@muhgholy/next-drive 4.23.30 → 4.23.32

package/dist/{chunk-QE5EHVVA.cjs → chunk-WUG4ATLH.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkLTWWPQJA_cjs = require('./chunk-LTWWPQJA.cjs');
+var chunkHWNIRA6Y_cjs = require('./chunk-HWNIRA6Y.cjs');
 var path = require('path');
 var fs = require('fs');
 var crypto = require('crypto');
@@ -80,7 +80,7 @@ var handlePublicAction = async (req, res, action, config) => {
       res.status(400).json({ status: 400, message: "Could not open file: missing or invalid file ID" });
       return true;
     }
-    const drive = await chunkLTWWPQJA_cjs.drive_default.findById(id);
+    const drive = await chunkHWNIRA6Y_cjs.drive_default.findById(id);
     if (!drive) {
       res.status(404).json({ status: 404, message: "File not found or no longer available" });
       return true;
@@ -109,21 +109,68 @@ var handlePublicAction = async (req, res, action, config) => {
         return true;
       }
     }
-    const itemProvider = drive.provider?.type === "GOOGLE" ? chunkLTWWPQJA_cjs.GoogleDriveProvider : chunkLTWWPQJA_cjs.LocalStorageProvider;
+    if (config.security?.publicRateLimit) {
+      const { publicRateLimit } = config.security;
+      const abuse = globalThis.__nextDrive.abuse;
+      const now = Date.now();
+      if (now - abuse.lastSweep > 6e4) {
+        abuse.lastSweep = now;
+        for (const [seenKey, seenHits] of abuse.ipHits) {
+          const fresh = seenHits.filter((t) => now - t < 36e5);
+          if (fresh.length) abuse.ipHits.set(seenKey, fresh);
+          else abuse.ipHits.delete(seenKey);
+        }
+      }
+      const ip = publicRateLimit.clientId?.(req) ?? (publicRateLimit.trustedHeaders ?? ["cf-connecting-ip", "x-real-ip", "x-forwarded-for"]).map((h) => req.headers[h]).find(Boolean)?.toString().split(",")[0].trim() ?? req.socket?.remoteAddress ?? "unknown";
+      const key = `serve:${ip}`;
+      const hits = (abuse.ipHits.get(key) ?? []).filter((t) => now - t < publicRateLimit.windowMinutes * 6e4);
+      if (hits.length >= publicRateLimit.max) {
+        res.status(429).json({ status: 429, message: "Too many requests, please try again later" });
+        return true;
+      }
+      hits.push(now);
+      abuse.ipHits.set(key, hits);
+    }
+    const itemProvider = drive.provider?.type === "GOOGLE" ? chunkHWNIRA6Y_cjs.GoogleDriveProvider : chunkHWNIRA6Y_cjs.LocalStorageProvider;
     const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+    const fileHash = drive.information.type === "FILE" ? drive.information.hash : void 0;
+    const fileVersion = fileHash || drive._id.toString();
+    const ifNoneMatch = req.headers["if-none-match"];
     if (action === "thumbnail") {
-      const stream2 = await itemProvider.getThumbnail(drive, itemAccountId);
+      const etag2 = `"${fileVersion}-thumb"`;
       res.setHeader("Content-Type", "image/webp");
+      res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+      res.setHeader("ETag", etag2);
       if (config.cors?.enabled) {
         res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
       }
+      if (ifNoneMatch === etag2) {
+        res.status(304).end();
+        return true;
+      }
+      const abuse = globalThis.__nextDrive.abuse;
+      if (config.security?.transformConcurrency && abuse.transformActive >= config.security.transformConcurrency) {
+        res.status(503).json({ status: 503, message: "Server is busy processing images, please try again later" });
+        return true;
+      }
+      abuse.transformActive++;
+      let stream2;
+      try {
+        stream2 = await itemProvider.getThumbnail(drive, itemAccountId);
+      } finally {
+        abuse.transformActive--;
+      }
+      req.on("close", () => {
+        if (!res.writableEnded) stream2.destroy();
+      });
       stream2.pipe(res);
       return true;
     }
     const { stream, mime, size: fileSize } = await itemProvider.openStream(drive, itemAccountId);
     const safeFilename = sanitizeContentDispositionFilename(drive.name);
     const format = req.query.format;
-    const quality = req.query.quality;
+    const rawQuality = req.query.quality;
+    const quality = rawQuality && !isNaN(Number(rawQuality)) ? String(Math.round(Number(rawQuality) / 10) * 10) : rawQuality;
     const display = req.query.display;
     const sizePreset = req.query.size;
     const fit = req.query.fit;
@@ -136,7 +183,7 @@ var handlePublicAction = async (req, res, action, config) => {
     }
     if (shouldTransform) {
       try {
-        const settings = chunkLTWWPQJA_cjs.getImageSettings(fileSize, quality, display, sizePreset, fit, position);
+        const settings = chunkHWNIRA6Y_cjs.getImageSettings(fileSize, quality, display, sizePreset, fit, position);
         let targetFormat = format || mime.split("/")[1];
         if (targetFormat === "jpg") targetFormat = "jpeg";
         if (!["jpeg", "png", "webp", "avif"].includes(targetFormat)) {
@@ -153,21 +200,49 @@ var handlePublicAction = async (req, res, action, config) => {
           targetFormat
         ].join("_");
         const cachePath = path__default.default.join(cacheDir, `${cacheKey}.bin`);
+        const etag2 = `"${fileVersion}-${cacheKey}"`;
+        res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+        res.setHeader("ETag", etag2);
+        if (ifNoneMatch === etag2) {
+          if ("destroy" in stream) {
+            stream.destroy();
+          }
+          res.status(304).end();
+          return true;
+        }
         if (fs__default.default.existsSync(cachePath)) {
           const cacheStat = fs__default.default.statSync(cachePath);
           res.setHeader("Content-Type", `image/${targetFormat}`);
           res.setHeader("Content-Length", cacheStat.size);
-          res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
           if (config.cors?.enabled) {
             res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
           }
           if ("destroy" in stream) {
             stream.destroy();
           }
-          fs__default.default.createReadStream(cachePath).pipe(res);
+          const cachedStream = fs__default.default.createReadStream(cachePath);
+          req.on("close", () => {
+            if (!res.writableEnded) cachedStream.destroy();
+          });
+          cachedStream.pipe(res);
+          return true;
+        }
+        const abuse = globalThis.__nextDrive.abuse;
+        if (config.security?.transformConcurrency && abuse.transformActive >= config.security.transformConcurrency) {
+          if ("destroy" in stream) {
+            stream.destroy();
+          }
+          res.status(503).json({ status: 503, message: "Server is busy processing images, please try again later" });
           return true;
         }
         if (!fs__default.default.existsSync(cacheDir)) fs__default.default.mkdirSync(cacheDir, { recursive: true });
+        if (config.security?.cacheMaxAgeDays) {
+          const maxAgeMs = config.security.cacheMaxAgeDays * 24 * 60 * 60 * 1e3;
+          for (const entry of fs__default.default.readdirSync(cacheDir)) {
+            const entryPath = path__default.default.join(cacheDir, entry);
+            if (Date.now() - fs__default.default.statSync(entryPath).mtimeMs > maxAgeMs) fs__default.default.unlinkSync(entryPath);
+          }
+        }
         let pipeline = sharp__default.default();
         if (settings.width && settings.height) {
           pipeline = pipeline.resize(settings.width, settings.height, {
@@ -191,20 +266,43 @@ var handlePublicAction = async (req, res, action, config) => {
           pipeline = pipeline.avif({ quality: settings.quality, effort: settings.effort });
           res.setHeader("Content-Type", "image/avif");
         }
-        res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+        abuse.transformActive++;
         pipeline.on("error", (err) => {
+          abuse.transformActive--;
           console.error("[next-drive] Pipeline error:", err);
         });
+        pipeline.on("close", () => {
+          abuse.transformActive--;
+        });
         stream.pipe(pipeline);
+        const outStream = pipeline.clone().pipe(res);
+        req.on("close", () => {
+          if (!res.writableEnded) outStream.destroy();
+        });
         pipeline.clone().toFile(cachePath).catch((e) => console.error("[next-drive] Cache write failed:", e));
-        pipeline.clone().pipe(res);
         return true;
       } catch (e) {
         console.error("[next-drive] Image transformation failed:", e);
       }
     }
+    const etag = `"${fileVersion}"`;
     res.setHeader("Content-Type", mime);
     if (fileSize) res.setHeader("Content-Length", fileSize);
+    res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+    res.setHeader("ETag", etag);
+    if (ifNoneMatch === etag) {
+      if ("destroy" in stream) {
+        stream.destroy();
+      }
+      res.status(304).end();
+      return true;
+    }
+    if ("destroy" in stream) {
+      const destroyable = stream;
+      req.on("close", () => {
+        if (!res.writableEnded) destroyable.destroy();
+      });
+    }
     stream.pipe(res);
     return true;
   } catch (error) {
@@ -261,13 +359,13 @@ var handleAuthAction = async (req, res, action, config, owner) => {
       oAuth2Client.setCredentials(tokens);
       const oauth2 = googleapis.google.oauth2({ version: "v2", auth: oAuth2Client });
       const userInfo = await oauth2.userinfo.get();
-      const existing = await chunkLTWWPQJA_cjs.account_default.findOne({ owner, "metadata.google.email": userInfo.data.email, "metadata.provider": "GOOGLE" });
+      const existing = await chunkHWNIRA6Y_cjs.account_default.findOne({ owner, "metadata.google.email": userInfo.data.email, "metadata.provider": "GOOGLE" });
       if (existing) {
         existing.metadata.google.credentials = tokens;
         existing.markModified("metadata");
         await existing.save();
       } else {
-        const newAccount = new chunkLTWWPQJA_cjs.account_default({
+        const newAccount = new chunkHWNIRA6Y_cjs.account_default({
           owner,
           name: userInfo.data.name || "Google Drive",
           metadata: {
@@ -308,7 +406,7 @@ var handleAuthAction = async (req, res, action, config, owner) => {
       return true;
     }
     case "listAccounts": {
-      const accounts = await chunkLTWWPQJA_cjs.account_default.find({ owner });
+      const accounts = await chunkHWNIRA6Y_cjs.account_default.find({ owner });
       res.status(200).json({
         status: 200,
         data: {
@@ -324,20 +422,20 @@ var handleAuthAction = async (req, res, action, config, owner) => {
     }
     case "removeAccount": {
       const { id } = req.query;
-      const account = await chunkLTWWPQJA_cjs.account_default.findOne({ _id: id, owner });
+      const account = await chunkHWNIRA6Y_cjs.account_default.findOne({ _id: id, owner });
       if (!account) {
         res.status(404).json({ status: 404, message: "Could not disconnect: account not found" });
         return true;
       }
       if (account.metadata.provider === "GOOGLE") {
         try {
-          await chunkLTWWPQJA_cjs.GoogleDriveProvider.revokeToken(owner, account._id.toString());
+          await chunkHWNIRA6Y_cjs.GoogleDriveProvider.revokeToken(owner, account._id.toString());
         } catch (e) {
           console.error("Failed to revoke Google token:", e);
         }
       }
-      await chunkLTWWPQJA_cjs.account_default.deleteOne({ _id: id, owner });
-      await chunkLTWWPQJA_cjs.drive_default.deleteMany({ owner, storageAccountId: id });
+      await chunkHWNIRA6Y_cjs.account_default.deleteOne({ _id: id, owner });
+      await chunkHWNIRA6Y_cjs.drive_default.deleteMany({ owner, storageAccountId: id });
       res.status(200).json({ status: 200, message: "Account removed" });
       return true;
     }
@@ -442,8 +540,8 @@ var handleDriveAction = async (ctx) => {
         query.owner = owner;
       }
       if (afterId) query._id = { $lt: afterId };
-      const items = await chunkLTWWPQJA_cjs.drive_default.find(query, {}, { sort: { order: 1, _id: -1 }, limit });
-      const plainItems = chunkLTWWPQJA_cjs.withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
+      const items = await chunkHWNIRA6Y_cjs.drive_default.find(query, {}, { sort: { order: 1, _id: -1 }, limit });
+      const plainItems = chunkHWNIRA6Y_cjs.withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
       res.status(200).json({ status: 200, message: "Items retrieved", data: { items: plainItems, hasMore: items.length === limit } });
       return;
     }
@@ -468,20 +566,20 @@ var handleDriveAction = async (ctx) => {
         query.owner = owner;
       }
       if (folderId && folderId !== "root") query.parentId = folderId;
-      const items = await chunkLTWWPQJA_cjs.drive_default.find(query, {}, { limit, sort: { createdAt: -1 } });
-      const plainItems = chunkLTWWPQJA_cjs.withSignedUrls(await Promise.all(items.map((i) => i.toClient())), config);
+      const items = await chunkHWNIRA6Y_cjs.drive_default.find(query, {}, { limit, sort: { createdAt: -1 } });
+      const plainItems = chunkHWNIRA6Y_cjs.withSignedUrls(await Promise.all(items.map((i) => i.toClient())), config);
       res.status(200).json({ status: 200, message: "Results", data: { items: plainItems } });
       return;
     }
     case "upload": {
-      await chunkLTWWPQJA_cjs.handleUpload(req, res, { config, owner, authenticated, isRootMode, information, provider, accountId });
+      await chunkHWNIRA6Y_cjs.handleUpload(req, res, { config, owner, authenticated, isRootMode, information, provider, accountId });
       return;
     }
     case "createFolder": {
       const folderData = createFolderBodySchema.safeParse(req.body);
       if (!folderData.success) return void res.status(400).json({ status: 400, message: folderData.error.errors[0].message });
       const { name, parentId } = folderData.data;
-      const item = chunkLTWWPQJA_cjs.withSignedUrl(await provider.createFolder(name, parentId ?? null, owner, accountId), config);
+      const item = chunkHWNIRA6Y_cjs.withSignedUrl(await provider.createFolder(name, parentId ?? null, owner, accountId), config);
       res.status(201).json({ status: 201, message: "Folder created", data: { item } });
       return;
     }
@@ -489,9 +587,9 @@ var handleDriveAction = async (ctx) => {
       const deleteData = deleteQuerySchema.safeParse(req.query);
       if (!deleteData.success) return void res.status(400).json({ status: 400, message: "Could not move to trash: invalid ID" });
       const { id } = deleteData.data;
-      const drive = await chunkLTWWPQJA_cjs.drive_default.findById(id);
+      const drive = await chunkHWNIRA6Y_cjs.drive_default.findById(id);
       if (!drive) return void res.status(404).json({ status: 404, message: "Could not move to trash: item not found" });
-      const itemProvider = drive.provider?.type === "GOOGLE" ? chunkLTWWPQJA_cjs.GoogleDriveProvider : chunkLTWWPQJA_cjs.LocalStorageProvider;
+      const itemProvider = drive.provider?.type === "GOOGLE" ? chunkHWNIRA6Y_cjs.GoogleDriveProvider : chunkHWNIRA6Y_cjs.LocalStorageProvider;
       const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
       try {
         await itemProvider.trash([id], owner, itemAccountId);
@@ -529,7 +627,7 @@ var handleDriveAction = async (ctx) => {
     }
     case "trash": {
       try {
-        const { provider: trashProvider, accountId: trashAccountId } = await chunkLTWWPQJA_cjs.resolveProvider(req, owner);
+        const { provider: trashProvider, accountId: trashAccountId } = await chunkHWNIRA6Y_cjs.resolveProvider(req, owner);
         await trashProvider.syncTrash(owner, trashAccountId);
       } catch (e) {
         console.error("Trash sync failed", e);
@@ -540,8 +638,8 @@ var handleDriveAction = async (ctx) => {
         storageAccountId: accountId || null,
         trashedAt: { $ne: null }
       };
-      const items = await chunkLTWWPQJA_cjs.drive_default.find(query, {}, { sort: { trashedAt: -1 } });
-      const plainItems = chunkLTWWPQJA_cjs.withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
+      const items = await chunkHWNIRA6Y_cjs.drive_default.find(query, {}, { sort: { trashedAt: -1 } });
+      const plainItems = chunkHWNIRA6Y_cjs.withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
       res.status(200).json({ status: 200, message: "Trash items", data: { items: plainItems, hasMore: false } });
       return;
     }
@@ -549,16 +647,16 @@ var handleDriveAction = async (ctx) => {
       const restoreData = deleteQuerySchema.safeParse(req.query);
       if (!restoreData.success) return void res.status(400).json({ status: 400, message: "Could not restore: invalid ID" });
       const { id } = restoreData.data;
-      const drive = await chunkLTWWPQJA_cjs.drive_default.findById(id);
+      const drive = await chunkHWNIRA6Y_cjs.drive_default.findById(id);
       if (!drive) return void res.status(404).json({ status: 404, message: "Could not restore: item not found" });
       let targetParentId = drive.parentId;
       if (targetParentId) {
-        const parent = await chunkLTWWPQJA_cjs.drive_default.findById(targetParentId);
+        const parent = await chunkHWNIRA6Y_cjs.drive_default.findById(targetParentId);
         if (parent?.trashedAt) {
           targetParentId = null;
         }
       }
-      const itemProvider = drive.provider?.type === "GOOGLE" ? chunkLTWWPQJA_cjs.GoogleDriveProvider : chunkLTWWPQJA_cjs.LocalStorageProvider;
+      const itemProvider = drive.provider?.type === "GOOGLE" ? chunkHWNIRA6Y_cjs.GoogleDriveProvider : chunkHWNIRA6Y_cjs.LocalStorageProvider;
       const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
       try {
         await itemProvider.untrash([id], owner, itemAccountId);
@@ -592,7 +690,7 @@ var handleDriveAction = async (ctx) => {
           console.error(`Failed to move item ${id}`, e);
         }
       }
-      res.status(200).json({ status: 200, message: "Moved", data: { items: chunkLTWWPQJA_cjs.withSignedUrls(items, config) } });
+      res.status(200).json({ status: 200, message: "Moved", data: { items: chunkHWNIRA6Y_cjs.withSignedUrls(items, config) } });
       return;
     }
     case "reorder": {
@@ -613,7 +711,7 @@ var handleDriveAction = async (ctx) => {
       if (!isRootMode) {
         query.owner = owner;
       }
-      const existingItems = await chunkLTWWPQJA_cjs.drive_default.find(query, { _id: 1, parentId: 1 });
+      const existingItems = await chunkHWNIRA6Y_cjs.drive_default.find(query, { _id: 1, parentId: 1 });
       if (existingItems.length !== ids.length) {
         return void res.status(404).json({ status: 404, message: "Could not reorder: one or more items were not found" });
       }
@@ -633,9 +731,9 @@ var handleDriveAction = async (ctx) => {
           update: { $set: { order } }
         }
       }));
-      await chunkLTWWPQJA_cjs.drive_default.bulkWrite(operations);
-      const updatedItems = await chunkLTWWPQJA_cjs.drive_default.find(query, {}, { sort: { order: 1 } });
-      const plainItems = chunkLTWWPQJA_cjs.withSignedUrls(await Promise.all(updatedItems.map((item) => item.toClient())), config);
+      await chunkHWNIRA6Y_cjs.drive_default.bulkWrite(operations);
+      const updatedItems = await chunkHWNIRA6Y_cjs.drive_default.find(query, {}, { sort: { order: 1 } });
+      const plainItems = chunkHWNIRA6Y_cjs.withSignedUrls(await Promise.all(updatedItems.map((item) => item.toClient())), config);
       res.status(200).json({ status: 200, message: "Reordered", data: { items: plainItems } });
       return;
     }
@@ -643,7 +741,7 @@ var handleDriveAction = async (ctx) => {
       const renameData = renameBodySchema.safeParse({ id: req.query.id, ...req.body });
       if (!renameData.success) return void res.status(400).json({ status: 400, message: "Could not rename: invalid request data" });
       const { id, newName } = renameData.data;
-      const item = chunkLTWWPQJA_cjs.withSignedUrl(await provider.rename(id, newName, owner, accountId), config);
+      const item = chunkHWNIRA6Y_cjs.withSignedUrl(await provider.rename(id, newName, owner, accountId), config);
       res.status(200).json({ status: 200, message: "Renamed", data: { item } });
       return;
     }
@@ -659,7 +757,15 @@ var parseJsonBody = (req) => {
   return new Promise((resolve) => {
     try {
       const chunks = [];
-      req.on("data", (chunk) => chunks.push(chunk));
+      let totalBytes = 0;
+      req.on("data", (chunk) => {
+        totalBytes += chunk.length;
+        if (totalBytes > 1024 * 1024) {
+          req.destroy();
+          return resolve({});
+        }
+        chunks.push(chunk);
+      });
       req.on("end", () => {
         const raw = Buffer.concat(chunks).toString();
         if (!raw) return resolve({});
@@ -684,7 +790,7 @@ var driveAPIHandler = async (req, res) => {
   const action = req.query.action || (req.query.code && req.query.state ? "callback" : void 0);
   let config;
   try {
-    config = chunkLTWWPQJA_cjs.getDriveConfig();
+    config = chunkHWNIRA6Y_cjs.getDriveConfig();
   } catch (error) {
     console.error("[next-drive] Configuration error:", error);
     res.status(500).json({ status: 500, message: "Drive is not ready: failed to initialize configuration" });
@@ -705,7 +811,7 @@ var driveAPIHandler = async (req, res) => {
       const googleConfigured = !!(clientId && clientSecret && redirectUri);
       let authenticated2 = false;
       try {
-        await chunkLTWWPQJA_cjs.getDriveInformation({ method: "REQUEST", req });
+        await chunkHWNIRA6Y_cjs.getDriveInformation({ method: "REQUEST", req });
         authenticated2 = true;
       } catch {
         authenticated2 = false;
@@ -728,7 +834,7 @@ var driveAPIHandler = async (req, res) => {
     let information;
     let authenticated = true;
     try {
-      information = await chunkLTWWPQJA_cjs.getDriveInformation({ method: "REQUEST", req });
+      information = await chunkHWNIRA6Y_cjs.getDriveInformation({ method: "REQUEST", req });
     } catch (err) {
       if (action === "upload" && config.security?.unauthenticated?.enabled) {
         information = { key: null, storage: { quotaInBytes: 0 } };
@@ -740,7 +846,7 @@ var driveAPIHandler = async (req, res) => {
     const { key: owner } = information;
     const wasAuthHandled = await handleAuthAction(req, res, action, config, owner);
     if (wasAuthHandled) return;
-    const { provider, accountId } = await chunkLTWWPQJA_cjs.resolveProvider(req, owner);
+    const { provider, accountId } = await chunkHWNIRA6Y_cjs.resolveProvider(req, owner);
     await handleDriveAction({
       req,
       res,
@@ -762,5 +868,5 @@ var driveAPIHandler = async (req, res) => {
 
 exports.driveAPIHandler = driveAPIHandler;
 exports.driveFileSchemaZod = driveFileSchemaZod;
-//# sourceMappingURL=chunk-QE5EHVVA.cjs.map
-//# sourceMappingURL=chunk-QE5EHVVA.cjs.map
+//# sourceMappingURL=chunk-WUG4ATLH.cjs.map
+//# sourceMappingURL=chunk-WUG4ATLH.cjs.map