@voltro/plugin-storage 0.85.0 → 0.87.0

package/dist/grant.js

@@ -0,0 +1,132 @@
+import { storageEnv as e } from "./env.js";
+import { Exit as t, Schema as n } from "effect";
+import { createHmac as r, timingSafeEqual as i } from "node:crypto";
+import { StorageAccessPolicySchema as a } from "@voltro/protocol";
+import { noteConfigured as o, noteSigned as s, noteSigningLifetime as c, previousAccepted as l, resolveSessionSecrets as u } from "@voltro/protocol/session";
+//#region src/grant.ts
+var d = () => {
+	let t = e.read("VOLTRO_STORAGE_SECRET");
+	if (t !== void 0 && t !== "") {
+		let n = e.read("VOLTRO_STORAGE_SECRET_PREVIOUS");
+		return o("storage", t, n), n === void 0 || n === "" || n === t || !l("storage", n) ? [t] : [t, n];
+	}
+	let n = u();
+	return n.previous === void 0 ? [n.current.secret] : [n.current.secret, n.previous.secret];
+}, f = (t, n) => {
+	s(t === e.read("VOLTRO_STORAGE_SECRET") ? "storage" : "session", t, n * 1e3);
+}, p = (t) => {
+	c(e.read("VOLTRO_STORAGE_SECRET") ? "storage" : "session", t * 1e3);
+}, m = () => d()[0], h = (e, t, n) => {
+	let a = v(t), o = !1;
+	for (let t of typeof n == "string" ? [n] : n) {
+		if (!t) continue;
+		let n = r("sha256", t).update(e).digest();
+		a.length === n.length && i(a, n) && (o = !0);
+	}
+	return o;
+}, g = (e) => typeof e == "string" ? e.length > 0 : e.some((e) => e.length > 0), _ = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), v = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
+	return Buffer.from(t, "base64");
+}, y = (e, t, n = m(), i = "/_voltro/storage") => {
+	if (!n) throw Error("signGrant: secret must be a non-empty string");
+	let a = {
+		refId: e,
+		audience: i,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, o = _(JSON.stringify(a)), s = _(r("sha256", n).update(o).digest());
+	return f(n, a.exp), `${o}.${s}`;
+}, b = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n);
+	if (!h(r, e.slice(n + 1), t)) return null;
+	try {
+		let e = JSON.parse(v(r).toString("utf8"));
+		return typeof e.audience != "string" || !e.audience || typeof e.refId != "string" || typeof e.exp != "number" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, x = (e) => e.version !== 2 || typeof e.writeScope != "string" || !/^[a-f0-9]{64}$/.test(e.writeScope) || Object.hasOwn(e, "replicaId") || e.issuerReplicaId !== void 0 && (typeof e.issuerReplicaId != "string" || !e.issuerReplicaId.trim()) ? !1 : e.access === void 0 || e.vis === "private" && t.isSuccess(n.decodeUnknownExit(a, { onExcessProperty: "error" })(e.access)), S = (e, t, n = m()) => {
+	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`u:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, C = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`u:${r}`, i, t)) return null;
+	try {
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, w = (e, t, n = m()) => {
+	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`f:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, T = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`f:${r}`, i, t)) return null;
+	try {
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, E = (e, t, n = m()) => {
+	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`r:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, D = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`r:${r}`, i, t)) return null;
+	try {
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, O = (e, t, n = m()) => {
+	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`m:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, k = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`m:${r}`, i, t)) return null;
+	try {
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+};
+//#endregion
+export { p as declareStorageSigningLifetime, m as resolveStorageSecret, d as resolveStorageSecrets, w as signFinalizeTicket, y as signGrant, O as signMultipartTicket, E as signResumableTicket, S as signUploadTicket, T as verifyFinalizeTicket, b as verifyGrant, k as verifyMultipartTicket, D as verifyResumableTicket, C as verifyUploadTicket };