cursedbelt-server 3.0.1 → 4.1.0

package/src/server/storage/binaryStoreFake.ts

@@ -0,0 +1,111 @@
+/**
+ * A `BinaryStore` that does nothing, so adding a method to the interface stops
+ * breaking twenty-two test files in apps nobody touched.
+ *
+ * ── The measurement (2026-09-08) ────────────────────────────────────────────
+ * `BinaryStore.fetchMedia` was added to serve audio off this Mac while
+ * Cloudflare's daily Worker quota was spent — a good change, landed on `main`,
+ * with apps/music green. It also broke **apps/collections and apps/roms**, four
+ * test files each, with `Property 'fetchMedia' is missing in type`. Both apps
+ * were left unable to typecheck, and therefore unable to gate or deploy, by a
+ * commit neither of them appears in. Nobody noticed for hours: a worker's
+ * `verify:scoped` only typechecks the workspaces its own diff touches, which is
+ * exactly the property that makes it fast.
+ *
+ * The owner's rule, in his words: *"a change to roms for example cannot block
+ * family tree app from passing its tests."* This is that rule for the one
+ * interface twenty-two suites all fake by hand.
+ *
+ * 🔴 **This is why the fake travels WITH the interface, into this package.** An
+ * interface whose change can break two other apps from a third app's commit is a
+ * shared interface already; a fake living in a different repo from the interface it
+ * fakes cannot do the job it exists for, because the two can be changed
+ * independently. Published as `cursedbelt-server/binary-store/testing`, beside
+ * `cursedbelt-server/binary-store` — the same split as `./d1` and `./d1/testing`, and
+ * for the same reason: a consumer's PRODUCTION graph must not be able to reach a
+ * fake.
+ *
+ * ── 🔴 Why defaults and not optional members ────────────────────────────────
+ * The obvious alternative is to mark each new capability `fetchMedia?:` on the
+ * interface. That moves the cost to every REAL consumer — each one then has to
+ * narrow before calling, for a method the production store always has — and it
+ * makes "did we implement this?" unanswerable by the typechecker, which is the
+ * one question the interface exists to answer. The fakes are the side that
+ * should absorb the change, so the defaults live here.
+ *
+ * ── What a default may do ───────────────────────────────────────────────────
+ * As little as possible, and never something a test could mistake for a result.
+ * `get` and `meta` answer "not here"; `fetchMedia` answers 404; the mutators do
+ * nothing. A suite that cares about any of them overrides it — spread this first
+ * and the file's own members win:
+ *
+ *     const store: BinaryStore = {
+ *       ...binaryStoreFakeDefaults("collections"),
+ *       async meta(key) { … what this suite is actually about … },
+ *     };
+ */
+import type { BinaryStore, FileTokenClaims } from './binaryStore';
+
+/**
+ * Every member of {@link BinaryStore}, inert.
+ *
+ * @param appId the tenant the fake claims to be. Required, and deliberately so —
+ *        a blank tenant is the mistake `binaryStoreTenant` exists to catch, and a
+ *        fake that quietly defaults it would hide a test written against the
+ *        wrong app.
+ */
+export function binaryStoreFakeDefaults(appId: string): BinaryStore {
+  return {
+    appId,
+    async put(): Promise<void> {},
+    async putLarge(): Promise<void> {},
+    async get(): Promise<Uint8Array | null> {
+      return null;
+    },
+    async meta(): Promise<null> {
+      return null;
+    },
+    async stat(): Promise<null> {
+      return null;
+    },
+    async has(): Promise<boolean> {
+      return false;
+    },
+    // 🔴 `"unknown"`, never `"absent"`. A fake that claimed to know a key is missing
+    // would let a listing route's "answer only from the memo" branch look exercised
+    // when nothing was ever memoized — the one thing a test of that branch is for.
+    known(): 'present' | 'absent' | 'unknown' {
+      return 'unknown';
+    },
+    // 🔴 `0`, and never a lie about work done. The real one returns how many
+    // negative memos it dropped, and an app's repair route reports that number to
+    // the owner — a fake that invented one would make a broken repair read as a
+    // working one in the only test that could catch it.
+    forgetMisses(): number {
+      return 0;
+    },
+    cacheStats(): { present: number; absent: number } {
+      return { present: 0, absent: 0 };
+    },
+    async remove(): Promise<void> {},
+    async removePrefix(): Promise<void> {},
+    async mediaUrl(key: string): Promise<string> {
+      // Carries the key, so an assertion on "which object was linked" reads.
+      return `https://binary-server.test/media/${appId}/${key}`;
+    },
+    async mediaPrefixUrl(prefix: string, master: string): Promise<string> {
+      // Carries BOTH, because the bug this shape exists to prevent is signing the wrong
+      // one of them — a URL pointing at the master but scoped to the wrong prefix 403s
+      // every segment while the master itself loads fine.
+      return `https://binary-server.test/media/${appId}/${master}?p=${encodeURIComponent(prefix)}`;
+    },
+    async fetchMedia(): Promise<Response> {
+      // 🔴 404, not an empty 200. A fake that answers "here are zero bytes" makes a
+      // streaming route look like it worked on an object that does not exist.
+      return new Response(null, { status: 404 });
+    },
+    async signToken(_claims: FileTokenClaims, _ttlSeconds: number): Promise<string> {
+      return 'fake-token';
+    },
+  };
+}

package/src/server/storage/fileUploadClient.integration.spec.ts

@@ -1,7 +1,7 @@
 /*
  * Moved from cursedbelt's src/react/media at the 2026-09-15 split: this spec
  * drives the published react-side upload client against this package's storage
- * INTERNALS (diskStore, streamToken, private-media), which are deliberately not
+ * INTERNALS (diskStore, streamToken), which are deliberately not
  * exported — so the spec lives beside them and takes the client half from the
  * published `cursedbelt` instead. Runtime deps stay acyclic; this is dev-only.
  */
@@ -13,8 +13,6 @@ import path from 'node:path';
 import { Hono } from 'hono';
 import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
 import { runMigrations } from '../migration/runner';
-import { generateUserSalt } from '../private-media/crypto';
-import { createUnlockService } from '../private-media/unlock';
 import { createDiskStore } from './diskStore';
 import { createSqliteFileCatalogue } from './files/catalogue';
 import { mountFileRoutes, SINGLE_UPLOAD_TOO_LARGE } from './files/fileRoutes';
@@ -24,11 +22,9 @@ import type { MediaCtx } from './types';
 import { createFileUploadClient } from 'cursedbelt/react/media/upload-client';
 
 // Drives the REAL mountFileRoutes edge — the client and the routes share one header
-// protocol (X-Filename/X-Tags/X-Unlock-Token), so the round-trip is the contract.
+// protocol (X-Filename/X-Tags), so the round-trip is the contract.
 
 const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
-const unlock = createUnlockService({ serverSecret: 'srv', unlockSecret: 'unl' });
-const salt = generateUserSalt();
 
 describe('createFileUploadClient ⇄ mountFileRoutes', () => {
   let db: Database;
@@ -55,10 +51,6 @@ describe('createFileUploadClient ⇄ mountFileRoutes', () => {
       token: createStreamTokenService({ secret: 's' }),
       catalogue,
       authorizeUpload: () => CTX,
-      privateUpload: {
-        unlock,
-        authorize: async () => ({ userId: CTX.userId, userSalt: salt }),
-      },
     });
   });
   afterAll(async () => {
@@ -90,17 +82,6 @@ describe('createFileUploadClient ⇄ mountFileRoutes', () => {
     expect(res.file?.size).toBe('replaced'.length);
   });
 
-  test('uploadPrivate with an unlock token lands an encrypted item', async () => {
-    const { token } = await unlock.unlock({ userId: CTX.userId, userSalt: salt, password: 'pw' });
-    const res = await client.uploadPrivate(
-      new File(['secret-bytes'], 'secret.jpg', { type: 'image/jpeg' }),
-      { unlockToken: token, tags: ['hidden'] },
-    );
-    expect(res.ok).toBe(true);
-    if (!res.ok) return;
-    expect(res.file?.processingStatus).toBe('ready'); // image blob path — no ffmpeg
-  });
-
   test('uploadAuto falls back to the streamed PUT when chunked is unwired (404 init)', async () => {
     const big = new File([new Uint8Array(9 * 1024 * 1024)], 'big.bin', {
       type: 'application/octet-stream',

package/src/server/storage/files/adapter.photo.display.spec.ts

@@ -12,7 +12,7 @@ import { createCataloguePhotoSource } from './adapter';
 import { createSqliteFileCatalogue } from './catalogue';
 import type { FileUrls } from './fileRoutes';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 import { bytesStream } from 'cursedbelt-core/testing';
 
 // End-to-end: an HEIC photo must gain a browser-safe full-size display derivative + advertise it as
@@ -79,7 +79,7 @@ async function heicBytes(): Promise<Uint8Array | null> {
 describe.skipIf(!haveFfmpeg)('photo display derivative (HEIC)', () => {
   let db: Database;
   let root: string;
-  let cat: FileCatalogue & PrivateFileCatalogue;
+  let cat: FileCatalogue;
 
   beforeAll(async () => {
     db = new Database(':memory:');

package/src/server/storage/files/adapter.photo.spec.ts

@@ -11,7 +11,7 @@ import { createCataloguePhotoSource } from './adapter';
 import { createSqliteFileCatalogue } from './catalogue';
 import type { FileUrls } from './fileRoutes';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 
 // The photo source is an image-filtered VIEW over the catalogue: primary bytes via the file
 // route URL, grid thumb via the type-agnostic poster URL (only when the thumbnailer produced one).
@@ -42,7 +42,7 @@ const fakeMediaUrls: MediaUrls = {
 describe('createCataloguePhotoSource', () => {
   let db: Database;
   let root: string;
-  let cat: FileCatalogue & PrivateFileCatalogue;
+  let cat: FileCatalogue;
   let photoId: string;
   let videoId: string;
 

package/src/server/storage/files/adapter.spec.ts

@@ -39,7 +39,6 @@ const videoRecord = (over: Partial<FileRecord> = {}): FileRecord => ({
   size: 10,
   fileType: 'video',
   tags: ['fun'],
-  isPrivate: false,
   favorite: false,
   collectionIds: [],
   hasThumbnail: true,

package/src/server/storage/files/catalogue.media-host.spec.ts

@@ -4,22 +4,15 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { runMigrations } from '../../migration/runner';
-import {
-  cryptBlobStream,
-  derivePasswordSetKey,
-  generateUserSalt,
-  openMeta,
-  unwrapContentKey,
-} from '../../private-media/crypto';
 import { createDiskStore } from '../diskStore';
-import { fsPosterKey, type MediaCtx, type MediaStore, privateSourceKey } from '../types';
+import { fsPosterKey, type MediaCtx, type MediaStore } from '../types';
 import { createSqliteFileCatalogue, fileBinaryKey } from './catalogue';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 import { bytesStream } from 'cursedbelt-core/testing';
 
-// New media-host capabilities: private NON-video blobs (photos), in-place byte replacement
-// (the editor's "overwrite original"), and ingest-time image thumbnails.
+// Media-host capabilities: in-place byte replacement (the editor's "overwrite original") and
+// ingest-time image thumbnails.
 
 const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
 const OWNER = CTX.userId;
@@ -30,7 +23,7 @@ const drain = async (s: ReadableStream<Uint8Array>): Promise<Uint8Array> =>
 let db: Database;
 let root: string;
 let store: MediaStore;
-let cat: FileCatalogue & PrivateFileCatalogue;
+let cat: FileCatalogue;
 
 beforeAll(async () => {
   db = new Database(':memory:');
@@ -51,55 +44,6 @@ afterAll(async () => {
   await rm(root, { recursive: true, force: true });
 });
 
-describe('private blob ingest (non-video)', () => {
-  const salt = generateUserSalt();
-  const setKey = derivePasswordSetKey('photo-pass', salt);
-  const plaintext = new TextEncoder().encode('these are secret photo bytes — not for the feed');
-  let id: string;
-
-  test('ingests an image as a ready, encrypted blob (no ffmpeg involved)', async () => {
-    const item = await cat.ingestPrivate(
-      CTX,
-      { name: 'secret.jpg', mime: 'image/jpeg', body: stream(plaintext), tags: ['hidden'] },
-      { setKey, keyMode: 'deniable' },
-    );
-    id = item.id;
-    expect(item.processingStatus).toBe('ready');
-    expect(item.size).toBe(plaintext.byteLength);
-    expect(item.hasHls).toBe(false);
-  });
-
-  test('stored bytes are ciphertext; the wrapped content key decrypts them', async () => {
-    const stored = await store.get(privateSourceKey(OWNER, id));
-    expect(stored).not.toBeNull();
-    expect(stored?.byteLength).toBe(plaintext.byteLength); // CTR is length-preserving
-    expect(Buffer.from(stored as Uint8Array).equals(Buffer.from(plaintext))).toBe(false);
-
-    const item = await cat.asPrivateIndex().get(OWNER, id);
-    const content = unwrapContentKey(setKey, item?.wrappedContentKey ?? '');
-    expect(content).not.toBeNull();
-    const decrypted = await drain(
-      cryptBlobStream(content as NonNullable<typeof content>, stream(stored as Uint8Array)),
-    );
-    expect(Buffer.from(decrypted).equals(Buffer.from(plaintext))).toBe(true);
-  });
-
-  test('the sealed descriptor reveals name/mime/tags to its set key only', async () => {
-    const item = await cat.asPrivateIndex().get(OWNER, id);
-    const meta = openMeta<{ name: string; mime: string; tags: string[] }>(
-      setKey,
-      item?.sealedMeta ?? '',
-    );
-    expect(meta).toEqual({ name: 'secret.jpg', mime: 'image/jpeg', tags: ['hidden'] });
-    expect(openMeta(derivePasswordSetKey('wrong', salt), item?.sealedMeta ?? '')).toBeNull();
-  });
-
-  test('index.remove wipes the ciphertext blob too', async () => {
-    await cat.asPrivateIndex().remove(OWNER, id);
-    expect(await store.get(privateSourceKey(OWNER, id))).toBeNull();
-  });
-});
-
 describe('replaceContent — overwrite bytes, keep identity', () => {
   let id: string;
   let collectionId: string;
@@ -137,19 +81,10 @@ describe('replaceContent — overwrite bytes, keep identity', () => {
     expect(new TextDecoder().decode(bytes as Uint8Array)).toBe('v2 much longer replacement bytes');
   });
 
-  test('unknown id → null; private rows refuse replacement', async () => {
+  test('unknown id → null', async () => {
     expect(await cat.replaceContent(CTX, 'nope', { mime: 'text/plain', body: stream('x') })).toBe(
       null,
     );
-    const salt = generateUserSalt();
-    const priv = await cat.ingestPrivate(
-      CTX,
-      { name: 'p.jpg', mime: 'image/jpeg', body: stream('p') },
-      { setKey: derivePasswordSetKey('pw', salt), keyMode: 'deniable' },
-    );
-    expect(
-      cat.replaceContent(CTX, priv.id, { mime: 'image/jpeg', body: stream('q') }),
-    ).rejects.toThrow(/private/);
   });
 });
 

package/src/server/storage/files/catalogue.recover.spec.ts

@@ -10,7 +10,8 @@ import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
 import type { FileCatalogue } from './types';
 
 // recoverProcessing (ported from ca's recoverOnBoot): a restart mid-transcode leaves video rows
-// stuck in processing/pending; public rows get re-kicked (source persists), private rows are failed.
+// stuck in processing/pending; they get re-kicked (the source persists) unless the row has already
+// burned its kick budget, in which case it lands on `failed` — see the attempt-cap describe below.
 describe('FileCatalogue.recoverProcessing', () => {
   let db: Database;
   let root: string;
@@ -25,13 +26,11 @@ describe('FileCatalogue.recoverProcessing', () => {
       store: createDiskStore(root),
       workDir: path.join(root, 'w'),
     });
-    // Simulate two rows a crash left mid-transcode: one public, one private.
-    const insert = db.query(
-      `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, created_at, updated_at)
-       VALUES ($id, 'u1', $name, 'video/mp4', 10, 'video', $priv, 'processing', 40, 'disk', 1, 1)`,
-    );
-    insert.run({ $id: 'pub1', $name: 'a.mp4', $priv: 0 });
-    insert.run({ $id: 'prv1', $name: '', $priv: 1 });
+    // Simulate a row a crash left mid-transcode.
+    db.query(
+      `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, created_at, updated_at)
+       VALUES ($id, 'u1', $name, 'video/mp4', 10, 'video', 'processing', 40, 'disk', 1, 1)`,
+    ).run({ $id: 'pub1', $name: 'a.mp4' });
   });
   afterAll(async () => {
     await Bun.sleep(150); // let the re-kicked public job settle before closing the db
@@ -39,18 +38,10 @@ describe('FileCatalogue.recoverProcessing', () => {
     await rm(root, { recursive: true, force: true });
   });
 
-  test('re-queues stuck public videos and fails stuck private ones', () => {
+  test('re-queues stuck videos', () => {
     const res = cat.recoverProcessing();
     expect(res.requeued).toBe(1); // pub1 re-kicked
-    expect(res.failed).toBe(1); // prv1 can't be re-kicked at boot → failed
-
-    const status = (id: string) =>
-      db
-        .query<{ processing_status: string }, { $id: string }>(
-          'SELECT processing_status FROM files WHERE id = $id',
-        )
-        .get({ $id: id })?.processing_status;
-    expect(status('prv1')).toBe('failed');
+    expect(res.failed).toBe(0);
     // pub1 was re-kicked (its final status is settled by the async pipeline; here we just assert it
     // left the recover call counted as requeued, not failed).
   });
@@ -68,7 +59,7 @@ describe('FileCatalogue.recoverProcessing', () => {
 // The boot-loop guard: when the transcode itself keeps killing the process (ffmpeg OOM →
 // restart → re-kick), the attempt cap must land the row on `failed` instead of re-kicking forever.
 describe('FileCatalogue.recoverProcessing attempt cap', () => {
-  test('marks a public video failed once processing_attempts reaches the cap', async () => {
+  test('marks a video failed once processing_attempts reaches the cap', async () => {
     const db = new Database(':memory:');
     runMigrations(db, FILE_CATALOGUE_MIGRATIONS);
     const root = await mkdtemp(path.join(tmpdir(), 'fc-recover-cap-'));
@@ -79,8 +70,8 @@ describe('FileCatalogue.recoverProcessing attempt cap', () => {
       maxProcessingAttempts: 2,
     });
     db.query(
-      `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, processing_attempts, created_at, updated_at)
-       VALUES ('loop1', 'u1', 'l.mp4', 'video/mp4', 10, 'video', 0, 'processing', 40, 'disk', 2, 1, 1)`,
+      `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, processing_attempts, created_at, updated_at)
+       VALUES ('loop1', 'u1', 'l.mp4', 'video/mp4', 10, 'video', 'processing', 40, 'disk', 2, 1, 1)`,
     ).run();
 
     const res = cat.recoverProcessing();
@@ -111,8 +102,8 @@ describe('FileCatalogue transcodeVideos: false', () => {
       transcodeVideos: false,
     });
     db.query(
-      `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, created_at, updated_at)
-       VALUES ('raw1', 'u1', 'r.mp4', 'video/mp4', 10, 'video', 0, 'processing', 40, 'disk', 1, 1)`,
+      `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, created_at, updated_at)
+       VALUES ('raw1', 'u1', 'r.mp4', 'video/mp4', 10, 'video', 'processing', 40, 'disk', 1, 1)`,
     ).run();
 
     const res = cat.recoverProcessing();