@vobase/core 0.9.0 → 0.11.0

package/src/modules/storage/providers/local.ts

@@ -0,0 +1,124 @@
+import { mkdirSync, unlinkSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { join, normalize, dirname } from 'node:path';
+
+import { validation } from '../../../infra/errors';
+import type {
+  StorageProvider,
+  StorageObjectInfo,
+  LocalProviderConfig,
+} from '../../../contracts/storage';
+
+function sanitizePath(inputPath: string): string {
+  if (inputPath.includes('..')) {
+    throw validation(
+      { path: inputPath },
+      'Invalid path: directory traversal not allowed',
+    );
+  }
+  return normalize(inputPath).replace(/^\/+/, '');
+}
+
+export function createLocalProvider(config: LocalProviderConfig): StorageProvider {
+  const basePath = config.basePath;
+  const baseUrl = config.baseUrl ?? '/api/storage';
+
+  // Ensure base directory exists
+  mkdirSync(basePath, { recursive: true });
+
+  return {
+    async upload(fullKey, data, opts) {
+      const safe = sanitizePath(fullKey);
+      const fullPath = join(basePath, safe);
+
+      if (opts?.maxSize && data.byteLength > opts.maxSize) {
+        throw validation(
+          { size: data.byteLength, maxSize: opts.maxSize },
+          `File size ${data.byteLength} exceeds maximum allowed size ${opts.maxSize}`,
+        );
+      }
+
+      const dir = dirname(fullPath);
+      mkdirSync(dir, { recursive: true });
+
+      await Bun.write(fullPath, data);
+    },
+
+    async download(fullKey) {
+      const safe = sanitizePath(fullKey);
+      const file = Bun.file(join(basePath, safe));
+      if (!(await file.exists())) {
+        throw validation({ key: fullKey }, `File not found: ${fullKey}`);
+      }
+      return new Uint8Array(await file.arrayBuffer());
+    },
+
+    async delete(fullKey) {
+      const safe = sanitizePath(fullKey);
+      const fullPath = join(basePath, safe);
+      try {
+        unlinkSync(fullPath);
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
+      }
+    },
+
+    async exists(fullKey) {
+      const safe = sanitizePath(fullKey);
+      return existsSync(join(basePath, safe));
+    },
+
+    presign(fullKey, _opts) {
+      const safe = sanitizePath(fullKey);
+      // Local provider returns a proxy URL — the server handles the actual I/O
+      return `${baseUrl}/${safe}`;
+    },
+
+    async list(prefix, opts) {
+      const safe = sanitizePath(prefix || '');
+      const dir = join(basePath, safe);
+      const limit = opts?.limit ?? 100;
+
+      const objects: StorageObjectInfo[] = [];
+
+      if (!existsSync(dir)) {
+        return { objects };
+      }
+
+      const entries = readdirSync(dir, { recursive: true });
+      let skipping = !!opts?.cursor;
+
+      for (const entry of entries) {
+        const entryStr = typeof entry === 'string' ? entry : entry.toString();
+        const fullPath = join(dir, entryStr);
+
+        try {
+          const stat = statSync(fullPath);
+          if (!stat.isFile()) continue;
+        } catch {
+          continue;
+        }
+
+        const key = safe ? `${safe}/${entryStr}` : entryStr;
+
+        if (skipping) {
+          if (key === opts?.cursor) skipping = false;
+          continue;
+        }
+
+        if (objects.length >= limit) {
+          return { objects, cursor: objects[objects.length - 1].key };
+        }
+
+        const stat = statSync(fullPath);
+        objects.push({
+          key,
+          size: stat.size,
+          contentType: 'application/octet-stream',
+          lastModified: stat.mtime,
+        });
+      }
+
+      return { objects };
+    },
+  };
+}

package/src/modules/storage/providers/s3.ts

@@ -0,0 +1,83 @@
+import { S3Client } from 'bun';
+
+import type {
+  StorageProvider,
+  StorageObjectInfo,
+  S3ProviderConfig,
+} from '../../../contracts/storage';
+import { validation } from '../../../infra/errors';
+
+export function createS3Provider(config: S3ProviderConfig): StorageProvider {
+  const client = new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...(config.region && { region: config.region }),
+    ...(config.endpoint && { endpoint: config.endpoint }),
+  });
+
+  return {
+    async upload(fullKey, data, opts) {
+      if (opts?.maxSize && data.byteLength > opts.maxSize) {
+        throw validation(
+          { size: data.byteLength, maxSize: opts.maxSize },
+          `File size ${data.byteLength} exceeds maximum allowed size ${opts.maxSize}`,
+        );
+      }
+
+      const file = client.file(fullKey);
+      await file.write(data, {
+        ...(opts?.contentType && { type: opts.contentType }),
+      });
+    },
+
+    async download(fullKey) {
+      const file = client.file(fullKey);
+      try {
+        const buf = await file.arrayBuffer();
+        return new Uint8Array(buf);
+      } catch {
+        throw validation({ key: fullKey }, `File not found: ${fullKey}`);
+      }
+    },
+
+    async delete(fullKey) {
+      const file = client.file(fullKey);
+      await file.delete();
+    },
+
+    async exists(fullKey) {
+      const file = client.file(fullKey);
+      return file.exists();
+    },
+
+    presign(fullKey, opts) {
+      return client.presign(fullKey, {
+        expiresIn: opts.expiresIn ?? 3600,
+        method: opts.method ?? 'GET',
+      });
+    },
+
+    async list(prefix, opts) {
+      // Bun's S3Client doesn't have a native list API — use the S3 ListObjectsV2 REST API
+      const limit = opts?.limit ?? 100;
+      const params = new URLSearchParams({
+        'list-type': '2',
+        prefix: prefix,
+        'max-keys': String(limit),
+      });
+      if (opts?.cursor) {
+        params.set('start-after', opts.cursor);
+      }
+
+      // const endpoint = config.endpoint ?? `https://s3.${config.region ?? 'us-east-1'}.amazonaws.com`;
+      // const url = `${endpoint}/${config.bucket}?${params}`;
+
+      // Bun's S3Client doesn't expose ListObjectsV2 — full listing requires XML parsing.
+      // Most use cases rely on metadata in SQLite; enhance here when needed.
+      // This will be enhanced when needed; most use cases rely on metadata in SQLite
+      const objects: StorageObjectInfo[] = [];
+      return { objects };
+    },
+  };
+}

package/src/modules/storage/routes.ts

@@ -0,0 +1,76 @@
+import { Hono } from 'hono';
+
+import type { StorageService } from './service';
+
+export function createStorageRoutes(service: StorageService): Hono {
+  const routes = new Hono();
+
+  // POST /api/storage/:bucket — upload a file
+  routes.post('/:bucket', async (c) => {
+    const bucketName = c.req.param('bucket');
+    const bucket = service.bucket(bucketName);
+
+    const body = await c.req.parseBody();
+    const file = body.file;
+
+    if (!file || !(file instanceof File)) {
+      return c.json({ error: 'Missing file in request body' }, 400);
+    }
+
+    const data = new Uint8Array(await file.arrayBuffer());
+    const key = (body.key as string) || file.name;
+    const contentType = file.type || 'application/octet-stream';
+
+    const obj = await bucket.upload(key, data, { contentType });
+    return c.json(obj, 201);
+  });
+
+  // POST /api/storage/:bucket/confirm — confirm a presigned upload
+  routes.post('/:bucket/confirm', async (c) => {
+    const bucketName = c.req.param('bucket');
+    const bucket = service.bucket(bucketName);
+    const { key } = await c.req.json<{ key: string }>();
+
+    const meta = await bucket.metadata(key);
+    if (meta) {
+      return c.json(meta);
+    }
+
+    return c.json({ error: 'Object not found' }, 404);
+  });
+
+  // GET /api/storage/:bucket — list objects
+  routes.get('/:bucket', async (c) => {
+    const bucketName = c.req.param('bucket');
+    const bucket = service.bucket(bucketName);
+
+    const prefix = c.req.query('prefix');
+    const cursor = c.req.query('cursor');
+    const limit = c.req.query('limit');
+
+    const result = await bucket.list({
+      prefix: prefix || undefined,
+      cursor: cursor || undefined,
+      limit: limit ? Number.parseInt(limit, 10) : undefined,
+    });
+
+    return c.json(result);
+  });
+
+  // GET /api/storage/:bucket/:key{.+} — download / proxy a file
+  routes.get('/:bucket/:key{.+}', async (c) => {
+    const bucketName = c.req.param('bucket');
+    const key = c.req.param('key');
+    const bucket = service.bucket(bucketName);
+
+    const data = await bucket.download(key);
+    const meta = await bucket.metadata(key);
+    const contentType = meta?.contentType ?? 'application/octet-stream';
+
+    return new Response(data.buffer as ArrayBuffer, {
+      headers: { 'content-type': contentType },
+    });
+  });
+
+  return routes;
+}

package/src/modules/storage/schema.ts

@@ -0,0 +1,26 @@
+import { index, integer, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core';
+
+import { nanoidPrimaryKey } from '../../db/helpers';
+
+export const storageObjects = sqliteTable(
+  '_storage_objects',
+  {
+    id: nanoidPrimaryKey(),
+    bucket: text('bucket').notNull(),
+    key: text('key').notNull(),
+    size: integer('size').notNull(),
+    contentType: text('content_type').notNull().default('application/octet-stream'),
+    metadata: text('metadata'),
+    uploadedBy: text('uploaded_by'),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' })
+      .notNull()
+      .$defaultFn(() => new Date()),
+  },
+  (table) => [
+    uniqueIndex('storage_objects_bucket_key_idx').on(table.bucket, table.key),
+    index('storage_objects_bucket_idx').on(table.bucket),
+    index('storage_objects_uploaded_by_idx').on(table.uploadedBy),
+  ],
+);
+
+export const storageSchema = { storageObjects };

package/src/modules/storage/service.ts

@@ -0,0 +1,202 @@
+import { eq, and } from 'drizzle-orm';
+
+import type { VobaseDb } from '../../db/client';
+import type {
+  StorageProvider,
+  UploadOptions,
+  PresignOptions,
+  StorageListResult,
+} from '../../contracts/storage';
+import { validation } from '../../infra/errors';
+import { storageObjects } from './schema';
+
+export interface BucketConfig {
+  access: 'public' | 'private';
+  maxSize?: number;
+  allowedTypes?: string[];
+}
+
+export interface StorageObject {
+  id: string;
+  bucket: string;
+  key: string;
+  size: number;
+  contentType: string;
+  metadata: Record<string, string> | null;
+  uploadedBy: string | null;
+  createdAt: Date;
+}
+
+export interface BucketHandle {
+  upload(key: string, data: Buffer | Uint8Array, opts?: UploadOptions): Promise<StorageObject>;
+  download(key: string): Promise<Uint8Array>;
+  delete(key: string): Promise<void>;
+  presign(key: string, opts?: PresignOptions): string;
+  list(opts?: BucketListOptions): Promise<StorageListResult>;
+  metadata(key: string): Promise<StorageObject | null>;
+}
+
+export interface BucketListOptions {
+  prefix?: string;
+  cursor?: string;
+  limit?: number;
+}
+
+export interface StorageService {
+  bucket(name: string): BucketHandle;
+}
+
+export function createStorageService(
+  provider: StorageProvider,
+  buckets: Record<string, BucketConfig>,
+  db: VobaseDb,
+): StorageService {
+  const validBucketNames = new Set(Object.keys(buckets));
+
+  function assertBucket(name: string): BucketConfig {
+    if (!validBucketNames.has(name)) {
+      throw validation(
+        { bucket: name, available: [...validBucketNames] },
+        `Unknown storage bucket "${name}". Available buckets: ${[...validBucketNames].join(', ')}`,
+      );
+    }
+    return buckets[name];
+  }
+
+  function fullKey(bucket: string, key: string): string {
+    return `${bucket}/${key}`;
+  }
+
+  return {
+    bucket(name: string): BucketHandle {
+      const config = assertBucket(name);
+
+      return {
+        async upload(key, data, opts) {
+          const fk = fullKey(name, key);
+          const contentType = opts?.contentType ?? 'application/octet-stream';
+
+          if (config.maxSize && data.byteLength > config.maxSize) {
+            throw validation(
+              { size: data.byteLength, maxSize: config.maxSize },
+              `File size ${data.byteLength} exceeds bucket max size ${config.maxSize}`,
+            );
+          }
+
+          if (config.allowedTypes && config.allowedTypes.length > 0) {
+            const allowed = config.allowedTypes.some((pattern) => {
+              if (pattern.endsWith('/*')) {
+                return contentType.startsWith(pattern.slice(0, -1));
+              }
+              return contentType === pattern;
+            });
+            if (!allowed) {
+              throw validation(
+                { contentType, allowedTypes: config.allowedTypes },
+                `Content type "${contentType}" is not allowed in bucket "${name}"`,
+              );
+            }
+          }
+
+          await provider.upload(fk, data, { ...opts, maxSize: config.maxSize });
+
+          // Upsert metadata in SQLite
+          const existing = db
+            .select()
+            .from(storageObjects)
+            .where(and(eq(storageObjects.bucket, name), eq(storageObjects.key, key)))
+            .get();
+
+          if (existing) {
+            db.update(storageObjects)
+              .set({
+                size: data.byteLength,
+                contentType,
+                metadata: opts?.metadata ? JSON.stringify(opts.metadata) : null,
+              })
+              .where(eq(storageObjects.id, existing.id))
+              .run();
+
+            return {
+              ...existing,
+              size: data.byteLength,
+              contentType,
+              metadata: opts?.metadata ?? null,
+              createdAt: existing.createdAt,
+            };
+          }
+
+          const row = db
+            .insert(storageObjects)
+            .values({
+              bucket: name,
+              key,
+              size: data.byteLength,
+              contentType,
+              metadata: opts?.metadata ? JSON.stringify(opts.metadata) : null,
+              uploadedBy: opts?.metadata?.uploadedBy ?? null,
+            })
+            .returning()
+            .get();
+
+          return {
+            id: row.id,
+            bucket: row.bucket,
+            key: row.key,
+            size: row.size,
+            contentType: row.contentType,
+            metadata: row.metadata ? JSON.parse(row.metadata) : null,
+            uploadedBy: row.uploadedBy,
+            createdAt: row.createdAt,
+          };
+        },
+
+        async download(key) {
+          return provider.download(fullKey(name, key));
+        },
+
+        async delete(key) {
+          await provider.delete(fullKey(name, key));
+          db.delete(storageObjects)
+            .where(and(eq(storageObjects.bucket, name), eq(storageObjects.key, key)))
+            .run();
+        },
+
+        presign(key, opts) {
+          return provider.presign(fullKey(name, key), opts ?? {});
+        },
+
+        async list(opts) {
+          const prefix = opts?.prefix
+            ? fullKey(name, opts.prefix)
+            : `${name}/`;
+          return provider.list(prefix, {
+            cursor: opts?.cursor,
+            limit: opts?.limit,
+          });
+        },
+
+        async metadata(key) {
+          const row = db
+            .select()
+            .from(storageObjects)
+            .where(and(eq(storageObjects.bucket, name), eq(storageObjects.key, key)))
+            .get();
+
+          if (!row) return null;
+
+          return {
+            id: row.id,
+            bucket: row.bucket,
+            key: row.key,
+            size: row.size,
+            contentType: row.contentType,
+            metadata: row.metadata ? JSON.parse(row.metadata) : null,
+            uploadedBy: row.uploadedBy,
+            createdAt: row.createdAt,
+          };
+        },
+      };
+    },
+  };
+}