@robodev-ai/runtime 0.2.0 → 0.4.0

package/src/storage-rules.test.ts

@@ -0,0 +1,110 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  DEFAULT_LIST_LIMIT,
+  MAX_LIST_LIMIT,
+  MAX_OBJECT_BYTES,
+  PRESIGN_GET_DEFAULT,
+  PRESIGN_GET_MAX,
+  assertObjectSize,
+  mintStorageServeToken,
+  parseLogicalKey,
+  storageListQuerySchema,
+  verifyStorageServeToken,
+} from "./storage-rules.js";
+
+const SECRET = "robodev-dev-local-secret";
+
+test("parseLogicalKey accepts hosted-safe keys", () => {
+  assert.equal(parseLogicalKey("avatars/me.png"), "avatars/me.png");
+  assert.equal(parseLogicalKey("a"), "a");
+  assert.equal(parseLogicalKey("A-Za-z0.9_"), "A-Za-z0.9_");
+});
+
+test("parseLogicalKey rejects empty, slash, and .. segments", () => {
+  assert.throws(
+    () => parseLogicalKey(""),
+    (err: { code?: string; statusCode?: number }) =>
+      err.code === "invalid_key" && err.statusCode === 400,
+  );
+  assert.throws(
+    () => parseLogicalKey("/abs"),
+    (err: { code?: string }) => err.code === "invalid_key",
+  );
+  assert.throws(
+    () => parseLogicalKey("../x"),
+    (err: { code?: string }) => err.code === "invalid_key",
+  );
+  assert.throws(
+    () => parseLogicalKey("a/../b"),
+    (err: { code?: string }) => err.code === "invalid_key",
+  );
+  assert.throws(
+    () => parseLogicalKey("a//b"),
+    (err: { code?: string }) => err.code === "invalid_key",
+  );
+  assert.throws(
+    () => parseLogicalKey("a/./b"),
+    (err: { code?: string }) => err.code === "invalid_key",
+  );
+  assert.throws(
+    () => parseLogicalKey("has space"),
+    (err: { code?: string }) => err.code === "invalid_key",
+  );
+  assert.throws(
+    () => parseLogicalKey("x".repeat(513)),
+    (err: { code?: string }) => err.code === "invalid_key",
+  );
+});
+
+test("list query defaults and caps", () => {
+  const parsed = storageListQuerySchema.parse({});
+  assert.equal(parsed.limit, DEFAULT_LIST_LIMIT);
+  assert.equal(parsed.offset, 0);
+  assert.equal(parsed.prefix, undefined);
+  assert.equal(storageListQuerySchema.parse({ limit: 100 }).limit, MAX_LIST_LIMIT);
+  assert.throws(() => storageListQuerySchema.parse({ limit: 101 }));
+  assert.throws(() => storageListQuerySchema.parse({ offset: -1 }));
+});
+
+test("assertObjectSize uses 25MB", () => {
+  assertObjectSize(MAX_OBJECT_BYTES);
+  assert.throws(
+    () => assertObjectSize(MAX_OBJECT_BYTES + 1),
+    (err: { code?: string; statusCode?: number }) =>
+      err.code === "object_too_large" && err.statusCode === 400,
+  );
+});
+
+test("serve tokens verify until expiry", () => {
+  const { exp, sig } = mintStorageServeToken(SECRET, "prj-1", "avatars/me.png", 900);
+  assert.equal(
+    verifyStorageServeToken(SECRET, "prj-1", "avatars/me.png", { exp: String(exp), sig }),
+    true,
+  );
+  assert.equal(verifyStorageServeToken(SECRET, "prj-1", "other", { exp: String(exp), sig }), false);
+  assert.equal(
+    verifyStorageServeToken(SECRET, "prj-2", "avatars/me.png", { exp: String(exp), sig }),
+    false,
+  );
+  assert.equal(
+    verifyStorageServeToken(SECRET, "prj-1", "avatars/me.png", { exp: String(exp), sig: "nope" }),
+    false,
+  );
+  assert.equal(verifyStorageServeToken(SECRET, "prj-1", "avatars/me.png", {}), false);
+});
+
+test("expired serve tokens fail", () => {
+  const { sig } = mintStorageServeToken(SECRET, "prj-1", "file.bin", PRESIGN_GET_DEFAULT);
+  const exp = Math.floor(Date.now() / 1000) - 10;
+  assert.equal(
+    verifyStorageServeToken(SECRET, "prj-1", "file.bin", { exp: String(exp), sig }),
+    false,
+  );
+});
+
+test("expiresIn is clamped to 1 hour", () => {
+  const before = Math.floor(Date.now() / 1000);
+  const { exp } = mintStorageServeToken(SECRET, "prj-1", "file.bin", 10_000);
+  assert.ok(exp <= before + PRESIGN_GET_MAX + 1);
+});

package/src/storage-rules.ts

@@ -0,0 +1,80 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+
+export const MAX_OBJECT_BYTES = 25 * 1024 * 1024;
+export const DEFAULT_LIST_LIMIT = 50;
+export const MAX_LIST_LIMIT = 100;
+export const PRESIGN_GET_DEFAULT = 900;
+export const PRESIGN_GET_MAX = 3600;
+
+const KEY_RE = /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/;
+
+export const storageListQuerySchema = z.object({
+  prefix: z.string().optional(),
+  limit: z.coerce.number().int().positive().max(MAX_LIST_LIMIT).default(DEFAULT_LIST_LIMIT),
+  offset: z.coerce.number().int().min(0).default(0),
+});
+
+function codedError(statusCode: number, code: string, message: string): never {
+  throw Object.assign(new Error(message), { statusCode, code });
+}
+
+export function parseLogicalKey(key: string): string {
+  if (!key || key.length > 512) {
+    codedError(400, "invalid_key", "Storage key must be 1–512 characters.");
+  }
+  if (key.startsWith("/")) {
+    codedError(400, "invalid_key", "Storage key must not start with /.");
+  }
+  const segments = key.split("/");
+  if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+    codedError(400, "invalid_key", "Storage key must not contain empty or .. segments.");
+  }
+  if (!KEY_RE.test(key)) {
+    codedError(400, "invalid_key", "Storage key may only contain A-Za-z0-9._- and /.");
+  }
+  return key;
+}
+
+export function assertObjectSize(size: number): void {
+  if (size > MAX_OBJECT_BYTES) {
+    codedError(400, "object_too_large", "File exceeds the 25MB limit.");
+  }
+}
+
+export function clampStorageExpiresIn(expiresIn?: number): number {
+  if (!expiresIn || !Number.isFinite(expiresIn)) return PRESIGN_GET_DEFAULT;
+  return Math.min(Math.max(Math.trunc(expiresIn), 1), PRESIGN_GET_MAX);
+}
+
+function serveSignature(secret: string, projectId: string, key: string, exp: number): string {
+  return createHmac("sha256", secret).update(`${projectId}\n${key}\n${exp}`).digest("hex");
+}
+
+export function mintStorageServeToken(
+  secret: string,
+  projectId: string,
+  key: string,
+  expiresIn?: number,
+): { exp: number; sig: string } {
+  const exp = Math.floor(Date.now() / 1000) + clampStorageExpiresIn(expiresIn);
+  return { exp, sig: serveSignature(secret, projectId, key, exp) };
+}
+
+export function verifyStorageServeToken(
+  secret: string,
+  projectId: string,
+  key: string,
+  query: { exp?: unknown; sig?: unknown },
+): boolean {
+  const expRaw = Array.isArray(query.exp) ? query.exp[0] : query.exp;
+  const sigRaw = Array.isArray(query.sig) ? query.sig[0] : query.sig;
+  if (typeof expRaw !== "string" && typeof expRaw !== "number") return false;
+  if (typeof sigRaw !== "string" || !sigRaw) return false;
+  const exp = Number(expRaw);
+  if (!Number.isFinite(exp) || exp <= Math.floor(Date.now() / 1000)) return false;
+  const expected = serveSignature(secret, projectId, key, Math.trunc(exp));
+  const given = sigRaw.toLowerCase();
+  if (expected.length !== given.length) return false;
+  return timingSafeEqual(Buffer.from(expected), Buffer.from(given));
+}