@webiny/api-file-manager-server 0.0.0-unstable.b6d7105cee → 6.6.0-alpha.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@webiny/api-file-manager-server",
-	"version": "0.0.0-unstable.b6d7105cee",
+	"version": "6.6.0-alpha.1",
 	"type": "module",
 	"exports": {
 		".": "./index.js",
@@ -14,25 +14,25 @@
 	"author": "Webiny Ltd",
 	"license": "MIT",
 	"dependencies": {
-		"@fastify/multipart": "10.1.0",
-		"@webiny/api": "0.0.0-unstable.b6d7105cee",
-		"@webiny/api-core": "0.0.0-unstable.b6d7105cee",
-		"@webiny/api-file-manager": "0.0.0-unstable.b6d7105cee",
-		"@webiny/background-tasks": "0.0.0-unstable.b6d7105cee",
-		"@webiny/feature": "0.0.0-unstable.b6d7105cee",
-		"@webiny/handler": "0.0.0-unstable.b6d7105cee",
-		"@webiny/plugins": "0.0.0-unstable.b6d7105cee",
-		"@webiny/utils": "0.0.0-unstable.b6d7105cee",
-		"@webiny/validation": "0.0.0-unstable.b6d7105cee",
-		"exifreader": "4.41.3",
-		"fastify": "5.10.0",
+		"@webiny/api-core": "6.6.0-alpha.1",
+		"@webiny/api-file-manager": "6.6.0-alpha.1",
+		"@webiny/api-graphql": "6.6.0-alpha.1",
+		"@webiny/background-tasks": "6.6.0-alpha.1",
+		"@webiny/event-handler-core": "6.6.0-alpha.1",
+		"@webiny/feature": "6.6.0-alpha.1",
+		"@webiny/handler": "6.6.0-alpha.1",
+		"@webiny/plugins": "6.6.0-alpha.1",
+		"@webiny/utils": "6.6.0-alpha.1",
+		"@webiny/validation": "6.6.0-alpha.1",
+		"exifreader": "4.43.0",
+		"p-map": "7.0.6",
 		"sharp": "0.35.3"
 	},
 	"devDependencies": {
-		"@webiny/build-tools": "0.0.0-unstable.b6d7105cee",
+		"@webiny/build-tools": "6.6.0-alpha.1",
 		"rimraf": "6.1.3",
 		"typescript": "7.0.2",
-		"vitest": "4.1.10"
+		"vitest": "4.1.11"
 	},
 	"publishConfig": {
 		"access": "public"

package/routes/UploadPartRoute/UploadPartRoute.d.ts

@@ -0,0 +1,23 @@
+import { HttpRouteDefinition, HttpRouteHandler } from "@webiny/event-handler-core";
+import { FileManagerServerConfig } from "../../features/FileManagerServerConfig/abstractions.js";
+declare class UploadPartRouteImpl implements HttpRouteHandler.Interface {
+    private readonly config;
+    constructor(config: FileManagerServerConfig.Interface);
+    handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response): Promise<import("@webiny/event-handler-core").IHttpResponseBuilder>;
+}
+export declare const UploadPartRoute: typeof UploadPartRouteImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+};
+declare class UploadPartRouteDefinitionImpl implements HttpRouteDefinition.Interface {
+    readonly name = "upload-part";
+    readonly method = "PUT";
+    readonly path = "/webiny-file-upload/parts";
+    readonly handler: typeof UploadPartRouteImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+    };
+}
+/** What the router matches on. Zero dependencies, so building it costs nothing. */
+export declare const UploadPartRouteDefinition: typeof UploadPartRouteDefinitionImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRouteDefinition>;
+};
+export {};

package/routes/UploadPartRoute/UploadPartRoute.js

@@ -0,0 +1,71 @@
+import node_path from "node:path";
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { HttpRouteDefinition, HttpRouteHandler } from "@webiny/event-handler-core";
+import { verifyUploadToken } from "../../utils/uploadToken.js";
+import { FileManagerServerConfig } from "../../features/FileManagerServerConfig/abstractions.js";
+import { isPathContained, toBuffer } from "../utils.js";
+class UploadPartRouteImpl {
+    constructor(config){
+        this.config = config;
+    }
+    async handle(request, response) {
+        const storagePath = this.config.storagePath;
+        const secret = this.config.uploadSecret;
+        const query = request.query ?? {};
+        const uploadId = query["uploadId"];
+        const partNumberStr = query["partNumber"];
+        const token = query["token"];
+        if (!uploadId || !partNumberStr || !token) return response.status(400).json({
+            error: "Missing uploadId, partNumber, or token."
+        });
+        const partNumber = parseInt(partNumberStr, 10);
+        if (isNaN(partNumber) || partNumber < 1) return response.status(400).json({
+            error: "Invalid partNumber."
+        });
+        let payload;
+        try {
+            payload = verifyUploadToken(token, secret);
+        } catch (err) {
+            return response.status(400).json({
+                error: err instanceof Error ? err.message : "Invalid token."
+            });
+        }
+        const expectedKey = `tenants/${payload.tenantId}/multipart/${uploadId}/part-${partNumber}`;
+        if (payload.key !== expectedKey) return response.status(400).json({
+            error: "Token key mismatch."
+        });
+        const destPath = node_path.join(storagePath, expectedKey);
+        if (!isPathContained(destPath, storagePath)) return response.status(400).json({
+            error: "Invalid path."
+        });
+        await mkdir(node_path.dirname(destPath), {
+            recursive: true
+        });
+        const body = toBuffer(request.body);
+        await writeFile(destPath, body);
+        const etag = createHash("md5").update(body).digest("hex");
+        return response.header("etag", etag);
+    }
+}
+const UploadPartRoute = HttpRouteHandler.createImplementation({
+    implementation: UploadPartRouteImpl,
+    dependencies: [
+        FileManagerServerConfig
+    ]
+});
+class UploadPartRouteDefinitionImpl {
+    constructor(){
+        this.name = "upload-part";
+        this.method = "PUT";
+        this.path = "/webiny-file-upload/parts";
+        this.handler = UploadPartRoute;
+    }
+}
+const UploadPartRouteDefinition = HttpRouteDefinition.createImplementation({
+    implementation: UploadPartRouteDefinitionImpl,
+    dependencies: []
+});
+export { UploadPartRoute, UploadPartRouteDefinition };
+
+//# sourceMappingURL=UploadPartRoute.js.map

package/routes/UploadPartRoute/UploadPartRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes/UploadPartRoute/UploadPartRoute.js","sources":["../../../src/routes/UploadPartRoute/UploadPartRoute.ts"],"sourcesContent":["import path from \"node:path\";\nimport { createHash } from \"node:crypto\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { HttpRouteDefinition, HttpRouteHandler } from \"@webiny/event-handler-core\";\nimport { verifyUploadToken } from \"~/utils/uploadToken.js\";\nimport { FileManagerServerConfig } from \"~/features/FileManagerServerConfig/abstractions.js\";\nimport { isPathContained, toBuffer } from \"../utils.js\";\n\nclass UploadPartRouteImpl implements HttpRouteHandler.Interface {\n    public constructor(private readonly config: FileManagerServerConfig.Interface) {}\n\n    public async handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response) {\n        const storagePath = this.config.storagePath;\n        const secret = this.config.uploadSecret;\n\n        const query = request.query ?? {};\n        const uploadId = query[\"uploadId\"];\n        const partNumberStr = query[\"partNumber\"];\n        const token = query[\"token\"];\n\n        if (!uploadId || !partNumberStr || !token) {\n            return response.status(400).json({ error: \"Missing uploadId, partNumber, or token.\" });\n        }\n\n        const partNumber = parseInt(partNumberStr, 10);\n        if (isNaN(partNumber) || partNumber < 1) {\n            return response.status(400).json({ error: \"Invalid partNumber.\" });\n        }\n\n        let payload;\n        try {\n            payload = verifyUploadToken(token, secret);\n        } catch (err) {\n            return response\n                .status(400)\n                .json({ error: err instanceof Error ? err.message : \"Invalid token.\" });\n        }\n\n        const expectedKey = `tenants/${payload.tenantId}/multipart/${uploadId}/part-${partNumber}`;\n        if (payload.key !== expectedKey) {\n            return response.status(400).json({ error: \"Token key mismatch.\" });\n        }\n\n        const destPath = path.join(storagePath, expectedKey);\n        if (!isPathContained(destPath, storagePath)) {\n            return response.status(400).json({ error: \"Invalid path.\" });\n        }\n\n        await mkdir(path.dirname(destPath), { recursive: true });\n\n        const body = toBuffer(request.body);\n        await writeFile(destPath, body);\n\n        const etag = createHash(\"md5\").update(body).digest(\"hex\");\n\n        return response.header(\"etag\", etag);\n    }\n}\n\nexport const UploadPartRoute = HttpRouteHandler.createImplementation({\n    implementation: UploadPartRouteImpl,\n    dependencies: [FileManagerServerConfig]\n});\n\nclass UploadPartRouteDefinitionImpl implements HttpRouteDefinition.Interface {\n    readonly name = \"upload-part\";\n    readonly method = \"PUT\";\n    readonly path = \"/webiny-file-upload/parts\";\n    readonly handler = UploadPartRoute;\n}\n\n/** What the router matches on. Zero dependencies, so building it costs nothing. */\nexport const UploadPartRouteDefinition = HttpRouteDefinition.createImplementation({\n    implementation: UploadPartRouteDefinitionImpl,\n    dependencies: []\n});\n"],"names":["UploadPartRouteImpl","config","request","response","storagePath","secret","query","uploadId","partNumberStr","token","partNumber","parseInt","isNaN","payload","verifyUploadToken","err","Error","expectedKey","destPath","path","isPathContained","mkdir","body","toBuffer","writeFile","etag","createHash","UploadPartRoute","HttpRouteHandler","FileManagerServerConfig","UploadPartRouteDefinitionImpl","UploadPartRouteDefinition","HttpRouteDefinition"],"mappings":";;;;;;;AAQA,MAAMA;IACF,YAAoCC,MAAyC,CAAE;aAA3CA,MAAM,GAANA;IAA4C;IAEhF,MAAa,OAAOC,OAAiC,EAAEC,QAAmC,EAAE;QACxF,MAAMC,cAAc,IAAI,CAAC,MAAM,CAAC,WAAW;QAC3C,MAAMC,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY;QAEvC,MAAMC,QAAQJ,QAAQ,KAAK,IAAI,CAAC;QAChC,MAAMK,WAAWD,KAAK,CAAC,WAAW;QAClC,MAAME,gBAAgBF,KAAK,CAAC,aAAa;QACzC,MAAMG,QAAQH,KAAK,CAAC,QAAQ;QAE5B,IAAI,CAACC,YAAY,CAACC,iBAAiB,CAACC,OAChC,OAAON,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAA0C;QAGxF,MAAMO,aAAaC,SAASH,eAAe;QAC3C,IAAII,MAAMF,eAAeA,aAAa,GAClC,OAAOP,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAGpE,IAAIU;QACJ,IAAI;YACAA,UAAUC,kBAAkBL,OAAOJ;QACvC,EAAE,OAAOU,KAAK;YACV,OAAOZ,SACF,MAAM,CAAC,KACP,IAAI,CAAC;gBAAE,OAAOY,eAAeC,QAAQD,IAAI,OAAO,GAAG;YAAiB;QAC7E;QAEA,MAAME,cAAc,CAAC,QAAQ,EAAEJ,QAAQ,QAAQ,CAAC,WAAW,EAAEN,SAAS,MAAM,EAAEG,YAAY;QAC1F,IAAIG,QAAQ,GAAG,KAAKI,aAChB,OAAOd,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAGpE,MAAMe,WAAWC,UAAAA,IAAS,CAACf,aAAaa;QACxC,IAAI,CAACG,gBAAgBF,UAAUd,cAC3B,OAAOD,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAgB;QAG9D,MAAMkB,MAAMF,UAAAA,OAAY,CAACD,WAAW;YAAE,WAAW;QAAK;QAEtD,MAAMI,OAAOC,SAASrB,QAAQ,IAAI;QAClC,MAAMsB,UAAUN,UAAUI;QAE1B,MAAMG,OAAOC,WAAW,OAAO,MAAM,CAACJ,MAAM,MAAM,CAAC;QAEnD,OAAOnB,SAAS,MAAM,CAAC,QAAQsB;IACnC;AACJ;AAEO,MAAME,kBAAkBC,iBAAiB,oBAAoB,CAAC;IACjE,gBAAgB5B;IAChB,cAAc;QAAC6B;KAAwB;AAC3C;AAEA,MAAMC;;aACO,IAAI,GAAG;aACP,MAAM,GAAG;aACT,IAAI,GAAG;aACP,OAAO,GAAGH;;AACvB;AAGO,MAAMI,4BAA4BC,oBAAoB,oBAAoB,CAAC;IAC9E,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/routes/UploadPartRoute/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const UploadPartRouteFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/routes/UploadPartRoute/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { UploadPartRouteDefinition } from "./UploadPartRoute.js";
+const UploadPartRouteFeature = createFeature({
+    name: "FileManagerServer/UploadPartRoute",
+    register (container) {
+        container.register(UploadPartRouteDefinition);
+    }
+});
+export { UploadPartRouteFeature };
+
+//# sourceMappingURL=feature.js.map

package/routes/UploadPartRoute/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes/UploadPartRoute/feature.js","sources":["../../../src/routes/UploadPartRoute/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { UploadPartRouteDefinition } from \"./UploadPartRoute.js\";\n\nexport const UploadPartRouteFeature = createFeature({\n    name: \"FileManagerServer/UploadPartRoute\",\n    register(container) {\n        container.register(UploadPartRouteDefinition);\n    }\n});\n"],"names":["UploadPartRouteFeature","createFeature","container","UploadPartRouteDefinition"],"mappings":";;AAGO,MAAMA,yBAAyBC,cAAc;IAChD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}

package/routes/UploadSingleFileRoute/UploadSingleFileRoute.d.ts

@@ -0,0 +1,23 @@
+import { HttpRouteDefinition, HttpRouteHandler } from "@webiny/event-handler-core";
+import { FileManagerServerConfig } from "../../features/FileManagerServerConfig/abstractions.js";
+declare class UploadSingleFileRouteImpl implements HttpRouteHandler.Interface {
+    private readonly config;
+    constructor(config: FileManagerServerConfig.Interface);
+    handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response): Promise<import("@webiny/event-handler-core").IHttpResponseBuilder>;
+}
+export declare const UploadSingleFileRoute: typeof UploadSingleFileRouteImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+};
+declare class UploadSingleFileRouteDefinitionImpl implements HttpRouteDefinition.Interface {
+    readonly name = "upload-single-file";
+    readonly method = "POST";
+    readonly path = "/webiny-file-upload";
+    readonly handler: typeof UploadSingleFileRouteImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+    };
+}
+/** What the router matches on. Zero dependencies, so building it costs nothing. */
+export declare const UploadSingleFileRouteDefinition: typeof UploadSingleFileRouteDefinitionImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRouteDefinition>;
+};
+export {};

package/routes/UploadSingleFileRoute/UploadSingleFileRoute.js

@@ -0,0 +1,78 @@
+import node_path from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+import { HttpRouteDefinition, HttpRouteHandler } from "@webiny/event-handler-core";
+import { verifyUploadToken } from "../../utils/uploadToken.js";
+import { FileManagerServerConfig } from "../../features/FileManagerServerConfig/abstractions.js";
+import { getBoundary, isPathContained, parseMultipart, toBuffer } from "../utils.js";
+class UploadSingleFileRouteImpl {
+    constructor(config){
+        this.config = config;
+    }
+    async handle(request, response) {
+        const storagePath = this.config.storagePath;
+        const secret = this.config.uploadSecret;
+        const contentType = request.headers["content-type"] ?? request.headers["Content-Type"] ?? "";
+        const boundary = getBoundary(contentType);
+        if (!boundary) return response.status(400).json({
+            error: "Expected multipart/form-data with a boundary."
+        });
+        const { fields, files } = parseMultipart(toBuffer(request.body), boundary);
+        const key = fields.find((field)=>"key" === field.name)?.value;
+        const token = fields.find((field)=>"token" === field.name)?.value;
+        const file = files[0];
+        if (!key || !token) return response.status(400).json({
+            error: "Missing key or token."
+        });
+        if (!file) return response.status(400).json({
+            error: "No file in request."
+        });
+        let payload;
+        try {
+            payload = verifyUploadToken(token, secret);
+        } catch (err) {
+            return response.status(400).json({
+                error: err instanceof Error ? err.message : "Invalid token."
+            });
+        }
+        if (payload.key !== key) return response.status(400).json({
+            error: "Token key mismatch."
+        });
+        const fileSize = file.data.length;
+        if (payload.uploadMaxFileSize > 0 && fileSize > payload.uploadMaxFileSize) return response.status(400).json({
+            error: "File exceeds maximum allowed size."
+        });
+        if (payload.uploadMinFileSize > 0 && fileSize < payload.uploadMinFileSize) return response.status(400).json({
+            error: "File is below minimum allowed size."
+        });
+        const destPath = node_path.join(storagePath, key);
+        if (!isPathContained(destPath, storagePath)) return response.status(400).json({
+            error: "Invalid path."
+        });
+        await mkdir(node_path.dirname(destPath), {
+            recursive: true
+        });
+        await writeFile(destPath, file.data);
+        return response.status(204);
+    }
+}
+const UploadSingleFileRoute = HttpRouteHandler.createImplementation({
+    implementation: UploadSingleFileRouteImpl,
+    dependencies: [
+        FileManagerServerConfig
+    ]
+});
+class UploadSingleFileRouteDefinitionImpl {
+    constructor(){
+        this.name = "upload-single-file";
+        this.method = "POST";
+        this.path = "/webiny-file-upload";
+        this.handler = UploadSingleFileRoute;
+    }
+}
+const UploadSingleFileRouteDefinition = HttpRouteDefinition.createImplementation({
+    implementation: UploadSingleFileRouteDefinitionImpl,
+    dependencies: []
+});
+export { UploadSingleFileRoute, UploadSingleFileRouteDefinition };
+
+//# sourceMappingURL=UploadSingleFileRoute.js.map

package/routes/UploadSingleFileRoute/UploadSingleFileRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes/UploadSingleFileRoute/UploadSingleFileRoute.js","sources":["../../../src/routes/UploadSingleFileRoute/UploadSingleFileRoute.ts"],"sourcesContent":["import path from \"node:path\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { HttpRouteDefinition, HttpRouteHandler } from \"@webiny/event-handler-core\";\nimport { verifyUploadToken } from \"~/utils/uploadToken.js\";\nimport { FileManagerServerConfig } from \"~/features/FileManagerServerConfig/abstractions.js\";\nimport { isPathContained, toBuffer, parseMultipart, getBoundary } from \"../utils.js\";\n\nclass UploadSingleFileRouteImpl implements HttpRouteHandler.Interface {\n    public constructor(private readonly config: FileManagerServerConfig.Interface) {}\n\n    public async handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response) {\n        const storagePath = this.config.storagePath;\n        const secret = this.config.uploadSecret;\n\n        const contentType =\n            request.headers[\"content-type\"] ?? request.headers[\"Content-Type\"] ?? \"\";\n        const boundary = getBoundary(contentType);\n        if (!boundary) {\n            return response\n                .status(400)\n                .json({ error: \"Expected multipart/form-data with a boundary.\" });\n        }\n\n        const { fields, files } = parseMultipart(toBuffer(request.body), boundary);\n        const key = fields.find(field => field.name === \"key\")?.value;\n        const token = fields.find(field => field.name === \"token\")?.value;\n        const file = files[0];\n\n        if (!key || !token) {\n            return response.status(400).json({ error: \"Missing key or token.\" });\n        }\n\n        if (!file) {\n            return response.status(400).json({ error: \"No file in request.\" });\n        }\n\n        let payload;\n        try {\n            payload = verifyUploadToken(token, secret);\n        } catch (err) {\n            return response\n                .status(400)\n                .json({ error: err instanceof Error ? err.message : \"Invalid token.\" });\n        }\n\n        if (payload.key !== key) {\n            return response.status(400).json({ error: \"Token key mismatch.\" });\n        }\n\n        const fileSize = file.data.length;\n        if (payload.uploadMaxFileSize > 0 && fileSize > payload.uploadMaxFileSize) {\n            return response.status(400).json({ error: \"File exceeds maximum allowed size.\" });\n        }\n\n        if (payload.uploadMinFileSize > 0 && fileSize < payload.uploadMinFileSize) {\n            return response.status(400).json({ error: \"File is below minimum allowed size.\" });\n        }\n\n        const destPath = path.join(storagePath, key);\n        if (!isPathContained(destPath, storagePath)) {\n            return response.status(400).json({ error: \"Invalid path.\" });\n        }\n\n        await mkdir(path.dirname(destPath), { recursive: true });\n        await writeFile(destPath, file.data);\n\n        return response.status(204);\n    }\n}\n\nexport const UploadSingleFileRoute = HttpRouteHandler.createImplementation({\n    implementation: UploadSingleFileRouteImpl,\n    dependencies: [FileManagerServerConfig]\n});\n\nclass UploadSingleFileRouteDefinitionImpl implements HttpRouteDefinition.Interface {\n    readonly name = \"upload-single-file\";\n    readonly method = \"POST\";\n    readonly path = \"/webiny-file-upload\";\n    readonly handler = UploadSingleFileRoute;\n}\n\n/** What the router matches on. Zero dependencies, so building it costs nothing. */\nexport const UploadSingleFileRouteDefinition = HttpRouteDefinition.createImplementation({\n    implementation: UploadSingleFileRouteDefinitionImpl,\n    dependencies: []\n});\n"],"names":["UploadSingleFileRouteImpl","config","request","response","storagePath","secret","contentType","boundary","getBoundary","fields","files","parseMultipart","toBuffer","key","field","token","file","payload","verifyUploadToken","err","Error","fileSize","destPath","path","isPathContained","mkdir","writeFile","UploadSingleFileRoute","HttpRouteHandler","FileManagerServerConfig","UploadSingleFileRouteDefinitionImpl","UploadSingleFileRouteDefinition","HttpRouteDefinition"],"mappings":";;;;;;AAOA,MAAMA;IACF,YAAoCC,MAAyC,CAAE;aAA3CA,MAAM,GAANA;IAA4C;IAEhF,MAAa,OAAOC,OAAiC,EAAEC,QAAmC,EAAE;QACxF,MAAMC,cAAc,IAAI,CAAC,MAAM,CAAC,WAAW;QAC3C,MAAMC,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY;QAEvC,MAAMC,cACFJ,QAAQ,OAAO,CAAC,eAAe,IAAIA,QAAQ,OAAO,CAAC,eAAe,IAAI;QAC1E,MAAMK,WAAWC,YAAYF;QAC7B,IAAI,CAACC,UACD,OAAOJ,SACF,MAAM,CAAC,KACP,IAAI,CAAC;YAAE,OAAO;QAAgD;QAGvE,MAAM,EAAEM,MAAM,EAAEC,KAAK,EAAE,GAAGC,eAAeC,SAASV,QAAQ,IAAI,GAAGK;QACjE,MAAMM,MAAMJ,OAAO,IAAI,CAACK,CAAAA,QAASA,AAAe,UAAfA,MAAM,IAAI,GAAa;QACxD,MAAMC,QAAQN,OAAO,IAAI,CAACK,CAAAA,QAASA,AAAe,YAAfA,MAAM,IAAI,GAAe;QAC5D,MAAME,OAAON,KAAK,CAAC,EAAE;QAErB,IAAI,CAACG,OAAO,CAACE,OACT,OAAOZ,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAwB;QAGtE,IAAI,CAACa,MACD,OAAOb,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAGpE,IAAIc;QACJ,IAAI;YACAA,UAAUC,kBAAkBH,OAAOV;QACvC,EAAE,OAAOc,KAAK;YACV,OAAOhB,SACF,MAAM,CAAC,KACP,IAAI,CAAC;gBAAE,OAAOgB,eAAeC,QAAQD,IAAI,OAAO,GAAG;YAAiB;QAC7E;QAEA,IAAIF,QAAQ,GAAG,KAAKJ,KAChB,OAAOV,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAGpE,MAAMkB,WAAWL,KAAK,IAAI,CAAC,MAAM;QACjC,IAAIC,QAAQ,iBAAiB,GAAG,KAAKI,WAAWJ,QAAQ,iBAAiB,EACrE,OAAOd,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAqC;QAGnF,IAAIc,QAAQ,iBAAiB,GAAG,KAAKI,WAAWJ,QAAQ,iBAAiB,EACrE,OAAOd,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsC;QAGpF,MAAMmB,WAAWC,UAAAA,IAAS,CAACnB,aAAaS;QACxC,IAAI,CAACW,gBAAgBF,UAAUlB,cAC3B,OAAOD,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAgB;QAG9D,MAAMsB,MAAMF,UAAAA,OAAY,CAACD,WAAW;YAAE,WAAW;QAAK;QACtD,MAAMI,UAAUJ,UAAUN,KAAK,IAAI;QAEnC,OAAOb,SAAS,MAAM,CAAC;IAC3B;AACJ;AAEO,MAAMwB,wBAAwBC,iBAAiB,oBAAoB,CAAC;IACvE,gBAAgB5B;IAChB,cAAc;QAAC6B;KAAwB;AAC3C;AAEA,MAAMC;;aACO,IAAI,GAAG;aACP,MAAM,GAAG;aACT,IAAI,GAAG;aACP,OAAO,GAAGH;;AACvB;AAGO,MAAMI,kCAAkCC,oBAAoB,oBAAoB,CAAC;IACpF,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/routes/UploadSingleFileRoute/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const UploadSingleFileRouteFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/routes/UploadSingleFileRoute/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { UploadSingleFileRouteDefinition } from "./UploadSingleFileRoute.js";
+const UploadSingleFileRouteFeature = createFeature({
+    name: "FileManagerServer/UploadSingleFileRoute",
+    register (container) {
+        container.register(UploadSingleFileRouteDefinition);
+    }
+});
+export { UploadSingleFileRouteFeature };
+
+//# sourceMappingURL=feature.js.map

package/routes/UploadSingleFileRoute/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes/UploadSingleFileRoute/feature.js","sources":["../../../src/routes/UploadSingleFileRoute/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { UploadSingleFileRouteDefinition } from \"./UploadSingleFileRoute.js\";\n\nexport const UploadSingleFileRouteFeature = createFeature({\n    name: \"FileManagerServer/UploadSingleFileRoute\",\n    register(container) {\n        container.register(UploadSingleFileRouteDefinition);\n    }\n});\n"],"names":["UploadSingleFileRouteFeature","createFeature","container","UploadSingleFileRouteDefinition"],"mappings":";;AAGO,MAAMA,+BAA+BC,cAAc;IACtD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}

package/routes/utils.d.ts

@@ -0,0 +1,18 @@
+export declare const isPathContained: (filePath: string, storagePath: string) => boolean;
+export declare const toBuffer: (body: unknown) => Buffer;
+interface MultipartField {
+    name: string;
+    value: string;
+}
+interface MultipartFile {
+    name: string;
+    filename: string;
+    data: Buffer;
+}
+export interface MultipartResult {
+    fields: MultipartField[];
+    files: MultipartFile[];
+}
+export declare const parseMultipart: (buffer: Buffer, boundary: string) => MultipartResult;
+export declare const getBoundary: (contentType: string) => string | undefined;
+export {};

package/routes/utils.js

@@ -0,0 +1,55 @@
+import node_path from "node:path";
+const isPathContained = (filePath, storagePath)=>{
+    const resolved = node_path.resolve(filePath);
+    const root = node_path.resolve(storagePath);
+    return resolved === root || resolved.startsWith(root + node_path.sep);
+};
+const toBuffer = (body)=>{
+    if (Buffer.isBuffer(body)) return body;
+    if (body instanceof Uint8Array) return Buffer.from(body);
+    if ("string" == typeof body) return Buffer.from(body, "base64");
+    return Buffer.alloc(0);
+};
+const parseMultipart = (buffer, boundary)=>{
+    const fields = [];
+    const files = [];
+    const separator = Buffer.from(`--${boundary}`);
+    let idx = buffer.indexOf(separator);
+    while(-1 !== idx){
+        const next = buffer.indexOf(separator, idx + separator.length);
+        if (-1 === next) break;
+        let part = buffer.subarray(idx + separator.length, next);
+        if ("\r\n" === part.subarray(0, 2).toString("latin1")) part = part.subarray(2);
+        if ("\r\n" === part.subarray(-2).toString("latin1")) part = part.subarray(0, -2);
+        const headerEnd = part.indexOf("\r\n\r\n");
+        if (-1 !== headerEnd) {
+            const rawHeaders = part.subarray(0, headerEnd).toString("utf8");
+            const content = part.subarray(headerEnd + 4);
+            const disposition = /content-disposition:[^\r\n]*/i.exec(rawHeaders)?.[0] ?? "";
+            const name = /name="([^"]*)"/i.exec(disposition)?.[1];
+            const filename = /filename="([^"]*)"/i.exec(disposition)?.[1];
+            if (void 0 !== name) if (void 0 !== filename) files.push({
+                name,
+                filename,
+                data: content
+            });
+            else fields.push({
+                name,
+                value: content.toString("utf8")
+            });
+        }
+        idx = next;
+    }
+    return {
+        fields,
+        files
+    };
+};
+const getBoundary = (contentType)=>{
+    const match = /boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType);
+    const value = match?.[1] ?? match?.[2];
+    return value?.trim();
+};
+export { getBoundary, isPathContained, parseMultipart, toBuffer };
+
+//# sourceMappingURL=utils.js.map

package/routes/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes/utils.js","sources":["../../src/routes/utils.ts"],"sourcesContent":["import path from \"node:path\";\n\nexport const isPathContained = (filePath: string, storagePath: string): boolean => {\n    const resolved = path.resolve(filePath);\n    const root = path.resolve(storagePath);\n    return resolved === root || resolved.startsWith(root + path.sep);\n};\n\n/* Normalise a transport request body into a Buffer. */\nexport const toBuffer = (body: unknown): Buffer => {\n    if (Buffer.isBuffer(body)) {\n        return body;\n    }\n    if (body instanceof Uint8Array) {\n        return Buffer.from(body);\n    }\n    if (typeof body === \"string\") {\n        return Buffer.from(body, \"base64\");\n    }\n    return Buffer.alloc(0);\n};\n\ninterface MultipartField {\n    name: string;\n    value: string;\n}\n\ninterface MultipartFile {\n    name: string;\n    filename: string;\n    data: Buffer;\n}\n\nexport interface MultipartResult {\n    fields: MultipartField[];\n    files: MultipartFile[];\n}\n\n/* Minimal multipart/form-data parser operating on the raw body buffer. */\nexport const parseMultipart = (buffer: Buffer, boundary: string): MultipartResult => {\n    const fields: MultipartField[] = [];\n    const files: MultipartFile[] = [];\n    const separator = Buffer.from(`--${boundary}`);\n\n    let idx = buffer.indexOf(separator);\n    while (idx !== -1) {\n        const next = buffer.indexOf(separator, idx + separator.length);\n        if (next === -1) {\n            break;\n        }\n\n        let part = buffer.subarray(idx + separator.length, next);\n        if (part.subarray(0, 2).toString(\"latin1\") === \"\\r\\n\") {\n            part = part.subarray(2);\n        }\n        if (part.subarray(-2).toString(\"latin1\") === \"\\r\\n\") {\n            part = part.subarray(0, -2);\n        }\n\n        const headerEnd = part.indexOf(\"\\r\\n\\r\\n\");\n        if (headerEnd !== -1) {\n            const rawHeaders = part.subarray(0, headerEnd).toString(\"utf8\");\n            const content = part.subarray(headerEnd + 4);\n\n            const disposition = /content-disposition:[^\\r\\n]*/i.exec(rawHeaders)?.[0] ?? \"\";\n            const name = /name=\"([^\"]*)\"/i.exec(disposition)?.[1];\n            const filename = /filename=\"([^\"]*)\"/i.exec(disposition)?.[1];\n\n            if (name !== undefined) {\n                if (filename !== undefined) {\n                    files.push({ name, filename, data: content });\n                } else {\n                    fields.push({ name, value: content.toString(\"utf8\") });\n                }\n            }\n        }\n\n        idx = next;\n    }\n\n    return { fields, files };\n};\n\nexport const getBoundary = (contentType: string): string | undefined => {\n    const match = /boundary=(?:\"([^\"]+)\"|([^;]+))/i.exec(contentType);\n    const value = match?.[1] ?? match?.[2];\n    return value?.trim();\n};\n"],"names":["isPathContained","filePath","storagePath","resolved","path","root","toBuffer","body","Buffer","Uint8Array","parseMultipart","buffer","boundary","fields","files","separator","idx","next","part","headerEnd","rawHeaders","content","disposition","name","filename","undefined","getBoundary","contentType","match","value"],"mappings":";AAEO,MAAMA,kBAAkB,CAACC,UAAkBC;IAC9C,MAAMC,WAAWC,UAAAA,OAAY,CAACH;IAC9B,MAAMI,OAAOD,UAAAA,OAAY,CAACF;IAC1B,OAAOC,aAAaE,QAAQF,SAAS,UAAU,CAACE,OAAOD,UAAAA,GAAQ;AACnE;AAGO,MAAME,WAAW,CAACC;IACrB,IAAIC,OAAO,QAAQ,CAACD,OAChB,OAAOA;IAEX,IAAIA,gBAAgBE,YAChB,OAAOD,OAAO,IAAI,CAACD;IAEvB,IAAI,AAAgB,YAAhB,OAAOA,MACP,OAAOC,OAAO,IAAI,CAACD,MAAM;IAE7B,OAAOC,OAAO,KAAK,CAAC;AACxB;AAmBO,MAAME,iBAAiB,CAACC,QAAgBC;IAC3C,MAAMC,SAA2B,EAAE;IACnC,MAAMC,QAAyB,EAAE;IACjC,MAAMC,YAAYP,OAAO,IAAI,CAAC,CAAC,EAAE,EAAEI,UAAU;IAE7C,IAAII,MAAML,OAAO,OAAO,CAACI;IACzB,MAAOC,AAAQ,OAARA,IAAY;QACf,MAAMC,OAAON,OAAO,OAAO,CAACI,WAAWC,MAAMD,UAAU,MAAM;QAC7D,IAAIE,AAAS,OAATA,MACA;QAGJ,IAAIC,OAAOP,OAAO,QAAQ,CAACK,MAAMD,UAAU,MAAM,EAAEE;QACnD,IAAIC,AAA2C,WAA3CA,KAAK,QAAQ,CAAC,GAAG,GAAG,QAAQ,CAAC,WAC7BA,OAAOA,KAAK,QAAQ,CAAC;QAEzB,IAAIA,AAAyC,WAAzCA,KAAK,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAC3BA,OAAOA,KAAK,QAAQ,CAAC,GAAG;QAG5B,MAAMC,YAAYD,KAAK,OAAO,CAAC;QAC/B,IAAIC,AAAc,OAAdA,WAAkB;YAClB,MAAMC,aAAaF,KAAK,QAAQ,CAAC,GAAGC,WAAW,QAAQ,CAAC;YACxD,MAAME,UAAUH,KAAK,QAAQ,CAACC,YAAY;YAE1C,MAAMG,cAAc,gCAAgC,IAAI,CAACF,aAAa,CAAC,EAAE,IAAI;YAC7E,MAAMG,OAAO,kBAAkB,IAAI,CAACD,cAAc,CAAC,EAAE;YACrD,MAAME,WAAW,sBAAsB,IAAI,CAACF,cAAc,CAAC,EAAE;YAE7D,IAAIC,AAASE,WAATF,MACA,IAAIC,AAAaC,WAAbD,UACAV,MAAM,IAAI,CAAC;gBAAES;gBAAMC;gBAAU,MAAMH;YAAQ;iBAE3CR,OAAO,IAAI,CAAC;gBAAEU;gBAAM,OAAOF,QAAQ,QAAQ,CAAC;YAAQ;QAGhE;QAEAL,MAAMC;IACV;IAEA,OAAO;QAAEJ;QAAQC;IAAM;AAC3B;AAEO,MAAMY,cAAc,CAACC;IACxB,MAAMC,QAAQ,kCAAkC,IAAI,CAACD;IACrD,MAAME,QAAQD,OAAO,CAAC,EAAE,IAAIA,OAAO,CAAC,EAAE;IACtC,OAAOC,OAAO;AAClB"}

package/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sources":["../src/index.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { mkdirSync } from \"node:fs\";\nimport { ContextPlugin } from \"@webiny/api\";\nimport { uploadRoutesPlugin } from \"~/routes/uploadRoutes.js\";\nimport { modifyFastifyPlugin } from \"~/routes/uploadRoutes.js\";\nimport { CleanupStaleMultipartUploadsFeature } from \"~/features/CleanupStaleMultipartUploads/feature.js\";\nimport { DeleteFileFromDiskFeature } from \"~/features/DeleteFileFromDisk/feature.js\";\nimport { ExtractMetadataFeature } from \"~/features/ExtractMetadata/feature.js\";\nimport { FlushCacheFeature } from \"~/features/FlushCache/feature.js\";\nimport { GetFileContentsByIdFeature } from \"~/features/GetFileContentsById/feature.js\";\nimport { GetFileContentsByKeyFeature } from \"~/features/GetFileContentsByKey/feature.js\";\nimport { GetUploadPayloadFeature } from \"~/features/GetUploadPayload/feature.js\";\nimport { CreateMultiPartUploadFeature } from \"~/features/CreateMultiPartUpload/feature.js\";\nimport { CompleteMultiPartUploadFeature } from \"~/features/CompleteMultiPartUpload/feature.js\";\nexport { createFileUploadModifier } from \"@webiny/api-file-manager/features/upload/index.js\";\nexport { createAssetDelivery } from \"./assetDelivery/createAssetDelivery.js\";\n\nconst contextPlugin = new ContextPlugin(context => {\n    const storagePath = process.env[\"WEBINY_LOCAL_STORAGE_PATH\"];\n    if (!storagePath) {\n        throw new Error(\n            `\"WEBINY_LOCAL_STORAGE_PATH\" environment variable is not defined. Please set it to a valid local path.`\n        );\n    }\n\n    const uploadSecret = process.env[\"WEBINY_UPLOAD_SECRET\"];\n    if (!uploadSecret) {\n        throw new Error(\n            `\"WEBINY_UPLOAD_SECRET\" environment variable is not defined. Please set it to a secret string used to sign upload tokens.`\n        );\n    }\n\n    if (!existsSync(storagePath)) {\n        mkdirSync(storagePath, { recursive: true });\n    }\n\n    const container = context.container;\n\n    FlushCacheFeature.register(container);\n    DeleteFileFromDiskFeature.register(container);\n    ExtractMetadataFeature.register(container);\n    GetFileContentsByIdFeature.register(container);\n    GetFileContentsByKeyFeature.register(container);\n    GetUploadPayloadFeature.register(container);\n    CreateMultiPartUploadFeature.register(container);\n    CompleteMultiPartUploadFeature.register(container);\n    CleanupStaleMultipartUploadsFeature.register(container);\n});\n\ncontextPlugin.name = `fileManagerServer.context`;\n\nexport const createFileManagerServer = () => [\n    contextPlugin,\n    uploadRoutesPlugin,\n    modifyFastifyPlugin\n];\n"],"names":["contextPlugin","ContextPlugin","context","storagePath","process","Error","uploadSecret","existsSync","mkdirSync","container","FlushCacheFeature","DeleteFileFromDiskFeature","ExtractMetadataFeature","GetFileContentsByIdFeature","GetFileContentsByKeyFeature","GetUploadPayloadFeature","CreateMultiPartUploadFeature","CompleteMultiPartUploadFeature","CleanupStaleMultipartUploadsFeature","createFileManagerServer","uploadRoutesPlugin","modifyFastifyPlugin"],"mappings":";;;;;;;;;;;;AAiBA,MAAMA,gBAAgB,IAAIC,cAAcC,CAAAA;IACpC,MAAMC,cAAcC,QAAQ,GAAG,CAAC,4BAA4B;IAC5D,IAAI,CAACD,aACD,MAAM,IAAIE,MACN;IAIR,MAAMC,eAAeF,QAAQ,GAAG,CAAC,uBAAuB;IACxD,IAAI,CAACE,cACD,MAAM,IAAID,MACN;IAIR,IAAI,CAACE,WAAWJ,cACZK,UAAUL,aAAa;QAAE,WAAW;IAAK;IAG7C,MAAMM,YAAYP,QAAQ,SAAS;IAEnCQ,kBAAkB,QAAQ,CAACD;IAC3BE,0BAA0B,QAAQ,CAACF;IACnCG,uBAAuB,QAAQ,CAACH;IAChCI,2BAA2B,QAAQ,CAACJ;IACpCK,4BAA4B,QAAQ,CAACL;IACrCM,wBAAwB,QAAQ,CAACN;IACjCO,6BAA6B,QAAQ,CAACP;IACtCQ,+BAA+B,QAAQ,CAACR;IACxCS,oCAAoC,QAAQ,CAACT;AACjD;AAEAT,cAAc,IAAI,GAAG;AAEd,MAAMmB,0BAA0B,IAAM;QACzCnB;QACAoB;QACAC;KACH"}

package/routes/uploadRoutes.d.ts

@@ -1,4 +0,0 @@
-import { RoutePlugin } from "@webiny/handler/plugins/RoutePlugin.js";
-import { ModifyFastifyPlugin } from "@webiny/handler/plugins/ModifyFastifyPlugin.js";
-export declare const modifyFastifyPlugin: ModifyFastifyPlugin;
-export declare const uploadRoutesPlugin: RoutePlugin<import("@webiny/handler/types").Context>;

package/routes/uploadRoutes.js

@@ -1,130 +0,0 @@
-import node_path from "node:path";
-import { Readable } from "node:stream";
-import { createHash } from "node:crypto";
-import { mkdir, writeFile } from "node:fs/promises";
-import { createWriteStream } from "node:fs";
-import { pipeline } from "node:stream/promises";
-import { RoutePlugin } from "@webiny/handler/plugins/RoutePlugin.js";
-import { ModifyFastifyPlugin } from "@webiny/handler/plugins/ModifyFastifyPlugin.js";
-import { verifyUploadToken } from "../utils/uploadToken.js";
-const getStoragePath = ()=>String(process.env.WEBINY_LOCAL_STORAGE_PATH);
-const getUploadSecret = ()=>String(process.env.WEBINY_UPLOAD_SECRET);
-const isPathContained = (filePath, storagePath)=>{
-    const resolved = node_path.resolve(filePath);
-    const root = node_path.resolve(storagePath);
-    if (!resolved.startsWith(root + node_path.sep) && resolved !== root) return false;
-    return true;
-};
-const modifyFastifyPlugin = new ModifyFastifyPlugin((app)=>{
-    app.register(import("@fastify/multipart"), {
-        limits: {
-            fileSize: 5368709120
-        }
-    });
-    app.addContentTypeParser("application/octet-stream", {
-        parseAs: "buffer"
-    }, (_request, body, done)=>{
-        done(null, body);
-    });
-});
-modifyFastifyPlugin.name = "fileManagerServer.modifyFastify";
-const uploadRoutesPlugin = new RoutePlugin(({ onPost, onPut })=>{
-    onPost("/webiny-file-upload", async (request, reply)=>{
-        const storagePath = getStoragePath();
-        const secret = getUploadSecret();
-        let key;
-        let token;
-        let fileChunks;
-        let fileSize = 0;
-        const parts = request.parts();
-        for await (const part of parts)if ("field" === part.type) {
-            if ("key" === part.fieldname) key = part.value;
-            else if ("token" === part.fieldname) token = part.value;
-        } else if ("file" === part.type) {
-            const chunks = [];
-            for await (const chunk of part.file){
-                chunks.push(chunk);
-                fileSize += chunk.length;
-            }
-            fileChunks = chunks;
-        }
-        if (!key || !token) return reply.code(400).send({
-            error: "Missing key or token."
-        });
-        if (!fileChunks) return reply.code(400).send({
-            error: "No file in request."
-        });
-        let payload;
-        try {
-            payload = verifyUploadToken(token, secret);
-        } catch (err) {
-            return reply.code(400).send({
-                error: err instanceof Error ? err.message : "Invalid token."
-            });
-        }
-        if (payload.key !== key) return reply.code(400).send({
-            error: "Token key mismatch."
-        });
-        if (payload.uploadMaxFileSize > 0 && fileSize > payload.uploadMaxFileSize) return reply.code(400).send({
-            error: "File exceeds maximum allowed size."
-        });
-        if (payload.uploadMinFileSize > 0 && fileSize < payload.uploadMinFileSize) return reply.code(400).send({
-            error: "File is below minimum allowed size."
-        });
-        const destPath = node_path.join(storagePath, key);
-        if (!isPathContained(destPath, storagePath)) return reply.code(400).send({
-            error: "Invalid path."
-        });
-        const destDir = node_path.dirname(destPath);
-        await mkdir(destDir, {
-            recursive: true
-        });
-        const writeStream = createWriteStream(destPath);
-        const readable = Readable.from(fileChunks);
-        await pipeline(readable, writeStream);
-        return reply.code(204).send();
-    });
-    onPut("/webiny-file-upload/parts", async (request, reply)=>{
-        const storagePath = getStoragePath();
-        const secret = getUploadSecret();
-        const query = request.query;
-        const uploadId = query["uploadId"];
-        const partNumberStr = query["partNumber"];
-        const token = query["token"];
-        if (!uploadId || !partNumberStr || !token) return reply.code(400).send({
-            error: "Missing uploadId, partNumber, or token."
-        });
-        const partNumber = parseInt(partNumberStr, 10);
-        if (isNaN(partNumber) || partNumber < 1) return reply.code(400).send({
-            error: "Invalid partNumber."
-        });
-        let payload;
-        try {
-            payload = verifyUploadToken(token, secret);
-        } catch (err) {
-            return reply.code(400).send({
-                error: err instanceof Error ? err.message : "Invalid token."
-            });
-        }
-        const expectedKey = `tenants/${payload.tenantId}/multipart/${uploadId}/part-${partNumber}`;
-        if (payload.key !== expectedKey) return reply.code(400).send({
-            error: "Token key mismatch."
-        });
-        const destPath = node_path.join(storagePath, expectedKey);
-        if (!isPathContained(destPath, storagePath)) return reply.code(400).send({
-            error: "Invalid path."
-        });
-        const destDir = node_path.dirname(destPath);
-        await mkdir(destDir, {
-            recursive: true
-        });
-        const body = request.body;
-        await writeFile(destPath, body);
-        const etag = createHash("md5").update(body).digest("hex");
-        return reply.code(200).header("ETag", etag).send();
-    });
-});
-uploadRoutesPlugin.name = "fileManagerServer.uploadRoutes";
-export { modifyFastifyPlugin, uploadRoutesPlugin };
-
-//# sourceMappingURL=uploadRoutes.js.map

package/routes/uploadRoutes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes/uploadRoutes.js","sources":["../../src/routes/uploadRoutes.ts"],"sourcesContent":["import path from \"node:path\";\nimport { Readable } from \"node:stream\";\nimport { createHash } from \"node:crypto\";\nimport { mkdir } from \"node:fs/promises\";\nimport { writeFile } from \"node:fs/promises\";\nimport { createWriteStream } from \"node:fs\";\nimport { pipeline } from \"node:stream/promises\";\nimport { RoutePlugin } from \"@webiny/handler/plugins/RoutePlugin.js\";\nimport { ModifyFastifyPlugin } from \"@webiny/handler/plugins/ModifyFastifyPlugin.js\";\nimport { verifyUploadToken } from \"~/utils/uploadToken.js\";\n\nconst getStoragePath = (): string => {\n    return String(process.env.WEBINY_LOCAL_STORAGE_PATH);\n};\n\nconst getUploadSecret = (): string => {\n    return String(process.env.WEBINY_UPLOAD_SECRET);\n};\n\nconst isPathContained = (filePath: string, storagePath: string): boolean => {\n    const resolved = path.resolve(filePath);\n    const root = path.resolve(storagePath);\n    if (!resolved.startsWith(root + path.sep) && resolved !== root) {\n        return false;\n    }\n    return true;\n};\n\nexport const modifyFastifyPlugin = new ModifyFastifyPlugin(app => {\n    app.register(import(\"@fastify/multipart\"), {\n        limits: {\n            fileSize: 5 * 1024 * 1024 * 1024 /* 5 GB */\n        }\n    });\n\n    app.addContentTypeParser(\n        \"application/octet-stream\",\n        { parseAs: \"buffer\" },\n        (_request, body, done) => {\n            done(null, body);\n        }\n    );\n});\n\nmodifyFastifyPlugin.name = \"fileManagerServer.modifyFastify\";\n\nexport const uploadRoutesPlugin = new RoutePlugin(({ onPost, onPut }) => {\n    /* POST /webiny-file-upload — simple single-file upload via multipart/form-data.\n       Form fields: key (storage path), token (HMAC upload token).\n       File field: the raw file bytes (any field name). */\n    onPost(\"/webiny-file-upload\", async (request, reply) => {\n        const storagePath = getStoragePath();\n        const secret = getUploadSecret();\n\n        let key: string | undefined;\n        let token: string | undefined;\n        let fileChunks: Buffer[] | undefined;\n        let fileSize = 0;\n\n        const parts = request.parts();\n\n        for await (const part of parts) {\n            if (part.type === \"field\") {\n                if (part.fieldname === \"key\") {\n                    key = part.value as string;\n                } else if (part.fieldname === \"token\") {\n                    token = part.value as string;\n                }\n            } else if (part.type === \"file\") {\n                /* Collect the file stream into memory so we can measure and hash it. */\n                const chunks: Buffer[] = [];\n                for await (const chunk of part.file) {\n                    chunks.push(chunk as Buffer);\n                    fileSize += (chunk as Buffer).length;\n                }\n                fileChunks = chunks;\n            }\n        }\n\n        if (!key || !token) {\n            return reply.code(400).send({ error: \"Missing key or token.\" });\n        }\n\n        if (!fileChunks) {\n            return reply.code(400).send({ error: \"No file in request.\" });\n        }\n\n        let payload;\n        try {\n            payload = verifyUploadToken(token, secret);\n        } catch (err) {\n            return reply\n                .code(400)\n                .send({ error: err instanceof Error ? err.message : \"Invalid token.\" });\n        }\n\n        if (payload.key !== key) {\n            return reply.code(400).send({ error: \"Token key mismatch.\" });\n        }\n\n        if (payload.uploadMaxFileSize > 0 && fileSize > payload.uploadMaxFileSize) {\n            return reply.code(400).send({ error: \"File exceeds maximum allowed size.\" });\n        }\n\n        if (payload.uploadMinFileSize > 0 && fileSize < payload.uploadMinFileSize) {\n            return reply.code(400).send({ error: \"File is below minimum allowed size.\" });\n        }\n\n        const destPath = path.join(storagePath, key);\n\n        if (!isPathContained(destPath, storagePath)) {\n            return reply.code(400).send({ error: \"Invalid path.\" });\n        }\n\n        const destDir = path.dirname(destPath);\n        await mkdir(destDir, { recursive: true });\n\n        const writeStream = createWriteStream(destPath);\n        const readable = Readable.from(fileChunks);\n\n        await pipeline(readable, writeStream);\n\n        return reply.code(204).send();\n    });\n\n    /* PUT /webiny-file-upload/parts — multipart chunk upload via raw binary body.\n       Query params: uploadId, partNumber, token.\n       Body: raw binary chunk (application/octet-stream). */\n    onPut(\"/webiny-file-upload/parts\", async (request, reply) => {\n        const storagePath = getStoragePath();\n        const secret = getUploadSecret();\n\n        const query = request.query as Record<string, string | undefined>;\n        const uploadId = query[\"uploadId\"];\n        const partNumberStr = query[\"partNumber\"];\n        const token = query[\"token\"];\n\n        if (!uploadId || !partNumberStr || !token) {\n            return reply.code(400).send({ error: \"Missing uploadId, partNumber, or token.\" });\n        }\n\n        const partNumber = parseInt(partNumberStr, 10);\n        if (isNaN(partNumber) || partNumber < 1) {\n            return reply.code(400).send({ error: \"Invalid partNumber.\" });\n        }\n\n        let payload;\n        try {\n            payload = verifyUploadToken(token, secret);\n        } catch (err) {\n            return reply\n                .code(400)\n                .send({ error: err instanceof Error ? err.message : \"Invalid token.\" });\n        }\n\n        const expectedKey = `tenants/${payload.tenantId}/multipart/${uploadId}/part-${partNumber}`;\n\n        if (payload.key !== expectedKey) {\n            return reply.code(400).send({ error: \"Token key mismatch.\" });\n        }\n\n        const destPath = path.join(storagePath, expectedKey);\n\n        if (!isPathContained(destPath, storagePath)) {\n            return reply.code(400).send({ error: \"Invalid path.\" });\n        }\n\n        const destDir = path.dirname(destPath);\n        await mkdir(destDir, { recursive: true });\n\n        const body = request.body as Buffer;\n\n        await writeFile(destPath, body);\n\n        const etag = createHash(\"md5\").update(body).digest(\"hex\");\n\n        return reply.code(200).header(\"ETag\", etag).send();\n    });\n});\n\nuploadRoutesPlugin.name = \"fileManagerServer.uploadRoutes\";\n"],"names":["getStoragePath","String","process","getUploadSecret","isPathContained","filePath","storagePath","resolved","path","root","modifyFastifyPlugin","ModifyFastifyPlugin","app","_request","body","done","uploadRoutesPlugin","RoutePlugin","onPost","onPut","request","reply","secret","key","token","fileChunks","fileSize","parts","part","chunks","chunk","payload","verifyUploadToken","err","Error","destPath","destDir","mkdir","writeStream","createWriteStream","readable","Readable","pipeline","query","uploadId","partNumberStr","partNumber","parseInt","isNaN","expectedKey","writeFile","etag","createHash"],"mappings":";;;;;;;;;AAWA,MAAMA,iBAAiB,IACZC,OAAOC,QAAQ,GAAG,CAAC,yBAAyB;AAGvD,MAAMC,kBAAkB,IACbF,OAAOC,QAAQ,GAAG,CAAC,oBAAoB;AAGlD,MAAME,kBAAkB,CAACC,UAAkBC;IACvC,MAAMC,WAAWC,UAAAA,OAAY,CAACH;IAC9B,MAAMI,OAAOD,UAAAA,OAAY,CAACF;IAC1B,IAAI,CAACC,SAAS,UAAU,CAACE,OAAOD,UAAAA,GAAQ,KAAKD,aAAaE,MACtD,OAAO;IAEX,OAAO;AACX;AAEO,MAAMC,sBAAsB,IAAIC,oBAAoBC,CAAAA;IACvDA,IAAI,QAAQ,CAAC,MAAM,CAAC,uBAAuB;QACvC,QAAQ;YACJ,UAAU;QACd;IACJ;IAEAA,IAAI,oBAAoB,CACpB,4BACA;QAAE,SAAS;IAAS,GACpB,CAACC,UAAUC,MAAMC;QACbA,KAAK,MAAMD;IACf;AAER;AAEAJ,oBAAoB,IAAI,GAAG;AAEpB,MAAMM,qBAAqB,IAAIC,YAAY,CAAC,EAAEC,MAAM,EAAEC,KAAK,EAAE;IAIhED,OAAO,uBAAuB,OAAOE,SAASC;QAC1C,MAAMf,cAAcN;QACpB,MAAMsB,SAASnB;QAEf,IAAIoB;QACJ,IAAIC;QACJ,IAAIC;QACJ,IAAIC,WAAW;QAEf,MAAMC,QAAQP,QAAQ,KAAK;QAE3B,WAAW,MAAMQ,QAAQD,MACrB,IAAIC,AAAc,YAAdA,KAAK,IAAI,EACT;YAAA,IAAIA,AAAmB,UAAnBA,KAAK,SAAS,EACdL,MAAMK,KAAK,KAAK;iBACb,IAAIA,AAAmB,YAAnBA,KAAK,SAAS,EACrBJ,QAAQI,KAAK,KAAK;QACtB,OACG,IAAIA,AAAc,WAAdA,KAAK,IAAI,EAAa;YAE7B,MAAMC,SAAmB,EAAE;YAC3B,WAAW,MAAMC,SAASF,KAAK,IAAI,CAAE;gBACjCC,OAAO,IAAI,CAACC;gBACZJ,YAAaI,MAAiB,MAAM;YACxC;YACAL,aAAaI;QACjB;QAGJ,IAAI,CAACN,OAAO,CAACC,OACT,OAAOH,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAwB;QAGjE,IAAI,CAACI,YACD,OAAOJ,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAG/D,IAAIU;QACJ,IAAI;YACAA,UAAUC,kBAAkBR,OAAOF;QACvC,EAAE,OAAOW,KAAK;YACV,OAAOZ,MACF,IAAI,CAAC,KACL,IAAI,CAAC;gBAAE,OAAOY,eAAeC,QAAQD,IAAI,OAAO,GAAG;YAAiB;QAC7E;QAEA,IAAIF,QAAQ,GAAG,KAAKR,KAChB,OAAOF,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAG/D,IAAIU,QAAQ,iBAAiB,GAAG,KAAKL,WAAWK,QAAQ,iBAAiB,EACrE,OAAOV,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAqC;QAG9E,IAAIU,QAAQ,iBAAiB,GAAG,KAAKL,WAAWK,QAAQ,iBAAiB,EACrE,OAAOV,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsC;QAG/E,MAAMc,WAAW3B,UAAAA,IAAS,CAACF,aAAaiB;QAExC,IAAI,CAACnB,gBAAgB+B,UAAU7B,cAC3B,OAAOe,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAgB;QAGzD,MAAMe,UAAU5B,UAAAA,OAAY,CAAC2B;QAC7B,MAAME,MAAMD,SAAS;YAAE,WAAW;QAAK;QAEvC,MAAME,cAAcC,kBAAkBJ;QACtC,MAAMK,WAAWC,SAAS,IAAI,CAAChB;QAE/B,MAAMiB,SAASF,UAAUF;QAEzB,OAAOjB,MAAM,IAAI,CAAC,KAAK,IAAI;IAC/B;IAKAF,MAAM,6BAA6B,OAAOC,SAASC;QAC/C,MAAMf,cAAcN;QACpB,MAAMsB,SAASnB;QAEf,MAAMwC,QAAQvB,QAAQ,KAAK;QAC3B,MAAMwB,WAAWD,KAAK,CAAC,WAAW;QAClC,MAAME,gBAAgBF,KAAK,CAAC,aAAa;QACzC,MAAMnB,QAAQmB,KAAK,CAAC,QAAQ;QAE5B,IAAI,CAACC,YAAY,CAACC,iBAAiB,CAACrB,OAChC,OAAOH,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAA0C;QAGnF,MAAMyB,aAAaC,SAASF,eAAe;QAC3C,IAAIG,MAAMF,eAAeA,aAAa,GAClC,OAAOzB,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAG/D,IAAIU;QACJ,IAAI;YACAA,UAAUC,kBAAkBR,OAAOF;QACvC,EAAE,OAAOW,KAAK;YACV,OAAOZ,MACF,IAAI,CAAC,KACL,IAAI,CAAC;gBAAE,OAAOY,eAAeC,QAAQD,IAAI,OAAO,GAAG;YAAiB;QAC7E;QAEA,MAAMgB,cAAc,CAAC,QAAQ,EAAElB,QAAQ,QAAQ,CAAC,WAAW,EAAEa,SAAS,MAAM,EAAEE,YAAY;QAE1F,IAAIf,QAAQ,GAAG,KAAKkB,aAChB,OAAO5B,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAsB;QAG/D,MAAMc,WAAW3B,UAAAA,IAAS,CAACF,aAAa2C;QAExC,IAAI,CAAC7C,gBAAgB+B,UAAU7B,cAC3B,OAAOe,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAgB;QAGzD,MAAMe,UAAU5B,UAAAA,OAAY,CAAC2B;QAC7B,MAAME,MAAMD,SAAS;YAAE,WAAW;QAAK;QAEvC,MAAMtB,OAAOM,QAAQ,IAAI;QAEzB,MAAM8B,UAAUf,UAAUrB;QAE1B,MAAMqC,OAAOC,WAAW,OAAO,MAAM,CAACtC,MAAM,MAAM,CAAC;QAEnD,OAAOO,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC,QAAQ8B,MAAM,IAAI;IACpD;AACJ;AAEAnC,mBAAmB,IAAI,GAAG"}

package/utils/resolveServerUrl.d.ts

@@ -1,2 +0,0 @@
-import type { FastifyRequest } from "fastify";
-export declare const resolveServerUrl: (request: FastifyRequest) => Promise<string>;

package/utils/resolveServerUrl.js

@@ -1,10 +0,0 @@
-import { ServiceDiscovery } from "@webiny/api-core/features/serviceDiscovery/ServiceDiscovery.js";
-const resolveServerUrl = async (request)=>{
-    const manifest = await ServiceDiscovery.load();
-    const domain = manifest?.api?.cloudfront?.domain;
-    if (domain) return domain;
-    return `${request.protocol}://${request.hostname}`;
-};
-export { resolveServerUrl };
-
-//# sourceMappingURL=resolveServerUrl.js.map

package/utils/resolveServerUrl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils/resolveServerUrl.js","sources":["../../src/utils/resolveServerUrl.ts"],"sourcesContent":["import { ServiceDiscovery } from \"@webiny/api-core/features/serviceDiscovery/ServiceDiscovery.js\";\nimport type { FastifyRequest } from \"fastify\";\n\nexport const resolveServerUrl = async (request: FastifyRequest): Promise<string> => {\n    const manifest = await ServiceDiscovery.load();\n    const domain = manifest?.api?.cloudfront?.domain;\n    if (domain) {\n        return domain as string;\n    }\n\n    return `${request.protocol}://${request.hostname}`;\n};\n"],"names":["resolveServerUrl","request","manifest","ServiceDiscovery","domain"],"mappings":";AAGO,MAAMA,mBAAmB,OAAOC;IACnC,MAAMC,WAAW,MAAMC,iBAAiB,IAAI;IAC5C,MAAMC,SAASF,UAAU,KAAK,YAAY;IAC1C,IAAIE,QACA,OAAOA;IAGX,OAAO,GAAGH,QAAQ,QAAQ,CAAC,GAAG,EAAEA,QAAQ,QAAQ,EAAE;AACtD"}