@ya-accelerators/web-backend-framework 0.0.118 → 0.0.120
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/constants.d.ts
CHANGED
|
@@ -6,6 +6,7 @@ export declare const constants: {
|
|
|
6
6
|
UPLOADS_PREFIX: string;
|
|
7
7
|
UPLOADS_EXPIRE_DAYS: number;
|
|
8
8
|
UPLOAD_TOKEN_LENGTH: number;
|
|
9
|
+
UPLOAD_ACTOR_SALT_LENGTH: number;
|
|
9
10
|
UPLOAD_FILENAME_MAX_LENGTH: number;
|
|
10
11
|
UPLOAD_CONTENT_TYPE_MAX_LENGTH: number;
|
|
11
12
|
UPLOAD_STORED_CONTENT_TYPE: string;
|
package/dist/constants.js
CHANGED
|
@@ -4,6 +4,7 @@ export const constants = {
|
|
|
4
4
|
UPLOADS_PREFIX: '_uploads/',
|
|
5
5
|
UPLOADS_EXPIRE_DAYS: 1,
|
|
6
6
|
UPLOAD_TOKEN_LENGTH: 43,
|
|
7
|
+
UPLOAD_ACTOR_SALT_LENGTH: 32,
|
|
7
8
|
UPLOAD_FILENAME_MAX_LENGTH: 255,
|
|
8
9
|
UPLOAD_CONTENT_TYPE_MAX_LENGTH: 255,
|
|
9
10
|
UPLOAD_STORED_CONTENT_TYPE: 'application/octet-stream',
|
package/dist/constants.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAE9D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wBAAwB,EAAE,wEAAwE;IAClG,cAAc,EAAE,WAAW;IAC3B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,GAAG;IAC/B,8BAA8B,EAAE,GAAG;IACnC,0BAA0B,EAAE,0BAA0B;IAEtD,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,+CAA+C;IAC/C,uBAAuB,EAAE;QACvB,YAAY;QACZ,WAAW;QACX,WAAW;QACX,cAAc;QACd,YAAY;QACZ,YAAY;KACJ;IAEV,GAAG,YAAY;CAChB,CAAA"}
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAE9D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wBAAwB,EAAE,wEAAwE;IAClG,cAAc,EAAE,WAAW;IAC3B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;IACvB,wBAAwB,EAAE,EAAE;IAC5B,0BAA0B,EAAE,GAAG;IAC/B,8BAA8B,EAAE,GAAG;IACnC,0BAA0B,EAAE,0BAA0B;IAEtD,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,+CAA+C;IAC/C,uBAAuB,EAAE;QACvB,YAAY;QACZ,WAAW;QACX,WAAW;QACX,cAAc;QACd,YAAY;QACZ,YAAY;KACJ;IAEV,GAAG,YAAY;CAChB,CAAA"}
|
|
@@ -11,7 +11,21 @@ const UPLOAD_MINT_MAX = 60;
|
|
|
11
11
|
const UPLOAD_MINT_WINDOW_SEC = 60;
|
|
12
12
|
const UPLOAD_TOKEN_TTL_SEC = 5 * 60;
|
|
13
13
|
const tokenKey = (token) => `uploadtoken:${token}`;
|
|
14
|
-
const
|
|
14
|
+
const digestActor = (actorSalt, actorUserId) => createHash('sha256')
|
|
15
|
+
.update(JSON.stringify([actorSalt, actorUserId]))
|
|
16
|
+
.digest('hex');
|
|
17
|
+
const bindActor = (actorUserId) => {
|
|
18
|
+
const actorSalt = Util.createOTP(constants.UPLOAD_ACTOR_SALT_LENGTH, false);
|
|
19
|
+
return `${actorSalt}:${digestActor(actorSalt, actorUserId)}`;
|
|
20
|
+
};
|
|
21
|
+
const matchesActorBinding = (binding, actorUserId) => {
|
|
22
|
+
const separator = binding.indexOf(':');
|
|
23
|
+
if (separator === -1) {
|
|
24
|
+
return binding === createHash('sha256').update(actorUserId).digest('hex');
|
|
25
|
+
}
|
|
26
|
+
const actorSalt = binding.slice(0, separator);
|
|
27
|
+
return binding.slice(separator + 1) === digestActor(actorSalt, actorUserId);
|
|
28
|
+
};
|
|
15
29
|
export const mint = async (bucket) => {
|
|
16
30
|
const { allowed } = await coordination.rateLimit.attempt({
|
|
17
31
|
key: `file-upload:mint:${defaultEnv.SERVICE}`,
|
|
@@ -25,7 +39,7 @@ export const mint = async (bucket) => {
|
|
|
25
39
|
const actorUserId = getCurrentAuditContext()?.actorUserId;
|
|
26
40
|
await redis.set(tokenKey(token), JSON.stringify({
|
|
27
41
|
bucket,
|
|
28
|
-
...(actorUserId === undefined ? {} : { actorUserIdHash:
|
|
42
|
+
...(actorUserId === undefined ? {} : { actorUserIdHash: bindActor(actorUserId) }),
|
|
29
43
|
}), UPLOAD_TOKEN_TTL_SEC);
|
|
30
44
|
return { token, url: `${defaultEnv.BASE_URL}/_uploads` };
|
|
31
45
|
};
|
|
@@ -104,9 +118,10 @@ export const consume = async (key, bucket, constraints) => {
|
|
|
104
118
|
return undefined;
|
|
105
119
|
}
|
|
106
120
|
const actorUserId = getCurrentAuditContext()?.actorUserId;
|
|
121
|
+
const uploaderActorId = object.metadata?.uploaderactorid;
|
|
107
122
|
if (actorUserId === undefined
|
|
108
|
-
?
|
|
109
|
-
:
|
|
123
|
+
? uploaderActorId !== undefined
|
|
124
|
+
: uploaderActorId === undefined || !matchesActorBinding(uploaderActorId, actorUserId)) {
|
|
110
125
|
return undefined;
|
|
111
126
|
}
|
|
112
127
|
await s3.deleteObject({ bucket, key: objectKey });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/uploads/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AACvD,OAAO,EAAE,EAAE,EAAE,MAAM,8BAA8B,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAE/B,MAAM,eAAe,GAAG,EAAE,CAAA;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,CAAA;AAEnC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,eAAe,KAAK,EAAE,CAAA;AAC1D,MAAM,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/uploads/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AACvD,OAAO,EAAE,EAAE,EAAE,MAAM,8BAA8B,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAE/B,MAAM,eAAe,GAAG,EAAE,CAAA;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,CAAA;AAEnC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,eAAe,KAAK,EAAE,CAAA;AAC1D,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,WAAmB,EAAE,EAAE,CAC7D,UAAU,CAAC,QAAQ,CAAC;KACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;KAChD,MAAM,CAAC,KAAK,CAAC,CAAA;AAElB,MAAM,SAAS,GAAG,CAAC,WAAmB,EAAE,EAAE;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;IAC3E,OAAO,GAAG,SAAS,IAAI,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAA;AAC9D,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,WAAmB,EAAE,EAAE;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAC7C,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC;QACvD,GAAG,EAAE,oBAAoB,UAAU,CAAC,OAAO,EAAE;QAC7C,GAAG,EAAE,eAAe;QACpB,SAAS,EAAE,sBAAsB;KAClC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,yBAAyB,CAAC,4BAA4B,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,sBAAsB,EAAE,EAAE,WAAW,CAAA;IACzD,MAAM,KAAK,CAAC,GAAG,CACb,QAAQ,CAAC,KAAK,CAAC,EACf,IAAI,CAAC,SAAS,CAAC;QACb,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;KAClF,CAAC,EACF,oBAAoB,CACrB,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,QAAQ,WAAW,EAAE,CAAA;AAC1D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;IACtD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC1B,CAAC;QACD,MAAM,SAAS,GAAG,MAAyD,CAAA;QAC3E,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC1B,CAAC;QACD,IACE,iBAAiB,IAAI,SAAS;YAC9B,SAAS,CAAC,eAAe,KAAK,SAAS;YACvC,OAAO,SAAS,CAAC,eAAe,KAAK,QAAQ,EAC7C,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,GAAG,CAAC,SAAS,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,eAAyB,EAAE,CAAC;SAC7G,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;AACH,CAAC,CAAA;AAED,oGAAoG;AACpG,oGAAoG;AACpG,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,MAMjC,EAAE,EAAE;IACH,0GAA0G;IAC1G,uGAAuG;IACvG,kDAAkD;IAClD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/C,KAAK,EAAE;aACJ,yBAAyB,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,SAAS,CAAC,cAAc;YAChC,UAAU,EAAE,SAAS,CAAC,mBAAmB;SAC1C,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IAC7B,MAAM,EAAE,CAAC,SAAS,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,GAAG,SAAS,CAAC,cAAc,GAAG,GAAG,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,SAAS,CAAC,0BAA0B;QACjD,sGAAsG;QACtG,QAAQ,EAAE;YACR,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC;YACrC,mBAAmB,EAAE,MAAM,CAAC,WAAW;YACvC,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;SAC7F;KACF,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAA;AAC3F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAC1B,GAAW,EACX,MAAc,EACd,WAA8D,EAC9D,EAAE;IACF,yGAAyG;IACzG,qFAAqF;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,CAAC,cAAc,GAAG,GAAG,EAAE,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;IAC7D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,sBAAsB,EAAE,EAAE,WAAW,CAAA;IACzD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAA;IACxD,IACE,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,eAAe,KAAK,SAAS;QAC/B,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC,EACvF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,mBAAmB,IAAI,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,0BAA0B,CAAA;IACnH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAA;IAC/B,IAAI,WAAW,EAAE,OAAO,KAAK,SAAS,IAAI,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;QACrE,8BAA8B,CAAC,oBAAoB,IAAI,oBAAoB,WAAW,CAAC,OAAO,aAAa,CAAC,CAAA;IAC9G,CAAC;IACD,IACE,WAAW,EAAE,MAAM,KAAK,SAAS;QACjC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACtC,CAAC;QACD,8BAA8B,CAAC,sBAAsB,QAAQ,iBAAiB,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AACzG,CAAC,CAAA"}
|