deepspace 0.11.0 → 0.13.0

package/dist/server.js

@@ -174,8 +174,54 @@ var BUILT_IN_TOOLS = [
   }
 ];
 
+// src/shared/app-files.ts
+var MAX_APP_FILE_BYTES = 1024 * 1024 * 1024;
+var MAX_UPLOAD_REQUEST_BYTES = 25 * 1024 * 1024;
+var UPLOAD_PART_BYTES = 20 * 1024 * 1024;
+var MAX_UPLOAD_PARTS = Math.ceil(MAX_APP_FILE_BYTES / UPLOAD_PART_BYTES);
+var MAX_BASE64_UPLOAD_BYTES = Math.floor(MAX_UPLOAD_REQUEST_BYTES * 3 / 4);
+var MAX_DEPLOY_ASSET_FILE_BYTES = 25 * 1024 * 1024;
+var DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "image/svg+xml",
+  "application/xml",
+  "text/xml",
+  "application/javascript",
+  "text/javascript",
+  "application/ecmascript",
+  "text/ecmascript"
+]);
+function activeContentMessage(mimeType) {
+  return `${mimeType} is not accepted: the files API serves your app's own origin, so stored HTML/SVG/JavaScript would execute there with your users' sessions. Ship it as a build asset under \`public/\` instead, where it is served as part of your app rather than as user-uploaded content.`;
+}
+function formatBytes(bytes) {
+  if (bytes >= 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GiB`;
+  if (bytes >= 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
+  if (bytes >= 1024) return `${Math.round(bytes / 1024)} KiB`;
+  return `${bytes} B`;
+}
+function encodeKeyPath(key) {
+  return key.split("/").map(encodeURIComponent).join("/");
+}
+function oversizeMessage(bytes, limit = MAX_APP_FILE_BYTES) {
+  return `That file is ${formatBytes(bytes)}; the limit is ${formatBytes(limit)} per file.`;
+}
+function oversizeRequestMessage(bytes) {
+  return `This request carries ${formatBytes(bytes)}; one request may carry ${formatBytes(MAX_UPLOAD_REQUEST_BYTES)}. Files above ${formatBytes(UPLOAD_PART_BYTES)} upload in parts.`;
+}
+function oversizePartMessage(bytes) {
+  return `This part carries ${formatBytes(bytes)}; a part may carry ${formatBytes(UPLOAD_PART_BYTES)} \u2014 the size the upload advertised.`;
+}
+
 // src/server/utils/scoped-r2-files.ts
 var CORS_HEADERS = { "Access-Control-Allow-Origin": "*" };
+function fail(status, error, code, extra) {
+  return Response.json(
+    { error, ...code ? { code } : {}, ...extra },
+    { status, headers: CORS_HEADERS }
+  );
+}
 function contentDisposition(originalName) {
   const safe = originalName.replace(/[^\x20-\x7e]|["\\]/g, "_") || "download";
   const encoded = encodeURIComponent(originalName).replace(
@@ -190,25 +236,89 @@ function sanitizeSubpath(raw) {
   if (segments.some((s) => s === ".." || s === ".")) return null;
   return raw;
 }
-function encodeKeyPath(key) {
-  return key.split("/").map(encodeURIComponent).join("/");
+function overRequestBound(bytes, slack = 0) {
+  if (bytes <= MAX_UPLOAD_REQUEST_BYTES + slack) return null;
+  return fail(413, oversizeRequestMessage(bytes), "too_large", {
+    maxBytes: MAX_UPLOAD_REQUEST_BYTES,
+    partSize: UPLOAD_PART_BYTES
+  });
+}
+function overCeiling(bytes) {
+  if (bytes <= MAX_APP_FILE_BYTES) return null;
+  return fail(413, oversizeMessage(bytes), "too_large", { maxBytes: MAX_APP_FILE_BYTES });
+}
+function overPartBound(bytes) {
+  if (bytes <= UPLOAD_PART_BYTES) return null;
+  return fail(413, oversizePartMessage(bytes), "too_large", { maxBytes: UPLOAD_PART_BYTES });
+}
+function declaredLength(request, what) {
+  const raw = request.headers.get("content-length");
+  const declared = raw === null ? NaN : Number(raw);
+  if (!Number.isSafeInteger(declared) || declared < 0) {
+    return fail(
+      411,
+      `${what} must declare a Content-Length. A chunked or length-less body is refused: R2 cannot size a write it has no length for.`,
+      "length_required"
+    );
+  }
+  return declared;
 }
 function isKeyWithinPrefix(key, prefix) {
   return key.startsWith(prefix);
 }
-var DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
-  "text/html",
-  "application/xhtml+xml",
-  "image/svg+xml",
-  "application/xml",
-  "text/xml",
-  "application/javascript",
-  "text/javascript",
-  "application/ecmascript",
-  "text/ecmascript"
+function anchorKey(raw, prefix) {
+  const safe = sanitizeSubpath(raw);
+  if (safe === null) return fail(400, "Invalid key: traversal not allowed", "invalid_key");
+  if (!safe) return fail(400, "Invalid key: empty", "invalid_key");
+  return { key: `${prefix}${safe}` };
+}
+var VERB_ROUTES = /* @__PURE__ */ new Set([
+  "POST upload",
+  "POST multipart",
+  "DELETE multipart",
+  "PUT multipart/part",
+  "POST multipart/complete"
 ]);
-function normalizeMimeType(raw) {
-  return raw.split(";")[0].trim().toLowerCase();
+function isFilesVerbPath(method, subpath) {
+  return VERB_ROUTES.has(`${method} ${subpath}`);
+}
+function resolveMimeType(raw) {
+  const mimeType = raw.split(";")[0].trim().toLowerCase() || "application/octet-stream";
+  return DANGEROUS_MIME_TYPES.has(mimeType) ? fail(415, activeContentMessage(mimeType), "active_content") : { mimeType };
+}
+function r2ErrorCode(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const match = /\((\d{4,6})\)\s*$/.exec(message.trim());
+  return match ? Number(match[1]) : null;
+}
+function multipartFailure(error) {
+  switch (r2ErrorCode(error)) {
+    case 10024:
+      return fail(
+        404,
+        "That upload does not exist \u2014 it was completed, abandoned, or expired. Start a new one.",
+        "unknown_upload"
+      );
+    case 10011:
+    // EntityTooSmall
+    case 10025:
+    // InvalidPart — a named part was never uploaded
+    case 10048:
+      return fail(
+        400,
+        "The parts do not assemble: every part except the last must be exactly the size the upload advertised, and each must be uploaded before it is named.",
+        "bad_parts"
+      );
+    case 10012:
+    // MetadataTooLarge
+    case 10020:
+      return fail(400, "The upload names a key or metadata R2 will not accept.", "invalid_key");
+    default: {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error("[files:multipart] R2 error:", message);
+      return fail(503, "The files service could not complete that upload. Retry shortly.", "r2_error");
+    }
+  }
 }
 function createScopedR2Handler(config) {
   const requireAuthForMutations = config.requireAuthForMutations ?? true;
@@ -240,14 +350,12 @@ function createScopedR2Handler(config) {
       return Response.json({ error: errorMsg }, { status, headers: CORS_HEADERS });
     }
     const prefix = result.prefix;
-    if (subpath === "upload" && request.method === "POST") {
+    if (isFilesVerbPath(request.method, subpath)) {
       if (requireAuthForMutations && !auth.userId) {
-        return Response.json(
-          { error: "Authentication required" },
-          { status: 401, headers: CORS_HEADERS }
-        );
+        await request.body?.cancel().catch(() => void 0);
+        return fail(401, "Authentication required", "unauthorized");
       }
-      return handleUpload(request, url, bucket, prefix, auth.userId, scope);
+      return subpath === "upload" ? handleUpload(request, url, bucket, prefix, auth.userId, scope) : handleMultipart(request, url, bucket, prefix, auth.userId, scope, subpath);
     }
     if (!subpath && request.method === "GET") {
       return handleList(bucket, prefix, url, scope);
@@ -274,87 +382,250 @@ function createScopedR2Handler(config) {
           { status: 403, headers: CORS_HEADERS }
         );
       }
-      await bucket.delete(subpath);
-      return Response.json({ success: true, deleted: subpath }, { headers: CORS_HEADERS });
+      const existed = await bucket.head(subpath) !== null;
+      if (existed) await bucket.delete(subpath);
+      return Response.json(
+        { success: true, deleted: existed ? subpath : null, existed },
+        { headers: CORS_HEADERS }
+      );
     }
     return Response.json({ error: "Method not allowed" }, { status: 405, headers: CORS_HEADERS });
   };
 }
 async function handleUpload(request, url, bucket, prefix, userId, scope) {
   try {
+    const declared = overRequestBound(Number(request.headers.get("content-length")), 8 * 1024);
+    if (declared) return declared;
     const contentType = request.headers.get("content-type") || "";
     let fileData;
     let fileName;
-    let mimeType;
+    let rawMimeType;
     if (contentType.includes("multipart/form-data")) {
       const formData = await request.formData();
       const file = formData.get("file");
-      if (!file) {
-        return Response.json({ error: "No file provided" }, { status: 400, headers: CORS_HEADERS });
-      }
+      if (!file) return fail(400, "No file provided", "bad_request");
+      const tooBig = overRequestBound(file.size);
+      if (tooBig) return tooBig;
       fileData = await file.arrayBuffer();
       fileName = formData.get("name")?.toString() || file.name;
-      mimeType = file.type || "application/octet-stream";
+      rawMimeType = file.type || "application/octet-stream";
     } else {
       const body = await request.json();
-      if (!body.data || !body.name) {
-        return Response.json(
-          { error: "Missing data or name" },
-          { status: 400, headers: CORS_HEADERS }
-        );
-      }
+      if (!body.data || !body.name) return fail(400, "Missing data or name", "bad_request");
       const base64Data = body.data.replace(/^data:[^;]+;base64,/, "");
+      const tooBig = overRequestBound(Math.floor(base64Data.length * 3 / 4));
+      if (tooBig) return tooBig;
       fileData = Uint8Array.from(atob(base64Data), (c) => c.charCodeAt(0)).buffer;
       fileName = body.name;
-      mimeType = body.mimeType || "application/octet-stream";
-    }
-    mimeType = normalizeMimeType(mimeType) || "application/octet-stream";
-    if (DANGEROUS_MIME_TYPES.has(mimeType)) {
-      return Response.json(
-        { error: `Unsupported media type: ${mimeType}` },
-        { status: 415, headers: CORS_HEADERS }
-      );
-    }
-    const requestedKey = url.searchParams.get("key");
-    let key;
-    if (requestedKey !== null) {
-      const safe = sanitizeSubpath(requestedKey);
-      if (safe === null) {
-        return Response.json(
-          { error: "Invalid key: traversal not allowed" },
-          { status: 400, headers: CORS_HEADERS }
-        );
-      }
-      if (!safe) {
-        return Response.json(
-          { error: "Invalid key: empty" },
-          { status: 400, headers: CORS_HEADERS }
-        );
-      }
-      key = `${prefix}${safe}`;
-    } else {
-      const fileKey = `${Date.now()}-${Math.random().toString(36).slice(2, 11)}-${fileName}`;
-      key = `${prefix}${fileKey}`;
-    }
-    await bucket.put(key, fileData, {
-      httpMetadata: { contentType: mimeType },
-      customMetadata: {
-        originalName: fileName,
-        ...userId ? { uploadedBy: userId } : {},
-        uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
-      }
+      rawMimeType = body.mimeType || "application/octet-stream";
+    }
+    const mime = resolveMimeType(rawMimeType);
+    if (mime instanceof Response) return mime;
+    const located = locateUpload(url, prefix, fileName);
+    if (located instanceof Response) return located;
+    await bucket.put(located.key, fileData, {
+      httpMetadata: { contentType: mime.mimeType },
+      customMetadata: fileMetadata(fileName, userId)
     });
-    const fileUrl = new URL(`/api/files/${encodeKeyPath(key)}`, url.origin);
-    fileUrl.searchParams.set("scope", scope);
-    return Response.json(
-      { success: true, key, url: fileUrl.toString(), name: fileName },
-      { headers: CORS_HEADERS }
-    );
+    return storedFileJson(located.key, fileName, url, scope);
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Upload failed";
     console.error("[handleUpload] Error:", msg, err instanceof Error ? err.stack : "");
-    return Response.json({ error: msg }, { status: 500, headers: CORS_HEADERS });
+    return fail(500, msg, "upload_failed");
+  }
+}
+function locateUpload(url, prefix, fileName) {
+  const requested = url.searchParams.get("key");
+  const subkey = requested ?? `${Date.now()}-${Math.random().toString(36).slice(2, 11)}-${fileName}`;
+  const anchored = anchorKey(subkey, prefix);
+  return anchored instanceof Response ? anchored : { key: anchored.key, subkey };
+}
+function fileMetadata(fileName, userId) {
+  return {
+    originalName: fileName,
+    ...userId ? { uploadedBy: userId } : {},
+    uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function storedFileJson(key, name, url, scope) {
+  const fileUrl = new URL(`/api/files/${encodeKeyPath(key)}`, url.origin);
+  fileUrl.searchParams.set("scope", scope);
+  return Response.json(
+    { success: true, key, url: fileUrl.toString(), name },
+    { headers: CORS_HEADERS }
+  );
+}
+var MAX_CONTROL_BODY_BYTES = 64 * 1024;
+async function readControlJson(request) {
+  const declared = declaredLength(request, "This request");
+  if (declared instanceof Response) return declared;
+  if (declared > MAX_CONTROL_BODY_BYTES) {
+    return fail(413, `Request body exceeds ${MAX_CONTROL_BODY_BYTES} bytes`, "too_large");
+  }
+  let parsed;
+  try {
+    parsed = await request.json();
+  } catch {
+    return fail(400, "Body must be JSON", "bad_request");
+  }
+  return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : fail(400, "Body must be a JSON object", "bad_request");
+}
+function resolveSession(url, prefix) {
+  const uploadKey = url.searchParams.get("uploadKey");
+  const uploadId = url.searchParams.get("uploadId");
+  if (!uploadKey || !uploadId) {
+    return fail(400, "uploadKey and uploadId are required", "bad_request");
+  }
+  const anchored = anchorKey(uploadKey, prefix);
+  return anchored instanceof Response ? anchored : { key: anchored.key, uploadId };
+}
+async function streamPart(upload, partNumber, body, expectedBytes) {
+  let observedBytes = 0;
+  const sized = new FixedLengthStream(expectedBytes);
+  const pumped = body.pipeThrough(
+    new TransformStream({
+      transform(chunk, controller) {
+        observedBytes += chunk.byteLength;
+        controller.enqueue(chunk);
+      }
+    })
+  ).pipeTo(sized.writable);
+  const [uploaded, drained] = await Promise.allSettled([
+    upload.uploadPart(partNumber, sized.readable),
+    pumped
+  ]);
+  if (uploaded.status === "rejected" || drained.status === "rejected") {
+    const reason = uploaded.status === "rejected" ? uploaded.reason : drained.reason;
+    return { ok: false, lengthMismatch: observedBytes !== expectedBytes, error: reason };
+  }
+  return { ok: true, part: uploaded.value };
+}
+async function handleMultipart(request, url, bucket, prefix, userId, scope, subpath) {
+  if (subpath === "multipart" && request.method === "POST") {
+    return multipartInit(request, url, bucket, prefix, userId);
+  }
+  if (subpath === "multipart/part") return multipartPart(request, url, bucket, prefix);
+  if (subpath === "multipart/complete") {
+    return multipartComplete(request, url, bucket, prefix, scope);
+  }
+  return multipartAbort(url, bucket, prefix);
+}
+async function multipartInit(request, url, bucket, prefix, userId) {
+  const body = await readControlJson(request);
+  if (body instanceof Response) return body;
+  const size = body.size;
+  if (!Number.isSafeInteger(size) || size < 0) {
+    return fail(400, "size must be a non-negative integer number of bytes", "bad_request");
+  }
+  const tooBig = overCeiling(size);
+  if (tooBig) return tooBig;
+  const name = typeof body.name === "string" ? body.name.trim() : "";
+  if (!name) return fail(400, "name is required", "bad_request");
+  const mime = resolveMimeType(typeof body.mimeType === "string" ? body.mimeType : "");
+  if (mime instanceof Response) return mime;
+  const located = locateUpload(url, prefix, name);
+  if (located instanceof Response) return located;
+  let upload;
+  try {
+    upload = await bucket.createMultipartUpload(located.key, {
+      httpMetadata: { contentType: mime.mimeType },
+      customMetadata: fileMetadata(name, userId)
+    });
+  } catch (error) {
+    return multipartFailure(error);
+  }
+  return Response.json(
+    {
+      uploadId: upload.uploadId,
+      // Echoed back on every later call. Relative to the app, exactly like
+      // `?key=`, so the mount that anchors keys anchors this one too.
+      uploadKey: located.subkey,
+      partSize: UPLOAD_PART_BYTES,
+      maxParts: MAX_UPLOAD_PARTS,
+      maxBytes: MAX_APP_FILE_BYTES
+    },
+    { headers: CORS_HEADERS }
+  );
+}
+async function multipartPart(request, url, bucket, prefix) {
+  const refuse = async (response) => {
+    await request.body?.cancel().catch(() => void 0);
+    return response;
+  };
+  const declaredBytes = declaredLength(request, "Part uploads");
+  if (declaredBytes instanceof Response) return refuse(declaredBytes);
+  const tooBig = overPartBound(declaredBytes);
+  if (tooBig) return refuse(tooBig);
+  const partNumber = Number(url.searchParams.get("partNumber"));
+  if (!Number.isSafeInteger(partNumber) || partNumber < 1 || partNumber > MAX_UPLOAD_PARTS) {
+    return refuse(
+      fail(400, `partNumber must be a whole number from 1 to ${MAX_UPLOAD_PARTS}`, "bad_request")
+    );
+  }
+  const session = resolveSession(url, prefix);
+  if (session instanceof Response) return refuse(session);
+  if (!request.body) return fail(400, "A part body is required", "bad_request");
+  const upload = bucket.resumeMultipartUpload(session.key, session.uploadId);
+  const stored = await streamPart(upload, partNumber, request.body, declaredBytes);
+  if (!stored.ok) {
+    return stored.lengthMismatch ? fail(
+      400,
+      `Part ${partNumber} declared ${declaredBytes} bytes but its body did not carry them`,
+      "bad_request"
+    ) : multipartFailure(stored.error);
+  }
+  return Response.json(
+    { partNumber: stored.part.partNumber, etag: stored.part.etag },
+    { headers: CORS_HEADERS }
+  );
+}
+async function multipartComplete(request, url, bucket, prefix, scope) {
+  const body = await readControlJson(request);
+  if (body instanceof Response) return body;
+  const session = resolveSession(url, prefix);
+  if (session instanceof Response) return session;
+  const raw = body.parts;
+  if (!Array.isArray(raw) || raw.length === 0) {
+    return fail(400, "parts must be a non-empty array", "bad_request");
+  }
+  if (raw.length > MAX_UPLOAD_PARTS) {
+    return fail(400, `An upload may have at most ${MAX_UPLOAD_PARTS} parts`, "bad_request");
+  }
+  const parts = [];
+  for (let index = 0; index < raw.length; index++) {
+    const { partNumber, etag } = raw[index] ?? {};
+    if (!Number.isSafeInteger(partNumber) || partNumber < 1) {
+      return fail(400, `parts[${index}].partNumber must be a positive integer`, "bad_request");
+    }
+    if (typeof etag !== "string" || !etag) {
+      return fail(400, `parts[${index}].etag must be the string uploadPart returned`, "bad_request");
+    }
+    parts.push({ partNumber, etag });
+  }
+  let object;
+  try {
+    object = await bucket.resumeMultipartUpload(session.key, session.uploadId).complete(parts);
+  } catch (error) {
+    return multipartFailure(error);
+  }
+  const tooBig = overCeiling(object.size);
+  if (tooBig) {
+    await bucket.delete(session.key).catch(() => void 0);
+    return tooBig;
+  }
+  const name = object.customMetadata?.originalName ?? session.key.split("/").pop() ?? "file";
+  return storedFileJson(session.key, name, url, scope);
+}
+async function multipartAbort(url, bucket, prefix) {
+  const session = resolveSession(url, prefix);
+  if (session instanceof Response) return session;
+  try {
+    await bucket.resumeMultipartUpload(session.key, session.uploadId).abort();
+  } catch (error) {
+    console.error("[files:multipart] abort:", error instanceof Error ? error.message : error);
+    return Response.json({ success: true, aborted: false }, { headers: CORS_HEADERS });
   }
+  return Response.json({ success: true, aborted: true }, { headers: CORS_HEADERS });
 }
 async function handleList(bucket, prefix, url, scope) {
   const userPrefix = url.searchParams.get("prefix") || "";
@@ -7662,6 +7933,10 @@ export {
   GLOBAL_DO_TYPE_NAMES,
   GameRoom,
   JobRoom,
+  MAX_APP_FILE_BYTES,
+  MAX_DEPLOY_ASSET_FILE_BYTES,
+  MAX_UPLOAD_PARTS,
+  MAX_UPLOAD_REQUEST_BYTES,
   MESSAGES_SCHEMA,
   PresenceRoom,
   REACTIONS_SCHEMA,
@@ -7680,6 +7955,7 @@ export {
   SubscriptionAuthError,
   SubscriptionRequiredError,
   TEST_ACCOUNT_EMAIL_SUFFIX,
+  UPLOAD_PART_BYTES,
   USERS_COLUMNS,
   VOTING_SCHEMAS,
   WORKSPACE_SCHEMAS,
@@ -7722,6 +7998,7 @@ export {
   deleteRecord,
   enqueueJob,
   executeQuery,
+  formatBytes,
   getAllUsers,
   getChat,
   getGlobalDOSchemas,
@@ -7745,6 +8022,7 @@ export {
   handleYjsJoin,
   handleYjsLeave,
   isAutoProvision,
+  isFilesVerbPath,
   isOwner,
   isTestAccountClaims,
   isTestAccountEmail,