@proteinjs/db-file 1.7.4 → 1.7.6

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.7.6](https://github.com/proteinjs/db/compare/@proteinjs/db-file@1.7.5...@proteinjs/db-file@1.7.6) (2026-08-29)
+
+**Note:** Version bump only for package @proteinjs/db-file
+
+
+
+
+
+## [1.7.5](https://github.com/proteinjs/db/compare/@proteinjs/db-file@1.7.4...@proteinjs/db-file@1.7.5) (2026-08-28)
+
+
+### Bug Fixes
+
+* file byte access gates on the file row — the browser-facing byte ops refuse ids whose row the caller cannot reach ([3ba4a7c](https://github.com/proteinjs/db/commit/3ba4a7cf50d5055998ea3ccc479068fe8262aad0))
+
+
+
+
+
 ## [1.7.4](https://github.com/proteinjs/db/compare/@proteinjs/db-file@1.7.3...@proteinjs/db-file@1.7.4) (2026-08-28)
 
 

package/dist/src/FileStorage.d.ts

@@ -55,8 +55,18 @@ export declare class FileStorage implements FileStorageService {
     getFile(fileId: string): Promise<File>;
     /**
      * Retrieves the data chunks associated with a given file.
+     *
+     * Gated on the {@link getFile} row read — the same two-legged access decision every serving
+     * path derives from (the caller's SCOPED read, else shared-content reachability), so bytes are
+     * exactly as reachable as the row that names them. The gate lives here because this is the
+     * browser-facing service boundary (`FileStorageService` is `allUsers`) and the driver byte ops
+     * below are deliberately unscoped. Server-side doors that make their OWN documented access
+     * decision (the avatar route, issue/ticket attachment doors) read bytes through
+     * `FileStorage.getDriver()` instead.
      * @param fileId - The `id` of the file.
      * @returns The file data as a single string.
+     * @throws When the file row does not exist or is not readable by the caller — the same named
+     *         miss either way, so existence is not leaked to unauthorized callers.
      */
     getFileData(fileId: string): Promise<string>;
     /**
@@ -75,8 +85,15 @@ export declare class FileStorage implements FileStorageService {
     }): Promise<string | undefined>;
     /**
      * Updates the data chunks associated with a given file.
+     *
+     * Gated on the caller's SCOPED row read — owner scope is the write grant on ScopedRecords
+     * (the same authorization a scoped row update enforces). Deliberately STRICTER than
+     * {@link getFileData}: the {@link FileReachabilityResolver} leg widens READS only, so a
+     * share recipient who can read the bytes still cannot write them.
      * @param fileId - The `id` of the file.
      * @param data - The new data string to replace the existing data.
+     * @throws When the file row does not exist or is not writable by the caller — the same named
+     *         miss either way, so existence is not leaked to unauthorized callers.
      */
     updateFileData(fileId: string, data: string): Promise<void>;
     /**

package/dist/src/FileStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FileStorage.d.ts","sourceRoot":"","sources":["../../src/FileStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoC,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAyB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAInE;;;KAGK;AACL,eAAO,MAAM,cAAc,mBACiE,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,+BAAgC,SAAQ,QAAQ;IAC/D,SAAS,IAAI,iBAAiB,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,WAAY,YAAW,kBAAkB;IACpD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAoB;IAElC,eAAe;;;;MAIpB;IAEF;;;;;OAKG;IACH,MAAM,CAAC,SAAS,IAAI,iBAAiB;IAkBrC;;;;;OAKG;IACG,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/F;;;;;;;;;;;OAWG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB5C;;;;OAIG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD;;;;;;;;;;OAUG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAc7F;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrE;;;;;;OAMG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIhD"}
+{"version":3,"file":"FileStorage.d.ts","sourceRoot":"","sources":["../../src/FileStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoC,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAyB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAInE;;;KAGK;AACL,eAAO,MAAM,cAAc,mBACiE,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,+BAAgC,SAAQ,QAAQ;IAC/D,SAAS,IAAI,iBAAiB,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,WAAY,YAAW,kBAAkB;IACpD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAoB;IAElC,eAAe;;;;MAIpB;IAEF;;;;;OAKG;IACH,MAAM,CAAC,SAAS,IAAI,iBAAiB;IAkBrC;;;;;OAKG;IACG,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/F;;;;;;;;;;;OAWG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB5C;;;;;;;;;;;;;;OAcG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASlD;;;;;;;;;;OAUG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAc7F;;;;;;;;;;;OAWG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjE;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrE;;;;;;OAMG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIhD"}

package/dist/src/FileStorage.js

@@ -158,15 +158,32 @@ var FileStorage = /** @class */ (function () {
     };
     /**
      * Retrieves the data chunks associated with a given file.
+     *
+     * Gated on the {@link getFile} row read — the same two-legged access decision every serving
+     * path derives from (the caller's SCOPED read, else shared-content reachability), so bytes are
+     * exactly as reachable as the row that names them. The gate lives here because this is the
+     * browser-facing service boundary (`FileStorageService` is `allUsers`) and the driver byte ops
+     * below are deliberately unscoped. Server-side doors that make their OWN documented access
+     * decision (the avatar route, issue/ticket attachment doors) read bytes through
+     * `FileStorage.getDriver()` instead.
      * @param fileId - The `id` of the file.
      * @returns The file data as a single string.
+     * @throws When the file row does not exist or is not readable by the caller — the same named
+     *         miss either way, so existence is not leaked to unauthorized callers.
      */
     FileStorage.prototype.getFileData = function (fileId) {
         return __awaiter(this, void 0, void 0, function () {
+            var file;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, FileStorage.getDriver().getFileData(fileId)];
-                    case 1: return [2 /*return*/, _a.sent()];
+                    case 0: return [4 /*yield*/, this.getFile(fileId)];
+                    case 1:
+                        file = _a.sent();
+                        if (!file) {
+                            throw new Error("File not found: ".concat(fileId));
+                        }
+                        return [4 /*yield*/, FileStorage.getDriver().getFileData(fileId)];
+                    case 2: return [2 /*return*/, _a.sent()];
                 }
             });
         });
@@ -205,15 +222,31 @@ var FileStorage = /** @class */ (function () {
     };
     /**
      * Updates the data chunks associated with a given file.
+     *
+     * Gated on the caller's SCOPED row read — owner scope is the write grant on ScopedRecords
+     * (the same authorization a scoped row update enforces). Deliberately STRICTER than
+     * {@link getFileData}: the {@link FileReachabilityResolver} leg widens READS only, so a
+     * share recipient who can read the bytes still cannot write them.
      * @param fileId - The `id` of the file.
      * @param data - The new data string to replace the existing data.
+     * @throws When the file row does not exist or is not writable by the caller — the same named
+     *         miss either way, so existence is not leaked to unauthorized callers.
      */
     FileStorage.prototype.updateFileData = function (fileId, data) {
         return __awaiter(this, void 0, void 0, function () {
+            var db, file;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, FileStorage.getDriver().updateFileData(fileId, data)];
+                    case 0:
+                        db = (0, user_1.getScopedDb)();
+                        return [4 /*yield*/, db.get(tables_1.tables.File, { id: fileId })];
                     case 1:
+                        file = _a.sent();
+                        if (!file) {
+                            throw new Error("File not found: ".concat(fileId));
+                        }
+                        return [4 /*yield*/, FileStorage.getDriver().updateFileData(fileId, data)];
+                    case 2:
                         _a.sent();
                         return [2 /*return*/];
                 }

package/dist/src/FileStorage.js.map

@@ -1 +1 @@
-{"version":3,"file":"FileStorage.js","sourceRoot":"","sources":["../../src/FileStorage.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAiF;AAEjF,0CAAyC;AACzC,oEAA0F;AAE1F,uEAA0E;AAC1E,oDAAmE;AACnE,4CAA2C;AAC3C,6DAA4D;AAE5D;;;KAGK;AACE,IAAM,cAAc,GAAG;IAC5B,OAAA,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAE,IAAA,0CAAqB,GAAkB;AAA1F,CAA0F,CAAC;AADhF,QAAA,cAAc,kBACkE;AAS7F;;;;GAIG;AACH;IAAA;QAGS,oBAAe,GAAG;YACvB,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAI;aACf;SACF,CAAC;IAyIJ,CAAC;IAvIC;;;;;OAKG;IACI,qBAAS,GAAhB;QACE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;YACvB,IAAM,oBAAoB,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CACxD,oDAAoD,CACrD,CAAC;YACF,IAAI,oBAAoB,EAAE;gBACxB,WAAW,CAAC,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;aACvD;iBAAM;gBACL,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC;oBACvC,OAAO,EAAE,2EAA2E;iBACrF,CAAC,CAAC;gBACH,WAAW,CAAC,MAAM,GAAG,IAAI,yCAAmB,EAAE,CAAC;aAChD;SACF;QAED,OAAO,WAAW,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACG,gCAAU,GAAhB,UAAiB,YAA4C,EAAE,QAAgB;;;;;;wBACvE,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,IAAI,EAAE,YAAY,CAAC,EAAA;;wBAAjD,IAAI,GAAG,SAA0C;wBACvD,qBAAM,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAAxD,SAAwD,CAAC;wBACzD,sBAAO,IAAI,EAAC;;;;KACb;IAED;;;;;;;;;;;OAWG;IACG,6BAAO,GAAb,UAAc,MAAc;;;;;;wBACpB,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,GAAG,CAAC,eAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,IAAI,EAAE;4BACR,sBAAO,IAAI,EAAC;yBACb;8BAEoD,EAA9B,SAAA,uDAA4B,GAAE;;;6BAA9B,CAAA,cAA8B,CAAA;wBAA1C,QAAQ;wBACb,qBAAM,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAA;;6BAA1C,SAA0C,EAA1C,wBAA0C;wBAGrC,qBAAM,IAAA,0BAAmB,GAAE,CAAC,GAAG,CAAC,eAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAFnE,sFAAsF;oBACtF,sEAAsE;oBACtE,sBAAO,SAA4D,EAAC;;wBAJjD,IAA8B,CAAA;;4BAQrD,sBAAO,IAAI,EAAC;;;;KACb;IAED;;;;OAIG;IACG,iCAAW,GAAjB,UAAkB,MAAc;;;;4BACvB,qBAAM,WAAW,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAA;4BAAxD,sBAAO,SAAiD,EAAC;;;;KAC1D;IAED;;;;;;;;;;OAUG;IACG,kCAAY,GAAlB,UAAmB,MAAc,EAAE,OAA4B;;;;;4BAChD,qBAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAA;;wBAAjC,IAAI,GAAG,SAA0B;wBACvC,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,0BAAmB,MAAM,CAAE,CAAC,CAAC;yBAC9C;wBAEK,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;wBACvC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE;4BACxB,sBAAO,SAAS,EAAC;yBAClB;wBAEM,qBAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAA;4BAAjD,sBAAO,SAA0C,EAAC;;;;KACnD;IAED;;;;OAIG;IACG,oCAAc,GAApB,UAAqB,MAAc,EAAE,IAAY;;;;4BAC/C,qBAAM,WAAW,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAA;;wBAA1D,SAA0D,CAAC;;;;;KAC5D;IAED;;;OAGG;IACG,gCAAU,GAAhB,UAAiB,IAAoC;;;;;;wBAC7C,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACzB,qBAAM,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAA;;wBAAlC,SAAkC,CAAC;wBAE7B,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;6BACnC,MAAM,CAAC,UAAU,EAAjB,wBAAiB;wBACnB,qBAAM,MAAM,CAAC,UAAU,CAAC,IAAY,CAAC,EAAA;;wBAArC,SAAqC,CAAC;;;;;;KAEzC;IAED;;;;;;OAMG;IACG,gCAAU,GAAhB,UAAiB,MAAc;;;;;;wBACvB,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACzB,qBAAM,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IACH,kBAAC;AAAD,CAAC,AAhJD,IAgJC;AAhJY,kCAAW"}
+{"version":3,"file":"FileStorage.js","sourceRoot":"","sources":["../../src/FileStorage.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAAiF;AAEjF,0CAAyC;AACzC,oEAA0F;AAE1F,uEAA0E;AAC1E,oDAAmE;AACnE,4CAA2C;AAC3C,6DAA4D;AAE5D;;;KAGK;AACE,IAAM,cAAc,GAAG;IAC5B,OAAA,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAE,IAAA,0CAAqB,GAAkB;AAA1F,CAA0F,CAAC;AADhF,QAAA,cAAc,kBACkE;AAS7F;;;;GAIG;AACH;IAAA;QAGS,oBAAe,GAAG;YACvB,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAI;aACf;SACF,CAAC;IAqKJ,CAAC;IAnKC;;;;;OAKG;IACI,qBAAS,GAAhB;QACE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;YACvB,IAAM,oBAAoB,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CACxD,oDAAoD,CACrD,CAAC;YACF,IAAI,oBAAoB,EAAE;gBACxB,WAAW,CAAC,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;aACvD;iBAAM;gBACL,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC;oBACvC,OAAO,EAAE,2EAA2E;iBACrF,CAAC,CAAC;gBACH,WAAW,CAAC,MAAM,GAAG,IAAI,yCAAmB,EAAE,CAAC;aAChD;SACF;QAED,OAAO,WAAW,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACG,gCAAU,GAAhB,UAAiB,YAA4C,EAAE,QAAgB;;;;;;wBACvE,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,IAAI,EAAE,YAAY,CAAC,EAAA;;wBAAjD,IAAI,GAAG,SAA0C;wBACvD,qBAAM,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAAxD,SAAwD,CAAC;wBACzD,sBAAO,IAAI,EAAC;;;;KACb;IAED;;;;;;;;;;;OAWG;IACG,6BAAO,GAAb,UAAc,MAAc;;;;;;wBACpB,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,GAAG,CAAC,eAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,IAAI,EAAE;4BACR,sBAAO,IAAI,EAAC;yBACb;8BAEoD,EAA9B,SAAA,uDAA4B,GAAE;;;6BAA9B,CAAA,cAA8B,CAAA;wBAA1C,QAAQ;wBACb,qBAAM,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAA;;6BAA1C,SAA0C,EAA1C,wBAA0C;wBAGrC,qBAAM,IAAA,0BAAmB,GAAE,CAAC,GAAG,CAAC,eAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAFnE,sFAAsF;oBACtF,sEAAsE;oBACtE,sBAAO,SAA4D,EAAC;;wBAJjD,IAA8B,CAAA;;4BAQrD,sBAAO,IAAI,EAAC;;;;KACb;IAED;;;;;;;;;;;;;;OAcG;IACG,iCAAW,GAAjB,UAAkB,MAAc;;;;;4BACjB,qBAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAA;;wBAAjC,IAAI,GAAG,SAA0B;wBACvC,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,0BAAmB,MAAM,CAAE,CAAC,CAAC;yBAC9C;wBAEM,qBAAM,WAAW,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAA;4BAAxD,sBAAO,SAAiD,EAAC;;;;KAC1D;IAED;;;;;;;;;;OAUG;IACG,kCAAY,GAAlB,UAAmB,MAAc,EAAE,OAA4B;;;;;4BAChD,qBAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAA;;wBAAjC,IAAI,GAAG,SAA0B;wBACvC,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,0BAAmB,MAAM,CAAE,CAAC,CAAC;yBAC9C;wBAEK,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;wBACvC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE;4BACxB,sBAAO,SAAS,EAAC;yBAClB;wBAEM,qBAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAA;4BAAjD,sBAAO,SAA0C,EAAC;;;;KACnD;IAED;;;;;;;;;;;OAWG;IACG,oCAAc,GAApB,UAAqB,MAAc,EAAE,IAAY;;;;;;wBACzC,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,GAAG,CAAC,eAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,0BAAmB,MAAM,CAAE,CAAC,CAAC;yBAC9C;wBAED,qBAAM,WAAW,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAA;;wBAA1D,SAA0D,CAAC;;;;;KAC5D;IAED;;;OAGG;IACG,gCAAU,GAAhB,UAAiB,IAAoC;;;;;;wBAC7C,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACzB,qBAAM,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAA;;wBAAlC,SAAkC,CAAC;wBAE7B,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;6BACnC,MAAM,CAAC,UAAU,EAAjB,wBAAiB;wBACnB,qBAAM,MAAM,CAAC,UAAU,CAAC,IAAY,CAAC,EAAA;;wBAArC,SAAqC,CAAC;;;;;;KAEzC;IAED;;;;;;OAMG;IACG,gCAAU,GAAhB,UAAiB,MAAc;;;;;;wBACvB,EAAE,GAAG,IAAA,kBAAW,GAAE,CAAC;wBACzB,qBAAM,EAAE,CAAC,MAAM,CAAC,eAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IACH,kBAAC;AAAD,CAAC,AA5KD,IA4KC;AA5KY,kCAAW"}

package/dist/test/FileByteAccess.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=FileByteAccess.test.d.ts.map

package/dist/test/FileByteAccess.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileByteAccess.test.d.ts","sourceRoot":"","sources":["../../test/FileByteAccess.test.ts"],"names":[],"mappings":""}

package/dist/test/FileByteAccess.test.js

@@ -0,0 +1,252 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var reflection_1 = require("@proteinjs/reflection");
+var FileStorage_1 = require("../src/FileStorage");
+var DbFileStorageDriver_1 = require("../src/DbFileStorageDriver");
+var FileTestEnvironment_1 = require("./FileTestEnvironment");
+/** Every byte value once — a payload that corrupts under any text/base64 mix-up. */
+var rawBytes = Buffer.from(Array.from({ length: 256 }, function (_, i) { return i; }));
+var rawBase64 = rawBytes.toString('base64');
+/** A same-length replacement payload, byte-distinct at every position — the poisoning attempt. */
+var poisonBytes = Buffer.from(Array.from({ length: 256 }, function (_, i) { return 255 - i; }));
+var poisonBase64 = poisonBytes.toString('base64');
+/**
+ * The byte-access gates on the browser-facing service (FileStorageService is `allUsers`, so
+ * these methods are every logged-in user's to call with any file id they can guess or leak):
+ *
+ * - **Reads** (`getFileData`): gated on the {@link FileStorage.getFile} row read — the same
+ *   two-legged access decision every serving path derives from (the caller's SCOPED read, else
+ *   the FileReachabilityResolver shared-content leg). Bytes are exactly as reachable as the row
+ *   that names them. Ungated, a foreign file id read another user's bytes outright (the driver
+ *   byte ops are deliberately unscoped — the access wall lives at this service boundary).
+ * - **Writes** (`updateFileData`): gated on the caller's SCOPED row read — owner scope is the
+ *   write grant on ScopedRecords. Stricter than reads: the resolver leg widens READS only, so a
+ *   share recipient who can read bytes still cannot write them. Ungated, a foreign file id let
+ *   any caller poison another user's bytes (with the DbFileStorageDriver: caller-scoped chunk
+ *   inserts landing beside the owner's — this suite runs that real driver so the intact-bytes
+ *   assertions prove no chunk ever landed).
+ *
+ * The resolver is stubbed at the seam (content packages sit above db-file); denial is the named
+ * `File not found` — existence is not leaked to unauthorized callers.
+ */
+var testEnv = new FileTestEnvironment_1.FileTestEnvironment();
+var objectCache = function () { return reflection_1.SourceRepository.get().objectCache; };
+var owner;
+var recipient;
+var stranger;
+/** File ids the stub resolver reports as reachable for the current user. */
+var reachableFileIds = new Set();
+/** How many times the seam was consulted — the owner's scoped leg must never pay for it. */
+var resolverConsultations = 0;
+beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, testEnv.beforeAll()];
+            case 1:
+                _a.sent();
+                // The seam getFile consults on a scoped-read miss, stubbed (the real thought-media resolver
+                // lives above this package).
+                objectCache()['@proteinjs/db-file/FileReachabilityResolver'] = [
+                    {
+                        canReadViaReference: function (fileId) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                resolverConsultations++;
+                                return [2 /*return*/, reachableFileIds.has(fileId)];
+                            });
+                        }); },
+                    },
+                ];
+                // The real chunked driver: write-gate bites are proven at the chunk-row level, not a mock.
+                testEnv.setDriver(new DbFileStorageDriver_1.DbFileStorageDriver());
+                return [4 /*yield*/, testEnv.createUser({ name: 'File owner', email: 'byte-owner@test.local' })];
+            case 2:
+                owner = _a.sent();
+                return [4 /*yield*/, testEnv.createUser({ name: 'Share recipient', email: 'byte-recipient@test.local' })];
+            case 3:
+                recipient = _a.sent();
+                return [4 /*yield*/, testEnv.createUser({ name: 'Stranger', email: 'byte-stranger@test.local' })];
+            case 4:
+                stranger = _a.sent();
+                testEnv.actAs(owner);
+                return [2 /*return*/];
+        }
+    });
+}); });
+afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                delete objectCache()['@proteinjs/db-file/FileReachabilityResolver'];
+                return [4 /*yield*/, testEnv.afterAll()];
+            case 1:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); });
+beforeEach(function () {
+    reachableFileIds.clear();
+    resolverConsultations = 0;
+    testEnv.actAs(owner);
+});
+var createOwnerFile = function (name) { return __awaiter(void 0, void 0, void 0, function () {
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, new FileStorage_1.FileStorage().createFile({ name: name, type: 'application/octet-stream', size: rawBytes.length }, rawBase64)];
+            case 1: return [2 /*return*/, _a.sent()];
+        }
+    });
+}); };
+describe('byte reads gate on the file-row read (the getFile decision)', function () {
+    it('the owner reads their bytes through the scoped leg alone — resolvers are never consulted', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var file, fileDataBase64;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, createOwnerFile('own-bytes.bin')];
+                case 1:
+                    file = _a.sent();
+                    return [4 /*yield*/, new FileStorage_1.FileStorage().getFileData(file.id)];
+                case 2:
+                    fileDataBase64 = _a.sent();
+                    expect(fileDataBase64).toEqual(rawBase64);
+                    expect(resolverConsultations).toEqual(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("THE VULN (read): a stranger holding only the file id is DENIED another user's bytes", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var file;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, createOwnerFile('private-bytes.bin')];
+                case 1:
+                    file = _a.sent();
+                    testEnv.actAs(stranger);
+                    return [4 /*yield*/, expect(new FileStorage_1.FileStorage().getFileData(file.id)).rejects.toThrow("File not found: ".concat(file.id))];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a shared-content recipient (resolver-vouched) reads the bytes byte-identical', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var file, fileDataBase64;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, createOwnerFile('shared-bytes.bin')];
+                case 1:
+                    file = _a.sent();
+                    reachableFileIds.add(file.id);
+                    testEnv.actAs(recipient);
+                    return [4 /*yield*/, new FileStorage_1.FileStorage().getFileData(file.id)];
+                case 2:
+                    fileDataBase64 = _a.sent();
+                    expect(fileDataBase64).toEqual(rawBase64);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+describe('byte writes gate on the caller WRITING the row (owner scope; read-reachability never grants it)', function () {
+    it("THE VULN (write): a stranger holding only the file id cannot poison another user's bytes", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var file, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, createOwnerFile('unpoisonable.bin')];
+                case 1:
+                    file = _b.sent();
+                    testEnv.actAs(stranger);
+                    return [4 /*yield*/, expect(new FileStorage_1.FileStorage().updateFileData(file.id, poisonBase64)).rejects.toThrow("File not found: ".concat(file.id))];
+                case 2:
+                    _b.sent();
+                    // The outcome that matters: no chunk landed — the owner's bytes read back untouched.
+                    testEnv.actAs(owner);
+                    _a = expect;
+                    return [4 /*yield*/, new FileStorage_1.FileStorage().getFileData(file.id)];
+                case 3:
+                    _a.apply(void 0, [_b.sent()]).toEqual(rawBase64);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("read-reachability does NOT grant write: a vouched recipient's byte write is denied, bytes intact", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var file, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, createOwnerFile('read-only-share.bin')];
+                case 1:
+                    file = _c.sent();
+                    reachableFileIds.add(file.id);
+                    testEnv.actAs(recipient);
+                    _a = expect;
+                    return [4 /*yield*/, new FileStorage_1.FileStorage().getFileData(file.id)];
+                case 2:
+                    _a.apply(void 0, [_c.sent()]).toEqual(rawBase64);
+                    return [4 /*yield*/, expect(new FileStorage_1.FileStorage().updateFileData(file.id, poisonBase64)).rejects.toThrow("File not found: ".concat(file.id))];
+                case 3:
+                    _c.sent();
+                    testEnv.actAs(owner);
+                    _b = expect;
+                    return [4 /*yield*/, new FileStorage_1.FileStorage().getFileData(file.id)];
+                case 4:
+                    _b.apply(void 0, [_c.sent()]).toEqual(rawBase64);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the owner replaces their bytes wholesale', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var file, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, createOwnerFile('rewritable.bin')];
+                case 1:
+                    file = _b.sent();
+                    return [4 /*yield*/, new FileStorage_1.FileStorage().updateFileData(file.id, poisonBase64)];
+                case 2:
+                    _b.sent();
+                    _a = expect;
+                    return [4 /*yield*/, new FileStorage_1.FileStorage().getFileData(file.id)];
+                case 3:
+                    _a.apply(void 0, [_b.sent()]).toEqual(poisonBase64);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=FileByteAccess.test.js.map

package/dist/test/FileByteAccess.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileByteAccess.test.js","sourceRoot":"","sources":["../../test/FileByteAccess.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAyD;AAGzD,kDAAiD;AACjD,kEAAiE;AACjE,6DAA4D;AAE5D,oFAAoF;AACpF,IAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,EAAD,CAAC,CAAC,CAAC,CAAC;AACvE,IAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,kGAAkG;AAClG,IAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,GAAG,GAAG,CAAC,EAAP,CAAO,CAAC,CAAC,CAAC;AAChF,IAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;;;GAkBG;AAEH,IAAM,OAAO,GAAG,IAAI,yCAAmB,EAAE,CAAC;AAE1C,IAAM,WAAW,GAAG,cAAM,OAAC,6BAAgB,CAAC,GAAG,EAA2C,CAAC,WAAW,EAA5E,CAA4E,CAAC;AAEvG,IAAI,KAAW,CAAC;AAChB,IAAI,SAAe,CAAC;AACpB,IAAI,QAAc,CAAC;AACnB,4EAA4E;AAC5E,IAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC3C,4FAA4F;AAC5F,IAAI,qBAAqB,GAAG,CAAC,CAAC;AAE9B,SAAS,CAAC;;;oBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;gBAAzB,SAAyB,CAAC;gBAC1B,4FAA4F;gBAC5F,6BAA6B;gBAC7B,WAAW,EAAE,CAAC,6CAA6C,CAAC,GAAG;oBAC7D;wBACE,mBAAmB,EAAE,UAAO,MAAc;;gCACxC,qBAAqB,EAAE,CAAC;gCACxB,sBAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAC;;6BACrC;qBACF;iBACF,CAAC;gBACF,2FAA2F;gBAC3F,OAAO,CAAC,SAAS,CAAC,IAAI,yCAAmB,EAAE,CAAC,CAAC;gBACrC,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;gBAAxF,KAAK,GAAG,SAAgF,CAAC;gBAC7E,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,EAAA;;gBAArG,SAAS,GAAG,SAAyF,CAAC;gBAC3F,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,EAAA;;gBAA5F,QAAQ,GAAG,SAAiF,CAAC;gBAC7F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;;;;KACtB,CAAC,CAAC;AAEH,QAAQ,CAAC;;;;gBACP,OAAO,WAAW,EAAE,CAAC,6CAA6C,CAAC,CAAC;gBACpE,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;gBAAxB,SAAwB,CAAC;;;;KAC1B,CAAC,CAAC;AAEH,UAAU,CAAC;IACT,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACzB,qBAAqB,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,IAAM,eAAe,GAAG,UAAO,IAAY;;;oBACzC,qBAAM,IAAI,yBAAW,EAAE,CAAC,UAAU,CAChC,EAAE,IAAI,MAAA,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAU,EACzE,SAAS,CACV,EAAA;oBAHD,sBAAA,SAGC,EAAA;;;KAAA,CAAC;AAEJ,QAAQ,CAAC,6DAA6D,EAAE;IACtE,EAAE,CAAC,0FAA0F,EAAE;;;;wBAChF,qBAAM,eAAe,CAAC,eAAe,CAAC,EAAA;;oBAA7C,IAAI,GAAG,SAAsC;oBAE5B,qBAAM,IAAI,yBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAEnE,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,MAAM,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;;;;SAC1C,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE;;;;wBAC3E,qBAAM,eAAe,CAAC,mBAAmB,CAAC,EAAA;;oBAAjD,IAAI,GAAG,SAA0C;oBAEvD,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACxB,qBAAM,MAAM,CAAC,IAAI,yBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAmB,IAAI,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAAlG,SAAkG,CAAC;;;;SACpG,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE;;;;wBACpE,qBAAM,eAAe,CAAC,kBAAkB,CAAC,EAAA;;oBAAhD,IAAI,GAAG,SAAyC;oBACtD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAE9B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACF,qBAAM,IAAI,yBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAEnE,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iGAAiG,EAAE;IAC1G,EAAE,CAAC,0FAA0F,EAAE;;;;wBAChF,qBAAM,eAAe,CAAC,kBAAkB,CAAC,EAAA;;oBAAhD,IAAI,GAAG,SAAyC;oBAEtD,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACxB,qBAAM,MAAM,CAAC,IAAI,yBAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAmB,IAAI,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAAnH,SAAmH,CAAC;oBAEpH,qFAAqF;oBACrF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrB,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,yBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;;;;SACzE,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE;;;;wBACxF,qBAAM,eAAe,CAAC,qBAAqB,CAAC,EAAA;;oBAAnD,IAAI,GAAG,SAA4C;oBACzD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAE9B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACzB,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,yBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBACxE,qBAAM,MAAM,CAAC,IAAI,yBAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAmB,IAAI,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAAnH,SAAmH,CAAC;oBAEpH,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrB,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,yBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;;;;SACzE,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE;;;;wBAChC,qBAAM,eAAe,CAAC,gBAAgB,CAAC,EAAA;;oBAA9C,IAAI,GAAG,SAAuC;oBAEpD,qBAAM,IAAI,yBAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAA;;oBAA7D,SAA6D,CAAC;oBAE9D,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,yBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;;;;SAC5E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proteinjs/db-file",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "description": "File storage in the db",
   "publishConfig": {
     "access": "public"
@@ -22,7 +22,7 @@
     "watch": "reflection-watch"
   },
   "dependencies": {
-    "@proteinjs/db": "^1.36.0",
+    "@proteinjs/db": "^1.37.0",
     "@proteinjs/logger": "^1.0.21",
     "@proteinjs/reflection": "^1.2.0",
     "@proteinjs/server-api": "^3.0.11",
@@ -31,7 +31,7 @@
     "moment": "2.29.4"
   },
   "devDependencies": {
-    "@proteinjs/db-driver-spanner": "^1.24.0",
+    "@proteinjs/db-driver-spanner": "^1.25.0",
     "@proteinjs/reflection-build": "^2.0.1",
     "@types/jest": "29.5.5",
     "@types/node": "14.0.27",
@@ -46,5 +46,5 @@
   },
   "main": "./dist/generated/index.js",
   "types": "./dist/generated/index.d.ts",
-  "gitHead": "1b1a4fa4c3a6bbf2b4e236735ab505bfe7b54ef6"
+  "gitHead": "cb0fda126d5d2bd5b17d1bc13e87c2373eb61f52"
 }

package/src/FileStorage.ts

@@ -105,10 +105,25 @@ export class FileStorage implements FileStorageService {
 
   /**
    * Retrieves the data chunks associated with a given file.
+   *
+   * Gated on the {@link getFile} row read — the same two-legged access decision every serving
+   * path derives from (the caller's SCOPED read, else shared-content reachability), so bytes are
+   * exactly as reachable as the row that names them. The gate lives here because this is the
+   * browser-facing service boundary (`FileStorageService` is `allUsers`) and the driver byte ops
+   * below are deliberately unscoped. Server-side doors that make their OWN documented access
+   * decision (the avatar route, issue/ticket attachment doors) read bytes through
+   * `FileStorage.getDriver()` instead.
    * @param fileId - The `id` of the file.
    * @returns The file data as a single string.
+   * @throws When the file row does not exist or is not readable by the caller — the same named
+   *         miss either way, so existence is not leaked to unauthorized callers.
    */
   async getFileData(fileId: string): Promise<string> {
+    const file = await this.getFile(fileId);
+    if (!file) {
+      throw new Error(`File not found: ${fileId}`);
+    }
+
     return await FileStorage.getDriver().getFileData(fileId);
   }
 
@@ -139,10 +154,23 @@ export class FileStorage implements FileStorageService {
 
   /**
    * Updates the data chunks associated with a given file.
+   *
+   * Gated on the caller's SCOPED row read — owner scope is the write grant on ScopedRecords
+   * (the same authorization a scoped row update enforces). Deliberately STRICTER than
+   * {@link getFileData}: the {@link FileReachabilityResolver} leg widens READS only, so a
+   * share recipient who can read the bytes still cannot write them.
    * @param fileId - The `id` of the file.
    * @param data - The new data string to replace the existing data.
+   * @throws When the file row does not exist or is not writable by the caller — the same named
+   *         miss either way, so existence is not leaked to unauthorized callers.
    */
   async updateFileData(fileId: string, data: string): Promise<void> {
+    const db = getScopedDb();
+    const file = await db.get(tables.File, { id: fileId });
+    if (!file) {
+      throw new Error(`File not found: ${fileId}`);
+    }
+
     await FileStorage.getDriver().updateFileData(fileId, data);
   }
 

package/test/FileByteAccess.test.ts

@@ -0,0 +1,143 @@
+import { SourceRepository } from '@proteinjs/reflection';
+import { User } from '@proteinjs/user';
+import { File } from '../src/tables/FileTable';
+import { FileStorage } from '../src/FileStorage';
+import { DbFileStorageDriver } from '../src/DbFileStorageDriver';
+import { FileTestEnvironment } from './FileTestEnvironment';
+
+/** Every byte value once — a payload that corrupts under any text/base64 mix-up. */
+const rawBytes = Buffer.from(Array.from({ length: 256 }, (_, i) => i));
+const rawBase64 = rawBytes.toString('base64');
+/** A same-length replacement payload, byte-distinct at every position — the poisoning attempt. */
+const poisonBytes = Buffer.from(Array.from({ length: 256 }, (_, i) => 255 - i));
+const poisonBase64 = poisonBytes.toString('base64');
+
+/**
+ * The byte-access gates on the browser-facing service (FileStorageService is `allUsers`, so
+ * these methods are every logged-in user's to call with any file id they can guess or leak):
+ *
+ * - **Reads** (`getFileData`): gated on the {@link FileStorage.getFile} row read — the same
+ *   two-legged access decision every serving path derives from (the caller's SCOPED read, else
+ *   the FileReachabilityResolver shared-content leg). Bytes are exactly as reachable as the row
+ *   that names them. Ungated, a foreign file id read another user's bytes outright (the driver
+ *   byte ops are deliberately unscoped — the access wall lives at this service boundary).
+ * - **Writes** (`updateFileData`): gated on the caller's SCOPED row read — owner scope is the
+ *   write grant on ScopedRecords. Stricter than reads: the resolver leg widens READS only, so a
+ *   share recipient who can read bytes still cannot write them. Ungated, a foreign file id let
+ *   any caller poison another user's bytes (with the DbFileStorageDriver: caller-scoped chunk
+ *   inserts landing beside the owner's — this suite runs that real driver so the intact-bytes
+ *   assertions prove no chunk ever landed).
+ *
+ * The resolver is stubbed at the seam (content packages sit above db-file); denial is the named
+ * `File not found` — existence is not leaked to unauthorized callers.
+ */
+
+const testEnv = new FileTestEnvironment();
+type SourceRepositoryInternals = { objectCache: Record<string, unknown[]> };
+const objectCache = () => (SourceRepository.get() as unknown as SourceRepositoryInternals).objectCache;
+
+let owner: User;
+let recipient: User;
+let stranger: User;
+/** File ids the stub resolver reports as reachable for the current user. */
+const reachableFileIds = new Set<string>();
+/** How many times the seam was consulted — the owner's scoped leg must never pay for it. */
+let resolverConsultations = 0;
+
+beforeAll(async () => {
+  await testEnv.beforeAll();
+  // The seam getFile consults on a scoped-read miss, stubbed (the real thought-media resolver
+  // lives above this package).
+  objectCache()['@proteinjs/db-file/FileReachabilityResolver'] = [
+    {
+      canReadViaReference: async (fileId: string) => {
+        resolverConsultations++;
+        return reachableFileIds.has(fileId);
+      },
+    },
+  ];
+  // The real chunked driver: write-gate bites are proven at the chunk-row level, not a mock.
+  testEnv.setDriver(new DbFileStorageDriver());
+  owner = await testEnv.createUser({ name: 'File owner', email: 'byte-owner@test.local' });
+  recipient = await testEnv.createUser({ name: 'Share recipient', email: 'byte-recipient@test.local' });
+  stranger = await testEnv.createUser({ name: 'Stranger', email: 'byte-stranger@test.local' });
+  testEnv.actAs(owner);
+});
+
+afterAll(async () => {
+  delete objectCache()['@proteinjs/db-file/FileReachabilityResolver'];
+  await testEnv.afterAll();
+});
+
+beforeEach(() => {
+  reachableFileIds.clear();
+  resolverConsultations = 0;
+  testEnv.actAs(owner);
+});
+
+const createOwnerFile = async (name: string): Promise<File> =>
+  await new FileStorage().createFile(
+    { name, type: 'application/octet-stream', size: rawBytes.length } as File,
+    rawBase64
+  );
+
+describe('byte reads gate on the file-row read (the getFile decision)', () => {
+  it('the owner reads their bytes through the scoped leg alone — resolvers are never consulted', async () => {
+    const file = await createOwnerFile('own-bytes.bin');
+
+    const fileDataBase64 = await new FileStorage().getFileData(file.id);
+
+    expect(fileDataBase64).toEqual(rawBase64);
+    expect(resolverConsultations).toEqual(0);
+  });
+
+  it("THE VULN (read): a stranger holding only the file id is DENIED another user's bytes", async () => {
+    const file = await createOwnerFile('private-bytes.bin');
+
+    testEnv.actAs(stranger);
+    await expect(new FileStorage().getFileData(file.id)).rejects.toThrow(`File not found: ${file.id}`);
+  });
+
+  it('a shared-content recipient (resolver-vouched) reads the bytes byte-identical', async () => {
+    const file = await createOwnerFile('shared-bytes.bin');
+    reachableFileIds.add(file.id);
+
+    testEnv.actAs(recipient);
+    const fileDataBase64 = await new FileStorage().getFileData(file.id);
+
+    expect(fileDataBase64).toEqual(rawBase64);
+  });
+});
+
+describe('byte writes gate on the caller WRITING the row (owner scope; read-reachability never grants it)', () => {
+  it("THE VULN (write): a stranger holding only the file id cannot poison another user's bytes", async () => {
+    const file = await createOwnerFile('unpoisonable.bin');
+
+    testEnv.actAs(stranger);
+    await expect(new FileStorage().updateFileData(file.id, poisonBase64)).rejects.toThrow(`File not found: ${file.id}`);
+
+    // The outcome that matters: no chunk landed — the owner's bytes read back untouched.
+    testEnv.actAs(owner);
+    expect(await new FileStorage().getFileData(file.id)).toEqual(rawBase64);
+  });
+
+  it("read-reachability does NOT grant write: a vouched recipient's byte write is denied, bytes intact", async () => {
+    const file = await createOwnerFile('read-only-share.bin');
+    reachableFileIds.add(file.id);
+
+    testEnv.actAs(recipient);
+    expect(await new FileStorage().getFileData(file.id)).toEqual(rawBase64);
+    await expect(new FileStorage().updateFileData(file.id, poisonBase64)).rejects.toThrow(`File not found: ${file.id}`);
+
+    testEnv.actAs(owner);
+    expect(await new FileStorage().getFileData(file.id)).toEqual(rawBase64);
+  });
+
+  it('the owner replaces their bytes wholesale', async () => {
+    const file = await createOwnerFile('rewritable.bin');
+
+    await new FileStorage().updateFileData(file.id, poisonBase64);
+
+    expect(await new FileStorage().getFileData(file.id)).toEqual(poisonBase64);
+  });
+});