graphile-presigned-url-plugin 1.14.0 → 1.15.0

package/esm/storage-module-cache.js

@@ -28,50 +28,9 @@ const storageModuleCache = new LRUCache({
     updateAgeOnGet: true,
 });
 /**
- * SQL query to resolve the app-level storage module config for a database.
- *
- * Joins storage_module → table → schema to get fully-qualified table names.
- * Filters to app-level (scope = 'app') by default.
- *
- * Requires the multi-scope schema (scope column on storage_module).
- */
-const APP_STORAGE_MODULE_QUERY = `
-  SELECT
-    sm.id,
-    sm.scope,
-    sm.entity_table_id,
-    bs.schema_name AS buckets_schema,
-    bt.name AS buckets_table,
-    fs.schema_name AS files_schema,
-    ft.name AS files_table,
-    sm.endpoint,
-    sm.public_url_prefix,
-    sm.provider,
-    sm.allowed_origins,
-    sm.upload_url_expiry_seconds,
-    sm.download_url_expiry_seconds,
-    sm.default_max_file_size,
-    sm.max_filename_length,
-    sm.cache_ttl_seconds,
-    sm.max_bulk_files,
-    sm.max_bulk_total_size,
-    sm.has_path_shares,
-    NULL AS entity_schema,
-    NULL AS entity_table
-  FROM metaschema_modules_public.storage_module sm
-  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
-  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
-  JOIN metaschema_public.table ft ON ft.id = sm.files_table_id
-  JOIN metaschema_public.schema fs ON fs.id = ft.schema_id
-  WHERE sm.database_id = $1
-    AND sm.scope = 'app'
-  LIMIT 1
-`;
-/**
- * SQL query to resolve ALL storage modules for a database (app-level + entity-scoped).
- *
- * Returns all storage modules with their entity table names for ownerId resolution.
- * Requires the multi-scope schema.
+ * SQL query to resolve ALL storage modules for a database, whatever their
+ * scope. Returns each module with its entity table names so callers can
+ * classify entity-keyed planes and resolve owners.
  */
 const ALL_STORAGE_MODULES_QUERY = `
   SELECT
@@ -94,6 +53,7 @@ const ALL_STORAGE_MODULES_QUERY = `
     sm.max_bulk_files,
     sm.max_bulk_total_size,
     sm.has_path_shares,
+    sm.has_confirm_upload,
     es.schema_name AS entity_schema,
     et.name AS entity_table
   FROM metaschema_modules_public.storage_module sm
@@ -132,99 +92,11 @@ function buildConfig(row) {
         maxFilenameLength: row.max_filename_length ?? DEFAULT_MAX_FILENAME_LENGTH,
         cacheTtlSeconds,
         hasPathShares: row.has_path_shares ?? false,
+        hasConfirmUpload: row.has_confirm_upload ?? false,
         maxBulkFiles: row.max_bulk_files ?? DEFAULT_MAX_BULK_FILES,
         maxBulkTotalSize: row.max_bulk_total_size ?? DEFAULT_MAX_BULK_TOTAL_SIZE,
     };
 }
-/**
- * Resolve the app-level storage module config for a database, using the LRU cache.
- *
- * This is the default path when no ownerId is provided. It returns the
- * storage module with scope = 'app' (app-level / database-wide).
- *
- * @param pgClient - A pg client from the Graphile context (withPgClient or pgClient)
- * @param databaseId - The metaschema database UUID
- * @returns StorageModuleConfig or null if no storage module is provisioned
- */
-export async function getStorageModuleConfig(pgClient, databaseId) {
-    const cacheKey = `storage:${databaseId}:app`;
-    const cached = storageModuleCache.get(cacheKey);
-    if (cached) {
-        return cached;
-    }
-    log.debug(`Cache miss for app-level storage in database ${databaseId}, querying metaschema...`);
-    const result = await pgClient.query({ text: APP_STORAGE_MODULE_QUERY, values: [databaseId] });
-    if (result.rows.length === 0) {
-        log.warn(`No app-level storage module found for database ${databaseId}`);
-        return null;
-    }
-    const config = buildConfig(result.rows[0]);
-    storageModuleCache.set(cacheKey, config);
-    log.debug(`Cached app-level storage config for database ${databaseId}: ${config.bucketsQualifiedName}`);
-    return config;
-}
-/**
- * Resolve the storage module config for a specific owner entity.
- *
- * When ownerId is provided, this function:
- * 1. Loads ALL storage modules for the database (cached)
- * 2. Finds which entity-scoped module contains the ownerId in its entity table
- * 3. Returns that module's config
- *
- * This is the core of Option C — the ownerId tells us which scope to use.
- *
- * @param pgClient - A pg client from the Graphile context
- * @param databaseId - The metaschema database UUID
- * @param ownerId - The entity instance UUID (e.g., a data room ID, team ID)
- * @returns StorageModuleConfig or null if no matching module found
- */
-export async function getStorageModuleConfigForOwner(pgClient, databaseId, ownerId) {
-    // Check if we already have a cached mapping for this ownerId
-    const ownerCacheKey = `storage:${databaseId}:owner:${ownerId}`;
-    const cachedOwner = storageModuleCache.get(ownerCacheKey);
-    if (cachedOwner) {
-        return cachedOwner;
-    }
-    // Load all storage modules for this database
-    const allModulesCacheKey = `storage:${databaseId}:all`;
-    let allConfigs;
-    const cachedAll = storageModuleCache.get(allModulesCacheKey);
-    if (cachedAll) {
-        // We stored a sentinel; re-derive from individual caches
-        // Actually, let's just query fresh — this is the cache-miss path
-        allConfigs = [];
-    }
-    else {
-        allConfigs = [];
-    }
-    if (allConfigs.length === 0) {
-        log.debug(`Loading all storage modules for database ${databaseId} to resolve ownerId ${ownerId}`);
-        const result = await pgClient.query({ text: ALL_STORAGE_MODULES_QUERY, values: [databaseId] });
-        allConfigs = result.rows.map(buildConfig);
-        // Cache each individual config by its scope
-        for (const config of allConfigs) {
-            const key = `storage:${databaseId}:scope:${config.scope}`;
-            storageModuleCache.set(key, config);
-        }
-    }
-    // Find entity-scoped modules and probe their entity tables for the ownerId
-    const entityModules = allConfigs.filter((c) => c.entityQualifiedName !== null);
-    for (const mod of entityModules) {
-        const probeResult = await pgClient.query({
-            text: `SELECT 1 FROM ${mod.entityQualifiedName} WHERE id = $1 LIMIT 1`,
-            values: [ownerId],
-        });
-        if (probeResult.rows.length > 0) {
-            // Found the matching module — cache the ownerId→module mapping
-            storageModuleCache.set(ownerCacheKey, mod);
-            log.debug(`Resolved ownerId ${ownerId} to storage module ${mod.id} ` +
-                `(scope=${mod.scope}, table=${mod.bucketsQualifiedName})`);
-            return mod;
-        }
-    }
-    log.warn(`No entity-scoped storage module found for ownerId ${ownerId} in database ${databaseId}`);
-    return null;
-}
 /**
  * Resolve the storage module that owns a specific file by probing all file tables.
  *
@@ -270,11 +142,6 @@ export async function loadAllStorageModules(pgClient, databaseId) {
     log.debug(`Loading all storage modules for database ${databaseId}`);
     const result = await pgClient.query({ text: ALL_STORAGE_MODULES_QUERY, values: [databaseId] });
     const configs = result.rows.map(buildConfig);
-    // Cache each individual config by its scope
-    for (const config of configs) {
-        const key = `storage:${databaseId}:scope:${config.scope}`;
-        storageModuleCache.set(key, config);
-    }
     // Store the full list under a sentinel key (only if non-empty to avoid caching failed lookups)
     if (configs.length > 0) {
         const sentinel = { ...configs[0], _allConfigs: configs };
@@ -351,9 +218,9 @@ export async function getBucketConfig(pgClient, storageConfig, databaseId, bucke
         return cached;
     }
     log.debug(`Bucket cache miss for ${databaseId}:${bucketKey}${ownerId ? ` (owner=${ownerId})` : ''}, querying DB...`);
-    // Entity-scoped buckets use (owner_id, key) composite lookup;
-    // app-level buckets just use key.
-    const isEntityScoped = storageConfig.scope !== 'app';
+    // Entity-keyed planes (the module records an entity table) use the
+    // (owner_id, key) composite lookup; app- and database-scope planes just use key.
+    const isEntityScoped = storageConfig.entityTableId !== null;
     const hasOwner = ownerId && isEntityScoped;
     const result = await pgClient.query({
         text: hasOwner

package/esm/types.d.ts

@@ -61,6 +61,12 @@ export interface StorageModuleConfig {
     cacheTtlSeconds: number;
     /** Whether this storage module uses ltree path + path shares (determines if path column exists on files) */
     hasPathShares: boolean;
+    /**
+     * Whether the files table carries the confirm-upload lifecycle (`status`,
+     * `promoted_at`). Only then can a row be told apart from the bytes it claims:
+     * without it every row is treated as live, because there is nothing to read.
+     */
+    hasConfirmUpload: boolean;
     /** Max files per requestBulkUploadUrls batch (default: 100) */
     maxBulkFiles: number;
     /** Max total size per bulk upload batch in bytes (default: 1GB) */

package/file-lifecycle.d.ts

@@ -0,0 +1,20 @@
+import type { StorageModuleConfig } from './types';
+/**
+ * The statuses in which a files row stands for bytes a reader can actually GET.
+ * A `requested` row is a claim, not an object — its presigned PUT may never have
+ * run — and `rejected`/`expired` are settled failures.
+ */
+export declare const LIVE_FILE_STATUSES: string[];
+/**
+ * The `status` column, when the module has one, for splicing into a select list.
+ */
+export declare function statusSelectFragment(storageConfig: StorageModuleConfig): string;
+/**
+ * Whether an existing row may be handed back as a dedup hit.
+ *
+ * Modules without the confirm-upload lifecycle have no `status` column, so there
+ * is nothing to read and every row is presumed live, as before.
+ */
+export declare function isLiveFileRow(storageConfig: StorageModuleConfig, row: {
+    status?: string;
+}): boolean;

package/file-lifecycle.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LIVE_FILE_STATUSES = void 0;
+exports.statusSelectFragment = statusSelectFragment;
+exports.isLiveFileRow = isLiveFileRow;
+/**
+ * The statuses in which a files row stands for bytes a reader can actually GET.
+ * A `requested` row is a claim, not an object — its presigned PUT may never have
+ * run — and `rejected`/`expired` are settled failures.
+ */
+exports.LIVE_FILE_STATUSES = ['uploaded', 'processed'];
+/**
+ * The `status` column, when the module has one, for splicing into a select list.
+ */
+function statusSelectFragment(storageConfig) {
+    return storageConfig.hasConfirmUpload ? ', status' : '';
+}
+/**
+ * Whether an existing row may be handed back as a dedup hit.
+ *
+ * Modules without the confirm-upload lifecycle have no `status` column, so there
+ * is nothing to read and every row is presumed live, as before.
+ */
+function isLiveFileRow(storageConfig, row) {
+    if (!storageConfig.hasConfirmUpload)
+        return true;
+    return exports.LIVE_FILE_STATUSES.includes(row.status);
+}

package/index.d.ts

@@ -27,6 +27,7 @@
  * ```
  */
 export { CONFIRM_PREFIX_BYTES, confirmUploadedBytes, type ConfirmUploadInput, type ConfirmUploadVerdict, } from './confirm-upload';
+export { validateCustomKey } from './custom-key';
 export type { ResolvedBucketCoordinate } from './default-bucket';
 export { resolveDefaultBucket } from './default-bucket';
 export { createDownloadUrlPlugin } from './download-url-field';
@@ -38,5 +39,5 @@ export { createPresignedUrlPlugin, PresignedUrlPlugin } from './plugin';
 export { PresignedUrlPreset } from './preset';
 export { type WithPgClient, withRequestPgClient } from './request-pg-client';
 export { copyS3Object, deleteS3Object, generatePresignedGetUrl, generatePresignedPutUrl, headObject, readObjectPrefix } from './s3-signer';
-export { clearBucketCache, clearStorageModuleCache, getBucketConfig, getStorageModuleConfig, getStorageModuleConfigForOwner, isS3BucketProvisioned, loadAllStorageModules, markS3BucketProvisioned, resolveStorageConfigFromCodec, resolveStorageModuleByFileId } from './storage-module-cache';
+export { clearBucketCache, clearStorageModuleCache, getBucketConfig, isS3BucketProvisioned, loadAllStorageModules, markS3BucketProvisioned, resolveStorageConfigFromCodec, resolveStorageModuleByFileId } from './storage-module-cache';
 export type { BucketConfig, BucketNameResolver, EnsureBucketProvisioned, PresignedUrlPluginOptions, RequestUploadUrlInput, RequestUploadUrlPayload, S3Config, S3ConfigOrGetter, StorageModuleConfig, } from './types';

package/index.js

@@ -28,10 +28,12 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveStorageModuleByFileId = exports.resolveStorageConfigFromCodec = exports.markS3BucketProvisioned = exports.loadAllStorageModules = exports.isS3BucketProvisioned = exports.getStorageModuleConfigForOwner = exports.getStorageModuleConfig = exports.getBucketConfig = exports.clearStorageModuleCache = exports.clearBucketCache = exports.readObjectPrefix = exports.headObject = exports.generatePresignedPutUrl = exports.generatePresignedGetUrl = exports.deleteS3Object = exports.copyS3Object = exports.withRequestPgClient = exports.PresignedUrlPreset = exports.PresignedUrlPlugin = exports.createPresignedUrlPlugin = exports.resolveS3ForDatabase = exports.resolveS3 = exports.provisionAndRecordPhysicalBucket = exports.mintPhysicalBucketName = exports.resolveManagedUploadTarget = exports.finalizeStagedUpload = exports.buildFileProjection = exports.assertUploadAllowedByBucket = exports.getFileRefFieldBinding = exports.FileRefFieldNotRegisteredError = exports.clearFileRefFieldCache = exports.createDownloadUrlPlugin = exports.resolveDefaultBucket = exports.confirmUploadedBytes = exports.CONFIRM_PREFIX_BYTES = void 0;
+exports.resolveStorageModuleByFileId = exports.resolveStorageConfigFromCodec = exports.markS3BucketProvisioned = exports.loadAllStorageModules = exports.isS3BucketProvisioned = exports.getBucketConfig = exports.clearStorageModuleCache = exports.clearBucketCache = exports.readObjectPrefix = exports.headObject = exports.generatePresignedPutUrl = exports.generatePresignedGetUrl = exports.deleteS3Object = exports.copyS3Object = exports.withRequestPgClient = exports.PresignedUrlPreset = exports.PresignedUrlPlugin = exports.createPresignedUrlPlugin = exports.resolveS3ForDatabase = exports.resolveS3 = exports.provisionAndRecordPhysicalBucket = exports.mintPhysicalBucketName = exports.resolveManagedUploadTarget = exports.finalizeStagedUpload = exports.buildFileProjection = exports.assertUploadAllowedByBucket = exports.getFileRefFieldBinding = exports.FileRefFieldNotRegisteredError = exports.clearFileRefFieldCache = exports.createDownloadUrlPlugin = exports.resolveDefaultBucket = exports.validateCustomKey = exports.confirmUploadedBytes = exports.CONFIRM_PREFIX_BYTES = void 0;
 var confirm_upload_1 = require("./confirm-upload");
 Object.defineProperty(exports, "CONFIRM_PREFIX_BYTES", { enumerable: true, get: function () { return confirm_upload_1.CONFIRM_PREFIX_BYTES; } });
 Object.defineProperty(exports, "confirmUploadedBytes", { enumerable: true, get: function () { return confirm_upload_1.confirmUploadedBytes; } });
+var custom_key_1 = require("./custom-key");
+Object.defineProperty(exports, "validateCustomKey", { enumerable: true, get: function () { return custom_key_1.validateCustomKey; } });
 var default_bucket_1 = require("./default-bucket");
 Object.defineProperty(exports, "resolveDefaultBucket", { enumerable: true, get: function () { return default_bucket_1.resolveDefaultBucket; } });
 var download_url_field_1 = require("./download-url-field");
@@ -68,8 +70,6 @@ var storage_module_cache_1 = require("./storage-module-cache");
 Object.defineProperty(exports, "clearBucketCache", { enumerable: true, get: function () { return storage_module_cache_1.clearBucketCache; } });
 Object.defineProperty(exports, "clearStorageModuleCache", { enumerable: true, get: function () { return storage_module_cache_1.clearStorageModuleCache; } });
 Object.defineProperty(exports, "getBucketConfig", { enumerable: true, get: function () { return storage_module_cache_1.getBucketConfig; } });
-Object.defineProperty(exports, "getStorageModuleConfig", { enumerable: true, get: function () { return storage_module_cache_1.getStorageModuleConfig; } });
-Object.defineProperty(exports, "getStorageModuleConfigForOwner", { enumerable: true, get: function () { return storage_module_cache_1.getStorageModuleConfigForOwner; } });
 Object.defineProperty(exports, "isS3BucketProvisioned", { enumerable: true, get: function () { return storage_module_cache_1.isS3BucketProvisioned; } });
 Object.defineProperty(exports, "loadAllStorageModules", { enumerable: true, get: function () { return storage_module_cache_1.loadAllStorageModules; } });
 Object.defineProperty(exports, "markS3BucketProvisioned", { enumerable: true, get: function () { return storage_module_cache_1.markS3BucketProvisioned; } });

package/managed-upload.js

@@ -25,6 +25,7 @@ exports.assertUploadAllowedByBucket = assertUploadAllowedByBucket;
 exports.finalizeStagedUpload = finalizeStagedUpload;
 const logger_1 = require("@pgpmjs/logger");
 const default_bucket_1 = require("./default-bucket");
+const file_lifecycle_1 = require("./file-lifecycle");
 const file_ref_registry_1 = require("./file-ref-registry");
 const physical_bucket_1 = require("./physical-bucket");
 const request_pg_client_1 = require("./request-pg-client");
@@ -95,8 +96,8 @@ async function resolveManagedUploadTarget(args) {
                 `unregistered upload column and database ${databaseId} has no app-scope storage module to ` +
                 'default to; there is no environment bucket to fall back to');
     }
-    if (storageConfig.scope !== 'app') {
-        // An entity-scoped module resolves its bucket per owning row, and a
+    if (storageConfig.entityTableId !== null) {
+        // An entity-keyed module resolves its bucket per owning row, and a
         // multipart column write does not carry one. Refuse rather than write a
         // tenant's file into whichever bucket happened to resolve.
         throw new Error(`STORAGE_SCOPE_UNSUPPORTED: ${field.schemaName}.${field.tableName}.${field.columnName} binds to ` +
@@ -198,7 +199,7 @@ async function finalizeStagedUpload(args) {
     const finalKey = staged.contentHash;
     const existing = await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, async (pgClient) => {
         const result = await pgClient.query({
-            text: `SELECT id, key, mime_type, size, filename
+            text: `SELECT id, key, mime_type, size, filename${(0, file_lifecycle_1.statusSelectFragment)(storageConfig)}
              FROM ${storageConfig.filesQualifiedName}
              WHERE content_hash = $1 AND bucket_id = $2
              LIMIT 1`,
@@ -206,7 +207,22 @@ async function finalizeStagedUpload(args) {
         });
         return result.rows[0];
     });
-    if (existing) {
+    // Only a row that already stands for stored bytes may absorb this upload. One
+    // that never received them is dropped, and the staged object is promoted as a
+    // fresh file below — which is also what keeps the insert possible, since the
+    // final key is the content hash and (bucket_id, key) is unique. The GC job the
+    // delete enqueues re-takes the reference count when it runs, by which point
+    // the replacement row exists, so it no-ops.
+    if (existing && !(0, file_lifecycle_1.isLiveFileRow)(storageConfig, existing)) {
+        log.info(`Restarting upload of hash ${staged.contentHash}: file ${existing.id} is ${existing.status}, so it carries no bytes`);
+        await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, async (pgClient) => {
+            await pgClient.query({
+                text: `DELETE FROM ${storageConfig.filesQualifiedName} WHERE id = $1`,
+                values: [existing.id],
+            });
+        });
+    }
+    else if (existing) {
         log.info(`Dedup hit: file ${existing.id} already carries hash ${staged.contentHash}`);
         await (0, s3_signer_1.deleteS3Object)(s3, staged.stagingKey);
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-presigned-url-plugin",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Presigned URL upload plugin for PostGraphile v5 — requestUploadUrl mutation and downloadUrl computed field",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -44,6 +44,7 @@
     "@aws-sdk/s3-request-presigner": "^3.1052.0",
     "@pgpmjs/logger": "^2.25.0",
     "@pgsql/quotes": "^18.2.4",
+    "graphile-storage-registry": "^0.1.0",
     "lru-cache": "^11.2.7",
     "mime-bytes": "^0.32.0"
   },
@@ -61,5 +62,5 @@
     "@types/node": "^22.19.11",
     "makage": "^0.3.0"
   },
-  "gitHead": "b5b6b9f05276b7e9cbd3d1f4acd31dd315c353ea"
+  "gitHead": "d10fe91ede80a4c2dfe2c1c6dcf6fe7193784eba"
 }

package/plugin.d.ts

@@ -7,6 +7,8 @@
  *    on root Mutation for each @storageFiles/@storageBuckets pair. These combine
  *    bucket resolution + file INSERT + presigned URL generation in one step.
  *    E.g., `uploadAppFile(input: { bucketKey: "public", contentHash: "...", ... })`
+ *    Pairs are discovered from the registry's FK relations (see
+ *    graphile-storage-registry) — table naming carries no meaning here.
  *
  * 2. Delete middleware — wraps `delete*` mutations on `@storageFiles`-tagged tables
  *    with S3 object cleanup (sync + async GC fallback via AFTER DELETE trigger).