@velajs/storage 0.3.0 → 0.3.1

package/dist/drivers/s3/s3.driver.js

@@ -58,7 +58,10 @@ function toError(status, code, message, key) {
     const retryable = mapped === 'Provider' || mapped === 'RateLimited' || mapped === 'Timeout' || mapped === 'Network';
     return new StorageError(mapped, message ?? code ?? `S3 error${key ? ` (${key})` : ''}`, {
         status: status >= 400 ? status : undefined,
-        retryable
+        retryable,
+        // `message`/`code` are the provider's own <Message>/<Code> — never client-safe,
+        // even on a 4xx status (e.g. AccessDenied/NoSuchKey text can carry internal detail).
+        internal: true
     });
 }
 async function s3Error(res, key) {

package/dist/storage.controller.js

@@ -47,10 +47,16 @@ import { clampExpiry, dispositionHeader, mapError, parseRange, serializeStored }
         fail(c, e) {
             const err = e instanceof StorageError ? e : StorageError.wrap(e);
             const { wire, status } = mapError(err.code);
+            // Never echo a provider/transport/wrapped message to the client: those are
+            // flagged `internal` (driver <Message>/<Code>, StorageError.wrap, fromStatus)
+            // and can carry host/bucket/credential detail — including on a 4xx status.
+            // Redact internal errors at any status, plus all upstream (5xx) responses;
+            // 4xx codes with an author-vouched message echo it.
+            const message = err.internal || status >= 500 ? 'storage backend error' : err.message;
             return c.json({
                 error: {
                     code: wire,
-                    message: err.message
+                    message
                 }
             }, status);
         }

package/dist/storage.error.d.ts

@@ -12,12 +12,22 @@ export interface StorageErrorOptions {
     status?: number;
     /** Override the default retryability implied by {@link StorageErrorCode}. */
     retryable?: boolean;
+    /**
+     * True when `message` came from a provider/transport/wrapped source rather
+     * than being authored as client-safe text. The HTTP controller redacts such
+     * messages so raw provider detail never reaches a client. Default false —
+     * a bare `new StorageError(code, msg)` is the author's vouch that `msg` is
+     * client-safe; driver/wrap code MUST set this when echoing provider text.
+     */
+    internal?: boolean;
 }
 export declare class StorageError extends Error {
     name: string;
     readonly code: StorageErrorCode;
     readonly retryable: boolean;
     readonly status: number | undefined;
+    /** Whether `message` is non-client-safe (provider/transport/wrapped origin). */
+    readonly internal: boolean;
     constructor(code: StorageErrorCode, message: string, options?: StorageErrorOptions);
     /** Wrap an arbitrary thrown value as a `StorageError` (idempotent). */
     static wrap(e: unknown): StorageError;

package/dist/storage.error.js

@@ -15,6 +15,7 @@ export class StorageError extends Error {
     code;
     retryable;
     status;
+    /** Whether `message` is non-client-safe (provider/transport/wrapped origin). */ internal;
     constructor(code, message, options){
         super(message, options?.cause !== undefined ? {
             cause: options.cause
@@ -22,14 +23,17 @@ export class StorageError extends Error {
         this.code = code;
         this.status = options?.status;
         this.retryable = options?.retryable ?? RETRYABLE.has(code);
+        this.internal = options?.internal ?? false;
     }
     /** Wrap an arbitrary thrown value as a `StorageError` (idempotent). */ static wrap(e) {
         if (e instanceof StorageError) return e;
         if (isAbort(e)) return new StorageError('Aborted', 'operation aborted', {
             cause: e
         });
+        // The wrapped message is arbitrary provider/host text — never client-safe.
         return new StorageError('Provider', e instanceof Error ? e.message : String(e), {
-            cause: e
+            cause: e,
+            internal: true
         });
     }
     /** Map a transport status code to a `StorageError` (5xx/429 retryable). */ static fromStatus(status, message, cause) {
@@ -37,7 +41,9 @@ export class StorageError extends Error {
         return new StorageError(code, message, {
             status,
             cause,
-            retryable: status === 429 || status >= 500
+            retryable: status === 429 || status >= 500,
+            // Message came off a transport response — treat as non-client-safe.
+            internal: true
         });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velajs/storage",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Edge-first, driver-based object/file storage for the Vela framework",
   "type": "module",
   "main": "./dist/index.js",