@rebasepro/server 0.14.0 → 0.14.1-canary.g7e666eb

package/dist/{jwt-_IFqfTOg.js → jwt-CYGFT0ih.js}

@@ -2,8 +2,123 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-DSJWtz9O.js";
+import "./src-Cz9nMgUR.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { createHash, randomBytes } from "crypto";
+import path from "node:path";
+//#region ../types/src/types/storage_source.ts
+/**
+* Describes a named storage backend — a place files live.
+*
+* Declared once and shared front + back: the frontend uses it to decide
+* transport (HTTP proxy vs direct SDK), the backend uses the same `key`
+* to resolve a StorageController, and collection properties reference
+* a definition by its `key` via `StorageConfig.storageSource`.
+*
+* This mirrors the {@link DataSourceDefinition} pattern used for databases.
+*
+* @group Models
+*/
+/**
+* The default storage source key, used when a property does not specify
+* a `storageSource`. Shared by the frontend and backend registries so
+* both agree on "the default storage backend".
+* @group Models
+*/
+var DEFAULT_STORAGE_SOURCE_KEY = "(default)";
+/**
+* The environment-variable suffix for a storage or data source key.
+*
+* `""` for the default source — so a single-bucket project keeps configuring
+* plain `S3_BUCKET` — and `__<KEY>` for every named one, uppercased with
+* non-alphanumerics collapsed to underscores: `media-cdn` → `S3_BUCKET__MEDIA_CDN`.
+*
+* The rule derives the variable name from the declared key rather than
+* discovering keys by scanning the environment. Scanning would have to guess how
+* `S3_BUCKET__MEDIA_CDN` splits into a key; deriving cannot be ambiguous, and a
+* typo surfaces as a missing source at boot instead of a silently ignored
+* variable.
+*
+* It lives in this package, with no dependencies, because four things must agree
+* on it exactly: the CLI (validating a build), the runtime (reading its own
+* environment), the control plane (writing a tenant's Secret), and the docs. A
+* second implementation of a naming convention is a second chance to disagree.
+*
+* @group Models
+*/
+function storageEnvSuffix(key, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
+	if (!key || key === defaultKey) return "";
+	const normalized = key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+	if (!normalized) throw new Error(`Source key "${key}" cannot be turned into an environment variable name. Use a key containing at least one letter or digit.`);
+	return `__${normalized}`;
+}
+/**
+* Two distinct keys that collapse onto the same variable name, or `null`.
+*
+* `media-cdn` and `media_cdn` are different source keys but the same suffix, so
+* without this one of them silently reads the other's configuration. Returns the
+* offending pair rather than throwing, so each caller can raise it in its own
+* idiom — a `BundleError` at boot, a build failure in the CLI, a rejected deploy
+* in a control plane.
+*
+* @group Models
+*/
+function findStorageSuffixCollision(keys, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const key of keys) {
+		const suffix = storageEnvSuffix(key, defaultKey);
+		const existing = seen.get(suffix);
+		if (existing !== void 0 && existing !== key) return {
+			a: existing,
+			b: key,
+			suffix
+		};
+		seen.set(suffix, key);
+	}
+	return null;
+}
+/**
+* Merge the two places a project may declare storage sources into one list.
+*
+* `rebase.json` is authoritative for every field it states. Config code may add
+* sources it does not mention and fill in fields it left out, but may not
+* contradict it: the manifest is what a host reads to decide which buckets need
+* configuring, and a runtime that quietly disagreed with it would put the
+* console back to describing a topology the tenant does not have — the exact
+* failure this whole mechanism exists to end.
+*
+* Note what is *not* here: no default source is invented when both inputs are
+* empty. That decision belongs to the resolver, which knows whether declaring
+* nothing means "one plain bucket" (it does) or "no storage at all".
+*
+* @group Models
+*/
+function normalizeStorageSources(declared, exported) {
+	const merged = /* @__PURE__ */ new Map();
+	const declaredEntries = Array.isArray(declared) ? declared.filter((d) => d?.key).map((d) => [d.key, d]) : Object.entries(declared ?? {});
+	for (const [key, config] of declaredEntries) merged.set(key, {
+		key,
+		engine: config.engine,
+		transport: config.transport ?? "server",
+		...config.label !== void 0 ? { label: config.label } : {}
+	});
+	for (const definition of exported ?? []) {
+		if (!definition?.key) continue;
+		const existing = merged.get(definition.key);
+		if (!existing) {
+			merged.set(definition.key, {
+				key: definition.key,
+				engine: definition.engine,
+				transport: definition.transport ?? "server",
+				...definition.label !== void 0 ? { label: definition.label } : {}
+			});
+			continue;
+		}
+		if (existing.label === void 0 && definition.label !== void 0) existing.label = definition.label;
+	}
+	return Array.from(merged.values());
+}
+//#endregion
 //#region ../../node_modules/.pnpm/safe-buffer@5.2.1/node_modules/safe-buffer/index.js
 var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
@@ -4147,6 +4262,159 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
+//#region src/storage/keys.ts
+var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
+/**
+* Canonical storage keys and bucket names.
+*
+* Storage is not under RLS, so a `storageAuthorize` hook is the whole access
+* control model — and a hook can only be correct if the key it is shown is the
+* key that is written. That is the invariant this module exists to hold: one
+* canonical string, computed once per request, handed to the hook, to the
+* controller, and to the download token alike.
+*
+* ## Why rejecting beats stripping
+*
+* The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two
+* things were wrong with that, and only one of them was the obvious one.
+*
+* The obvious one: a single pass is not a fixed point. `....//` contains `../`
+* at offset 2, so removing it leaves `../` behind — the sanitizer manufactured
+* the traversal it was there to remove. `users/alice/....//bob/x` came out as
+* `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with
+* `users/alice/`) and the filesystem reads as bob's. The hook approved one
+* object and the controller wrote another.
+*
+* The subtler one, and the reason this is a rewrite rather than a loop: even a
+* correct strip is a silent rewrite. A caller who asks to store at `a/../b` and
+* gets an object at `a/b` was not protected, they were misled — and every later
+* read, ownership row and audit line now refers to a path nobody chose. So a key
+* that means something other than what it says is refused (400), not repaired.
+*
+* Note what is NOT traversal under this rule: `....` is an ordinary directory
+* name, and `users/alice/....//bob/x` canonicalizes to
+* `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
+* exactly right. Only a real `..` segment is refused.
+*/
+/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
+var MAX_STORAGE_KEY_LENGTH = 1024;
+/**
+* A key that cannot be canonicalized. Carries no path back to the caller
+* beyond what they sent, so it is safe to surface as a 400 message.
+*/
+var InvalidStorageKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidStorageKeyError";
+	}
+};
+/**
+* Canonicalize a caller-supplied storage key, or throw
+* {@link InvalidStorageKeyError}.
+*
+* Normalizations applied (safe, idempotent, and meaning-preserving):
+* - leading slashes removed — `/a/b` and `a/b` name the same object
+* - `.` segments and repeated slashes collapsed
+*
+* Refusals (the key means something other than what it says):
+* - any `..` segment, on either separator, at any depth
+* - null bytes
+* - keys longer than {@link MAX_STORAGE_KEY_LENGTH}
+*
+* A trailing slash is preserved: it is how the folder route marks a prefix.
+*/
+function canonicalStorageKey(rawKey) {
+	if (rawKey.includes("\0")) throw new InvalidStorageKeyError("Storage key contains a null byte.");
+	if (rawKey.length > 1024) throw new InvalidStorageKeyError(`Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`);
+	if (rawKey.split(/[\\/]/).some((segment) => segment === "..")) throw new InvalidStorageKeyError("Storage key contains a '..' path segment. Keys must name an object directly.");
+	const withoutLeadingSlashes = rawKey.replace(/^\/+/, "");
+	if (withoutLeadingSlashes === "") return "";
+	const denotesDirectory = /(?:^|\/)\.?$/.test(withoutLeadingSlashes);
+	const normalized = path.posix.normalize(withoutLeadingSlashes);
+	if (normalized === "." || normalized === "./") return "";
+	const key = normalized.replace(/^\.\//, "").replace(/^\/+/, "");
+	if (key === "") return "";
+	return denotesDirectory && !key.endsWith("/") ? `${key}/` : key;
+}
+/**
+* Canonicalize, or return `null` when the key is not canonicalizable.
+*
+* For callers that must fail closed without an exception — the download-token
+* middleware compares a request path against a granted path, and a key it
+* cannot canonicalize simply matches nothing.
+*/
+function tryCanonicalStorageKey(rawKey) {
+	try {
+		return canonicalStorageKey(rawKey);
+	} catch {
+		return null;
+	}
+}
+/**
+* Canonicalize the storage *source* a request names (`?storageId=`), so that
+* "the default source" has exactly one spelling.
+*
+* The default source can be asked for three ways — the parameter omitted, sent
+* empty, or sent as the literal `(default)` — and all three resolve to the same
+* controller. Without a single spelling, the value derived when a download
+* token is minted and the value derived when it is presented can differ for the
+* same object, which is either a spurious 403 or, if the comparison is dropped
+* to stop those, no scoping at all.
+*
+* Deliberately *not* validated against the registry: this is a naming rule, not
+* an existence check, and it must give the same answer in `auth/` (which has no
+* registry) as in the storage routes. An id that names no source still
+* canonicalizes to itself and simply matches only itself.
+*/
+function canonicalStorageId(rawStorageId) {
+	if (rawStorageId === void 0 || rawStorageId === null) return DEFAULT_STORAGE_SOURCE_KEY;
+	const trimmed = rawStorageId.trim();
+	return trimmed === "" ? DEFAULT_STORAGE_SOURCE_KEY : trimmed;
+}
+/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */
+var InvalidStorageBucketError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidStorageBucketError";
+	}
+};
+/**
+* One path segment: letters, digits, `.`, `_`, `-`, first character
+* alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS
+* and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,
+* absolute paths and anything containing a separator unrepresentable.
+*/
+var STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/**
+* Canonicalize a caller-supplied bucket name, or throw
+* {@link InvalidStorageBucketError}.
+*
+* The bucket is the *other* caller-controlled routing value in an upload
+* request, and it was the one nobody validated. `LocalStorageController`
+* builds `join(basePath, bucket)` and then checks containment against that
+* result, so a bucket of `../../etc` moved the boundary rather than crossing
+* it — the guard passed because the guard's reference point was the attacker's.
+* The containment check now resolves against the storage root, and this is the
+* check at the route boundary that stops the value before it gets there.
+*
+* A bucket is configuration, not user data: there is no legitimate caller that
+* needs a separator, a leading dot, or a `..` in one. So this refuses rather
+* than repairs, exactly as {@link canonicalStorageKey} does — a rewritten
+* bucket would silently store the object somewhere the caller did not ask for.
+*
+* Returns `undefined` when the caller named no bucket (absent, or an empty
+* form field), which is how every controller spells "use my default". An empty
+* string used to reach `getFullPath` and resolve to the storage *root* rather
+* than the `default` bucket, which is a third place a bare key did not
+* round-trip.
+*/
+function canonicalStorageBucket(rawBucket) {
+	if (rawBucket === void 0 || rawBucket === null || rawBucket === "") return void 0;
+	if (rawBucket.length > 63) throw new InvalidStorageBucketError(`Storage bucket exceeds the maximum length of 63 characters.`);
+	if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) throw new InvalidStorageBucketError("Storage bucket must be a single name of letters, digits, '.', '_' or '-', starting with a letter or digit.");
+	return rawBucket;
+}
+//#endregion
 //#region src/auth/jwt.ts
 var jwt_exports = /* @__PURE__ */ __exportAll({
 	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
@@ -4166,7 +4434,6 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	verifyDownloadToken: () => verifyDownloadToken,
 	verifyMfaPendingToken: () => verifyMfaPendingToken
 });
-var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 var jwtConfig = {
 	secret: "",
 	accessExpiresIn: "1h",
@@ -4392,12 +4659,27 @@ function verifyMfaPendingToken(token) {
 }
 /**
 * Generate a short-lived download token scoped to a specific file path or prefix
+* *within one storage source*.
+*
+* Both halves of that scope are load-bearing. A key is only unique inside its
+* own bucket, and a project with more than one source routinely holds the same
+* key in several of them — `avatars/u1.png` in `(default)` and in `media` are
+* different objects, quite possibly with different owners. A token that names
+* only the path is therefore a grant on every source at once: authorize a read
+* on the source whose `storageAuthorize` hook says yes, then spend the token
+* against `?storageId=` pointing somewhere else.
+*
+* `storageId` is optional here only because omitting it *is* the default
+* source, which is what the overwhelming majority of deployments have. A mint
+* site that forgets to pass a named source produces a default-scoped token,
+* which fails closed at `/file/*` rather than over-granting.
 */
-function generateDownloadToken(path, expiresInSeconds = 300) {
+function generateDownloadToken(path, expiresInSeconds = 300, storageId) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	const payload = {
 		purpose: "file-read",
-		path
+		path,
+		storageId: canonicalStorageId(storageId)
 	};
 	return import_jsonwebtoken.default.sign(payload, jwtConfig.secret, {
 		expiresIn: expiresInSeconds,
@@ -4405,7 +4687,14 @@ function generateDownloadToken(path, expiresInSeconds = 300) {
 	});
 }
 /**
-* Verify and decode a download token
+* Verify and decode a download token.
+*
+* A token minted before `storageId` existed carries no such claim. It is read
+* as a grant on the **default source** rather than on all of them: that is the
+* fail-closed reading, and it is what such a token almost always was, since a
+* named source has to be asked for explicitly. The cost is bounded by the
+* five-minute TTL — for at most that long after a deploy, an in-flight token
+* for a *named* source is refused and the client re-fetches `/metadata`.
 */
 function verifyDownloadToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
@@ -4413,7 +4702,8 @@ function verifyDownloadToken(token) {
 		const decoded = import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
 		if (decoded && decoded.purpose === "file-read" && typeof decoded.path === "string") return {
 			purpose: "file-read",
-			path: decoded.path
+			path: decoded.path,
+			storageId: canonicalStorageId(typeof decoded.storageId === "string" ? decoded.storageId : null)
 		};
 		return null;
 	} catch (error) {
@@ -4422,6 +4712,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { generateMfaPendingToken as a, getRefreshTokenExpiry as c, isJwtConfigured as d, jwt_exports as f, require_jsonwebtoken as g, verifyMfaPendingToken as h, generateDownloadToken as i, getRefreshTokenTtlMs as l, verifyDownloadToken as m, configureJwt as n, generateRefreshToken as o, verifyAccessToken as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, hashRefreshToken as u };
+export { DEFAULT_STORAGE_SOURCE_KEY as C, storageEnvSuffix as E, require_jsonwebtoken as S, normalizeStorageSources as T, InvalidStorageKeyError as _, generateMfaPendingToken as a, canonicalStorageKey as b, getRefreshTokenExpiry as c, isJwtConfigured as d, jwt_exports as f, InvalidStorageBucketError as g, verifyMfaPendingToken as h, generateDownloadToken as i, getRefreshTokenTtlMs as l, verifyDownloadToken as m, configureJwt as n, generateRefreshToken as o, verifyAccessToken as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, hashRefreshToken as u, canonicalStorageBucket as v, findStorageSuffixCollision as w, tryCanonicalStorageKey as x, canonicalStorageId as y };
 
-//# sourceMappingURL=jwt-_IFqfTOg.js.map
+//# sourceMappingURL=jwt-CYGFT0ih.js.map