@webiny/api-file-manager-standalone 6.6.0-alpha.4

package/routes/utils.d.ts

@@ -0,0 +1,18 @@
+export declare const isPathContained: (filePath: string, storagePath: string) => boolean;
+export declare const toBuffer: (body: unknown) => Buffer;
+interface MultipartField {
+    name: string;
+    value: string;
+}
+interface MultipartFile {
+    name: string;
+    filename: string;
+    data: Buffer;
+}
+export interface MultipartResult {
+    fields: MultipartField[];
+    files: MultipartFile[];
+}
+export declare const parseMultipart: (buffer: Buffer, boundary: string) => MultipartResult;
+export declare const getBoundary: (contentType: string) => string | undefined;
+export {};

package/routes/utils.js

@@ -0,0 +1,55 @@
+import node_path from "node:path";
+const isPathContained = (filePath, storagePath)=>{
+    const resolved = node_path.resolve(filePath);
+    const root = node_path.resolve(storagePath);
+    return resolved === root || resolved.startsWith(root + node_path.sep);
+};
+const toBuffer = (body)=>{
+    if (Buffer.isBuffer(body)) return body;
+    if (body instanceof Uint8Array) return Buffer.from(body);
+    if ("string" == typeof body) return Buffer.from(body, "base64");
+    return Buffer.alloc(0);
+};
+const parseMultipart = (buffer, boundary)=>{
+    const fields = [];
+    const files = [];
+    const separator = Buffer.from(`--${boundary}`);
+    let idx = buffer.indexOf(separator);
+    while(-1 !== idx){
+        const next = buffer.indexOf(separator, idx + separator.length);
+        if (-1 === next) break;
+        let part = buffer.subarray(idx + separator.length, next);
+        if ("\r\n" === part.subarray(0, 2).toString("latin1")) part = part.subarray(2);
+        if ("\r\n" === part.subarray(-2).toString("latin1")) part = part.subarray(0, -2);
+        const headerEnd = part.indexOf("\r\n\r\n");
+        if (-1 !== headerEnd) {
+            const rawHeaders = part.subarray(0, headerEnd).toString("utf8");
+            const content = part.subarray(headerEnd + 4);
+            const disposition = /content-disposition:[^\r\n]*/i.exec(rawHeaders)?.[0] ?? "";
+            const name = /name="([^"]*)"/i.exec(disposition)?.[1];
+            const filename = /filename="([^"]*)"/i.exec(disposition)?.[1];
+            if (void 0 !== name) if (void 0 !== filename) files.push({
+                name,
+                filename,
+                data: content
+            });
+            else fields.push({
+                name,
+                value: content.toString("utf8")
+            });
+        }
+        idx = next;
+    }
+    return {
+        fields,
+        files
+    };
+};
+const getBoundary = (contentType)=>{
+    const match = /boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType);
+    const value = match?.[1] ?? match?.[2];
+    return value?.trim();
+};
+export { getBoundary, isPathContained, parseMultipart, toBuffer };
+
+//# sourceMappingURL=utils.js.map

package/routes/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes/utils.js","sources":["../../src/routes/utils.ts"],"sourcesContent":["import path from \"node:path\";\n\nexport const isPathContained = (filePath: string, storagePath: string): boolean => {\n    const resolved = path.resolve(filePath);\n    const root = path.resolve(storagePath);\n    return resolved === root || resolved.startsWith(root + path.sep);\n};\n\n/* Normalise a transport request body into a Buffer. */\nexport const toBuffer = (body: unknown): Buffer => {\n    if (Buffer.isBuffer(body)) {\n        return body;\n    }\n    if (body instanceof Uint8Array) {\n        return Buffer.from(body);\n    }\n    if (typeof body === \"string\") {\n        return Buffer.from(body, \"base64\");\n    }\n    return Buffer.alloc(0);\n};\n\ninterface MultipartField {\n    name: string;\n    value: string;\n}\n\ninterface MultipartFile {\n    name: string;\n    filename: string;\n    data: Buffer;\n}\n\nexport interface MultipartResult {\n    fields: MultipartField[];\n    files: MultipartFile[];\n}\n\n/* Minimal multipart/form-data parser operating on the raw body buffer. */\nexport const parseMultipart = (buffer: Buffer, boundary: string): MultipartResult => {\n    const fields: MultipartField[] = [];\n    const files: MultipartFile[] = [];\n    const separator = Buffer.from(`--${boundary}`);\n\n    let idx = buffer.indexOf(separator);\n    while (idx !== -1) {\n        const next = buffer.indexOf(separator, idx + separator.length);\n        if (next === -1) {\n            break;\n        }\n\n        let part = buffer.subarray(idx + separator.length, next);\n        if (part.subarray(0, 2).toString(\"latin1\") === \"\\r\\n\") {\n            part = part.subarray(2);\n        }\n        if (part.subarray(-2).toString(\"latin1\") === \"\\r\\n\") {\n            part = part.subarray(0, -2);\n        }\n\n        const headerEnd = part.indexOf(\"\\r\\n\\r\\n\");\n        if (headerEnd !== -1) {\n            const rawHeaders = part.subarray(0, headerEnd).toString(\"utf8\");\n            const content = part.subarray(headerEnd + 4);\n\n            const disposition = /content-disposition:[^\\r\\n]*/i.exec(rawHeaders)?.[0] ?? \"\";\n            const name = /name=\"([^\"]*)\"/i.exec(disposition)?.[1];\n            const filename = /filename=\"([^\"]*)\"/i.exec(disposition)?.[1];\n\n            if (name !== undefined) {\n                if (filename !== undefined) {\n                    files.push({ name, filename, data: content });\n                } else {\n                    fields.push({ name, value: content.toString(\"utf8\") });\n                }\n            }\n        }\n\n        idx = next;\n    }\n\n    return { fields, files };\n};\n\nexport const getBoundary = (contentType: string): string | undefined => {\n    const match = /boundary=(?:\"([^\"]+)\"|([^;]+))/i.exec(contentType);\n    const value = match?.[1] ?? match?.[2];\n    return value?.trim();\n};\n"],"names":["isPathContained","filePath","storagePath","resolved","path","root","toBuffer","body","Buffer","Uint8Array","parseMultipart","buffer","boundary","fields","files","separator","idx","next","part","headerEnd","rawHeaders","content","disposition","name","filename","undefined","getBoundary","contentType","match","value"],"mappings":";AAEO,MAAMA,kBAAkB,CAACC,UAAkBC;IAC9C,MAAMC,WAAWC,UAAAA,OAAY,CAACH;IAC9B,MAAMI,OAAOD,UAAAA,OAAY,CAACF;IAC1B,OAAOC,aAAaE,QAAQF,SAAS,UAAU,CAACE,OAAOD,UAAAA,GAAQ;AACnE;AAGO,MAAME,WAAW,CAACC;IACrB,IAAIC,OAAO,QAAQ,CAACD,OAChB,OAAOA;IAEX,IAAIA,gBAAgBE,YAChB,OAAOD,OAAO,IAAI,CAACD;IAEvB,IAAI,AAAgB,YAAhB,OAAOA,MACP,OAAOC,OAAO,IAAI,CAACD,MAAM;IAE7B,OAAOC,OAAO,KAAK,CAAC;AACxB;AAmBO,MAAME,iBAAiB,CAACC,QAAgBC;IAC3C,MAAMC,SAA2B,EAAE;IACnC,MAAMC,QAAyB,EAAE;IACjC,MAAMC,YAAYP,OAAO,IAAI,CAAC,CAAC,EAAE,EAAEI,UAAU;IAE7C,IAAII,MAAML,OAAO,OAAO,CAACI;IACzB,MAAOC,AAAQ,OAARA,IAAY;QACf,MAAMC,OAAON,OAAO,OAAO,CAACI,WAAWC,MAAMD,UAAU,MAAM;QAC7D,IAAIE,AAAS,OAATA,MACA;QAGJ,IAAIC,OAAOP,OAAO,QAAQ,CAACK,MAAMD,UAAU,MAAM,EAAEE;QACnD,IAAIC,AAA2C,WAA3CA,KAAK,QAAQ,CAAC,GAAG,GAAG,QAAQ,CAAC,WAC7BA,OAAOA,KAAK,QAAQ,CAAC;QAEzB,IAAIA,AAAyC,WAAzCA,KAAK,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAC3BA,OAAOA,KAAK,QAAQ,CAAC,GAAG;QAG5B,MAAMC,YAAYD,KAAK,OAAO,CAAC;QAC/B,IAAIC,AAAc,OAAdA,WAAkB;YAClB,MAAMC,aAAaF,KAAK,QAAQ,CAAC,GAAGC,WAAW,QAAQ,CAAC;YACxD,MAAME,UAAUH,KAAK,QAAQ,CAACC,YAAY;YAE1C,MAAMG,cAAc,gCAAgC,IAAI,CAACF,aAAa,CAAC,EAAE,IAAI;YAC7E,MAAMG,OAAO,kBAAkB,IAAI,CAACD,cAAc,CAAC,EAAE;YACrD,MAAME,WAAW,sBAAsB,IAAI,CAACF,cAAc,CAAC,EAAE;YAE7D,IAAIC,AAASE,WAATF,MACA,IAAIC,AAAaC,WAAbD,UACAV,MAAM,IAAI,CAAC;gBAAES;gBAAMC;gBAAU,MAAMH;YAAQ;iBAE3CR,OAAO,IAAI,CAAC;gBAAEU;gBAAM,OAAOF,QAAQ,QAAQ,CAAC;YAAQ;QAGhE;QAEAL,MAAMC;IACV;IAEA,OAAO;QAAEJ;QAAQC;IAAM;AAC3B;AAEO,MAAMY,cAAc,CAACC;IACxB,MAAMC,QAAQ,kCAAkC,IAAI,CAACD;IACrD,MAAME,QAAQD,OAAO,CAAC,EAAE,IAAIA,OAAO,CAAC,EAAE;IACtC,OAAOC,OAAO;AAClB"}

package/types.d.ts

@@ -0,0 +1,10 @@
+import "@webiny/background-tasks/api/features/TaskController/augmentation.js";
+export type { PresignedPostPayloadData } from "@webiny/api-file-manager/features/upload/index.js";
+export type { FileData } from "@webiny/api-file-manager/features/upload/index.js";
+export interface UploadTokenPayload {
+    key: string;
+    tenantId: string;
+    expiresAt: number;
+    uploadMinFileSize: number;
+    uploadMaxFileSize: number;
+}

package/types.js

@@ -0,0 +1 @@
+import "@webiny/background-tasks/api/features/TaskController/augmentation.js";

package/utils/uploadToken.d.ts

@@ -0,0 +1,3 @@
+import type { UploadTokenPayload } from "../types.js";
+export declare const createUploadToken: (payload: UploadTokenPayload, secret: string) => string;
+export declare const verifyUploadToken: (token: string, secret: string) => UploadTokenPayload;

package/utils/uploadToken.js

@@ -0,0 +1,22 @@
+import { createHmac } from "node:crypto";
+const createUploadToken = (payload, secret)=>{
+    const json = JSON.stringify(payload);
+    const encoded = Buffer.from(json).toString("base64url");
+    const signature = createHmac("sha256", secret).update(encoded).digest("base64url");
+    return `${encoded}.${signature}`;
+};
+const verifyUploadToken = (token, secret)=>{
+    const dotIndex = token.indexOf(".");
+    if (-1 === dotIndex) throw new Error("Invalid token format.");
+    const encoded = token.slice(0, dotIndex);
+    const signature = token.slice(dotIndex + 1);
+    const expectedSignature = createHmac("sha256", secret).update(encoded).digest("base64url");
+    if (signature !== expectedSignature) throw new Error("Invalid token signature.");
+    const json = Buffer.from(encoded, "base64url").toString("utf-8");
+    const payload = JSON.parse(json);
+    if (payload.expiresAt < Date.now()) throw new Error("Token has expired.");
+    return payload;
+};
+export { createUploadToken, verifyUploadToken };
+
+//# sourceMappingURL=uploadToken.js.map

package/utils/uploadToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils/uploadToken.js","sources":["../../src/utils/uploadToken.ts"],"sourcesContent":["import { createHmac } from \"node:crypto\";\nimport type { UploadTokenPayload } from \"~/types.js\";\n\nexport const createUploadToken = (payload: UploadTokenPayload, secret: string): string => {\n    const json = JSON.stringify(payload);\n    const encoded = Buffer.from(json).toString(\"base64url\");\n    const signature = createHmac(\"sha256\", secret).update(encoded).digest(\"base64url\");\n\n    return `${encoded}.${signature}`;\n};\n\nexport const verifyUploadToken = (token: string, secret: string): UploadTokenPayload => {\n    const dotIndex = token.indexOf(\".\");\n    if (dotIndex === -1) {\n        throw new Error(\"Invalid token format.\");\n    }\n\n    const encoded = token.slice(0, dotIndex);\n    const signature = token.slice(dotIndex + 1);\n\n    const expectedSignature = createHmac(\"sha256\", secret).update(encoded).digest(\"base64url\");\n\n    if (signature !== expectedSignature) {\n        throw new Error(\"Invalid token signature.\");\n    }\n\n    const json = Buffer.from(encoded, \"base64url\").toString(\"utf-8\");\n    const payload = JSON.parse(json) as UploadTokenPayload;\n\n    if (payload.expiresAt < Date.now()) {\n        throw new Error(\"Token has expired.\");\n    }\n\n    return payload;\n};\n"],"names":["createUploadToken","payload","secret","json","JSON","encoded","Buffer","signature","createHmac","verifyUploadToken","token","dotIndex","Error","expectedSignature","Date"],"mappings":";AAGO,MAAMA,oBAAoB,CAACC,SAA6BC;IAC3D,MAAMC,OAAOC,KAAK,SAAS,CAACH;IAC5B,MAAMI,UAAUC,OAAO,IAAI,CAACH,MAAM,QAAQ,CAAC;IAC3C,MAAMI,YAAYC,WAAW,UAAUN,QAAQ,MAAM,CAACG,SAAS,MAAM,CAAC;IAEtE,OAAO,GAAGA,QAAQ,CAAC,EAAEE,WAAW;AACpC;AAEO,MAAME,oBAAoB,CAACC,OAAeR;IAC7C,MAAMS,WAAWD,MAAM,OAAO,CAAC;IAC/B,IAAIC,AAAa,OAAbA,UACA,MAAM,IAAIC,MAAM;IAGpB,MAAMP,UAAUK,MAAM,KAAK,CAAC,GAAGC;IAC/B,MAAMJ,YAAYG,MAAM,KAAK,CAACC,WAAW;IAEzC,MAAME,oBAAoBL,WAAW,UAAUN,QAAQ,MAAM,CAACG,SAAS,MAAM,CAAC;IAE9E,IAAIE,cAAcM,mBACd,MAAM,IAAID,MAAM;IAGpB,MAAMT,OAAOG,OAAO,IAAI,CAACD,SAAS,aAAa,QAAQ,CAAC;IACxD,MAAMJ,UAAUG,KAAK,KAAK,CAACD;IAE3B,IAAIF,QAAQ,SAAS,GAAGa,KAAK,GAAG,IAC5B,MAAM,IAAIF,MAAM;IAGpB,OAAOX;AACX"}