@miguelmorales13/nestkit 0.10.0 → 0.11.0

package/README.md

@@ -857,6 +857,28 @@ van a la misma base, una sola clase implementa los dos y se atan con `useExistin
 `revokeIfActive` **tiene que ser atómico** —un UPDATE condicional, no un leer-y-escribir—: esa
 fila es lo único que impide que un refresh token robado se use dos veces.
 
+**El `state` va incluido y no se puede apagar.** Sin él, cualquiera puede entregarle a una persona
+una URL de callback que lleva un `code` de **su propia** cuenta del proveedor: el navegador de la
+víctima completa el flujo y acaba dentro de la sesión del atacante, metiendo sus datos —su peso, su
+dieta, lo que sea— en una cuenta que controla otro. Es el ataque que este parámetro existe para
+cerrar, y es fácil no tenerlo sin notarlo, porque el login funciona igual de bien sin él.
+
+`GET /auth/:provider` firma un `state` y lo deja en una cookie al salir; el callback exige que el
+valor que devuelve el proveedor coincida con esa cookie, y lo comprueba **antes** de canjear el
+`code` —si la llamada no salió de un acceso empezado en ese navegador, no hay por qué gastar el
+`code` ni hablar con el proveedor—. La cookie se borra pase lo que pase, así que una pestaña
+olvidada no sirve para repetir el callback más tarde.
+
+Va firmado en vez de guardado en una tabla: no necesita esquema ni limpieza y caduca solo. Se
+ajusta con `stateCookieName` y `stateTtlSeconds` (diez minutos por defecto: da para escribir una
+contraseña y pasar un segundo factor, y deja sin valor a una URL filtrada para cuando alguien la
+encuentre).
+
+> **Incompatible desde 0.11.0.** `authorizeUrl(provider)` devolvía la URL como string y ahora
+> devuelve `{ url, state, expiresAt }` — el `state` hay que escribirlo en una cookie. Si usás
+> `createOAuthController()` no tenés que hacer nada, ya lo hace. Solo afecta a quien llame al
+> servicio desde un controlador propio.
+
 Personalizable sin tocar la librería: nombre y path de la cookie, TTLs, `sameSite`, a dónde vuelve
 el navegador tras entrar / fallar / vincular, si un login cierra las demás sesiones
 (`singleSession`, por defecto sí), qué campos del usuario salen por la API (`mapUser`), el guard de
@@ -985,28 +1007,52 @@ MediaModule.forRoot({
   publicUrl: 'https://api.tuapp.com/api',   // ¡con el prefijo global!
   uploadSecret: process.env.MEDIA_SECRET,
   ttlMs: 60 * 60 * 1000,                    // por defecto una hora
+  // Por defecto: png, jpeg, webp y gif. Ampliá solo con formatos que no
+  // puedan ejecutar nada (ver abajo por qué SVG no está en la lista).
+  allowedContentTypes: ['image/png', 'image/jpeg'],
+  limits: { maxFiles: 50, maxTotalBytes: 256 * 1024 * 1024 },  // los de por defecto
 })
 ```
 
 Expone `POST /media` (devuelve `{ url }`) y `GET /media/:id`. La subida va protegida con un secreto
 compartido en la cabecera `x-media-secret`, no con un JWT, porque quien llama es un job de CI y no
-una persona con sesión; sin él cualquiera podría alojar contenido arbitrario en tu dominio. La
+una persona con sesión; sin él cualquiera podría alojar contenido arbitrario en tu dominio. Se
+compara en tiempo constante: un `!==` corta en el primer byte distinto, así que lo que tarda
+delata cuánto se acertó. La
 descarga es pública a propósito: los servicios que consumen estas URLs las piden sin credenciales.
 
 **Vive en memoria, a propósito.** Entre guardar y publicar pasan segundos, así que un reinicio en el
 medio solo significa reintentar, y no queda nada en disco. Si necesitás que los archivos sobrevivan
 a un reinicio, esta es la herramienta equivocada: usá `storage`.
 
+Y por vivir en memoria, **tiene techo**: tope de archivos y de bytes, porque esa memoria es el
+montículo del proceso y las entradas duran una hora. Sin límite, un bucle contra el endpoint de
+subida —tanto un fallo de un job de publicación como alguien con el secreto— lo hace crecer hasta
+que el proceso muere, y se lleva por delante la API entera, no solo las subidas. Al llegar al tope
+**rechaza en vez de desalojar lo más viejo**: desalojar rompería en silencio una publicación en
+curso, y quien la lanzó no puede saber que su imagen desapareció hasta que el servicio remoto
+responde un 404 que no se explica.
+
+**No acepta SVG, y no es un olvido.** Un SVG es un documento que puede llevar script, y servido
+desde tu dominio ese script corre **en el origen de tu aplicación**: sus cookies, su
+almacenamiento. Es un XSS almacenado que regala el propio alojador de archivos. Por eso el tipo
+declarado se coteja contra una lista en vez de tomarse por bueno, y al servir se manda
+`x-content-type-options: nosniff` para que el navegador tampoco decida por su cuenta.
+
 Dos errores que cuestan una tarde:
 
 - `publicUrl` **tiene que incluir el prefijo global** de la app. Sin él la URL cae en lo que sirva el
   frontend, que responde 200 con una página HTML, y el consumidor se descarga eso en vez del archivo.
 - Fastify solo parsea JSON de fábrica. Sin registrar un parser para los tipos que vas a aceptar, la
-  subida responde 415:
+  subida responde 415. **Listá los tipos, no uses `/^image\//`** —que es lo que decía este
+  ejemplo hasta 0.11.0—: ese patrón deja pasar `image/svg+xml`, y aunque el módulo ahora lo
+  rechace, es mejor que ni siquiera llegue a parsearse:
 
 ```ts
 app.getHttpAdapter().getInstance().addContentTypeParser(
-  /^image\//, { parseAs: 'buffer' }, (_req, body, done) => done(null, body),
+  ['image/png', 'image/jpeg', 'image/webp'],
+  { parseAs: 'buffer', bodyLimit: 12 * 1024 * 1024 },
+  (_req, body, done) => done(null, body),
 )
 ```
 
@@ -1083,7 +1129,7 @@ Qué se añadió en cada versión y por qué está hecho así: [CAMBIOS.md](./CA
 
 ## Estado del paquete
 
-`0.10.0`. Sin adaptador Mongo real. Sin tests unitarios propios.
+`0.11.0`. Sin adaptador Mongo real. Sin tests unitarios propios.
 
 `auth/oauth` y `umami` sí tienen un consumidor real: **nutrimx** corre su acceso con Google y
 Facebook sobre este módulo en producción. El resto sigue sin ejercitarse de verdad.

package/dist/auth/oauth/index.cjs

@@ -141,9 +141,11 @@ function resolveOAuthOptions(options) {
       secure: _nullishCoalesce(_optionalChain([options, 'access', _9 => _9.cookie, 'optionalAccess', _10 => _10.secure]), () => ( process.env.NODE_ENV === "production"))
     },
     linkCookieName: _nullishCoalesce(options.linkCookieName, () => ( "link_intent")),
+    stateCookieName: _nullishCoalesce(options.stateCookieName, () => ( "oauth_state")),
     accessTtlSeconds: _nullishCoalesce(options.accessTtlSeconds, () => ( 15 * 60)),
     refreshTtlSeconds: _nullishCoalesce(options.refreshTtlSeconds, () => ( 30 * 24 * 60 * 60)),
     linkTtlSeconds: _nullishCoalesce(options.linkTtlSeconds, () => ( 10 * 60)),
+    stateTtlSeconds: _nullishCoalesce(options.stateTtlSeconds, () => ( 10 * 60)),
     accessSecret: options.accessSecret,
     refreshSecret: options.refreshSecret,
     singleSession: _nullishCoalesce(options.singleSession, () => ( true)),
@@ -192,8 +194,60 @@ var OAuthAuthService = class {
     }
     return found;
   }
+  /**
+   * The provider's consent URL, together with the `state` that has to travel
+   * back with the callback.
+   *
+   * `state` is not decoration. Without it, anyone can hand a victim a
+   * callback URL carrying an authorization code for *their own* provider
+   * account: the victim's browser completes the flow and ends up signed in as
+   * the attacker, entering their data into an account someone else controls.
+   * The value goes out in the URL and, signed, into a cookie; the callback
+   * proceeds only when the two match, which a third party cannot arrange
+   * because they cannot write cookies for this domain.
+   *
+   * Signed rather than stored in a table: it needs no schema and no cleanup,
+   * and it expires on its own.
+   */
   authorizeUrl(name) {
-    return buildAuthorizeUrl(this.provider(name));
+    const provider = this.provider(name);
+    const ttl = this.options.stateTtlSeconds;
+    const state = _jsonwebtoken2.default.sign(
+      // `nonce` makes two authorize requests within the same second produce
+      // different tokens; `typ` keeps this from being swapped with the link
+      // token, which is signed with the same secret.
+      { typ: "state", provider: provider.name, nonce: _crypto.randomUUID.call(void 0, ) },
+      requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET"),
+      { expiresIn: ttl }
+    );
+    return {
+      url: buildAuthorizeUrl(provider, state),
+      state,
+      expiresAt: new Date(Date.now() + ttl * 1e3)
+    };
+  }
+  /**
+   * Whether the `state` the provider sent back is the one issued for this
+   * provider, to this browser, and still valid.
+   *
+   * Both halves are checked. Matching the cookie proves the callback belongs
+   * to the authorize request this browser started; verifying the signature
+   * proves the pair was not simply invented by whoever crafted the URL.
+   */
+  verifyState(received, fromCookie, provider) {
+    if (!received || !fromCookie) return false;
+    const a = Buffer.from(received);
+    const b = Buffer.from(fromCookie);
+    if (a.length !== b.length || !_crypto.timingSafeEqual.call(void 0, a, b)) return false;
+    try {
+      const payload = _jsonwebtoken2.default.verify(
+        received,
+        requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET")
+      );
+      return payload.typ === "state" && payload.provider === provider;
+    } catch (e2) {
+      return false;
+    }
   }
   /** Exchanges the callback's `code` for a normalised profile. */
   async profileFromCode(name, code) {
@@ -303,7 +357,7 @@ var OAuthAuthService = class {
         requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET")
       );
       return payload.typ === "link" && payload.sub ? payload.sub : null;
-    } catch (e2) {
+    } catch (e3) {
       return null;
     }
   }
@@ -388,7 +442,7 @@ var OAuthAuthService = class {
         token,
         requireSecret(this.options.refreshSecret, "JWT_REFRESH_SECRET")
       );
-    } catch (e3) {
+    } catch (e4) {
       throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("Invalid refresh token.");
     }
   }
@@ -491,12 +545,24 @@ function createOAuthController(options = {}) {
       return { ok: true };
     }
     start(provider, reply) {
-      redirect(reply, this.auth.authorizeUrl(provider));
+      const { url, state, expiresAt } = this.auth.authorizeUrl(provider);
+      setCookie(reply, this.auth.config.stateCookieName, state, {
+        ...this.cookieBase(),
+        expires: expiresAt
+      });
+      redirect(reply, url);
     }
-    async callback(provider, code, request, reply) {
+    async callback(provider, code, state, request, reply) {
       if (!code) throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)(this.auth.config.genericErrorMessage());
+      const stateCookie = _optionalChain([request, 'access', _19 => _19.cookies, 'optionalAccess', _20 => _20[this.auth.config.stateCookieName]]);
+      clearCookie(reply, this.auth.config.stateCookieName, {
+        path: this.auth.config.cookie.path
+      });
+      if (!this.auth.verifyState(state, stateCookie, provider)) {
+        throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)(this.auth.config.genericErrorMessage());
+      }
       const profile = await this.auth.profileFromCode(provider, code);
-      const linkUserId = this.auth.readLinkToken(_optionalChain([request, 'access', _19 => _19.cookies, 'optionalAccess', _20 => _20[this.auth.config.linkCookieName]]));
+      const linkUserId = this.auth.readLinkToken(_optionalChain([request, 'access', _21 => _21.cookies, 'optionalAccess', _22 => _22[this.auth.config.linkCookieName]]));
       if (linkUserId) {
         clearCookie(reply, this.auth.config.linkCookieName, { path: this.auth.config.cookie.path });
         try {
@@ -562,8 +628,9 @@ function createOAuthController(options = {}) {
     _common.UseFilters.call(void 0, OAuthCallbackFilter),
     _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Param.call(void 0, "provider")),
     _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Query.call(void 0, "code")),
-    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 2, _common.Req.call(void 0, )),
-    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 3, _common.Res.call(void 0, ))
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 2, _common.Query.call(void 0, "state")),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 3, _common.Req.call(void 0, )),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 4, _common.Res.call(void 0, ))
   ], OAuthControllerHost.prototype, "callback", 1);
   OAuthControllerHost = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
     _common.Controller.call(void 0, _nullishCoalesce(options.path, () => ( "auth")))

package/dist/auth/oauth/index.js

@@ -141,9 +141,11 @@ function resolveOAuthOptions(options) {
       secure: options.cookie?.secure ?? process.env.NODE_ENV === "production"
     },
     linkCookieName: options.linkCookieName ?? "link_intent",
+    stateCookieName: options.stateCookieName ?? "oauth_state",
     accessTtlSeconds: options.accessTtlSeconds ?? 15 * 60,
     refreshTtlSeconds: options.refreshTtlSeconds ?? 30 * 24 * 60 * 60,
     linkTtlSeconds: options.linkTtlSeconds ?? 10 * 60,
+    stateTtlSeconds: options.stateTtlSeconds ?? 10 * 60,
     accessSecret: options.accessSecret,
     refreshSecret: options.refreshSecret,
     singleSession: options.singleSession ?? true,
@@ -157,7 +159,7 @@ function resolveOAuthOptions(options) {
 
 // src/auth/oauth/oauth-auth.service.ts
 import { Inject, Injectable, ServiceUnavailableException } from "@nestjs/common";
-import { createHash, randomUUID } from "crypto";
+import { createHash, randomUUID, timingSafeEqual } from "crypto";
 import jwt from "jsonwebtoken";
 function hashToken(token) {
   return createHash("sha256").update(token).digest("hex");
@@ -192,8 +194,60 @@ var OAuthAuthService = class {
     }
     return found;
   }
+  /**
+   * The provider's consent URL, together with the `state` that has to travel
+   * back with the callback.
+   *
+   * `state` is not decoration. Without it, anyone can hand a victim a
+   * callback URL carrying an authorization code for *their own* provider
+   * account: the victim's browser completes the flow and ends up signed in as
+   * the attacker, entering their data into an account someone else controls.
+   * The value goes out in the URL and, signed, into a cookie; the callback
+   * proceeds only when the two match, which a third party cannot arrange
+   * because they cannot write cookies for this domain.
+   *
+   * Signed rather than stored in a table: it needs no schema and no cleanup,
+   * and it expires on its own.
+   */
   authorizeUrl(name) {
-    return buildAuthorizeUrl(this.provider(name));
+    const provider = this.provider(name);
+    const ttl = this.options.stateTtlSeconds;
+    const state = jwt.sign(
+      // `nonce` makes two authorize requests within the same second produce
+      // different tokens; `typ` keeps this from being swapped with the link
+      // token, which is signed with the same secret.
+      { typ: "state", provider: provider.name, nonce: randomUUID() },
+      requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET"),
+      { expiresIn: ttl }
+    );
+    return {
+      url: buildAuthorizeUrl(provider, state),
+      state,
+      expiresAt: new Date(Date.now() + ttl * 1e3)
+    };
+  }
+  /**
+   * Whether the `state` the provider sent back is the one issued for this
+   * provider, to this browser, and still valid.
+   *
+   * Both halves are checked. Matching the cookie proves the callback belongs
+   * to the authorize request this browser started; verifying the signature
+   * proves the pair was not simply invented by whoever crafted the URL.
+   */
+  verifyState(received, fromCookie, provider) {
+    if (!received || !fromCookie) return false;
+    const a = Buffer.from(received);
+    const b = Buffer.from(fromCookie);
+    if (a.length !== b.length || !timingSafeEqual(a, b)) return false;
+    try {
+      const payload = jwt.verify(
+        received,
+        requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET")
+      );
+      return payload.typ === "state" && payload.provider === provider;
+    } catch {
+      return false;
+    }
   }
   /** Exchanges the callback's `code` for a normalised profile. */
   async profileFromCode(name, code) {
@@ -491,10 +545,22 @@ function createOAuthController(options = {}) {
       return { ok: true };
     }
     start(provider, reply) {
-      redirect(reply, this.auth.authorizeUrl(provider));
+      const { url, state, expiresAt } = this.auth.authorizeUrl(provider);
+      setCookie(reply, this.auth.config.stateCookieName, state, {
+        ...this.cookieBase(),
+        expires: expiresAt
+      });
+      redirect(reply, url);
     }
-    async callback(provider, code, request, reply) {
+    async callback(provider, code, state, request, reply) {
       if (!code) throw new UnauthorizedAppException(this.auth.config.genericErrorMessage());
+      const stateCookie = request.cookies?.[this.auth.config.stateCookieName];
+      clearCookie(reply, this.auth.config.stateCookieName, {
+        path: this.auth.config.cookie.path
+      });
+      if (!this.auth.verifyState(state, stateCookie, provider)) {
+        throw new UnauthorizedAppException(this.auth.config.genericErrorMessage());
+      }
       const profile = await this.auth.profileFromCode(provider, code);
       const linkUserId = this.auth.readLinkToken(request.cookies?.[this.auth.config.linkCookieName]);
       if (linkUserId) {
@@ -562,8 +628,9 @@ function createOAuthController(options = {}) {
     UseFilters(OAuthCallbackFilter),
     __decorateParam(0, Param("provider")),
     __decorateParam(1, Query("code")),
-    __decorateParam(2, Req()),
-    __decorateParam(3, Res())
+    __decorateParam(2, Query("state")),
+    __decorateParam(3, Req()),
+    __decorateParam(4, Res())
   ], OAuthControllerHost.prototype, "callback", 1);
   OAuthControllerHost = __decorateClass([
     Controller(options.path ?? "auth")

package/dist/auth/oauth/oauth-auth.service.d.ts

@@ -29,7 +29,35 @@ export declare class OAuthAuthService<U extends OAuthUser = OAuthUser> {
      * differently, and distinguishing them only tells a prober what exists.
      */
     provider(name: string): OAuthProviderConfig;
-    authorizeUrl(name: string): string;
+    /**
+     * The provider's consent URL, together with the `state` that has to travel
+     * back with the callback.
+     *
+     * `state` is not decoration. Without it, anyone can hand a victim a
+     * callback URL carrying an authorization code for *their own* provider
+     * account: the victim's browser completes the flow and ends up signed in as
+     * the attacker, entering their data into an account someone else controls.
+     * The value goes out in the URL and, signed, into a cookie; the callback
+     * proceeds only when the two match, which a third party cannot arrange
+     * because they cannot write cookies for this domain.
+     *
+     * Signed rather than stored in a table: it needs no schema and no cleanup,
+     * and it expires on its own.
+     */
+    authorizeUrl(name: string): {
+        url: string;
+        state: string;
+        expiresAt: Date;
+    };
+    /**
+     * Whether the `state` the provider sent back is the one issued for this
+     * provider, to this browser, and still valid.
+     *
+     * Both halves are checked. Matching the cookie proves the callback belongs
+     * to the authorize request this browser started; verifying the signature
+     * proves the pair was not simply invented by whoever crafted the URL.
+     */
+    verifyState(received: string | undefined, fromCookie: string | undefined, provider: string): boolean;
     /** Exchanges the callback's `code` for a normalised profile. */
     profileFromCode(name: string, code: string): Promise<OAuthProfile>;
     /**

package/dist/auth/oauth/oauth.options.d.ts

@@ -41,10 +41,21 @@ export interface OAuthAuthOptions<U extends OAuthUser = OAuthUser> {
      * already signed-in account. Default `link_intent`.
      */
     linkCookieName?: string;
+    /**
+     * Cookie holding the `state` that ties an authorize request to its
+     * callback. Defaults to `oauth_state`.
+     */
+    stateCookieName?: string;
     /** Defaults: 15 min access, 30 days refresh, 10 min link permission. */
     accessTtlSeconds?: number;
     refreshTtlSeconds?: number;
     linkTtlSeconds?: number;
+    /**
+     * How long a `state` stays valid. Defaults to ten minutes — long enough to
+     * type a password and pass a second factor, short enough that a leaked
+     * authorize URL is worthless by the time anyone finds it.
+     */
+    stateTtlSeconds?: number;
     /** Read from `JWT_ACCESS_SECRET` / `JWT_REFRESH_SECRET` when omitted. */
     accessSecret?: string;
     refreshSecret?: string;

package/dist/index.cjs

@@ -3,12 +3,12 @@
 
 
 
-var _chunkSPTDXUEDcjs = require('./chunk-SPTDXUED.cjs');
+var _chunkRF75KC63cjs = require('./chunk-RF75KC63.cjs');
 
 
 
 
-var _chunkRF75KC63cjs = require('./chunk-RF75KC63.cjs');
+var _chunkSPTDXUEDcjs = require('./chunk-SPTDXUED.cjs');
 require('./chunk-MR2IFCZE.cjs');
 
 
@@ -27,9 +27,6 @@ var _chunkTJHRABMLcjs = require('./chunk-TJHRABML.cjs');
 var _chunk3CLYZC3Tcjs = require('./chunk-3CLYZC3T.cjs');
 
 
-var _chunkQS2W5XCQcjs = require('./chunk-QS2W5XCQ.cjs');
-
-
 
 var _chunkM3EL5O6Tcjs = require('./chunk-M3EL5O6T.cjs');
 require('./chunk-7SOM7EZP.cjs');
@@ -49,6 +46,9 @@ var _chunkZA56XBCKcjs = require('./chunk-ZA56XBCK.cjs');
 
 
 var _chunkR7BVS6CIcjs = require('./chunk-R7BVS6CI.cjs');
+
+
+var _chunkQS2W5XCQcjs = require('./chunk-QS2W5XCQ.cjs');
 require('./chunk-2REOCMUD.cjs');
 
 

package/dist/index.js

@@ -1,14 +1,14 @@
 import "./chunk-EPVKCBPT.js";
-import {
-  SUPABASE_ANON_CLIENT,
-  SUPABASE_SERVICE_ROLE_CLIENT,
-  SupabaseModule
-} from "./chunk-PA24P76K.js";
 import {
   PG_POOL,
   PgModule,
   withTenantScope
 } from "./chunk-VKOPDDCC.js";
+import {
+  SUPABASE_ANON_CLIENT,
+  SUPABASE_SERVICE_ROLE_CLIENT,
+  SupabaseModule
+} from "./chunk-PA24P76K.js";
 import "./chunk-NAK4WDKS.js";
 import {
   REQUEST_ID_HEADER,
@@ -25,9 +25,6 @@ import {
   BaseCrudService,
   createCrudController
 } from "./chunk-JOVBJDJ2.js";
-import {
-  BaseResponseDto
-} from "./chunk-XX2HPTRU.js";
 import {
   I18nModule,
   translateOr
@@ -49,6 +46,9 @@ import {
 import {
   AppException
 } from "./chunk-YFYHLYHN.js";
+import {
+  BaseResponseDto
+} from "./chunk-XX2HPTRU.js";
 import "./chunk-4MGIQFAJ.js";
 export {
   AppException,

package/dist/media/index.cjs

@@ -20,28 +20,60 @@ var _common = require('@nestjs/common');
 
 
 
+var _crypto = require('crypto');
+
 // src/media/media.service.ts
 
 
 // src/media/media.options.ts
 var MEDIA_OPTIONS = /* @__PURE__ */ Symbol("MEDIA_OPTIONS");
 var MEDIA_TTL = /* @__PURE__ */ Symbol("MEDIA_TTL");
+var MEDIA_LIMITS = /* @__PURE__ */ Symbol("MEDIA_LIMITS");
 
 // src/media/media.service.ts
-var _crypto = require('crypto');
+
 var MediaService = class {
-  constructor(ttlMs) {
+  constructor(ttlMs, limits) {
     this.ttlMs = ttlMs;
+    this.limits = limits;
     this.logger = new (0, _common.Logger)(MediaService.name);
     this.store = /* @__PURE__ */ new Map();
   }
+  /**
+   * Stores a file, or throws if the store is already full.
+   *
+   * The ceiling matters more than it looks. This map is the process's own
+   * heap, entries live for an hour, and nothing here bounded how many there
+   * could be: a loop against the upload endpoint — a bug in a publishing job
+   * as easily as someone with the secret — grows it until the process dies,
+   * and it takes the whole API down with it, not just uploads.
+   *
+   * Refusing is the right answer rather than evicting the oldest: an eviction
+   * would silently break a publication already in flight, and the caller
+   * cannot tell that its image vanished until the remote service reports a
+   * 404 it cannot explain.
+   */
   put(data, contentType) {
     this.sweep();
+    if (this.store.size >= this.limits.maxFiles) {
+      throw new (0, _common.PayloadTooLargeException)(
+        `The media store is full (${this.limits.maxFiles} files). Try again shortly.`
+      );
+    }
+    const total = this.bytesHeld();
+    if (total + data.length > this.limits.maxTotalBytes) {
+      throw new (0, _common.PayloadTooLargeException)("The media store is out of room. Try again shortly.");
+    }
     const id = _crypto.randomUUID.call(void 0, ).replace(/-/g, "");
     this.store.set(id, { data, contentType, expiresAt: Date.now() + this.ttlMs });
     this.logger.log(`Stored ${id} (${(data.length / 1024).toFixed(0)} KB)`);
     return id;
   }
+  bytesHeld() {
+    let total = 0;
+    for (const entry of this.store.values()) total += entry.data.length;
+    return total;
+  }
   get(id) {
     const found = this.store.get(id);
     if (!found) return void 0;
@@ -61,10 +93,18 @@ var MediaService = class {
 };
 MediaService = exports.MediaService = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
   _common.Injectable.call(void 0, ),
-  _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Inject.call(void 0, MEDIA_TTL))
+  _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Inject.call(void 0, MEDIA_TTL)),
+  _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Inject.call(void 0, MEDIA_LIMITS))
 ], MediaService);
 
 // src/media/media.controller.ts
+function secretMatches(received, expected) {
+  if (!received) return false;
+  const a = Buffer.from(received);
+  const b = Buffer.from(expected);
+  return a.length === b.length && _crypto.timingSafeEqual.call(void 0, a, b);
+}
+var DEFAULT_ALLOWED = ["image/png", "image/jpeg", "image/webp", "image/gif"];
 var MediaController = class {
   // Both dependencies are injected by explicit token, like the rest of this
   // package. The bundler does not emit decorator metadata, so injecting by type
@@ -78,18 +118,25 @@ var MediaController = class {
     if (!this.options.uploadSecret) {
       throw new (0, _common.UnauthorizedException)("Media uploads are not configured.");
     }
-    if (secret !== this.options.uploadSecret) {
+    if (!secretMatches(secret, this.options.uploadSecret)) {
       throw new (0, _common.UnauthorizedException)("Invalid secret.");
     }
     const data = request.body;
     if (!_optionalChain([data, 'optionalAccess', _ => _.length])) throw new (0, _common.UnauthorizedException)("Empty body.");
-    const id = this.media.put(Buffer.from(data), _nullishCoalesce(request.headers["content-type"], () => ( "image/png")));
+    const allowed = _nullishCoalesce(this.options.allowedContentTypes, () => ( DEFAULT_ALLOWED));
+    const declared = _optionalChain([request, 'access', _2 => _2.headers, 'access', _3 => _3["content-type"], 'optionalAccess', _4 => _4.split, 'call', _5 => _5(";"), 'access', _6 => _6[0], 'optionalAccess', _7 => _7.trim, 'call', _8 => _8(), 'access', _9 => _9.toLowerCase, 'call', _10 => _10()]);
+    if (!declared || !allowed.includes(declared)) {
+      throw new (0, _common.BadRequestException)(
+        `Unsupported content type. Allowed: ${allowed.join(", ")}.`
+      );
+    }
+    const id = this.media.put(Buffer.from(data), declared);
     return { url: `${this.options.publicUrl}/media/${id}` };
   }
   serve(id, reply) {
     const found = this.media.get(id);
     if (!found) throw new (0, _common.NotFoundException)("That file is no longer available.");
-    reply.header("content-type", found.contentType).header("cache-control", "no-store").send(found.data);
+    reply.header("content-type", found.contentType).header("cache-control", "no-store").header("x-content-type-options", "nosniff").send(found.data);
   }
 };
 _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
@@ -110,6 +157,7 @@ MediaController = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
 
 // src/media/media.module.ts
 var ONE_HOUR = 60 * 60 * 1e3;
+var DEFAULT_LIMITS = { maxFiles: 50, maxTotalBytes: 256 * 1024 * 1024 };
 var MediaModule = class {
   static forRoot(options) {
     return {
@@ -118,6 +166,7 @@ var MediaModule = class {
       providers: [
         { provide: MEDIA_OPTIONS, useValue: options },
         { provide: MEDIA_TTL, useValue: _nullishCoalesce(options.ttlMs, () => ( ONE_HOUR)) },
+        { provide: MEDIA_LIMITS, useValue: { ...DEFAULT_LIMITS, ...options.limits } },
         MediaService
       ],
       exports: [MediaService]
@@ -132,4 +181,5 @@ MediaModule = exports.MediaModule = _chunk2REOCMUDcjs.__decorateClass.call(void
 
 
 
-exports.MEDIA_OPTIONS = MEDIA_OPTIONS; exports.MEDIA_TTL = MEDIA_TTL; exports.MediaModule = MediaModule; exports.MediaService = MediaService;
+
+exports.MEDIA_LIMITS = MEDIA_LIMITS; exports.MEDIA_OPTIONS = MEDIA_OPTIONS; exports.MEDIA_TTL = MEDIA_TTL; exports.MediaModule = MediaModule; exports.MediaService = MediaService;

package/dist/media/index.d.ts

@@ -1,5 +1,5 @@
 export { MediaModule } from './media.module.js';
 export { MediaService } from './media.service.js';
-export { MEDIA_OPTIONS, MEDIA_TTL } from './media.options.js';
-export type { MediaOptions } from './media.options.js';
+export { MEDIA_OPTIONS, MEDIA_TTL, MEDIA_LIMITS } from './media.options.js';
+export type { MediaOptions, MediaLimits } from './media.options.js';
 export type { StoredMedia } from './media.service.js';

package/dist/media/index.js

@@ -8,6 +8,7 @@ import { Module } from "@nestjs/common";
 
 // src/media/media.controller.ts
 import {
+  BadRequestException,
   Controller,
   Get,
   Headers,
@@ -19,29 +20,60 @@ import {
   Res,
   UnauthorizedException
 } from "@nestjs/common";
+import { timingSafeEqual } from "crypto";
 
 // src/media/media.service.ts
-import { Inject, Injectable, Logger } from "@nestjs/common";
+import { Inject, Injectable, Logger, PayloadTooLargeException } from "@nestjs/common";
 
 // src/media/media.options.ts
 var MEDIA_OPTIONS = /* @__PURE__ */ Symbol("MEDIA_OPTIONS");
 var MEDIA_TTL = /* @__PURE__ */ Symbol("MEDIA_TTL");
+var MEDIA_LIMITS = /* @__PURE__ */ Symbol("MEDIA_LIMITS");
 
 // src/media/media.service.ts
 import { randomUUID } from "crypto";
 var MediaService = class {
-  constructor(ttlMs) {
+  constructor(ttlMs, limits) {
     this.ttlMs = ttlMs;
+    this.limits = limits;
     this.logger = new Logger(MediaService.name);
     this.store = /* @__PURE__ */ new Map();
   }
+  /**
+   * Stores a file, or throws if the store is already full.
+   *
+   * The ceiling matters more than it looks. This map is the process's own
+   * heap, entries live for an hour, and nothing here bounded how many there
+   * could be: a loop against the upload endpoint — a bug in a publishing job
+   * as easily as someone with the secret — grows it until the process dies,
+   * and it takes the whole API down with it, not just uploads.
+   *
+   * Refusing is the right answer rather than evicting the oldest: an eviction
+   * would silently break a publication already in flight, and the caller
+   * cannot tell that its image vanished until the remote service reports a
+   * 404 it cannot explain.
+   */
   put(data, contentType) {
     this.sweep();
+    if (this.store.size >= this.limits.maxFiles) {
+      throw new PayloadTooLargeException(
+        `The media store is full (${this.limits.maxFiles} files). Try again shortly.`
+      );
+    }
+    const total = this.bytesHeld();
+    if (total + data.length > this.limits.maxTotalBytes) {
+      throw new PayloadTooLargeException("The media store is out of room. Try again shortly.");
+    }
     const id = randomUUID().replace(/-/g, "");
     this.store.set(id, { data, contentType, expiresAt: Date.now() + this.ttlMs });
     this.logger.log(`Stored ${id} (${(data.length / 1024).toFixed(0)} KB)`);
     return id;
   }
+  bytesHeld() {
+    let total = 0;
+    for (const entry of this.store.values()) total += entry.data.length;
+    return total;
+  }
   get(id) {
     const found = this.store.get(id);
     if (!found) return void 0;
@@ -61,10 +93,18 @@ var MediaService = class {
 };
 MediaService = __decorateClass([
   Injectable(),
-  __decorateParam(0, Inject(MEDIA_TTL))
+  __decorateParam(0, Inject(MEDIA_TTL)),
+  __decorateParam(1, Inject(MEDIA_LIMITS))
 ], MediaService);
 
 // src/media/media.controller.ts
+function secretMatches(received, expected) {
+  if (!received) return false;
+  const a = Buffer.from(received);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+var DEFAULT_ALLOWED = ["image/png", "image/jpeg", "image/webp", "image/gif"];
 var MediaController = class {
   // Both dependencies are injected by explicit token, like the rest of this
   // package. The bundler does not emit decorator metadata, so injecting by type
@@ -78,18 +118,25 @@ var MediaController = class {
     if (!this.options.uploadSecret) {
       throw new UnauthorizedException("Media uploads are not configured.");
     }
-    if (secret !== this.options.uploadSecret) {
+    if (!secretMatches(secret, this.options.uploadSecret)) {
       throw new UnauthorizedException("Invalid secret.");
     }
     const data = request.body;
     if (!data?.length) throw new UnauthorizedException("Empty body.");
-    const id = this.media.put(Buffer.from(data), request.headers["content-type"] ?? "image/png");
+    const allowed = this.options.allowedContentTypes ?? DEFAULT_ALLOWED;
+    const declared = request.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+    if (!declared || !allowed.includes(declared)) {
+      throw new BadRequestException(
+        `Unsupported content type. Allowed: ${allowed.join(", ")}.`
+      );
+    }
+    const id = this.media.put(Buffer.from(data), declared);
     return { url: `${this.options.publicUrl}/media/${id}` };
   }
   serve(id, reply) {
     const found = this.media.get(id);
     if (!found) throw new NotFoundException("That file is no longer available.");
-    reply.header("content-type", found.contentType).header("cache-control", "no-store").send(found.data);
+    reply.header("content-type", found.contentType).header("cache-control", "no-store").header("x-content-type-options", "nosniff").send(found.data);
   }
 };
 __decorateClass([
@@ -110,6 +157,7 @@ MediaController = __decorateClass([
 
 // src/media/media.module.ts
 var ONE_HOUR = 60 * 60 * 1e3;
+var DEFAULT_LIMITS = { maxFiles: 50, maxTotalBytes: 256 * 1024 * 1024 };
 var MediaModule = class {
   static forRoot(options) {
     return {
@@ -118,6 +166,7 @@ var MediaModule = class {
       providers: [
         { provide: MEDIA_OPTIONS, useValue: options },
         { provide: MEDIA_TTL, useValue: options.ttlMs ?? ONE_HOUR },
+        { provide: MEDIA_LIMITS, useValue: { ...DEFAULT_LIMITS, ...options.limits } },
         MediaService
       ],
       exports: [MediaService]
@@ -128,6 +177,7 @@ MediaModule = __decorateClass([
   Module({})
 ], MediaModule);
 export {
+  MEDIA_LIMITS,
   MEDIA_OPTIONS,
   MEDIA_TTL,
   MediaModule,

package/dist/media/media.options.d.ts

@@ -1,5 +1,11 @@
 export declare const MEDIA_OPTIONS: unique symbol;
 export declare const MEDIA_TTL: unique symbol;
+export declare const MEDIA_LIMITS: unique symbol;
+/** What the store refuses to exceed. See `MediaService` for why it has to. */
+export interface MediaLimits {
+    maxFiles: number;
+    maxTotalBytes: number;
+}
 export interface MediaOptions {
     /**
      * Base URL the generated links point to, **including the global prefix** if
@@ -9,6 +15,20 @@ export interface MediaOptions {
     publicUrl: string;
     /** Shared secret required to upload. Without it, uploads are refused. */
     uploadSecret?: string;
+    /**
+     * Content types accepted on upload and echoed back when serving.
+     *
+     * Defaults to PNG, JPEG, WebP and GIF — deliberately **not** SVG. An SVG is
+     * a document that can carry script, and serving one from your own domain
+     * runs that script in your application's origin: same cookies, same
+     * storage. Widen this only for formats that cannot execute.
+     */
+    allowedContentTypes?: string[];
+    /**
+     * Ceiling on what the store may hold at once. Defaults to 50 files and
+     * 256 MB. Uploads beyond it are refused rather than queued.
+     */
+    limits?: Partial<MediaLimits>;
     /** How long a file stays available. Defaults to one hour. */
     ttlMs?: number;
 }

package/dist/media/media.service.d.ts

@@ -1,3 +1,4 @@
+import { type MediaLimits } from './media.options.js';
 export interface StoredMedia {
     data: Buffer;
     contentType: string;
@@ -18,10 +19,26 @@ export interface StoredMedia {
  */
 export declare class MediaService {
     private readonly ttlMs;
+    private readonly limits;
     private readonly logger;
     private readonly store;
-    constructor(ttlMs: number);
+    constructor(ttlMs: number, limits: MediaLimits);
+    /**
+     * Stores a file, or throws if the store is already full.
+     *
+     * The ceiling matters more than it looks. This map is the process's own
+     * heap, entries live for an hour, and nothing here bounded how many there
+     * could be: a loop against the upload endpoint — a bug in a publishing job
+     * as easily as someone with the secret — grows it until the process dies,
+     * and it takes the whole API down with it, not just uploads.
+     *
+     * Refusing is the right answer rather than evicting the oldest: an eviction
+     * would silently break a publication already in flight, and the caller
+     * cannot tell that its image vanished until the remote service reports a
+     * 404 it cannot explain.
+     */
     put(data: Buffer, contentType: string): string;
+    private bytesHeld;
     get(id: string): StoredMedia | undefined;
     /** Swept on write, which is the only moment the map can have grown. */
     private sweep;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miguelmorales13/nestkit",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": false,
   "license": "MIT",
   "type": "module",