@palbase/backend 18.0.0 → 20.0.0

package/dist/bin/palbase-backend.cjs

@@ -1330,7 +1330,7 @@ function renderPath(template, tokens) {
   return template.replaceAll("{userId}", sanitizeSegment(tokens.userId ?? "anonymous")).replaceAll("{uploadId}", sanitizeSegment(tokens.uploadId)).replaceAll("{filename}", sanitizeSegment(tokens.filename ?? "file"));
 }
 function sanitizeSegment(raw) {
-  const cleaned = raw.replace(/[-]/g, "").replace(/[/\\]/g, "-").replace(/\.{2,}/g, ".").replace(/^\.+/, "").trim();
+  const cleaned = raw.replace(/[\x00-\x1F\x7F]/g, "").replace(/[/\\]/g, "-").replace(/\.{2,}/g, ".").replace(/^\.+/, "").trim();
   return cleaned === "" ? "file" : cleaned.slice(0, 200);
 }
 function grantFor(entry, ctx, bucketLimits) {
@@ -1428,6 +1428,39 @@ async function createApp(opts) {
   const requestALS = opts.runtimeHooks?.__requestALS ?? __requestALS;
   const uploadSecret = config.uploadSecret ?? "";
   const completions = new CompletionLedger();
+  function buildServices(db) {
+    return {
+      Database: db.client,
+      Cache: cache,
+      Log: log,
+      Documents: modules.Documents ?? stubModule("Documents"),
+      Storage: modules.Storage ?? stubModule("Storage"),
+      Notifications: modules.Notifications ?? stubModule("Notifications"),
+      Flags: modules.Flags ?? stubModule("Flags"),
+      Realtime: modules.Realtime ?? stubModule("Realtime"),
+      Purchases: modules.Purchases ?? stubModule("Purchases"),
+      // Named, never undefined. A backend started without a secrets client
+      // that returned `undefined` here would fail inside the handler as
+      // "Cannot read properties of undefined", which says nothing about what
+      // to configure — the stub says the name and the variable.
+      Secrets: modules.Secrets ?? stubModule("Secrets")
+    };
+  }
+  async function runInServiceScope(fn) {
+    const db = createRequestDatabase(sql, {
+      role: config.dbRole,
+      serviceRole: config.dbServiceRole,
+      claimsJson: "{}"
+    });
+    try {
+      const out = await runWithRuntime(buildServices(db), fn);
+      await db.commit();
+      return out;
+    } catch (err) {
+      await db.rollback(err);
+      throw err;
+    }
+  }
   async function handleAuthorize(req, requestId) {
     if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
       return envelope("unauthorized", "This endpoint is not callable directly", 401, requestId);
@@ -1594,22 +1627,7 @@ async function createApp(opts) {
       claimsJson: JSON.stringify(claims ?? {})
     });
     try {
-      const services = {
-        Database: db.client,
-        Cache: cache,
-        Log: log,
-        Documents: modules.Documents ?? stubModule("Documents"),
-        Storage: modules.Storage ?? stubModule("Storage"),
-        Notifications: modules.Notifications ?? stubModule("Notifications"),
-        Flags: modules.Flags ?? stubModule("Flags"),
-        Realtime: modules.Realtime ?? stubModule("Realtime"),
-        Purchases: modules.Purchases ?? stubModule("Purchases"),
-        // Named, never undefined. A backend started without a secrets client
-        // that returned `undefined` here would fail inside the handler as
-        // "Cannot read properties of undefined", which says nothing about what
-        // to configure — the stub says the name and the variable.
-        Secrets: modules.Secrets ?? stubModule("Secrets")
-      };
+      const services = buildServices(db);
       const result = await runWithRuntime(services, () => {
         const box = requestALS.getStore();
         if (box) {
@@ -1672,6 +1690,7 @@ async function createApp(opts) {
     handle,
     routes,
     config,
+    runInServiceScope,
     async shutdown() {
       const closable = sql;
       await closable.close?.();