cursedbelt-server 4.8.0 → 4.9.0

package/dist/server/storage/files/chunkedUpload.d.ts

@@ -35,7 +35,7 @@ export interface ChunkedUploadService {
 /**
  * Mint the direct-to-backend PUT URL for one chunk. The app supplies this so the module stays
  * backend-agnostic. For binary-server: `${base}/upload-chunk/${app}/${key}?token=` with a token
- * carrying { k, uid, sid, ci, tc }.
+ * carrying { k, uid, sid, ci, tc, sz }.
  */
 export type MintChunkUpload = (args: {
     key: string;
@@ -43,6 +43,17 @@ export type MintChunkUpload = (args: {
     ci: number;
     tc: number;
     owner: string;
+    /**
+     * The SOURCE byte length this session was opened with — pass it straight into the token's `sz`
+     * claim (`FileTokenClaims.sz`), which is the only end-to-end integrity check the upload path
+     * has: binary-server compares it to the assembled object and answers 422 instead of indexing a
+     * short one.
+     *
+     * 🔴 `undefined` when the caller could not state a positive length, and then the claim must be
+     * OMITTED rather than sent as `0` — a declared zero refuses every assemble. That is the same
+     * posture the claim itself has: optional, so that declaring it could never take an upload down.
+     */
+    sz?: number;
 }) => Promise<string>;
 export declare function createChunkedUploadService(cfg: {
     catalogue: FileCatalogue;

package/dist/server/storage/files/chunkedUpload.js

@@ -39,7 +39,12 @@ export function createChunkedUploadService(cfg) {
                 tags: req.tags,
                 createdAt: now(),
             });
-            const chunkUploadUrls = await Promise.all(Array.from({ length: chunkCount }, (_, ci) => cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner })));
+            // 🔴 The source length rides along, because `chunkCount` above is derived from it and a
+            // count is not a length: a session that splits the file wrongly stores whatever it sent,
+            // faithfully, with a 201. Omitted rather than zeroed when the caller stated no positive
+            // size — `sz: 0` would refuse every assemble. See `MintChunkUpload.sz`.
+            const declaredSize = Number.isFinite(req.size) && req.size > 0 ? req.size : undefined;
+            const chunkUploadUrls = await Promise.all(Array.from({ length: chunkCount }, (_, ci) => cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner, sz: declaredSize })));
             return { fileId, sid, key, chunkSize, chunkCount, chunkUploadUrls };
         },
         async complete(sid, confirmed) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.8.0",
+	"version": "4.9.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/server/storage/files/chunkedUpload.spec.ts

@@ -39,7 +39,7 @@ describe('chunked upload', () => {
       now: () => ++clock,
     });
     const ledger = createStorageOpsLedger(db, () => ++clock);
-    const minted: Array<{ key: string; sid: string; ci: number; tc: number }> = [];
+    const minted: Array<{ key: string; sid: string; ci: number; tc: number; sz?: number }> = [];
     const svc = createChunkedUploadService({
       catalogue,
       ledger,
@@ -67,6 +67,10 @@ describe('chunked upload', () => {
     expect(init.chunkUploadUrls).toHaveLength(3);
     expect(minted.map((m) => m.ci)).toEqual([0, 1, 2]);
     expect(minted.every((m) => m.tc === 3 && m.sid === init.sid)).toBe(true);
+    // 🔴 The SOURCE length, on every chunk. `tc` is derived from it and a count is not a length:
+    // without this the minter has nothing to put in the token's `sz` claim, and binary-server's
+    // only end-to-end check of the finished object against its source stays inert.
+    expect(minted.map((m) => m.sz)).toEqual([20 * 1024 * 1024, 20 * 1024 * 1024, 20 * 1024 * 1024]);
     // The mint targets exactly the key the catalogue will look for on complete.
     expect(init.key).toBe(catalogueUploadKey('u1', init.fileId, 'image/png'));
 
@@ -78,6 +82,16 @@ describe('chunked upload', () => {
     expect(svc.pending()).toBe(1);
   });
 
+  test('🔴 a size the caller could not state is OMITTED, never declared as zero', async () => {
+    // `sz: 0` would compare zero to the assembled length and refuse every assemble — so an
+    // unknown size degrades to exactly today's behaviour (no claim, recorded undeclared) rather
+    // than to a 422. `chunkCount` still clamps to one chunk, which is the old `req.size || 1`.
+    const { svc, minted } = build();
+    const init = await svc.init(CTX, { name: 'unknown.bin', mime: 'application/octet-stream', size: 0 });
+    expect(init.chunkCount).toBe(1);
+    expect(minted.map((m) => m.sz)).toEqual([undefined]);
+  });
+
   test('complete registers the catalogue row over the assembled bytes + marks the op done', async () => {
     const { catalogue, ledger, svc } = build();
     const init = await svc.init(CTX, {

package/src/server/storage/files/chunkedUpload.ts

@@ -64,7 +64,7 @@ export interface ChunkedUploadService {
 /**
  * Mint the direct-to-backend PUT URL for one chunk. The app supplies this so the module stays
  * backend-agnostic. For binary-server: `${base}/upload-chunk/${app}/${key}?token=` with a token
- * carrying { k, uid, sid, ci, tc }.
+ * carrying { k, uid, sid, ci, tc, sz }.
  */
 export type MintChunkUpload = (args: {
   key: string;
@@ -72,6 +72,17 @@ export type MintChunkUpload = (args: {
   ci: number;
   tc: number;
   owner: string;
+  /**
+   * The SOURCE byte length this session was opened with — pass it straight into the token's `sz`
+   * claim (`FileTokenClaims.sz`), which is the only end-to-end integrity check the upload path
+   * has: binary-server compares it to the assembled object and answers 422 instead of indexing a
+   * short one.
+   *
+   * 🔴 `undefined` when the caller could not state a positive length, and then the claim must be
+   * OMITTED rather than sent as `0` — a declared zero refuses every assemble. That is the same
+   * posture the claim itself has: optional, so that declaring it could never take an upload down.
+   */
+  sz?: number;
 }) => Promise<string>;
 
 export function createChunkedUploadService(cfg: {
@@ -110,9 +121,14 @@ export function createChunkedUploadService(cfg: {
         tags: req.tags,
         createdAt: now(),
       });
+      // 🔴 The source length rides along, because `chunkCount` above is derived from it and a
+      // count is not a length: a session that splits the file wrongly stores whatever it sent,
+      // faithfully, with a 201. Omitted rather than zeroed when the caller stated no positive
+      // size — `sz: 0` would refuse every assemble. See `MintChunkUpload.sz`.
+      const declaredSize = Number.isFinite(req.size) && req.size > 0 ? req.size : undefined;
       const chunkUploadUrls = await Promise.all(
         Array.from({ length: chunkCount }, (_, ci) =>
-          cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner }),
+          cfg.mintChunkUpload({ key, sid, ci, tc: chunkCount, owner, sz: declaredSize }),
         ),
       );
       return { fileId, sid, key, chunkSize, chunkCount, chunkUploadUrls };