@venizia/ignis 0.2.0-4 → 0.2.0-40

package/dist/components/static-asset/controller/factory.js

@@ -9,22 +9,131 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AssetControllerFactory = void 0;
+exports.AssetControllerFactory = exports.resolveServedContentType = exports.buildObjectLink = exports.findLabelsInQuery = void 0;
 const controllers_1 = require("../../../base/controllers");
 const metadata_1 = require("../../../base/metadata");
-const core_1 = require("@venizia/ignis-helpers/core");
-const common_1 = require("@venizia/ignis-helpers/common");
 const ignis_helpers_1 = require("@venizia/ignis-helpers");
+const common_1 = require("@venizia/ignis-helpers/common");
+const core_1 = require("@venizia/ignis-helpers/core");
 const node_fs_1 = require("node:fs");
 const common_2 = require("../common");
+const common_3 = require("../common");
+const node_crypto_1 = require("node:crypto");
 const base_definition_1 = require("./base.definition");
 /** Hono ALREADY percent-decodes path params - a second decodeURIComponent throws on `report_100%.pdf` and turns `a%2Fb.png` into a DIFFERENT object; `isValidName`/`isValidPath` still run on this value, so traversal is still rejected. */
+/** The upload labels, read off the multipart form. Every value arrives as text, so `sequence` is the one that needs converting. */
+/** The label names, in one place: the reader below and the stale-caller warning have to agree. */
+const UPLOAD_LABEL_NAMES = [
+    'principalType',
+    'principalId',
+    'variant',
+    'sequence',
+    'folderPath',
+];
+/**
+ * Names any label still arriving in the query string. The value is still READ - see
+ * {@link readUploadLabels} - so this is a deprecation notice, not a report of something dropped.
+ */
+const findLabelsInQuery = (opts) => UPLOAD_LABEL_NAMES.filter(name => opts.query[name] !== undefined);
+exports.findLabelsInQuery = findLabelsInQuery;
+/**
+ * The labels, body first and query as the way back.
+ *
+ * The query is where they used to travel. Refusing to read it would have been a clean break on
+ * paper and a broken upload in practice: a client whose form library only emits `append(key, value,
+ * filename)` - the three-argument form, which requires a Blob - cannot put a text field in a
+ * multipart body at all, so it THROWS rather than quietly losing a label. A read-with-warning lets
+ * each consumer move on its own schedule; the body always wins, so a migrated caller is never
+ * affected by a stale parameter left in a URL.
+ */
+const readUploadLabels = (opts) => {
+    const { fields, fallback = {} } = opts;
+    const read = (name) => fields[name] || fallback[name] || undefined;
+    const sequence = read('sequence');
+    return {
+        principalType: read('principalType'),
+        principalId: read('principalId'),
+        variant: read('variant'),
+        sequence: sequence === undefined ? undefined : Number(sequence),
+        folderPath: read('folderPath'),
+    };
+};
 const readObjectName = rawObjectName => rawObjectName;
 /** Encodes an object path into a SINGLE url segment: `{objectName}` matches one segment only, so `/` must be percent-encoded too (Hono decodes it back before the handler reads the param). */
 const encodeObjectPath = objectPath => {
     return encodeURIComponent(objectPath);
 };
-/** Sets whitelisted metadata headers on the response context. */
+/** The bucket one request works on: a configured value wins - called on every request, so an application may read an environment variable lazily - else the path param, which is only registered when there is no configured bucket. */
+const resolveBucket = async (opts) => {
+    const { configured, param } = opts;
+    if (configured === undefined) {
+        return param ?? '';
+    }
+    return (0, common_1.resolveValueAsync)(configured);
+};
+/** The URL of one object, in the shape its controller serves: no `/buckets/<name>` with a configured bucket, and a raw path with `rawObjectPath`. */
+const buildObjectLink = (opts) => {
+    const { basePath, bucket, object } = opts;
+    const { hasConfiguredBucket = false, rawObjectPath = false } = opts;
+    const bucketSegment = hasConfiguredBucket ? '' : `/buckets/${bucket.name}`;
+    const objectSegment = rawObjectPath ? object.key : encodeObjectPath(object.key);
+    return `${basePath}${bucketSegment}/objects/${objectSegment}`;
+};
+exports.buildObjectLink = buildObjectLink;
+/** Mirrors `BaseStorageHelper.normalizeObjectName`, which is protected: `resolveObjectName` is offered the very name the helper would otherwise have written. */
+const defaultObjectName = ({ file }) => {
+    const { originalName, folderPath } = file;
+    const normalizedFileName = originalName.toLowerCase().replace(/ /g, '_');
+    if (!folderPath) {
+        return normalizedFileName;
+    }
+    return `${folderPath.toLowerCase().replace(/ /g, '_')}/${normalizedFileName}`;
+};
+/**
+ * The served type comes from the object NAME, never the backend or the uploader: a renderable type on
+ * the API origin is stored XSS. Exported so a hand-written route makes the same decision - the
+ * backend's own content-type is dropped by `WHITELIST_HEADERS`.
+ */
+const resolveServedContentType = (opts) => {
+    const { helper, object } = opts;
+    const candidate = helper.getMimeType({ filename: object.key }).toLowerCase().split(';')[0].trim();
+    if (!common_2.RENDERABLE_CONTENT_TYPES.has(candidate)) {
+        return { contentType: common_1.HTTP.HeaderValues.APPLICATION_OCTET_STREAM, isRenderable: false };
+    }
+    return { contentType: candidate, isRenderable: true };
+};
+exports.resolveServedContentType = resolveServedContentType;
+/**
+ * Reads one `Range` header. Only a single byte range is honoured - multipart ranges need a multipart
+ * body no browser asks for here. An unsatisfiable or malformed range returns `null`, and the caller
+ * serves the whole object, which is what RFC 9110 allows.
+ */
+const readByteRange = (opts) => {
+    const { header, size } = opts;
+    if (!header || size <= 0) {
+        return null;
+    }
+    const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+    if (!match) {
+        return null;
+    }
+    const [, rawStart, rawEnd] = match;
+    // `bytes=-500` means the LAST 500 bytes, not "from 0 to 500".
+    if (!rawStart) {
+        const suffixLength = Number(rawEnd);
+        if (!Number.isInteger(suffixLength) || suffixLength <= 0) {
+            return null;
+        }
+        return { start: Math.max(size - suffixLength, 0), end: size - 1 };
+    }
+    const start = Number(rawStart);
+    const end = rawEnd ? Number(rawEnd) : size - 1;
+    if (!Number.isInteger(start) || !Number.isInteger(end) || start > end || start >= size) {
+        return null;
+    }
+    return { start, end: Math.min(end, size - 1) };
+};
+/** Sets whitelisted metadata headers on the response context. `content-type` is not among them. */
 const applyMetadataHeaders = ({ ctx, metadata }) => {
     Object.entries(metadata).forEach(([key, value]) => {
         if (!common_2.WHITELIST_HEADERS.includes(key.toLowerCase())) {
@@ -33,16 +142,67 @@ const applyMetadataHeaders = ({ ctx, metadata }) => {
         ctx.header(key.toLowerCase(), String(value).replace(/[\r\n]/g, ''));
     });
 };
+/**
+ * The MetaLink row for one uploaded object. Both upload paths go through here, so a direct upload
+ * lands exactly the row an ordinary one does - the application's `createMetaLink` when it gives
+ * one, the component's default otherwise.
+ */
+const createMetaLinkRow = async (opts) => {
+    const { metaLink, helper, storage, uploadResult, fileStat, query } = opts;
+    if (metaLink.createMetaLink) {
+        const created = await metaLink.createMetaLink({ uploadResult, fileStat, query });
+        return created.data;
+    }
+    // Resolved per call so an application that swaps the repository is not pinned to the first one.
+    const repository = await (0, common_1.resolveValueAsync)(metaLink.repository);
+    const created = await repository.create({
+        data: {
+            bucketName: uploadResult.bucket.name,
+            objectName: uploadResult.object.key,
+            link: uploadResult.link,
+            // The column is NOT NULL and a backend may report nothing.
+            mimetype: fileStat.metadata?.mimetype ?? helper.getMimeType({ filename: uploadResult.object.key }),
+            size: fileStat.size,
+            etag: fileStat.etag,
+            metadata: fileStat.metadata,
+            storageType: storage,
+            isSynced: true,
+            principalId: query.principalId ? String(query.principalId) : undefined,
+            principalType: query.principalType ? String(query.principalType) : undefined,
+            variant: query.variant ? String(query.variant) : undefined,
+            // Absent leaves the column default rather than writing 0, so a row the caller never
+            // ordered is indistinguishable from a legacy one.
+            sequence: query.sequence === undefined ? undefined : Number(query.sequence),
+        },
+    });
+    return created.data;
+};
 class AssetControllerFactory extends core_1.BaseHelper {
     constructor() {
         super({ scope: AssetControllerFactory.name });
     }
     static defineAssetController(opts) {
         const { controller, helper, options, useMetaLink, metaLink, storage } = opts;
-        const { name, basePath, routes, isStrict = true } = controller;
+        const { resolveObjectName, defineRoutesBefore, defineExtraRoutes } = opts;
+        const { directUpload } = controller;
+        const { name, basePath, routes, isStrict = true, bucket, rawObjectPath = false } = controller;
         const maxFolderDepth = options?.maxFolderDepth ?? ignis_helpers_1.BaseStorageHelper.DEFAULT_MAX_FOLDER_DEPTH;
+        const maxBytes = options?.maxBytes;
+        const hasConfiguredBucket = bucket !== undefined;
+        const definitions = (0, base_definition_1.buildAssetDefinitions)({ hasConfiguredBucket, rawObjectPath });
         // The mount path may be declared with or without a leading slash; a link must carry exactly one.
         const normalizedBasePath = basePath.startsWith('/') ? basePath : `/${basePath}`;
+        /** Only when the URL shape deviates: with neither option the storage helper's own link is left untouched. */
+        const shapedLinkFn = hasConfiguredBucket || rawObjectPath
+            ? (linkOptions) => (0, exports.buildObjectLink)({
+                basePath: normalizedBasePath,
+                bucket: linkOptions.bucket,
+                object: linkOptions.object,
+                hasConfiguredBucket,
+                rawObjectPath,
+            })
+            : undefined;
+        const normalizeLinkFn = options?.normalizeLinkFn ?? shapedLinkFn;
         let GeneratedStaticAssetController = class GeneratedStaticAssetController extends controllers_1.BaseRestController {
             constructor() {
                 super({
@@ -65,79 +225,161 @@ class AssetControllerFactory extends core_1.BaseHelper {
                 }
             }
             binding() {
+                // First, so a literal path can win over the built-in catch-all `rawObjectPath` registers.
+                defineRoutesBefore?.({ controller: this, helper, basePath: normalizedBasePath });
+                // A single-bucket application has no reason to expose bucket creation or deletion, so the
+                // four bucket-management routes are not registered once `bucket` is configured.
+                if (!hasConfiguredBucket) {
+                    this.bindRoute({
+                        configs: { ...definitions.GET_BUCKETS, ...routes?.getBuckets },
+                    }).to({
+                        handler: async (ctx) => {
+                            const buckets = await helper.getBuckets();
+                            return ctx.json(buckets, common_1.HTTP.ResultCodes.RS_2.Ok);
+                        },
+                    });
+                    this.bindRoute({
+                        configs: { ...definitions.GET_BUCKET_BY_NAME, ...routes?.getBucketByName },
+                    }).to({
+                        handler: async (ctx) => {
+                            const params = ctx.req.valid('param');
+                            const bucketName = await resolveBucket({
+                                configured: bucket,
+                                param: params.bucketName,
+                            });
+                            if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
+                                throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
+                            }
+                            const found = await helper.getBucket({ bucket: { name: bucketName } });
+                            return ctx.json(found, common_1.HTTP.ResultCodes.RS_2.Ok);
+                        },
+                    });
+                    this.bindRoute({
+                        configs: { ...definitions.CREATE_BUCKET, ...routes?.createBucket },
+                    }).to({
+                        handler: async (ctx) => {
+                            const params = ctx.req.valid('param');
+                            const bucketName = await resolveBucket({
+                                configured: bucket,
+                                param: params.bucketName,
+                            });
+                            if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
+                                throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
+                            }
+                            const createdBucket = await helper.createBucket({ bucket: { name: bucketName } });
+                            return ctx.json(createdBucket, common_1.HTTP.ResultCodes.RS_2.Ok);
+                        },
+                    });
+                    this.bindRoute({
+                        configs: { ...definitions.DELETE_BUCKET, ...routes?.deleteBucket },
+                    }).to({
+                        handler: async (ctx) => {
+                            const params = ctx.req.valid('param');
+                            const bucketName = await resolveBucket({
+                                configured: bucket,
+                                param: params.bucketName,
+                            });
+                            if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
+                                throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
+                            }
+                            const isRemovedBucket = await helper.removeBucket({
+                                bucket: { name: bucketName },
+                            });
+                            return ctx.json({ isDeleted: isRemovedBucket }, common_1.HTTP.ResultCodes.RS_2.Ok);
+                        },
+                    });
+                }
                 this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.GET_BUCKETS, ...routes?.getBuckets },
-                }).to({
-                    handler: async (ctx) => {
-                        const bucket = await helper.getBuckets();
-                        return ctx.json(bucket, common_1.HTTP.ResultCodes.RS_2.Ok);
-                    },
-                });
-                this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.GET_BUCKET_BY_NAME, ...routes?.getBucketByName },
-                }).to({
-                    handler: async (ctx) => {
-                        const { bucketName } = ctx.req.valid('param');
-                        if (!helper.isValidName(bucketName)) {
-                            throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
-                        }
-                        const bucket = await helper.getBucket({ name: bucketName });
-                        return ctx.json(bucket, common_1.HTTP.ResultCodes.RS_2.Ok);
-                    },
-                });
-                this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.GET_OBJECT_BY_NAME, ...routes?.getObjectByName },
+                    configs: { ...definitions.GET_OBJECT_BY_NAME, ...routes?.getObjectByName },
                 }).to({
                     handler: async (ctx) => {
-                        const { bucketName, objectName: rawObjectName } = ctx.req.valid('param');
-                        const objectName = readObjectName(rawObjectName);
-                        if (!helper.isValidName(bucketName)) {
+                        const params = ctx.req.valid('param');
+                        const bucketName = await resolveBucket({
+                            configured: bucket,
+                            param: params.bucketName,
+                        });
+                        const objectName = readObjectName(params.objectName);
+                        if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
                         }
-                        if (!helper.isValidPath(objectName, { maxDepth: maxFolderDepth })) {
+                        if (!helper.isValidObjectKey({ object: { key: objectName }, maxDepth: maxFolderDepth })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.OBJECT_NAME_INVALID });
                         }
-                        const fileStat = await helper.getStat({ bucket: bucketName, name: objectName });
+                        const fileStat = await helper.getStat({
+                            bucket: { name: bucketName },
+                            object: { key: objectName },
+                        });
                         const { size, metadata } = fileStat;
                         applyMetadataHeaders({ ctx, metadata });
-                        if (!ctx.res.headers.has(common_1.HTTP.Headers.CONTENT_TYPE)) {
-                            ctx.header(common_1.HTTP.Headers.CONTENT_TYPE, common_1.HTTP.HeaderValues.APPLICATION_OCTET_STREAM);
-                        }
-                        ctx.header(common_1.HTTP.Headers.CONTENT_LENGTH, size.toString());
+                        const served = (0, exports.resolveServedContentType)({ helper, object: { key: objectName } });
+                        ctx.header(common_1.HTTP.Headers.CONTENT_TYPE, served.contentType);
                         ctx.header('x-content-type-options', 'nosniff');
-                        const stream = await helper.getFile({ bucket: bucketName, name: objectName });
+                        // Sandboxed even when renderable, so an unforeseen renderable type cannot reach this origin.
+                        ctx.header(common_1.HTTP.Headers.CONTENT_SECURITY_POLICY, 'sandbox');
+                        // Advertised unconditionally: a player only offers seeking once it sees this.
+                        ctx.header('accept-ranges', 'bytes');
+                        // A type outside the allow-list downloads instead of rendering; that is the XSS boundary.
+                        if (!served.isRenderable) {
+                            const inlineName = objectName.split('/').pop() ?? objectName;
+                            ctx.header(common_1.HTTP.Headers.CONTENT_DISPOSITION, (0, ignis_helpers_1.createContentDispositionHeader)({ filename: inlineName, type: 'attachment' }));
+                        }
+                        const range = readByteRange({ header: ctx.req.header('range'), size });
+                        if (range) {
+                            ctx.header(common_1.HTTP.Headers.CONTENT_LENGTH, String(range.end - range.start + 1));
+                            ctx.header(common_1.HTTP.Headers.CONTENT_RANGE, `bytes ${range.start}-${range.end}/${size}`);
+                        }
+                        else {
+                            ctx.header(common_1.HTTP.Headers.CONTENT_LENGTH, size.toString());
+                        }
+                        // The web stream is what a Response body wants, so no Node Readable sits in between.
+                        const stream = await helper.getObjectStream({
+                            bucket: { name: bucketName },
+                            object: { key: objectName },
+                            ...(range ? { range } : {}),
+                        });
                         return new Response(stream, {
                             headers: ctx.res.headers,
-                            status: common_1.HTTP.ResultCodes.RS_2.Ok,
+                            status: range ? common_1.HTTP.ResultCodes.RS_2.PartialContent : common_1.HTTP.ResultCodes.RS_2.Ok,
                         });
                     },
                 });
                 this.bindRoute({
                     configs: {
-                        ...base_definition_1.StaticAssetDefinitions.DOWNLOAD_OBJECT_BY_NAME,
+                        ...definitions.DOWNLOAD_OBJECT_BY_NAME,
                         ...routes?.downloadObjectByName,
                     },
                 }).to({
                     handler: async (ctx) => {
-                        const { bucketName, objectName: rawObjectName } = ctx.req.valid('param');
-                        const objectName = readObjectName(rawObjectName);
-                        if (!helper.isValidName(bucketName)) {
+                        const params = ctx.req.valid('param');
+                        const bucketName = await resolveBucket({
+                            configured: bucket,
+                            param: params.bucketName,
+                        });
+                        const objectName = readObjectName(params.objectName);
+                        if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
                         }
-                        if (!helper.isValidPath(objectName, { maxDepth: maxFolderDepth })) {
+                        if (!helper.isValidObjectKey({ object: { key: objectName }, maxDepth: maxFolderDepth })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.OBJECT_NAME_INVALID });
                         }
-                        const fileStat = await helper.getStat({ bucket: bucketName, name: objectName });
+                        const fileStat = await helper.getStat({
+                            bucket: { name: bucketName },
+                            object: { key: objectName },
+                        });
                         const { size, metadata } = fileStat;
                         applyMetadataHeaders({ ctx, metadata });
-                        if (!ctx.res.headers.has(common_1.HTTP.Headers.CONTENT_TYPE)) {
-                            ctx.header(common_1.HTTP.Headers.CONTENT_TYPE, common_1.HTTP.HeaderValues.APPLICATION_OCTET_STREAM);
-                        }
+                        // Download always attaches, so the served type only has to be honest, never renderable.
+                        const served = (0, exports.resolveServedContentType)({ helper, object: { key: objectName } });
+                        ctx.header(common_1.HTTP.Headers.CONTENT_TYPE, served.contentType);
                         ctx.header(common_1.HTTP.Headers.CONTENT_LENGTH, size.toString());
                         const fileName = objectName.split('/').pop() ?? objectName;
                         ctx.header(common_1.HTTP.Headers.CONTENT_DISPOSITION, (0, ignis_helpers_1.createContentDispositionHeader)({ filename: fileName, type: 'attachment' }));
                         ctx.header('x-content-type-options', 'nosniff');
-                        const stream = await helper.getFile({ bucket: bucketName, name: objectName });
+                        ctx.header(common_1.HTTP.Headers.CONTENT_SECURITY_POLICY, 'sandbox');
+                        const stream = await helper.getObjectStream({
+                            bucket: { name: bucketName },
+                            object: { key: objectName },
+                        });
                         return new Response(stream, {
                             headers: ctx.res.headers,
                             status: common_1.HTTP.ResultCodes.RS_2.Ok,
@@ -145,28 +387,18 @@ class AssetControllerFactory extends core_1.BaseHelper {
                     },
                 });
                 this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.CREATE_BUCKET, ...routes?.createBucket },
+                    configs: { ...definitions.UPLOAD, ...routes?.upload },
                 }).to({
                     handler: async (ctx) => {
-                        const { bucketName } = ctx.req.valid('param');
-                        if (!helper.isValidName(bucketName)) {
+                        // A configured bucket drops `params` from this route entirely, so it is read only when it exists.
+                        const bucketParam = hasConfiguredBucket
+                            ? undefined
+                            : ctx.req.valid('param').bucketName;
+                        const bucketName = await resolveBucket({ configured: bucket, param: bucketParam });
+                        if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
                         }
-                        const createdBucket = await helper.createBucket({ name: bucketName });
-                        return ctx.json(createdBucket, common_1.HTTP.ResultCodes.RS_2.Ok);
-                    },
-                });
-                this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.UPLOAD, ...routes?.upload },
-                }).to({
-                    handler: async (ctx) => {
-                        const { bucketName } = ctx.req.valid('param');
-                        const query = ctx.req.valid('query');
-                        if (!helper.isValidName(bucketName)) {
-                            throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
-                        }
-                        const folderPath = query.folderPath;
-                        if (folderPath) {
+                        const validateFolderPath = (folderPath) => {
                             const normalizedFolder = folderPath.replace(/^\/+|\/+$/g, '');
                             if (!normalizedFolder) {
                                 throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.FOLDER_PATH_INVALID });
@@ -179,19 +411,46 @@ class AssetControllerFactory extends core_1.BaseHelper {
                                     message: `Folder path exceeds max depth of ${maxFolderDepth}`,
                                 });
                             }
-                            const invalidSegmentIndex = folderSegments.findIndex(segment => !helper.isValidName(segment));
+                            const invalidSegmentIndex = folderSegments.findIndex(segment => !helper.isValidSegment({ segment }));
                             if (invalidSegmentIndex !== -1) {
                                 throw (0, core_1.getError)({
                                     error: common_2.StaticAssetErrors.FOLDER_SEGMENT_INVALID,
                                     message: `Invalid folder path segment: ${folderSegments[invalidSegmentIndex]}`,
                                 });
                             }
+                        };
+                        // Before the body is spooled. A multipart envelope is larger than the files inside it,
+                        // so a request under the ceiling can still carry a file over it - hence the second check
+                        // below. This one only buys the early exit, and a missing header buys nothing.
+                        if (maxBytes !== undefined) {
+                            const declaredLength = Number(ctx.req.header(common_1.HTTP.Headers.CONTENT_LENGTH));
+                            if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+                                throw (0, core_1.getError)({
+                                    error: common_2.StaticAssetErrors.UPLOAD_TOO_LARGE,
+                                    message: `Request body of ${declaredLength} bytes exceeds the maximum of ${maxBytes}`,
+                                });
+                            }
                         }
-                        const filesArray = await (0, ignis_helpers_1.parseMultipartBody)({
+                        const { files: filesArray, fields } = await (0, ignis_helpers_1.parseMultipartBody)({
                             context: ctx,
                             storage: options?.parseMultipartBody?.storage,
                             uploadDir: options?.parseMultipartBody?.uploadDir,
                         });
+                        // The labels travel WITH the payload rather than in the URL, so an identifier does not
+                        // land in every access log along the way. The cost is that they are unreadable until
+                        // the body is parsed, which is why the folder check runs here and not above.
+                        const queryLabels = ctx.req.query();
+                        const query = readUploadLabels({ fields, fallback: queryLabels });
+                        const stale = (0, exports.findLabelsInQuery)({ query: queryLabels });
+                        if (stale.length > 0) {
+                            this.logger
+                                .for('UPLOAD')
+                                .warn('Label(s) read from the query string - they belong in the form body, and this fallback will go | names: %s', stale.join(', '));
+                        }
+                        const folderPath = query.folderPath;
+                        if (folderPath) {
+                            validateFolderPath(folderPath);
+                        }
                         const spoolPaths = filesArray
                             .map(file => file.path)
                             .filter((filePath) => Boolean(filePath));
@@ -206,6 +465,14 @@ class AssetControllerFactory extends core_1.BaseHelper {
                                         message: `Empty file content | name: ${file.originalname}`,
                                     });
                                 }
+                                // The authoritative check: `buffer.length`, not the reported `size`, because the
+                                // reported one is whatever the client declared.
+                                if (maxBytes !== undefined && buffer.length > maxBytes) {
+                                    throw (0, core_1.getError)({
+                                        error: common_2.StaticAssetErrors.UPLOAD_TOO_LARGE,
+                                        message: `File ${file.originalname} of ${buffer.length} bytes exceeds the maximum of ${maxBytes}`,
+                                    });
+                                }
                                 return {
                                     originalName: file.originalname,
                                     mimetype: file.mimetype,
@@ -215,11 +482,25 @@ class AssetControllerFactory extends core_1.BaseHelper {
                                     folderPath: folderPath ?? undefined,
                                 };
                             });
+                            // Built per request: the hook is offered the bucket, which only the route knows. No
+                            // hook leaves `normalizeNameFn` exactly as configured, so the stored name is unchanged.
+                            const normalizeNameFn = resolveObjectName
+                                ? (naming) => {
+                                    const defaultKey = options?.normalizeNameFn
+                                        ? options.normalizeNameFn(naming)
+                                        : defaultObjectName(naming);
+                                    return resolveObjectName({
+                                        bucket: { name: bucketName },
+                                        file: naming.file,
+                                        defaultKey,
+                                    });
+                                }
+                                : options?.normalizeNameFn;
                             uploaded = await helper.upload({
-                                bucket: bucketName,
+                                bucket: { name: bucketName },
                                 files: modifiedFiles,
-                                normalizeNameFn: options?.normalizeNameFn,
-                                normalizeLinkFn: options?.normalizeLinkFn,
+                                normalizeNameFn,
+                                normalizeLinkFn,
                                 // Without this the helper re-validates against its own hard default of 2, so an app configured for a deeper tree spools the body and only then fails inside the helper.
                                 maxFolderDepth,
                             });
@@ -234,47 +515,30 @@ class AssetControllerFactory extends core_1.BaseHelper {
                         for (const uploadResult of uploaded) {
                             try {
                                 const fileStat = await helper.getStat({
-                                    bucket: uploadResult.bucketName,
-                                    name: uploadResult.objectName,
+                                    bucket: uploadResult.bucket,
+                                    object: uploadResult.object,
                                 });
-                                const { data: createdMetaLink } = metaLink.createMetaLink
-                                    ? await metaLink.createMetaLink({
-                                        uploadResult,
-                                        fileStat,
-                                        query,
-                                    })
-                                    : await metaLink.repository.create({
-                                        data: {
-                                            bucketName: uploadResult.bucketName,
-                                            objectName: uploadResult.objectName,
-                                            link: uploadResult.link,
-                                            mimetype: fileStat.metadata?.['mimetype'],
-                                            size: fileStat.size,
-                                            etag: fileStat.etag,
-                                            metadata: fileStat.metadata,
-                                            storageType: storage,
-                                            isSynced: true,
-                                            principalId: query.principalId ? String(query.principalId) : undefined,
-                                            principalType: query.principalType
-                                                ? String(query.principalType)
-                                                : undefined,
-                                            variant: query.variant ? String(query.variant) : undefined,
-                                        },
-                                    });
-                                results.push({ ...uploadResult, metaLink: createdMetaLink });
+                                const createdMetaLink = await createMetaLinkRow({
+                                    metaLink,
+                                    helper,
+                                    storage,
+                                    uploadResult,
+                                    fileStat,
+                                    query,
+                                });
+                                results.push({ ...uploadResult, metaLink: { data: createdMetaLink } });
                             }
                             catch (error) {
                                 this.logger
                                     .for('UPLOAD')
-                                    .error('Failed to create MetaLink | objectName: %s | Error: %s', uploadResult.objectName, error);
+                                    .error('Failed to create MetaLink | objectName: %s | Error: %s', uploadResult.object.key, error);
                                 results.push({
                                     ...uploadResult,
-                                    metaLink: null,
                                     // A CODE, never the driver text. This handler returns 200, so it bypasses the
                                     // error middleware and `database.handler` - the two places that strip
                                     // `detail`/`table`/`constraint` - and shipped raw constraint names to the client.
                                     // The real error is already logged in full immediately above.
-                                    metaLinkError: 'META_LINK_CREATE_FAILED',
+                                    metaLink: { error: common_2.META_LINK_CREATE_FAILED },
                                 });
                             }
                         }
@@ -282,36 +546,39 @@ class AssetControllerFactory extends core_1.BaseHelper {
                     },
                 });
                 this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.DELETE_BUCKET, ...routes?.deleteBucket },
+                    configs: { ...definitions.DELETE_OBJECT, ...routes?.deleteObject },
                 }).to({
                     handler: async (ctx) => {
-                        const { bucketName } = ctx.req.valid('param');
-                        if (!helper.isValidName(bucketName)) {
-                            throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
-                        }
-                        const isRemovedBucket = await helper.removeBucket({
-                            name: bucketName,
+                        const params = ctx.req.valid('param');
+                        const bucketName = await resolveBucket({
+                            configured: bucket,
+                            param: params.bucketName,
                         });
-                        return ctx.json({ isDeleted: isRemovedBucket }, common_1.HTTP.ResultCodes.RS_2.Ok);
-                    },
-                });
-                this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.DELETE_OBJECT, ...routes?.deleteObject },
-                }).to({
-                    handler: async (ctx) => {
-                        const { bucketName, objectName: rawObjectName } = ctx.req.valid('param');
-                        const objectName = readObjectName(rawObjectName);
-                        if (!helper.isValidName(bucketName)) {
+                        const objectName = readObjectName(params.objectName);
+                        if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
                         }
-                        if (!helper.isValidPath(objectName, { maxDepth: maxFolderDepth })) {
+                        if (!helper.isValidObjectKey({ object: { key: objectName }, maxDepth: maxFolderDepth })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.OBJECT_NAME_INVALID });
                         }
-                        await helper.removeObject({ bucket: bucketName, name: objectName });
+                        // Deliberately idempotent: S3 answers 200 for a key that was never there, and consumers
+                        // already depend on it. `disk` throws instead, so the two are reconciled here, not below.
+                        try {
+                            await helper.removeObject({
+                                bucket: { name: bucketName },
+                                object: { key: objectName },
+                            });
+                        }
+                        catch (error) {
+                            if (!(0, ignis_helpers_1.isNotFoundError)({ error })) {
+                                throw error;
+                            }
+                        }
                         if (!useMetaLink || !metaLink) {
                             return ctx.json({ success: true }, common_1.HTTP.ResultCodes.RS_2.Ok);
                         }
-                        metaLink.repository
+                        const deleteRepository = await (0, common_1.resolveValueAsync)(metaLink.repository);
+                        deleteRepository
                             .deleteAll({
                             where: {
                                 bucketName,
@@ -332,12 +599,16 @@ class AssetControllerFactory extends core_1.BaseHelper {
                     },
                 });
                 this.bindRoute({
-                    configs: { ...base_definition_1.StaticAssetDefinitions.LIST_OBJECTS, ...routes?.listObjects },
+                    configs: { ...definitions.LIST_OBJECTS, ...routes?.listObjects },
                 }).to({
                     handler: async (ctx) => {
-                        const { bucketName } = ctx.req.valid('param');
+                        // A configured bucket drops `params` from this route entirely, so it is read only when it exists.
+                        const bucketParam = hasConfiguredBucket
+                            ? undefined
+                            : ctx.req.valid('param').bucketName;
+                        const bucketName = await resolveBucket({ configured: bucket, param: bucketParam });
                         const { prefix, recursive, maxKeys } = ctx.req.valid('query');
-                        if (!helper.isValidName(bucketName)) {
+                        if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
                             throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
                         }
                         // A NaN or 0 maxKeys is silently treated as "unlimited" by the storage backends, so an unparsable value must be rejected instead of forwarded.
@@ -352,7 +623,7 @@ class AssetControllerFactory extends core_1.BaseHelper {
                             }
                         }
                         const objects = await helper.listObjects({
-                            bucket: bucketName,
+                            bucket: { name: bucketName },
                             prefix,
                             useRecursive: recursive === 'true',
                             maxKeys: resolvedMaxKeys,
@@ -360,27 +631,191 @@ class AssetControllerFactory extends core_1.BaseHelper {
                         return ctx.json(objects, common_1.HTTP.ResultCodes.RS_2.Ok);
                     },
                 });
+                if (directUpload) {
+                    if (!hasConfiguredBucket) {
+                        throw (0, core_1.getError)({
+                            message: `[${name}] directUpload needs controller.bucket | a policy names one bucket, and a bucket in the URL is a bucket the caller chooses`,
+                        });
+                    }
+                    const pendingPrefix = directUpload.pendingPrefix ?? common_2.DEFAULT_PENDING_PREFIX;
+                    this.bindRoute({
+                        configs: { ...definitions.UPLOAD_POLICY, ...routes?.uploadPolicy },
+                    }).to({
+                        handler: async (ctx) => {
+                            if (!(await directUpload.authorize({ context: ctx }))) {
+                                throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.UPLOAD_NOT_AUTHORIZED });
+                            }
+                            const { files } = ctx.req.valid('json');
+                            const bucketName = await resolveBucket({ configured: bucket });
+                            const policies = [];
+                            for (const file of files) {
+                                if (file.size !== undefined && file.size > directUpload.maxBytes) {
+                                    throw (0, core_1.getError)({
+                                        error: common_2.StaticAssetErrors.UPLOAD_TOO_LARGE,
+                                        message: `File '${file.fileName}' is ${file.size} bytes, over the ${directUpload.maxBytes} the policy allows`,
+                                    });
+                                }
+                                // Generated, never taken from the caller: a key the caller picks is a key the caller
+                                // can collide with, and the pending object is the one thing a policy authorizes.
+                                const objectName = `${pendingPrefix}${(0, node_crypto_1.randomUUID)()}/${file.fileName}`;
+                                const policy = await helper.presignPost({
+                                    bucket: { name: bucketName },
+                                    keyPrefix: pendingPrefix,
+                                    maxBytes: directUpload.maxBytes,
+                                    contentType: file.contentType,
+                                    expiresIn: directUpload.expiresIn,
+                                });
+                                policies.push({
+                                    ...policy,
+                                    objectName,
+                                    commitToken: (0, common_3.buildCommitToken)({
+                                        payload: {
+                                            bucket: bucketName,
+                                            key: objectName,
+                                            expiresAt: new Date(policy.expiresAt).getTime(),
+                                        },
+                                        secretKey: directUpload.secretKey,
+                                    }),
+                                });
+                            }
+                            return ctx.json(policies, common_1.HTTP.ResultCodes.RS_2.Ok);
+                        },
+                    });
+                    this.bindRoute({
+                        configs: { ...definitions.UPLOAD_COMMIT, ...routes?.uploadCommit },
+                    }).to({
+                        handler: async (ctx) => {
+                            const { commitToken, ...labels } = ctx.req.valid('json');
+                            // Verified BEFORE any storage call. That is what keeps this route from being a name
+                            // prober: a forged token fails without a round trip, so timing says nothing.
+                            const payload = (0, common_3.readCommitToken)({
+                                token: commitToken,
+                                secretKey: directUpload.secretKey,
+                            });
+                            // Labels, not authorization - the token deliberately carries no business fields, so
+                            // they travel beside it rather than inside it.
+                            const queryLabels = ctx.req.query();
+                            const query = readUploadLabels({
+                                fields: labels,
+                                fallback: queryLabels,
+                            });
+                            const staleLabels = (0, exports.findLabelsInQuery)({ query: queryLabels });
+                            if (staleLabels.length > 0) {
+                                this.logger
+                                    .for('UPLOAD_COMMIT')
+                                    .warn('Label(s) read from the query string - they belong in the JSON body, and this fallback will go | names: %s', staleLabels.join(', '));
+                            }
+                            const bucketRef = { name: payload.bucket };
+                            const pendingObject = { key: payload.key };
+                            const object = { key: payload.key.slice(pendingPrefix.length) };
+                            // Before the copy, so a hook that throws leaves the object under the pending prefix
+                            // for a lifecycle rule, rather than stranding it at the final key.
+                            await directUpload.onCommit?.({ bucket: bucketRef, pendingObject, object });
+                            await helper.copyObject({
+                                bucket: bucketRef,
+                                source: pendingObject,
+                                destination: object,
+                            });
+                            // The copy IS the commit; removing the temporary object is cleanup. A failure here
+                            // leaves one object for the lifecycle rule, and failing the request would tell the
+                            // caller their upload did not work when it did.
+                            await helper
+                                .removeObject({ bucket: bucketRef, object: pendingObject })
+                                .catch(error => {
+                                this.logger
+                                    .for('UPLOAD_COMMIT')
+                                    .warn('Committed, but the pending object remains | key: %s | error: %s', pendingObject.key, error);
+                            });
+                            const link = (0, exports.buildObjectLink)({
+                                basePath: normalizedBasePath,
+                                bucket: bucketRef,
+                                object,
+                                hasConfiguredBucket,
+                                rawObjectPath,
+                            });
+                            // The two upload paths have to agree. Without this the ordinary upload writes a row
+                            // and the direct one does not, so a client reading `metaLink` off the response renders
+                            // an empty state with no error - the failure nobody reports.
+                            let metaLinkResult;
+                            if (useMetaLink && metaLink) {
+                                try {
+                                    const fileStat = await helper.getStat({ bucket: bucketRef, object });
+                                    const data = await createMetaLinkRow({
+                                        metaLink,
+                                        helper,
+                                        storage,
+                                        uploadResult: {
+                                            bucket: bucketRef,
+                                            object: {
+                                                key: object.key,
+                                                size: fileStat.size,
+                                                contentType: fileStat.metadata?.mimetype ??
+                                                    helper.getMimeType({ filename: object.key }),
+                                            },
+                                            link,
+                                        },
+                                        fileStat,
+                                        query,
+                                    });
+                                    metaLinkResult = { data };
+                                }
+                                catch (error) {
+                                    // The copy already happened and the pending object is gone, so the object IS
+                                    // committed. Answering 500 would send the caller back with a token whose source
+                                    // no longer exists - which is why the ordinary upload reports this in the body
+                                    // too, as a code rather than the driver's text.
+                                    this.logger
+                                        .for('UPLOAD_COMMIT')
+                                        .error('Failed to create MetaLink | objectName: %s | Error: %s', object.key, error);
+                                    metaLinkResult = { error: common_2.META_LINK_CREATE_FAILED };
+                                }
+                            }
+                            return ctx.json({
+                                bucket: bucketRef,
+                                object,
+                                link,
+                                ...(metaLinkResult === undefined ? {} : { metaLink: metaLinkResult }),
+                            }, common_1.HTTP.ResultCodes.RS_2.Ok);
+                        },
+                    });
+                }
                 if (useMetaLink && metaLink) {
                     this.bindRoute({
-                        configs: { ...base_definition_1.StaticAssetDefinitions.RECREATE_METALINK, ...routes?.recreateMetaLink },
+                        configs: { ...definitions.RECREATE_METALINK, ...routes?.recreateMetaLink },
                     }).to({
                         handler: async (ctx) => {
-                            const { bucketName, objectName: rawObjectName } = ctx.req.valid('param');
-                            const objectName = readObjectName(rawObjectName);
-                            if (!helper.isValidName(bucketName)) {
+                            const params = ctx.req.valid('param');
+                            const bucketName = await resolveBucket({
+                                configured: bucket,
+                                param: params.bucketName,
+                            });
+                            const objectName = readObjectName(params.objectName);
+                            if (!helper.isValidBucketName({ bucket: { name: bucketName } })) {
                                 throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.BUCKET_NAME_INVALID });
                             }
-                            if (!helper.isValidPath(objectName, { maxDepth: maxFolderDepth })) {
+                            if (!helper.isValidObjectKey({ object: { key: objectName }, maxDepth: maxFolderDepth })) {
                                 throw (0, core_1.getError)({ error: common_2.StaticAssetErrors.OBJECT_NAME_INVALID });
                             }
                             const fileStat = await helper.getStat({
-                                bucket: bucketName,
-                                name: objectName,
+                                bucket: { name: bucketName },
+                                object: { key: objectName },
                             });
                             const link = options?.normalizeLinkFn
-                                ? options.normalizeLinkFn({ bucketName, normalizeName: objectName })
-                                : `${normalizedBasePath}/buckets/${bucketName}/objects/${encodeObjectPath(objectName)}`;
-                            const existing = await metaLink.repository.findOne({
+                                ? options.normalizeLinkFn({
+                                    bucket: { name: bucketName },
+                                    object: { key: objectName },
+                                })
+                                : (0, exports.buildObjectLink)({
+                                    basePath: normalizedBasePath,
+                                    bucket: { name: bucketName },
+                                    object: { key: objectName },
+                                    hasConfiguredBucket,
+                                    rawObjectPath,
+                                });
+                            // Read per call, never once per handler: an application may rebind the repository
+                            // between two of these, and a copy held across them would answer from the old binding.
+                            const findRepository = await (0, common_1.resolveValueAsync)(metaLink.repository);
+                            const existing = await findRepository.findOne({
                                 filter: {
                                     where: {
                                         bucketName,
@@ -389,7 +824,8 @@ class AssetControllerFactory extends core_1.BaseHelper {
                                 },
                             });
                             if (existing) {
-                                await metaLink.repository.updateById({
+                                const updateRepository = await (0, common_1.resolveValueAsync)(metaLink.repository);
+                                await updateRepository.updateById({
                                     id: existing.id,
                                     data: {
                                         link,
@@ -401,15 +837,17 @@ class AssetControllerFactory extends core_1.BaseHelper {
                                         isSynced: true,
                                     },
                                 });
-                                const updatedMetaLink = await metaLink.repository.findById({ id: existing.id });
+                                const readRepository = await (0, common_1.resolveValueAsync)(metaLink.repository);
+                                const updatedMetaLink = await readRepository.findById({ id: existing.id });
                                 return ctx.json({ success: true, metaLink: updatedMetaLink }, common_1.HTTP.ResultCodes.RS_2.Ok);
                             }
-                            const createdMetaLink = await metaLink.repository.create({
+                            const createRepository = await (0, common_1.resolveValueAsync)(metaLink.repository);
+                            const createdMetaLink = await createRepository.create({
                                 data: {
                                     bucketName,
                                     objectName,
                                     link,
-                                    mimetype: fileStat.metadata?.['mimetype'],
+                                    mimetype: fileStat.metadata?.mimetype ?? helper.getMimeType({ filename: objectName }),
                                     size: fileStat.size,
                                     etag: fileStat.etag,
                                     metadata: fileStat.metadata,
@@ -421,6 +859,8 @@ class AssetControllerFactory extends core_1.BaseHelper {
                         },
                     });
                 }
+                // Last, so a built-in route always wins a path collision with an application's own.
+                defineExtraRoutes?.({ controller: this, helper, basePath: normalizedBasePath });
             }
         };
         GeneratedStaticAssetController = __decorate([