@opengis/fastify-table 2.0.105 → 2.0.107

package/dist/server/routes/auth/controllers/jwt/token.js

@@ -14,19 +14,17 @@ export default async function oauthToken(req, reply) {
     const payload = req.method === "POST" ? body : query;
     const { grant_type, client_id, code, redirect_uri, code_verifier } = payload;
     if (grant_type !== "authorization_code") {
-        return reply
-            .code(400)
-            .send({ message: "unsupported grant_type", code: 400 });
+        return reply.code(400).send({ error: "unsupported grant_type", code: 400 });
     }
     if (!client_id) {
         return reply
             .code(400)
-            .send({ message: "not enough params: client_id", code: 400 });
+            .send({ error: "not enough params: client_id", code: 400 });
     }
     if (!code) {
         return reply
             .code(400)
-            .send({ message: "not enough params: code", code: 400 });
+            .send({ error: "not enough params: code", code: 400 });
     }
     const q = `select owner_user_id, client_secret_hash, redirect_uris from oauth.clients where client_id=$1 and token_endpoint_auth_method=$2`;
     const { owner_user_id: userId, client_secret_hash: secret, redirect_uris = [], } = pg.pk?.["oauth.clients"]
@@ -41,31 +39,31 @@ export default async function oauthToken(req, reply) {
     if (storedIp !== ip) {
         return reply
             .code(403)
-            .send({ message: "access restricted: wrong IP address", code: 403 });
+            .send({ error: "access restricted: wrong IP address", code: 403 });
     }
     if (!stored) {
         return reply
             .code(403)
-            .send({ message: "access restricted: code expired", code: 403 });
+            .send({ error: "access restricted: code expired", code: 403 });
     }
     const isValid = await scryptVerify(stored, code);
     if (!isValid) {
         return reply
             .code(403)
-            .send({ message: "access restricted: stored code mismatch", code: 403 });
+            .send({ error: "access restricted: stored code mismatch", code: 403 });
     }
     if (!isCodeValid) {
         return reply
             .code(403)
-            .send({ message: "access restricted: invalid code", code: 403 });
+            .send({ error: "access restricted: invalid code", code: 403 });
     }
     if (!userId) {
-        return reply.code(400).send({ message: "invalid client id", code: 400 });
+        return reply.code(400).send({ error: "invalid client id", code: 400 });
     }
     if (redirect_uri &&
         Array.isArray(redirect_uris) &&
         !redirect_uris.includes(redirect_uri)) {
-        return reply.code(400).send({ message: "invalid redirect_uri", code: 400 });
+        return reply.code(400).send({ error: "invalid redirect_uri", code: 400 });
     }
     const user = pg.pk?.["admin.users"]
         ? await pg
@@ -75,7 +73,7 @@ export default async function oauthToken(req, reply) {
             .then((el) => el.rows[0])
         : null;
     if (!user) {
-        return reply.code(404).send({ message: "user not found", code: 404 });
+        return reply.code(404).send({ error: "user not found", code: 404 });
     }
     const expire = expires_at ? expires_at - Date.now() : expireMsec;
     const href1 = await authorizeUser(user, req, "jwt", expire);

package/dist/server/routes/cron/controllers/cronApi.d.ts

@@ -1,2 +1,2 @@
-export default function cronApi(req: any): Promise<any>;
+export default function cronApi(req: any, reply: any): Promise<any>;
 //# sourceMappingURL=cronApi.d.ts.map

package/dist/server/routes/cron/controllers/cronApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cronApi.d.ts","sourceRoot":"","sources":["../../../../../server/routes/cron/controllers/cronApi.ts"],"names":[],"mappings":"AAEA,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,gBAoB7C"}
+{"version":3,"file":"cronApi.d.ts","sourceRoot":"","sources":["../../../../../server/routes/cron/controllers/cronApi.ts"],"names":[],"mappings":"AAEA,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAsBzD"}

package/dist/server/routes/cron/controllers/cronApi.js

@@ -1,15 +1,17 @@
 import cronList from "../../../plugins/cron/cronList.js";
-export default async function cronApi(req) {
+export default async function cronApi(req, reply) {
     const { params = {}, user = {}, hostname } = req;
     if ((!user.uid || !user.user_type?.includes("admin")) &&
         !hostname?.includes("local")) {
-        return { message: "access restricted", status: 403 };
+        return reply.status(403).send({ error: "access restricted", code: 403 });
     }
     if (params.name === "list") {
         return { data: Object.keys(cronList || {}) };
     }
     if (!cronList[params.name]) {
-        return { message: `cron not found: ${params.name}`, status: 404 };
+        return reply
+            .status(404)
+            .send({ error: `cron not found: ${params.name}`, code: 404 });
     }
     const result = await cronList[params.name]?.(req);
     return result;

package/dist/server/routes/crud/controllers/insert.d.ts

@@ -1,6 +1,3 @@
 import { type FastifyReply } from "fastify";
-export default function insert(req: any, reply: FastifyReply): Promise<{
-    message: string;
-    status: number;
-}>;
+export default function insert(req: any, reply: FastifyReply): Promise<never>;
 //# sourceMappingURL=insert.d.ts.map

package/dist/server/routes/crud/controllers/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB5C,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY;;;GAsKjE"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB5C,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBA4KjE"}

package/dist/server/routes/crud/controllers/insert.js

@@ -2,7 +2,7 @@ import { applyHook, getAccess, getTemplate, checkXSS, checkSQL, dataInsert, getT
 export default async function insert(req, reply) {
     const { pg = pgClients.client, user = {}, params = {}, body = {}, headers = {}, } = req || {};
     if (!user) {
-        return reply.status(403).send("access restricted");
+        return reply.status(403).send({ error: "access restricted", code: 403 });
     }
     const hookData = (await applyHook("preInsert", {
         pg,
@@ -11,7 +11,10 @@ export default async function insert(req, reply) {
         body,
     }));
     if (hookData?.message && hookData?.status) {
-        return { message: hookData?.message, status: hookData?.status };
+        const response = hookData.status >= 400
+            ? { error: hookData.message, code: hookData.status }
+            : hookData.message;
+        return reply.status(hookData.status).send(response);
     }
     const { referer } = headers;
     const tokenData = await getToken({
@@ -30,18 +33,20 @@ export default async function insert(req, reply) {
         !config.local &&
         !config.security?.disableToken &&
         !config.auth?.disable) {
-        return reply.status(400).send("invalid token");
+        return reply.status(400).send({ error: "invalid token", code: 400 });
     }
     if (!actions.includes("add") && !config.local && !tokenData) {
-        return reply.status(403).send("access restricted: actions");
+        return reply
+            .status(403)
+            .send({ error: "access restricted: actions", code: 403 });
     }
     if (!add) {
-        return reply.status(400).send("table is required");
+        return reply.status(400).send({ error: "table is required", code: 400 });
     }
     const loadTemplate = await getTemplate("table", add);
     const { table } = loadTemplate || hookData || tokenData || req.params || {};
     if (!table) {
-        return reply.status(404).send("table not found");
+        return reply.status(404).send({ error: "table not found", code: 404 });
     }
     const formData = form || loadTemplate?.form
         ? (await getTemplate("form", form || loadTemplate?.form)) || {}
@@ -56,9 +61,10 @@ export default async function insert(req, reply) {
             uid: user?.uid,
             msg: xssCheck.error,
         });
-        return reply
-            .status(409)
-            .send("Дані містять заборонені символи. Приберіть їх та спробуйте ще раз");
+        return reply.status(409).send({
+            error: "Дані містять заборонені символи. Приберіть їх та спробуйте ще раз",
+            code: 409,
+        });
     }
     const fieldCheck = validateData({ body, schema });
     if (fieldCheck.error) {
@@ -68,9 +74,10 @@ export default async function insert(req, reply) {
             uid: user?.uid,
             ...fieldCheck,
         });
-        return reply
-            .status(409)
-            .send("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
+        return reply.status(409).send({
+            error: "Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз",
+            code: 409,
+        });
     }
     const sqlCheck = checkSQL({ body, schema });
     if (sqlCheck.error) {
@@ -80,9 +87,10 @@ export default async function insert(req, reply) {
             uid: user?.uid,
             ...sqlCheck,
         });
-        return reply
-            .status(409)
-            .send("Дані містять заборонені sql символи. Приберіть їх та спробуйте ще раз");
+        return reply.status(409).send({
+            error: "Дані містять заборонені sql символи. Приберіть їх та спробуйте ще раз",
+            code: 409,
+        });
     }
     if (![add, table].includes("admin.users")) {
         Object.assign(body, { uid: user?.uid, editor_id: user?.uid });
@@ -104,7 +112,7 @@ export default async function insert(req, reply) {
         referer,
     });
     if (!res) {
-        return reply.status(400).send("nothing added");
+        return reply.status(400).send({ error: "nothing added", code: 400 });
     }
     // admin.custom_column
     await applyHook("afterInsert", {

package/dist/server/routes/crud/controllers/table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAe5C,wBAA8B,QAAQ,CACpC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,GAAG,gBA0NZ"}
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAe5C,wBAA8B,QAAQ,CACpC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,GAAG,gBAkOZ"}

package/dist/server/routes/crud/controllers/table.js

@@ -22,14 +22,15 @@ export default async function tableAPI(req, reply, called) {
     if (!loadTable &&
         !pg.pk?.[tokenData?.table] &&
         !(pg.pk?.[templateName] && called)) {
-        return reply.status(404).send("not found");
+        return reply.status(404).send({ error: "not found", code: 404 });
     }
     const { table: table1 = params.table, form: form1, obj, } = hookData || loadTable || tokenData || {};
     const table = loadTable?.table || table1;
     const form = loadTable?.form || form1;
     const id = hookData?.id || tokenData?.id || params.id;
-    if (tokenData && !id)
-        return { message: {} };
+    if (tokenData && !id) {
+        return reply.status(403).send({ error: "invalid token", code: 403 });
+    }
     if (!table && !id) {
         return reply.status(400).send("not enough params");
     }
@@ -46,14 +47,18 @@ export default async function tableAPI(req, reply, called) {
         return reply.status(400).send("invalid token");
     }
     if (!actions.includes("edit") && !config?.local && !tokenData && !called) {
-        return reply.status(403).send("access restricted: actions");
+        return reply
+            .status(403)
+            .send({ error: "access restricted: actions", code: 403 });
     }
     const { pk, columns: dbColumns = [] } = await getMeta({
         pg,
         table,
     });
     if (!pk) {
-        return reply.status(404).send(`table not found: ${table}`);
+        return reply
+            .status(404)
+            .send({ error: `table not found: ${table}`, code: 404 });
     }
     // const cols = columns.map((el) => el.name || el).join(',');
     const formData = (await getTemplate("form", form)) || {};
@@ -107,7 +112,9 @@ export default async function tableAPI(req, reply, called) {
         .query(q.replace(/{{uid}}/, user?.uid), [id])
         .then((el) => el.rows[0]);
     if (!data) {
-        return reply.status(404).send(`object not found: ${id}`);
+        return reply
+            .status(404)
+            .send({ error: `object not found: ${id}`, code: 404 });
     }
     Object.keys(schema)
         .filter((key) => schema[key]?.type === "DataTable")

package/dist/server/routes/crud/controllers/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/update.ts"],"names":[],"mappings":"AAeA,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAsLxD"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/update.ts"],"names":[],"mappings":"AAeA,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBA4LxD"}

package/dist/server/routes/crud/controllers/update.js

@@ -4,7 +4,7 @@ import insert from "./insert.js";
 export default async function update(req, reply) {
     const { pg = pgClients.client, user, params = {}, body = {}, headers = {}, unittest, } = req;
     if (!user) {
-        return reply.status(403).send("access restricted");
+        return reply.status(403).send({ error: "access restricted", code: 403 });
     }
     const hookData = (await applyHook("preUpdate", {
         pg,
@@ -13,7 +13,10 @@ export default async function update(req, reply) {
         user,
     }));
     if (hookData?.message && hookData?.status) {
-        return { message: hookData?.message, status: hookData?.status };
+        const response = hookData.status >= 400
+            ? { error: hookData.message, code: hookData.status }
+            : hookData.message;
+        return reply.status(hookData.status).send(response);
     }
     const { referer } = headers;
     const tokenData = await getToken({
@@ -37,19 +40,21 @@ export default async function update(req, reply) {
         !config.local &&
         !config.security?.disableToken &&
         !config.auth?.disable) {
-        return reply.status(400).send("invalid token");
+        return reply.status(400).send({ error: "invalid token", code: 400 });
     }
     if (!actions.includes("edit") && !config.local && !tokenData) {
-        return reply.status(403).send("access restricted: actions");
+        return reply
+            .status(403)
+            .send({ error: "access restricted: actions", code: 403 });
     }
     if (!edit) {
-        return reply.status(400).send("table is required");
+        return reply.status(400).send({ error: "table is required", code: 400 });
     }
     if (!id && tokenData?.table) {
         return insert(req, reply);
     }
     if (!id) {
-        return reply.status(400).send("id is required");
+        return reply.status(400).send({ error: "id is required", code: 400 });
     }
     const loadTemplate = await getTemplate("table", edit);
     const { table } = loadTemplate || hookData || tokenData || params || {};
@@ -69,9 +74,10 @@ export default async function update(req, reply) {
     const xssCheck = checkXSS({ body, schema });
     if (xssCheck.error && formData?.xssCheck !== false) {
         logger.file("injection/xss", { msg: xssCheck.error, table }, req);
-        return reply
-            .status(409)
-            .send("Дані містять заборонені символи. Приберіть їх та спробуйте ще раз");
+        return reply.status(409).send({
+            error: "Дані містять заборонені символи. Приберіть їх та спробуйте ще раз",
+            code: 409,
+        });
     }
     const fieldCheck = validateData({ body, schema });
     if (fieldCheck.error) {
@@ -81,9 +87,10 @@ export default async function update(req, reply) {
             uid: user?.uid,
             ...fieldCheck,
         });
-        return reply
-            .status(409)
-            .send("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
+        return reply.status(409).send({
+            error: "Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз",
+            code: 409,
+        });
     }
     const sqlCheck = checkSQL({ body, schema });
     if (sqlCheck.error) {
@@ -93,9 +100,10 @@ export default async function update(req, reply) {
             uid: user?.uid,
             ...sqlCheck,
         });
-        return reply
-            .status(409)
-            .send("Дані містять заборонені sql символи. Приберіть їх та спробуйте ще раз");
+        return reply.status(409).send({
+            error: "Дані містять заборонені sql символи. Приберіть їх та спробуйте ще раз",
+            code: 409,
+        });
     }
     if (tokenData?.obj) {
         const objData = tokenData.obj?.split("#").reduce((p, el) => ({

package/dist/server/routes/file/controllers/delete.d.ts

@@ -16,19 +16,5 @@
  * @returns {Object} headers Заголовки HTTP
  * @returns {String} message Повідомлення про успішне виконання або об'єкт з параметрами
  */
-export default function deleteFileAPI(req: any): Promise<{
-    message: string;
-    status: number;
-} | {
-    message: {
-        id: any;
-        filepath: any;
-    };
-    status: number;
-    error?: undefined;
-} | {
-    error: any;
-    status: number;
-    message?: undefined;
-}>;
+export default function deleteFileAPI(req: any, reply: any): Promise<any>;
 //# sourceMappingURL=delete.d.ts.map

package/dist/server/routes/file/controllers/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/delete.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;GAiBG;AAEH,wBAA8B,aAAa,CAAC,GAAG,EAAE,GAAG;;;;;;;;;;;;;;GAyFnD"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/delete.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,wBAA8B,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAoF/D"}

package/dist/server/routes/file/controllers/delete.js

@@ -1,5 +1,4 @@
 import { config, dataUpdate, logger, pgClients } from "../../../../utils.js";
-const resp = { message: "File not found", status: 404 };
 /**
  * Апі використовується для видалення файлів за допомогою fs або s3
  *
@@ -18,15 +17,15 @@ const resp = { message: "File not found", status: 404 };
  * @returns {Object} headers Заголовки HTTP
  * @returns {String} message Повідомлення про успішне виконання або об'єкт з параметрами
  */
-export default async function deleteFileAPI(req) {
+export default async function deleteFileAPI(req, reply) {
     const { pg = pgClients.client, params = {}, user = {} } = req;
+    const { uid, user_rnokpp: rnokpp } = user;
     if (!params["*"]) {
-        return resp;
+        return reply.status(404).send({ error: "File not found", code: 404 });
     }
     const filename = params["*"].startsWith("/") || /^[0-9]+$/.test(params["*"])
         ? params["*"]
         : `/${params["*"]}`;
-    const { uid, user_rnokpp: rnokpp } = user;
     if (!filename) {
         logger.file("file", {
             level: "INFO",
@@ -36,7 +35,7 @@ export default async function deleteFileAPI(req) {
             uid,
             rnokpp,
         });
-        return resp;
+        return reply.status(404).send({ error: "File not found", code: 404 });
     }
     if (filename.includes("..")) {
         logger.file("file", {
@@ -47,7 +46,7 @@ export default async function deleteFileAPI(req) {
             uid,
             rnokpp,
         });
-        return resp;
+        return reply.status(404).send({ error: "File not found", code: 404 });
     }
     try {
         const result = await pg
@@ -64,36 +63,30 @@ export default async function deleteFileAPI(req) {
             logger.file("file", {
                 level: "INFO",
                 type: "delete",
-                message: resp.message,
+                message: "file not found",
                 file: params["*"],
                 uid,
                 rnokpp,
             });
-            return resp;
+            return reply.status(404).send({ error: "File not found", code: 404 });
         }
         const message = { id: res.file_id, filepath: res.file_path };
-        logger.file("file", {
-            level: "INFO",
-            type: "delete",
+        logger.file("file/delete", {
             message,
             file: params["*"],
             uid,
             rnokpp,
         });
-        return { message, status: 200 };
+        return message;
     }
     catch (err) {
-        logger.file("file", {
-            level: "ERROR",
-            type: "delete",
-            message: err.toString(),
+        logger.file("file/delete", {
+            error: err.toString(),
             file: params["*"],
             uid,
             rnokpp,
         });
-        return {
-            error: config?.local ? err.toString() : "Помилка видалення файлу",
-            status: 500,
-        };
+        const error = config.local ? err.toString() : "Помилка видалення файлу";
+        return reply.status(500).send({ error, code: 500 });
     }
 }

package/dist/server/routes/file/controllers/download.d.ts

@@ -1,3 +1,4 @@
+import type { FastifyReply } from "fastify";
 /**
  * Апі використовується для скачування файлів за допомогою fs або s3
  *
@@ -15,6 +16,5 @@
  * @returns {Object} headers Заголовки HTTP
  * @returns {String} pipe Шлях до файла для скачування або відображення
  */
-declare function download({ params }: any, reply: any): Promise<any>;
-export default download;
+export default function download({ params, user }: any, reply: FastifyReply): Promise<any>;
 //# sourceMappingURL=download.d.ts.map

package/dist/server/routes/file/controllers/download.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/download.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;GAgBG;AAEH,iBAAe,QAAQ,CAAC,EACtB,MAAM,EACP,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAkCjB;AAED,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/download.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB5C;;;;;;;;;;;;;;;;GAgBG;AAEH,wBAA8B,QAAQ,CACpC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EACrB,KAAK,EAAE,YAAY,gBAgDpB"}

package/dist/server/routes/file/controllers/download.js

@@ -1,6 +1,9 @@
-import path from 'node:path';
-import providers from '../../../plugins/file/providers/index.js';
-import getMimeType from '../../../plugins/file/providers/mime/index.js';
+import path from "node:path";
+import providers from "../../../plugins/file/providers/index.js";
+import getMimeType from "../../../plugins/file/providers/mime/index.js";
+import logger from "../../../plugins/logger/getLogger.js";
+import applyHook from "../../../plugins/hook/applyHook.js";
+const { downloadFile } = providers();
 /* const allowedPublicDirs = [
   'upload', 'page', 'site', 'maps', 'tmp', 'uploads', 'site_slider', 'module', 'product', 'image', 'geo_works_file',
 ]; */
@@ -21,36 +24,42 @@ import getMimeType from '../../../plugins/file/providers/mime/index.js';
  * @returns {Object} headers Заголовки HTTP
  * @returns {String} pipe Шлях до файла для скачування або відображення
  */
-async function download({ params }, reply) {
-    if (!params?.['*'])
-        return { message: 'not enough params', status: 400 };
-    const filename = params['*'].startsWith('/') ? params['*'].slice(1) : params['*'];
-    if (!filename)
-        return { message: "required param 'filename'", status: 400 };
-    if (filename?.includes?.('..'))
-        return { message: 'wrong params', status: 400 };
-    /* const { security } = getSettings();
-    const { enabled: externalAccess } = await pg.one('select enabled from admin.data_api where account_name = $1 and api_key = $2', { args: [account, key] });
-    if ((sid === 35 && !isUser && !externalAccess)
-      || (sid === 1
-        && !allowedPublicDirs.some((dir) => filename?.includes?.(`${dir}/`))
-        && !security?.public_dirs?.split(',')?.some((dir) => filename?.includes?.(`${dir}/`)))
-    ) {
-      return { error: 'Немає доступу', status: 403 };
-    } */
-    const filepath = filename.startsWith('files/')
+export default async function download({ params, user }, reply) {
+    if (!params?.["*"]) {
+        return reply.status(400).send({ error: "not enough params", code: 400 });
+    }
+    const filename = params["*"].startsWith("/")
+        ? params["*"].slice(1)
+        : params["*"];
+    if (!filename) {
+        return reply
+            .status(400)
+            .send({ error: "required param 'filename'", code: 400 });
+    }
+    if (filename.includes?.("../")) {
+        return reply.status(403).send({ error: "wrong params", code: 403 });
+    }
+    const filepath = filename.startsWith("files/")
         ? filename
-        : path.join('files', filename);
-    // download
-    const fp = providers({});
-    const fileStream = await fp.downloadFile(filepath);
-    if (!fileStream)
-        return { error: `Файл не знайдено - ${filename}`, status: 404 };
+        : path.join("files", filename);
+    const hookData = await applyHook("preDownload", {
+        user,
+        relpath: filepath,
+        reply,
+    });
+    if (hookData)
+        return hookData;
+    const fileStream = await downloadFile(filepath);
+    if (!fileStream) {
+        return reply
+            .status(404)
+            .send({ error: `Файл не знайдено - ${filename}`, code: 404 });
+    }
     const headers = {
-        'Content-Disposition': `attachment; filename=${path.basename(filename)}`,
-        'Content-Type': getMimeType(filepath),
+        "Content-Disposition": `attachment; filename=${path.basename(filename)}`,
+        "Content-Type": getMimeType(filepath),
     };
+    logger.file("file/download", { filepath: params["*"], uid: user?.uid });
     reply.headers(headers);
     return fileStream;
 }
-export default download;

package/dist/server/routes/file/controllers/files.d.ts

@@ -17,9 +17,10 @@ import type { FastifyReply } from "fastify";
  * @returns {Object} headers Заголовки HTTP
  * @returns {String} pipe Шлях до файла для скачування або відображення
  */
-export default function getFile({ params }: {
+export default function getFile({ params, user }: {
     params: {
         "*": string;
     };
+    user?: Record<string, any>;
 }, reply: FastifyReply): Promise<any>;
 //# sourceMappingURL=files.d.ts.map

package/dist/server/routes/file/controllers/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAU5C;;;;;;;;;;;;;;;;;GAiBG;AAEH,wBAA8B,OAAO,CACnC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACvC,KAAK,EAAE,YAAY,gBAgDpB"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../../server/routes/file/controllers/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAW5C;;;;;;;;;;;;;;;;;GAiBG;AAEH,wBAA8B,OAAO,CACnC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,EACzE,KAAK,EAAE,YAAY,gBAqDpB"}