@things-factory/attachment-base 10.1.111 → 10.1.113

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/attachment-base",
-  "version": "10.1.111",
+  "version": "10.1.113",
   "main": "dist-server/index.js",
   "browser": "client/index.js",
   "things-factory": true,
@@ -29,12 +29,12 @@
     "@aws-sdk/s3-presigned-post": "^3.46.0",
     "@azure/storage-blob": "^12.18.0",
     "@koa/multer": "^3.0.0",
-    "@things-factory/auth-base": "^10.1.111",
+    "@things-factory/auth-base": "^10.1.113",
     "@things-factory/env": "^10.1.20",
     "@things-factory/shell": "^10.1.106",
     "mime": "^3.0.0",
     "multer": "^1.4.5-lts.1",
     "sharp": "^0.33.0"
   },
-  "gitHead": "f33122c15e5b3e45393129e9418e2c367a273ade"
+  "gitHead": "9da1e467ddce23e600e64f08454289cb3b806212"
 }

package/tests/attachment-access.test.ts

@@ -0,0 +1,104 @@
+/**
+ * Who reads an attachment, and the share link - ADR-0106 decisions 2 and 3. Pure rules, compiled package.
+ */
+const access = require('../dist-server/attachment-access')
+const rule = require('../dist-server/service/attachment-share/attachment-share-rule')
+
+const ID = '3f2a9c1e-1111-4aaa-8bbb-0123456789ab'
+const context = (domainId = 'd1', userId: string | null = 'u1') => ({ state: { domain: { id: domainId }, user: userId ? { id: userId } : undefined } })
+const row = (over: any = {}) => ({ id: ID, path: `${ID}.png`, domainId: 'd1', refType: '', ...over })
+
+afterEach(() => {
+  access.registerAttachmentReader('', null)
+  access.registerAttachmentReader('expense', null)
+})
+
+describe('the id a storage path carries', () => {
+  it('★ <uuid>.<ext> and <uuid> - nothing else is an attachment path', () => {
+    expect(access.attachmentIdOf(`${ID}.png`)).toBe(ID)
+    expect(access.attachmentIdOf(ID)).toBe(ID)
+    for (const bad of ['', 'x.png', '../etc/passwd', `${ID}/x.png`, `a/${ID}.png`]) expect([bad, access.attachmentIdOf(bad)]).toEqual([bad, null])
+  })
+})
+
+describe('who may read (decision 2)', () => {
+  it('★ only the attachment\'s domain - another domain reads nothing, the parent is not opened here', async () => {
+    expect(await access.mayRead(row(), context('d1'))).toBe(true)
+    expect(await access.mayRead(row(), context('d2'))).toBe(false)
+  })
+
+  it('★ nobody signed in reads nothing', async () => {
+    expect(await access.mayRead(row({ refType: '' }), context('d1', null))).toBe(false)
+  })
+
+  it('★ a registered reader decides for its refType - and a reader that throws is a no', async () => {
+    access.registerAttachmentReader('', () => false)
+    expect(await access.mayRead(row(), context())).toBe(false)
+    access.registerAttachmentReader('', () => {
+      throw new Error('broken')
+    })
+    expect(await access.mayRead(row(), context())).toBe(false)
+    access.registerAttachmentReader('', async () => true)
+    expect(await access.mayRead(row(), context())).toBe(true)
+  })
+
+  it('★ a refType on neither list stays closed - a new one cannot open by being forgotten', async () => {
+    expect(await access.mayRead(row({ refType: 'SomethingNew' }), context())).toBe(false)
+    access.registerAttachmentReader('expense', () => true)
+    expect(await access.mayRead(row({ refType: 'expense' }), context())).toBe(true)
+  })
+
+  it('the two lists do not overlap', () => {
+    for (const refType of access.SENSITIVE_REF_TYPES) expect([refType, access.ORDINARY_REF_TYPES.has(refType)]).toEqual([refType, false])
+  })
+
+  it('★ a sensitive refType with no reader stays closed', async () => {
+    for (const refType of access.SENSITIVE_REF_TYPES) {
+      expect([refType, await access.mayRead(row({ refType }), context())]).toEqual([refType, false])
+    }
+  })
+})
+
+describe('the share link (decision 3)', () => {
+  const NOW = new Date('2026-10-02T09:00:00Z')
+  const share = { id: 's1', attachmentId: ID, domainId: 'd1', expiresAt: new Date('2026-10-09T09:00:00Z') }
+
+  it('★ opens with its own signature, before expiry, while not taken back', () => {
+    const signature = rule.shareSignature('secret', share)
+    expect(rule.shareOpens('secret', share, signature, NOW)).toBe(true)
+    expect(rule.shareOpens('secret', { ...share, revokedAt: NOW }, signature, NOW)).toBe(false)
+    expect(rule.shareOpens('secret', share, signature, new Date('2026-10-09T09:00:01Z'))).toBe(false)
+  })
+
+  it('★ the signature binds the attachment, the domain and the expiry - change one and it does not open', () => {
+    const signature = rule.shareSignature('secret', share)
+    for (const changed of [{ attachmentId: 'other' }, { domainId: 'd2' }, { expiresAt: new Date('2027-01-01T00:00:00Z') }, { id: 's2' }]) {
+      expect(rule.shareOpens('secret', { ...share, ...changed }, signature, NOW)).toBe(false)
+    }
+    expect(rule.shareOpens('other-secret', share, signature, NOW)).toBe(false)
+    expect(rule.shareOpens('secret', share, '', NOW)).toBe(false)
+  })
+
+  it('the address carries the link id and the signature, not the file path', () => {
+    const url = rule.shareUrl('secret', share)
+    expect(url.startsWith('/attachment-share/s1/')).toBe(true)
+    expect(url).not.toContain(ID)
+  })
+
+  it('★ a caller may shorten the default expiry, never lengthen it', () => {
+    expect(rule.shareExpiry(NOW, 168).toISOString()).toBe('2026-10-09T09:00:00.000Z')
+    expect(rule.shareExpiry(NOW, 168, 24).toISOString()).toBe('2026-10-03T09:00:00.000Z')
+    expect(rule.shareExpiry(NOW, 168, 9999).toISOString()).toBe('2026-10-09T09:00:00.000Z')
+  })
+})
+
+describe('a refType its module guards (figure-thumbnail, Figure 711dd85af0)', () => {
+  afterEach(() => access.registerAttachmentReader('figure-thumbnail', null))
+
+  it('★ closed until the module registers its reader - then the reader decides', async () => {
+    expect(access.ORDINARY_REF_TYPES.has('figure-thumbnail')).toBe(false)
+    expect(await access.mayRead(row({ refType: 'figure-thumbnail' }), context())).toBe(false)
+    access.registerAttachmentReader('figure-thumbnail', () => true)
+    expect(await access.mayRead(row({ refType: 'figure-thumbnail' }), context())).toBe(true)
+  })
+})

package/tests/attachment-route.test.ts

@@ -0,0 +1,88 @@
+/**
+ * The attachment route, step one of ADR-0106: the anonymous upload is gone, and no shared cache keeps an attachment.
+ *
+ * The compiled package is used (entities and resolvers need tsc's decorator metadata). The storage is a stand-in -
+ * the test environment configures none - so the route and createAttachment run as they are, against a storage that
+ * only records what it was asked.
+ */
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+const mockStored: any[] = []
+const mockStorage = {
+  type: 'stand-in',
+  sendFile: jest.fn(async (context: any) => {
+    context.body = 'bytes'
+  }),
+  uploadFile: jest.fn(async () => {
+    const one = { id: 'a1', path: 'a1.txt', size: 3, filename: 'note.txt', encoding: '7bit', contents: Buffer.from('abc') }
+    mockStored.push(one)
+    return one
+  }),
+  deleteFile: jest.fn()
+}
+
+jest.mock('../dist-server/attachment-const', () => ({ ...jest.requireActual('../dist-server/attachment-const'), STORAGE: mockStorage }))
+
+const { ATTACHMENT_CACHE_CONTROL } = jest.requireActual('../dist-server/attachment-const')
+
+/* Only the listeners this module adds - other modules loaded in the same process listen on the same event. */
+const before = new Set(process.listeners('bootstrap-module-global-public-route' as any))
+require('../dist-server/routes')
+const mine = process
+  .listeners('bootstrap-module-global-public-route' as any)
+  .filter(listener => !before.has(listener) && /ATTACHMENT_PATH/.test(String(listener)))
+
+function routesRegistered() {
+  const routes: Record<string, any[]> = { get: [], post: [], put: [], delete: [], all: [] }
+  const router: any = { use: () => {} }
+  for (const method of Object.keys(routes)) router[method] = (path: string, ...handlers: any[]) => routes[method].push({ path, handlers })
+  for (const listener of mine) (listener as any)({}, router)
+  return routes
+}
+
+describe('the attachment route (ADR-0106 decision 1)', () => {
+  it('★ there is no upload route - the anonymous POST /attachment is gone', () => {
+    const routes = routesRegistered()
+    expect(routes.post.map(r => r.path)).toEqual([])
+    expect(routes.get.map(r => r.path)).toEqual(['/attachment/:attachment', '/attachment-share/:share/:signature'])
+  })
+
+  it('★ a served attachment is private - no shared cache keeps it', async () => {
+    const routes = routesRegistered()
+    const headers: Record<string, string> = {}
+    const context: any = { params: { attachment: 'a1.png' }, set: (k: string, v: string) => (headers[k] = v) }
+    const handler = routes.get[0].handlers[routes.get[0].handlers.length - 1]
+    await handler(context, async () => {})
+    expect(headers['Cache-Control']).toBe(ATTACHMENT_CACHE_CONTROL)
+    expect(ATTACHMENT_CACHE_CONTROL).toMatch(/^private\b/)
+  })
+
+  it('★ every storage sets the one private value - s3 and azure used to overwrite it with public', () => {
+    for (const file of ['routes.ts', 'storage-s3.ts', 'storage-azure-blob.ts', 'storage-file.ts', 'storage-database.ts']) {
+      const source = readFileSync(join(__dirname, '..', 'server', file), 'utf8')
+      expect([file, /['"]public\b/.test(source)]).toEqual([file, false])
+    }
+  })
+})
+
+describe('uploading still works - through GraphQL createAttachment', () => {
+  it('★ createAttachment stores the file and saves a row with the domain and the uploader', async () => {
+    const { createAttachment } = require('../dist-server/service/attachment/attachment-mutation')
+    const saved: any[] = []
+    const context: any = {
+      state: {
+        domain: { id: 'd1' },
+        user: { id: 'u1' },
+        tx: { getRepository: () => ({ save: async (row: any) => (saved.push(row), row) }) }
+      },
+      t: (key: string) => key
+    }
+    const file = Promise.resolve({ mimetype: 'text/plain', filename: 'note.txt', encoding: '7bit', createReadStream: () => null })
+
+    const row = await createAttachment(null, { attachment: { file, category: 'doc', refType: 'note', refBy: 'n1' } }, context)
+
+    expect(mockStorage.uploadFile).toHaveBeenCalledTimes(1)
+    expect(row).toMatchObject({ domain: { id: 'd1' }, creator: { id: 'u1' }, path: 'a1.txt', refType: 'note', refBy: 'n1' })
+  })
+})

package/translations/en.json

@@ -3,5 +3,6 @@
   "label.file": "file",
   "label.select file": "select file",
   "label.ref_by": "Reference ID",
-  "error.not allowed file type for upload": "{mimetype} is not an allowed file type for upload."
-}
+  "error.not allowed file type for upload": "{mimetype} is not an allowed file type for upload.",
+  "error.attachment not found": "the attachment is not found."
+}

package/translations/ja.json

@@ -3,5 +3,6 @@
   "label.file": "ファイル",
   "label.select file": "ファイル選択",
   "label.ref_by": "参照 ID",
-  "error.not allowed file type for upload": "{mimetype}はアップロードが許可されていないファイルタイプです。"
+  "error.not allowed file type for upload": "{mimetype}はアップロードが許可されていないファイルタイプです。",
+  "error.attachment not found": "添付ファイルが見つかりません。"
 }

package/translations/ko.json

@@ -3,5 +3,6 @@
   "label.file": "파일",
   "label.select file": "파일 선택",
   "label.ref_by": "참조 ID",
-  "error.not allowed file type for upload": "{mimetype}은 업로드가 허가되지 않은 파일형식입니다."
-}
+  "error.not allowed file type for upload": "{mimetype}은 업로드가 허가되지 않은 파일형식입니다.",
+  "error.attachment not found": "첨부를 찾을 수 없습니다."
+}

package/translations/ms.json

@@ -3,5 +3,6 @@
   "label.file": "fail",
   "label.select file": "pilih fail",
   "label.ref_by": "rujukan ID",
-  "error.not allowed file type for upload": "{mimetype} adalah jenis fail yang tidak dibenarkan untuk dimuat naik."
+  "error.not allowed file type for upload": "{mimetype} adalah jenis fail yang tidak dibenarkan untuk dimuat naik.",
+  "error.attachment not found": "lampiran tidak ditemui."
 }

package/translations/zh.json

@@ -3,5 +3,6 @@
   "label.file": "文件",
   "label.select file": "选择文件",
   "label.ref_by": "参考 ID",
-  "error.not allowed file type for upload": "{mimetype}是未经允许的上传文件类型。"
+  "error.not allowed file type for upload": "{mimetype}是未经允许的上传文件类型。",
+  "error.attachment not found": "找不到附件。"
 }