@rebasepro/server 0.9.1-canary.f2f61da → 0.9.1-canary.faee831

package/dist/storage/LocalStorageController.d.ts

@@ -3,6 +3,13 @@
  */
 import { StorageController, LocalStorageConfig } from "./types";
 import { UploadFileProps, UploadFileResult, DownloadConfig, StorageListResult } from "@rebasepro/types";
+/**
+ * Bucket used when a call names none.
+ *
+ * Every method resolves through this, so put/get/delete/list agree on where a
+ * bare key lives.
+ */
+export declare const DEFAULT_BUCKET = "default";
 /**
  * Local filesystem storage implementation
  * Stores files in a directory structure: {basePath}/{bucket}/{path}
@@ -17,8 +24,18 @@ export declare class LocalStorageController implements StorageController {
      */
     private ensureDir;
     /**
-     * Get the full filesystem path for a storage path.
-     * Includes a path traversal guard to prevent escaping the base directory.
+     * Get the full filesystem path for a storage path, with a traversal guard
+     * that keeps the result inside the bucket directory.
+     *
+     * Defaults the bucket the way `putObject` does.
+     *
+     * `putObject` has always written into `default` when given no bucket, while
+     * the read side resolved a bare key against the storage root — where
+     * nothing is. The two disagreed silently: `getObject` returned null (reads
+     * as "file missing"), `deleteObject` deleted nothing (404s are swallowed by
+     * design), and `listObjects` returned an empty page. So the obvious
+     * `putObject({ key })` → `getObject(key)` did not round-trip and nothing
+     * said why. One default, applied everywhere, removes the whole class.
      */
     private getFullPath;
     /**

package/dist/storage/routes.d.ts

@@ -7,7 +7,7 @@
  * is used.
  */
 import { Hono } from "hono";
-import { StorageController } from "./types";
+import { StorageController, type StorageAuthorize } from "./types";
 import type { StorageRegistry } from "./storage-registry";
 import { type StorageSourceDefinition, type AuthAdapter } from "@rebasepro/types";
 import { HonoEnv } from "../api/types";
@@ -45,6 +45,13 @@ export interface StorageRoutesConfig {
      * configured" crash when `configureJwt()` was never called.
      */
     authAdapter?: AuthAdapter;
+    /**
+     * Per-object access control, consulted after authentication on every
+     * storage route. See `StorageAuthorize`.
+     *
+     * Omitted, storage behaves as before: authenticated means allowed.
+     */
+    authorize?: StorageAuthorize;
 }
 /**
  * Extract the wildcard portion of a route path from the full request path.

package/dist/storage/tus-handler.d.ts

@@ -20,10 +20,30 @@ import type { StorageRegistry } from "./storage-registry";
 export declare class TusHandler {
     private storageController?;
     private storageRegistry?;
+    /**
+     * Per-object authorization, applied to the resumable path too.
+     *
+     * TUS is a second way to write an object, so a hook enforced only on
+     * `POST /upload` would leave the door it was added to close standing
+     * open. The target key lives in the `Upload-Metadata` header, which
+     * only this class parses — hence the injection rather than a check in
+     * the route. Rejects by throwing.
+     */
+    private authorizeUpload?;
     private uploads;
     private tusDir;
     private cleanupTimer?;
-    constructor(storageBaseDir: string, storageController?: StorageController | undefined, storageRegistry?: StorageRegistry | undefined);
+    constructor(storageBaseDir: string, storageController?: StorageController | undefined, storageRegistry?: StorageRegistry | undefined, 
+    /**
+     * Per-object authorization, applied to the resumable path too.
+     *
+     * TUS is a second way to write an object, so a hook enforced only on
+     * `POST /upload` would leave the door it was added to close standing
+     * open. The target key lives in the `Upload-Metadata` header, which
+     * only this class parses — hence the injection rather than a check in
+     * the route. Rejects by throwing.
+     */
+    authorizeUpload?: ((c: Context, key: string, bucket: string) => Promise<void>) | undefined);
     /** Ensure the temp directory exists. */
     private ensureDir;
     /** Start periodic cleanup of stale uploads. */

package/dist/storage/types.d.ts

@@ -78,6 +78,39 @@ export interface GCSStorageConfig {
  * interface and pass the instance directly to the `storage` config.
  */
 export type BackendStorageConfig = LocalStorageConfig | S3StorageConfig | GCSStorageConfig;
+/** What a storage request is trying to do to an object. */
+export type StorageOperation = "read" | "write" | "delete" | "list";
+/** The caller, as resolved by whichever auth middleware ran. */
+export interface StorageAuthorizeUser {
+    uid: string;
+    email?: string;
+    roles?: string[];
+}
+export interface StorageAuthorizeContext {
+    /** Object key, bucket prefix stripped and traversal already sanitized. */
+    key: string;
+    bucket: string;
+    operation: StorageOperation;
+    /** Null when the route allows unauthenticated access. */
+    user: StorageAuthorizeUser | null;
+    /** Named backend the request targeted, when one was given. */
+    storageId?: string;
+}
+/**
+ * Per-object access control for storage, the analogue of an RLS policy on a
+ * collection.
+ *
+ * Without it, storage routes authenticate but do not authorize: `requireAuth`
+ * and `publicRead` are global switches, so any signed-in user could read any
+ * key they could name. That is fine for a single-tenant app and useless for a
+ * multi-tenant one, where the only thing separating two tenants' files would be
+ * key unguessability — not an access-control model. Multi-tenant apps were
+ * left to route every byte through a custom function to get an ownership check
+ * in, and each of them had to invent it.
+ *
+ * Return false (or throw) to deny. Denials surface as 403.
+ */
+export type StorageAuthorize = (ctx: StorageAuthorizeContext) => boolean | Promise<boolean>;
 /**
  * Storage controller interface for backend implementations
  */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server",
   "type": "module",
-  "version": "0.9.1-canary.f2f61da",
+  "version": "0.9.1-canary.faee831",
   "description": "Database-Agnostic Backend Core for Rebase",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -44,13 +44,13 @@
     "jsonwebtoken": "^9.0.3",
     "ws": "^8.21.0",
     "zod": "^4.4.3",
-    "@rebasepro/client": "0.9.1-canary.f2f61da",
-    "@rebasepro/common": "0.9.1-canary.f2f61da",
-    "@rebasepro/types": "0.9.1-canary.f2f61da",
-    "@rebasepro/utils": "0.9.1-canary.f2f61da"
+    "@rebasepro/common": "0.9.1-canary.faee831",
+    "@rebasepro/types": "0.9.1-canary.faee831",
+    "@rebasepro/utils": "0.9.1-canary.faee831",
+    "@rebasepro/client": "0.9.1-canary.faee831"
   },
   "devDependencies": {
-    "hono": "^4.12.25",
+    "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^25.9.3",
@@ -60,6 +60,7 @@
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^6.0.2",
     "cross-env": "^10.1.0",
+    "hono": "^4.12.25",
     "jest": "^30.4.2",
     "ts-jest": "29.4.11",
     "typescript": "^6.0.3",