happy2 0.0.5 → 0.0.11

package/packages/happy2-server/dist/routes/files.js

@@ -1,65 +1,125 @@
+import { fileCanAccess } from "../modules/file/fileCanAccess.js";
+import { fileDeleteOwnedUnreferenced } from "../modules/file/fileDeleteOwnedUnreferenced.js";
+import { fileFind } from "../modules/file/fileFind.js";
+import { fileFindUploadedBy } from "../modules/file/fileFindUploadedBy.js";
+import { userSetPhoto } from "../modules/user/userSetPhoto.js";
+import {} from "../modules/drizzle.js";
 import { FileQuotaExceededError, FileStorage, InvalidUploadError, UploadRejectedError, } from "../modules/files/storage.js";
 import { UploadIncompleteError, UploadLimitError, UploadNotFoundError, UploadOffsetError, } from "../modules/files/provider.js";
-export function registerFileRoutes(app, config, auth, database, tokens, files, collaboration) {
+export function registerFileRoutes(app, config, auth, executor, tokens, files) {
     app.get("/v0/me", async (request, reply) => {
         const current = await auth.authenticate(request);
-        return current ? { user: current.user } : reply.code(401).send({ error: "unauthorized" });
+        return current
+            ? {
+                user: current.user,
+            }
+            : reply.code(401).send({
+                error: "unauthorized",
+            });
     });
     app.post("/v0/me/uploadAvatarFile", async (request, reply) => {
         const current = await auth.authenticate(request);
         if (!current)
-            return reply.code(401).send({ error: "unauthorized" });
+            return reply.code(401).send({
+                error: "unauthorized",
+            });
         const upload = await request.file();
         if (!upload)
-            return reply.code(400).send({ error: "avatar_required" });
-        const visibilityField = upload.fields.visibility;
-        const visibilityPart = Array.isArray(visibilityField)
-            ? visibilityField[0]
-            : visibilityField;
-        const visibility = visibilityPart?.value;
+            return reply.code(400).send({
+                error: "avatar_required",
+            });
+        let input;
+        try {
+            input = await readLimited(upload.file, 10 * 1024 * 1024);
+        }
+        catch (error) {
+            if (error instanceof InvalidUploadError)
+                return reply.code(400).send({
+                    error: "invalid_avatar",
+                    message: error.message,
+                });
+            throw error;
+        }
+        const visibility = multipartFieldValue(upload.fields.visibility);
         if (visibility !== "public" && visibility !== "private")
-            return reply.code(400).send({ error: "visibility_required" });
+            return reply.code(400).send({
+                error: "visibility_required",
+            });
+        const crop = avatarCropParse(multipartFieldValue(upload.fields.crop));
+        if (!crop)
+            return reply.code(400).send({
+                error: "invalid_avatar_crop",
+                message: "Avatar crop must contain integer x, y, width, and height values",
+            });
         try {
-            const file = await files.saveAvatarUpload(current.user, await readLimited(upload.file, 10 * 1024 * 1024), visibility === "public");
-            return reply.code(201).send({ file: await fileResponse(files, file, false) });
+            const file = await files.saveAvatarUpload(current.user, input, crop, visibility === "public");
+            return reply.code(201).send({
+                file: await fileResponse(files, file, false),
+            });
         }
         catch (error) {
             if (error instanceof FileQuotaExceededError || error instanceof UploadRejectedError)
                 return sendUploadError(reply, request.log, error);
             if (error instanceof InvalidUploadError)
-                return reply.code(400).send({ error: "invalid_avatar", message: error.message });
-            request.log.error({ err: error }, "Avatar upload failed");
-            return reply.code(500).send({ error: "internal_server_error" });
+                return reply.code(400).send({
+                    error: "invalid_avatar",
+                    message: error.message,
+                });
+            request.log.error({
+                err: error,
+            }, "Avatar upload failed");
+            return reply.code(500).send({
+                error: "internal_server_error",
+            });
         }
     });
     app.post("/v0/me/updateAvatar", async (request, reply) => {
         const current = await auth.authenticate(request);
         if (!current)
-            return reply.code(401).send({ error: "unauthorized" });
+            return reply.code(401).send({
+                error: "unauthorized",
+            });
         const fileId = request.body?.fileId;
         if (typeof fileId !== "string")
-            return reply.code(400).send({ error: "file_id_required" });
-        const file = await database.findFileUploadedBy(fileId, current.user.id);
+            return reply.code(400).send({
+                error: "file_id_required",
+            });
+        const file = await fileFindUploadedBy(executor, fileId, current.user.id);
         if (!file || !file.isPublic)
-            return reply.code(400).send({ error: "avatar_requires_own_public_file" });
-        return (await database.setUserPhoto(current.user.id, file.id))
-            ? { user: { ...current.user, photoFileId: file.id } }
-            : reply.code(400).send({ error: "avatar_update_failed" });
+            return reply.code(400).send({
+                error: "avatar_requires_own_public_file",
+            });
+        return (await userSetPhoto(executor, current.user.id, file.id))
+            ? {
+                user: {
+                    ...current.user,
+                    photoFileId: file.id,
+                },
+            }
+            : reply.code(400).send({
+                error: "avatar_update_failed",
+            });
     });
-    if (collaboration) {
+    if (executor) {
         app.post("/v0/files/upload", async (request, reply) => {
             const current = await auth.authenticate(request);
             if (!current)
-                return reply.code(401).send({ error: "unauthorized" });
+                return reply.code(401).send({
+                    error: "unauthorized",
+                });
             const upload = await request.file();
             if (!upload)
-                return reply.code(400).send({ error: "file_required" });
+                return reply.code(400).send({
+                    error: "file_required",
+                });
             try {
                 const file = await files.saveAttachmentUpload(current.user, upload.file, {
                     filename: upload.filename,
                     contentType: upload.mimetype,
                 });
-                return reply.code(201).send({ file: await fileResponse(files, file, true) });
+                return reply.code(201).send({
+                    file: await fileResponse(files, file, true),
+                });
             }
             catch (error) {
                 return sendUploadError(reply, request.log, error);
@@ -68,19 +128,25 @@ export function registerFileRoutes(app, config, auth, database, tokens, files, c
         app.post("/v0/files/createUpload", async (request, reply) => {
             const current = await auth.authenticate(request);
             if (!current)
-                return reply.code(401).send({ error: "unauthorized" });
+                return reply.code(401).send({
+                    error: "unauthorized",
+                });
             const body = request.body;
             if ((body?.filename !== undefined && typeof body.filename !== "string") ||
                 (body?.contentType !== undefined && typeof body.contentType !== "string") ||
                 typeof body?.size !== "number")
-                return reply.code(400).send({ error: "invalid_upload_request" });
+                return reply.code(400).send({
+                    error: "invalid_upload_request",
+                });
             try {
                 const upload = await files.createResumableUpload(current.user, {
                     filename: body.filename,
                     contentType: body.contentType,
                     size: body.size,
                 });
-                return reply.code(201).send({ upload: uploadResponse(upload) });
+                return reply.code(201).send({
+                    upload: uploadResponse(upload),
+                });
             }
             catch (error) {
                 return sendUploadError(reply, request.log, error);
@@ -89,55 +155,84 @@ export function registerFileRoutes(app, config, auth, database, tokens, files, c
         app.get("/v0/files/:uploadId/uploadState", async (request, reply) => {
             const current = await auth.authenticate(request);
             if (!current)
-                return reply.code(401).send({ error: "unauthorized" });
+                return reply.code(401).send({
+                    error: "unauthorized",
+                });
             const uploadId = request.params.uploadId;
             const upload = uploadId
                 ? await files.resumableUploadState(current.user.id, uploadId)
                 : undefined;
             return upload
-                ? { upload: uploadResponse(upload) }
-                : reply.code(404).send({ error: "not_found" });
+                ? {
+                    upload: uploadResponse(upload),
+                }
+                : reply.code(404).send({
+                    error: "not_found",
+                });
         });
         app.post("/v0/files/:uploadId/appendUpload", async (request, reply) => {
             const current = await auth.authenticate(request);
             if (!current)
-                return reply.code(401).send({ error: "unauthorized" });
+                return reply.code(401).send({
+                    error: "unauthorized",
+                });
             const uploadId = request.params.uploadId;
             const offset = parseUploadOffset(request.headers["upload-offset"]);
             if (!uploadId || offset === undefined)
-                return reply.code(400).send({ error: "upload_offset_required" });
+                return reply.code(400).send({
+                    error: "upload_offset_required",
+                });
             try {
                 const part = await request.file();
                 if (!part)
-                    return reply.code(400).send({ error: "file_required" });
+                    return reply.code(400).send({
+                        error: "file_required",
+                    });
                 const upload = await files.appendResumableUpload(current.user.id, uploadId, offset, part.file);
                 return upload
-                    ? { upload: uploadResponse(upload) }
-                    : reply.code(404).send({ error: "not_found" });
+                    ? {
+                        upload: uploadResponse(upload),
+                    }
+                    : reply.code(404).send({
+                        error: "not_found",
+                    });
             }
             catch (error) {
                 if (error instanceof UploadOffsetError)
                     return reply
                         .code(409)
                         .header("upload-offset", String(error.actualOffset))
-                        .send({ error: "upload_offset_mismatch", offset: error.actualOffset });
+                        .send({
+                        error: "upload_offset_mismatch",
+                        offset: error.actualOffset,
+                    });
                 if (error instanceof UploadLimitError)
-                    return reply.code(400).send({ error: "invalid_upload_chunk" });
+                    return reply.code(400).send({
+                        error: "invalid_upload_chunk",
+                    });
                 return sendUploadError(reply, request.log, error);
             }
         });
         app.post("/v0/files/:uploadId/completeUpload", async (request, reply) => {
             const current = await auth.authenticate(request);
             if (!current)
-                return reply.code(401).send({ error: "unauthorized" });
+                return reply.code(401).send({
+                    error: "unauthorized",
+                });
             const uploadId = request.params.uploadId;
             if (!uploadId)
-                return reply.code(404).send({ error: "not_found" });
+                return reply.code(404).send({
+                    error: "not_found",
+                });
             try {
                 const file = await files.completeResumableUpload(current.user, uploadId);
                 return file
-                    ? reply.code(201).send({ file: await fileResponse(files, file, true) })
-                    : reply.code(404).send({ error: "not_found" });
+                    ? reply.code(201).send({
+                        file: await fileResponse(files, file, true),
+                    })
+                    : reply.code(404).send({
+                        error: "not_found",
+                    });
             }
             catch (error) {
                 if (error instanceof UploadIncompleteError)
@@ -152,20 +247,30 @@ export function registerFileRoutes(app, config, auth, database, tokens, files, c
         app.post("/v0/files/:uploadId/cancelUpload", async (request, reply) => {
             const current = await auth.authenticate(request);
             if (!current)
-                return reply.code(401).send({ error: "unauthorized" });
+                return reply.code(401).send({
+                    error: "unauthorized",
+                });
             const uploadId = request.params.uploadId;
             return uploadId && (await files.cancelResumableUpload(current.user.id, uploadId))
-                ? { cancelled: true }
-                : reply.code(404).send({ error: "not_found" });
+                ? {
+                    cancelled: true,
+                }
+                : reply.code(404).send({
+                    error: "not_found",
+                });
         });
     }
     app.post("/v0/files/:fileId/deleteFile", async (request, reply) => {
         const current = await auth.authenticate(request);
         if (!current)
-            return reply.code(401).send({ error: "unauthorized" });
+            return reply.code(401).send({
+                error: "unauthorized",
+            });
         const fileId = request.params.fileId;
         if (!fileId)
-            return reply.code(404).send({ error: "not_found" });
+            return reply.code(404).send({
+                error: "not_found",
+            });
         const body = (request.body ?? {});
         if (!body ||
             typeof body !== "object" ||
@@ -173,73 +278,101 @@ export function registerFileRoutes(app, config, auth, database, tokens, files, c
             Object.keys(body).some((key) => key !== "reason") ||
             (body.reason !== undefined &&
                 (typeof body.reason !== "string" || body.reason.length > 500)))
-            return reply.code(400).send({ error: "invalid_request" });
-        const file = await database.findFileUploadedBy(fileId, current.user.id);
+            return reply.code(400).send({
+                error: "invalid_request",
+            });
+        const file = await fileFindUploadedBy(executor, fileId, current.user.id);
         if (!file)
-            return reply.code(404).send({ error: "not_found" });
-        const result = await database.deleteOwnedUnreferencedFile(fileId, current.user.id, typeof body.reason === "string" ? body.reason : undefined);
+            return reply.code(404).send({
+                error: "not_found",
+            });
+        const result = await fileDeleteOwnedUnreferenced(executor, fileId, current.user.id, typeof body.reason === "string" ? body.reason : undefined);
         if (result === "not_found")
-            return reply.code(404).send({ error: "not_found" });
+            return reply.code(404).send({
+                error: "not_found",
+            });
         if (result === "in_use")
-            return reply.code(409).send({ error: "file_in_use" });
+            return reply.code(409).send({
+                error: "file_in_use",
+            });
         await files.deleteStoredFile(file).catch((error) => {
-            request.log.error({ err: error, fileId }, "Deleted file storage cleanup failed");
+            request.log.error({
+                err: error,
+                fileId,
+            }, "Deleted file storage cleanup failed");
         });
-        return { deleted: true };
+        return {
+            deleted: true,
+        };
     });
     app.post("/v0/files/:fileId/createSignedUrl", async (request, reply) => {
         const current = await auth.authenticate(request);
         if (!current)
-            return reply.code(401).send({ error: "unauthorized" });
+            return reply.code(401).send({
+                error: "unauthorized",
+            });
         const fileId = request.params.fileId;
-        const file = fileId ? await database.findFile(fileId) : undefined;
+        const file = fileId ? await fileFind(executor, fileId) : undefined;
         const accessible = file &&
             (file.uploadedByUserId === current.user.id ||
                 file.isPublic ||
-                (collaboration
-                    ? await collaboration.canAccessFile(current.user.id, file.id)
-                    : false));
+                (await fileCanAccess(executor, current.user.id, file.id)));
         return !file
-            ? reply.code(404).send({ error: "not_found" })
+            ? reply.code(404).send({
+                error: "not_found",
+            })
             : !accessible
-                ? reply.code(404).send({ error: "not_found" })
-                : { signedUrl: await signedUrl(config, tokens, file.id) };
+                ? reply.code(404).send({
+                    error: "not_found",
+                })
+                : {
+                    signedUrl: await signedUrl(config, tokens, file.id),
+                };
     });
     app.get("/v0/files/:fileId", async (request, reply) => {
         const fileId = request.params.fileId;
         const token = request.query.token;
         if (!fileId)
-            return reply.code(404).send({ error: "not_found" });
-        const file = await database.findFile(fileId);
+            return reply.code(404).send({
+                error: "not_found",
+            });
+        const file = await fileFind(executor, fileId);
         if (!file)
-            return reply.code(404).send({ error: "not_found" });
+            return reply.code(404).send({
+                error: "not_found",
+            });
         if (token) {
             try {
                 if ((await tokens.verifyFileUrlToken(token)) !== fileId)
-                    return reply.code(401).send({ error: "invalid_file_url" });
+                    return reply.code(401).send({
+                        error: "invalid_file_url",
+                    });
             }
             catch {
-                return reply.code(401).send({ error: "invalid_file_url" });
+                return reply.code(401).send({
+                    error: "invalid_file_url",
+                });
             }
         }
         else {
             const current = await auth.authenticate(request);
             if (!current)
-                return reply.code(401).send({ error: "unauthorized" });
+                return reply.code(401).send({
+                    error: "unauthorized",
+                });
             const accessible = file.isPublic ||
                 file.uploadedByUserId === current.user.id ||
-                (collaboration
-                    ? await collaboration.canAccessFile(current.user.id, file.id)
-                    : false);
+                (await fileCanAccess(executor, current.user.id, file.id));
             if (!accessible)
-                return reply.code(404).send({ error: "not_found" });
+                return reply.code(404).send({
+                    error: "not_found",
+                });
         }
         const range = parseRange(request.headers.range, file.size);
         if (range === "invalid")
-            return reply
-                .code(416)
-                .header("content-range", `bytes */${file.size}`)
-                .send({ error: "invalid_range" });
+            return reply.code(416).header("content-range", `bytes */${file.size}`).send({
+                error: "invalid_range",
+            });
         const response = reply
             .type(file.contentType)
             .header("cache-control", "private, max-age=300")
@@ -260,30 +393,40 @@ export function registerFileRoutes(app, config, auth, database, tokens, files, c
             const fileId = request.params.fileId;
             const token = request.query.token;
             if (!fileId)
-                return reply.code(404).send({ error: "not_found" });
-            const file = await database.findFile(fileId);
+                return reply.code(404).send({
+                    error: "not_found",
+                });
+            const file = await fileFind(executor, fileId);
             if (!file)
-                return reply.code(404).send({ error: "not_found" });
+                return reply.code(404).send({
+                    error: "not_found",
+                });
             if (token) {
                 try {
                     if ((await tokens.verifyFileUrlToken(token)) !== fileId)
-                        return reply.code(401).send({ error: "invalid_file_url" });
+                        return reply.code(401).send({
+                            error: "invalid_file_url",
+                        });
                 }
                 catch {
-                    return reply.code(401).send({ error: "invalid_file_url" });
+                    return reply.code(401).send({
+                        error: "invalid_file_url",
+                    });
                 }
             }
             else {
                 const current = await auth.authenticate(request);
                 if (!current)
-                    return reply.code(401).send({ error: "unauthorized" });
+                    return reply.code(401).send({
+                        error: "unauthorized",
+                    });
                 const accessible = file.isPublic ||
                     file.uploadedByUserId === current.user.id ||
-                    (collaboration
-                        ? await collaboration.canAccessFile(current.user.id, file.id)
-                        : false);
+                    (await fileCanAccess(executor, current.user.id, file.id));
                 if (!accessible)
-                    return reply.code(404).send({ error: "not_found" });
+                    return reply.code(404).send({
+                        error: "not_found",
+                    });
             }
             const asset = await files.variant(file, variant);
             return asset
@@ -294,7 +437,9 @@ export function registerFileRoutes(app, config, auth, database, tokens, files, c
                     .header("x-content-type-options", "nosniff")
                     .header("content-disposition", "inline")
                     .send(asset.stream)
-                : reply.code(404).send({ error: "not_found" });
+                : reply.code(404).send({
+                    error: "not_found",
+                });
         });
     }
 }
@@ -326,13 +471,19 @@ function parseRange(header, size) {
         end < start ||
         start >= size)
         return "invalid";
-    return { start, end: Math.min(end, size - 1) };
+    return {
+        start,
+        end: Math.min(end, size - 1),
+    };
 }
 async function signedUrl(config, tokens, fileId) {
     const expiresAt = new Date(Date.now() + config.files.signedUrlExpirySeconds * 1000);
     const url = new URL(`/v0/files/${fileId}`, config.server.publicUrl);
     url.searchParams.set("token", await tokens.issueFileUrlToken(fileId, config.files.signedUrlExpirySeconds));
-    return { url: url.toString(), expiresAt: expiresAt.toISOString() };
+    return {
+        url: url.toString(),
+        expiresAt: expiresAt.toISOString(),
+    };
 }
 async function readLimited(stream, maximum) {
     const chunks = [];
@@ -346,6 +497,31 @@ async function readLimited(stream, maximum) {
     }
     return Buffer.concat(chunks, size);
 }
+function multipartFieldValue(field) {
+    const part = Array.isArray(field) ? field[0] : field;
+    return part?.value;
+}
+function avatarCropParse(value) {
+    if (typeof value !== "string")
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return undefined;
+    const candidate = parsed;
+    if (Object.keys(parsed).length !== 4 ||
+        !Number.isSafeInteger(candidate.x) ||
+        !Number.isSafeInteger(candidate.y) ||
+        !Number.isSafeInteger(candidate.width) ||
+        !Number.isSafeInteger(candidate.height))
+        return undefined;
+    return candidate;
+}
 async function fileResponse(files, file, includeVariants) {
     const variants = includeVariants ? await files.variantSizes(file) : {};
     return {
@@ -380,7 +556,9 @@ function parseUploadOffset(value) {
 }
 function sendUploadError(reply, log, error) {
     if (error instanceof UploadNotFoundError)
-        return reply.code(404).send({ error: "not_found" });
+        return reply.code(404).send({
+            error: "not_found",
+        });
     if (error instanceof FileQuotaExceededError)
         return reply.code(413).send({
             error: "file_quota_exceeded",
@@ -388,10 +566,19 @@ function sendUploadError(reply, log, error) {
             limit: error.limit,
         });
     if (error instanceof UploadRejectedError)
-        return reply.code(422).send({ error: "upload_rejected" });
+        return reply.code(422).send({
+            error: "upload_rejected",
+        });
     if (error instanceof InvalidUploadError)
-        return reply.code(400).send({ error: "invalid_file", message: error.message });
-    log.error({ err: error }, "File upload failed");
-    return reply.code(500).send({ error: "internal_server_error" });
+        return reply.code(400).send({
+            error: "invalid_file",
+            message: error.message,
+        });
+    log.error({
+        err: error,
+    }, "File upload failed");
+    return reply.code(500).send({
+        error: "internal_server_error",
+    });
 }
 //# sourceMappingURL=files.js.map