@ya-accelerators/nextjs-framework 0.0.92 → 0.0.94

package/dist/lib/index.d.ts

@@ -2,9 +2,11 @@ import * as cookie from './cookie';
 import * as nextAuth from './next-auth';
 import * as serverAction from './server-action';
 import * as trpc from './trpc';
+import * as uploads from './uploads';
 export declare const Lib: {
     cookie: typeof cookie;
     nextAuth: typeof nextAuth;
     serverAction: typeof serverAction;
     trpc: typeof trpc;
+    uploads: typeof uploads;
 };

package/dist/lib/index.js

@@ -2,10 +2,12 @@ import * as cookie from './cookie';
 import * as nextAuth from './next-auth';
 import * as serverAction from './server-action';
 import * as trpc from './trpc';
+import * as uploads from './uploads';
 export const Lib = {
     cookie,
     nextAuth,
     serverAction,
     trpc,
+    uploads,
 };
 //# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,QAAQ,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAA;AAE9B,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,IAAI;CACL,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,UAAU,CAAA;AAClC,OAAO,KAAK,QAAQ,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAA;AAC9B,OAAO,KAAK,OAAO,MAAM,WAAW,CAAA;AAEpC,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,IAAI;IACJ,OAAO;CACR,CAAA"}

package/dist/lib/uploads/index.d.ts

@@ -0,0 +1,4 @@
+export declare const createUploadRoute: (uploadAction: () => Promise<{
+    token: string;
+    url: string;
+}>) => (request: Request) => Promise<Response>;

package/dist/lib/uploads/index.js

@@ -0,0 +1,64 @@
+import { logger } from '../../logger';
+// Same-origin upload relay. The browser POSTs the file bytes to the app's own origin and this route
+// forwards them to the backend's `/_uploads` sink: the one-time token and the target URL are resolved
+// server-side by `uploadAction`, so the token never reaches the browser and the page never makes a
+// cross-origin request (no CORS preflight, and no mixed content when the page is served over https while
+// the backend is plain http in dev). The destination is not caller-supplied, so this is not an open relay.
+export const createUploadRoute = (uploadAction) => async (request) => {
+    // Unlike a Server Action, a route handler gets no framework CSRF protection, and this one is
+    // cookie-authenticated: without this check an attacker's page could POST a body cross-site and have the
+    // victim's session mint a token and store the object. Two accept conditions, because neither covers both
+    // deployments on its own: `Sec-Fetch-Site` is browser-set and a forbidden header name (unforgeable) but
+    // is only attached to trustworthy origins, so it is absent on the plain-http dev hosts; the Origin/Host
+    // comparison covers those, and compares against `Host` alone — `x-forwarded-host` is caller-settable, so
+    // trusting it would let an attacker match its own Origin.
+    const origin = request.headers.get('origin');
+    if (request.headers.get('sec-fetch-site') !== 'same-origin' &&
+        (origin === null || URL.parse(origin)?.host !== request.headers.get('host'))) {
+        return new Response(JSON.stringify({ error: 'cross-origin upload rejected' }), {
+            status: 403,
+            headers: { 'content-type': 'application/json' },
+        });
+    }
+    const filename = request.headers.get('x-upload-filename');
+    const minted = await uploadAction().catch((error) => {
+        logger.error('upload', { error });
+        return undefined;
+    });
+    if (minted === undefined) {
+        return new Response(JSON.stringify({ error: 'upload token could not be issued' }), {
+            status: 502,
+            headers: { 'content-type': 'application/json' },
+        });
+    }
+    const { token, url } = minted;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${token}`,
+            // Forwarded only when present — the backend falls back to its own default name for an absent header,
+            // but an empty string would be taken as the real filename.
+            ...(filename === null ? {} : { 'x-upload-filename': filename }),
+            'content-type': request.headers.get('content-type') ?? 'application/octet-stream',
+        },
+        // The body is buffered rather than streamed: passing `request.body` through requires the
+        // `duplex: 'half'` init option, which the DOM `RequestInit` type Next.js compiles against does not
+        // declare. The backend caps a single upload at its own ceiling, so the buffer stays bounded.
+        body: await request.arrayBuffer(),
+    }).catch((error) => {
+        logger.error('upload', { url, error });
+        return undefined;
+    });
+    if (response === undefined) {
+        return new Response(JSON.stringify({ error: 'upload backend unreachable' }), {
+            status: 502,
+            headers: { 'content-type': 'application/json' },
+        });
+    }
+    const body = await response.text();
+    if (!response.ok) {
+        logger.error('upload', { status: response.status, body });
+    }
+    return new Response(body, { status: response.status, headers: { 'content-type': 'application/json' } });
+};
+//# sourceMappingURL=index.js.map

package/dist/lib/uploads/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/uploads/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,oGAAoG;AACpG,sGAAsG;AACtG,mGAAmG;AACnG,yGAAyG;AACzG,2GAA2G;AAC3G,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,YAA2D,EAAE,EAAE,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;IAC1F,6FAA6F;IAC7F,wGAAwG;IACxG,yGAAyG;IACzG,wGAAwG;IACxG,wGAAwG;IACxG,yGAAyG;IACzG,0DAA0D;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,aAAa;QACvD,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,EAAE;YACjF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,qGAAqG;YACrG,2DAA2D;YAC3D,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;YAC/D,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;SAClF;QACD,yFAAyF;QACzF,mGAAmG;QACnG,6FAA6F;QAC7F,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,EAAE;YAC3E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;AACzG,CAAC,CAAA"}