src/storage/config/doctor/storage-config.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;AAeA,kDAiBC;AAhCD,2CAA0D;AAG1D,iDAA4D;AAE5D,sEAAiE;AACjE,kFAAwE;AAExE;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,UAAmC;IACrE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,qCAAqC,UAAU,CAAC,QAAQ,cAAc,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC9G,MAAM,EAAE,2CAA2C,oDAAqB,kDAAkD;YAC1H,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;SAC/E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;IAEvD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,YAAY,MAAM,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG;QACjG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAOhB;IACA;IAPV,EAAE,GAAG,gBAAgB,CAAC;IACtB,QAAQ,GAAG,SAAS,CAAC;IACrB,KAAK,GAAG,8BAA8B,CAAC;IACvC,YAAY,GAAG,oDAAqB,CAAC;IAE9C,YACmB,QAA6B,EAC7B,aAAmC;QADnC,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,oDAAoD;IACpD,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,CAAC;YACH,OAAO,mBAAmB,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,oDAAoD;gBAC5D,MAAM,EACJ,8FAA8F;oBAC9F,qBAAqB,oDAAqB,GAAG;gBAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AA9BY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAQkB,2BAAmB;QACd,6CAAoB;GAR3C,wBAAwB,CA8BpC"}