digitaltwin-core 0.8.3 → 0.9.1

package/dist/components/assets_manager.js

@@ -132,6 +132,51 @@ export class AssetsManager {
         // Check if the filename ends with the required extension (case-insensitive)
         return filename.toLowerCase().endsWith(requiredExtension.toLowerCase());
     }
+    /**
+     * Validates that a string is valid base64-encoded data.
+     *
+     * Used internally to ensure file data in batch uploads is properly base64-encoded
+     * before attempting to decode it.
+     *
+     * @private
+     * @param {any} data - Data to validate as base64
+     * @returns {boolean} True if data is a valid base64 string, false otherwise
+     *
+     * @example
+     * ```typescript
+     * this.validateBase64('SGVsbG8gV29ybGQ=') // returns true
+     * this.validateBase64('not-base64!@#') // returns false
+     * this.validateBase64(123) // returns false (not a string)
+     * this.validateBase64('') // returns false (empty string)
+     * ```
+     */
+    validateBase64(data) {
+        // Must be a non-empty string
+        if (typeof data !== 'string' || data.length === 0) {
+            return false;
+        }
+        // Base64 regex: only A-Z, a-z, 0-9, +, /, and = for padding
+        // Padding (=) can only appear at the end, max 2 times
+        const base64Regex = /^[A-Za-z0-9+/]+={0,2}$/;
+        const trimmed = data.trim();
+        // Must match regex
+        if (!base64Regex.test(trimmed)) {
+            return false;
+        }
+        // Length must be multiple of 4
+        if (trimmed.length % 4 !== 0) {
+            return false;
+        }
+        // Try to decode to verify it's valid base64
+        try {
+            const decoded = Buffer.from(trimmed, 'base64').toString('base64');
+            // Re-encode and compare to ensure no data loss (valid base64)
+            return decoded === trimmed;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Upload a new asset file with metadata.
      *
@@ -148,7 +193,8 @@ export class AssetsManager {
      *   source: 'https://city-data.example.com/buildings',
      *   owner_id: 'user123',
      *   filename: 'building.glb',
-     *   file: fileBuffer
+     *   file: fileBuffer,
+     *   is_public: true
      * })
      * ```
      */
@@ -173,7 +219,8 @@ export class AssetsManager {
             description: request.description,
             source: request.source,
             owner_id: request.owner_id,
-            filename: request.filename
+            filename: request.filename,
+            is_public: request.is_public ?? true // Default to public if not specified
         };
         await this.db.save(metadata);
     }
@@ -183,15 +230,61 @@ export class AssetsManager {
      * Returns a JSON list of all assets with their metadata, following the
      * framework pattern but adapted for assets management.
      *
+     * Access control:
+     * - Unauthenticated users: Can only see public assets
+     * - Authenticated users: Can see public assets + their own private assets
+     * - Admin users: Can see all assets (public and private from all users)
+     *
      * @returns {Promise<DataResponse>} JSON response with all assets
      */
-    async retrieve() {
+    async retrieve(req) {
         try {
             const assets = await this.getAllAssets();
             const config = this.getConfiguration();
+            // Check if user is admin (admins can see everything)
+            const isAdmin = req && ApisixAuthParser.isAdmin(req.headers || {});
+            // If admin, skip filtering and return all assets
+            if (isAdmin) {
+                const assetsWithMetadata = assets.map(asset => ({
+                    id: asset.id,
+                    name: asset.name,
+                    date: asset.date,
+                    contentType: asset.contentType,
+                    description: asset.description || '',
+                    source: asset.source || '',
+                    owner_id: asset.owner_id || null,
+                    filename: asset.filename || '',
+                    is_public: asset.is_public ?? true,
+                    url: `/${config.name}/${asset.id}`,
+                    download_url: `/${config.name}/${asset.id}/download`
+                }));
+                return {
+                    status: 200,
+                    content: JSON.stringify(assetsWithMetadata),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
+            // For non-admin users, check authentication and ownership
+            let authenticatedUserId = null;
+            if (req && ApisixAuthParser.hasValidAuth(req.headers || {})) {
+                const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+                if (authUser) {
+                    const userRecord = await this.userService.findOrCreateUser(authUser);
+                    authenticatedUserId = userRecord.id || null;
+                }
+            }
+            // Filter assets based on visibility and ownership
+            const visibleAssets = assets.filter(asset => {
+                // Public assets are visible to everyone
+                if (asset.is_public) {
+                    return true;
+                }
+                // Private assets are only visible to the owner
+                return authenticatedUserId !== null && asset.owner_id === authenticatedUserId;
+            });
             // Transform to include asset metadata and user-friendly URLs
             // Note: assets are already sorted by date desc from DB query
-            const assetsWithMetadata = assets.map(asset => ({
+            const assetsWithMetadata = visibleAssets.map(asset => ({
                 id: asset.id,
                 name: asset.name,
                 date: asset.date,
@@ -201,6 +294,7 @@ export class AssetsManager {
                 source: asset.source || '',
                 owner_id: asset.owner_id || null,
                 filename: asset.filename || '',
+                is_public: asset.is_public ?? true,
                 // Add URLs that the front-end can actually use
                 url: `/${config.name}/${asset.id}`, // For display/use
                 download_url: `/${config.name}/${asset.id}/download` // For download
@@ -264,7 +358,7 @@ export class AssetsManager {
     /**
      * Update asset metadata by ID.
      *
-     * Updates the metadata (description and/or source) of a specific asset.
+     * Updates the metadata (description, source, and/or visibility) of a specific asset.
      * Asset metadata is stored as dedicated columns in the database.
      *
      * @param {string} id - The ID of the asset to update
@@ -275,7 +369,8 @@ export class AssetsManager {
      * ```typescript
      * await assetsManager.updateAssetMetadata('123', {
      *   description: 'Updated building model with new textures',
-     *   source: 'https://updated-source.example.com'
+     *   source: 'https://updated-source.example.com',
+     *   is_public: false
      * })
      * ```
      */
@@ -302,7 +397,8 @@ export class AssetsManager {
             description: updates.description ?? record.description ?? '',
             source: updates.source ?? record.source ?? '',
             owner_id: record.owner_id ?? null,
-            filename: record.filename ?? ''
+            filename: record.filename ?? '',
+            is_public: updates.is_public !== undefined ? updates.is_public : (record.is_public ?? true)
         };
         // Update the record - delete and re-create with updated metadata
         await this.db.delete(id, this.getConfiguration().name);
@@ -393,7 +489,8 @@ export class AssetsManager {
                 description: request.description,
                 source: request.source,
                 owner_id: request.owner_id,
-                filename: request.filename
+                filename: request.filename,
+                is_public: request.is_public ?? true
             };
             metadataList.push(metadata);
         }
@@ -491,10 +588,37 @@ export class AssetsManager {
         ];
     }
     /**
-     * Handle upload endpoint
+     * Handle single asset upload via HTTP POST.
+     *
+     * Flow:
+     * 1. Validate request structure and authentication
+     * 2. Extract user identity from Apache APISIX headers
+     * 3. Validate file extension and read uploaded file
+     * 4. Store file via storage service and metadata in database
+     * 5. Set owner_id to authenticated user (prevents ownership spoofing)
+     * 6. Apply is_public setting (defaults to true if not specified)
+     *
+     * Authentication: Required
+     * Ownership: Automatically set to authenticated user
+     *
+     * @param req - HTTP request with multipart/form-data file upload
+     * @returns HTTP response with success/error status
+     *
+     * @example
+     * POST /assets
+     * Content-Type: multipart/form-data
+     * x-user-id: user-uuid
+     * x-user-roles: user,premium
+     *
+     * Form data:
+     * - file: <binary file>
+     * - description: "3D model of building"
+     * - source: "https://source.com"
+     * - is_public: true
      */
     async handleUpload(req) {
         try {
+            // Validate request structure
             if (!req || !req.body) {
                 return {
                     status: 400,
@@ -504,7 +628,7 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
-            // Check authentication
+            // Step 1: Verify user is authenticated via Apache APISIX headers
             if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
                 return {
                     status: 401,
@@ -514,7 +638,7 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
-            // Parse authenticated user
+            // Step 2: Extract user identity from APISIX headers (x-user-id, x-user-roles)
             const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
             if (!authUser) {
                 return {
@@ -525,11 +649,22 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
-            // Find or create user in database
+            // Step 3: Find or create user record in database and sync roles from Keycloak
             const userRecord = await this.userService.findOrCreateUser(authUser);
-            const { description, source } = req.body;
+            if (!userRecord.id) {
+                return {
+                    status: 500,
+                    content: JSON.stringify({
+                        error: 'Failed to retrieve user information'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
+            // Step 4: Extract form data from multipart upload
+            const { description, source, is_public } = req.body;
             const filePath = req.file?.path;
             const filename = req.file?.originalname || req.body.filename;
+            // Step 5: Validate required fields are present
             if (!filePath || !description || !source) {
                 return {
                     status: 400,
@@ -579,7 +714,8 @@ export class AssetsManager {
                     source,
                     owner_id: userRecord.id,
                     filename,
-                    file: fileBuffer
+                    file: fileBuffer,
+                    is_public: is_public !== undefined ? Boolean(is_public) : true
                 });
                 // Clean up temporary file after successful upload
                 await fs.unlink(filePath).catch(() => {
@@ -654,7 +790,7 @@ export class AssetsManager {
                 };
             }
             const { id } = req.params || {};
-            const { description, source } = req.body || {};
+            const { description, source, is_public } = req.body || {};
             if (!id) {
                 return {
                     status: 400,
@@ -664,17 +800,26 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
-            if (!description && !source) {
+            if (!description && !source && is_public === undefined) {
                 return {
                     status: 400,
                     content: JSON.stringify({
-                        error: 'At least one field (description or source) must be provided for update'
+                        error: 'At least one field (description, source, or is_public) must be provided for update'
                     }),
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
             // Find or create user in database
             const userRecord = await this.userService.findOrCreateUser(authUser);
+            if (!userRecord.id) {
+                return {
+                    status: 500,
+                    content: JSON.stringify({
+                        error: 'Failed to retrieve user information'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
             // Check if asset exists and belongs to this user
             const asset = await this.getAssetById(id);
             if (!asset) {
@@ -701,6 +846,8 @@ export class AssetsManager {
                 updates.description = description;
             if (source !== undefined)
                 updates.source = source;
+            if (is_public !== undefined)
+                updates.is_public = Boolean(is_public);
             await this.updateAssetMetadata(id, updates);
             return {
                 status: 200,
@@ -724,6 +871,11 @@ export class AssetsManager {
      * Returns the file content of a specific asset by ID for display/use in front-end.
      * No download headers - just the raw file content.
      *
+     * Access control:
+     * - Public assets: Accessible to everyone
+     * - Private assets: Accessible only to owner
+     * - Admin users: Can access all assets (public and private)
+     *
      * @param {any} req - HTTP request object with params.id
      * @returns {Promise<DataResponse>} HTTP response with file content
      *
@@ -762,6 +914,42 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'text/plain' }
                 };
             }
+            // Check if user is admin (admins can access everything)
+            const isAdmin = ApisixAuthParser.isAdmin(req.headers || {});
+            // Check visibility: if private and user is not admin, verify ownership
+            if (!asset.is_public && !isAdmin) {
+                // Asset is private, require authentication
+                if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
+                    return {
+                        status: 401,
+                        content: JSON.stringify({
+                            error: 'Authentication required for private assets'
+                        }),
+                        headers: { 'Content-Type': 'application/json' }
+                    };
+                }
+                // Verify ownership
+                const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+                if (!authUser) {
+                    return {
+                        status: 401,
+                        content: JSON.stringify({
+                            error: 'Invalid authentication headers'
+                        }),
+                        headers: { 'Content-Type': 'application/json' }
+                    };
+                }
+                const userRecord = await this.userService.findOrCreateUser(authUser);
+                if (!userRecord.id || asset.owner_id !== userRecord.id) {
+                    return {
+                        status: 403,
+                        content: JSON.stringify({
+                            error: 'This asset is private'
+                        }),
+                        headers: { 'Content-Type': 'application/json' }
+                    };
+                }
+            }
             // Get the file content
             const fileContent = await asset.data();
             return {
@@ -789,6 +977,11 @@ export class AssetsManager {
      * Downloads the file content of a specific asset by ID with download headers.
      * Forces browser to download the file rather than display it.
      *
+     * Access control:
+     * - Public assets: Accessible to everyone
+     * - Private assets: Accessible only to owner
+     * - Admin users: Can download all assets (public and private)
+     *
      * @param {any} req - HTTP request object with params.id
      * @returns {Promise<DataResponse>} HTTP response with file content and download headers
      *
@@ -827,6 +1020,42 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'text/plain' }
                 };
             }
+            // Check if user is admin (admins can download everything)
+            const isAdmin = ApisixAuthParser.isAdmin(req.headers || {});
+            // Check visibility: if private and user is not admin, verify ownership
+            if (!asset.is_public && !isAdmin) {
+                // Asset is private, require authentication
+                if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
+                    return {
+                        status: 401,
+                        content: JSON.stringify({
+                            error: 'Authentication required for private assets'
+                        }),
+                        headers: { 'Content-Type': 'application/json' }
+                    };
+                }
+                // Verify ownership
+                const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+                if (!authUser) {
+                    return {
+                        status: 401,
+                        content: JSON.stringify({
+                            error: 'Invalid authentication headers'
+                        }),
+                        headers: { 'Content-Type': 'application/json' }
+                    };
+                }
+                const userRecord = await this.userService.findOrCreateUser(authUser);
+                if (!userRecord.id || asset.owner_id !== userRecord.id) {
+                    return {
+                        status: 403,
+                        content: JSON.stringify({
+                            error: 'This asset is private'
+                        }),
+                        headers: { 'Content-Type': 'application/json' }
+                    };
+                }
+            }
             // Get the file content
             const fileContent = await asset.data();
             // Get original filename from asset metadata
@@ -898,6 +1127,15 @@ export class AssetsManager {
             }
             // Find or create user in database
             const userRecord = await this.userService.findOrCreateUser(authUser);
+            if (!userRecord.id) {
+                return {
+                    status: 500,
+                    content: JSON.stringify({
+                        error: 'Failed to retrieve user information'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
             // Check if asset exists and belongs to this user
             const asset = await this.getAssetById(id);
             if (!asset) {
@@ -950,6 +1188,38 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
+            // Check authentication
+            if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
+                return {
+                    status: 401,
+                    content: JSON.stringify({
+                        error: 'Authentication required'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
+            // Parse authenticated user
+            const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+            if (!authUser) {
+                return {
+                    status: 401,
+                    content: JSON.stringify({
+                        error: 'Invalid authentication headers'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
+            // Find or create user in database
+            const userRecord = await this.userService.findOrCreateUser(authUser);
+            if (!userRecord.id) {
+                return {
+                    status: 500,
+                    content: JSON.stringify({
+                        error: 'Failed to retrieve user information'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
             const requests = req.body.requests;
             if (!Array.isArray(requests) || requests.length === 0) {
                 return {
@@ -960,7 +1230,7 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
-            // Validate all requests first (including extensions)
+            // Validate all requests first (including extensions and base64 format)
             for (const request of requests) {
                 if (!request.file || !request.description || !request.source || !request.filename) {
                     return {
@@ -971,6 +1241,16 @@ export class AssetsManager {
                         headers: { 'Content-Type': 'application/json' }
                     };
                 }
+                // Validate that file is valid base64 string
+                if (!this.validateBase64(request.file)) {
+                    return {
+                        status: 400,
+                        content: JSON.stringify({
+                            error: `Invalid base64 data for file: ${request.filename}. File must be a valid base64-encoded string.`
+                        }),
+                        headers: { 'Content-Type': 'application/json' }
+                    };
+                }
                 // Validate file extension for each request
                 if (!this.validateFileExtension(request.filename)) {
                     const config = this.getConfiguration();
@@ -990,9 +1270,10 @@ export class AssetsManager {
                     await this.uploadAsset({
                         description: request.description,
                         source: request.source,
-                        owner_id: request.owner_id || null,
+                        owner_id: userRecord.id,
                         filename: request.filename,
-                        file: Buffer.from(request.file, 'base64') // Assuming base64 encoded
+                        file: Buffer.from(request.file, 'base64'), // Already validated as base64 above
+                        is_public: request.is_public !== undefined ? Boolean(request.is_public) : true
                     });
                     results.push({ success: true, filename: request.filename });
                 }
@@ -1039,6 +1320,38 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
+            // Check authentication
+            if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
+                return {
+                    status: 401,
+                    content: JSON.stringify({
+                        error: 'Authentication required'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
+            // Parse authenticated user
+            const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+            if (!authUser) {
+                return {
+                    status: 401,
+                    content: JSON.stringify({
+                        error: 'Invalid authentication headers'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
+            // Find or create user in database
+            const userRecord = await this.userService.findOrCreateUser(authUser);
+            if (!userRecord.id) {
+                return {
+                    status: 500,
+                    content: JSON.stringify({
+                        error: 'Failed to retrieve user information'
+                    }),
+                    headers: { 'Content-Type': 'application/json' }
+                };
+            }
             const { ids } = req.body;
             if (!Array.isArray(ids) || ids.length === 0) {
                 return {
@@ -1049,10 +1362,29 @@ export class AssetsManager {
                     headers: { 'Content-Type': 'application/json' }
                 };
             }
-            // Process deletions individually with error handling
+            // Process deletions individually with error handling and ownership checks
             const results = [];
             for (const id of ids) {
                 try {
+                    // Check if asset exists and belongs to this user
+                    const asset = await this.getAssetById(id);
+                    if (!asset) {
+                        results.push({
+                            success: false,
+                            id,
+                            error: 'Asset not found'
+                        });
+                        continue;
+                    }
+                    // Check ownership (only owner can delete their assets)
+                    if (asset.owner_id !== userRecord.id) {
+                        results.push({
+                            success: false,
+                            id,
+                            error: 'You can only delete your own assets'
+                        });
+                        continue;
+                    }
                     await this.deleteAssetById(id);
                     results.push({ success: true, id });
                 }