@rpcbase/server 0.512.0 → 0.514.0

package/dist/{handler-Bh3a6Br1.js → handler-GZgk5k3c.js}

@@ -2,7 +2,7 @@ import { models, getTenantFilesystemDb } from "@rpcbase/db";
 import { GridFSBucket, ObjectId } from "mongodb";
 import { JSDOM } from "jsdom";
 import createDOMPurify from "dompurify";
-import { g as getTenantId, a as getModelCtx, b as buildUploadsAbility, c as getUploadSessionAccessQuery, e as ensureUploadIndexes, d as getBucketName, f as getUserId, h as getChunkSizeBytes, i as getSessionTtlMs, j as computeSha256Hex, t as toBufferPayload, n as normalizeSha256Hex, k as getMaxClientUploadBytesPerSecond, l as getRawBodyLimitBytes } from "./shared-BJomDDWK.js";
+import { g as getTenantId, a as getModelCtx, b as buildUploadsAbility, c as getUploadSessionAccessQuery, e as ensureUploadIndexes, d as getBucketName, f as getUserId, h as getChunkSizeBytes, i as getSessionTtlMs, j as computeSha256Hex, t as toBufferPayload, n as normalizeSha256Hex, k as getMaxClientUploadBytesPerSecond, l as getRawBodyLimitBytes } from "./shared-Dy9x-P7F.js";
 import { randomBytes } from "node:crypto";
 import { o as object, n as number, b as boolean, s as string, a as array, _ as _enum } from "./schemas-Cjdjgehl.js";
 const MAX_SVG_BYTES = 128 * 1024;
@@ -16,12 +16,17 @@ const looksLikeSvgText = (text) => {
 };
 const looksLikeSvg = (sniff) => looksLikeSvgText(sniff.toString("utf8"));
 const sanitizeSvg = (svg) => DOMPurify.sanitize(svg, {
-  USE_PROFILES: { svg: true, svgFilters: true }
+  USE_PROFILES: {
+    svg: true,
+    svgFilters: true
+  }
 });
 const sanitizeSvgProcessor = {
   id: "sanitize-svg",
   maxBytes: MAX_SVG_BYTES,
-  match: ({ sniff }) => looksLikeSvg(sniff),
+  match: ({
+    sniff
+  }) => looksLikeSvg(sniff),
   process: (data) => {
     if (data.length > MAX_SVG_BYTES) {
       throw new Error("svg_too_large");
@@ -38,7 +43,10 @@ const sanitizeSvgProcessor = {
     if (sanitizedBuffer.length > MAX_SVG_BYTES) {
       throw new Error("svg_too_large");
     }
-    return { data: sanitizedBuffer, mimeType: "image/svg+xml" };
+    return {
+      data: sanitizedBuffer,
+      mimeType: "image/svg+xml"
+    };
   }
 };
 const uploadProcessors = Object.freeze([sanitizeSvgProcessor]);
@@ -115,53 +123,94 @@ const completeUpload = async (_payload, ctx) => {
   const tenantId = getTenantId(ctx);
   if (!tenantId) {
     ctx.res.status(400);
-    return { ok: false, error: "tenant_missing" };
+    return {
+      ok: false,
+      error: "tenant_missing"
+    };
   }
   const uploadId = String(ctx.req.params?.uploadId ?? "").trim();
   if (!uploadId) {
     ctx.res.status(400);
-    return { ok: false, error: "invalid_upload_id" };
+    return {
+      ok: false,
+      error: "invalid_upload_id"
+    };
   }
   const modelCtx = getModelCtx(ctx, tenantId);
-  const [UploadSession, UploadChunk] = await Promise.all([
-    models.get("RBUploadSession", modelCtx),
-    models.get("RBUploadChunk", modelCtx)
-  ]);
+  const [UploadSession, UploadChunk] = await Promise.all([models.get("RBUploadSession", modelCtx), models.get("RBUploadChunk", modelCtx)]);
   const ability = buildUploadsAbility(ctx, tenantId);
   if (!ability.can("update", "RBUploadSession")) {
     ctx.res.status(401);
-    return { ok: false, error: "unauthorized" };
+    return {
+      ok: false,
+      error: "unauthorized"
+    };
   }
-  const existing = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "read")] }).lean();
+  const existing = await UploadSession.findOne({
+    $and: [{
+      _id: uploadId
+    }, getUploadSessionAccessQuery(ability, "read")]
+  }).lean();
   if (!existing) {
     ctx.res.status(404);
-    return { ok: false, error: "not_found" };
+    return {
+      ok: false,
+      error: "not_found"
+    };
   }
   if (existing.status === "done" && existing.fileId) {
-    return { ok: true, fileId: existing.fileId };
+    return {
+      ok: true,
+      fileId: existing.fileId
+    };
   }
-  const locked = await UploadSession.findOneAndUpdate(
-    { $and: [{ _id: uploadId }, { status: "uploading" }, getUploadSessionAccessQuery(ability, "update")] },
-    { $set: { status: "assembling" }, $unset: { error: "" } },
-    { new: true }
-  ).lean();
+  const locked = await UploadSession.findOneAndUpdate({
+    $and: [{
+      _id: uploadId
+    }, {
+      status: "uploading"
+    }, getUploadSessionAccessQuery(ability, "update")]
+  }, {
+    $set: {
+      status: "assembling"
+    },
+    $unset: {
+      error: ""
+    }
+  }, {
+    new: true
+  }).lean();
   if (!locked) {
     ctx.res.status(409);
-    return { ok: false, error: "not_uploading" };
+    return {
+      ok: false,
+      error: "not_uploading"
+    };
   }
   await ensureUploadIndexes(UploadSession, UploadChunk);
   const fsDb = await getTenantFilesystemDb(tenantId);
   const nativeDb = fsDb.db;
   if (!nativeDb) {
-    await UploadSession.updateOne(
-      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "update")] },
-      { $set: { status: "error", error: "filesystem_db_unavailable" } }
-    );
+    await UploadSession.updateOne({
+      $and: [{
+        _id: uploadId
+      }, getUploadSessionAccessQuery(ability, "update")]
+    }, {
+      $set: {
+        status: "error",
+        error: "filesystem_db_unavailable"
+      }
+    });
     ctx.res.status(500);
-    return { ok: false, error: "assembly_failed" };
+    return {
+      ok: false,
+      error: "assembly_failed"
+    };
   }
   const bucketName = getBucketName();
-  const bucket = new GridFSBucket(nativeDb, { bucketName });
+  const bucket = new GridFSBucket(nativeDb, {
+    bucketName
+  });
   const lockedUserId = typeof locked.userId === "string" ? locked.userId : void 0;
   const maxProcessorBytes = getMaxUploadProcessorBytes();
   const shouldBufferForProcessing = locked.totalSize <= maxProcessorBytes;
@@ -172,7 +221,11 @@ const completeUpload = async (_payload, ctx) => {
     if (!shouldBufferForProcessing && declaredSvg) {
       throw new Error("svg_too_large");
     }
-    const cursor = UploadChunk.find({ uploadId }).sort({ index: 1 }).cursor();
+    const cursor = UploadChunk.find({
+      uploadId
+    }).sort({
+      index: 1
+    }).cursor();
     let expectedIndex = 0;
     const chunks = [];
     let bufferedBytes = 0;
@@ -214,9 +267,15 @@ const completeUpload = async (_payload, ctx) => {
                 tenantId,
                 mimeType: locked.mimeType,
                 totalSize: locked.totalSize,
-                ...typeof locked.isPublic === "boolean" ? { isPublic: locked.isPublic } : {},
-                ...typeof locked.ownerKeyHash === "string" ? { ownerKeyHash: locked.ownerKeyHash } : {},
-                ...lockedUserId ? { userId: lockedUserId } : {}
+                ...typeof locked.isPublic === "boolean" ? {
+                  isPublic: locked.isPublic
+                } : {},
+                ...typeof locked.ownerKeyHash === "string" ? {
+                  ownerKeyHash: locked.ownerKeyHash
+                } : {},
+                ...lockedUserId ? {
+                  userId: lockedUserId
+                } : {}
               }
             });
             for (const pending of pendingChunks) {
@@ -240,7 +299,11 @@ const completeUpload = async (_payload, ctx) => {
     }
     if (shouldBufferForProcessing) {
       const assembled = Buffer.concat(chunks, bufferedBytes);
-      const { data: processed, mimeType: processedMimeType, applied } = await applyUploadProcessors(assembled, {
+      const {
+        data: processed,
+        mimeType: processedMimeType,
+        applied
+      } = await applyUploadProcessors(assembled, {
         filename: locked.filename,
         clientMimeType: locked.mimeType
       });
@@ -250,10 +313,19 @@ const completeUpload = async (_payload, ctx) => {
           tenantId,
           mimeType: processedMimeType,
           totalSize: locked.totalSize,
-          ...applied.length ? { processors: applied, processedSize: processed.length } : {},
-          ...typeof locked.isPublic === "boolean" ? { isPublic: locked.isPublic } : {},
-          ...typeof locked.ownerKeyHash === "string" ? { ownerKeyHash: locked.ownerKeyHash } : {},
-          ...lockedUserId ? { userId: lockedUserId } : {}
+          ...applied.length ? {
+            processors: applied,
+            processedSize: processed.length
+          } : {},
+          ...typeof locked.isPublic === "boolean" ? {
+            isPublic: locked.isPublic
+          } : {},
+          ...typeof locked.ownerKeyHash === "string" ? {
+            ownerKeyHash: locked.ownerKeyHash
+          } : {},
+          ...lockedUserId ? {
+            userId: lockedUserId
+          } : {}
         }
       });
       const finished = waitForStreamFinished(uploadStream);
@@ -277,9 +349,15 @@ const completeUpload = async (_payload, ctx) => {
             tenantId,
             mimeType: locked.mimeType,
             totalSize: locked.totalSize,
-            ...typeof locked.isPublic === "boolean" ? { isPublic: locked.isPublic } : {},
-            ...typeof locked.ownerKeyHash === "string" ? { ownerKeyHash: locked.ownerKeyHash } : {},
-            ...lockedUserId ? { userId: lockedUserId } : {}
+            ...typeof locked.isPublic === "boolean" ? {
+              isPublic: locked.isPublic
+            } : {},
+            ...typeof locked.ownerKeyHash === "string" ? {
+              ownerKeyHash: locked.ownerKeyHash
+            } : {},
+            ...lockedUserId ? {
+              userId: lockedUserId
+            } : {}
           }
         });
         for (const pending of pendingChunks) {
@@ -295,80 +373,146 @@ const completeUpload = async (_payload, ctx) => {
     if (!fileId) {
       throw new Error("missing_file_id");
     }
-    await UploadSession.updateOne(
-      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "update")] },
-      { $set: { status: "done", fileId }, $unset: { error: "" } }
-    );
+    await UploadSession.updateOne({
+      $and: [{
+        _id: uploadId
+      }, getUploadSessionAccessQuery(ability, "update")]
+    }, {
+      $set: {
+        status: "done",
+        fileId
+      },
+      $unset: {
+        error: ""
+      }
+    });
     try {
-      await UploadChunk.deleteMany({ uploadId });
+      await UploadChunk.deleteMany({
+        uploadId
+      });
     } catch {
     }
-    return { ok: true, fileId };
+    return {
+      ok: true,
+      fileId
+    };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     await abortUploadStream(uploadStream);
     if (message === "missing_chunks") {
-      await UploadSession.updateOne(
-        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "update")] },
-        { $set: { status: "uploading" } }
-      );
+      await UploadSession.updateOne({
+        $and: [{
+          _id: uploadId
+        }, getUploadSessionAccessQuery(ability, "update")]
+      }, {
+        $set: {
+          status: "uploading"
+        }
+      });
       ctx.res.status(409);
-      return { ok: false, error: "missing_chunks" };
+      return {
+        ok: false,
+        error: "missing_chunks"
+      };
     }
     if (message === "svg_too_large") {
-      await UploadSession.updateOne(
-        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "update")] },
-        { $set: { status: "error", error: message } }
-      );
+      await UploadSession.updateOne({
+        $and: [{
+          _id: uploadId
+        }, getUploadSessionAccessQuery(ability, "update")]
+      }, {
+        $set: {
+          status: "error",
+          error: message
+        }
+      });
       ctx.res.status(413);
-      return { ok: false, error: message };
+      return {
+        ok: false,
+        error: message
+      };
     }
     if (message === "svg_invalid" || message === "svg_sanitize_failed") {
-      await UploadSession.updateOne(
-        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "update")] },
-        { $set: { status: "error", error: message } }
-      );
+      await UploadSession.updateOne({
+        $and: [{
+          _id: uploadId
+        }, getUploadSessionAccessQuery(ability, "update")]
+      }, {
+        $set: {
+          status: "error",
+          error: message
+        }
+      });
       ctx.res.status(400);
-      return { ok: false, error: message };
+      return {
+        ok: false,
+        error: message
+      };
     }
-    await UploadSession.updateOne(
-      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "update")] },
-      { $set: { status: "error", error: message } }
-    );
+    await UploadSession.updateOne({
+      $and: [{
+        _id: uploadId
+      }, getUploadSessionAccessQuery(ability, "update")]
+    }, {
+      $set: {
+        status: "error",
+        error: message
+      }
+    });
     ctx.res.status(500);
-    return { ok: false, error: "assembly_failed" };
+    return {
+      ok: false,
+      error: "assembly_failed"
+    };
   }
 };
 const getStatus = async (_payload, ctx) => {
   const tenantId = getTenantId(ctx);
   if (!tenantId) {
     ctx.res.status(400);
-    return { ok: false, error: "tenant_missing" };
+    return {
+      ok: false,
+      error: "tenant_missing"
+    };
   }
   const uploadId = String(ctx.req.params?.uploadId ?? "").trim();
   if (!uploadId) {
     ctx.res.status(400);
-    return { ok: false, error: "invalid_upload_id" };
+    return {
+      ok: false,
+      error: "invalid_upload_id"
+    };
   }
   const modelCtx = getModelCtx(ctx, tenantId);
-  const [UploadSession, UploadChunk] = await Promise.all([
-    models.get("RBUploadSession", modelCtx),
-    models.get("RBUploadChunk", modelCtx)
-  ]);
+  const [UploadSession, UploadChunk] = await Promise.all([models.get("RBUploadSession", modelCtx), models.get("RBUploadChunk", modelCtx)]);
   const ability = buildUploadsAbility(ctx, tenantId);
   if (!ability.can("read", "RBUploadSession")) {
     ctx.res.status(401);
-    return { ok: false, error: "unauthorized" };
+    return {
+      ok: false,
+      error: "unauthorized"
+    };
   }
-  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "read")] }).lean();
+  const session = await UploadSession.findOne({
+    $and: [{
+      _id: uploadId
+    }, getUploadSessionAccessQuery(ability, "read")]
+  }).lean();
   if (!session) {
     ctx.res.status(404);
-    return { ok: false, error: "not_found" };
+    return {
+      ok: false,
+      error: "not_found"
+    };
   }
-  const receivedDocs = await UploadChunk.find(
-    { uploadId },
-    { index: 1, _id: 0 }
-  ).sort({ index: 1 }).lean();
+  const receivedDocs = await UploadChunk.find({
+    uploadId
+  }, {
+    index: 1,
+    _id: 0
+  }).sort({
+    index: 1
+  }).lean();
   const received = receivedDocs.map((doc) => typeof doc.index === "number" ? doc.index : -1).filter((n) => Number.isInteger(n) && n >= 0);
   return {
     ok: true,
@@ -376,7 +520,9 @@ const getStatus = async (_payload, ctx) => {
     chunkSize: session.chunkSize,
     chunksTotal: session.chunksTotal,
     received,
-    ...session.fileId ? { fileId: session.fileId } : {}
+    ...session.fileId ? {
+      fileId: session.fileId
+    } : {}
   };
 };
 const InitRoute = "/api/rb/file-uploads";
@@ -415,22 +561,30 @@ const initUpload = async (payload, ctx) => {
   const tenantId = getTenantId(ctx);
   if (!tenantId) {
     ctx.res.status(400);
-    return { ok: false, error: "tenant_missing" };
+    return {
+      ok: false,
+      error: "tenant_missing"
+    };
   }
   const userId = getUserId(ctx);
   const parsed = initRequestSchema.safeParse(payload ?? {});
   if (!parsed.success) {
     ctx.res.status(400);
-    return { ok: false, error: "invalid_payload" };
+    return {
+      ok: false,
+      error: "invalid_payload"
+    };
   }
   const chunkSize = getChunkSizeBytes();
-  const { filename, mimeType, totalSize, isPublic } = parsed.data;
+  const {
+    filename,
+    mimeType,
+    totalSize,
+    isPublic
+  } = parsed.data;
   const chunksTotal = Math.ceil(totalSize / chunkSize);
   const modelCtx = getModelCtx(ctx, tenantId);
-  const [UploadSession, UploadChunk] = await Promise.all([
-    models.get("RBUploadSession", modelCtx),
-    models.get("RBUploadChunk", modelCtx)
-  ]);
+  const [UploadSession, UploadChunk] = await Promise.all([models.get("RBUploadSession", modelCtx), models.get("RBUploadChunk", modelCtx)]);
   await ensureUploadIndexes(UploadSession, UploadChunk);
   const uploadId = new ObjectId().toString();
   const now = Date.now();
@@ -439,11 +593,17 @@ const initUpload = async (payload, ctx) => {
   const ownerKeyHash = uploadKey ? computeSha256Hex(Buffer.from(uploadKey)) : void 0;
   await UploadSession.create({
     _id: uploadId,
-    ...userId ? { userId } : {},
-    ...ownerKeyHash ? { ownerKeyHash } : {},
+    ...userId ? {
+      userId
+    } : {},
+    ...ownerKeyHash ? {
+      ownerKeyHash
+    } : {},
     filename,
     mimeType,
-    ...typeof isPublic === "boolean" ? { isPublic } : {},
+    ...typeof isPublic === "boolean" ? {
+      isPublic
+    } : {},
     totalSize,
     chunkSize,
     chunksTotal,
@@ -456,58 +616,88 @@ const initUpload = async (payload, ctx) => {
     uploadId,
     chunkSize,
     chunksTotal,
-    ...uploadKey ? { uploadKey } : {}
+    ...uploadKey ? {
+      uploadKey
+    } : {}
   };
 };
 const uploadChunk = async (payload, ctx) => {
   const tenantId = getTenantId(ctx);
   if (!tenantId) {
     ctx.res.status(400);
-    return { ok: false, error: "tenant_missing" };
+    return {
+      ok: false,
+      error: "tenant_missing"
+    };
   }
   const uploadId = String(ctx.req.params?.uploadId ?? "").trim();
   const indexRaw = String(ctx.req.params?.index ?? "").trim();
   const index = Number(indexRaw);
   if (!uploadId || !Number.isInteger(index) || index < 0) {
     ctx.res.status(400);
-    return { ok: false, error: "invalid_chunk_ref" };
+    return {
+      ok: false,
+      error: "invalid_chunk_ref"
+    };
   }
   const modelCtx = getModelCtx(ctx, tenantId);
-  const [UploadSession, UploadChunk] = await Promise.all([
-    models.get("RBUploadSession", modelCtx),
-    models.get("RBUploadChunk", modelCtx)
-  ]);
+  const [UploadSession, UploadChunk] = await Promise.all([models.get("RBUploadSession", modelCtx), models.get("RBUploadChunk", modelCtx)]);
   const ability = buildUploadsAbility(ctx, tenantId);
   if (!ability.can("update", "RBUploadSession")) {
     ctx.res.status(401);
-    return { ok: false, error: "unauthorized" };
+    return {
+      ok: false,
+      error: "unauthorized"
+    };
   }
-  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, "update")] }).lean();
+  const session = await UploadSession.findOne({
+    $and: [{
+      _id: uploadId
+    }, getUploadSessionAccessQuery(ability, "update")]
+  }).lean();
   if (!session) {
     ctx.res.status(404);
-    return { ok: false, error: "not_found" };
+    return {
+      ok: false,
+      error: "not_found"
+    };
   }
   if (session.status !== "uploading") {
     ctx.res.status(409);
-    return { ok: false, error: "not_uploading" };
+    return {
+      ok: false,
+      error: "not_uploading"
+    };
   }
   if (index >= session.chunksTotal) {
     ctx.res.status(400);
-    return { ok: false, error: "index_out_of_range" };
+    return {
+      ok: false,
+      error: "index_out_of_range"
+    };
   }
   const data = toBufferPayload(payload);
   if (!data) {
     ctx.res.status(400);
-    return { ok: false, error: "invalid_body" };
+    return {
+      ok: false,
+      error: "invalid_body"
+    };
   }
   const expectedSize = index === session.chunksTotal - 1 ? session.totalSize - session.chunkSize * (session.chunksTotal - 1) : session.chunkSize;
   if (data.length > expectedSize) {
     ctx.res.status(413);
-    return { ok: false, error: "chunk_too_large" };
+    return {
+      ok: false,
+      error: "chunk_too_large"
+    };
   }
   if (data.length !== expectedSize) {
     ctx.res.status(400);
-    return { ok: false, error: "invalid_chunk_size" };
+    return {
+      ok: false,
+      error: "invalid_chunk_size"
+    };
   }
   const checksumHeader = ctx.req.get("X-Chunk-SHA256");
   const sha256 = checksumHeader ? computeSha256Hex(data) : void 0;
@@ -515,29 +705,35 @@ const uploadChunk = async (payload, ctx) => {
     const expectedSha256 = normalizeSha256Hex(checksumHeader);
     if (sha256 !== expectedSha256) {
       ctx.res.status(400);
-      return { ok: false, error: "checksum_mismatch" };
+      return {
+        ok: false,
+        error: "checksum_mismatch"
+      };
     }
   }
   await ensureUploadIndexes(UploadSession, UploadChunk);
-  await UploadChunk.updateOne(
-    { uploadId, index },
-    {
-      $set: {
-        uploadId,
-        index,
-        data,
-        size: data.length,
-        sha256,
-        expiresAt: session.expiresAt
-      },
-      $setOnInsert: {
-        createdAt: /* @__PURE__ */ new Date()
-      }
+  await UploadChunk.updateOne({
+    uploadId,
+    index
+  }, {
+    $set: {
+      uploadId,
+      index,
+      data,
+      size: data.length,
+      sha256,
+      expiresAt: session.expiresAt
     },
-    { upsert: true }
-  );
+    $setOnInsert: {
+      createdAt: /* @__PURE__ */ new Date()
+    }
+  }, {
+    upsert: true
+  });
   ctx.res.status(204);
-  return { ok: true };
+  return {
+    ok: true
+  };
 };
 const rawBodyParser = ({
   limitBytes,
@@ -584,7 +780,10 @@ const rawBodyParser = ({
         done = true;
         cleanup();
         req.destroy();
-        res.status(413).json({ ok: false, error: "chunk_too_large" });
+        res.status(413).json({
+          ok: false,
+          error: "chunk_too_large"
+        });
         return;
       }
       chunks.push(buffer);
@@ -666,13 +865,10 @@ const consumeRateBudget = (state, bytes, rateBytesPerSecond, now) => {
 };
 const handler = (api) => {
   const chunkSizeBytes = getChunkSizeBytes();
-  api.use(
-    InitRoute,
-    rawBodyParser({
-      limitBytes: getRawBodyLimitBytes(chunkSizeBytes),
-      maxClientBytesPerSecond: getMaxClientUploadBytesPerSecond()
-    })
-  );
+  api.use(InitRoute, rawBodyParser({
+    limitBytes: getRawBodyLimitBytes(chunkSizeBytes),
+    maxClientBytesPerSecond: getMaxClientUploadBytesPerSecond()
+  }));
   api.post(InitRoute, initUpload);
   api.put(ChunkRoute, uploadChunk);
   api.get(StatusRoute, getStatus);
@@ -681,4 +877,4 @@ const handler = (api) => {
 export {
   handler as default
 };
-//# sourceMappingURL=handler-Bh3a6Br1.js.map
+//# sourceMappingURL=handler-GZgk5k3c.js.map