instaserve 1.1.19 → 1.1.21

package/api.txt

@@ -41,7 +41,7 @@ POST /upload
   Upload a file.
   Body (JSON):
   {
-    "bucket": "my-bucket-name",
+    "bucket": "my-bucket-name", // Optional if env var set
     "key": "filename.jpg",
     "body": "base64_encoded_string_contents",
     "contentType": "image/jpeg"
@@ -49,13 +49,13 @@ POST /upload
 
 POST /files
   List files in a bucket.
-  Body (JSON): { "bucket": "my-bucket-name" }
+  Body (JSON): { "bucket": "my-bucket-name" } // Bucket optional if env var set
   Returns: List of file objects (key, size, lastModified).
 
 GET /download?bucket=my-bucket-name&key=filename.jpg
-  Download a file directly.
+  Download a file directly. Bucket optional if env var set.
   (Available via the 'download' route handler)
 
 GET /delete?bucket=my-bucket-name&key=filename.jpg
-  Delete a file.
+  Delete a file. Bucket optional if env var set.
   (Available via the 'delete' route handler)

package/lib/auth0.js

@@ -41,7 +41,7 @@ export default {
     if (token) {
       global.sqlite.prepare("UPDATE users SET token = NULL WHERE token = ?").run(token);
     }
-    res.setHeader("Set-Cookie", "token=; Path=/; HttpOnly; Secure; SameSite=Lax");
+    res.setHeader("Set-Cookie", "token=; Path=/; HttpOnly; Secure; SameSite=Strict");
     res.writeHead(302, { Location: LOGGEDOUT_REDIRECT });
     res.end();
   },

package/lib/r2.js

@@ -5,6 +5,7 @@ import { URL } from 'url';
 const cloudflareAccessKeyId = process.env.CLOUDFLARE_ACCESS_KEY_ID || process.env.cloudflareAccessKeyId;
 const cloudflareSecretAccessKey = process.env.CLOUDFLARE_SECRET_ACCESS_KEY || process.env.cloudflareSecretAccessKey;
 const cloudflareAccountId = process.env.CLOUDFLARE_ACCOUNT_ID || process.env.cloudflareAccountId;
+const cloudflareBucket = process.env.CLOUDFLARE_BUCKET || process.env.cloudflareBucket || process.env.CLOUDFLARE_BUCKET_NAME || process.env.cloudflareBucketName;
 
 if (!cloudflareAccessKeyId || !cloudflareSecretAccessKey || !cloudflareAccountId) {
   console.warn("Cloudflare environment variables not set! Please set CLOUDFLARE_ACCESS_KEY_ID, CLOUDFLARE_SECRET_ACCESS_KEY, and CLOUDFLARE_ACCOUNT_ID.");
@@ -152,6 +153,7 @@ const getSecrets = ({ cloudflareAccessKeyId, cloudflareSecretAccessKey, cloudfla
 );
 
 async function uploadToR2(bucket, key, body, contentType, secrets) {
+  bucket = bucket || cloudflareBucket;
   if (!body) body = Buffer.alloc(0);
   const signed = signR2('PUT', bucket, key, body, ...getSecrets(secrets));
   signed.headers['Content-Type'] = contentType || 'application/octet-stream';
@@ -160,6 +162,7 @@ async function uploadToR2(bucket, key, body, contentType, secrets) {
 }
 
 async function downloadFromR2(bucket, key, secrets) {
+  bucket = bucket || cloudflareBucket;
   const signed = signR2('GET', bucket, key, null, ...getSecrets(secrets));
   const { hostname, pathname, search } = new URL(signed.url);
 
@@ -187,11 +190,13 @@ async function downloadFromR2(bucket, key, secrets) {
 }
 
 async function deleteFromR2(bucket, key, secrets) {
+  bucket = bucket || cloudflareBucket;
   await requestR2(signR2('DELETE', bucket, key, null, ...getSecrets(secrets)));
   return { success: true };
 }
 
 async function listR2Files(bucket, prefix, secrets) {
+  bucket = bucket || cloudflareBucket;
   const qs = prefix ? `list-type=2&prefix=${encodeURIComponent(prefix)}` : 'list-type=2';
 
   const data = await requestR2(signR2('GET', bucket, '', null, ...getSecrets(secrets), qs));
@@ -204,6 +209,7 @@ async function listR2Files(bucket, prefix, secrets) {
 }
 
 function getSignedDownloadUrl(bucket, key, secrets) {
+  bucket = bucket || cloudflareBucket;
   return signR2('GET', bucket, key, null, ...getSecrets(secrets)).url;
 }
 
@@ -229,8 +235,30 @@ export const fileRoutes = {
   },
   download: async (req, res, data) => {
     try {
-      return await downloadFromR2(data.bucket, data.key, data.secrets || defaultSecrets);
-    } catch (e) { return { error: e.message }; }
+      const r2Msg = await downloadFromR2(data.bucket, data.key, data.secrets || defaultSecrets);
+      res.writeHead(r2Msg.statusCode, r2Msg.statusMessage, r2Msg.headers);
+
+      await new Promise((resolve, reject) => {
+        r2Msg.pipe(res);
+        r2Msg.on('error', (err) => {
+          res.destroy(err);
+          reject(err);
+        });
+        res.on('finish', resolve);
+        res.on('error', reject);
+      });
+
+      // returning nothing to prevent sendResponse from interfering
+      return;
+    } catch (e) {
+      // If headers weren't sent yet, we can return error JSON
+      if (!res.headersSent) {
+        return { error: e.message };
+      }
+      // If headers were sent, we can't cleanly return JSON, 
+      // but the stream error handling above usually takes care of destroying the socket.
+      console.error("Download stream error:", e);
+    }
   },
   delete: async (req, res, data) => {
     try {

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "instaserve",
-  "version": "1.1.19",
+  "version": "1.1.21",
   "description": "Instant web stack",
   "main": "module.mjs",
   "bin": "./instaserve",
   "scripts": {
-    "start": "node instaserve",
+    "start": "node instaserve -api ./routes-full.js -secure -port 3001 -public ./public",
     "test": "./test_api.sh"
   },
   "type": "module",

package/public/index.html

@@ -258,7 +258,7 @@
 
                     <h3 class="section-title">R2 Storage</h3>
                     <div style="margin-top: 0.5rem;">
-                        <input type="text" id="r2-bucket" placeholder="Bucket Name" class="input-field">
+                        <input type="text" id="r2-bucket" placeholder="Bucket Name (Optional)" class="input-field">
                         <input type="file" id="r2-file" style="margin-bottom: 0.5rem; width: 100%;">
                         <div style="display: flex; gap: 0.5rem;">
                             <button onclick="uploadFile()" class="btn-sm">Upload File</button>
@@ -321,7 +321,7 @@
             const bucket = val('r2-bucket');
             const fileInput = document.getElementById('r2-file');
             const file = fileInput.files[0];
-            if (!bucket || !file) return log('Please enter a bucket and select a file.');
+            if (!file) return log('Please select a file.');
 
             const reader = new FileReader();
             reader.onload = async () => {
@@ -338,7 +338,7 @@
 
         async function listFiles() {
             const bucket = val('r2-bucket');
-            if (!bucket) return log('Please enter a bucket.');
+
             await api('POST', '/files', { bucket });
         }
     </script>

package/test_api.sh

@@ -139,6 +139,65 @@ else
   echo "  ❌ FAIL: $RESPONSE"
 fi
 
+# File API Tests
+TEST_FILE_KEY="test_file.txt"
+TEST_FILE_CONTENT="Hello R2 File Test"
+# Use base64 without newlines
+TEST_FILE_B64=$(echo -n "$TEST_FILE_CONTENT" | base64 | tr -d '\n')
+
+echo ""
+echo "--- File API Tests ---"
+
+# Test 5.1: Upload File
+echo "- Testing POST /upload..."
+RESPONSE=$(curl -k -s -X POST "$BASE_URL/upload" \
+  -H "Cookie: token=$TEST_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{\"key\": \"$TEST_FILE_KEY\", \"body\": \"$TEST_FILE_B64\", \"contentType\": \"text/plain\"}")
+
+if [[ "$RESPONSE" == *"true"* ]]; then
+  echo "  ✅ PASS"
+else
+  echo "  ❌ FAIL: $RESPONSE"
+fi
+
+# Test 5.2: Download File
+echo "- Testing GET /download..."
+RESPONSE=$(curl -k -s "$BASE_URL/download?key=$TEST_FILE_KEY" \
+  -H "Cookie: token=$TEST_TOKEN")
+
+if [[ "$RESPONSE" == *"$TEST_FILE_CONTENT"* ]]; then
+  echo "  ✅ PASS: Content matches"
+else
+  echo "  ❌ FAIL: Content mismatch or error. Got: $RESPONSE"
+fi
+
+# Test 5.3: List Files
+echo "- Testing POST /files (List)..."
+RESPONSE=$(curl -k -s -X POST "$BASE_URL/files" \
+  -H "Cookie: token=$TEST_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{}")
+
+if [[ "$RESPONSE" == *"$TEST_FILE_KEY"* ]]; then
+  echo "  ✅ PASS: Found file in list"
+else
+  echo "  ❌ FAIL: $RESPONSE"
+fi
+
+# Test 5.4: Delete File
+echo "- Testing POST /delete..."
+RESPONSE=$(curl -k -s -X POST "$BASE_URL/delete" \
+  -H "Cookie: token=$TEST_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{\"key\": \"$TEST_FILE_KEY\"}")
+
+if [[ "$RESPONSE" == *"true"* ]]; then
+  echo "  ✅ PASS"
+else
+  echo "  ❌ FAIL: $RESPONSE"
+fi
+
 # 7. Test Login Redirect
 echo "- Testing GET /login (Expect 302 Redirect to Auth0)..."
 LOGIN_HTTP_CODE=$(curl -k -s -o /dev/null -w "%{http_code}" "$BASE_URL/login")