@voltro/plugin-storage 0.84.0 → 0.86.0

package/dist/avatar.js

@@ -0,0 +1,39 @@
+import { StorageError as e } from "./types.js";
+import { Effect as t } from "effect";
+//#region src/avatar.ts
+var n = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/jpg": "jpg",
+	"image/gif": "gif",
+	"image/webp": "webp",
+	"image/svg+xml": "svg"
+}, r = (e) => {
+	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
+	if (!t) throw Error("not a data URI");
+	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
+	return {
+		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
+		contentType: n
+	};
+}, i = (i, a) => t.gen(function* () {
+	let o = yield* t.try({
+		try: () => r(a.dataUri),
+		catch: (t) => new e({
+			provider: "avatar",
+			message: String(t?.message ?? t),
+			transient: !1,
+			status: 400
+		})
+	}), s = n[o.contentType] ?? "bin";
+	return yield* i.put({
+		bytes: o.bytes,
+		contentType: o.contentType,
+		tenantId: a.tenantId,
+		ownerId: a.userId,
+		visibility: "public",
+		key: `avatars/${a.userId}/avatar.${s}`
+	});
+});
+//#endregion
+export { r as decodeDataUri, i as putAvatar };

package/dist/constraints.js

@@ -0,0 +1,93 @@
+//#region src/constraints.ts
+var e = (e, t) => {
+	if (!t || t.length === 0) return !0;
+	let n = e.toLowerCase();
+	return t.some((e) => {
+		let t = e.toLowerCase();
+		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
+	});
+}, t = [
+	{
+		ct: /^image\/png$/,
+		offset: 0,
+		magic: [
+			137,
+			80,
+			78,
+			71
+		]
+	},
+	{
+		ct: /^image\/jpe?g$/,
+		offset: 0,
+		magic: [
+			255,
+			216,
+			255
+		]
+	},
+	{
+		ct: /^image\/gif$/,
+		offset: 0,
+		magic: [
+			71,
+			73,
+			70,
+			56
+		]
+	},
+	{
+		ct: /^image\/webp$/,
+		offset: 0,
+		magic: [
+			82,
+			73,
+			70,
+			70
+		]
+	},
+	{
+		ct: /^image\/bmp$/,
+		offset: 0,
+		magic: [66, 77]
+	},
+	{
+		ct: /^application\/pdf$/,
+		offset: 0,
+		magic: [
+			37,
+			80,
+			68,
+			70
+		]
+	},
+	{
+		ct: /^application\/zip$/,
+		offset: 0,
+		magic: [
+			80,
+			75,
+			3,
+			4
+		]
+	},
+	{
+		ct: /^application\/gzip$/,
+		offset: 0,
+		magic: [31, 139]
+	}
+], n = (e, n) => {
+	let r = n.toLowerCase(), i = t.find((e) => e.ct.test(r));
+	return i ? e.length < i.offset + i.magic.length ? !1 : i.magic.every((t, n) => e[i.offset + n] === t) : !0;
+}, r = (t, r, i) => i ? i.maxBytes !== void 0 && t.byteLength > i.maxBytes ? {
+	reason: "too-large",
+	detail: `${t.byteLength} bytes exceeds the ${i.maxBytes}-byte limit`
+} : e(r, i.allowedContentTypes) ? i.sniff && !n(t, r) ? {
+	reason: "content-mismatch",
+	detail: `bytes do not match the declared content type '${r}'`
+} : null : {
+	reason: "content-type-not-allowed",
+	detail: `content type '${r}' is not in the allow-list`
+} : null;
+//#endregion
+export { r as checkLimits, e as contentTypeAllowed, n as sniffMatches };

package/dist/derivatives.js

@@ -0,0 +1,30 @@
+import { isTransformable as e, loadSharp as t } from "./transform.js";
+//#region src/derivatives.ts
+var n = async (n, r, i) => {
+	if (!e(r)) return { bytes: n };
+	let a = await t();
+	if (!a) return { bytes: n };
+	try {
+		let e = n;
+		if (i?.normalize) {
+			let t = await a(Buffer.from(n), { failOn: "none" }).rotate().toBuffer();
+			e = new Uint8Array(t);
+		}
+		let t = await a(Buffer.from(e), { failOn: "none" }).metadata(), r = await a(Buffer.from(e), { failOn: "none" }).resize({
+			width: 24,
+			height: 24,
+			fit: "inside",
+			withoutEnlargement: !0
+		}).webp({ quality: 40 }).toBuffer().catch(() => null);
+		return {
+			bytes: e,
+			...typeof t.width == "number" ? { width: t.width } : {},
+			...typeof t.height == "number" ? { height: t.height } : {},
+			...r ? { placeholder: `data:image/webp;base64,${r.toString("base64")}` } : {}
+		};
+	} catch {
+		return { bytes: n };
+	}
+};
+//#endregion
+export { n as extractImageMetadata };

package/dist/env.js

@@ -0,0 +1,156 @@
+import { pluginEnv as e } from "@voltro/env";
+//#region src/env.ts
+var t = e([
+	{
+		name: "STORAGE_PROVIDER",
+		required: !1,
+		secret: !1,
+		description: "Provider name: 's3' | 'minio' | 'azure' | 'database' | 'filesystem' | 'memory'. Default 'memory'."
+	},
+	{
+		name: "S3_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "S3/MinIO bucket name. Default STORAGE_BUCKET, else \"voltro\"."
+	},
+	{
+		name: "STORAGE_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "Fallback bucket name when S3_BUCKET is unset."
+	},
+	{
+		name: "S3_REGION",
+		required: !1,
+		secret: !1,
+		description: "S3 region. Falls back to AWS_REGION."
+	},
+	{
+		name: "AWS_REGION",
+		required: !1,
+		secret: !1,
+		description: "AWS region fallback for the S3 provider."
+	},
+	{
+		name: "S3_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom S3 endpoint URL. Falls back to MINIO_ENDPOINT."
+	},
+	{
+		name: "MINIO_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "MinIO endpoint URL fallback for the S3 provider."
+	},
+	{
+		name: "S3_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "S3 access key id. Falls back to AWS_ACCESS_KEY_ID."
+	},
+	{
+		name: "AWS_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "AWS access key id fallback for the S3 provider."
+	},
+	{
+		name: "S3_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "S3 secret access key. Falls back to AWS_SECRET_ACCESS_KEY."
+	},
+	{
+		name: "AWS_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "AWS secret access key fallback for the S3 provider."
+	},
+	{
+		name: "S3_FORCE_PATH_STYLE",
+		required: !1,
+		secret: !1,
+		description: "Set to \"1\" to force path-style S3 addressing."
+	},
+	{
+		name: "STORAGE_CDN_URL",
+		required: !1,
+		secret: !1,
+		description: "Public base URL (CDN) served in front of the bucket for public objects."
+	},
+	{
+		name: "VOLTRO_PUBLIC_URL",
+		required: !1,
+		secret: !1,
+		description: "Absolute public base URL of THIS api (scheme://host[:port]) — prepended to the /_voltro/storage/:id serve URL so getUrl/mintUrl/the upload route emit ABSOLUTE URLs. Required when the api is a different origin than the app."
+	},
+	{
+		name: "STORAGE_ALLOWED_ORIGINS",
+		required: !1,
+		secret: !1,
+		description: "Comma-separated origins allowed to read the serve route + POST the upload route cross-origin (CORS). Use '*' for any. Omit for same-origin only."
+	},
+	{
+		name: "AZURE_STORAGE_ACCOUNT",
+		required: !1,
+		secret: !1,
+		description: "Azure storage account name (provider \"azure\")."
+	},
+	{
+		name: "AZURE_STORAGE_KEY",
+		required: !1,
+		secret: !0,
+		description: "Azure account key — needed to mint SAS URLs."
+	},
+	{
+		name: "AZURE_STORAGE_CONNECTION_STRING",
+		required: !1,
+		secret: !0,
+		description: "Azure connection string (carries the account key)."
+	},
+	{
+		name: "AZURE_STORAGE_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom Azure blob endpoint (e.g. Azurite)."
+	},
+	{
+		name: "AZURE_STORAGE_CONTAINER",
+		required: !1,
+		secret: !1,
+		description: "Azure blob container name (the \"bucket\")."
+	},
+	{
+		name: "STORAGE_ROOT",
+		required: !1,
+		secret: !1,
+		description: "Filesystem provider root directory. Default \".voltro-storage\"."
+	},
+	{
+		name: "VOLTRO_STORAGE_SECRET",
+		required: !1,
+		secret: !0,
+		description: "HMAC secret for signed grant tokens. Falls back to the session secret."
+	},
+	{
+		name: "VOLTRO_SESSION_COOKIE",
+		required: !1,
+		secret: !1,
+		description: "Session cookie name used to resolve private-object access. Default \"voltro:session\"."
+	},
+	{
+		name: "CLAMAV_HOST",
+		required: !1,
+		secret: !1,
+		description: "clamd host for the optional clamav virus scanner. Default 127.0.0.1."
+	},
+	{
+		name: "CLAMAV_PORT",
+		required: !1,
+		secret: !1,
+		description: "clamd port for the optional clamav virus scanner. Default 3310."
+	}
+]);
+//#endregion
+export { t as storageEnv };

package/dist/grant.js

@@ -0,0 +1,112 @@
+import { storageEnv as e } from "./env.js";
+import { createHmac as t, timingSafeEqual as n } from "node:crypto";
+import { Exit as r, Schema as i } from "effect";
+import { StorageAccessPolicySchema as a } from "@voltro/protocol";
+import { resolveSessionSecret as o } from "@voltro/protocol/session";
+//#region src/grant.ts
+var s = () => e.read("VOLTRO_STORAGE_SECRET") ?? o(), c = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), l = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
+	return Buffer.from(t, "base64");
+}, u = (e, n, r = s(), i = "/_voltro/storage") => {
+	if (!r) throw Error("signGrant: secret must be a non-empty string");
+	let a = {
+		refId: e,
+		audience: i,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, o = c(JSON.stringify(a));
+	return `${o}.${c(t("sha256", r).update(o).digest())}`;
+}, d = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(a).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return typeof e.audience != "string" || !e.audience || typeof e.refId != "string" || typeof e.exp != "number" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, f = (e) => e.version !== 2 || typeof e.writeScope != "string" || !/^[a-f0-9]{64}$/.test(e.writeScope) || Object.hasOwn(e, "replicaId") || e.issuerReplicaId !== void 0 && (typeof e.issuerReplicaId != "string" || !e.issuerReplicaId.trim()) ? !1 : e.access === void 0 || e.vis === "private" && r.isSuccess(i.decodeUnknownExit(a, { onExcessProperty: "error" })(e.access)), p = (e, n, r = s()) => {
+	if (!r) throw Error("signUploadTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`u:${a}`).digest())}`;
+}, m = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`u:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, h = (e, n, r = s()) => {
+	if (!r) throw Error("signFinalizeTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`f:${a}`).digest())}`;
+}, g = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`f:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, _ = (e, n, r = s()) => {
+	if (!r) throw Error("signResumableTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`r:${a}`).digest())}`;
+}, v = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`r:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, y = (e, n, r = s()) => {
+	if (!r) throw Error("signMultipartTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`m:${a}`).digest())}`;
+}, b = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`m:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+};
+//#endregion
+export { s as resolveStorageSecret, h as signFinalizeTicket, u as signGrant, y as signMultipartTicket, _ as signResumableTicket, p as signUploadTicket, g as verifyFinalizeTicket, d as verifyGrant, b as verifyMultipartTicket, v as verifyResumableTicket, m as verifyUploadTicket };