@moxt-ai/mobius 0.0.27 → 0.0.29

package/dist/authorization/local-raster.js

@@ -0,0 +1,134 @@
+import { readFile, realpath, stat } from "node:fs/promises";
+import { basename, isAbsolute, normalize, relative, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+const MAX_LOCAL_RASTER_BYTES = 3_000_000;
+const PNG_SIGNATURE = Uint8Array.of(0x89, 0x50, 0x4e, 0x47);
+const JPEG_SIGNATURE = Uint8Array.of(0xff, 0xd8, 0xff);
+const GIF87_SIGNATURE = new TextEncoder().encode("GIF87a");
+const GIF89_SIGNATURE = new TextEncoder().encode("GIF89a");
+const RIFF_SIGNATURE = new TextEncoder().encode("RIFF");
+const WEBP_SIGNATURE = new TextEncoder().encode("WEBP");
+export class LocalRasterImage {
+    bytes;
+    mimeType;
+    name;
+    constructor(name, mimeType, bytes) {
+        this.bytes = bytes;
+        this.mimeType = mimeType;
+        this.name = name;
+    }
+    base64 = () => Buffer.from(this.bytes).toString("base64");
+}
+function startsWith(bytes, signature, offset = 0) {
+    if (bytes.byteLength < offset + signature.byteLength) {
+        return false;
+    }
+    return signature.every((value, index) => bytes[offset + index] === value);
+}
+function sniffRasterMime(bytes) {
+    if (startsWith(bytes, PNG_SIGNATURE)) {
+        return "image/png";
+    }
+    if (startsWith(bytes, JPEG_SIGNATURE)) {
+        return "image/jpeg";
+    }
+    if (startsWith(bytes, GIF87_SIGNATURE) || startsWith(bytes, GIF89_SIGNATURE)) {
+        return "image/gif";
+    }
+    if (startsWith(bytes, RIFF_SIGNATURE) && startsWith(bytes, WEBP_SIGNATURE, 8)) {
+        return "image/webp";
+    }
+    return null;
+}
+function isInsideRoot(root, target) {
+    const relation = relative(root, target);
+    return relation !== ".." && !relation.startsWith(`..${sep}`) && !isAbsolute(relation);
+}
+async function resolveCanonicalPath(requested, signal) {
+    signal.throwIfAborted();
+    if (!isAbsolute(requested) || requested.includes("\0") || normalize(requested) !== requested) {
+        return null;
+    }
+    try {
+        const target = await realpath(requested);
+        signal.throwIfAborted();
+        if (!isAbsolute(target) || normalize(target) !== target) {
+            return null;
+        }
+        return target;
+    }
+    catch (cause) {
+        signal.throwIfAborted();
+        if (cause instanceof Error && cause.name === "AbortError") {
+            throw cause;
+        }
+        return null;
+    }
+}
+function parseLocalImageUri(uri) {
+    const trimmed = uri.trim();
+    if (trimmed.length === 0 || trimmed.length > 2_048 || trimmed.includes("\0")) {
+        return null;
+    }
+    if (trimmed.startsWith("data:")) {
+        return null;
+    }
+    if (trimmed.startsWith("file:")) {
+        try {
+            const url = new URL(trimmed);
+            if (url.protocol !== "file:" || url.host.length > 0) {
+                return null;
+            }
+            return fileURLToPath(url);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
+        return null;
+    }
+    return trimmed;
+}
+export async function readAuthorizedRaster(uri, roots, signal) {
+    signal.throwIfAborted();
+    const requested = parseLocalImageUri(uri);
+    if (requested === null) {
+        return null;
+    }
+    const target = await resolveCanonicalPath(requested, signal);
+    if (target === null) {
+        return null;
+    }
+    const targetMetadata = await stat(target);
+    signal.throwIfAborted();
+    if (!targetMetadata.isFile() || targetMetadata.size < 1 || targetMetadata.size > MAX_LOCAL_RASTER_BYTES) {
+        return null;
+    }
+    const authorizedRoots = [];
+    for (const root of roots) {
+        const directory = await resolveCanonicalPath(root, signal);
+        if (directory === null) {
+            continue;
+        }
+        const metadata = await stat(directory);
+        signal.throwIfAborted();
+        if (metadata.isDirectory()) {
+            authorizedRoots.push(directory);
+        }
+    }
+    if (!authorizedRoots.some((root) => isInsideRoot(root, target))) {
+        return null;
+    }
+    const bytes = new Uint8Array(await readFile(target));
+    signal.throwIfAborted();
+    if (bytes.byteLength < 1 || bytes.byteLength > MAX_LOCAL_RASTER_BYTES) {
+        return null;
+    }
+    const mimeType = sniffRasterMime(bytes);
+    if (mimeType === null) {
+        return null;
+    }
+    return new LocalRasterImage(basename(target) || "Image", mimeType, bytes);
+}
+//# sourceMappingURL=local-raster.js.map

package/dist/authorization/local-raster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-raster.js","sourceRoot":"","sources":["../../src/authorization/local-raster.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,MAAM,aAAa,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC3D,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC3D,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACxD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAIxD,MAAM,OAAO,gBAAgB;IAChB,KAAK,CAAa;IAClB,QAAQ,CAAsB;IAC9B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,QAA6B,EAAE,KAAiB;QACtE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IAEQ,MAAM,GAAG,GAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;CAC9E;AAED,SAAS,UAAU,CAAC,KAAiB,EAAE,SAAqB,EAAE,MAAM,GAAG,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACtC,IAAI,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC;IACvB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;QAC3E,OAAO,WAAW,CAAC;IACvB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,MAAmB;IACtE,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACxD,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,GAAW,EACX,KAAwB,EACxB,MAAmB;IAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,GAAG,sBAAsB,EAAE,CAAC;QACtG,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC"}