@vex-chat/spire 0.7.4 → 1.0.0

package/dist/server/file.js

@@ -1,94 +1,134 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getFileRouter = void 0;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const crypto_1 = require("@vex-chat/crypto");
-const express_1 = __importDefault(require("express"));
-const multer_1 = __importDefault(require("multer"));
-const tweetnacl_1 = __importDefault(require("tweetnacl"));
-const uuid_1 = require("uuid");
-const getFileRouter = (db, log) => {
-    const router = express_1.default.Router();
-    router.get("/:id", (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-        const entry = yield db.retrieveFile(req.params.id);
+import * as fs from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+import express from "express";
+import { XUtils } from "@vex-chat/crypto";
+import { FilePayloadSchema } from "@vex-chat/types";
+import multer from "multer";
+import { z } from "zod/v4";
+import { msgpack } from "../utils/msgpack.js";
+import { uploadLimiter } from "./rateLimit.js";
+import { getParam } from "./utils.js";
+import { protect } from "./index.js";
+const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
+export const getFileRouter = (db, log) => {
+    const router = express.Router();
+    router.get("/:id", protect, async (req, res) => {
+        const safeId = safePathParam.safeParse(getParam(req, "id"));
+        if (!safeId.success) {
+            res.sendStatus(400);
+            return;
+        }
+        const entry = await db.retrieveFile(safeId.data);
         if (!entry) {
             res.sendStatus(404);
         }
         else {
-            const stream = fs_1.default.createReadStream("./files/" + entry.fileID);
+            const stream = fs.createReadStream("./files/" + entry.fileID);
             stream.on("error", (err) => {
-                console.log(err.toString());
-                res.send(500);
+                log.error(err.toString());
+                res.sendStatus(500);
             });
             stream.pipe(res);
         }
-    }));
-    router.get("/:id/details", (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-        const entry = yield db.retrieveFile(req.params.id);
+    });
+    router.get("/:id/details", protect, async (req, res) => {
+        const safeId = safePathParam.safeParse(getParam(req, "id"));
+        if (!safeId.success) {
+            res.sendStatus(400);
+            return;
+        }
+        const entry = await db.retrieveFile(safeId.data);
         if (!entry) {
             res.sendStatus(404);
         }
         else {
-            fs_1.default.stat(path_1.default.resolve("./files/" + entry.fileID), (err, stat) => {
+            fs.stat(path.resolve("./files/" + entry.fileID), (err, stat) => {
                 if (err) {
                     res.sendStatus(500);
                     return;
                 }
                 res.set("Cache-control", "public, max-age=31536000");
-                res.send(Object.assign(Object.assign({}, entry), { size: stat.size, birthtime: stat.birthtime }));
+                res.send(msgpack.encode({
+                    ...entry,
+                    birthtime: stat.birthtime,
+                    size: stat.size,
+                }));
             });
         }
-    }));
-    router.post("/", multer_1.default().single("file"), (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-        const payload = req.body;
+    });
+    router.post("/json", protect, async (req, res) => {
+        const deviceDetails = req.device;
+        if (!deviceDetails) {
+            res.sendStatus(401);
+            return;
+        }
+        const parsed = FilePayloadSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid file payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const payload = parsed.data;
         if (payload.nonce === "") {
             res.sendStatus(400);
             return;
         }
-        const deviceEntry = yield db.retrieveDevice(payload.owner);
-        if (!deviceEntry) {
-            log.warn("No device found.");
-            res.send(400);
+        if (!payload.file) {
+            res.sendStatus(400);
+            return;
+        }
+        const buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        const newFile = {
+            fileID: crypto.randomUUID(),
+            nonce: payload.nonce,
+            owner: payload.owner,
+        };
+        await fsp.writeFile("files/" + newFile.fileID, buf);
+        log.info("Wrote new file " + newFile.fileID);
+        await db.createFile(newFile);
+        res.send(msgpack.encode(newFile));
+    });
+    // Multipart file upload — form fields are strings from multer, not full FilePayload
+    const multipartFields = z.object({
+        nonce: z.string().min(1),
+        owner: z.string().min(1),
+    });
+    router.post("/", uploadLimiter, protect, multer().single("file"), async (req, res) => {
+        const deviceDetails = req.device;
+        if (!deviceDetails) {
+            res.sendStatus(400);
             return;
         }
-        const devices = yield db.retrieveUserDeviceList([deviceEntry.owner]);
-        let token = null;
-        for (const device of devices) {
-            const verified = tweetnacl_1.default.sign.open(crypto_1.XUtils.decodeHex(payload.signed), crypto_1.XUtils.decodeHex(device.signKey));
-            if (verified) {
-                token = verified;
-            }
+        const parsed = multipartFields.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid file payload",
+                issues: parsed.error.issues,
+            });
+            return;
         }
-        if (!token) {
-            log.warn("Bad signature on token.");
-            res.sendStatus(401);
+        const payload = parsed.data;
+        if (req.file === undefined) {
+            res.sendStatus(400);
+            return;
+        }
+        if (payload.nonce === "") {
+            res.sendStatus(400);
             return;
         }
         const newFile = {
-            fileID: uuid_1.v4(),
-            owner: payload.owner,
+            fileID: crypto.randomUUID(),
             nonce: payload.nonce,
+            owner: payload.owner,
         };
-        // write the file to disk
-        fs_1.default.writeFile("files/" + newFile.fileID, req.file.buffer, () => {
-            log.info("Wrote new file " + newFile.fileID);
-        });
-        yield db.createFile(newFile);
-        res.send(newFile);
-    }));
+        await fsp.writeFile("files/" + newFile.fileID, req.file.buffer);
+        log.info("Wrote new file " + newFile.fileID);
+        await db.createFile(newFile);
+        res.send(msgpack.encode(newFile));
+    });
     return router;
 };
-exports.getFileRouter = getFileRouter;
+//# sourceMappingURL=file.js.map

package/dist/server/file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/server/file.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAY,EAAE,GAAmB,EAAE,EAAE;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACJ,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC1B,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACJ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBAC3D,IAAI,GAAG,EAAE,CAAC;oBACN,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO;gBACX,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;gBACrD,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;oBACX,GAAG,KAAK;oBACR,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAClB,CAAC,CACL,CAAC;YACN,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAEjC,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QAE5B,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAY;YACrB,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;QAEF,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7C,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACP,GAAG,EACH,aAAa,EACb,OAAO,EACP,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EACvB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAEjC,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QAE5B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAY;YACrB,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;QAEF,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7C,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/index.d.ts

@@ -1,7 +1,10 @@
-import { XTypes } from "@vex-chat/types";
-import expressWs from "express-ws";
-import winston from "winston";
-import { Database } from "../Database";
+import type { Database } from "../Database.ts";
+import type winston from "winston";
+import express from "express";
+import { type KeyPair } from "@vex-chat/crypto";
+import { TokenScopes } from "@vex-chat/types";
 export declare const EXPIRY_TIME: number;
-export declare const protect: (req: any, res: any, next: () => void) => void;
-export declare const initApp: (api: expressWs.Application, db: Database, log: winston.Logger, tokenValidator: (key: string, scope: XTypes.HTTP.TokenScopes) => boolean, signKeys: nacl.SignKeyPair, notify: (userID: string, event: string, transmissionID: string, data?: any, deviceID?: string | undefined) => void) => void;
+export declare const ALLOWED_IMAGE_TYPES: string[];
+export declare const protect: express.RequestHandler;
+export declare const msgpackParser: express.RequestHandler;
+export declare const initApp: (api: express.Application, db: Database, log: winston.Logger, tokenValidator: (key: string, scope: TokenScopes) => boolean, signKeys: KeyPair, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void) => void;