@rubytech/create-maxy-code 0.1.488 → 0.1.490

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/target.ts

@@ -0,0 +1,91 @@
+// Where an upload may land (Task 1910).
+//
+// Before this, an upload had no destination at all: the key was a flat
+// `ownerId/filename` and the client could not say which folder they meant. This
+// module is the one definition of a legal target on the portal side.
+//
+// It is NOT the security boundary. The device re-derives the account's exposed
+// folder set itself and refuses anything outside it, exactly as the download
+// path already does. Both checks exist for the same reason: if this end is ever
+// wrong — a stale index, a bug here, a compromised Pages project — the device
+// is what contains it. A parity test pins the two rules to the same answers.
+
+import type { D1Database } from './types'
+import { grantAllows } from './session'
+import { ownerPrefix } from './authorize'
+
+/**
+ * One path segment of a legal target: not empty, not a traversal token, and
+ * carrying no separator of either flavour.
+ *
+ * Rejected outright rather than normalised, the same rule and the same reason
+ * as authorizeKey — a normaliser is one more thing that can be wrong, and no
+ * legitimate folder name contains any of these.
+ *
+ * Deliberately identical to the device's own safeSegment in
+ * portal-uploads-pull.ts. The two are separate implementations on purpose (no
+ * import crosses that boundary) and the parity test is what keeps them honest.
+ */
+export function isSafeTargetSegment(s: string): boolean {
+  if (!s || s === '.' || s === '..') return false
+  return !s.includes('/') && !s.includes('\\') && !s.includes('\0')
+}
+
+export type TargetCheck = { ok: true } | { ok: false; reason: 'segment' | 'grant' | 'index' }
+
+/**
+ * Whether this person may upload into `targetPath`.
+ *
+ * Three clauses, in the order that costs least: every segment is safe, the
+ * person's grant admits the top-level name, and the account's published index
+ * carries a folder row for the exact path.
+ *
+ * That last clause is the whole permission model: you can only drop where you
+ * can see. The legal target set is exactly the set of folders already rendered
+ * to this person, so no new concept is introduced and no folder can be named
+ * that the client could not already open.
+ *
+ * The empty target is always legal and costs no query. It is the default
+ * uploads area, which is deliberately never in the index.
+ *
+ * The three reasons are distinct in the log because they mean different things
+ * to an operator: `segment` is a malformed request, `grant` is a person seeing
+ * less than their account exposes, and `index` is usually a folder that exists
+ * on the device but has not been published yet.
+ */
+export async function checkTarget(
+  db: D1Database,
+  accountId: string,
+  grant: string[],
+  targetPath: string,
+): Promise<TargetCheck> {
+  if (targetPath === '') return { ok: true }
+  if (!targetPath.split('/').every(isSafeTargetSegment)) return { ok: false, reason: 'segment' }
+  if (!grantAllows(grant, targetPath)) return { ok: false, reason: 'grant' }
+  const row = await db
+    .prepare(
+      `SELECT d.relPath AS relPath
+         FROM directory d
+         JOIN directory_state s
+           ON s.accountId = d.accountId AND s.currentGeneration = d.generation
+        WHERE d.accountId = ? AND d.relPath = ? AND d.isDir = 1`,
+    )
+    .bind(accountId, targetPath)
+    .first<{ relPath: string }>()
+  return row ? { ok: true } : { ok: false, reason: 'index' }
+}
+
+/**
+ * `ownerId/targetPath/filename`, collapsing to `ownerId/filename` when
+ * untargeted.
+ *
+ * The target is IN the key because `objectKey` is UNIQUE. With a flat key the
+ * same filename dropped into two folders would collide: the upsert would
+ * overwrite the first object, reset its ingested flag, and the first file would
+ * never reach the device at all.
+ */
+export function uploadKey(ownerId: string, targetPath: string, filename: string): string {
+  return targetPath
+    ? `${ownerPrefix(ownerId)}${targetPath}/${filename}`
+    : `${ownerPrefix(ownerId)}${filename}`
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/types.ts

@@ -24,11 +24,34 @@ export interface R2ObjectBody {
   size: number
 }
 
+/** One completed part, as R2 returns it and as `complete` wants it back. */
+export interface R2UploadedPart {
+  partNumber: number
+  etag: string
+}
+
+/**
+ * An open multipart session (Task 1910).
+ *
+ * The client slices a large file and sends parts, because an upload body is
+ * read wholly into the Function's memory: one 1 GiB request would OOM the
+ * isolate, and an OOM emits no [data-portal] line at all. Parts keep the
+ * existing per-request bound and let a large file respect it repeatedly.
+ */
+export interface R2MultipartUpload {
+  uploadId: string
+  uploadPart: (partNumber: number, value: ArrayBuffer | Uint8Array) => Promise<R2UploadedPart>
+  complete: (parts: R2UploadedPart[]) => Promise<{ size?: number } | null>
+  abort: () => Promise<void>
+}
+
 export interface R2Bucket {
   put: (key: string, value: ArrayBuffer | Uint8Array) => Promise<unknown>
   get: (key: string) => Promise<R2ObjectBody | null>
   delete: (key: string) => Promise<void>
   head: (key: string) => Promise<{ size: number } | null>
+  createMultipartUpload: (key: string) => Promise<R2MultipartUpload>
+  resumeMultipartUpload: (key: string, uploadId: string) => R2MultipartUpload
 }
 
 export interface PortalEnv {

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/delete.ts

@@ -22,6 +22,51 @@ export async function processDelete(
   }
   const owner = q(session.ownerId)
 
+  // What the client is asking to remove decides HOW it is removed, so the row
+  // is read before anything is written (Task 1910).
+  const row = await env.DB.prepare('SELECT devicePath FROM manifest WHERE objectKey = ?')
+    .bind(key)
+    .first<{ devicePath: string }>()
+  if (!row) {
+    log(`[data-portal] op=delete owner=${owner} key=${q(key)} result=absent`)
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
+
+  // A moved file's bytes are on the device and its R2 object is already gone.
+  // Deleting here would report success while the client's file stayed on the
+  // device forever. Instead the row is marked, and the pull removes the device
+  // file, confirms it is absent, and only then removes the row — so a
+  // withdrawal completes on BOTH sides or on neither.
+  //
+  // `pending: true` is not decoration: the client is told the file is on its
+  // way out rather than gone, because it will still be there for up to a
+  // minute and saying otherwise would be a lie the next refresh exposes.
+  if (row.devicePath) {
+    try {
+      await env.DB.prepare('UPDATE manifest SET deleted = 1 WHERE objectKey = ?').bind(key).run()
+    } catch (err) {
+      log(
+        `[data-portal] op=withdraw owner=${owner} key=${q(key)} ` +
+          `result=failed err="${(err as Error).message}"`,
+      )
+      return { status: 502, payload: { ok: false, error: 'withdraw failed' } }
+    }
+    // Re-read rather than assume the UPDATE landed: an unmarked row is a
+    // withdrawal the pull will never see, and nothing else would report it.
+    const marked = await env.DB.prepare('SELECT deleted FROM manifest WHERE objectKey = ?')
+      .bind(key)
+      .first<{ deleted: number }>()
+    const ok = marked?.deleted === 1
+    log(
+      `[data-portal] op=withdraw owner=${owner} key=${q(key)} devicePath=${q(row.devicePath)} ` +
+        `ms=${now() - startedMs} result=${ok ? 'marked' : 'not-marked'}`,
+    )
+    return {
+      status: ok ? 200 : 500,
+      payload: { ok, pending: true },
+    }
+  }
+
   // Both writes are wrapped and each emits its own line, mirroring upload's
   // steps 3-5. Unwrapped, a throw here escapes the handler, Pages returns a
   // bare 500, and NOTHING is logged — and if the R2 delete succeeded before the

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/download.ts

@@ -2,10 +2,13 @@ import type { Handler, Logger, PortalEnv, R2ObjectBody } from './_lib/types'
 import { grantAllows, readSessionCookie, resolveSession } from './_lib/session'
 import { q } from './_lib/log'
 import { authorizeKey } from './_lib/authorize'
-import { buildSignedUrl, SIGNED_TTL_MS } from './_lib/portal-sign.mjs'
+import { buildOwnUploadUrl, buildSignedUrl, SIGNED_TTL_MS } from './_lib/portal-sign.mjs'
 
 interface DownloadResult extends Handler {
   body?: R2ObjectBody | null
+  /** Set when the row has moved: the bytes are on the device, so the caller
+   *  302s to a signed own-upload link instead of streaming R2. */
+  url?: string
 }
 
 export async function processDownload(
@@ -25,9 +28,49 @@ export async function processDownload(
     log(`[data-portal] op=download owner=${q(session.ownerId)} result=denied reason=not-owner`)
     return { status: 403, payload: { ok: false, error: 'denied' } }
   }
+  // Where the bytes are decides how they are served (Task 1910). A moved row's
+  // R2 object has been deleted, so reading it here would 404 the client's own
+  // upload the moment the device collected it.
+  const row = await env.DB.prepare('SELECT devicePath FROM manifest WHERE objectKey = ?')
+    .bind(key)
+    .first<{ devicePath: string }>()
+  if (!row) {
+    log(`[data-portal] op=download owner=${q(session.ownerId)} result=absent`)
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
+
+  if (row.devicePath) {
+    const secret = env.PORTAL_FETCH_SECRET
+    const origin = env.PORTAL_INSTALL_ORIGIN
+    if (!secret || !origin) {
+      // Reported as offline rather than a server error, the same judgement the
+      // indexed path makes: from the client's side the file genuinely is
+      // unreachable, and the operator's signal is this line, not a 500.
+      log(`[data-portal] op=download owner=${q(session.ownerId)} result=unconfigured`)
+      return { status: 503, payload: { ok: false, error: 'device-offline' } }
+    }
+    const expiresAt = nowMs + SIGNED_TTL_MS
+    const url = await buildOwnUploadUrl(
+      origin,
+      secret,
+      session.accountId,
+      session.ownerId,
+      row.devicePath,
+      expiresAt,
+    )
+    log(
+      `[data-portal] op=download owner=${q(session.ownerId)} key=${q(key)} ` +
+        `devicePath=${q(row.devicePath)} result=moved`,
+    )
+    return { status: 200, payload: { ok: true, url }, url }
+  }
+
   const obj = await env.BUCKET.get(key)
   if (!obj) {
-    log(`[data-portal] op=download owner=${q(session.ownerId)} result=absent`)
+    // The row says the bytes are in R2 and they are not. That is a phantom row,
+    // which emits nothing at request time anywhere else — the audit's
+    // reconcile is what counts them, and this line is what dates one.
+    log(`[data-portal] op=download owner=${q(session.ownerId)} result=absent reason=no-object`)
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
   log(`[data-portal] op=download owner=${q(session.ownerId)} result=ok bytes=${obj.size ?? 'na'}`)
@@ -83,15 +126,33 @@ export async function processIndexedDownload(
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
 
-  const row = await env.DB.prepare('SELECT relPath FROM directory WHERE accountId = ? AND relPath = ?')
+  const row = await env.DB.prepare(
+    // Through the generation pointer, like every other reader: a row staged by
+    // a push in flight must not be servable before the flip blesses it.
+    `SELECT d.relPath AS relPath, d.isDir AS isDir
+       FROM directory d
+       JOIN directory_state s
+         ON s.accountId = d.accountId AND s.currentGeneration = d.generation
+      WHERE d.accountId = ? AND d.relPath = ?`,
+  )
     .bind(session.accountId, relPath)
-    .first<{ relPath: string }>()
+    .first<{ relPath: string; isDir: number }>()
   if (!row) {
     log(
       `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} result=absent`,
     )
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
+  if (row.isDir) {
+    // Folders are in the index, so a client can name one here. A folder has no
+    // bytes: minting a link would send the device a path it cannot serve, and
+    // the browser an opaque failure. Refused before the probe, and reported
+    // distinguishably from not-granted and absent.
+    log(
+      `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} result=is-directory`,
+    )
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
 
   const secret = env.PORTAL_FETCH_SECRET
   const origin = env.PORTAL_INSTALL_ORIGIN
@@ -164,13 +225,19 @@ export async function onRequestGet(context: PagesContext): Promise<Response> {
   }
 
   const key = params.get('key') ?? ''
-  const { status, payload, body } = await processDownload(
+  const { status, payload, body, url } = await processDownload(
     sessionId,
     key,
     context.env,
     (line) => console.log(line),
     Date.now(),
   )
+  // A moved row has no bytes here to stream. Both the click path and a drag-out
+  // follow a 302 to the device, so this needs no redirect=1 discriminator the
+  // way the indexed path does: there is no JSON alternative to fall back to.
+  if (status === 200 && url) {
+    return Response.redirect(url, 302)
+  }
   if (status === 200 && body) {
     return new Response(body.body, {
       status: 200,

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/files.ts

@@ -6,6 +6,7 @@ interface DirRow {
   relPath: string
   sizeBytes: number
   modifiedAt: string
+  isDir: number
 }
 
 export interface DirEntry {
@@ -19,10 +20,12 @@ export interface DirEntry {
 /**
  * Collapse the flat `directory` rows into one level of listing under `prefix`.
  *
- * Folders are synthesised from path segments rather than stored, so the device
- * publishes files alone and an empty folder simply does not exist. The prefix
- * matches on a whole segment (`quotes/`, not `quotes`), so a partial name can
- * never reach a sibling folder's contents.
+ * The device publishes a row per folder as well as per file, so a folder
+ * holding no files at any depth is a real entry that opens and reads as empty.
+ * Folders are ALSO derived from the path segments of deeper rows, and the two
+ * sources collapse onto one entry per name. The prefix matches on a whole
+ * segment (`quotes/`, not `quotes`), so a partial name can never reach a
+ * sibling folder's contents.
  */
 export function entriesUnder(rows: DirRow[], prefix: string): DirEntry[] {
   const base = prefix ? `${prefix}/` : ''
@@ -34,6 +37,21 @@ export function entriesUnder(rows: DirRow[], prefix: string): DirEntry[] {
     if (!rest) continue
     const slash = rest.indexOf('/')
     if (slash === -1) {
+      // A folder's own row has nothing left after the prefix, exactly like a
+      // file's. `isDir` is the only thing separating them; without it a folder
+      // lands in the file list and a click tries to download it.
+      if (row.isDir) {
+        if (!dirs.has(rest)) {
+          dirs.set(rest, {
+            name: rest,
+            kind: 'directory',
+            relPath: row.relPath,
+            sizeBytes: null,
+            modifiedAt: null,
+          })
+        }
+        continue
+      }
       files.push({
         name: rest,
         kind: 'file',
@@ -62,6 +80,33 @@ export function entriesUnder(rows: DirRow[], prefix: string): DirEntry[] {
   return [...dirList, ...files]
 }
 
+/**
+ * Whether an upload row belongs in the client's own uploads panel (Task 1910).
+ *
+ * One rule covers both halves of the move: a row is listed while its bytes are
+ * still in R2, and after the move ONLY when the file is not reachable in the
+ * folder tree.
+ *
+ * So a targeted file leaves the panel and appears in the folder it was dropped
+ * into, and an untargeted file — which lands in `uploads/`, never exposed —
+ * stays in the panel and downloads through the device. Nothing is listed twice
+ * and nothing becomes unreachable.
+ *
+ * A withdrawn row is hidden while the device removal is pending. That is a
+ * brief state, not a tombstone filter: the row is deleted outright once the
+ * device file is confirmed absent.
+ */
+export function shouldListUpload(
+  row: { devicePath: string; deleted: number },
+  visibleTops: Set<string>,
+): boolean {
+  if (row.deleted) return false
+  if (!row.devicePath) return true
+  // The whole top segment, never a prefix — `job` must not satisfy `jobs`, the
+  // same rule grantAllows follows for the same reason.
+  return !visibleTops.has(row.devicePath.split('/')[0])
+}
+
 export async function processFiles(
   sessionId: string,
   env: PortalEnv,
@@ -76,34 +121,56 @@ export async function processFiles(
   }
   // Scoped by ownerId, not by key prefix: the owner is the authority.
   const rows = await env.DB.prepare(
-    'SELECT fileId, filename, objectKey, size, uploadedAt, ingested FROM manifest WHERE ownerId = ? ORDER BY uploadedAt DESC',
+    'SELECT fileId, filename, objectKey, size, uploadedAt, ingested, targetPath, devicePath, deleted ' +
+      'FROM manifest WHERE ownerId = ? ORDER BY uploadedAt DESC',
   )
     .bind(session.ownerId)
     .all<Record<string, unknown>>()
-  const files = rows.results ?? []
+  const allFiles = rows.results ?? []
 
-  // The account's published folder index, scoped by accountId. No account bound
-  // means no folders: an enrolment predating that column lands here, and the
-  // empty `account=` field in the log line is what says so.
+  // The account's published folder index, scoped by accountId and read through
+  // the generation pointer so a push in flight is never half-visible. No
+  // account bound means no folders: an enrolment predating that column lands
+  // here, and the empty `account=` field in the log line is what says so.
   let entries: DirEntry[] = []
   const grant = session.folders
+  // The tops the client can actually browse. Built from the SAME grant-filtered
+  // rows the tree is built from, so the uploads panel and the tree can never
+  // disagree about what is reachable.
+  const visibleTops = new Set<string>()
   if (session.accountId) {
     const dir = await env.DB.prepare(
-      'SELECT relPath, sizeBytes, modifiedAt FROM directory WHERE accountId = ?',
+      `SELECT d.relPath AS relPath, d.sizeBytes AS sizeBytes, d.modifiedAt AS modifiedAt,
+              d.isDir AS isDir
+         FROM directory d
+         JOIN directory_state s
+           ON s.accountId = d.accountId AND s.currentGeneration = d.generation
+        WHERE d.accountId = ?`,
     )
       .bind(session.accountId)
       .all<DirRow>()
     // The grant narrows below the account's exposed set: keep only rows the
     // grant admits. An empty grant admits everything, which is the full set and
     // today's behaviour.
-    const rows = (dir.results ?? []).filter((row) => grantAllows(grant, row.relPath))
-    entries = entriesUnder(rows, prefix)
+    const granted = (dir.results ?? []).filter((row) => grantAllows(grant, row.relPath))
+    for (const row of granted) visibleTops.add(row.relPath.split('/')[0])
+    entries = entriesUnder(granted, prefix)
   }
 
+  // Filtered AFTER the directory read, because the rule needs to know what the
+  // client can reach. A moved file is not gone; it is listed where it lives.
+  const files = allFiles.filter((f) =>
+    shouldListUpload(
+      { devicePath: String(f.devicePath ?? ''), deleted: Number(f.deleted ?? 0) },
+      visibleTops,
+    ),
+  )
+
   log(
     `[data-portal] op=list owner=${q(session.ownerId)} account=${q(session.accountId)} ` +
       `granted=${grant.length === 0 ? 'full' : grant.length} ` +
-      `prefix=${q(prefix)} files=${files.length} entries=${entries.length} result=ok`,
+      `prefix=${q(prefix)} files=${files.length} moved=${allFiles.length - files.length} ` +
+      `entries=${entries.length} result=ok`,
   )
   return { status: 200, payload: { ok: true, files, entries } }
 }