@velora-cms/server 0.11.0 → 0.12.0

package/dist/routes/media.js

@@ -1,7 +1,41 @@
 import { z } from "zod";
-import { ApiErrorSchema, MediaDeleteResponseSchema, MediaFileResponseSchema, MediaListQuerySchema, MediaListResponseSchema, } from "@velora-cms/api-schemas";
+import { ApiErrorSchema, MediaDeleteResponseSchema, MediaFileResponseSchema, MediaLinkResponseSchema, MediaListQuerySchema, MediaListResponseSchema, UpdateMediaVisibilityRequestSchema, } from "@velora-cms/api-schemas";
 import { requireAuth } from "../auth/require-auth.js";
+import { sanitizeForKey } from "../media/media-service.js";
+import { mintMediaToken } from "../media/media-tokens.js";
 const MediaParamsSchema = z.object({ id: z.string().uuid() });
+const PATH_SEPARATOR_RE = /[\\/]/;
+// LOW-11: multipart file parts can't be described by the Zod `schema`
+// option (Fastify/Zod validate JSON bodies, not multipart streams), so
+// this runs by hand right after `request.file()` resolves, before the
+// filename is ever handed to MediaService.upload (which turns it
+// straight into a storage key via sanitizeForKey). Defense in depth
+// alongside HIGH-2's driver-level assertValidStorageKey: this rejects
+// with a friendly, rule-naming 400 instead of a generic 500 from
+// whatever the driver does with a hostile key.
+//
+// In practice @fastify/multipart's busboy already runs its own
+// basename()-style stripping on `filename` before this ever sees it
+// (path components dropped, a bare "." or ".." collapsed to "" and
+// caught by the pre-existing `!file.filename` check) — see
+// media.test.ts for direct unit coverage of every branch below, since
+// an HTTP round-trip can no longer exercise the path-separator branch
+// with the multipart plugin's default (non-preservePath) config. This
+// still guards the cases busboy does NOT touch (e.g. a filename that
+// sanitizes to nothing without being "."/".." verbatim) and stays
+// correct if that config or an internal caller ever changes.
+export function invalidUploadFilenameReason(filename) {
+    if (filename === "." || filename === "..") {
+        return 'Filename must not be "." or ".."';
+    }
+    if (PATH_SEPARATOR_RE.test(filename)) {
+        return "Filename must not contain path separators (\"/\" or \"\\\")";
+    }
+    if (sanitizeForKey(filename).length === 0) {
+        return "Filename must not be empty after sanitization";
+    }
+    return null;
+}
 export const mediaRoutes = async (app, opts) => {
     const { mediaService } = opts;
     async function toResponse(media) {
@@ -25,6 +59,10 @@ export const mediaRoutes = async (app, opts) => {
         if (!file || !file.filename) {
             return reply.code(400).send({ message: "A multipart file field is required" });
         }
+        const filenameError = invalidUploadFilenameReason(file.filename);
+        if (filenameError) {
+            return reply.code(400).send({ message: filenameError });
+        }
         const data = await file.toBuffer();
         const media = await mediaService.upload({
             filename: file.filename,
@@ -35,10 +73,10 @@ export const mediaRoutes = async (app, opts) => {
         return reply.code(201).send(await toResponse(media));
     });
     // Media library listing — admin-authed (SEC-6, S175 audit). This lists
-    // EVERY uploaded asset regardless of publish state, each with a working
-    // presigned downloadUrl, so it must not be anonymously enumerable;
-    // published/headless media has its own API-key-gated /api/v1/media
-    // surface. The admin UI reaches this through authFetch.
+    // EVERY uploaded asset regardless of publish state, so it must not be
+    // anonymously enumerable; published/headless media has its own
+    // API-key-gated /api/v1/media surface. The admin UI reaches this
+    // through authFetch.
     app.get("/api/media", {
         onRequest: requireAuth,
         schema: {
@@ -72,6 +110,58 @@ export const mediaRoutes = async (app, opts) => {
         }
         return toResponse(media);
     });
+    // Flips the visibility flag (S186c §2) — admin-authed, same as every
+    // other /api/media route (this is the backoffice library surface, not
+    // the API-key-gated /api/v1/media headless read path). No file move, no
+    // key/URL change; only the row changes.
+    app.patch("/api/media/:id", {
+        onRequest: requireAuth,
+        schema: {
+            params: MediaParamsSchema,
+            body: UpdateMediaVisibilityRequestSchema,
+            response: {
+                200: MediaFileResponseSchema,
+                400: ApiErrorSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const media = await mediaService.getById(request.params.id);
+        if (!media) {
+            return reply.code(404).send({ message: `No media file found for id ${request.params.id}` });
+        }
+        const updated = await mediaService.setVisibility(request.params.id, request.body.visibility);
+        return toResponse(updated);
+    });
+    // Mints a signed, short-lived link to a media item (S186c §3) — the
+    // "Copy temporary link" button behind a private item in the admin.
+    // Same requireAuth idiom as every other /api/media route (any
+    // signed-in admin user, not a role gate) — mandate 4 of the S186c
+    // Task 3 review round: this is the file's own admin-session auth, kept
+    // consistent across the whole /api/media surface rather than inventing
+    // a stricter check just for this route. Works for a public item too
+    // (harmless — the plain stable path already serves it with no token
+    // needed); the admin UI simply only surfaces the button for private
+    // ones.
+    app.post("/api/media/:id/link", {
+        onRequest: requireAuth,
+        schema: {
+            params: MediaParamsSchema,
+            response: {
+                200: MediaLinkResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const media = await mediaService.getById(request.params.id);
+        if (!media) {
+            return reply.code(404).send({ message: `No media file found for id ${request.params.id}` });
+        }
+        const { token, expiresAt } = mintMediaToken(media.id);
+        return { url: `${media.url}?token=${encodeURIComponent(token)}`, expiresAt };
+    });
     app.delete("/api/media/:id", {
         onRequest: requireAuth,
         schema: {

package/dist/routes/plugin-storage.js

@@ -22,7 +22,11 @@ import { PluginNotActiveError, PluginNotInstalledError } from "../plugins/plugin
 //   - This was NOT the CMS's only unauthenticated read of internal content
 //     data — GET /api/media and GET /api/media/:id
 //     (apps/server/src/routes/media.ts:65-66, 84-85) are unauthenticated
-//     and return media items each carrying a fresh presigned downloadUrl,
+//     and return media items each carrying a downloadUrl (M3 fix wave: no
+//     longer presigned/time-limited as of S186c — a stable app path,
+//     `/media/<id>/<filename>`, that GET /media/:id/:filename streams
+//     server-side; see media-service.ts's getDownloadUrl and
+//     apps/server/prisma/schema.prisma's storageKey field comment),
 //     and GET /api/document-types (apps/server/src/routes/document-types.ts:146-147),
 //     GET /api/templates (apps/server/src/routes/templates.ts:40-41),
 //     GET /api/themes (apps/server/src/routes/themes.ts:15-16), and

package/dist/routes/public-api.js

@@ -11,7 +11,7 @@ import { isPublicDocsEnabled } from "../config/public-docs.js";
 import { maxQueryComplexity, maxQueryDepth } from "../config/graphql-limits.js";
 import { createFieldCountRule } from "../graphql/field-count-rule.js";
 import { buildGraphqlSchema } from "../graphql/schema.js";
-import { computeExtensions, isNotFoundError, preparePublishedItem, resolveItemNode, resolveSubtreeFilter, toPublicDocumentType, toPublicMediaFile, toSummaries, } from "./published-item.js";
+import { computeExtensions, isNotFoundError, preparePublishedItem, resolveItemNode, resolvePublicBaseUrl, resolveSubtreeFilter, toPublicDocumentType, toPublicMediaFile, toSummaries, } from "./published-item.js";
 const PublicContentParamsSchema = z.object({ id: z.string().uuid() });
 // mercurius' own /api/v1/graphql routes carry plain JSON-Schema objects for
 // their request/response envelope (not Zod). This app's validatorCompiler/
@@ -400,7 +400,8 @@ export const publicApiRoutes = async (app, opts) => {
     }, async (request) => {
         const { cursor, limit, search } = request.query;
         const files = await mediaService.list({ cursor, limit, search });
-        const items = await Promise.all(files.map((file) => toPublicMediaFile(mediaService, file)));
+        const baseUrl = resolvePublicBaseUrl(request);
+        const items = await Promise.all(files.map((file) => toPublicMediaFile(mediaService, file, baseUrl)));
         const nextCursor = files.length === limit ? (files[files.length - 1]?.id ?? null) : null;
         return { items, nextCursor };
     });
@@ -415,7 +416,7 @@ export const publicApiRoutes = async (app, opts) => {
         if (!media) {
             return reply.code(404).send({ message: `No media file found for id ${request.params.id}` });
         }
-        return toPublicMediaFile(mediaService, media);
+        return toPublicMediaFile(mediaService, media, resolvePublicBaseUrl(request));
     });
     // Public document type introspection + template listing (Session 105).
     // Both are read-only projections over existing backoffice adapter calls
@@ -539,6 +540,7 @@ export const publicApiRoutes = async (app, opts) => {
                 contentService,
                 mediaService,
                 getContentNode: (id) => adapter.getContentNode(id),
+                mediaBaseUrl: resolvePublicBaseUrl(request),
             }),
         });
     });

package/dist/routes/published-item.d.ts

@@ -18,7 +18,8 @@ export declare function resolveSubtreeFilter(adapter: DatabaseAdapter, underId:
 } | null>;
 export declare function toSummaries(nodes: ContentNode[]): PublicContentNodeSummary[];
 export declare function toPublicDocumentType(doc: DocumentTypeDefinition): PublicDocumentType;
-export declare function toPublicMediaFile(mediaService: MediaService, media: MediaFile): Promise<PublicMediaFile>;
+export { resolvePublicBaseUrl } from "../config/public-url.js";
+export declare function toPublicMediaFile(mediaService: MediaService, media: MediaFile, baseUrl: string): Promise<PublicMediaFile>;
 export type PublishedItemDeps = {
     adapter: DatabaseAdapter;
     listSerializerContributions: () => Array<{

package/dist/routes/published-item.js

@@ -117,16 +117,39 @@ export function toPublicDocumentType(doc) {
         })),
     };
 }
-// The S105 public media projection, with a FRESH presigned download URL
-// (never cached/stored — same convention as the REST media routes).
-export async function toPublicMediaFile(mediaService, media) {
-    const downloadUrl = await mediaService.getDownloadUrl(media.id);
+// S186c Task 3, mandate 1: the PUBLIC surface (REST /api/v1/media* and
+// GraphQL) is consumed cross-origin by design — a headless frontend's own
+// server fetches `downloadUrl` directly (e.g. the blog starter's
+// og-image route does `fetch(media.downloadUrl)`, and its post template
+// renders `<img src={media.downloadUrl}>` on the FRONTEND's origin, not
+// the CMS's). A path-relative URL there resolves against the wrong
+// origin and 404s. The backoffice /api/media surface stays
+// path-relative on purpose (routes/media.ts's toResponse) — it's always
+// same-origin with the admin SPA that renders it.
+//
+// S186c Task 3 fix wave, L1: the actual base-resolution logic (and its
+// full doc comment) moved to config/public-url.ts, mirroring
+// config/preview.ts's previewBaseUrl idiom — re-exported here unchanged
+// so every existing call site (public-api.ts, graphql/schema.ts) keeps
+// importing it from this module.
+export { resolvePublicBaseUrl } from "../config/public-url.js";
+// The S105 public media projection. downloadUrl is the stable, computed
+// app path (S186c §1/§3, `/media/<id>/<filename>`) made ABSOLUTE (see
+// resolvePublicBaseUrl above) — NOT a time-limited presigned URL; it's
+// recomputed on every call from id+filename rather than cached/stored,
+// same convention as the REST media routes, but there is nothing here to
+// expire. For a PRIVATE item the underlying path additionally carries a
+// freshly minted `?token=` (MediaService.getDownloadUrl, S186c §3) —
+// still recomputed fresh, still made absolute the same way.
+export async function toPublicMediaFile(mediaService, media, baseUrl) {
+    const relativeUrl = await mediaService.getDownloadUrl(media.id);
     return {
         id: media.id,
         filename: media.filename,
         mimeType: media.mimeType,
         size: media.size,
-        downloadUrl,
+        downloadUrl: `${baseUrl}${relativeUrl}`,
+        visibility: media.visibility,
         uploadedAt: media.uploadedAt,
     };
 }

package/dist/scripts/copy-admin-bundle.js

@@ -1,4 +1,4 @@
-import { cpSync, existsSync, rmSync } from "node:fs";
+import { cpSync, existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 // Build-time only. The devDependency on @velora-cms/admin-ui exists purely
@@ -21,4 +21,12 @@ if (!existsSync(source)) {
 }
 rmSync(target, { recursive: true, force: true });
 cpSync(source, target, { recursive: true });
+// S186b: stamp the bundle with this build's own server version, so a
+// scaffold that copies dist/admin-bundle out (or a syncAdminBundle() run
+// later) inherits a version marker for boot-time drift detection
+// (admin-static.ts) without re-deriving it. Resolved relative to this
+// script, not cwd — same reasoning as `source`/`target` above.
+const packageJson = JSON.parse(readFileSync(join(serverDist, "..", "package.json"), "utf8"));
+writeFileSync(join(target, ".velora-version"), packageJson.version);
 console.log(`[copy-admin-bundle] copied admin bundle -> ${target}`);
+console.log(`[copy-admin-bundle] stamped version ${packageJson.version}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velora-cms/server",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "engines": {
     "node": ">=22.12"
   },
@@ -9,7 +9,8 @@
   "license": "Apache-2.0",
   "type": "module",
   "bin": {
-    "velora-server": "./dist/bin.js"
+    "velora-server": "./dist/bin.js",
+    "velora-sync-admin": "./dist/bin-sync-admin.js"
   },
   "main": "./dist/lib.js",
   "exports": {
@@ -58,9 +59,9 @@
     "mercurius": "16.10.0",
     "prisma": "6.19.3",
     "zod": "4.4.3",
+    "@velora-cms/api-schemas": "0.12.0",
+    "@velora-cms/db-adapter": "0.11.2",
     "@velora-cms/content-service": "0.11.0",
-    "@velora-cms/api-schemas": "0.11.0",
-    "@velora-cms/db-adapter": "0.11.0",
     "@velora-cms/design-tokens": "0.11.0",
     "@velora-cms/plugin-package": "0.11.0",
     "@velora-cms/plugin-sdk": "0.11.0",
@@ -75,10 +76,10 @@
     "form-data": "4.0.6",
     "tar": "^7.5.22",
     "tsx": "4.22.4",
-    "@velora-cms/docs": "0.1.0",
-    "create-velora-plugin": "0.11.0",
     "@velora-cms/admin-ui": "0.1.0",
+    "@velora-cms/docs": "0.1.0",
     "@velora-cms/google-maps": "0.1.0",
+    "create-velora-plugin": "0.11.0",
     "velora-plugin": "0.11.0",
     "@velora-cms/reading-time": "0.1.0"
   },

package/prisma/schema.prisma

@@ -60,14 +60,27 @@ model MediaFile {
   filename   String
   mimeType   String   @map("mime_type")
   size       Int
-  // Object key inside the S3 bucket — what upload/download/delete address.
-  // `url` is the canonical object URL persisted for API responses; actual
-  // downloads go through presigned URLs generated from the key.
+  // Object key inside the storage backend (S3/MinIO or the local driver) —
+  // what upload/download/delete address. `url` is the canonical stable app
+  // path persisted for API responses (`/media/<id>/<filename>`, S186c
+  // §1/§3). M3 fix wave: downloads do NOT go through presigned URLs
+  // anymore (that mechanism expired in 15 minutes even for public files,
+  // which S186c replaced) — GET /media/:id/:filename (media-public.ts)
+  // looks up this key server-side and streams the bytes itself, same as
+  // the backoffice /api/media route.
   storageKey String   @unique @map("storage_key")
   url        String
   uploadedBy String   @map("uploaded_by")
   uploader   User     @relation(fields: [uploadedBy], references: [id])
   uploadedAt DateTime @default(now()) @map("uploaded_at")
+  // 'public' | 'private' (S186c §2) — a flag, never a location: flipping it
+  // updates this row only, no file move, no key/URL change in either
+  // storage driver. Existing rows default/backfill to 'public', matching
+  // their pre-S186c behavior (everything was effectively link-accessible).
+  // Ships as core-migration step 0003_media_visibility (probe-guarded,
+  // additive) for pre-existing databases; new/db-push databases get it
+  // straight from this column.
+  visibility String   @default("public")
 
   @@index([uploadedBy])
   @@map("media_files")