@protobase/server 0.15.1 → 0.15.2

package/dist/files/attach.js

@@ -1,4 +1,6 @@
 import { badRequest } from "../problem.js";
+import { accepts } from "./media-types.js";
+import { externalFile, parseExternalUrl } from "./external-url.js";
 import { baseOf, parseUri, variantPaths } from "./uri.js";
 import { tenantScope } from "../tenant.js";
 import { readTicket } from "./ticket.js";
@@ -11,10 +13,15 @@ const ticketScope = (access, field) => ({
 	user: String(access.session.user.id)
 });
 const fileFields = (access) => Object.values(access.full.fields).filter((field) => field.file);
+const externalRefusal = (field, url) => {
+	const type = externalFile(url).type ?? "application/octet-stream";
+	return accepts(field.file.accept, type) ? void 0 : `This field takes ${field.file.accept.join(", ")}; the URL's extension gives ${type}`;
+};
 /**
 * File values of a validated create or update body, made ready to store: a ticket from `:upload` becomes its clean URI
 * plus the derived fields it carries, `null` clears the field and its derived fields, and the stored value itself is a
-* no-op. Anything else is refused, so a row can only point at a file its writer uploaded for that field.
+* no-op. A field with `.externalUrls()` also stores an https URL as it is, its derived fields `null`. Anything else is
+* refused, so a row can only point at a file its writer uploaded for that field, or at one elsewhere.
 */
 const attachFiles = async (access, values, current) => {
 	const names = Object.keys(values).filter((name) => access.full.fields[name]?.file);
@@ -35,13 +42,28 @@ const attachFiles = async (access, values, current) => {
 			delete result[name];
 			continue;
 		}
+		const external = field.file.external ? parseExternalUrl(String(value)) : void 0;
+		if (external) {
+			const refusal = externalRefusal(field, external);
+			if (refusal) {
+				errors.push({
+					field: name,
+					code: "invalid-value",
+					message: refusal
+				});
+				continue;
+			}
+			result[name] = value;
+			for (const target of derive) result[target] = null;
+			continue;
+		}
 		const ticket = await readTicket(files.signer, String(value), ticketScope(access, name), now);
 		if (!ticket.ok || ticket.ref.provider !== field.file.provider) {
-			const expired = !ticket.ok && ticket.reason === "expired";
+			const message = !ticket.ok && ticket.reason === "expired" ? "The upload expired; upload the file again" : field.file.external ? "Neither a file uploaded for this field nor an https URL without credentials" : "Not a file uploaded for this field; upload it with :upload first";
 			errors.push({
 				field: name,
 				code: "invalid-value",
-				message: expired ? "The upload expired; upload the file again" : "Not a file uploaded for this field; upload it with :upload first"
+				message
 			});
 			continue;
 		}

package/dist/files/external-url.js

@@ -0,0 +1,34 @@
+import { typeOfExtension } from "./media-types.js";
+//#region src/files/external-url.ts
+const urlText = /^[\x21-\x7e]+$/;
+const scheme = "https://";
+/**
+* The URL an external file value names: an absolute `https:` URL with a host and no user name or password, written
+* out without spaces or control characters, its host first after `https://`; `undefined` for anything else, a provider
+* URI included.
+*/
+const parseExternalUrl = (value) => {
+	if (!value.startsWith(scheme) || !urlText.test(value) || !URL.canParse(value)) return void 0;
+	const url = new URL(value);
+	if (url.username !== "" || url.password !== "" || !value.slice(8).toLowerCase().startsWith(url.host)) return void 0;
+	return url;
+};
+const lastSegment = (path) => path.slice(path.lastIndexOf("/") + 1);
+const decoded = (segment) => {
+	try {
+		return decodeURIComponent(segment);
+	} catch (error) {
+		if (error instanceof URIError) return segment;
+		throw error;
+	}
+};
+/** An external file's name and type: its path's last segment, else its host, and the type of that segment's extension. */
+const externalFile = (url) => {
+	const segment = decoded(lastSegment(url.pathname));
+	return {
+		name: segment || url.hostname,
+		type: typeOfExtension(segment)
+	};
+};
+//#endregion
+export { externalFile, parseExternalUrl };

package/dist/files/options.d.ts

@@ -17,5 +17,10 @@ export type FilesOptions = {
    * config, so a built bundle carries it with its native add-on.
    */
   sharp?: Sharp;
+  /**
+   * Hosts whose images the admin app draws with the page's referrer, besides the app's own and those its providers link
+   * public files from: `['images.example.com']`. Images from any other host load with `referrerPolicy="no-referrer"`.
+   */
+  trustedHosts?: string[];
 };
 //#endregion

package/dist/files/present.js

@@ -1,5 +1,6 @@
 import { downloadExpiry, signedDownloadUrl } from "./download-url.js";
 import { servedType } from "./media-types.js";
+import { externalFile, parseExternalUrl } from "./external-url.js";
 import { parseUri, variantPaths } from "./uri.js";
 import { encodeKey } from "@protobase/schema/internal";
 //#region src/files/present.ts
@@ -18,20 +19,37 @@ const linker = async (files, access, row, field, ref, expires) => {
 		expires
 	});
 };
+const placeholderOf = (access, row, field) => {
+	const target = field.file?.placeholder;
+	const placeholder = target !== void 0 && access.model.fields[target] ? row[target] : void 0;
+	return typeof placeholder === "string" ? placeholder : void 0;
+};
+const externalObject = (access, row, field, value, url) => {
+	const { name, type } = externalFile(url);
+	const placeholder = placeholderOf(access, row, field);
+	return {
+		uri: value,
+		name,
+		type: type ?? "application/octet-stream",
+		url: value,
+		...placeholder !== void 0 && { placeholder }
+	};
+};
 const fileObject = async (files, access, row, field, value, expires) => {
+	const external = field.file?.external ? parseExternalUrl(value) : void 0;
+	if (external) return externalObject(access, row, field, value, external);
 	const ref = parseUri(value);
 	if (!ref || !files.providers[ref.provider]) return {
 		uri: value,
 		missing: true
 	};
-	const target = field.file?.placeholder;
-	const placeholder = target !== void 0 && access.model.fields[target] ? row[target] : void 0;
+	const placeholder = placeholderOf(access, row, field);
 	const described = {
 		uri: value,
 		name: ref.name,
 		type: servedType(ref.path),
 		...ref.size !== void 0 && { size: ref.size },
-		...typeof placeholder === "string" && { placeholder }
+		...placeholder !== void 0 && { placeholder }
 	};
 	const link = await linker(files, access, row, field.name, ref, expires);
 	if (!link) return described;
@@ -54,7 +72,8 @@ const fileObject = async (files, access, row, field, value, expires) => {
 /**
 * Records as responses carry them: each readable file field as `{ uri, name, type, size, url }`, with its `variants` and
 * `placeholder` when it has them. The URLs are minted here, after the ETag, for a caller who may already see the row:
-* private files get a signed link to this row's field, public ones their permanent address. Stored values, hooks and
+* private files get a signed link to this row's field, public ones their permanent address, and an external URL of a
+* field with `.externalUrls()` is its own `url`. Stored values, hooks and
 * ETags only ever see the URI.
 */
 const presentFiles = async (access, rows) => {

package/dist/files/runtime.js

@@ -2,6 +2,7 @@ import { fileColumns, runCleanup } from "./cleanup-runner.js";
 import { storageCleanupSchedule } from "./cleanup-schedule.js";
 import { resolveProviders, retentionOf } from "./providers.js";
 import { createSigner } from "./signer.js";
+import { trustedImageHosts } from "./trusted-hosts.js";
 //#region src/files/runtime.ts
 /** How long an upload ticket stays usable, so a form left open still saves. */
 const ticketSeconds = 86400;
@@ -26,6 +27,7 @@ const createFilesRuntime = ({ options = {}, env, models, systemPath }) => {
 		retention: (provider) => retention(providers[provider]),
 		path: `${systemPath}/files`,
 		columns: fileColumns(models),
+		trustedHosts: trustedImageHosts(providers, options.trustedHosts),
 		...options.sharp && { sharp: options.sharp }
 	};
 };

package/dist/files/trusted-hosts.js

@@ -0,0 +1,14 @@
+//#region src/files/trusted-hosts.ts
+const hostPattern = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+const checkedHost = (host) => {
+	if (!hostPattern.test(host)) throw new Error(`files.trustedHosts: "${host}" is not a host name; write it like images.example.com, without https:// or a path`);
+	return host;
+};
+const providerHost = (provider) => provider.publicUrl !== void 0 && URL.canParse(provider.publicUrl) ? [new URL(provider.publicUrl).hostname] : [];
+/**
+* The hosts whose images the app draws with the page's referrer, besides its own: those its providers link public files
+* from, and those the config adds. Every other image is drawn with `referrerPolicy="no-referrer"`.
+*/
+const trustedImageHosts = (providers, configured = []) => [.../* @__PURE__ */ new Set([...Object.values(providers).flatMap(providerHost), ...configured.map(checkedHost)])].sort();
+//#endregion
+export { trustedImageHosts };

package/dist/meta.js

@@ -79,6 +79,7 @@ const createMeta = (deps) => {
 			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } },
 			...deps.errorReporting && { errorReporting: deps.errorReporting },
 			...deps.mapStyle && { maps: { style: deps.mapStyle } },
+			...deps.files && deps.files.trustedHosts.length > 0 && { files: { trustedHosts: deps.files.trustedHosts } },
 			...plugins.length > 0 && { plugins },
 			...sources.length > 0 && { sources }
 		};

package/dist/openapi/schemas.js

@@ -28,11 +28,11 @@ const hoist = (entry, schema) => {
 const fileSchema = {
 	type: "object",
 	required: ["uri"],
-	description: "A stored file. `url` downloads it: a signed link valid one to two hours for private files, a permanent one for public files. A value that names no configured provider comes as `{ uri, missing: true }`.",
+	description: "A stored file. `url` downloads it: a signed link valid one to two hours for private files, a permanent one for public files, the URL itself for an external file. A value that names no configured provider comes as `{ uri, missing: true }`.",
 	properties: {
 		uri: {
 			type: "string",
-			description: "The stored value, `{provider}:{path}?name=…&size=…`; send it back unchanged to keep the file"
+			description: "The stored value, `{provider}:{path}?name=…&size=…` or an external https URL; send it back unchanged to keep the file"
 		},
 		name: { type: "string" },
 		type: {

package/dist/project-config.js

@@ -101,6 +101,7 @@ const mergedFiles = (named) => {
 		label
 	})));
 	checkUnique("The file provider", providers);
+	const trustedHosts = [...new Set(all.flatMap(({ files }) => files.trustedHosts ?? []))];
 	const { retention, secret, sharp } = lastSet(all.map(({ files }) => ({
 		retention: files.retention,
 		secret: files.secret,
@@ -110,7 +111,8 @@ const mergedFiles = (named) => {
 		...providers.length > 0 && { providers: Object.fromEntries(providers.map(({ name, value }) => [name, value])) },
 		...retention !== void 0 && { retention },
 		...secret !== void 0 && { secret },
-		...sharp !== void 0 && { sharp }
+		...sharp !== void 0 && { sharp },
+		...trustedHosts.length > 0 && { trustedHosts }
 	};
 };
 const mergedJobs = (named) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.15.1",
-    "@protobase/query": "0.15.1",
-    "@protobase/schema": "0.15.1",
+    "@protobase/layout": "0.15.2",
+    "@protobase/query": "0.15.2",
+    "@protobase/schema": "0.15.2",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",