digitaltwin-core 0.9.0 → 0.9.2

package/dist/components/assets_manager.js

@@ -1,5 +1,6 @@
 import { ApisixAuthParser } from '../auth/apisix_parser.js';
 import { UserService } from '../auth/user_service.js';
+import { successResponse, errorResponse, badRequestResponse, unauthorizedResponse, forbiddenResponse, notFoundResponse, textResponse, fileResponse, multiStatusResponse, HttpStatus } from '../utils/http_responses.js';
 import fs from 'fs/promises';
 /**
  * Abstract base class for Assets Manager components with authentication and access control.
@@ -65,17 +66,23 @@ export class AssetsManager {
      *
      * @param {DatabaseAdapter} db - The database adapter for metadata storage
      * @param {StorageService} storage - The storage service for file persistence
+     * @param {UserService} [userService] - Optional user service for authentication (created automatically if not provided)
      *
      * @example
      * ```typescript
+     * // Standard usage (UserService created automatically)
      * const assetsManager = new MyAssetsManager()
      * assetsManager.setDependencies(databaseAdapter, storageService)
+     *
+     * // For testing (inject mock UserService)
+     * const mockUserService = new MockUserService()
+     * assetsManager.setDependencies(databaseAdapter, storageService, mockUserService)
      * ```
      */
-    setDependencies(db, storage) {
+    setDependencies(db, storage, userService) {
         this.db = db;
         this.storage = storage;
-        this.userService = new UserService(db);
+        this.userService = userService ?? new UserService(db);
     }
     /**
      * Validates that a source string is a valid URL.
@@ -132,6 +139,237 @@ export class AssetsManager {
         // Check if the filename ends with the required extension (case-insensitive)
         return filename.toLowerCase().endsWith(requiredExtension.toLowerCase());
     }
+    /**
+     * Validates that a string is valid base64-encoded data.
+     *
+     * Used internally to ensure file data in batch uploads is properly base64-encoded
+     * before attempting to decode it.
+     *
+     * @private
+     * @param {any} data - Data to validate as base64
+     * @returns {boolean} True if data is a valid base64 string, false otherwise
+     *
+     * @example
+     * ```typescript
+     * this.validateBase64('SGVsbG8gV29ybGQ=') // returns true
+     * this.validateBase64('not-base64!@#') // returns false
+     * this.validateBase64(123) // returns false (not a string)
+     * this.validateBase64('') // returns false (empty string)
+     * ```
+     */
+    validateBase64(data) {
+        // Must be a non-empty string
+        if (typeof data !== 'string' || data.length === 0) {
+            return false;
+        }
+        // Base64 regex: only A-Z, a-z, 0-9, +, /, and = for padding
+        // Padding (=) can only appear at the end, max 2 times
+        const base64Regex = /^[A-Za-z0-9+/]+={0,2}$/;
+        const trimmed = data.trim();
+        // Must match regex
+        if (!base64Regex.test(trimmed)) {
+            return false;
+        }
+        // Length must be multiple of 4
+        if (trimmed.length % 4 !== 0) {
+            return false;
+        }
+        // Try to decode to verify it's valid base64
+        try {
+            const decoded = Buffer.from(trimmed, 'base64').toString('base64');
+            // Re-encode and compare to ensure no data loss (valid base64)
+            return decoded === trimmed;
+        }
+        catch {
+            return false;
+        }
+    }
+    // ============================================================================
+    // Authentication & Request Processing Helpers
+    // ============================================================================
+    /**
+     * Authenticates a request and returns the user record.
+     *
+     * This method consolidates the authentication flow:
+     * 1. Validates APISIX headers are present
+     * 2. Parses authentication headers
+     * 3. Finds or creates user record in database
+     *
+     * @param req - HTTP request object
+     * @returns AuthResult with either userRecord on success or DataResponse on failure
+     *
+     * @example
+     * ```typescript
+     * const authResult = await this.authenticateRequest(req)
+     * if (!authResult.success) {
+     *     return authResult.response
+     * }
+     * const userRecord = authResult.userRecord
+     * ```
+     */
+    async authenticateRequest(req) {
+        if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
+            return { success: false, response: unauthorizedResponse() };
+        }
+        const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+        if (!authUser) {
+            return { success: false, response: unauthorizedResponse('Invalid authentication headers') };
+        }
+        const userRecord = await this.userService.findOrCreateUser(authUser);
+        if (!userRecord.id) {
+            return { success: false, response: errorResponse('Failed to retrieve user information') };
+        }
+        return { success: true, userRecord };
+    }
+    /**
+     * Extracts upload data from multipart form request.
+     *
+     * @param req - HTTP request object with body and file
+     * @returns UploadData object with extracted fields
+     */
+    extractUploadData(req) {
+        return {
+            description: req.body?.description,
+            source: req.body?.source,
+            is_public: req.body?.is_public,
+            filePath: req.file?.path,
+            filename: req.file?.originalname || req.body?.filename
+        };
+    }
+    /**
+     * Validates required fields for asset upload and returns validated data.
+     *
+     * @param data - Upload data to validate
+     * @returns UploadValidationResult with validated data on success or error response on failure
+     */
+    validateUploadFields(data) {
+        if (!data.filePath || !data.description || !data.source) {
+            return {
+                success: false,
+                response: badRequestResponse('Missing required fields: description, source, file')
+            };
+        }
+        if (!data.filename) {
+            return {
+                success: false,
+                response: badRequestResponse('Filename could not be determined from uploaded file')
+            };
+        }
+        if (!this.validateFileExtension(data.filename)) {
+            const config = this.getConfiguration();
+            return {
+                success: false,
+                response: badRequestResponse(`Invalid file extension. Expected: ${config.extension}`)
+            };
+        }
+        return {
+            success: true,
+            data: {
+                description: data.description,
+                source: data.source,
+                filePath: data.filePath,
+                filename: data.filename,
+                is_public: data.is_public !== undefined ? Boolean(data.is_public) : true
+            }
+        };
+    }
+    /**
+     * Reads file content from temporary upload path.
+     *
+     * @param filePath - Path to temporary file
+     * @returns Buffer with file content
+     * @throws Error if file cannot be read
+     */
+    async readTempFile(filePath) {
+        return fs.readFile(filePath);
+    }
+    /**
+     * Cleans up temporary file after processing.
+     * Silently ignores cleanup errors.
+     *
+     * @param filePath - Path to temporary file
+     */
+    async cleanupTempFile(filePath) {
+        await fs.unlink(filePath).catch(() => {
+            // Ignore cleanup errors
+        });
+    }
+    /**
+     * Validates ownership of an asset.
+     *
+     * @param asset - Asset record to check
+     * @param userId - User ID to validate against
+     * @returns DataResponse with error if not owner, undefined if valid
+     */
+    validateOwnership(asset, userId) {
+        if (asset.owner_id !== userId) {
+            return forbiddenResponse('You can only modify your own assets');
+        }
+        return undefined;
+    }
+    /**
+     * Checks if a user can access a private asset.
+     *
+     * @param asset - Asset record to check
+     * @param req - HTTP request for authentication context
+     * @returns DataResponse with error if access denied, undefined if allowed
+     */
+    async checkPrivateAssetAccess(asset, req) {
+        // Public assets are always accessible
+        if (asset.is_public) {
+            return undefined;
+        }
+        // Admins can access everything
+        if (ApisixAuthParser.isAdmin(req.headers || {})) {
+            return undefined;
+        }
+        // Private asset - require authentication
+        if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
+            return unauthorizedResponse('Authentication required for private assets');
+        }
+        const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+        if (!authUser) {
+            return unauthorizedResponse('Invalid authentication headers');
+        }
+        const userRecord = await this.userService.findOrCreateUser(authUser);
+        if (!userRecord.id || asset.owner_id !== userRecord.id) {
+            return forbiddenResponse('This asset is private');
+        }
+        return undefined;
+    }
+    /**
+     * Fetches an asset by ID with full access control validation.
+     *
+     * This method consolidates the common logic for retrieving an asset:
+     * 1. Validates that ID is provided
+     * 2. Fetches the asset from database
+     * 3. Verifies the asset belongs to this component
+     * 4. Checks access permissions for private assets
+     *
+     * @param req - HTTP request with params.id
+     * @returns Object with asset on success, or DataResponse on failure
+     */
+    async fetchAssetWithAccessCheck(req) {
+        const { id } = req.params || {};
+        if (!id) {
+            return { success: false, response: badRequestResponse('Asset ID is required') };
+        }
+        const asset = await this.getAssetById(id);
+        if (!asset) {
+            return { success: false, response: textResponse(HttpStatus.NOT_FOUND, 'Asset not found') };
+        }
+        // Verify this asset belongs to our component
+        const config = this.getConfiguration();
+        if (asset.name !== config.name) {
+            return { success: false, response: textResponse(HttpStatus.NOT_FOUND, 'Asset not found') };
+        }
+        // Check access permissions for private assets
+        const accessError = await this.checkPrivateAssetAccess(asset, req);
+        if (accessError) {
+            return { success: false, response: accessError };
+        }
+        return { success: true, asset };
+    }
     /**
      * Upload a new asset file with metadata.
      *
@@ -148,7 +386,8 @@ export class AssetsManager {
      *   source: 'https://city-data.example.com/buildings',
      *   owner_id: 'user123',
      *   filename: 'building.glb',
-     *   file: fileBuffer
+     *   file: fileBuffer,
+     *   is_public: true
      * })
      * ```
      */
@@ -173,7 +412,8 @@ export class AssetsManager {
             description: request.description,
             source: request.source,
             owner_id: request.owner_id,
-            filename: request.filename
+            filename: request.filename,
+            is_public: request.is_public ?? true // Default to public if not specified
         };
         await this.db.save(metadata);
     }
@@ -183,43 +423,69 @@ export class AssetsManager {
      * Returns a JSON list of all assets with their metadata, following the
      * framework pattern but adapted for assets management.
      *
+     * Access control:
+     * - Unauthenticated users: Can only see public assets
+     * - Authenticated users: Can see public assets + their own private assets
+     * - Admin users: Can see all assets (public and private from all users)
+     *
      * @returns {Promise<DataResponse>} JSON response with all assets
      */
-    async retrieve() {
+    async retrieve(req) {
         try {
             const assets = await this.getAllAssets();
-            const config = this.getConfiguration();
-            // Transform to include asset metadata and user-friendly URLs
-            // Note: assets are already sorted by date desc from DB query
-            const assetsWithMetadata = assets.map(asset => ({
-                id: asset.id,
-                name: asset.name,
-                date: asset.date,
-                contentType: asset.contentType,
-                // Asset-specific metadata (from DB columns)
-                description: asset.description || '',
-                source: asset.source || '',
-                owner_id: asset.owner_id || null,
-                filename: asset.filename || '',
-                // Add URLs that the front-end can actually use
-                url: `/${config.name}/${asset.id}`, // For display/use
-                download_url: `/${config.name}/${asset.id}/download` // For download
-            }));
-            return {
-                status: 200,
-                content: JSON.stringify(assetsWithMetadata),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            const isAdmin = req && ApisixAuthParser.isAdmin(req.headers || {});
+            // Admin can see everything
+            if (isAdmin) {
+                return successResponse(this.formatAssetsForResponse(assets));
+            }
+            // Get authenticated user ID if available
+            const authenticatedUserId = await this.getAuthenticatedUserId(req);
+            // Filter to visible assets only
+            const visibleAssets = assets.filter(asset => asset.is_public || (authenticatedUserId !== null && asset.owner_id === authenticatedUserId));
+            return successResponse(this.formatAssetsForResponse(visibleAssets));
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
-                    error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return errorResponse(error);
+        }
+    }
+    /**
+     * Gets the authenticated user's database ID from request headers.
+     *
+     * @param req - HTTP request object
+     * @returns User ID or null if not authenticated
+     */
+    async getAuthenticatedUserId(req) {
+        if (!req || !ApisixAuthParser.hasValidAuth(req.headers || {})) {
+            return null;
         }
+        const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
+        if (!authUser) {
+            return null;
+        }
+        const userRecord = await this.userService.findOrCreateUser(authUser);
+        return userRecord.id || null;
+    }
+    /**
+     * Formats assets for API response with metadata and URLs.
+     *
+     * @param assets - Array of asset records
+     * @returns Formatted assets array ready for JSON serialization
+     */
+    formatAssetsForResponse(assets) {
+        const config = this.getConfiguration();
+        return assets.map(asset => ({
+            id: asset.id,
+            name: asset.name,
+            date: asset.date,
+            contentType: asset.contentType,
+            description: asset.description || '',
+            source: asset.source || '',
+            owner_id: asset.owner_id || null,
+            filename: asset.filename || '',
+            is_public: asset.is_public ?? true,
+            url: `/${config.name}/${asset.id}`,
+            download_url: `/${config.name}/${asset.id}/download`
+        }));
     }
     /**
      * Get all assets for this component type.
@@ -264,7 +530,7 @@ export class AssetsManager {
     /**
      * Update asset metadata by ID.
      *
-     * Updates the metadata (description and/or source) of a specific asset.
+     * Updates the metadata (description, source, and/or visibility) of a specific asset.
      * Asset metadata is stored as dedicated columns in the database.
      *
      * @param {string} id - The ID of the asset to update
@@ -275,7 +541,8 @@ export class AssetsManager {
      * ```typescript
      * await assetsManager.updateAssetMetadata('123', {
      *   description: 'Updated building model with new textures',
-     *   source: 'https://updated-source.example.com'
+     *   source: 'https://updated-source.example.com',
+     *   is_public: false
      * })
      * ```
      */
@@ -302,7 +569,8 @@ export class AssetsManager {
             description: updates.description ?? record.description ?? '',
             source: updates.source ?? record.source ?? '',
             owner_id: record.owner_id ?? null,
-            filename: record.filename ?? ''
+            filename: record.filename ?? '',
+            is_public: updates.is_public !== undefined ? updates.is_public : (record.is_public ?? true)
         };
         // Update the record - delete and re-create with updated metadata
         await this.db.delete(id, this.getConfiguration().name);
@@ -393,7 +661,8 @@ export class AssetsManager {
                 description: request.description,
                 source: request.source,
                 owner_id: request.owner_id,
-                filename: request.filename
+                filename: request.filename,
+                is_public: request.is_public ?? true
             };
             metadataList.push(metadata);
         }
@@ -491,129 +760,84 @@ export class AssetsManager {
         ];
     }
     /**
-     * Handle upload endpoint
+     * Handle single asset upload via HTTP POST.
+     *
+     * Flow:
+     * 1. Validate request structure and authentication
+     * 2. Extract user identity from Apache APISIX headers
+     * 3. Validate file extension and read uploaded file
+     * 4. Store file via storage service and metadata in database
+     * 5. Set owner_id to authenticated user (prevents ownership spoofing)
+     * 6. Apply is_public setting (defaults to true if not specified)
+     *
+     * Authentication: Required
+     * Ownership: Automatically set to authenticated user
+     *
+     * @param req - HTTP request with multipart/form-data file upload
+     * @returns HTTP response with success/error status
+     *
+     * @example
+     * POST /assets
+     * Content-Type: multipart/form-data
+     * x-user-id: user-uuid
+     * x-user-roles: user,premium
+     *
+     * Form data:
+     * - file: <binary file>
+     * - description: "3D model of building"
+     * - source: "https://source.com"
+     * - is_public: true
      */
     async handleUpload(req) {
         try {
-            if (!req || !req.body) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Invalid request: missing request body'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
-            }
-            // Check authentication
-            if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
-                return {
-                    status: 401,
-                    content: JSON.stringify({
-                        error: 'Authentication required'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
-            }
-            // Parse authenticated user
-            const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
-            if (!authUser) {
-                return {
-                    status: 401,
-                    content: JSON.stringify({
-                        error: 'Invalid authentication headers'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            // Validate request structure
+            if (!req?.body) {
+                return badRequestResponse('Invalid request: missing request body');
             }
-            // Find or create user in database
-            const userRecord = await this.userService.findOrCreateUser(authUser);
-            if (!userRecord.id) {
-                return {
-                    status: 500,
-                    content: JSON.stringify({
-                        error: 'Failed to retrieve user information'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            // Authenticate user
+            const authResult = await this.authenticateRequest(req);
+            if (!authResult.success) {
+                return authResult.response;
             }
-            const { description, source } = req.body;
-            const filePath = req.file?.path;
-            const filename = req.file?.originalname || req.body.filename;
-            if (!filePath || !description || !source) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Missing required fields: description, source, file'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            const userId = authResult.userRecord.id;
+            if (!userId) {
+                return errorResponse('Failed to retrieve user information');
             }
-            if (!filename) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Filename could not be determined from uploaded file'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
-            }
-            // Validate file extension early to avoid processing invalid files
-            if (!this.validateFileExtension(filename)) {
-                const config = this.getConfiguration();
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: `Invalid file extension. Expected: ${config.extension}`
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            // Extract and validate upload data
+            const uploadData = this.extractUploadData(req);
+            const validation = this.validateUploadFields(uploadData);
+            if (!validation.success) {
+                return validation.response;
             }
+            const validData = validation.data;
             // Read file from temporary location
             let fileBuffer;
             try {
-                fileBuffer = await fs.readFile(filePath);
+                fileBuffer = await this.readTempFile(validData.filePath);
             }
             catch (error) {
-                return {
-                    status: 500,
-                    content: JSON.stringify({
-                        error: `Failed to read uploaded file: ${error instanceof Error ? error.message : 'Unknown error'}`
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+                return errorResponse(`Failed to read uploaded file: ${error instanceof Error ? error.message : 'Unknown error'}`);
             }
+            // Upload asset and cleanup
             try {
                 await this.uploadAsset({
-                    description,
-                    source,
-                    owner_id: userRecord.id,
-                    filename,
-                    file: fileBuffer
-                });
-                // Clean up temporary file after successful upload
-                await fs.unlink(filePath).catch(() => {
-                    // Ignore cleanup errors, but log them in production
+                    description: validData.description,
+                    source: validData.source,
+                    owner_id: userId,
+                    filename: validData.filename,
+                    file: fileBuffer,
+                    is_public: validData.is_public
                 });
+                await this.cleanupTempFile(validData.filePath);
             }
             catch (error) {
-                // Clean up temporary file even on error
-                await fs.unlink(filePath).catch(() => { });
+                await this.cleanupTempFile(validData.filePath);
                 throw error;
             }
-            return {
-                status: 200,
-                content: JSON.stringify({ message: 'Asset uploaded successfully' }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return successResponse({ message: 'Asset uploaded successfully' });
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
-                    error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return errorResponse(error);
         }
     }
     /**
@@ -633,107 +857,48 @@ export class AssetsManager {
     async handleUpdate(req) {
         try {
             if (!req) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Invalid request: missing request object'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+                return badRequestResponse('Invalid request: missing request object');
             }
-            // Check authentication
-            if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
-                return {
-                    status: 401,
-                    content: JSON.stringify({
-                        error: 'Authentication required'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            // Authenticate user
+            const authResult = await this.authenticateRequest(req);
+            if (!authResult.success) {
+                return authResult.response;
             }
-            // Parse authenticated user
-            const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
-            if (!authUser) {
-                return {
-                    status: 401,
-                    content: JSON.stringify({
-                        error: 'Invalid authentication headers'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            const userId = authResult.userRecord.id;
+            if (!userId) {
+                return errorResponse('Failed to retrieve user information');
             }
             const { id } = req.params || {};
-            const { description, source } = req.body || {};
+            const { description, source, is_public } = req.body || {};
             if (!id) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Asset ID is required'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
-            }
-            if (!description && !source) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'At least one field (description or source) must be provided for update'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+                return badRequestResponse('Asset ID is required');
             }
-            // Find or create user in database
-            const userRecord = await this.userService.findOrCreateUser(authUser);
-            if (!userRecord.id) {
-                return {
-                    status: 500,
-                    content: JSON.stringify({
-                        error: 'Failed to retrieve user information'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            if (!description && !source && is_public === undefined) {
+                return badRequestResponse('At least one field (description, source, or is_public) must be provided for update');
             }
-            // Check if asset exists and belongs to this user
+            // Check if asset exists
             const asset = await this.getAssetById(id);
             if (!asset) {
-                return {
-                    status: 404,
-                    content: JSON.stringify({
-                        error: 'Asset not found'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+                return notFoundResponse('Asset not found');
             }
-            // Check ownership (only owner can modify their assets)
-            if (asset.owner_id !== userRecord.id) {
-                return {
-                    status: 403,
-                    content: JSON.stringify({
-                        error: 'You can only modify your own assets'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            // Check ownership
+            const ownershipError = this.validateOwnership(asset, userId);
+            if (ownershipError) {
+                return ownershipError;
             }
+            // Build and apply updates
             const updates = {};
             if (description !== undefined)
                 updates.description = description;
             if (source !== undefined)
                 updates.source = source;
+            if (is_public !== undefined)
+                updates.is_public = Boolean(is_public);
             await this.updateAssetMetadata(id, updates);
-            return {
-                status: 200,
-                content: JSON.stringify({ message: 'Asset metadata updated successfully' }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return successResponse({ message: 'Asset metadata updated successfully' });
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
-                    error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return errorResponse(error);
         }
     }
     /**
@@ -742,6 +907,11 @@ export class AssetsManager {
      * Returns the file content of a specific asset by ID for display/use in front-end.
      * No download headers - just the raw file content.
      *
+     * Access control:
+     * - Public assets: Accessible to everyone
+     * - Private assets: Accessible only to owner
+     * - Admin users: Can access all assets (public and private)
+     *
      * @param {any} req - HTTP request object with params.id
      * @returns {Promise<DataResponse>} HTTP response with file content
      *
@@ -753,52 +923,15 @@ export class AssetsManager {
      */
     async handleGetAsset(req) {
         try {
-            const { id } = req.params || {};
-            if (!id) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Asset ID is required'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            const result = await this.fetchAssetWithAccessCheck(req);
+            if (!result.success) {
+                return result.response;
             }
-            const asset = await this.getAssetById(id);
-            if (!asset) {
-                return {
-                    status: 404,
-                    content: 'Asset not found',
-                    headers: { 'Content-Type': 'text/plain' }
-                };
-            }
-            // Verify this asset belongs to our component
-            const config = this.getConfiguration();
-            if (asset.name !== config.name) {
-                return {
-                    status: 404,
-                    content: 'Asset not found',
-                    headers: { 'Content-Type': 'text/plain' }
-                };
-            }
-            // Get the file content
-            const fileContent = await asset.data();
-            return {
-                status: 200,
-                content: fileContent,
-                headers: {
-                    'Content-Type': config.contentType
-                    // No Content-Disposition - browser will display/use the file
-                }
-            };
+            const fileContent = await result.asset.data();
+            return fileResponse(fileContent, this.getConfiguration().contentType);
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
-                    error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return errorResponse(error);
         }
     }
     /**
@@ -807,6 +940,11 @@ export class AssetsManager {
      * Downloads the file content of a specific asset by ID with download headers.
      * Forces browser to download the file rather than display it.
      *
+     * Access control:
+     * - Public assets: Accessible to everyone
+     * - Private assets: Accessible only to owner
+     * - Admin users: Can download all assets (public and private)
+     *
      * @param {any} req - HTTP request object with params.id
      * @returns {Promise<DataResponse>} HTTP response with file content and download headers
      *
@@ -818,54 +956,16 @@ export class AssetsManager {
      */
     async handleDownload(req) {
         try {
-            const { id } = req.params || {};
-            if (!id) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Asset ID is required'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            const result = await this.fetchAssetWithAccessCheck(req);
+            if (!result.success) {
+                return result.response;
             }
-            const asset = await this.getAssetById(id);
-            if (!asset) {
-                return {
-                    status: 404,
-                    content: 'Asset not found',
-                    headers: { 'Content-Type': 'text/plain' }
-                };
-            }
-            // Verify this asset belongs to our component
-            const config = this.getConfiguration();
-            if (asset.name !== config.name) {
-                return {
-                    status: 404,
-                    content: 'Asset not found',
-                    headers: { 'Content-Type': 'text/plain' }
-                };
-            }
-            // Get the file content
-            const fileContent = await asset.data();
-            // Get original filename from asset metadata
-            const filename = asset.filename || `asset_${id}`;
-            return {
-                status: 200,
-                content: fileContent,
-                headers: {
-                    'Content-Type': config.contentType,
-                    'Content-Disposition': `attachment; filename="${filename}"`
-                }
-            };
+            const fileContent = await result.asset.data();
+            const filename = result.asset.filename || `asset_${req.params?.id}`;
+            return fileResponse(fileContent, this.getConfiguration().contentType, filename);
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
-                    error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return errorResponse(error);
         }
     }
     /**
@@ -883,84 +983,34 @@ export class AssetsManager {
      */
     async handleDelete(req) {
         try {
-            // Check authentication first
-            if (!ApisixAuthParser.hasValidAuth(req.headers || {})) {
-                return {
-                    status: 401,
-                    content: JSON.stringify({
-                        error: 'Authentication required'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            // Authenticate user
+            const authResult = await this.authenticateRequest(req);
+            if (!authResult.success) {
+                return authResult.response;
             }
-            // Parse authenticated user
-            const authUser = ApisixAuthParser.parseAuthHeaders(req.headers || {});
-            if (!authUser) {
-                return {
-                    status: 401,
-                    content: JSON.stringify({
-                        error: 'Invalid authentication headers'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            const userId = authResult.userRecord.id;
+            if (!userId) {
+                return errorResponse('Failed to retrieve user information');
             }
             const { id } = req.params || {};
             if (!id) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Asset ID is required'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+                return badRequestResponse('Asset ID is required');
             }
-            // Find or create user in database
-            const userRecord = await this.userService.findOrCreateUser(authUser);
-            if (!userRecord.id) {
-                return {
-                    status: 500,
-                    content: JSON.stringify({
-                        error: 'Failed to retrieve user information'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
-            }
-            // Check if asset exists and belongs to this user
+            // Check if asset exists
             const asset = await this.getAssetById(id);
             if (!asset) {
-                return {
-                    status: 404,
-                    content: JSON.stringify({
-                        error: 'Asset not found'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+                return notFoundResponse('Asset not found');
             }
-            // Check ownership (only owner can delete their assets)
-            if (asset.owner_id !== userRecord.id) {
-                return {
-                    status: 403,
-                    content: JSON.stringify({
-                        error: 'You can only delete your own assets'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            // Check ownership
+            const ownershipError = this.validateOwnership(asset, userId);
+            if (ownershipError) {
+                return ownershipError;
             }
             await this.deleteAssetById(id);
-            return {
-                status: 200,
-                content: JSON.stringify({ message: 'Asset deleted successfully' }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return successResponse({ message: 'Asset deleted successfully' });
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
-                    error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            return errorResponse(error);
         }
     }
     /**
@@ -968,149 +1018,160 @@ export class AssetsManager {
      */
     async handleUploadBatch(req) {
         try {
-            if (!req || !req.body) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Invalid request: missing request body'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            if (!req?.body) {
+                return badRequestResponse('Invalid request: missing request body');
+            }
+            // Authenticate user
+            const authResult = await this.authenticateRequest(req);
+            if (!authResult.success) {
+                return authResult.response;
+            }
+            const userId = authResult.userRecord.id;
+            if (!userId) {
+                return errorResponse('Failed to retrieve user information');
             }
             const requests = req.body.requests;
             if (!Array.isArray(requests) || requests.length === 0) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Requests array is required and must not be empty'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+                return badRequestResponse('Requests array is required and must not be empty');
             }
-            // Validate all requests first (including extensions)
-            for (const request of requests) {
-                if (!request.file || !request.description || !request.source || !request.filename) {
-                    return {
-                        status: 400,
-                        content: JSON.stringify({
-                            error: 'Each request must have description, source, filename, and file'
-                        }),
-                        headers: { 'Content-Type': 'application/json' }
-                    };
-                }
-                // Validate file extension for each request
-                if (!this.validateFileExtension(request.filename)) {
-                    const config = this.getConfiguration();
-                    return {
-                        status: 400,
-                        content: JSON.stringify({
-                            error: `Invalid file extension for ${request.filename}. Expected: ${config.extension}`
-                        }),
-                        headers: { 'Content-Type': 'application/json' }
-                    };
-                }
-            }
-            // Process each request individually for compatibility
-            const results = [];
-            for (const request of requests) {
-                try {
-                    await this.uploadAsset({
-                        description: request.description,
-                        source: request.source,
-                        owner_id: request.owner_id || null,
-                        filename: request.filename,
-                        file: Buffer.from(request.file, 'base64') // Assuming base64 encoded
-                    });
-                    results.push({ success: true, filename: request.filename });
-                }
-                catch (error) {
-                    results.push({
-                        success: false,
-                        filename: request.filename,
-                        error: error instanceof Error ? error.message : 'Unknown error'
-                    });
-                }
+            // Validate all requests first
+            const validationError = this.validateBatchRequests(requests);
+            if (validationError) {
+                return validationError;
             }
+            // Process each request
+            const results = await this.processBatchUploads(requests, userId);
             const successCount = results.filter(r => r.success).length;
             const failureCount = results.length - successCount;
-            return {
-                status: failureCount > 0 ? 207 : 200, // 207 Multi-Status if some failed
-                content: JSON.stringify({
-                    message: `${successCount}/${requests.length} assets uploaded successfully`,
-                    results
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            const message = `${successCount}/${requests.length} assets uploaded successfully`;
+            if (failureCount > 0) {
+                return multiStatusResponse(message, results);
+            }
+            return successResponse({ message, results });
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
+            return errorResponse(error);
+        }
+    }
+    /**
+     * Validates all requests in a batch upload.
+     *
+     * @param requests - Array of upload requests to validate
+     * @returns DataResponse with error if validation fails, undefined if valid
+     */
+    validateBatchRequests(requests) {
+        const config = this.getConfiguration();
+        for (const request of requests) {
+            if (!request.file || !request.description || !request.source || !request.filename) {
+                return badRequestResponse('Each request must have description, source, filename, and file');
+            }
+            if (!this.validateBase64(request.file)) {
+                return badRequestResponse(`Invalid base64 data for file: ${request.filename}. File must be a valid base64-encoded string.`);
+            }
+            if (!this.validateFileExtension(request.filename)) {
+                return badRequestResponse(`Invalid file extension for ${request.filename}. Expected: ${config.extension}`);
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Processes batch upload requests.
+     *
+     * @param requests - Array of upload requests
+     * @param ownerId - Owner user ID
+     * @returns Array of results for each upload
+     */
+    async processBatchUploads(requests, ownerId) {
+        const results = [];
+        for (const request of requests) {
+            try {
+                await this.uploadAsset({
+                    description: request.description,
+                    source: request.source,
+                    owner_id: ownerId,
+                    filename: request.filename,
+                    file: Buffer.from(request.file, 'base64'),
+                    is_public: request.is_public !== undefined ? Boolean(request.is_public) : true
+                });
+                results.push({ success: true, filename: request.filename });
+            }
+            catch (error) {
+                results.push({
+                    success: false,
+                    filename: request.filename,
                     error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+                });
+            }
         }
+        return results;
     }
     /**
      * Handle batch delete endpoint
      */
     async handleDeleteBatch(req) {
         try {
-            if (!req || !req.body) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'Invalid request: missing request body'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
+            if (!req?.body) {
+                return badRequestResponse('Invalid request: missing request body');
+            }
+            // Authenticate user
+            const authResult = await this.authenticateRequest(req);
+            if (!authResult.success) {
+                return authResult.response;
+            }
+            const userId = authResult.userRecord.id;
+            if (!userId) {
+                return errorResponse('Failed to retrieve user information');
             }
             const { ids } = req.body;
             if (!Array.isArray(ids) || ids.length === 0) {
-                return {
-                    status: 400,
-                    content: JSON.stringify({
-                        error: 'IDs array is required and must not be empty'
-                    }),
-                    headers: { 'Content-Type': 'application/json' }
-                };
-            }
-            // Process deletions individually with error handling
-            const results = [];
-            for (const id of ids) {
-                try {
-                    await this.deleteAssetById(id);
-                    results.push({ success: true, id });
-                }
-                catch (error) {
-                    results.push({
-                        success: false,
-                        id,
-                        error: error instanceof Error ? error.message : 'Unknown error'
-                    });
-                }
+                return badRequestResponse('IDs array is required and must not be empty');
             }
+            // Process deletions
+            const results = await this.processBatchDeletes(ids, userId);
             const successCount = results.filter(r => r.success).length;
             const failureCount = results.length - successCount;
-            return {
-                status: failureCount > 0 ? 207 : 200, // 207 Multi-Status if some failed
-                content: JSON.stringify({
-                    message: `${successCount}/${ids.length} assets deleted successfully`,
-                    results
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+            const message = `${successCount}/${ids.length} assets deleted successfully`;
+            if (failureCount > 0) {
+                return multiStatusResponse(message, results);
+            }
+            return successResponse({ message, results });
         }
         catch (error) {
-            return {
-                status: 500,
-                content: JSON.stringify({
+            return errorResponse(error);
+        }
+    }
+    /**
+     * Processes batch delete requests.
+     *
+     * @param ids - Array of asset IDs to delete
+     * @param userId - User ID for ownership validation
+     * @returns Array of results for each deletion
+     */
+    async processBatchDeletes(ids, userId) {
+        const results = [];
+        for (const id of ids) {
+            try {
+                const asset = await this.getAssetById(id);
+                if (!asset) {
+                    results.push({ success: false, id, error: 'Asset not found' });
+                    continue;
+                }
+                if (asset.owner_id !== userId) {
+                    results.push({ success: false, id, error: 'You can only delete your own assets' });
+                    continue;
+                }
+                await this.deleteAssetById(id);
+                results.push({ success: true, id });
+            }
+            catch (error) {
+                results.push({
+                    success: false,
+                    id,
                     error: error instanceof Error ? error.message : 'Unknown error'
-                }),
-                headers: { 'Content-Type': 'application/json' }
-            };
+                });
+            }
         }
+        return results;
     }
 }
 //# sourceMappingURL=assets_manager.js.map