@yunsoft/yuncms-api 0.1.26 → 0.1.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-api",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Express API runtime and bundled Studio server for YunCMS.",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
     "@modelcontextprotocol/node": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@node-saml/node-saml": "5.1.0",
-    "@yunsoft/yuncms-core": "0.1.26",
+    "@yunsoft/yuncms-core": "0.1.27",
     "express": "5.2.1",
     "ldapts": "9.0.0",
     "openid-client": "6.8.7",

package/src/app.js

@@ -50,8 +50,9 @@ function studioCors(config) {
     if (origin && allowedOrigin && origin === allowedOrigin) {
       res.set('access-control-allow-origin', origin);
       res.set('vary', 'Origin');
-      res.set('access-control-allow-headers', 'content-type, authorization, x-request-id, x-filename, x-title, x-mimetype, mcp-protocol-version, mcp-method, mcp-name');
-      res.set('access-control-allow-methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
+      res.set('access-control-allow-headers', 'content-type, authorization, x-request-id, x-filename, x-title, x-mimetype, mcp-protocol-version, mcp-method, mcp-name, range, if-range, if-none-match, if-modified-since');
+      res.set('access-control-allow-methods', 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS');
+      res.set('access-control-expose-headers', 'etag, content-range, accept-ranges, last-modified');
     }
     if (req.method === 'OPTIONS') return res.sendStatus(204);
     return next();

package/src/byte-range.js

@@ -0,0 +1,204 @@
+/**
+ * Pure HTTP byte-range helper compliant with RFC 9110 Sections 13.1.5 and 14.1.2.
+ * @see https://www.rfc-editor.org/rfc/rfc9110.html#name-if-range
+ */
+
+export function parseByteRange(rangeHeader, size) {
+  if (rangeHeader == null || rangeHeader === '') {
+    return { type: 'none' };
+  }
+
+  if (typeof rangeHeader !== 'string') {
+    return { type: 'malformed' };
+  }
+
+  const trimmed = rangeHeader.trim();
+  if (!trimmed.startsWith('bytes=')) {
+    return { type: 'malformed' };
+  }
+
+  const spec = trimmed.slice(6).trim();
+  if (!spec) {
+    return { type: 'malformed' };
+  }
+
+  // Multi-range is ignored according to YunCMS specification
+  if (spec.includes(',')) {
+    return { type: 'multi' };
+  }
+
+  const match = spec.match(/^(?:(\d+)-(\d*)|-(\d+))$/);
+  if (!match) {
+    return { type: 'malformed' };
+  }
+
+  const safeSize = Number(size);
+
+  if (match[1] !== undefined) {
+    const startStr = match[1];
+    const endStr = match[2];
+
+    if (endStr !== '') {
+      // Form: start-end
+      // Guard against huge numbers exceeding MAX_SAFE_INTEGER
+      if (startStr.length > 16 || Number(startStr) > Number.MAX_SAFE_INTEGER) {
+        return { type: 'unsatisfiable', size: safeSize };
+      }
+
+      const start = Number(startStr);
+      let end;
+      if (endStr.length > 16 || Number(endStr) > Number.MAX_SAFE_INTEGER) {
+        end = safeSize > 0 ? safeSize - 1 : 0;
+      } else {
+        end = Number(endStr);
+      }
+
+      // RFC 9110 14.1.2: invalid if last-byte-pos is less than first-byte-pos
+      if (start > end) {
+        return { type: 'malformed' };
+      }
+
+      if (safeSize === 0 || start >= safeSize) {
+        return { type: 'unsatisfiable', size: safeSize };
+      }
+
+      const clampedEnd = Math.min(end, safeSize - 1);
+      return {
+        type: 'range',
+        start,
+        end: clampedEnd,
+        length: clampedEnd - start + 1,
+        size: safeSize,
+      };
+    }
+
+    // Form: start- (open-ended)
+    if (startStr.length > 16 || Number(startStr) > Number.MAX_SAFE_INTEGER) {
+      return { type: 'unsatisfiable', size: safeSize };
+    }
+
+    const start = Number(startStr);
+    if (safeSize === 0 || start >= safeSize) {
+      return { type: 'unsatisfiable', size: safeSize };
+    }
+
+    const end = safeSize - 1;
+    return {
+      type: 'range',
+      start,
+      end,
+      length: end - start + 1,
+      size: safeSize,
+    };
+  }
+
+  // Form: -suffix
+  const suffixStr = match[3];
+  if (suffixStr.length > 16 || Number(suffixStr) > Number.MAX_SAFE_INTEGER) {
+    if (safeSize === 0) return { type: 'unsatisfiable', size: safeSize };
+    return {
+      type: 'range',
+      start: 0,
+      end: safeSize - 1,
+      length: safeSize,
+      size: safeSize,
+    };
+  }
+
+  const suffix = Number(suffixStr);
+  if (suffix === 0 || safeSize === 0) {
+    return { type: 'unsatisfiable', size: safeSize };
+  }
+
+  const start = Math.max(0, safeSize - suffix);
+  const end = safeSize - 1;
+  return {
+    type: 'range',
+    start,
+    end,
+    length: end - start + 1,
+    size: safeSize,
+  };
+}
+
+const HTTP_DATE_REGEX = /^(?:(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT|(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), \d{2}-(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-\d{2} \d{2}:\d{2}:\d{2} GMT|(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?: \d|\d{2}) \d{2}:\d{2}:\d{2} \d{4})$/;
+
+export function checkIfRange(ifRangeHeader, etag, modifiedAt) {
+  if (ifRangeHeader == null || ifRangeHeader === '') {
+    return true;
+  }
+
+  if (typeof ifRangeHeader !== 'string') {
+    return false;
+  }
+
+  const token = ifRangeHeader.trim();
+  // RFC 9110 section 13.1.5: weak entity tags MUST NOT be used for subrange requests
+  if (token.startsWith('W/') || token.startsWith('w/')) {
+    return false;
+  }
+
+  // Strong entity tag
+  if (token.startsWith('"')) {
+    return token === etag;
+  }
+
+  // HTTP-date validator: exact second match per RFC 9110 section 13.1.5 (not <=)
+  // Non-HTTP dates (ISO strings, numeric timestamps, date garbage) are rejected per RFC 9110 section 5.6.7
+  if (!modifiedAt || !HTTP_DATE_REGEX.test(token)) {
+    return false;
+  }
+
+  const parsed = Date.parse(token);
+  if (Number.isNaN(parsed)) {
+    return false;
+  }
+
+  const modDate = modifiedAt instanceof Date ? modifiedAt : new Date(modifiedAt);
+  if (Number.isNaN(modDate.getTime())) {
+    return false;
+  }
+
+  return Math.floor(parsed / 1000) === Math.floor(modDate.getTime() / 1000);
+}
+
+export function evaluateRangeRequest({
+  rangeHeader,
+  ifRangeHeader,
+  size,
+  etag,
+  modifiedAt,
+}) {
+  const safeSize = Number(size);
+
+  if (ifRangeHeader && !checkIfRange(ifRangeHeader, etag, modifiedAt)) {
+    return {
+      status: 200,
+      contentLength: safeSize,
+    };
+  }
+
+  const parsed = parseByteRange(rangeHeader, safeSize);
+  if (parsed.type === 'range') {
+    return {
+      status: 206,
+      start: parsed.start,
+      end: parsed.end,
+      contentLength: parsed.length,
+      contentRange: `bytes ${parsed.start}-${parsed.end}/${safeSize}`,
+    };
+  }
+
+  if (parsed.type === 'unsatisfiable') {
+    return {
+      status: 416,
+      contentLength: 0,
+      contentRange: `bytes */${safeSize}`,
+    };
+  }
+
+  return {
+    status: 200,
+    contentLength: safeSize,
+  };
+}

package/src/extensions/discovery.js

@@ -55,11 +55,20 @@ async function resolveDependencyPackageRoot(rootDir, packageName) {
     }
 
     if (/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i.test(packageName)) {
-      const installedRoot = join(resolve(rootDir), 'node_modules', ...packageName.split('/'));
-      const installedPackagePath = join(installedRoot, 'package.json');
-      if (await exists(installedPackagePath)) {
-        const installedPackage = await readJson(installedPackagePath);
-        if (installedPackage.name === packageName) return installedRoot;
+      const lookupPaths = requireFromProject.resolve.paths(packageName) || [];
+      for (const lookupDir of lookupPaths) {
+        const candidateRoot = join(lookupDir, ...packageName.split('/'));
+        const candidatePackagePath = join(candidateRoot, 'package.json');
+        if (await exists(candidatePackagePath)) {
+          try {
+            const candidatePackage = await readJson(candidatePackagePath);
+            if (candidatePackage?.name === packageName) {
+              return candidateRoot;
+            }
+          } catch {
+            // Keep searching if candidate package.json is unreadable or malformed
+          }
+        }
       }
     }
 

package/src/routes/files.js

@@ -1,5 +1,7 @@
+import { pipeline } from 'node:stream/promises';
 import express from 'express';
 
+import { evaluateRangeRequest } from '../byte-range.js';
 import { serviceOptionsFromRequest } from '../service-options.js';
 
 function filesService(req) {
@@ -36,6 +38,52 @@ function attachmentHeader(filename) {
   return `attachment; filename="${safe.replace(/[^\x20-\x7e]/g, '_')}"; filename*=UTF-8''${encodeURIComponent(safe)}`;
 }
 
+async function pipeStreamToResponse(stream, res) {
+  let upstreamDestroyed = false;
+  const destroyUpstream = () => {
+    if (upstreamDestroyed) return;
+    upstreamDestroyed = true;
+    if (stream && typeof stream.destroy === 'function' && !stream.destroyed) {
+      try {
+        stream.destroy();
+      } catch {}
+    }
+  };
+
+  const onClose = () => {
+    if (!res.writableEnded) {
+      destroyUpstream();
+    }
+  };
+
+  res.on('close', onClose);
+
+  try {
+    await pipeline(stream, res);
+  } catch (error) {
+    destroyUpstream();
+    if (res.headersSent || res.destroyed) {
+      return;
+    }
+    throw error;
+  } finally {
+    res.off('close', onClose);
+    if (!res.writableEnded) {
+      destroyUpstream();
+    }
+  }
+}
+
+function clearFileHeaders(res) {
+  res.removeHeader('accept-ranges');
+  res.removeHeader('content-type');
+  res.removeHeader('content-disposition');
+  res.removeHeader('content-length');
+  res.removeHeader('content-range');
+  res.removeHeader('etag');
+  res.removeHeader('last-modified');
+}
+
 export function createFilesRouter({ maxUploadBytes = 25 * 1024 * 1024 } = {}) {
   const router = express.Router();
   const rawUpload = express.raw({ type: 'application/octet-stream', limit: maxUploadBytes });
@@ -74,12 +122,92 @@ export function createFilesRouter({ maxUploadBytes = 25 * 1024 * 1024 } = {}) {
     res.json({ data });
   });
 
+  router.head('/:id/content', async (req, res) => {
+    const info = await filesService(req).readContentInfo(req.params.id);
+    res.set('etag', info.etag);
+    if (info.modifiedAt) {
+      res.set('last-modified', info.modifiedAt.toUTCString());
+    }
+    res.set('accept-ranges', 'bytes');
+    res.set('content-type', info.file.mimetype || 'application/octet-stream');
+    res.set('content-disposition', attachmentHeader(info.file.filename_download));
+    if (req.fresh) {
+      return res.status(304).end();
+    }
+    res.set('content-length', String(info.size));
+    res.status(200).end();
+  });
+
   router.get('/:id/content', async (req, res) => {
-    const result = await filesService(req).readContent(req.params.id);
-    res.set('content-type', result.file.mimetype || 'application/octet-stream');
-    res.set('content-length', String(result.contents.byteLength));
-    res.set('content-disposition', attachmentHeader(result.file.filename_download));
-    res.send(result.contents);
+    const service = filesService(req);
+    const info = await service.readContentInfo(req.params.id);
+
+    res.set('etag', info.etag);
+    if (info.modifiedAt) {
+      res.set('last-modified', info.modifiedAt.toUTCString());
+    }
+
+    if (req.fresh) {
+      res.set('accept-ranges', 'bytes');
+      res.set('content-type', info.file.mimetype || 'application/octet-stream');
+      res.set('content-disposition', attachmentHeader(info.file.filename_download));
+      return res.status(304).end();
+    }
+
+    if (req.method === 'HEAD') {
+      res.set('accept-ranges', 'bytes');
+      res.set('content-type', info.file.mimetype || 'application/octet-stream');
+      res.set('content-disposition', attachmentHeader(info.file.filename_download));
+      res.set('content-length', String(info.size));
+      return res.status(200).end();
+    }
+
+    const evaluation = evaluateRangeRequest({
+      rangeHeader: req.get('range'),
+      ifRangeHeader: req.get('if-range'),
+      size: info.size,
+      etag: info.etag,
+      modifiedAt: info.modifiedAt,
+    });
+
+    if (evaluation.status === 416) {
+      res.set('accept-ranges', 'bytes');
+      res.set('content-type', info.file.mimetype || 'application/octet-stream');
+      res.set('content-disposition', attachmentHeader(info.file.filename_download));
+      res.set('content-range', evaluation.contentRange);
+      res.set('content-length', '0');
+      return res.status(416).end();
+    }
+
+    let streamResult;
+    try {
+      if (evaluation.status === 206) {
+        streamResult = await service.readContentStream(req.params.id, {
+          start: evaluation.start,
+          end: evaluation.end,
+        });
+      } else {
+        streamResult = await service.readContentStream(req.params.id);
+      }
+    } catch (streamError) {
+      clearFileHeaders(res);
+      throw streamError;
+    }
+
+    res.set('accept-ranges', 'bytes');
+    res.set('content-type', info.file.mimetype || 'application/octet-stream');
+    res.set('content-disposition', attachmentHeader(info.file.filename_download));
+
+    if (evaluation.status === 206) {
+      res.status(206);
+      res.set('content-range', evaluation.contentRange);
+      res.set('content-length', String(evaluation.contentLength));
+      return pipeStreamToResponse(streamResult.stream, res);
+    }
+
+    res.status(200);
+    res.set('content-length', String(info.size));
+    return pipeStreamToResponse(streamResult.stream, res);
   });
 
   router.patch('/:id', async (req, res) => {

package/src/routes/roles.js

@@ -17,7 +17,7 @@ export function createRolesRouter() {
   const router = express.Router();
 
   router.get('/', async (req, res) => {
-    res.json({ data: await rolesService(req).readMany() });
+    res.json({ data: await rolesService(req).readMany(req.query) });
   });
 
   router.post('/', async (req, res) => {

package/src/routes/users.js

@@ -17,7 +17,7 @@ export function createUsersRouter() {
   const router = express.Router();
 
   router.get('/', async (req, res) => {
-    res.json({ data: await usersService(req).readMany() });
+    res.json({ data: await usersService(req).readMany(req.query) });
   });
 
   router.post('/', async (req, res) => {