@nkzw/codiff-service 1.10.0 → 1.11.1

package/api.test.ts

@@ -1,5 +1,41 @@
 import { expect, test } from 'vite-plus/test';
-import { handleSharingApiRequest, type SharingEnv } from './api.ts';
+import { handleSharingApiRequest, readRequestText, type SharingEnv } from './api.ts';
+
+test('reads request bodies within a byte limit', async () => {
+  const request = new Request('https://codiff.dev/api/uploads', {
+    body: new Uint8Array([0x61, 0xe2, 0x82, 0xac]),
+    method: 'POST',
+  });
+
+  expect(await readRequestText(request, 4)).toBe('a€');
+});
+
+test('rejects request bodies that exceed declared or streamed byte limits', async () => {
+  const declared = new Request('https://codiff.dev/api/uploads', {
+    body: 'small',
+    headers: { 'content-length': '100' },
+    method: 'POST',
+  });
+  expect(await readRequestText(declared, 5)).toBeNull();
+
+  let cancelled = false;
+  const streamed = new Request('https://codiff.dev/api/uploads', {
+    body: new ReadableStream({
+      cancel() {
+        cancelled = true;
+        throw new Error('Cancellation failed.');
+      },
+      start(controller) {
+        controller.enqueue(new Uint8Array([1, 2, 3]));
+        controller.enqueue(new Uint8Array([4, 5, 6]));
+      },
+    }),
+    duplex: 'half',
+    method: 'POST',
+  } as RequestInit);
+  expect(await readRequestText(streamed, 5)).toBeNull();
+  expect(cancelled).toBe(true);
+});
 
 test('creates anonymous upload intents without touching persistent storage', async () => {
   let databaseAccesses = 0;

package/api.ts

@@ -1,6 +1,6 @@
 import { parsePlanShareUpload } from '@nkzw/codiff-core/share';
 import { z } from 'zod';
-import { db, eq, sql, withDatabase, type D1Binding } from './db.ts';
+import { and, db, eq, sql, withDatabase, type D1Binding } from './db.ts';
 import { plan, shareDailyUsage, uploadIntent, user, walkthrough, type UserRow } from './schema.ts';
 import {
   createUploadIntentSecret,
@@ -185,6 +185,44 @@ const unauthorized = () => json({ error: 'authentication-required' }, { status:
 const maxUploadByteSize = 25 * 1024 * 1024;
 const textEncoder = new TextEncoder();
 
+export const readRequestText = async (request: Request, maximumByteSize: number) => {
+  const contentLength = request.headers.get('content-length');
+  if (contentLength && Number(contentLength) > maximumByteSize) {
+    return null;
+  }
+
+  if (!request.body) {
+    return '';
+  }
+
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let byteSize = 0;
+  const chunks: Array<string> = [];
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        chunks.push(decoder.decode());
+        return chunks.join('');
+      }
+
+      byteSize += value.byteLength;
+      if (byteSize > maximumByteSize) {
+        try {
+          await reader.cancel();
+        } catch {
+          // Cancellation is best-effort; the size limit still determines the response.
+        }
+        return null;
+      }
+      chunks.push(decoder.decode(value, { stream: true }));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+};
+
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   value !== null && typeof value === 'object';
 
@@ -517,8 +555,8 @@ const uploadShare = async (request: Request, env: SharingEnv, options: SharingAp
     return unauthorized();
   }
 
-  const body = await request.text();
-  if (textEncoder.encode(body).byteLength > maxUploadByteSize) {
+  const body = await readRequestText(request, maxUploadByteSize);
+  if (body === null) {
     return json({ error: 'manifest-too-large' }, { status: 413 });
   }
 
@@ -547,11 +585,20 @@ const uploadShare = async (request: Request, env: SharingEnv, options: SharingAp
   }
   const now = new Date();
 
-  await env.WALKTHROUGH_BUCKET.put(objectKey, canonical, {
-    httpMetadata: { contentType: 'application/json; charset=utf-8' },
-  });
+  const [ownedIntent] = await db
+    .update(uploadIntent)
+    .set({ status: 'uploading', updatedAt: now })
+    .where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, 'claimed')))
+    .returning({ id: uploadIntent.id });
+  if (!ownedIntent) {
+    return unauthorized();
+  }
 
   try {
+    await env.WALKTHROUGH_BUCKET.put(objectKey, canonical, {
+      httpMetadata: { contentType: 'application/json; charset=utf-8' },
+    });
+
     if (upload.kind === 'walkthrough') {
       const source = upload.snapshot.repository.source;
       const repository = getRepositoryMetadata(source);
@@ -591,7 +638,7 @@ const uploadShare = async (request: Request, env: SharingEnv, options: SharingAp
             updatedAt: now,
             walkthroughSlug: slug,
           })
-          .where(eq(uploadIntent.id, intent.id)),
+          .where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, 'uploading'))),
       ]);
     } else {
       await db.batch([
@@ -619,11 +666,18 @@ const uploadShare = async (request: Request, env: SharingEnv, options: SharingAp
             updatedAt: now,
             walkthroughSlug: slug,
           })
-          .where(eq(uploadIntent.id, intent.id)),
+          .where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, 'uploading'))),
       ]);
     }
   } catch (error) {
-    await env.WALKTHROUGH_BUCKET.delete(objectKey);
+    try {
+      await env.WALKTHROUGH_BUCKET.delete(objectKey);
+    } finally {
+      await db
+        .update(uploadIntent)
+        .set({ status: 'claimed', updatedAt: new Date() })
+        .where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, 'uploading')));
+    }
     if (isQuotaError(error)) {
       return quotaResponse();
     }

package/dist/api.mjs

@@ -1,5 +1,5 @@
 import { plan, shareDailyUsage, uploadIntent, user, walkthrough } from "./schema.mjs";
-import { db, eq, sql, withDatabase } from "./db.mjs";
+import { and, db, eq, sql, withDatabase } from "./db.mjs";
 import { createUploadIntentSecret, hashUploadIntentSecret, verifyUploadIntentSecret } from "./upload-intent.mjs";
 import { parsePlanShareUpload } from "@nkzw/codiff-core/share";
 import { z } from "zod";
@@ -14,7 +14,7 @@ const reviewAuthorSchema = z.object({
 const reviewCommentSchema = z.object({
 	anchor: z.enum(["file", "line"]).optional(),
 	author: reviewAuthorSchema,
-	body: boundedString(128 * 1024),
+	body: boundedString(131072),
 	filePath: nonEmptyString(4096),
 	id: nonEmptyString(256),
 	isThreadResolved: z.boolean().optional(),
@@ -28,7 +28,7 @@ const reviewCommentSchema = z.object({
 }).passthrough().refine((comment) => comment.anchor === "file" || comment.lineNumber != null && comment.side != null && (comment.startLineNumber == null || comment.startSide != null), "Invalid walkthrough review comment.");
 const generalCommentSchema = z.object({
 	author: reviewAuthorSchema,
-	body: boundedString(128 * 1024),
+	body: boundedString(131072),
 	id: nonEmptyString(256),
 	submittedAt: boundedString(64).optional()
 }).passthrough();
@@ -60,7 +60,7 @@ const walkthroughManifestSchema = z.object({
 	reviewComments: z.array(reviewCommentSchema).max(1e4).optional(),
 	version: z.literal(1),
 	walkthrough: z.object({
-		summary: boundedString(128 * 1024).optional(),
+		summary: boundedString(131072).optional(),
 		title: nonEmptyString(300)
 	}).passthrough()
 }).passthrough();
@@ -82,8 +82,36 @@ const json = (value, init) => new Response(JSON.stringify(value), {
 const notFound = () => json({ error: "not-found" }, { status: 404 });
 const badRequest = (message) => json({ error: message }, { status: 400 });
 const unauthorized = () => json({ error: "authentication-required" }, { status: 401 });
-const maxUploadByteSize = 25 * 1024 * 1024;
+const maxUploadByteSize = 26214400;
 const textEncoder = new TextEncoder();
+const readRequestText = async (request, maximumByteSize) => {
+	const contentLength = request.headers.get("content-length");
+	if (contentLength && Number(contentLength) > maximumByteSize) return null;
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const decoder = new TextDecoder();
+	let byteSize = 0;
+	const chunks = [];
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) {
+				chunks.push(decoder.decode());
+				return chunks.join("");
+			}
+			byteSize += value.byteLength;
+			if (byteSize > maximumByteSize) {
+				try {
+					await reader.cancel();
+				} catch {}
+				return null;
+			}
+			chunks.push(decoder.decode(value, { stream: true }));
+		}
+	} finally {
+		reader.releaseLock();
+	}
+};
 const isRecord = (value) => value !== null && typeof value === "object";
 const isBetterAuthApi = (value) => isRecord(value) && isRecord(value.api) && typeof value.api.getSession === "function";
 const stringValue = (value) => typeof value === "string" && value ? value : null;
@@ -233,7 +261,7 @@ const hasAvailableQuota = async (userId, kind) => {
 const createUploadIntent = async (request, env, options) => {
 	const code = randomCode();
 	const now = /* @__PURE__ */ new Date();
-	const expiresAt = new Date(now.getTime() + 600 * 1e3);
+	const expiresAt = new Date(now.getTime() + 6e5);
 	const secret = await createUploadIntentSecret(env, code, expiresAt);
 	const tokenHash = await hashUploadIntentSecret(secret);
 	const shareUser = await getAuthenticatedShareUser(request, options.auth);
@@ -281,8 +309,8 @@ const uploadShare = async (request, env, options) => {
 	if (!code || !token) return unauthorized();
 	const [intent] = await db.select().from(uploadIntent).where(eq(uploadIntent.code, code)).limit(1);
 	if (!intent || intent.status !== "claimed" || !intent.sharedByUserId || intent.expiresAt.getTime() < Date.now() || intent.uploadTokenHash !== await sha256(token)) return unauthorized();
-	const body = await request.text();
-	if (textEncoder.encode(body).byteLength > maxUploadByteSize) return json({ error: "manifest-too-large" }, { status: 413 });
+	const body = await readRequestText(request, maxUploadByteSize);
+	if (body === null) return json({ error: "manifest-too-large" }, { status: 413 });
 	let upload;
 	try {
 		upload = parseShareUpload(body);
@@ -297,8 +325,13 @@ const uploadShare = async (request, env, options) => {
 	const shareUser = await getShareUserById(intent.sharedByUserId);
 	if (!shareUser) return unauthorized();
 	const now = /* @__PURE__ */ new Date();
-	await env.WALKTHROUGH_BUCKET.put(objectKey, canonical, { httpMetadata: { contentType: "application/json; charset=utf-8" } });
+	const [ownedIntent] = await db.update(uploadIntent).set({
+		status: "uploading",
+		updatedAt: now
+	}).where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, "claimed"))).returning({ id: uploadIntent.id });
+	if (!ownedIntent) return unauthorized();
 	try {
+		await env.WALKTHROUGH_BUCKET.put(objectKey, canonical, { httpMetadata: { contentType: "application/json; charset=utf-8" } });
 		if (upload.kind === "walkthrough") {
 			const source = upload.snapshot.repository.source;
 			const repository = getRepositoryMetadata(source);
@@ -332,7 +365,7 @@ const uploadShare = async (request, env, options) => {
 				status: "uploaded",
 				updatedAt: now,
 				walkthroughSlug: slug
-			}).where(eq(uploadIntent.id, intent.id))]);
+			}).where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, "uploading")))]);
 		} else await db.batch([db.insert(plan).values({
 			agent: cleanIdentityValue(upload.snapshot.source?.agent, 40),
 			byteSize: textEncoder.encode(canonical).byteLength,
@@ -353,9 +386,16 @@ const uploadShare = async (request, env, options) => {
 			status: "uploaded",
 			updatedAt: now,
 			walkthroughSlug: slug
-		}).where(eq(uploadIntent.id, intent.id))]);
+		}).where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, "uploading")))]);
 	} catch (error) {
-		await env.WALKTHROUGH_BUCKET.delete(objectKey);
+		try {
+			await env.WALKTHROUGH_BUCKET.delete(objectKey);
+		} finally {
+			await db.update(uploadIntent).set({
+				status: "claimed",
+				updatedAt: /* @__PURE__ */ new Date()
+			}).where(and(eq(uploadIntent.id, intent.id), eq(uploadIntent.status, "uploading")));
+		}
 		if (isQuotaError(error)) return quotaResponse();
 		throw error;
 	}
@@ -400,4 +440,4 @@ const handleSharingApi = async (request, env, options) => {
 };
 const handleSharingApiRequest = (request, env, options = {}) => withDatabase(env.DB, () => handleSharingApi(request, env, options));
 //#endregion
-export { getAuthenticatedShareUser, getRepositoryMetadata, handleSharingApiRequest, parseGitPullRequestUrl, parseShareUpload, shareUserFromAuthValue };
+export { getAuthenticatedShareUser, getRepositoryMetadata, handleSharingApiRequest, parseGitPullRequestUrl, parseShareUpload, readRequestText, shareUserFromAuthValue };

package/dist/fate.mjs

@@ -171,7 +171,7 @@ const indexWalkthroughFiles = async (database, walkthroughId, filePaths) => {
 	await database.update(walkthrough).set({ filesIndexedAt: /* @__PURE__ */ new Date() }).where(eq(walkthrough.id, walkthroughId));
 };
 const fetchShareStats = async (database, now = /* @__PURE__ */ new Date()) => {
-	const dayMilliseconds = 1440 * 60 * 1e3;
+	const dayMilliseconds = 864e5;
 	const today = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
 	const start = /* @__PURE__ */ new Date(today.getTime() - 6 * dayMilliseconds);
 	const dayForPlan = sql$1`date(${plan.createdAt}, 'unixepoch')`;
@@ -209,12 +209,12 @@ const fetchShareStats = async (database, now = /* @__PURE__ */ new Date()) => {
 		totalWalkthroughs: walkthroughTotals[0]?.count ?? 0
 	};
 };
-const shareCommentBodySchema = z.string().trim().min(1).max(128 * 1024);
+const shareCommentBodySchema = z.string().trim().min(1).max(131072);
 const shareCommentAnchorBlockSchema = z.object({
 	fingerprint: z.string().min(1).max(256),
 	path: z.array(z.number().int().min(0).max(1e6)).max(64),
 	runtimeKey: z.string().max(256).optional(),
-	text: z.string().max(64 * 1024),
+	text: z.string().max(65536),
 	type: z.string().min(1).max(64)
 });
 const shareCommentAnchorSchema = z.object({
@@ -222,7 +222,7 @@ const shareCommentAnchorSchema = z.object({
 	kind: z.enum(["block", "text"]),
 	quote: z.object({
 		end: z.number().int().min(0).max(1e6),
-		exact: z.string().max(64 * 1024),
+		exact: z.string().max(65536),
 		prefix: z.string().max(1024),
 		start: z.number().int().min(0).max(1e6),
 		suffix: z.string().max(1024)

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { plan, planRelations, shareCommentMessage, shareCommentMessageRelations, shareCommentThread, shareCommentThreadKind, shareCommentThreadRelations, shareCommentThreadStatus, shareDailyUsage, shareDailyUsageRelations, shareKind, uploadIntent, user, userRelations, walkthrough, walkthroughFile, walkthroughFileRelations, walkthroughRelations } from "./schema.mjs";
 import { and, createDb, db, eq, gte, runDatabaseBatches, sql, withDatabase } from "./db.mjs";
-import { getAuthenticatedShareUser, getRepositoryMetadata, handleSharingApiRequest, parseGitPullRequestUrl, parseShareUpload, shareUserFromAuthValue } from "./api.mjs";
+import { getAuthenticatedShareUser, getRepositoryMetadata, handleSharingApiRequest, parseGitPullRequestUrl, parseShareUpload, readRequestText, shareUserFromAuthValue } from "./api.mjs";
 import { SharingRoot, getSessionUserId, planDataView, shareCommentMessageDataView, shareCommentThreadDataView, shareStatsDataView, shareStatsDayDataView, uploadIntentDataView, uploadIntentSecretHeader, walkthroughDataView } from "./views.mjs";
 import { createSharingFateServer, shareCommentAnchorSchema, shareCommentTargetSchema } from "./fate.mjs";
-export { SharingRoot, and, createDb, createSharingFateServer, db, eq, getAuthenticatedShareUser, getRepositoryMetadata, getSessionUserId, gte, handleSharingApiRequest, parseGitPullRequestUrl, parseShareUpload, plan, planDataView, planRelations, runDatabaseBatches, shareCommentAnchorSchema, shareCommentMessage, shareCommentMessageDataView, shareCommentMessageRelations, shareCommentTargetSchema, shareCommentThread, shareCommentThreadDataView, shareCommentThreadKind, shareCommentThreadRelations, shareCommentThreadStatus, shareDailyUsage, shareDailyUsageRelations, shareKind, shareStatsDataView, shareStatsDayDataView, shareUserFromAuthValue, sql, uploadIntent, uploadIntentDataView, uploadIntentSecretHeader, user, userRelations, walkthrough, walkthroughDataView, walkthroughFile, walkthroughFileRelations, walkthroughRelations, withDatabase };
+export { SharingRoot, and, createDb, createSharingFateServer, db, eq, getAuthenticatedShareUser, getRepositoryMetadata, getSessionUserId, gte, handleSharingApiRequest, parseGitPullRequestUrl, parseShareUpload, plan, planDataView, planRelations, readRequestText, runDatabaseBatches, shareCommentAnchorSchema, shareCommentMessage, shareCommentMessageDataView, shareCommentMessageRelations, shareCommentTargetSchema, shareCommentThread, shareCommentThreadDataView, shareCommentThreadKind, shareCommentThreadRelations, shareCommentThreadStatus, shareDailyUsage, shareDailyUsageRelations, shareKind, shareStatsDataView, shareStatsDayDataView, shareUserFromAuthValue, sql, uploadIntent, uploadIntentDataView, uploadIntentSecretHeader, user, userRelations, walkthrough, walkthroughDataView, walkthroughFile, walkthroughFileRelations, walkthroughRelations, withDatabase };

package/dist/schema.mjs

@@ -105,6 +105,7 @@ const uploadIntent = sqliteTable("UploadIntent", {
 	status: text({ enum: [
 		"pending",
 		"claimed",
+		"uploading",
 		"uploaded"
 	] }).notNull().default("pending"),
 	updatedAt: timestampColumn(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nkzw/codiff-service",
-  "version": "1.10.0",
+  "version": "1.11.1",
   "description": "Provider-neutral Codiff sharing service.",
   "license": "MIT",
   "author": {
@@ -63,10 +63,10 @@
     }
   },
   "dependencies": {
-    "@nkzw/fate": "^1.3.2",
+    "@nkzw/fate": "^1.3.3",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@nkzw/codiff-core": "1.10.0"
+    "@nkzw/codiff-core": "1.11.1"
   },
   "peerDependencies": {
     "react": "^19.2.0",

package/schema.ts

@@ -141,7 +141,7 @@ export const uploadIntent = sqliteTable(
     secretHash: text().notNull(),
     sharedByUserId: text().references(() => user.id, { onDelete: 'set null' }),
     shareKind: text({ enum: shareKind }).notNull().default('walkthrough'),
-    status: text({ enum: ['pending', 'claimed', 'uploaded'] })
+    status: text({ enum: ['pending', 'claimed', 'uploading', 'uploaded'] })
       .notNull()
       .default('pending'),
     updatedAt: timestampColumn(),