@open-mercato/core 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/dist/modules/attachments/lib/attachment-service.js

@@ -0,0 +1,313 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { Attachment, AttachmentPartition } from "../data/entities.js";
+import { assertAttachmentScopeInvariant, checkAttachmentAccess } from "./access.js";
+import { buildAttachmentFileUrl } from "./imageUrls.js";
+import {
+  isScopedAttachmentUploadError
+} from "./scoped-upload-service.js";
+import { readAttachmentMetadata } from "./metadata.js";
+import {
+  buildAttachmentContentDisposition,
+  canRenderInlineAttachment,
+  hasDangerousExecutableExtension
+} from "./security.js";
+import {
+  isMultipartRequestWithinUploadLimit,
+  resolveAttachmentMaxBytes,
+  resolveAttachmentMultipartMaxBytes
+} from "./upload-limits.js";
+const logger = createLogger("attachments").child({ component: "attachment-service" });
+const SCOPED_UPLOAD_ERROR_MESSAGES = {
+  dangerous_executable: {
+    key: "attachments.errors.dangerousExecutable",
+    fallback: "Executable file types are not allowed as attachments."
+  },
+  max_upload_size: {
+    key: "attachments.errors.maxUploadSize",
+    fallback: "Attachment exceeds the maximum upload size."
+  },
+  active_content: {
+    key: "attachments.errors.activeContentBlocked",
+    fallback: "Active content uploads are not allowed."
+  },
+  partition_unavailable: {
+    key: "attachments.errors.partitionUnavailable",
+    fallback: "Attachment partition is not available for this scope."
+  },
+  quota_exceeded: {
+    key: "attachments.errors.quotaExceeded",
+    fallback: "Attachment storage quota exceeded for this tenant."
+  },
+  quota_target_exists: {
+    key: "attachments.errors.storagePathExists",
+    fallback: "The target storage path already exists."
+  },
+  quota_unavailable: {
+    key: "attachments.errors.quotaUnavailable",
+    fallback: "Storage quota accounting is unavailable."
+  },
+  quota_recovery_unsupported: {
+    key: "attachments.errors.quotaRecoveryUnsupported",
+    fallback: "Storage driver cannot participate in quota recovery."
+  },
+  storage_failed: {
+    key: "attachments.errors.storageFailed",
+    fallback: "Failed to store the attachment file."
+  },
+  persistence_failed: {
+    key: "attachments.errors.persistenceFailed",
+    fallback: "Failed to persist attachment."
+  }
+};
+const UPLOAD_FAILED_MESSAGE = {
+  key: "attachments.errors.uploadFailed",
+  fallback: "Attachment upload failed."
+};
+const UPLOAD_SERVICE_UNAVAILABLE_MESSAGE = {
+  key: "attachments.errors.uploadServiceUnavailable",
+  fallback: "The attachment upload service is not available."
+};
+async function translateAttachmentError(message) {
+  const { t } = await resolveTranslations();
+  return t(message.key, message.fallback);
+}
+async function readRequestBodyWithinLimit(request, maxBytes) {
+  const reader = request.body?.getReader();
+  if (!reader) throw new CrudHttpError(400, { error: "File is required" });
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > maxBytes) {
+        await reader.cancel();
+        throw new CrudHttpError(413, { error: "Attachment exceeds the maximum upload size." });
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body;
+}
+function assignmentMatches(candidate, expected) {
+  return candidate.type === expected.type && candidate.id === expected.id;
+}
+function partitionMatchesScope(partition, tenantId, organizationId) {
+  const partitionTenantId = partition.tenantId ?? null;
+  const partitionOrganizationId = partition.organizationId ?? null;
+  if (partitionTenantId === null && partitionOrganizationId === null) return true;
+  if (partitionTenantId === null || partitionOrganizationId === null) return false;
+  return partitionTenantId === tenantId && partitionOrganizationId === organizationId;
+}
+class DefaultAttachmentService {
+  /**
+   * The scoped upload service is supplied as a *resolver*, not an instance:
+   * resolving it eagerly would drag its own dependencies (notably `dataEngine`)
+   * into every container that merely constructs an `attachmentService`, even
+   * one that never uploads. `createScoped` requires it — module uploads must
+   * share the one reservation ledger rather than run a parallel quota
+   * mechanism — so its absence surfaces there, at the call that needs it.
+   */
+  constructor(em, storageDriverFactory, resolveScopedUploadService) {
+    this.em = em;
+    this.storageDriverFactory = storageDriverFactory;
+    this.resolveScopedUploadService = resolveScopedUploadService;
+  }
+  validateUpload(input) {
+    if (!isMultipartRequestWithinUploadLimit(input.contentLength ?? null)) {
+      throw new CrudHttpError(413, { error: "Attachment exceeds the maximum upload size." });
+    }
+    if (input.fileName && hasDangerousExecutableExtension(input.fileName)) {
+      throw new CrudHttpError(400, { error: "Executable file types are not allowed as attachments." });
+    }
+    if (typeof input.fileSize === "number" && input.fileSize > resolveAttachmentMaxBytes(null)) {
+      throw new CrudHttpError(413, { error: "Attachment exceeds the maximum upload size." });
+    }
+  }
+  async readUploadForm(request) {
+    this.validateUpload({ contentLength: request.headers.get("content-length") });
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("multipart/form-data")) {
+      throw new CrudHttpError(400, { error: "Expected multipart/form-data" });
+    }
+    const body = await readRequestBodyWithinLimit(request, resolveAttachmentMultipartMaxBytes());
+    const responseBody = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
+    try {
+      return await new Response(responseBody, { headers: { "content-type": contentType } }).formData();
+    } catch {
+      throw new CrudHttpError(400, { error: "Invalid multipart/form-data" });
+    }
+  }
+  async createScoped(input) {
+    assertAttachmentScopeInvariant(input);
+    this.validateUpload({ fileName: input.fileName, fileSize: input.buffer.length });
+    let uploadService = null;
+    try {
+      uploadService = this.resolveScopedUploadService?.() ?? null;
+    } catch (error) {
+      logger.error("Scoped attachment upload service could not be resolved", { err: error });
+    }
+    if (!uploadService) {
+      throw new CrudHttpError(500, {
+        error: await translateAttachmentError(UPLOAD_SERVICE_UNAVAILABLE_MESSAGE)
+      });
+    }
+    let attachment;
+    try {
+      attachment = await uploadService.upload({
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+        entityId: input.entityId,
+        recordId: input.recordId,
+        fileName: input.fileName,
+        buffer: input.buffer,
+        declaredMimeType: input.declaredMimeType ?? null,
+        assignments: input.assignments,
+        partitionCode: input.partitionCode,
+        requirePrivatePartition: true,
+        persistLink: input.persistLink
+      });
+    } catch (error) {
+      if (isScopedAttachmentUploadError(error)) {
+        const message = SCOPED_UPLOAD_ERROR_MESSAGES[error.code] ?? UPLOAD_FAILED_MESSAGE;
+        throw new CrudHttpError(error.status, { error: await translateAttachmentError(message) });
+      }
+      throw error;
+    }
+    return {
+      id: attachment.id,
+      url: attachment.url ?? buildAttachmentFileUrl(attachment.id),
+      fileName: attachment.fileName,
+      mimeType: attachment.mimeType,
+      fileSize: attachment.fileSize
+    };
+  }
+  async readScoped(input) {
+    const attachment = await findOneWithDecryption(
+      this.em,
+      Attachment,
+      {
+        id: input.attachmentId,
+        tenantId: input.auth.tenantId ?? null,
+        organizationId: input.auth.orgId ?? null
+      },
+      void 0,
+      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId }
+    );
+    if (!attachment) throw new CrudHttpError(404, { error: "Attachment not found" });
+    const partition = await findOneWithDecryption(
+      this.em,
+      AttachmentPartition,
+      { code: attachment.partitionCode },
+      void 0,
+      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId }
+    );
+    if (!partition) throw new CrudHttpError(500, { error: "Attachment partition is not configured" });
+    const access = checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true });
+    if (!access.ok) {
+      throw new CrudHttpError(access.status, { error: access.status === 401 ? "Unauthorized" : "Forbidden" });
+    }
+    if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {
+      throw new CrudHttpError(403, { error: "Attachment partition is not accessible for this scope" });
+    }
+    if (input.requirePrivatePartition && partition.isPublic) {
+      throw new CrudHttpError(403, { error: "Attachment partition is not accessible for this resource" });
+    }
+    if (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode) {
+      throw new CrudHttpError(404, { error: "Attachment not found" });
+    }
+    if (attachment.entityId !== input.expectedOwner.entityId || attachment.recordId !== input.expectedOwner.recordId) {
+      throw new CrudHttpError(404, { error: "Attachment not found" });
+    }
+    if (input.expectedAssignment) {
+      const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? [];
+      if (!assignments.some((candidate) => assignmentMatches(candidate, input.expectedAssignment))) {
+        throw new CrudHttpError(404, { error: "Attachment not found" });
+      }
+    }
+    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, {
+      tenantId: attachment.tenantId ?? "",
+      organizationId: attachment.organizationId ?? ""
+    });
+    let result;
+    try {
+      result = await driver.read(attachment.partitionCode, attachment.storagePath);
+    } catch {
+      throw new CrudHttpError(404, { error: "File not available" });
+    }
+    const mimeType = attachment.mimeType || "application/octet-stream";
+    const renderInline = !input.forceDownload && canRenderInlineAttachment(mimeType);
+    return {
+      buffer: result.buffer,
+      contentType: renderInline ? result.contentType ?? mimeType : "application/octet-stream",
+      contentDisposition: buildAttachmentContentDisposition(
+        attachment.fileName,
+        renderInline ? "inline" : "attachment"
+      ),
+      fileName: attachment.fileName,
+      mimeType
+    };
+  }
+  async releaseScoped(input, options = {}) {
+    const em = options.em ?? this.em;
+    const expectedAssignment = input.expectedAssignment;
+    if (!expectedAssignment) {
+      throw new CrudHttpError(500, {
+        error: "Attachment release requires the expected assignment of the releasing record"
+      });
+    }
+    const isInTransaction = em.isInTransaction;
+    if (options.flush !== false && typeof isInTransaction === "function" && isInTransaction.call(em)) {
+      throw new CrudHttpError(500, {
+        error: "Attachment release inside an ambient transaction requires flush: false and deferred provider cleanup"
+      });
+    }
+    const scope = { tenantId: input.tenantId, organizationId: input.organizationId };
+    const attachment = await findOneWithDecryption(
+      em,
+      Attachment,
+      {
+        id: input.attachmentId,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId
+      },
+      void 0,
+      scope
+    );
+    if (!attachment) throw new CrudHttpError(404, { error: "Attachment not found" });
+    if (attachment.entityId !== input.expectedOwner.entityId || attachment.recordId !== input.expectedOwner.recordId || input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode) {
+      throw new CrudHttpError(404, { error: "Attachment not found" });
+    }
+    const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? [];
+    if (!assignments.some((candidate) => assignmentMatches(candidate, expectedAssignment))) {
+      throw new CrudHttpError(409, { error: "Attachment is still referenced by another record" });
+    }
+    if (assignments.some((candidate) => !assignmentMatches(candidate, expectedAssignment))) {
+      throw new CrudHttpError(409, { error: "Attachment is still referenced by another record" });
+    }
+    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, scope);
+    const deleteProviderBytes = () => driver.delete(attachment.partitionCode, attachment.storagePath);
+    em.remove(attachment);
+    if (options.flush === false) {
+      return deleteProviderBytes;
+    }
+    await em.flush();
+    await deleteProviderBytes();
+  }
+}
+export {
+  DefaultAttachmentService
+};
+//# sourceMappingURL=attachment-service.js.map

package/dist/modules/attachments/lib/attachment-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/attachment-service.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { assertAttachmentScopeInvariant, checkAttachmentAccess } from './access'\nimport type { StorageDriverFactory } from './drivers'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport {\n  isScopedAttachmentUploadError,\n  type ScopedAttachmentUploadErrorCode,\n  type ScopedAttachmentUploadService,\n} from './scoped-upload-service'\nimport { readAttachmentMetadata, type AttachmentAssignment } from './metadata'\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n  hasDangerousExecutableExtension,\n} from './security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  resolveAttachmentMultipartMaxBytes,\n} from './upload-limits'\n\nconst logger = createLogger('attachments').child({ component: 'attachment-service' })\n\ntype AttachmentErrorMessage = {\n  key: string\n  fallback: string\n}\n\n/**\n * The scoped upload service reports failures as machine codes. Each maps to the\n * translation key the public attachment route uses for the same condition, and\n * the key is resolved server-side before it reaches the response body \u2014 clients\n * render the `error` field verbatim, so handing them a raw key would surface\n * `attachments.errors.quotaExceeded` as the user-facing message.\n */\nconst SCOPED_UPLOAD_ERROR_MESSAGES: Record<ScopedAttachmentUploadErrorCode, AttachmentErrorMessage> = {\n  dangerous_executable: {\n    key: 'attachments.errors.dangerousExecutable',\n    fallback: 'Executable file types are not allowed as attachments.',\n  },\n  max_upload_size: {\n    key: 'attachments.errors.maxUploadSize',\n    fallback: 'Attachment exceeds the maximum upload size.',\n  },\n  active_content: {\n    key: 'attachments.errors.activeContentBlocked',\n    fallback: 'Active content uploads are not allowed.',\n  },\n  partition_unavailable: {\n    key: 'attachments.errors.partitionUnavailable',\n    fallback: 'Attachment partition is not available for this scope.',\n  },\n  quota_exceeded: {\n    key: 'attachments.errors.quotaExceeded',\n    fallback: 'Attachment storage quota exceeded for this tenant.',\n  },\n  quota_target_exists: {\n    key: 'attachments.errors.storagePathExists',\n    fallback: 'The target storage path already exists.',\n  },\n  quota_unavailable: {\n    key: 'attachments.errors.quotaUnavailable',\n    fallback: 'Storage quota accounting is unavailable.',\n  },\n  quota_recovery_unsupported: {\n    key: 'attachments.errors.quotaRecoveryUnsupported',\n    fallback: 'Storage driver cannot participate in quota recovery.',\n  },\n  storage_failed: {\n    key: 'attachments.errors.storageFailed',\n    fallback: 'Failed to store the attachment file.',\n  },\n  persistence_failed: {\n    key: 'attachments.errors.persistenceFailed',\n    fallback: 'Failed to persist attachment.',\n  },\n}\n\nconst UPLOAD_FAILED_MESSAGE: AttachmentErrorMessage = {\n  key: 'attachments.errors.uploadFailed',\n  fallback: 'Attachment upload failed.',\n}\n\nconst UPLOAD_SERVICE_UNAVAILABLE_MESSAGE: AttachmentErrorMessage = {\n  key: 'attachments.errors.uploadServiceUnavailable',\n  fallback: 'The attachment upload service is not available.',\n}\n\nasync function translateAttachmentError(message: AttachmentErrorMessage): Promise<string> {\n  const { t } = await resolveTranslations()\n  return t(message.key, message.fallback)\n}\n\nexport type AttachmentOwner = {\n  entityId: string\n  recordId: string\n}\n\nexport type CreateScopedAttachmentInput = AttachmentOwner & {\n  tenantId: string\n  organizationId: string\n  partitionCode: string\n  fileName: string\n  declaredMimeType?: string | null\n  buffer: Buffer\n  assignments?: AttachmentAssignment[]\n  /**\n   * Persists a module-owned link inside the same transaction as the Attachment\n   * row. The callback receives only the generated id, never an Attachment\n   * entity or storage implementation.\n   */\n  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void\n}\n\nexport type CreatedScopedAttachment = {\n  id: string\n  url: string\n  fileName: string\n  mimeType: string\n  fileSize: number\n}\n\nexport type ReadScopedAttachmentInput = {\n  attachmentId: string\n  auth: NonNullable<AuthContext>\n  expectedOwner: AttachmentOwner\n  expectedAssignment?: AttachmentAssignment\n  expectedPartitionCode?: string\n  requirePrivatePartition?: boolean\n  forceDownload?: boolean\n}\n\nexport type ReadScopedAttachmentResult = {\n  buffer: Buffer\n  contentType: string\n  contentDisposition: string\n  fileName: string\n  mimeType: string\n}\n\nexport type ReleaseScopedAttachmentInput = {\n  attachmentId: string\n  tenantId: string\n  organizationId: string\n  expectedOwner: AttachmentOwner\n  /**\n   * Required: releasing an attachment deletes the row *and* the provider bytes,\n   * so the caller must name the one assignment it owns. The release only\n   * proceeds when that assignment is the attachment's sole reference.\n   */\n  expectedAssignment: AttachmentAssignment\n  expectedPartitionCode?: string\n}\n\nexport type AttachmentProviderCleanup = () => Promise<void>\n\nexport interface AttachmentService {\n  validateUpload(input: {\n    contentLength?: string | null\n    fileName?: string\n    fileSize?: number\n  }): void\n  readUploadForm?(request: Request): Promise<FormData>\n  createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment>\n  readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult>\n  releaseScoped?(\n    input: ReleaseScopedAttachmentInput,\n    options?: { em?: EntityManager; flush?: boolean },\n  ): Promise<AttachmentProviderCleanup | void>\n}\n\nasync function readRequestBodyWithinLimit(request: Request, maxBytes: number): Promise<Uint8Array> {\n  const reader = request.body?.getReader()\n  if (!reader) throw new CrudHttpError(400, { error: 'File is required' })\n  const chunks: Uint8Array[] = []\n  let totalBytes = 0\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (done) break\n      totalBytes += value.byteLength\n      if (totalBytes > maxBytes) {\n        await reader.cancel()\n        throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n      }\n      chunks.push(value)\n    }\n  } finally {\n    reader.releaseLock()\n  }\n  const body = new Uint8Array(totalBytes)\n  let offset = 0\n  for (const chunk of chunks) {\n    body.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return body\n}\n\n\nfunction assignmentMatches(candidate: AttachmentAssignment, expected: AttachmentAssignment): boolean {\n  return candidate.type === expected.type && candidate.id === expected.id\n}\n\nfunction partitionMatchesScope(\n  partition: AttachmentPartition,\n  tenantId: string | null | undefined,\n  organizationId: string | null | undefined,\n): boolean {\n  const partitionTenantId = partition.tenantId ?? null\n  const partitionOrganizationId = partition.organizationId ?? null\n  if (partitionTenantId === null && partitionOrganizationId === null) return true\n  if (partitionTenantId === null || partitionOrganizationId === null) return false\n  return partitionTenantId === tenantId && partitionOrganizationId === organizationId\n}\n\nexport class DefaultAttachmentService implements AttachmentService {\n  /**\n   * The scoped upload service is supplied as a *resolver*, not an instance:\n   * resolving it eagerly would drag its own dependencies (notably `dataEngine`)\n   * into every container that merely constructs an `attachmentService`, even\n   * one that never uploads. `createScoped` requires it \u2014 module uploads must\n   * share the one reservation ledger rather than run a parallel quota\n   * mechanism \u2014 so its absence surfaces there, at the call that needs it.\n   */\n  constructor(\n    private readonly em: EntityManager,\n    private readonly storageDriverFactory: StorageDriverFactory,\n    private readonly resolveScopedUploadService?: (() => ScopedAttachmentUploadService | null) | null,\n  ) {}\n\n  validateUpload(input: {\n    contentLength?: string | null\n    fileName?: string\n    fileSize?: number\n  }): void {\n    if (!isMultipartRequestWithinUploadLimit(input.contentLength ?? null)) {\n      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n    }\n    if (input.fileName && hasDangerousExecutableExtension(input.fileName)) {\n      throw new CrudHttpError(400, { error: 'Executable file types are not allowed as attachments.' })\n    }\n    if (typeof input.fileSize === 'number' && input.fileSize > resolveAttachmentMaxBytes(null)) {\n      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n    }\n  }\n\n  async readUploadForm(request: Request): Promise<FormData> {\n    this.validateUpload({ contentLength: request.headers.get('content-length') })\n    const contentType = request.headers.get('content-type') ?? ''\n    if (!contentType.toLowerCase().includes('multipart/form-data')) {\n      throw new CrudHttpError(400, { error: 'Expected multipart/form-data' })\n    }\n    const body = await readRequestBodyWithinLimit(request, resolveAttachmentMultipartMaxBytes())\n    const responseBody = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength) as ArrayBuffer\n    try {\n      return await new Response(responseBody, { headers: { 'content-type': contentType } }).formData()\n    } catch {\n      throw new CrudHttpError(400, { error: 'Invalid multipart/form-data' })\n    }\n  }\n\n  async createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment> {\n    assertAttachmentScopeInvariant(input)\n    this.validateUpload({ fileName: input.fileName, fileSize: input.buffer.length })\n\n    // Delegate to the platform's scoped upload service rather than repeating its\n    // work. It owns the fenced quota lease (reserve \u2192 storing \u2192 stored \u2192\n    // complete) that the recovery worker reconciles, writes to the provider\n    // outside the database transaction, and emits the attachment CRUD side\n    // effects. The previous implementation here ran a *second*, independent\n    // quota mechanism on a different advisory-lock key that counted only\n    // committed rows, so it could not see an in-flight reservation from the\n    // public attachment route and the two paths could jointly exceed a tenant's\n    // quota \u2014 and it wrote to storage inside the transaction, so a crash before\n    // commit left bytes nothing accounted for.\n    let uploadService: ScopedAttachmentUploadService | null = null\n    try {\n      uploadService = this.resolveScopedUploadService?.() ?? null\n    } catch (error) {\n      logger.error('Scoped attachment upload service could not be resolved', { err: error })\n    }\n    if (!uploadService) {\n      throw new CrudHttpError(500, {\n        error: await translateAttachmentError(UPLOAD_SERVICE_UNAVAILABLE_MESSAGE),\n      })\n    }\n\n    let attachment: Attachment\n    try {\n      attachment = await uploadService.upload({\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        entityId: input.entityId,\n        recordId: input.recordId,\n        fileName: input.fileName,\n        buffer: input.buffer,\n        declaredMimeType: input.declaredMimeType ?? null,\n        assignments: input.assignments,\n        partitionCode: input.partitionCode,\n        requirePrivatePartition: true,\n        persistLink: input.persistLink,\n      })\n    } catch (error) {\n      if (isScopedAttachmentUploadError(error)) {\n        const message = SCOPED_UPLOAD_ERROR_MESSAGES[error.code] ?? UPLOAD_FAILED_MESSAGE\n        throw new CrudHttpError(error.status, { error: await translateAttachmentError(message) })\n      }\n      throw error\n    }\n\n    return {\n      id: attachment.id,\n      url: attachment.url ?? buildAttachmentFileUrl(attachment.id),\n      fileName: attachment.fileName,\n      mimeType: attachment.mimeType,\n      fileSize: attachment.fileSize,\n    }\n  }\n\n  async readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult> {\n    // Scope the lookup at the database boundary so a foreign-tenant row is\n    // never materialized, then keep checkAttachmentAccess below as defense in\n    // depth. This service only ever stores fully scoped rows, so global rows\n    // and super-admin status deliberately do not widen the requested scope \u2014\n    // a super admin reads another tenant's attachment by switching scope, not\n    // by bypassing the filter.\n    const attachment = await findOneWithDecryption(\n      this.em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.auth.tenantId ?? null,\n        organizationId: input.auth.orgId ?? null,\n      },\n      undefined,\n      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },\n    )\n    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    const partition = await findOneWithDecryption(\n      this.em,\n      AttachmentPartition,\n      { code: attachment.partitionCode },\n      undefined,\n      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },\n    )\n    if (!partition) throw new CrudHttpError(500, { error: 'Attachment partition is not configured' })\n\n    const access = checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true })\n    if (!access.ok) {\n      throw new CrudHttpError(access.status, { error: access.status === 401 ? 'Unauthorized' : 'Forbidden' })\n    }\n    if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {\n      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this scope' })\n    }\n    if (input.requirePrivatePartition && partition.isPublic) {\n      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this resource' })\n    }\n    if (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    if (\n      attachment.entityId !== input.expectedOwner.entityId ||\n      attachment.recordId !== input.expectedOwner.recordId\n    ) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    if (input.expectedAssignment) {\n      const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []\n      if (!assignments.some((candidate) => assignmentMatches(candidate, input.expectedAssignment!))) {\n        throw new CrudHttpError(404, { error: 'Attachment not found' })\n      }\n    }\n\n    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n      tenantId: attachment.tenantId ?? '',\n      organizationId: attachment.organizationId ?? '',\n    })\n    let result: Awaited<ReturnType<typeof driver.read>>\n    try {\n      result = await driver.read(attachment.partitionCode, attachment.storagePath)\n    } catch {\n      throw new CrudHttpError(404, { error: 'File not available' })\n    }\n\n    const mimeType = attachment.mimeType || 'application/octet-stream'\n    const renderInline = !input.forceDownload && canRenderInlineAttachment(mimeType)\n    return {\n      buffer: result.buffer,\n      contentType: renderInline ? result.contentType ?? mimeType : 'application/octet-stream',\n      contentDisposition: buildAttachmentContentDisposition(\n        attachment.fileName,\n        renderInline ? 'inline' : 'attachment',\n      ),\n      fileName: attachment.fileName,\n      mimeType,\n    }\n  }\n\n  async releaseScoped(\n    input: ReleaseScopedAttachmentInput,\n    options: { em?: EntityManager; flush?: boolean } = {},\n  ): Promise<AttachmentProviderCleanup | void> {\n    const em = options.em ?? this.em\n    // The type makes `expectedAssignment` mandatory, but this service is handed\n    // out through untyped DI resolution and consumed through structural ports in\n    // other packages, so the shared-reference guard is enforced at runtime too:\n    // without it a caller could destroy an attachment other records still link.\n    const expectedAssignment = input.expectedAssignment\n    if (!expectedAssignment) {\n      throw new CrudHttpError(500, {\n        error: 'Attachment release requires the expected assignment of the releasing record',\n      })\n    }\n    const isInTransaction = (em as { isInTransaction?: () => boolean }).isInTransaction\n    if (\n      options.flush !== false\n      && typeof isInTransaction === 'function'\n      && isInTransaction.call(em)\n    ) {\n      throw new CrudHttpError(500, {\n        error: 'Attachment release inside an ambient transaction requires flush: false and deferred provider cleanup',\n      })\n    }\n    const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n    const attachment = await findOneWithDecryption(\n      em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      },\n      undefined,\n      scope,\n    )\n    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    if (\n      attachment.entityId !== input.expectedOwner.entityId\n      || attachment.recordId !== input.expectedOwner.recordId\n      || (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode)\n    ) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []\n    if (!assignments.some((candidate) => assignmentMatches(candidate, expectedAssignment))) {\n      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })\n    }\n    if (assignments.some((candidate) => !assignmentMatches(candidate, expectedAssignment))) {\n      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })\n    }\n\n    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, scope)\n    const deleteProviderBytes = () => driver.delete(attachment.partitionCode, attachment.storagePath)\n    em.remove(attachment)\n    if (options.flush === false) {\n      return deleteProviderBytes\n    }\n    await em.flush()\n    await deleteProviderBytes()\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC,6BAA6B;AAEtE,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,8BAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAcpF,MAAM,+BAAgG;AAAA,EACpG,sBAAsB;AAAA,IACpB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,iBAAiB;AAAA,IACf,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,uBAAuB;AAAA,IACrB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,qBAAqB;AAAA,IACnB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,mBAAmB;AAAA,IACjB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,4BAA4B;AAAA,IAC1B,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,oBAAoB;AAAA,IAClB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AACF;AAEA,MAAM,wBAAgD;AAAA,EACpD,KAAK;AAAA,EACL,UAAU;AACZ;AAEA,MAAM,qCAA6D;AAAA,EACjE,KAAK;AAAA,EACL,UAAU;AACZ;AAEA,eAAe,yBAAyB,SAAkD;AACxF,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,SAAO,EAAE,QAAQ,KAAK,QAAQ,QAAQ;AACxC;AAgFA,eAAe,2BAA2B,SAAkB,UAAuC;AACjG,QAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,MAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AACvE,QAAM,SAAuB,CAAC;AAC9B,MAAI,aAAa;AACjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,oBAAc,MAAM;AACpB,UAAI,aAAa,UAAU;AACzB,cAAM,OAAO,OAAO;AACpB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,MACvF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,WAAW,UAAU;AACtC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,WAAiC,UAAyC;AACnG,SAAO,UAAU,SAAS,SAAS,QAAQ,UAAU,OAAO,SAAS;AACvE;AAEA,SAAS,sBACP,WACA,UACA,gBACS;AACT,QAAM,oBAAoB,UAAU,YAAY;AAChD,QAAM,0BAA0B,UAAU,kBAAkB;AAC5D,MAAI,sBAAsB,QAAQ,4BAA4B,KAAM,QAAO;AAC3E,MAAI,sBAAsB,QAAQ,4BAA4B,KAAM,QAAO;AAC3E,SAAO,sBAAsB,YAAY,4BAA4B;AACvE;AAEO,MAAM,yBAAsD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjE,YACmB,IACA,sBACA,4BACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAEH,eAAe,OAIN;AACP,QAAI,CAAC,oCAAoC,MAAM,iBAAiB,IAAI,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,IACvF;AACA,QAAI,MAAM,YAAY,gCAAgC,MAAM,QAAQ,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wDAAwD,CAAC;AAAA,IACjG;AACA,QAAI,OAAO,MAAM,aAAa,YAAY,MAAM,WAAW,0BAA0B,IAAI,GAAG;AAC1F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,IACvF;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAqC;AACxD,SAAK,eAAe,EAAE,eAAe,QAAQ,QAAQ,IAAI,gBAAgB,EAAE,CAAC;AAC5E,UAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,QAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,+BAA+B,CAAC;AAAA,IACxE;AACA,UAAM,OAAO,MAAM,2BAA2B,SAAS,mCAAmC,CAAC;AAC3F,UAAM,eAAe,KAAK,OAAO,MAAM,KAAK,YAAY,KAAK,aAAa,KAAK,UAAU;AACzF,QAAI;AACF,aAAO,MAAM,IAAI,SAAS,cAAc,EAAE,SAAS,EAAE,gBAAgB,YAAY,EAAE,CAAC,EAAE,SAAS;AAAA,IACjG,QAAQ;AACN,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAAsE;AACvF,mCAA+B,KAAK;AACpC,SAAK,eAAe,EAAE,UAAU,MAAM,UAAU,UAAU,MAAM,OAAO,OAAO,CAAC;AAY/E,QAAI,gBAAsD;AAC1D,QAAI;AACF,sBAAgB,KAAK,6BAA6B,KAAK;AAAA,IACzD,SAAS,OAAO;AACd,aAAO,MAAM,0DAA0D,EAAE,KAAK,MAAM,CAAC;AAAA,IACvF;AACA,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,MAAM,yBAAyB,kCAAkC;AAAA,MAC1E,CAAC;AAAA,IACH;AAEA,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,cAAc,OAAO;AAAA,QACtC,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,QAAQ,MAAM;AAAA,QACd,kBAAkB,MAAM,oBAAoB;AAAA,QAC5C,aAAa,MAAM;AAAA,QACnB,eAAe,MAAM;AAAA,QACrB,yBAAyB;AAAA,QACzB,aAAa,MAAM;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,8BAA8B,KAAK,GAAG;AACxC,cAAM,UAAU,6BAA6B,MAAM,IAAI,KAAK;AAC5D,cAAM,IAAI,cAAc,MAAM,QAAQ,EAAE,OAAO,MAAM,yBAAyB,OAAO,EAAE,CAAC;AAAA,MAC1F;AACA,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,KAAK,WAAW,OAAO,uBAAuB,WAAW,EAAE;AAAA,MAC3D,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,OAAuE;AAOtF,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,KAAK,YAAY;AAAA,QACjC,gBAAgB,MAAM,KAAK,SAAS;AAAA,MACtC;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,MAAM;AAAA,IACpE;AACA,QAAI,CAAC,WAAY,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAC/E,UAAM,YAAY,MAAM;AAAA,MACtB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,cAAc;AAAA,MACjC;AAAA,MACA,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,MAAM;AAAA,IACpE;AACA,QAAI,CAAC,UAAW,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,yCAAyC,CAAC;AAEhG,UAAM,SAAS,sBAAsB,MAAM,MAAM,YAAY,WAAW,EAAE,sBAAsB,KAAK,CAAC;AACtG,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc,OAAO,QAAQ,EAAE,OAAO,OAAO,WAAW,MAAM,iBAAiB,YAAY,CAAC;AAAA,IACxG;AACA,QAAI,CAAC,sBAAsB,WAAW,MAAM,KAAK,UAAU,MAAM,KAAK,KAAK,GAAG;AAC5E,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wDAAwD,CAAC;AAAA,IACjG;AACA,QAAI,MAAM,2BAA2B,UAAU,UAAU;AACvD,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,2DAA2D,CAAC;AAAA,IACpG;AACA,QAAI,MAAM,yBAAyB,WAAW,kBAAkB,MAAM,uBAAuB;AAC3F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,QACE,WAAW,aAAa,MAAM,cAAc,YAC5C,WAAW,aAAa,MAAM,cAAc,UAC5C;AACA,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,QAAI,MAAM,oBAAoB;AAC5B,YAAM,cAAc,uBAAuB,WAAW,eAAe,EAAE,eAAe,CAAC;AACvF,UAAI,CAAC,YAAY,KAAK,CAAC,cAAc,kBAAkB,WAAW,MAAM,kBAAmB,CAAC,GAAG;AAC7F,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,MAC3F,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,IAC/C,CAAC;AACD,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAAA,IAC7E,QAAQ;AACN,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC9D;AAEA,UAAM,WAAW,WAAW,YAAY;AACxC,UAAM,eAAe,CAAC,MAAM,iBAAiB,0BAA0B,QAAQ;AAC/E,WAAO;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,aAAa,eAAe,OAAO,eAAe,WAAW;AAAA,MAC7D,oBAAoB;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,WAAW;AAAA,MAC5B;AAAA,MACA,UAAU,WAAW;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cACJ,OACA,UAAmD,CAAC,GACT;AAC3C,UAAM,KAAK,QAAQ,MAAM,KAAK;AAK9B,UAAM,qBAAqB,MAAM;AACjC,QAAI,CAAC,oBAAoB;AACvB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,kBAAmB,GAA2C;AACpE,QACE,QAAQ,UAAU,SACf,OAAO,oBAAoB,cAC3B,gBAAgB,KAAK,EAAE,GAC1B;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,WAAY,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAC/E,QACE,WAAW,aAAa,MAAM,cAAc,YACzC,WAAW,aAAa,MAAM,cAAc,YAC3C,MAAM,yBAAyB,WAAW,kBAAkB,MAAM,uBACtE;AACA,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,UAAM,cAAc,uBAAuB,WAAW,eAAe,EAAE,eAAe,CAAC;AACvF,QAAI,CAAC,YAAY,KAAK,CAAC,cAAc,kBAAkB,WAAW,kBAAkB,CAAC,GAAG;AACtF,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC5F;AACA,QAAI,YAAY,KAAK,CAAC,cAAc,CAAC,kBAAkB,WAAW,kBAAkB,CAAC,GAAG;AACtF,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC5F;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,WAAW,eAAe,KAAK;AAClG,UAAM,sBAAsB,MAAM,OAAO,OAAO,WAAW,eAAe,WAAW,WAAW;AAChG,OAAG,OAAO,UAAU;AACpB,QAAI,QAAQ,UAAU,OAAO;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,GAAG,MAAM;AACf,UAAM,oBAAoB;AAAA,EAC5B;AACF;",
+  "names": []
+}

package/dist/modules/attachments/lib/scoped-upload-service.js

@@ -1,5 +1,7 @@
+var _a, _b;
 import { randomUUID } from "node:crypto";
 import { emitCrudSideEffects } from "@open-mercato/shared/lib/commands/helpers";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { Attachment, AttachmentPartition } from "../data/entities.js";
 import { attachmentCrudEvents, attachmentCrudIndexer } from "./crud.js";
@@ -21,14 +23,19 @@ import {
 } from "./security.js";
 import { resolveAttachmentMaxBytes } from "./upload-limits.js";
 const logger = createLogger("attachments");
-class ScopedAttachmentUploadError extends Error {
+const SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER = /* @__PURE__ */ Symbol.for("@open-mercato/ScopedAttachmentUploadError");
+class ScopedAttachmentUploadError extends (_b = Error, _a = SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER, _b) {
   constructor(code, status) {
     super(code);
     this.code = code;
     this.status = status;
+    this[_a] = true;
     this.name = "ScopedAttachmentUploadError";
   }
 }
+function isScopedAttachmentUploadError(error) {
+  return Boolean(error) && typeof error === "object" && error[SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] === true;
+}
 class ScopedAttachmentUploadService {
   constructor(deps) {
     this.deps = deps;
@@ -56,6 +63,9 @@ class ScopedAttachmentUploadService {
       ]
     });
     if (!partition) throw new ScopedAttachmentUploadError("partition_unavailable", 400);
+    if (input.requirePrivatePartition && partition.isPublic) {
+      throw new ScopedAttachmentUploadError("partition_unavailable", 403);
+    }
     const driver = await storageDriverFactory.resolveForPartition(partition.code, {
       tenantId: input.tenantId,
       organizationId: input.organizationId
@@ -157,11 +167,13 @@ class ScopedAttachmentUploadService {
         });
         assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId });
         await tx.persist(attachment).flush();
+        await input.persistLink?.(tx, attachmentId);
         await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx);
       });
     } catch (error) {
       await this.compensateStorage(driver, partition.code, storedPath, reservation);
       logger.error("Scoped attachment persistence failed", { err: error });
+      if (isCrudHttpError(error)) throw error;
       throw new ScopedAttachmentUploadError("persistence_failed", 500);
     }
     if (useLlmOcr) {
@@ -197,6 +209,7 @@ class ScopedAttachmentUploadService {
 }
 export {
   ScopedAttachmentUploadError,
-  ScopedAttachmentUploadService
+  ScopedAttachmentUploadService,
+  isScopedAttachmentUploadError
 };
 //# sourceMappingURL=scoped-upload-service.js.map

package/dist/modules/attachments/lib/scoped-upload-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/scoped-upload-service.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from './crud'\nimport type { StorageDriverFactory } from './drivers'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'\nimport { extractAttachmentContent } from './textExtraction'\nimport { requestOcrProcessing } from './ocrQueue'\nimport { OcrService, shouldUseLlmOcr } from './ocrService'\nimport { assertAttachmentScopeInvariant } from './access'\nimport {\n  mergeAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from './metadata'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from './security'\nimport { resolveAttachmentMaxBytes } from './upload-limits'\nimport type { AttachmentQuotaService } from './quota-service'\n\nconst logger = createLogger('attachments')\n\nexport type ScopedAttachmentUploadErrorCode =\n  | 'dangerous_executable'\n  | 'max_upload_size'\n  | 'active_content'\n  | 'partition_unavailable'\n  | 'quota_exceeded'\n  | 'quota_target_exists'\n  | 'quota_unavailable'\n  | 'quota_recovery_unsupported'\n  | 'storage_failed'\n  | 'persistence_failed'\n\nexport class ScopedAttachmentUploadError extends Error {\n  constructor(\n    public readonly code: ScopedAttachmentUploadErrorCode,\n    public readonly status: number,\n  ) {\n    super(code)\n    this.name = 'ScopedAttachmentUploadError'\n  }\n}\n\nexport type ScopedAttachmentUploadInput = {\n  tenantId: string\n  organizationId: string\n  entityId: string\n  recordId: string\n  fileName: string\n  declaredMimeType?: string | null\n  buffer: Buffer\n  tags?: string[]\n  assignments?: AttachmentAssignment[]\n  partitionCode?: string | null\n  maxBytes?: number\n}\n\ntype QuotaRecoveryScheduler = (\n  payload: { reservationId: string; tenantId: string; organizationId: string },\n  delayMs: number,\n) => Promise<void>\n\nexport class ScopedAttachmentUploadService {\n  constructor(private readonly deps: {\n    em: EntityManager\n    dataEngine?: DataEngine | null\n    storageDriverFactory: StorageDriverFactory\n    attachmentQuotaService: AttachmentQuotaService\n    attachmentQuotaRecoveryScheduler: QuotaRecoveryScheduler\n  }) {}\n\n  async upload(input: ScopedAttachmentUploadInput): Promise<Attachment> {\n    const safeName = sanitizeUploadedFileName(input.fileName)\n    if (hasDangerousExecutableExtension(safeName)) {\n      throw new ScopedAttachmentUploadError('dangerous_executable', 400)\n    }\n    if (input.buffer.length > (input.maxBytes ?? resolveAttachmentMaxBytes())) {\n      throw new ScopedAttachmentUploadError('max_upload_size', 413)\n    }\n    const mimeType = detectAttachmentMimeType(input.buffer, safeName, input.declaredMimeType ?? '')\n    if (isActiveContentAttachment(input.buffer, safeName, mimeType)) {\n      throw new ScopedAttachmentUploadError('active_content', 400)\n    }\n\n    const { em, storageDriverFactory, attachmentQuotaService, attachmentQuotaRecoveryScheduler } = this.deps\n    await ensureDefaultPartitions(em)\n    const partitionCode = input.partitionCode ?? resolveDefaultPartitionCode(input.entityId)\n    const partition = await em.findOne(AttachmentPartition, {\n      code: partitionCode,\n      $or: [\n        { tenantId: null, organizationId: null },\n        { tenantId: input.tenantId, organizationId: input.organizationId },\n      ],\n    })\n    if (!partition) throw new ScopedAttachmentUploadError('partition_unavailable', 400)\n\n    const driver = await storageDriverFactory.resolveForPartition(partition.code, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n    })\n    const preparedStoragePath = driver.prepareStoragePath?.({\n      partitionCode: partition.code,\n      orgId: input.organizationId,\n      tenantId: input.tenantId,\n      fileName: safeName,\n    })\n    if (!preparedStoragePath) {\n      throw new ScopedAttachmentUploadError('quota_recovery_unsupported', 500)\n    }\n\n    let reservation: { id: string; leaseToken: string; expiresAt: Date } | null = null\n    try {\n      reservation = await attachmentQuotaService.reserve({\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        bytes: input.buffer.length,\n        source: 'attachment',\n        storageDriver: driver.key,\n        storagePath: preparedStoragePath,\n        partitionCode: partition.code,\n      })\n      await attachmentQuotaRecoveryScheduler({\n        reservationId: reservation.id,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))\n      await attachmentQuotaService.beginStorage(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      if (reservation) {\n        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => undefined)\n      }\n      const code = (error as { code?: unknown })?.code\n      if (code === 'quota_exceeded') throw new ScopedAttachmentUploadError('quota_exceeded', 413)\n      if (code === 'quota_target_exists') throw new ScopedAttachmentUploadError('quota_target_exists', 409)\n      throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n    }\n\n    if (!reservation) throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n\n    let storedPath = preparedStoragePath\n    try {\n      const stored = await driver.store({\n        partitionCode: partition.code,\n        orgId: input.organizationId,\n        tenantId: input.tenantId,\n        fileName: safeName,\n        buffer: input.buffer,\n        storagePath: preparedStoragePath,\n      })\n      storedPath = stored.storagePath\n      await attachmentQuotaService.markStored(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment storage failed', { err: error })\n      throw new ScopedAttachmentUploadError('storage_failed', 500)\n    }\n\n    let extractedContent: string | null = null\n    const wantsLlmOcr = partition.requiresOcr && shouldUseLlmOcr(mimeType, safeName)\n    const ocrService = wantsLlmOcr ? new OcrService() : null\n    const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n    if (partition.requiresOcr && !useLlmOcr) {\n      try {\n        const { filePath, cleanup } = await driver.toLocalPath(partition.code, storedPath)\n        try {\n          extractedContent = await extractAttachmentContent({ filePath, mimeType })\n        } finally {\n          await cleanup().catch(() => undefined)\n        }\n      } catch (error) {\n        logger.error('Scoped attachment text extraction failed', { err: error })\n      }\n    }\n\n    let assignments = input.assignments?.slice() ?? []\n    assignments = upsertAssignment(assignments, { type: input.entityId, id: input.recordId })\n    const metadata = mergeAttachmentMetadata(null, {\n      assignments,\n      tags: input.tags ?? [],\n    })\n    const attachmentId = randomUUID()\n    let attachment!: Attachment\n\n    try {\n      await em.transactional(async (tx) => {\n        attachment = tx.create(Attachment, {\n          id: attachmentId,\n          entityId: input.entityId,\n          recordId: input.recordId,\n          organizationId: input.organizationId,\n          tenantId: input.tenantId,\n          fileName: safeName,\n          mimeType,\n          fileSize: input.buffer.length,\n          partitionCode: partition.code,\n          storageDriver: partition.storageDriver || 'local',\n          storagePath: storedPath,\n          url: buildAttachmentFileUrl(attachmentId),\n          content: extractedContent,\n          storageMetadata: metadata,\n        })\n        assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId })\n        await tx.persist(attachment).flush()\n        await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx)\n      })\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment persistence failed', { err: error })\n      throw new ScopedAttachmentUploadError('persistence_failed', 500)\n    }\n\n    if (useLlmOcr) {\n      requestOcrProcessing(em, attachment, driver, storedPath).catch((error) => {\n        logger.error('Scoped attachment OCR scheduling failed', { err: error })\n      })\n    }\n    if (this.deps.dataEngine) {\n      await emitCrudSideEffects({\n        dataEngine: this.deps.dataEngine,\n        action: 'created',\n        entity: attachment,\n        identifiers: {\n          id: attachment.id,\n          organizationId: attachment.organizationId ?? null,\n          tenantId: attachment.tenantId ?? null,\n        },\n        events: attachmentCrudEvents,\n        indexer: attachmentCrudIndexer,\n      })\n      await this.deps.dataEngine.flushOrmEntityChanges()\n    }\n    return attachment\n  }\n\n  private async compensateStorage(\n    driver: Awaited<ReturnType<StorageDriverFactory['resolveForPartition']>>,\n    partitionCode: string,\n    storagePath: string,\n    reservation: { id: string; leaseToken: string },\n  ): Promise<void> {\n    try {\n      await (driver.deleteStrict?.(partitionCode, storagePath) ?? driver.delete(partitionCode, storagePath))\n      await this.deps.attachmentQuotaService.release(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      logger.error('Scoped attachment compensation failed', { err: error })\n    }\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAG3B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,YAAY,2BAA2B;AAChD,SAAS,sBAAsB,6BAA6B;AAE5D,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,mCAAmC;AACrE,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAG1C,MAAM,SAAS,aAAa,aAAa;AAclC,MAAM,oCAAoC,MAAM;AAAA,EACrD,YACkB,MACA,QAChB;AACA,UAAM,IAAI;AAHM;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAqBO,MAAM,8BAA8B;AAAA,EACzC,YAA6B,MAM1B;AAN0B;AAAA,EAMzB;AAAA,EAEJ,MAAM,OAAO,OAAyD;AACpE,UAAM,WAAW,yBAAyB,MAAM,QAAQ;AACxD,QAAI,gCAAgC,QAAQ,GAAG;AAC7C,YAAM,IAAI,4BAA4B,wBAAwB,GAAG;AAAA,IACnE;AACA,QAAI,MAAM,OAAO,UAAU,MAAM,YAAY,0BAA0B,IAAI;AACzE,YAAM,IAAI,4BAA4B,mBAAmB,GAAG;AAAA,IAC9D;AACA,UAAM,WAAW,yBAAyB,MAAM,QAAQ,UAAU,MAAM,oBAAoB,EAAE;AAC9F,QAAI,0BAA0B,MAAM,QAAQ,UAAU,QAAQ,GAAG;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,UAAM,EAAE,IAAI,sBAAsB,wBAAwB,iCAAiC,IAAI,KAAK;AACpG,UAAM,wBAAwB,EAAE;AAChC,UAAM,gBAAgB,MAAM,iBAAiB,4BAA4B,MAAM,QAAQ;AACvF,UAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,MACtD,MAAM;AAAA,MACN,KAAK;AAAA,QACH,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,QACvC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACnE;AAAA,IACF,CAAC;AACD,QAAI,CAAC,UAAW,OAAM,IAAI,4BAA4B,yBAAyB,GAAG;AAElF,UAAM,SAAS,MAAM,qBAAqB,oBAAoB,UAAU,MAAM;AAAA,MAC5E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD,UAAM,sBAAsB,OAAO,qBAAqB;AAAA,MACtD,eAAe,UAAU;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,4BAA4B,8BAA8B,GAAG;AAAA,IACzE;AAEA,QAAI,cAA0E;AAC9E,QAAI;AACF,oBAAc,MAAM,uBAAuB,QAAQ;AAAA,QACjD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,OAAO,MAAM,OAAO;AAAA,QACpB,QAAQ;AAAA,QACR,eAAe,OAAO;AAAA,QACtB,aAAa;AAAA,QACb,eAAe,UAAU;AAAA,MAC3B,CAAC;AACD,YAAM,iCAAiC;AAAA,QACrC,eAAe,YAAY;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB,GAAG,KAAK,IAAI,KAAO,YAAY,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;AAChE,YAAM,uBAAuB,aAAa,YAAY,IAAI,YAAY,UAAU;AAAA,IAClF,SAAS,OAAO;AACd,UAAI,aAAa;AACf,cAAM,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,MACpG;AACA,YAAM,OAAQ,OAA8B;AAC5C,UAAI,SAAS,iBAAkB,OAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAC1F,UAAI,SAAS,sBAAuB,OAAM,IAAI,4BAA4B,uBAAuB,GAAG;AACpG,YAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAAA,IAChE;AAEA,QAAI,CAAC,YAAa,OAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAEhF,QAAI,aAAa;AACjB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,eAAe,UAAU;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,UAAU,MAAM;AAAA,QAChB,UAAU;AAAA,QACV,QAAQ,MAAM;AAAA,QACd,aAAa;AAAA,MACf,CAAC;AACD,mBAAa,OAAO;AACpB,YAAM,uBAAuB,WAAW,YAAY,IAAI,YAAY,UAAU;AAAA,IAChF,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,QAAI,mBAAkC;AACtC,UAAM,cAAc,UAAU,eAAe,gBAAgB,UAAU,QAAQ;AAC/E,UAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,UAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAC9D,QAAI,UAAU,eAAe,CAAC,WAAW;AACvC,UAAI;AACF,cAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,OAAO,YAAY,UAAU,MAAM,UAAU;AACjF,YAAI;AACF,6BAAmB,MAAM,yBAAyB,EAAE,UAAU,SAAS,CAAC;AAAA,QAC1E,UAAE;AACA,gBAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,QACvC;AAAA,MACF,SAAS,OAAO;AACd,eAAO,MAAM,4CAA4C,EAAE,KAAK,MAAM,CAAC;AAAA,MACzE;AAAA,IACF;AAEA,QAAI,cAAc,MAAM,aAAa,MAAM,KAAK,CAAC;AACjD,kBAAc,iBAAiB,aAAa,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,SAAS,CAAC;AACxF,UAAM,WAAW,wBAAwB,MAAM;AAAA,MAC7C;AAAA,MACA,MAAM,MAAM,QAAQ,CAAC;AAAA,IACvB,CAAC;AACD,UAAM,eAAe,WAAW;AAChC,QAAI;AAEJ,QAAI;AACF,YAAM,GAAG,cAAc,OAAO,OAAO;AACnC,qBAAa,GAAG,OAAO,YAAY;AAAA,UACjC,IAAI;AAAA,UACJ,UAAU,MAAM;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,UAAU;AAAA,UACV;AAAA,UACA,UAAU,MAAM,OAAO;AAAA,UACvB,eAAe,UAAU;AAAA,UACzB,eAAe,UAAU,iBAAiB;AAAA,UAC1C,aAAa;AAAA,UACb,KAAK,uBAAuB,YAAY;AAAA,UACxC,SAAS;AAAA,UACT,iBAAiB;AAAA,QACnB,CAAC;AACD,uCAA+B,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe,CAAC;AAC3G,cAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AACnC,cAAM,uBAAuB,mBAAmB,YAAY,IAAI,YAAY,YAAY,EAAE;AAAA,MAC5F,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AACnE,YAAM,IAAI,4BAA4B,sBAAsB,GAAG;AAAA,IACjE;AAEA,QAAI,WAAW;AACb,2BAAqB,IAAI,YAAY,QAAQ,UAAU,EAAE,MAAM,CAAC,UAAU;AACxE,eAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AAAA,MACxE,CAAC;AAAA,IACH;AACA,QAAI,KAAK,KAAK,YAAY;AACxB,YAAM,oBAAoB;AAAA,QACxB,YAAY,KAAK,KAAK;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,IAAI,WAAW;AAAA,UACf,gBAAgB,WAAW,kBAAkB;AAAA,UAC7C,UAAU,WAAW,YAAY;AAAA,QACnC;AAAA,QACA,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,YAAM,KAAK,KAAK,WAAW,sBAAsB;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBACZ,QACA,eACA,aACA,aACe;AACf,QAAI;AACF,aAAO,OAAO,eAAe,eAAe,WAAW,KAAK,OAAO,OAAO,eAAe,WAAW;AACpG,YAAM,KAAK,KAAK,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU;AAAA,IACvF,SAAS,OAAO;AACd,aAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AAAA,IACtE;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from './crud'\nimport type { StorageDriverFactory } from './drivers'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'\nimport { extractAttachmentContent } from './textExtraction'\nimport { requestOcrProcessing } from './ocrQueue'\nimport { OcrService, shouldUseLlmOcr } from './ocrService'\nimport { assertAttachmentScopeInvariant } from './access'\nimport {\n  mergeAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from './metadata'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from './security'\nimport { resolveAttachmentMaxBytes } from './upload-limits'\nimport type { AttachmentQuotaService } from './quota-service'\n\nconst logger = createLogger('attachments')\n\nexport type ScopedAttachmentUploadErrorCode =\n  | 'dangerous_executable'\n  | 'max_upload_size'\n  | 'active_content'\n  | 'partition_unavailable'\n  | 'quota_exceeded'\n  | 'quota_target_exists'\n  | 'quota_unavailable'\n  | 'quota_recovery_unsupported'\n  | 'storage_failed'\n  | 'persistence_failed'\n\n// Use Symbol.for so the marker survives module duplication across bundle\n// boundaries. The production build emits this module into several server\n// chunks, so a consumer's `instanceof` compares against a different copy of the\n// class than the DI-resolved service threw from: the check silently fails, the\n// error escapes the caller's catch, and a deliberate 400/413 surfaces as a 500.\nconst SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER = Symbol.for('@open-mercato/ScopedAttachmentUploadError')\n\nexport class ScopedAttachmentUploadError extends Error {\n  readonly [SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] = true\n\n  constructor(\n    public readonly code: ScopedAttachmentUploadErrorCode,\n    public readonly status: number,\n  ) {\n    super(code)\n    this.name = 'ScopedAttachmentUploadError'\n  }\n}\n\n/**\n * Bundle-safe check for `ScopedAttachmentUploadError`. Prefer this over\n * `instanceof` at every call site \u2014 the class is duplicated across server\n * chunks, so `instanceof` is only reliable inside this module.\n */\nexport function isScopedAttachmentUploadError(error: unknown): error is ScopedAttachmentUploadError {\n  return Boolean(error)\n    && typeof error === 'object'\n    && (error as Record<symbol, unknown>)[SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] === true\n}\n\nexport type ScopedAttachmentUploadInput = {\n  tenantId: string\n  organizationId: string\n  entityId: string\n  recordId: string\n  fileName: string\n  declaredMimeType?: string | null\n  buffer: Buffer\n  tags?: string[]\n  assignments?: AttachmentAssignment[]\n  partitionCode?: string | null\n  maxBytes?: number\n  /**\n   * Reject a partition flagged public, so a module-owned upload (documents,\n   * warranty claims) never lands where an anonymous reader can reach it. The\n   * tenant/organization half of that guarantee is not this flag's job: the\n   * partition lookup below already matches only a global partition or one owned\n   * by this tenant and organization, whether or not the flag is set.\n   */\n  requirePrivatePartition?: boolean\n  /**\n   * Persists a module-owned link row inside the same transaction as the\n   * Attachment, so a link failure cannot leave a committed orphan attachment.\n   * The callback receives only the generated id, never the entity or the\n   * storage implementation.\n   */\n  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void\n}\n\ntype QuotaRecoveryScheduler = (\n  payload: { reservationId: string; tenantId: string; organizationId: string },\n  delayMs: number,\n) => Promise<void>\n\nexport class ScopedAttachmentUploadService {\n  constructor(private readonly deps: {\n    em: EntityManager\n    dataEngine?: DataEngine | null\n    storageDriverFactory: StorageDriverFactory\n    attachmentQuotaService: AttachmentQuotaService\n    attachmentQuotaRecoveryScheduler: QuotaRecoveryScheduler\n  }) {}\n\n  async upload(input: ScopedAttachmentUploadInput): Promise<Attachment> {\n    const safeName = sanitizeUploadedFileName(input.fileName)\n    if (hasDangerousExecutableExtension(safeName)) {\n      throw new ScopedAttachmentUploadError('dangerous_executable', 400)\n    }\n    if (input.buffer.length > (input.maxBytes ?? resolveAttachmentMaxBytes())) {\n      throw new ScopedAttachmentUploadError('max_upload_size', 413)\n    }\n    const mimeType = detectAttachmentMimeType(input.buffer, safeName, input.declaredMimeType ?? '')\n    if (isActiveContentAttachment(input.buffer, safeName, mimeType)) {\n      throw new ScopedAttachmentUploadError('active_content', 400)\n    }\n\n    const { em, storageDriverFactory, attachmentQuotaService, attachmentQuotaRecoveryScheduler } = this.deps\n    await ensureDefaultPartitions(em)\n    const partitionCode = input.partitionCode ?? resolveDefaultPartitionCode(input.entityId)\n    const partition = await em.findOne(AttachmentPartition, {\n      code: partitionCode,\n      $or: [\n        { tenantId: null, organizationId: null },\n        { tenantId: input.tenantId, organizationId: input.organizationId },\n      ],\n    })\n    if (!partition) throw new ScopedAttachmentUploadError('partition_unavailable', 400)\n    if (input.requirePrivatePartition && partition.isPublic) {\n      throw new ScopedAttachmentUploadError('partition_unavailable', 403)\n    }\n\n    const driver = await storageDriverFactory.resolveForPartition(partition.code, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n    })\n    const preparedStoragePath = driver.prepareStoragePath?.({\n      partitionCode: partition.code,\n      orgId: input.organizationId,\n      tenantId: input.tenantId,\n      fileName: safeName,\n    })\n    if (!preparedStoragePath) {\n      throw new ScopedAttachmentUploadError('quota_recovery_unsupported', 500)\n    }\n\n    let reservation: { id: string; leaseToken: string; expiresAt: Date } | null = null\n    try {\n      reservation = await attachmentQuotaService.reserve({\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        bytes: input.buffer.length,\n        source: 'attachment',\n        storageDriver: driver.key,\n        storagePath: preparedStoragePath,\n        partitionCode: partition.code,\n      })\n      await attachmentQuotaRecoveryScheduler({\n        reservationId: reservation.id,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))\n      await attachmentQuotaService.beginStorage(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      if (reservation) {\n        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => undefined)\n      }\n      const code = (error as { code?: unknown })?.code\n      if (code === 'quota_exceeded') throw new ScopedAttachmentUploadError('quota_exceeded', 413)\n      if (code === 'quota_target_exists') throw new ScopedAttachmentUploadError('quota_target_exists', 409)\n      throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n    }\n\n    if (!reservation) throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n\n    let storedPath = preparedStoragePath\n    try {\n      const stored = await driver.store({\n        partitionCode: partition.code,\n        orgId: input.organizationId,\n        tenantId: input.tenantId,\n        fileName: safeName,\n        buffer: input.buffer,\n        storagePath: preparedStoragePath,\n      })\n      storedPath = stored.storagePath\n      await attachmentQuotaService.markStored(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment storage failed', { err: error })\n      throw new ScopedAttachmentUploadError('storage_failed', 500)\n    }\n\n    let extractedContent: string | null = null\n    const wantsLlmOcr = partition.requiresOcr && shouldUseLlmOcr(mimeType, safeName)\n    const ocrService = wantsLlmOcr ? new OcrService() : null\n    const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n    if (partition.requiresOcr && !useLlmOcr) {\n      try {\n        const { filePath, cleanup } = await driver.toLocalPath(partition.code, storedPath)\n        try {\n          extractedContent = await extractAttachmentContent({ filePath, mimeType })\n        } finally {\n          await cleanup().catch(() => undefined)\n        }\n      } catch (error) {\n        logger.error('Scoped attachment text extraction failed', { err: error })\n      }\n    }\n\n    let assignments = input.assignments?.slice() ?? []\n    assignments = upsertAssignment(assignments, { type: input.entityId, id: input.recordId })\n    const metadata = mergeAttachmentMetadata(null, {\n      assignments,\n      tags: input.tags ?? [],\n    })\n    const attachmentId = randomUUID()\n    let attachment!: Attachment\n\n    try {\n      await em.transactional(async (tx) => {\n        attachment = tx.create(Attachment, {\n          id: attachmentId,\n          entityId: input.entityId,\n          recordId: input.recordId,\n          organizationId: input.organizationId,\n          tenantId: input.tenantId,\n          fileName: safeName,\n          mimeType,\n          fileSize: input.buffer.length,\n          partitionCode: partition.code,\n          storageDriver: partition.storageDriver || 'local',\n          storagePath: storedPath,\n          url: buildAttachmentFileUrl(attachmentId),\n          content: extractedContent,\n          storageMetadata: metadata,\n        })\n        assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId })\n        await tx.persist(attachment).flush()\n        await input.persistLink?.(tx, attachmentId)\n        await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx)\n      })\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment persistence failed', { err: error })\n      // `persistLink` is where callers run their own authorization (the\n      // documents module re-checks the edit capability inside this\n      // transaction), so a deliberate HTTP error from it must reach the route\n      // with its own status. Flattening it to 500 turns a documented 403 into\n      // an apparent server fault.\n      if (isCrudHttpError(error)) throw error\n      throw new ScopedAttachmentUploadError('persistence_failed', 500)\n    }\n\n    if (useLlmOcr) {\n      requestOcrProcessing(em, attachment, driver, storedPath).catch((error) => {\n        logger.error('Scoped attachment OCR scheduling failed', { err: error })\n      })\n    }\n    if (this.deps.dataEngine) {\n      await emitCrudSideEffects({\n        dataEngine: this.deps.dataEngine,\n        action: 'created',\n        entity: attachment,\n        identifiers: {\n          id: attachment.id,\n          organizationId: attachment.organizationId ?? null,\n          tenantId: attachment.tenantId ?? null,\n        },\n        events: attachmentCrudEvents,\n        indexer: attachmentCrudIndexer,\n      })\n      await this.deps.dataEngine.flushOrmEntityChanges()\n    }\n    return attachment\n  }\n\n  private async compensateStorage(\n    driver: Awaited<ReturnType<StorageDriverFactory['resolveForPartition']>>,\n    partitionCode: string,\n    storagePath: string,\n    reservation: { id: string; leaseToken: string },\n  ): Promise<void> {\n    try {\n      await (driver.deleteStrict?.(partitionCode, storagePath) ?? driver.delete(partitionCode, storagePath))\n      await this.deps.attachmentQuotaService.release(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      logger.error('Scoped attachment compensation failed', { err: error })\n    }\n  }\n}\n"],
+  "mappings": "AAAA;AAAA,SAAS,kBAAkB;AAG3B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,YAAY,2BAA2B;AAChD,SAAS,sBAAsB,6BAA6B;AAE5D,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,mCAAmC;AACrE,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAG1C,MAAM,SAAS,aAAa,aAAa;AAmBzC,MAAM,wCAAwC,uBAAO,IAAI,2CAA2C;AAE7F,MAAM,qCAAoC,YACrC,4CADqC,IAAM;AAAA,EAGrD,YACkB,MACA,QAChB;AACA,UAAM,IAAI;AAHM;AACA;AAJlB,SAAU,MAAyC;AAOjD,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,8BAA8B,OAAsD;AAClG,SAAO,QAAQ,KAAK,KACf,OAAO,UAAU,YAChB,MAAkC,qCAAqC,MAAM;AACrF;AAoCO,MAAM,8BAA8B;AAAA,EACzC,YAA6B,MAM1B;AAN0B;AAAA,EAMzB;AAAA,EAEJ,MAAM,OAAO,OAAyD;AACpE,UAAM,WAAW,yBAAyB,MAAM,QAAQ;AACxD,QAAI,gCAAgC,QAAQ,GAAG;AAC7C,YAAM,IAAI,4BAA4B,wBAAwB,GAAG;AAAA,IACnE;AACA,QAAI,MAAM,OAAO,UAAU,MAAM,YAAY,0BAA0B,IAAI;AACzE,YAAM,IAAI,4BAA4B,mBAAmB,GAAG;AAAA,IAC9D;AACA,UAAM,WAAW,yBAAyB,MAAM,QAAQ,UAAU,MAAM,oBAAoB,EAAE;AAC9F,QAAI,0BAA0B,MAAM,QAAQ,UAAU,QAAQ,GAAG;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,UAAM,EAAE,IAAI,sBAAsB,wBAAwB,iCAAiC,IAAI,KAAK;AACpG,UAAM,wBAAwB,EAAE;AAChC,UAAM,gBAAgB,MAAM,iBAAiB,4BAA4B,MAAM,QAAQ;AACvF,UAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,MACtD,MAAM;AAAA,MACN,KAAK;AAAA,QACH,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,QACvC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACnE;AAAA,IACF,CAAC;AACD,QAAI,CAAC,UAAW,OAAM,IAAI,4BAA4B,yBAAyB,GAAG;AAClF,QAAI,MAAM,2BAA2B,UAAU,UAAU;AACvD,YAAM,IAAI,4BAA4B,yBAAyB,GAAG;AAAA,IACpE;AAEA,UAAM,SAAS,MAAM,qBAAqB,oBAAoB,UAAU,MAAM;AAAA,MAC5E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD,UAAM,sBAAsB,OAAO,qBAAqB;AAAA,MACtD,eAAe,UAAU;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,4BAA4B,8BAA8B,GAAG;AAAA,IACzE;AAEA,QAAI,cAA0E;AAC9E,QAAI;AACF,oBAAc,MAAM,uBAAuB,QAAQ;AAAA,QACjD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,OAAO,MAAM,OAAO;AAAA,QACpB,QAAQ;AAAA,QACR,eAAe,OAAO;AAAA,QACtB,aAAa;AAAA,QACb,eAAe,UAAU;AAAA,MAC3B,CAAC;AACD,YAAM,iCAAiC;AAAA,QACrC,eAAe,YAAY;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB,GAAG,KAAK,IAAI,KAAO,YAAY,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;AAChE,YAAM,uBAAuB,aAAa,YAAY,IAAI,YAAY,UAAU;AAAA,IAClF,SAAS,OAAO;AACd,UAAI,aAAa;AACf,cAAM,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,MACpG;AACA,YAAM,OAAQ,OAA8B;AAC5C,UAAI,SAAS,iBAAkB,OAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAC1F,UAAI,SAAS,sBAAuB,OAAM,IAAI,4BAA4B,uBAAuB,GAAG;AACpG,YAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAAA,IAChE;AAEA,QAAI,CAAC,YAAa,OAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAEhF,QAAI,aAAa;AACjB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,eAAe,UAAU;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,UAAU,MAAM;AAAA,QAChB,UAAU;AAAA,QACV,QAAQ,MAAM;AAAA,QACd,aAAa;AAAA,MACf,CAAC;AACD,mBAAa,OAAO;AACpB,YAAM,uBAAuB,WAAW,YAAY,IAAI,YAAY,UAAU;AAAA,IAChF,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,QAAI,mBAAkC;AACtC,UAAM,cAAc,UAAU,eAAe,gBAAgB,UAAU,QAAQ;AAC/E,UAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,UAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAC9D,QAAI,UAAU,eAAe,CAAC,WAAW;AACvC,UAAI;AACF,cAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,OAAO,YAAY,UAAU,MAAM,UAAU;AACjF,YAAI;AACF,6BAAmB,MAAM,yBAAyB,EAAE,UAAU,SAAS,CAAC;AAAA,QAC1E,UAAE;AACA,gBAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,QACvC;AAAA,MACF,SAAS,OAAO;AACd,eAAO,MAAM,4CAA4C,EAAE,KAAK,MAAM,CAAC;AAAA,MACzE;AAAA,IACF;AAEA,QAAI,cAAc,MAAM,aAAa,MAAM,KAAK,CAAC;AACjD,kBAAc,iBAAiB,aAAa,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,SAAS,CAAC;AACxF,UAAM,WAAW,wBAAwB,MAAM;AAAA,MAC7C;AAAA,MACA,MAAM,MAAM,QAAQ,CAAC;AAAA,IACvB,CAAC;AACD,UAAM,eAAe,WAAW;AAChC,QAAI;AAEJ,QAAI;AACF,YAAM,GAAG,cAAc,OAAO,OAAO;AACnC,qBAAa,GAAG,OAAO,YAAY;AAAA,UACjC,IAAI;AAAA,UACJ,UAAU,MAAM;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,UAAU;AAAA,UACV;AAAA,UACA,UAAU,MAAM,OAAO;AAAA,UACvB,eAAe,UAAU;AAAA,UACzB,eAAe,UAAU,iBAAiB;AAAA,UAC1C,aAAa;AAAA,UACb,KAAK,uBAAuB,YAAY;AAAA,UACxC,SAAS;AAAA,UACT,iBAAiB;AAAA,QACnB,CAAC;AACD,uCAA+B,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe,CAAC;AAC3G,cAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AACnC,cAAM,MAAM,cAAc,IAAI,YAAY;AAC1C,cAAM,uBAAuB,mBAAmB,YAAY,IAAI,YAAY,YAAY,EAAE;AAAA,MAC5F,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AAMnE,UAAI,gBAAgB,KAAK,EAAG,OAAM;AAClC,YAAM,IAAI,4BAA4B,sBAAsB,GAAG;AAAA,IACjE;AAEA,QAAI,WAAW;AACb,2BAAqB,IAAI,YAAY,QAAQ,UAAU,EAAE,MAAM,CAAC,UAAU;AACxE,eAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AAAA,MACxE,CAAC;AAAA,IACH;AACA,QAAI,KAAK,KAAK,YAAY;AACxB,YAAM,oBAAoB;AAAA,QACxB,YAAY,KAAK,KAAK;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,IAAI,WAAW;AAAA,UACf,gBAAgB,WAAW,kBAAkB;AAAA,UAC7C,UAAU,WAAW,YAAY;AAAA,QACnC;AAAA,QACA,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,YAAM,KAAK,KAAK,WAAW,sBAAsB;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBACZ,QACA,eACA,aACA,aACe;AACf,QAAI;AACF,aAAO,OAAO,eAAe,eAAe,WAAW,KAAK,OAAO,OAAO,eAAe,WAAW;AACpG,YAAM,KAAK,KAAK,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU;AAAA,IACvF,SAAS,OAAO;AACd,aAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AAAA,IACtE;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/attachments/lib/upload-limits.js

@@ -33,11 +33,14 @@ function resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb) {
   }
   return Math.min(defaultMaxBytes, Math.floor(fieldMaxAttachmentSizeMb * 1024 * 1024));
 }
+function resolveAttachmentMultipartMaxBytes() {
+  return resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES;
+}
 function isMultipartRequestWithinUploadLimit(contentLengthHeader) {
   if (!contentLengthHeader) return true;
   const contentLength = Number(contentLengthHeader);
-  if (!Number.isFinite(contentLength) || contentLength <= 0) return true;
-  return contentLength <= resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES;
+  if (!Number.isSafeInteger(contentLength) || contentLength <= 0) return false;
+  return contentLength <= resolveAttachmentMultipartMaxBytes();
 }
 class MultipartUploadLimitError extends Error {
   constructor() {
@@ -78,6 +81,7 @@ export {
   isMultipartUploadLimitError,
   parseMultipartFormDataWithinUploadLimit,
   resolveAttachmentMaxBytes,
+  resolveAttachmentMultipartMaxBytes,
   resolveAttachmentTenantQuotaBytes,
   resolveDefaultAttachmentMaxUploadBytes,
   willExceedAttachmentTenantQuota

package/dist/modules/attachments/lib/upload-limits.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/upload-limits.ts"],
-  "sourcesContent": ["const DEFAULT_ATTACHMENT_MAX_UPLOAD_MB = 25\nconst DEFAULT_ATTACHMENT_TENANT_QUOTA_MB = 512\nconst MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES = 1024 * 1024\nconst ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_MAX_UPLOAD_MB',\n  'OPENMERCATO_ATTACHMENT_MAX_UPLOAD_MB',\n] as const\nconst ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_TENANT_QUOTA_MB',\n  'OPENMERCATO_ATTACHMENT_TENANT_QUOTA_MB',\n] as const\n\nfunction readEnvValue(names: readonly string[]): string | undefined {\n  return names.map((name) => process.env[name]).find((value) => typeof value === 'string')\n}\n\nfunction parseMegabytesEnv(names: readonly string[], fallbackMb: number): number {\n  const raw = readEnvValue(names)\n  const parsed = raw ? Number(raw) : NaN\n  if (Number.isFinite(parsed) && parsed > 0) {\n    return parsed\n  }\n  return fallbackMb\n}\n\nexport function resolveDefaultAttachmentMaxUploadBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS, DEFAULT_ATTACHMENT_MAX_UPLOAD_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentTenantQuotaBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS, DEFAULT_ATTACHMENT_TENANT_QUOTA_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb?: number | null): number {\n  const defaultMaxBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (typeof fieldMaxAttachmentSizeMb !== 'number' || fieldMaxAttachmentSizeMb <= 0) {\n    return defaultMaxBytes\n  }\n  return Math.min(defaultMaxBytes, Math.floor(fieldMaxAttachmentSizeMb * 1024 * 1024))\n}\n\nexport function isMultipartRequestWithinUploadLimit(contentLengthHeader: string | null): boolean {\n  if (!contentLengthHeader) return true\n  const contentLength = Number(contentLengthHeader)\n  if (!Number.isFinite(contentLength) || contentLength <= 0) return true\n  return contentLength <= (resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES)\n}\n\nexport class MultipartUploadLimitError extends Error {\n  constructor() {\n    super('Multipart request exceeds the maximum upload size.')\n    this.name = 'MultipartUploadLimitError'\n  }\n}\n\nexport function isMultipartUploadLimitError(error: unknown): error is MultipartUploadLimitError {\n  return error instanceof MultipartUploadLimitError\n}\n\nexport async function parseMultipartFormDataWithinUploadLimit(request: Request): Promise<FormData> {\n  if (!isMultipartRequestWithinUploadLimit(request.headers.get('content-length'))) {\n    throw new MultipartUploadLimitError()\n  }\n\n  if (!request.body) return request.formData()\n\n  const maxBytes = resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES\n  let consumedBytes = 0\n  const boundedBody = request.body.pipeThrough(new TransformStream<Uint8Array, Uint8Array>({\n    transform(chunk, controller) {\n      consumedBytes += chunk.byteLength\n      if (consumedBytes > maxBytes) {\n        controller.error(new MultipartUploadLimitError())\n        return\n      }\n      controller.enqueue(chunk)\n    },\n  }))\n  const contentType = request.headers.get('content-type')\n  const headers = contentType ? { 'content-type': contentType } : undefined\n  return new Response(boundedBody, { headers }).formData()\n}\n\nexport function willExceedAttachmentTenantQuota(currentUsageBytes: number, incomingFileBytes: number): boolean {\n  return (currentUsageBytes + incomingFileBytes) > resolveAttachmentTenantQuotaBytes()\n}\n"],
-  "mappings": "AAAA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,0CAA0C,OAAO;AACvD,MAAM,oCAAoC;AAAA,EACxC;AAAA,EACA;AACF;AACA,MAAM,sCAAsC;AAAA,EAC1C;AAAA,EACA;AACF;AAEA,SAAS,aAAa,OAA8C;AAClE,SAAO,MAAM,IAAI,CAAC,SAAS,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ;AACzF;AAEA,SAAS,kBAAkB,OAA0B,YAA4B;AAC/E,QAAM,MAAM,aAAa,KAAK;AAC9B,QAAM,SAAS,MAAM,OAAO,GAAG,IAAI;AACnC,MAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,yCAAiD;AAC/D,SAAO,KAAK,MAAM,kBAAkB,mCAAmC,gCAAgC,IAAI,OAAO,IAAI;AACxH;AAEO,SAAS,oCAA4C;AAC1D,SAAO,KAAK,MAAM,kBAAkB,qCAAqC,kCAAkC,IAAI,OAAO,IAAI;AAC5H;AAEO,SAAS,0BAA0B,0BAAkD;AAC1F,QAAM,kBAAkB,uCAAuC;AAC/D,MAAI,OAAO,6BAA6B,YAAY,4BAA4B,GAAG;AACjF,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,iBAAiB,KAAK,MAAM,2BAA2B,OAAO,IAAI,CAAC;AACrF;AAEO,SAAS,oCAAoC,qBAA6C;AAC/F,MAAI,CAAC,oBAAqB,QAAO;AACjC,QAAM,gBAAgB,OAAO,mBAAmB;AAChD,MAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,EAAG,QAAO;AAClE,SAAO,iBAAkB,uCAAuC,IAAI;AACtE;AAEO,MAAM,kCAAkC,MAAM;AAAA,EACnD,cAAc;AACZ,UAAM,oDAAoD;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,4BAA4B,OAAoD;AAC9F,SAAO,iBAAiB;AAC1B;AAEA,eAAsB,wCAAwC,SAAqC;AACjG,MAAI,CAAC,oCAAoC,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,UAAM,IAAI,0BAA0B;AAAA,EACtC;AAEA,MAAI,CAAC,QAAQ,KAAM,QAAO,QAAQ,SAAS;AAE3C,QAAM,WAAW,uCAAuC,IAAI;AAC5D,MAAI,gBAAgB;AACpB,QAAM,cAAc,QAAQ,KAAK,YAAY,IAAI,gBAAwC;AAAA,IACvF,UAAU,OAAO,YAAY;AAC3B,uBAAiB,MAAM;AACvB,UAAI,gBAAgB,UAAU;AAC5B,mBAAW,MAAM,IAAI,0BAA0B,CAAC;AAChD;AAAA,MACF;AACA,iBAAW,QAAQ,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC,CAAC;AACF,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc;AACtD,QAAM,UAAU,cAAc,EAAE,gBAAgB,YAAY,IAAI;AAChE,SAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,CAAC,EAAE,SAAS;AACzD;AAEO,SAAS,gCAAgC,mBAA2B,mBAAoC;AAC7G,SAAQ,oBAAoB,oBAAqB,kCAAkC;AACrF;",
+  "sourcesContent": ["const DEFAULT_ATTACHMENT_MAX_UPLOAD_MB = 25\nconst DEFAULT_ATTACHMENT_TENANT_QUOTA_MB = 512\nconst MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES = 1024 * 1024\nconst ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_MAX_UPLOAD_MB',\n  'OPENMERCATO_ATTACHMENT_MAX_UPLOAD_MB',\n] as const\nconst ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_TENANT_QUOTA_MB',\n  'OPENMERCATO_ATTACHMENT_TENANT_QUOTA_MB',\n] as const\n\nfunction readEnvValue(names: readonly string[]): string | undefined {\n  return names.map((name) => process.env[name]).find((value) => typeof value === 'string')\n}\n\nfunction parseMegabytesEnv(names: readonly string[], fallbackMb: number): number {\n  const raw = readEnvValue(names)\n  const parsed = raw ? Number(raw) : NaN\n  if (Number.isFinite(parsed) && parsed > 0) {\n    return parsed\n  }\n  return fallbackMb\n}\n\nexport function resolveDefaultAttachmentMaxUploadBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS, DEFAULT_ATTACHMENT_MAX_UPLOAD_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentTenantQuotaBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS, DEFAULT_ATTACHMENT_TENANT_QUOTA_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb?: number | null): number {\n  const defaultMaxBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (typeof fieldMaxAttachmentSizeMb !== 'number' || fieldMaxAttachmentSizeMb <= 0) {\n    return defaultMaxBytes\n  }\n  return Math.min(defaultMaxBytes, Math.floor(fieldMaxAttachmentSizeMb * 1024 * 1024))\n}\n\nexport function resolveAttachmentMultipartMaxBytes(): number {\n  return resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES\n}\n\nexport function isMultipartRequestWithinUploadLimit(contentLengthHeader: string | null): boolean {\n  if (!contentLengthHeader) return true\n  const contentLength = Number(contentLengthHeader)\n  if (!Number.isSafeInteger(contentLength) || contentLength <= 0) return false\n  return contentLength <= resolveAttachmentMultipartMaxBytes()\n}\n\nexport class MultipartUploadLimitError extends Error {\n  constructor() {\n    super('Multipart request exceeds the maximum upload size.')\n    this.name = 'MultipartUploadLimitError'\n  }\n}\n\nexport function isMultipartUploadLimitError(error: unknown): error is MultipartUploadLimitError {\n  return error instanceof MultipartUploadLimitError\n}\n\nexport async function parseMultipartFormDataWithinUploadLimit(request: Request): Promise<FormData> {\n  if (!isMultipartRequestWithinUploadLimit(request.headers.get('content-length'))) {\n    throw new MultipartUploadLimitError()\n  }\n\n  if (!request.body) return request.formData()\n\n  const maxBytes = resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES\n  let consumedBytes = 0\n  const boundedBody = request.body.pipeThrough(new TransformStream<Uint8Array, Uint8Array>({\n    transform(chunk, controller) {\n      consumedBytes += chunk.byteLength\n      if (consumedBytes > maxBytes) {\n        controller.error(new MultipartUploadLimitError())\n        return\n      }\n      controller.enqueue(chunk)\n    },\n  }))\n  const contentType = request.headers.get('content-type')\n  const headers = contentType ? { 'content-type': contentType } : undefined\n  return new Response(boundedBody, { headers }).formData()\n}\n\nexport function willExceedAttachmentTenantQuota(currentUsageBytes: number, incomingFileBytes: number): boolean {\n  return (currentUsageBytes + incomingFileBytes) > resolveAttachmentTenantQuotaBytes()\n}\n"],
+  "mappings": "AAAA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,0CAA0C,OAAO;AACvD,MAAM,oCAAoC;AAAA,EACxC;AAAA,EACA;AACF;AACA,MAAM,sCAAsC;AAAA,EAC1C;AAAA,EACA;AACF;AAEA,SAAS,aAAa,OAA8C;AAClE,SAAO,MAAM,IAAI,CAAC,SAAS,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ;AACzF;AAEA,SAAS,kBAAkB,OAA0B,YAA4B;AAC/E,QAAM,MAAM,aAAa,KAAK;AAC9B,QAAM,SAAS,MAAM,OAAO,GAAG,IAAI;AACnC,MAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,yCAAiD;AAC/D,SAAO,KAAK,MAAM,kBAAkB,mCAAmC,gCAAgC,IAAI,OAAO,IAAI;AACxH;AAEO,SAAS,oCAA4C;AAC1D,SAAO,KAAK,MAAM,kBAAkB,qCAAqC,kCAAkC,IAAI,OAAO,IAAI;AAC5H;AAEO,SAAS,0BAA0B,0BAAkD;AAC1F,QAAM,kBAAkB,uCAAuC;AAC/D,MAAI,OAAO,6BAA6B,YAAY,4BAA4B,GAAG;AACjF,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,iBAAiB,KAAK,MAAM,2BAA2B,OAAO,IAAI,CAAC;AACrF;AAEO,SAAS,qCAA6C;AAC3D,SAAO,uCAAuC,IAAI;AACpD;AAEO,SAAS,oCAAoC,qBAA6C;AAC/F,MAAI,CAAC,oBAAqB,QAAO;AACjC,QAAM,gBAAgB,OAAO,mBAAmB;AAChD,MAAI,CAAC,OAAO,cAAc,aAAa,KAAK,iBAAiB,EAAG,QAAO;AACvE,SAAO,iBAAiB,mCAAmC;AAC7D;AAEO,MAAM,kCAAkC,MAAM;AAAA,EACnD,cAAc;AACZ,UAAM,oDAAoD;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,4BAA4B,OAAoD;AAC9F,SAAO,iBAAiB;AAC1B;AAEA,eAAsB,wCAAwC,SAAqC;AACjG,MAAI,CAAC,oCAAoC,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,UAAM,IAAI,0BAA0B;AAAA,EACtC;AAEA,MAAI,CAAC,QAAQ,KAAM,QAAO,QAAQ,SAAS;AAE3C,QAAM,WAAW,uCAAuC,IAAI;AAC5D,MAAI,gBAAgB;AACpB,QAAM,cAAc,QAAQ,KAAK,YAAY,IAAI,gBAAwC;AAAA,IACvF,UAAU,OAAO,YAAY;AAC3B,uBAAiB,MAAM;AACvB,UAAI,gBAAgB,UAAU;AAC5B,mBAAW,MAAM,IAAI,0BAA0B,CAAC;AAChD;AAAA,MACF;AACA,iBAAW,QAAQ,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC,CAAC;AACF,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc;AACtD,QAAM,UAAU,cAAc,EAAE,gBAAgB,YAAY,IAAI;AAChE,SAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,CAAC,EAAE,SAAS;AACzD;AAEO,SAAS,gCAAgC,mBAA2B,mBAAoC;AAC7G,SAAQ,oBAAoB,oBAAqB,kCAAkC;AACrF;",
   "names": []
 }

package/dist/modules/audit_logs/backend/audit-logs/page.js

@@ -23,11 +23,13 @@ function AuditLogsPage() {
   const [actionsPageSize, setActionsPageSize] = React.useState(DEFAULT_PAGE_SIZE);
   const [actionsTotal, setActionsTotal] = React.useState(0);
   const [actionsTotalPages, setActionsTotalPages] = React.useState(1);
+  const [actionsTotalIsCapped, setActionsTotalIsCapped] = React.useState(false);
   const actionsPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE);
   const [accessPage, setAccessPage] = React.useState(1);
   const [accessPageSize, setAccessPageSize] = React.useState(DEFAULT_PAGE_SIZE);
   const [accessTotal, setAccessTotal] = React.useState(0);
   const [accessTotalPages, setAccessTotalPages] = React.useState(1);
+  const [accessTotalIsCapped, setAccessTotalIsCapped] = React.useState(false);
   const accessPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE);
   const fetchActions = React.useCallback(async (page, pageSize) => {
     const params = new URLSearchParams();
@@ -64,6 +66,7 @@ function AuditLogsPage() {
     });
     setActionsTotal(actionsRes.total ?? (actionsRes.items?.length ?? 0));
     setActionsTotalPages(actionsRes.totalPages ?? 1);
+    setActionsTotalIsCapped(actionsRes.totalIsCapped === true);
     setAccessLogs(accessRes.items ?? []);
     const resolvedPage = accessRes.page ?? accessPageNum;
     const resolvedPageSize = accessRes.pageSize ?? accessPageSizeNum;
@@ -80,6 +83,7 @@ function AuditLogsPage() {
     });
     setAccessTotal(resolvedTotal);
     setAccessTotalPages(resolvedTotalPages);
+    setAccessTotalIsCapped(accessRes.totalIsCapped === true);
   }, [fetchActions, fetchAccess]);
   const loadWithState = React.useCallback(async (actionPage, actionPageSize, accessPageNum, accessPageSizeNum) => {
     setLoading(true);
@@ -168,6 +172,7 @@ function AuditLogsPage() {
           pageSize: actionsPageSize,
           total: actionsTotal,
           totalPages: actionsTotalPages,
+          totalIsCapped: actionsTotalIsCapped,
           onPageChange: handleActionsPageChange
         }
       }
@@ -183,6 +188,7 @@ function AuditLogsPage() {
           pageSize: accessPageSize,
           total: accessTotal,
           totalPages: accessTotalPages,
+          totalIsCapped: accessTotalIsCapped,
           onPageChange: handleAccessPageChange
         }
       }