cabloy 5.1.102 → 5.1.103

package/vona/src/suite-vendor/a-image/modules/image-native/src/service/imageNative.ts

@@ -1,21 +1,18 @@
 import type { SharpConstructor } from 'sharp';
 import type {
   EntityImage,
-  IImageDeliveryOptions,
-  IImageDirectUploadInput,
-  IImageProviderDirectUploadResource,
+  IImageProviderDeliveryOptions,
   IImageProviderResolvedVariant,
   IImageProviderResource,
   IImageTransformOptions,
   IImageUploadInput,
   IImageVariantRequest,
 } from 'vona-module-a-image';
-import type { IUploadFile } from 'vona-module-a-upload';
 
 import fse from 'fs-extra';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
-import { BeanBase, uuidv4 } from 'vona';
+import { BeanBase, getRuntimePathPhysicalRoot, uuidv4 } from 'vona';
 import { Service } from 'vona-module-a-bean';
 import { resolveImageVariantRequestToTransform } from 'vona-module-a-image';
 
@@ -23,21 +20,7 @@ import type { IImageProviderNativeClientOptions } from '../bean/imageProvider.na
 
 type IImageNativeStoredImage = Pick<
   EntityImage,
-  'resourceId' | 'filename' | 'storagePath' | 'variants'
->;
-
-type IImageNativeDraftImage = Pick<
-  EntityImage,
-  | 'resourceId'
-  | 'filename'
-  | 'contentType'
-  | 'meta'
-  | 'imageScene'
-  | 'requireSignedURLs'
-  | 'storagePath'
-  | 'deliveryBaseUrl'
-  | 'variants'
-  | 'clientName'
+  'id' | 'resourceId' | 'filename' | 'contentType' | 'public' | 'storagePath' | 'variants'
 >;
 
 @Service()
@@ -56,80 +39,24 @@ export class ServiceImageNative extends BeanBase {
     options: IImageProviderNativeClientOptions,
   ): Promise<IImageProviderResource> {
     const resourceId = uuidv4();
-    const targetPath = await this._getFinalPath(resourceId, input.filename, options, input.file);
-    await fse.copy(input.file, targetPath);
-    return await this._buildStoredResource(targetPath, {
+    const isPublic = input.public ?? options.public;
+    const targetPath = await this._getFinalPath(
       resourceId,
-      filename: input.filename,
-      contentType: input.contentType,
-      meta: input.meta,
-      requireSignedURLs: input.requireSignedURLs ?? options.requireSignedURLs,
-      variants: options.variants ?? this.scope.config.imageNative.variants,
-      deliveryBaseUrl: options.deliveryBaseUrl,
-    });
-  }
-
-  async createDirectUpload(
-    input: IImageDirectUploadInput,
-    options: IImageProviderNativeClientOptions,
-  ): Promise<IImageProviderDirectUploadResource> {
-    const resourceId = this._sanitizeResourceId(input.customId) ?? uuidv4();
-    const storagePath = await this._getFinalPath(resourceId, input.filename, options);
-    const routePath = this.scope.util.combineApiPath(
-      `image-native/direct-upload/${encodeURIComponent(resourceId)}`,
-      false,
-      true,
+      input.filename,
+      isPublic,
+      options,
+      input.file,
     );
-    const tokenPath = this.scope.util.combineApiPath(
-      'image-native/direct-upload/:resourceId',
-      false,
-      true,
-    );
-    const tokenPayload = await this.bean.imageUploadPolicy.createDirectUploadToken({
-      resourceId,
-      path: tokenPath,
-    });
-    const uploadUrl = new URL(this.app.util.getAbsoluteUrlByApiPath(routePath));
-    uploadUrl.searchParams.set('token', tokenPayload.token);
-    return {
+    await fse.ensureDir(path.dirname(targetPath));
+    await fse.copy(input.file, targetPath);
+    return await this._buildStoredResource(targetPath, {
       resourceId,
       filename: input.filename,
       contentType: input.contentType,
       meta: input.meta,
-      requireSignedURLs: input.requireSignedURLs ?? options.requireSignedURLs,
+      public: isPublic,
       variants: options.variants ?? this.scope.config.imageNative.variants,
       deliveryBaseUrl: options.deliveryBaseUrl,
-      storagePath,
-      uploadUrl: uploadUrl.toString(),
-      draft: true,
-    };
-  }
-
-  async uploadDirectFile(image: IImageNativeDraftImage, file: IUploadFile) {
-    const draftPath = this._getDraftPath(image.storagePath, image.resourceId);
-    await fse.ensureDir(path.dirname(draftPath));
-    await fse.move(file.file, draftPath, { overwrite: true });
-    return draftPath;
-  }
-
-  async finalizeDirectUpload(
-    image: IImageNativeDraftImage,
-    options: IImageProviderNativeClientOptions,
-  ): Promise<IImageProviderResource | undefined> {
-    const storagePath =
-      image.storagePath ?? (await this._getFinalPath(image.resourceId, image.filename, options));
-    const draftPath = this._getDraftPath(storagePath, image.resourceId);
-    if (!(await fse.pathExists(draftPath))) return undefined;
-    await fse.ensureDir(path.dirname(storagePath));
-    await fse.move(draftPath, storagePath, { overwrite: true });
-    return await this._buildStoredResource(storagePath, {
-      resourceId: image.resourceId,
-      filename: image.filename,
-      contentType: image.contentType,
-      meta: image.meta,
-      requireSignedURLs: image.requireSignedURLs ?? options.requireSignedURLs,
-      variants: image.variants ?? options.variants ?? this.scope.config.imageNative.variants,
-      deliveryBaseUrl: image.deliveryBaseUrl ?? options.deliveryBaseUrl,
     });
   }
 
@@ -137,8 +64,6 @@ export class ServiceImageNative extends BeanBase {
     if (!image.storagePath) return;
     const dir = path.dirname(image.storagePath);
     if (!(await fse.pathExists(dir))) return;
-    const draftPath = this._getDraftPath(image.storagePath, image.resourceId);
-    await fse.remove(draftPath);
     const entries = await fse.readdir(dir);
     await Promise.all(
       entries
@@ -154,8 +79,13 @@ export class ServiceImageNative extends BeanBase {
     image: IImageNativeStoredImage,
     request: IImageVariantRequest,
     options: IImageProviderNativeClientOptions,
-    _deliveryOptions?: IImageDeliveryOptions,
+    _deliveryOptions?: IImageProviderDeliveryOptions,
   ) {
+    if (!(image.public ?? options.public)) {
+      throw new Error(
+        `Private image-native variant URL requires signed delivery: ${image.resourceId}`,
+      );
+    }
     const resolved = resolveImageVariantRequestToTransform(request, 'original', image.variants);
     if (
       resolved.variantName === 'original' &&
@@ -167,6 +97,34 @@ export class ServiceImageNative extends BeanBase {
     return await this._buildUrl(targetPath, options.deliveryBaseUrl);
   }
 
+  async downloadBuffer(
+    image: IImageNativeStoredImage,
+    request: IImageVariantRequest,
+  ): Promise<{
+    buffer: Buffer;
+    filename?: string;
+    contentType?: string;
+  } | null> {
+    if (!image.storagePath) {
+      throw new Error(`Image storage path missing: ${image.resourceId}`);
+    }
+    const resolved = resolveImageVariantRequestToTransform(request, 'original', image.variants);
+    const targetPath =
+      resolved.variantName === 'original' && this._isOriginalTransform(resolved.transformOptions)
+        ? image.storagePath
+        : await this._ensureVariantFile(image, resolved);
+    if (!(await fse.pathExists(targetPath))) return null;
+    return {
+      buffer: await fse.readFile(targetPath),
+      filename: image.filename,
+      contentType: this._resolveContentType(
+        targetPath,
+        image.contentType,
+        resolved.transformOptions,
+      ),
+    };
+  }
+
   private async _buildStoredResource(
     targetPath: string,
     data: {
@@ -174,7 +132,7 @@ export class ServiceImageNative extends BeanBase {
       filename?: string;
       contentType?: string;
       meta?: Record<string, unknown>;
-      requireSignedURLs?: boolean;
+      public?: boolean;
       variants?: EntityImage['variants'];
       deliveryBaseUrl?: string;
     },
@@ -189,7 +147,7 @@ export class ServiceImageNative extends BeanBase {
       size: Number(stat.size),
       width: metadata.width,
       height: metadata.height,
-      requireSignedURLs: data.requireSignedURLs,
+      public: data.public,
       variants: data.variants,
       meta: data.meta,
       storagePath: targetPath,
@@ -200,24 +158,34 @@ export class ServiceImageNative extends BeanBase {
   private async _getFinalPath(
     resourceId: string,
     filename: string | undefined,
+    isPublic: boolean | undefined,
     options: IImageProviderNativeClientOptions,
     filePath?: string,
   ) {
-    const publicPath = await this.app.util.getPublicPathPhysical(
-      path.join('image-native', options.subdir ?? 'default'),
-      true,
-    );
+    const basePath = await this._getBasePath(isPublic, options);
     const ext = this._getOriginalExt(filename, filePath ?? resourceId);
-    return path.join(publicPath, `${resourceId}${ext}`);
+    return path.join(basePath, `${resourceId}${ext}`);
   }
 
-  private _getDraftPath(storagePath: string | undefined, resourceId: string) {
-    if (!storagePath) {
-      throw new Error(`Image storage path missing: ${resourceId}`);
+  private async _getBasePath(
+    isPublic: boolean | undefined,
+    options: IImageProviderNativeClientOptions,
+  ) {
+    if (isPublic) {
+      return await this.app.util.getPublicPathPhysical(
+        path.join('image-native', options.subdir ?? 'default'),
+        true,
+      );
     }
-    const dir = path.dirname(storagePath);
-    const ext = path.extname(storagePath) || '.bin';
-    return path.join(dir, `${resourceId}__draft${ext}`);
+    const runtimeRoot = getRuntimePathPhysicalRoot(this.app);
+    const basePath = path.join(
+      runtimeRoot,
+      this.ctx.instance.id.toString(),
+      'image-native',
+      options.subdir ?? 'default',
+    );
+    await fse.ensureDir(basePath);
+    return basePath;
   }
 
   private async _ensureVariantFile(
@@ -308,8 +276,15 @@ export class ServiceImageNative extends BeanBase {
 
   private async _getVariantStaticPath(targetPath: string) {
     const publicRoot = await this.app.util.getPublicPathPhysical(undefined, true);
-    const relativePath = path.relative(publicRoot, targetPath).split(path.sep).join(path.posix.sep);
-    return path.posix.join('public', this.ctx.instance.id.toString(), relativePath);
+    const relativePath = path.relative(publicRoot, targetPath);
+    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+      throw new Error(`Image target path is not publicly accessible: ${targetPath}`);
+    }
+    return path.posix.join(
+      'public',
+      this.ctx.instance.id.toString(),
+      relativePath.split(path.sep).join(path.posix.sep),
+    );
   }
 
   private async _getVariantAbsolutePath(
@@ -323,8 +298,8 @@ export class ServiceImageNative extends BeanBase {
       const variantName = this._sanitizeVariantName(resolved.variantName);
       return path.join(dir, `${image.resourceId}__${variantName}${ext}`);
     }
-    const cacheKey = this._buildTransformCacheKey(resolved.transformOptions);
-    return path.join(dir, `${image.resourceId}__t_${cacheKey}${ext}`);
+    const transformKey = this._buildTransformKey(resolved.transformOptions);
+    return path.join(dir, `${image.resourceId}__t_${transformKey}${ext}`);
   }
 
   private _getVariantExt(
@@ -348,7 +323,25 @@ export class ServiceImageNative extends BeanBase {
     return format === 'jpeg' ? 'jpeg' : format;
   }
 
-  private _buildTransformCacheKey(transformOptions: IImageTransformOptions) {
+  private _resolveContentType(
+    targetPath: string,
+    contentType: string | undefined,
+    transformOptions: IImageTransformOptions,
+  ) {
+    const format = this._normalizeFormat(transformOptions.format);
+    if (format === 'jpeg') return 'image/jpeg';
+    if (format === 'png') return 'image/png';
+    if (format === 'webp') return 'image/webp';
+    if (format === 'avif') return 'image/avif';
+    const ext = path.extname(targetPath).toLowerCase();
+    if (ext === '.jpg' || ext === '.jpeg') return 'image/jpeg';
+    if (ext === '.png') return 'image/png';
+    if (ext === '.webp') return 'image/webp';
+    if (ext === '.avif') return 'image/avif';
+    return contentType;
+  }
+
+  private _buildTransformKey(transformOptions: IImageTransformOptions) {
     const stable = this._stableStringify(transformOptions);
     return createHash('sha1').update(stable).digest('hex').slice(0, 12);
   }
@@ -368,12 +361,6 @@ export class ServiceImageNative extends BeanBase {
     return JSON.stringify(value);
   }
 
-  private _sanitizeResourceId(resourceId: string | undefined) {
-    if (!resourceId) return undefined;
-    const sanitized = resourceId.replace(/[^\w.-]/g, '-');
-    return sanitized || undefined;
-  }
-
   private _sanitizeVariantName(variantName: string) {
     return variantName.replace(/[^\w.-]/g, '-');
   }

package/vona/src/suite-vendor/a-image/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-image",
-  "version": "5.0.5",
+  "version": "5.0.6",
   "description": "",
   "author": "",
   "files": [],

package/vona/src/suite-vendor/a-vona/modules/a-jwt/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-jwt",
-  "version": "5.1.15",
+  "version": "5.1.16",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-jwt/src/config/config.ts

@@ -1,5 +1,7 @@
 import type { VonaApplication } from 'vona';
 
+import { $protocolKey } from 'vona';
+
 import type { ConfigJwt } from '../types/jwt.ts';
 
 export function config(app: VonaApplication) {
@@ -15,7 +17,7 @@ export function config(app: VonaApplication) {
         header: '',
         headerAuth: 'authorization',
         headerAuthScheme: 'bearer',
-        query: 'auth_token',
+        query: $protocolKey('x-vona-passport-code'),
       },
     },
     tempAuthToken: {

package/vona/src/suite-vendor/a-vona/modules/a-jwt/src/service/jwtClient.ts

@@ -67,7 +67,9 @@ export class ServiceJwtClient extends BeanBase {
         [this.fieldClient]: this._clientName,
         [this.fieldData]: payloadData,
       };
-      if (options?.path) payload[this.fieldPath] = options.path;
+      if (options?.path) {
+        payload[this.fieldPath] = options.path;
+      }
       let signOptions = this._clientOptions.signOptions;
       if (options?.dev) {
         signOptions = Object.assign({}, signOptions, {
@@ -123,8 +125,9 @@ export class ServiceJwtClient extends BeanBase {
           // check field client
           if (payload[this.fieldClient] !== this._clientName) return this.app.throw(401);
           // check field path
-          if (!this._checkVerifyPath(payload[this.fieldPath], options?.path))
+          if (!this._checkVerifyPath(payload[this.fieldPath], options?.path)) {
             return this.app.throw(401);
+          }
           // passed
           resolve(payload[this.fieldData]);
         },
@@ -135,7 +138,9 @@ export class ServiceJwtClient extends BeanBase {
   _checkVerifyPath(pathTarget: string | string[] | undefined, pathReal: string | undefined) {
     if (!pathTarget) return true;
     const path = pathReal ?? String(this.ctx.route.routePathRaw);
-    if (Array.isArray(pathTarget) && !pathTarget.includes(path)) return false;
-    return pathTarget === path;
+    const targets = Array.isArray(pathTarget) ? pathTarget : [pathTarget];
+    return (
+      targets.every(target => typeof target === 'string') && targets.some(target => target === path)
+    );
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-upload/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-upload",
-  "version": "5.1.14",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-upload/src/bean/interceptor.upload.ts

@@ -28,9 +28,7 @@ export class InterceptorUpload extends BeanBase implements IInterceptorExecute {
       res = await next();
     } finally {
       // delete temp files
-      for (const fileCleanup of filesCleanup) {
-        fileCleanup();
-      }
+      this._cleanupFiles(filesCleanup);
       this.ctx[SymbolUploadValue] = undefined;
     }
     // ok
@@ -45,81 +43,132 @@ export class InterceptorUpload extends BeanBase implements IInterceptorExecute {
       const files: IUploadFile[] = [];
       const filesCleanup: Function[] = [];
       const fileWrites: Promise<void>[] = [];
+      const fileStreams: any[] = [];
+      const writeStreams: ReturnType<typeof createWriteStream>[] = [];
+      let bb: any;
       let settled = false;
       const rejectOnce = (err: Error) => {
         if (settled) return;
         settled = true;
+        for (const file of fileStreams) {
+          file.unpipe();
+          file.resume();
+        }
+        for (const writeStream of writeStreams) {
+          writeStream.destroy();
+        }
+        try {
+          this.ctx.req.unpipe(bb);
+          bb?.destroy();
+          this.ctx.req.resume();
+        } catch {
+          // ignore cleanup errors and preserve the receive error
+        }
+        this._cleanupFiles(filesCleanup);
         reject(err);
       };
-      // bb
-      const bb = Busboy(
-        Object.assign({ defParamCharset: 'utf8' }, options.busboy, {
-          headers: this.ctx.req.headers,
-        }),
-      );
-      bb.on('file', (name, file, info) => {
-        // temp
-        const fileTempObj = tmp.fileSync({
-          prefix: '.temp-upload-',
-        });
-        const fileTemp = fileTempObj.name;
-        filesCleanup.push(fileTempObj.removeCallback);
-        files.push({
-          name,
-          file: fileTemp,
-          info,
-        });
-        // save
-        const writeStream = createWriteStream(fileTemp);
-        const fileWrite = new Promise<void>((resolveWrite, rejectWrite) => {
-          writeStream.on('finish', () => {
-            resolveWrite();
-          });
-          writeStream.on('error', err => {
-            rejectWrite(err);
+      try {
+        // bb
+        bb = Busboy(
+          Object.assign({ defParamCharset: 'utf8' }, options.busboy, {
+            headers: this.ctx.req.headers,
+          }),
+        );
+        bb.on('file', (name, file, info) => {
+          if (settled) {
+            file.resume();
+            return;
+          }
+          fileStreams.push(file);
+          let fileTempObj: tmp.FileResult;
+          try {
+            fileTempObj = tmp.fileSync({
+              prefix: '.temp-upload-',
+            });
+          } catch (err) {
+            file.resume();
+            rejectOnce(err as Error);
+            return;
+          }
+          const fileTemp = fileTempObj.name;
+          filesCleanup.push(fileTempObj.removeCallback);
+          files.push({
+            name,
+            file: fileTemp,
+            info,
           });
-          file.on('error', err => {
-            rejectWrite(err);
+          // save
+          const writeStream = createWriteStream(fileTemp);
+          writeStreams.push(writeStream);
+          const fileWrite = new Promise<void>(resolveWrite => {
+            const complete = () => resolveWrite();
+            writeStream.on('finish', complete);
+            writeStream.on('error', err => {
+              rejectOnce(err);
+              complete();
+            });
+            file.on('error', err => {
+              rejectOnce(err);
+              complete();
+            });
+            file.on('limit', () => {
+              rejectOnce(this._createLimitError());
+              complete();
+            });
           });
+          fileWrites.push(fileWrite);
+          file.pipe(writeStream);
         });
-        fileWrites.push(
-          fileWrite.catch(err => {
-            rejectOnce(err as Error);
-            throw err;
-          }),
-        );
-        file.pipe(writeStream);
-      });
-      bb.on('field', (name, value, info) => {
-        fields.push({
-          name,
-          value,
-          info,
+        bb.on('field', (name, value, info) => {
+          if (info.nameTruncated || info.valueTruncated) {
+            rejectOnce(this._createLimitError());
+            return;
+          }
+          fields.push({
+            name,
+            value,
+            info,
+          });
         });
-      });
-      bb.on('close', async () => {
-        try {
+        bb.on('close', async () => {
           await Promise.all(fileWrites);
           if (settled) return;
           settled = true;
           resolve([fields, files, filesCleanup]);
-        } catch {
-          // handled by rejectOnce
-        }
-      });
-      bb.on('error', (err: Error) => {
-        rejectOnce(err);
-      });
-      bb.on('partsLimit', () => {
-        rejectOnce(new Error('partsLimit'));
-      });
-      bb.on('filesLimit', () => {
-        rejectOnce(new Error('filesLimit'));
-      });
-      bb.on('fieldsLimit', () => {
-        rejectOnce(new Error('fieldsLimit'));
-      });
-      this.ctx.req.pipe(bb);
+        });
+        bb.on('error', (err: Error) => {
+          rejectOnce(err);
+        });
+        bb.on('partsLimit', () => {
+          rejectOnce(this._createLimitError());
+        });
+        bb.on('filesLimit', () => {
+          rejectOnce(this._createLimitError());
+        });
+        bb.on('fieldsLimit', () => {
+          rejectOnce(this._createLimitError());
+        });
+        this.ctx.req.pipe(bb);
+      } catch (err) {
+        rejectOnce(err as Error);
+      }
     });
   }
+
+  private _cleanupFiles(filesCleanup: Function[]) {
+    for (const fileCleanup of filesCleanup) {
+      try {
+        fileCleanup();
+      } catch {
+        // try every cleanup callback without masking the primary error
+      }
+    }
+  }
+
+  private _createLimitError() {
+    const err: any = new Error('upload limit exceeded');
+    err.status = 413;
+    err.code = 413;
+    return err as Error;
+  }
 }

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.65",
+  "version": "5.1.66",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/packages-zova/zova/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova",
-  "version": "5.1.132",
+  "version": "5.1.133",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A vue3 framework with ioc",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "zova-core": "^5.1.77",
-    "zova-suite-a-zova": "^5.1.131"
+    "zova-suite-a-zova": "^5.1.132"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",