@ultimat3/storage 22.15.0 → 24.0.0

package/src/upload.ts

@@ -16,6 +16,7 @@ import {
   contentTypeUnrecognised,
   tooLarge,
 } from './errors';
+import { HEIF_CONTAINER, ISO_BMFF_CONTAINER, ISO_BMFF_TYPES, sniffIsoBmff } from './iso-bmff';
 import { assertSafeKey } from './path';
 
 export const DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
@@ -65,7 +66,12 @@ export function uploadPolicy(init: UploadPolicyInit = {}): UploadPolicy {
       init.maxBytes === undefined ? DEFAULT_MAX_UPLOAD_BYTES : init.maxBytes,
       1,
     ),
-    allowedContentTypes: init.allowedContentTypes ?? IMAGE_CONTENT_TYPES,
+    // Normalised, because the declared type is: `validateUpload` and `grantUpload` compare the
+    // NORMALISED declaration against this list, so an allowlist spelling an alias (`image/jpg`,
+    // `audio/x-m4a`) named a type no upload could ever match.
+    allowedContentTypes: (init.allowedContentTypes ?? IMAGE_CONTENT_TYPES).map(
+      normalizeContentType,
+    ),
     requireChecksum: init.requireChecksum ?? false,
   };
 }
@@ -111,7 +117,6 @@ const MAGIC_RULES: readonly MagicRule[] = [
     ],
   },
   { type: 'application/pdf', parts: [{ offset: 0, pattern: ascii('%PDF-') }] },
-  { type: 'video/mp4', parts: [{ offset: 4, pattern: ascii('ftyp') }] },
   // Every OOXML document and epub is a zip; the container is as far as magic bytes go.
   { type: 'application/zip', parts: [{ offset: 0, pattern: [0x50, 0x4b, 0x03, 0x04] }] },
 ];
@@ -154,7 +159,9 @@ export function sniffContentType(bytes: Uint8Array): string | undefined {
   for (const rule of MAGIC_RULES) {
     if (matches(bytes, rule)) return rule.type;
   }
-  return sniffText(bytes);
+  // Not a `MagicRule`: every ISO base media file opens with the same `ftyp` box, and the one rule
+  // that matched it labelled AVIF, HEIC, MOV and M4A all `video/mp4`. The major brand decides.
+  return sniffIsoBmff(bytes) ?? sniffText(bytes);
 }
 
 // A `Map`, not an object literal: `base` is the transport's own `Content-Type` header by the time
@@ -164,6 +171,10 @@ const ALIASES: ReadonlyMap<string, string> = new Map([
   ['image/jpg', 'image/jpeg'],
   ['image/x-png', 'image/png'],
   ['application/x-pdf', 'application/pdf'],
+  // What Chrome and Safari report for an `.m4a` / `.m4v` picked from disk.
+  ['audio/x-m4a', 'audio/mp4'],
+  ['audio/m4a', 'audio/mp4'],
+  ['video/x-m4v', 'video/mp4'],
 ]);
 
 /** Strip parameters and case: `IMAGE/PNG; charset=binary` and `image/png` are one type. */
@@ -182,11 +193,23 @@ const TEXT_FAMILY = new Set([
   'text/xml',
 ]);
 
-/** A generic sniff (zip container, plain text) may stand in for a specific declared type. */
+// A brand that names only the container: `isom` is on an audio-only MP4 as often as on a video,
+// and `mif1` on a still HEIC and a still AVIF alike. `image/heif` is also the general name of a
+// file whose brand says `heic`, so that pair matches in the other direction too.
+const MP4_CONTAINED = new Set(['audio/mp4']);
+const HEIF_CONTAINED = new Set(['image/heic', 'image/avif']);
+
+/**
+ * A generic sniff (zip container, ISO-BMFF container, plain text) may stand in for a specific
+ * declared type.
+ */
 export function contentTypeMatches(declared: string, sniffed: string): boolean {
   const type = normalizeContentType(declared);
   if (type === sniffed) return true;
   if (sniffed === 'application/zip') return ZIP_CONTAINERS.has(type);
+  if (sniffed === ISO_BMFF_CONTAINER) return MP4_CONTAINED.has(type);
+  if (sniffed === HEIF_CONTAINER) return HEIF_CONTAINED.has(type);
+  if (sniffed === 'image/heic') return type === HEIF_CONTAINER;
   if (sniffed === 'text/plain') return TEXT_FAMILY.has(type);
   return false;
 }
@@ -199,7 +222,10 @@ export function contentTypeMatches(declared: string, sniffed: string): boolean {
  * as provably wrong as one under `image/png`.
  */
 function hasSignature(declared: string): boolean {
-  return MAGIC_RULES.some((rule) => contentTypeMatches(declared, rule.type));
+  return (
+    MAGIC_RULES.some((rule) => contentTypeMatches(declared, rule.type)) ||
+    ISO_BMFF_TYPES.some((type) => contentTypeMatches(declared, type))
+  );
 }
 
 /**

package/src/driver-s3-fixture.ts

@@ -1,164 +0,0 @@
-// The in-memory `Bun.S3Client` stand-in the s3 driver's tests drive, and the helpers that read
-// its answers. Shared rather than copied because `driver-s3.test.ts` (reads, copies, listings,
-// credentials) and `driver-s3-put.test.ts` (everything `put()` refuses) must exercise the SAME
-// fake — two fakes drifting apart would be two providers, agreeing only by construction.
-
-import type { S3ClientLike, S3FileLike, S3ListResultLike, S3StatLike } from './driver-s3';
-import { isStorageError, objectNotFound } from './errors';
-
-/** The driver's private `DRIVER_NAME`; the fake reports failures against the same disk. */
-export const FAKE_DISK = 's3';
-
-export interface FakeObject {
-  bytes: Uint8Array;
-  type?: string | undefined;
-  etag?: string | undefined;
-  lastModified?: string | Date | undefined;
-}
-
-export interface PresignCall {
-  key: string;
-  options: {
-    method?: string | undefined;
-    expiresIn?: number | undefined;
-    type?: string | undefined;
-  };
-}
-
-export interface ListCall {
-  prefix?: string | undefined;
-  maxKeys?: number | undefined;
-  continuationToken?: string | undefined;
-}
-
-/**
- * What Bun hands back when the SERVICE refuses: an ordinary `Error` named `S3Error`, carrying the
- * provider's own code and status. The driver must read those structurally, because nothing in the
- * type system says a caught value has them.
- */
-export function s3Error(code: string, statusCode: number, key: string): Error {
-  return Object.assign(new Error(`${code}: the fake provider refused ${key}`), {
-    name: 'S3Error',
-    code,
-    statusCode,
-    path: key,
-  });
-}
-
-/** In-memory stand-in for `Bun.S3Client`, driven through `S3ClientLike` — no socket, ever. */
-export class FakeS3Client implements S3ClientLike {
-  readonly store = new Map<string, FakeObject>();
-  readonly fileCalls: string[] = [];
-  readonly presignCalls: PresignCall[] = [];
-  readonly listCalls: ListCall[] = [];
-  listResult: S3ListResultLike = { contents: [] };
-  /** A provider REFUSAL (403/503/reset) — the failure `delete()` must surface, not swallow. */
-  failDeleteFor: string | undefined;
-  /** A provider "there is nothing there" — the one failure `delete()` may call success. */
-  absentDeleteFor: string | undefined;
-  /**
-   * A refused LISTING — a denied `s3:ListBucket`, a throttle, an expired credential. There is no
-   * "absent" counterpart: a prefix with no keys is an empty page, never a rejection, so every
-   * failure `list()` can meet is one it must surface.
-   */
-  failListWith: Error | undefined;
-
-  /** Which key each handed-out `S3FileLike` stands for, so `write(sourceFile)` can read it. */
-  private readonly fileKeys = new WeakMap<object, string>();
-
-  /** The bytes behind an `S3FileLike` passed as `write`'s data, or `undefined` for raw bytes. */
-  sourceOf(data: unknown): Uint8Array | undefined {
-    if (typeof data !== 'object' || data === null) return undefined;
-    const sourceKey = this.fileKeys.get(data);
-    return sourceKey === undefined ? undefined : this.store.get(sourceKey)?.bytes;
-  }
-
-  file(key: string): S3FileLike {
-    this.fileCalls.push(key);
-    const store = this.store;
-    const client = this;
-    const handle: S3FileLike = {
-      async write(data, options) {
-        // `copy()` hands the SOURCE S3File to write(), exactly as Bun's own union allows, so the
-        // fake has to read one back out of its store rather than assume bytes.
-        const source = client.sourceOf(data);
-        const bytes =
-          source !== undefined
-            ? source
-            : data instanceof Uint8Array
-              ? data
-              : new Uint8Array(await (data as Blob).arrayBuffer());
-        store.set(key, { bytes, type: options?.type });
-        return bytes.byteLength;
-      },
-      async arrayBuffer() {
-        const entry = store.get(key);
-        // Reads the way the provider does: a GET on a key that is not there is a 404, and the
-        // driver is expected to have gated it behind exists() before ever getting here.
-        if (entry === undefined) throw objectNotFound(FAKE_DISK, key);
-        return new Uint8Array(entry.bytes).buffer;
-      },
-      async exists() {
-        return store.has(key);
-      },
-      async delete() {
-        // Shaped like the real thing: an `S3Error` is a plain Error with `name: 'S3Error'`, a
-        // provider `code` and a status. Deliberately NOT a StorageError — the driver has to
-        // classify a rejection it never authored, which is the only kind a provider hands back.
-        if (client.absentDeleteFor === key) throw s3Error('NoSuchKey', 404, key);
-        if (client.failDeleteFor === key) throw s3Error('AccessDenied', 403, key);
-        store.delete(key);
-      },
-      stream() {
-        const entry = store.get(key);
-        const bytes = entry?.bytes ?? new Uint8Array();
-        return new ReadableStream<Uint8Array>({
-          start(controller) {
-            controller.enqueue(bytes);
-            controller.close();
-          },
-        });
-      },
-      async stat(): Promise<S3StatLike> {
-        const entry = store.get(key);
-        if (entry === undefined) throw objectNotFound(FAKE_DISK, key);
-        return {
-          size: entry.bytes.byteLength,
-          type: entry.type,
-          etag: entry.etag,
-          lastModified: entry.lastModified,
-        };
-      },
-      presign(options) {
-        client.presignCalls.push({ key, options });
-        return `https://fake.example/${key}?signed`;
-      },
-    };
-    this.fileKeys.set(handle, key);
-    return handle;
-  }
-
-  async list(input: ListCall): Promise<S3ListResultLike> {
-    this.listCalls.push(input);
-    if (this.failListWith !== undefined) throw this.failListWith;
-    return this.listResult;
-  }
-}
-
-export const bytesOf = (text: string): Uint8Array => new TextEncoder().encode(text);
-export const textOf = (bytes: Uint8Array): string => new TextDecoder().decode(bytes);
-
-/** The error code a call answered with, or how it failed to answer with one. */
-export function codeOf(caught: unknown): string {
-  return isStorageError(caught) ? caught.code : `not-a-storage-error: ${String(caught)}`;
-}
-
-/** The thrown value itself, where the assertion is about its `cause`/`fix` and not just its code. */
-export async function catchError(fn: () => Promise<unknown>): Promise<unknown> {
-  try {
-    await fn();
-    return undefined;
-  } catch (error) {
-    return error;
-  }
-}