@ossy/cli 3.4.0 → 3.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/cli",
-  "version": "3.4.0",
+  "version": "3.5.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ossy-se/packages.git"
@@ -20,8 +20,8 @@
   },
   "dependencies": {
     "@babel/parser": "^7.28.6",
-    "@ossy/app": "^3.4.0",
-    "@ossy/sdk": "^3.4.0",
+    "@ossy/app": "^3.5.1",
+    "@ossy/sdk": "^3.5.0",
     "arg": "^5.0.2",
     "glob": "^13.0.6"
   },
@@ -33,5 +33,5 @@
     "/src",
     "README.md"
   ],
-  "gitHead": "d36b69444268d172bc3e8e1dc77e67afc63f8650"
+  "gitHead": "cafa2d72ae9c4f6197ebec0b5b857919a062ceff"
 }

package/src/app/publish.js

@@ -184,9 +184,12 @@ export async function publish (options) {
     }
 
     try {
-      await uploadFileToUrl(fileMeta, uploadUrl)
+      await uploadFileToUrl(fileMeta, uploadUrl, {
+        authorization: authToken,
+        workspaceId,
+      })
     } catch (err) {
-      logError({ message: `[@ossy/cli] app publish: S3 PUT failed for ${f}: ${err.message}` })
+      logError({ message: `[@ossy/cli] app publish: PUT failed for ${f}: ${err.message}` })
       errors++
       return
     }

package/src/call/cli.js

@@ -304,7 +304,10 @@ async function call (args) {
     const uploadUrl = result && result.content && result.content.uploadUrl
     if (uploadUrl) {
       try {
-        await uploadFileToUrl(fileMeta, uploadUrl)
+        await uploadFileToUrl(fileMeta, uploadUrl, {
+          authorization: auth || undefined,
+          workspaceId: workspaceId || undefined,
+        })
       } catch (err) {
         process.stderr.write(`[@ossy/cli] call: upload PUT failed: ${err.message || err}\n`)
         process.exit(1)

package/src/file.js

@@ -42,27 +42,51 @@ export function guessContentType (filePath) {
 }
 
 /**
- * PUT file bytes to a presigned S3 upload URL.
+ * Detect filesystem-backend upload URLs (`/local-storage?key=…`).
+ * S3 presigned URLs must not receive session cookies or Authorization headers.
+ * @param {string} url
+ * @returns {boolean}
+ */
+export function isLocalStorageUploadUrl (url) {
+  if (!url || typeof url !== 'string') return false
+  try {
+    const parsed = new URL(url, 'http://localhost')
+    return parsed.pathname === '/local-storage' || parsed.pathname.endsWith('/local-storage')
+  } catch {
+    return false
+  }
+}
+
+/**
+ * PUT file bytes to an upload URL (S3 presigned or local-storage).
+ * For local-storage, pass authorization + workspaceId so the route can enforce permissions.
  * Throws on network error or non-2xx response.
  * @param {{ absPath: string, size: number, type: string }} fileMeta
  * @param {string} uploadUrl
+ * @param {{ authorization?: string, workspaceId?: string }} [auth]
  * @returns {Promise<void>}
  */
-export async function uploadFileToUrl (fileMeta, uploadUrl) {
+export async function uploadFileToUrl (fileMeta, uploadUrl, auth = {}) {
   const { readFile } = await import('node:fs/promises')
   const body = await readFile(fileMeta.absPath)
+  /** @type {Record<string, string>} */
+  const headers = {
+    'Content-Type': fileMeta.type,
+    'Content-Length': String(fileMeta.size),
+  }
+  if (isLocalStorageUploadUrl(uploadUrl)) {
+    if (auth.authorization) headers.Authorization = auth.authorization
+    if (auth.workspaceId) headers.workspaceId = auth.workspaceId
+  }
   const res = await fetch(uploadUrl, {
     method: 'PUT',
-    headers: {
-      'Content-Type': fileMeta.type,
-      'Content-Length': String(fileMeta.size),
-    },
+    headers,
     body,
   })
   if (!res.ok) {
     const t = await res.text().catch(() => '')
     throw new Error(
-      `S3 PUT failed: HTTP ${res.status}${t ? ' — ' + t.slice(0, 200) : ''}`
+      `Upload PUT failed: HTTP ${res.status}${t ? ' — ' + t.slice(0, 200) : ''}`
     )
   }
 }

package/src/upload-dir/cli.js

@@ -252,10 +252,13 @@ export async function handler (args) {
     }
 
     try {
-      await uploadFileToUrl(fileMeta, uploadUrl)
+      await uploadFileToUrl(fileMeta, uploadUrl, {
+        authorization: auth || undefined,
+        workspaceId: workspaceId || undefined,
+      })
       filesUploaded++
     } catch (err) {
-      logError({ message: `[@ossy/cli] upload-dir: S3 PUT failed for ${f}: ${err.message}` })
+      logError({ message: `[@ossy/cli] upload-dir: PUT failed for ${f}: ${err.message}` })
       errors++
     }
   }