json-rest-api 1.0.21 → 1.0.22

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__storage__local-storage.js.txt

@@ -0,0 +1,218 @@
+     1	/**
+     2	 * Local File Storage Adapter
+     3	 *
+     4	 * Production-ready local storage with secure filename handling
+     5	 */
+     6	
+     7	import { promises as fs } from 'fs'
+     8	import path from 'path'
+     9	import crypto from 'crypto'
+    10	
+    11	export class LocalStorage {
+    12	  constructor (options = {}) {
+    13	    this.directory = path.resolve(options.directory || './uploads')
+    14	    this.fileBaseUrl = options.fileBaseUrl || '/uploads'
+    15	    this.nameStrategy = options.nameStrategy || 'hash' // 'hash', 'timestamp', 'original', 'custom'
+    16	    this.nameGenerator = options.nameGenerator // Custom function
+    17	    this.preserveExtension = options.preserveExtension !== false
+    18	    this.allowedExtensions = options.allowedExtensions // Whitelist
+    19	    this.maxFilenameLength = options.maxFilenameLength || 255
+    20	  }
+    21	
+    22	  /**
+    23	   * Generate a safe filename
+    24	   */
+    25	  async generateFilename (file) {
+    26	    let basename, extension
+    27	
+    28	    // Extract and validate extension
+    29	    const originalExt = path.extname(file.filename).toLowerCase()
+    30	    if (this.preserveExtension && originalExt) {
+    31	      // Validate extension against whitelist if provided
+    32	      if (this.allowedExtensions && !this.allowedExtensions.includes(originalExt)) {
+    33	        throw new Error(`File extension '${originalExt}' is not allowed`)
+    34	      }
+    35	      extension = originalExt
+    36	    } else {
+    37	      // Determine extension from MIME type for safety
+    38	      extension = this.getExtensionFromMimeType(file.mimetype)
+    39	    }
+    40	
+    41	    // Generate basename based on strategy
+    42	    switch (this.nameStrategy) {
+    43	      case 'hash':
+    44	        // Cryptographically secure random name
+    45	        basename = crypto.randomBytes(16).toString('hex')
+    46	        break
+    47	
+    48	      case 'timestamp':
+    49	        // Timestamp + random suffix to prevent collisions
+    50	        basename = `${Date.now()}_${crypto.randomBytes(4).toString('hex')}`
+    51	        break
+    52	
+    53	      case 'original':
+    54	        // Sanitized original filename
+    55	        basename = this.sanitizeFilename(
+    56	          path.basename(file.filename, originalExt)
+    57	        )
+    58	        break
+    59	
+    60	      case 'custom':
+    61	        if (!this.nameGenerator) {
+    62	          throw new Error('nameGenerator function required for custom strategy')
+    63	        }
+    64	        basename = await this.nameGenerator(file)
+    65	        break
+    66	
+    67	      default:
+    68	        throw new Error(`Unknown name strategy: ${this.nameStrategy}`)
+    69	    }
+    70	
+    71	    // Combine basename and extension
+    72	    let filename = extension ? `${basename}${extension}` : basename
+    73	
+    74	    // Ensure filename doesn't exceed max length
+    75	    if (filename.length > this.maxFilenameLength) {
+    76	      // Truncate basename to fit
+    77	      const maxBasename = this.maxFilenameLength - (extension?.length || 0)
+    78	      basename = basename.substring(0, maxBasename)
+    79	      filename = extension ? `${basename}${extension}` : basename
+    80	    }
+    81	
+    82	    // Handle duplicates
+    83	    filename = await this.ensureUnique(filename)
+    84	
+    85	    return filename
+    86	  }
+    87	
+    88	  /**
+    89	   * Sanitize filename for safe storage
+    90	   */
+    91	  sanitizeFilename (filename) {
+    92	    return filename
+    93	      // Remove path traversal attempts
+    94	      .replace(/\.\./g, '')
+    95	      .replace(/[\/\\]/g, '')
+    96	      // Remove control characters and special chars
+    97	      .replace(/[^\w\s.-]/g, '_')
+    98	      // Remove leading/trailing dots and spaces
+    99	      .replace(/^[\s.]+|[\s.]+$/g, '')
+   100	      // Collapse multiple underscores
+   101	      .replace(/_+/g, '_') ||
+   102	      // Default if empty
+   103	      'unnamed'
+   104	  }
+   105	
+   106	  /**
+   107	   * Ensure filename is unique
+   108	   */
+   109	  async ensureUnique (filename) {
+   110	    const filepath = path.join(this.directory, filename)
+   111	
+   112	    try {
+   113	      await fs.access(filepath)
+   114	      // File exists, generate unique name
+   115	      const ext = path.extname(filename)
+   116	      const base = path.basename(filename, ext)
+   117	      let counter = 1
+   118	      let newFilename
+   119	
+   120	      do {
+   121	        newFilename = `${base}_${counter}${ext}`
+   122	        counter++
+   123	      } while (await this.fileExists(path.join(this.directory, newFilename)))
+   124	
+   125	      return newFilename
+   126	    } catch (error) {
+   127	      // File doesn't exist, name is unique
+   128	      return filename
+   129	    }
+   130	  }
+   131	
+   132	  /**
+   133	   * Check if file exists
+   134	   */
+   135	  async fileExists (filepath) {
+   136	    try {
+   137	      await fs.access(filepath)
+   138	      return true
+   139	    } catch {
+   140	      return false
+   141	    }
+   142	  }
+   143	
+   144	  /**
+   145	   * Get safe extension from MIME type
+   146	   */
+   147	  getExtensionFromMimeType (mimetype) {
+   148	    // Safe mappings only
+   149	    const mimeToExt = {
+   150	      'image/jpeg': '.jpg',
+   151	      'image/png': '.png',
+   152	      'image/gif': '.gif',
+   153	      'image/webp': '.webp',
+   154	      'application/pdf': '.pdf',
+   155	      'text/plain': '.txt',
+   156	      'application/json': '.json',
+   157	      'video/mp4': '.mp4',
+   158	      'audio/mpeg': '.mp3',
+   159	      'application/zip': '.zip'
+   160	    }
+   161	
+   162	    return mimeToExt[mimetype] || '.bin'
+   163	  }
+   164	
+   165	  /**
+   166	   * Upload file with secure filename
+   167	   */
+   168	  async upload (file) {
+   169	    // Ensure directory exists
+   170	    await fs.mkdir(this.directory, { recursive: true })
+   171	
+   172	    // Generate secure filename
+   173	    const filename = await this.generateFilename(file)
+   174	    const filepath = path.join(this.directory, filename)
+   175	
+   176	    // Ensure we're not writing outside our directory (defense in depth)
+   177	    const resolvedPath = path.resolve(filepath)
+   178	    const resolvedDir = path.resolve(this.directory)
+   179	    if (!resolvedPath.startsWith(resolvedDir)) {
+   180	      throw new Error('Invalid file path')
+   181	    }
+   182	
+   183	    // Write file
+   184	    if (file.data) {
+   185	      await fs.writeFile(filepath, file.data)
+   186	    } else if (file.filepath) {
+   187	      await fs.rename(file.filepath, filepath)
+   188	    } else {
+   189	      throw new Error('File has no data or filepath')
+   190	    }
+   191	
+   192	    // Return public URL
+   193	    return `${this.fileBaseUrl}/${filename}`
+   194	  }
+   195	
+   196	  /**
+   197	   * Delete a file
+   198	   */
+   199	  async delete (url) {
+   200	    const filename = path.basename(url)
+   201	    const filepath = path.join(this.directory, filename)
+   202	
+   203	    // Security check
+   204	    const resolvedPath = path.resolve(filepath)
+   205	    const resolvedDir = path.resolve(this.directory)
+   206	    if (!resolvedPath.startsWith(resolvedDir)) {
+   207	      throw new Error('Invalid file path')
+   208	    }
+   209	
+   210	    try {
+   211	      await fs.unlink(filepath)
+   212	    } catch (error) {
+   213	      if (error.code !== 'ENOENT') {
+   214	        throw error
+   215	      }
+   216	    }
+   217	  }
+   218	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__storage__s3-storage.js.txt

@@ -0,0 +1,124 @@
+     1	/**
+     2	 * S3 Storage Adapter
+     3	 *
+     4	 * Stores uploaded files in Amazon S3 or S3-compatible storage.
+     5	 *
+     6	 * Usage:
+     7	 * ```javascript
+     8	 * import { S3Storage } from 'jsonrestapi/lib/storage/s3-storage.js';
+     9	 *
+    10	 * const storage = new S3Storage({
+    11	 *   bucket: 'my-uploads',
+    12	 *   region: 'us-east-1',
+    13	 *   accessKeyId: process.env.AWS_ACCESS_KEY_ID,
+    14	 *   secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
+    15	 *   prefix: 'uploads/' // optional path prefix
+    16	 * });
+    17	 *
+    18	 * const schema = {
+    19	 *   image: { type: 'file', storage }
+    20	 * };
+    21	 * ```
+    22	 */
+    23	
+    24	import crypto from 'crypto'
+    25	import path from 'path'
+    26	
+    27	export class S3Storage {
+    28	  constructor (options = {}) {
+    29	    this.bucket = options.bucket
+    30	    this.region = options.region || 'us-east-1'
+    31	    this.prefix = options.prefix || ''
+    32	    this.acl = options.acl || 'public-read'
+    33	
+    34	    if (!this.bucket) {
+    35	      throw new Error('S3Storage requires a bucket name')
+    36	    }
+    37	
+    38	    // Note: In a real implementation, you would initialize the AWS SDK here
+    39	    // For this example, we'll just mock the behavior
+    40	    this.mockMode = options.mockMode !== false // Default to mock mode
+    41	
+    42	    if (!this.mockMode) {
+    43	      // Real S3 initialization would go here
+    44	      // const { S3Client } = require('@aws-sdk/client-s3');
+    45	      // this.s3 = new S3Client({ region: this.region });
+    46	    }
+    47	  }
+    48	
+    49	  /**
+    50	   * Upload a file to S3
+    51	   * @param {Object} file - File object from detector
+    52	   * @returns {Promise<string>} URL of the uploaded file
+    53	   */
+    54	  async upload (file) {
+    55	    // Generate S3 key
+    56	    const ext = path.extname(file.filename)
+    57	    const hash = crypto.randomBytes(16).toString('hex')
+    58	    const key = `${this.prefix}${hash}${ext}`
+    59	
+    60	    if (this.mockMode) {
+    61	      // Mock mode - just return a fake URL
+    62	      const url = `https://${this.bucket}.s3.${this.region}.amazonaws.com/${key}`
+    63	
+    64	      // Simulate upload delay
+    65	      await new Promise(resolve => setTimeout(resolve, 100))
+    66	
+    67	      return url
+    68	    }
+    69	
+    70	    // Real S3 upload would go here
+    71	    /*
+    72	    const { PutObjectCommand } = require('@aws-sdk/client-s3');
+    73	
+    74	    const command = new PutObjectCommand({
+    75	      Bucket: this.bucket,
+    76	      Key: key,
+    77	      Body: file.data,
+    78	      ContentType: file.mimetype,
+    79	      ACL: this.acl,
+    80	      Metadata: {
+    81	        originalName: file.filename
+    82	      }
+    83	    });
+    84	
+    85	    await this.s3.send(command);
+    86	
+    87	    // Return public URL
+    88	    if (this.acl === 'public-read') {
+    89	      return `https://${this.bucket}.s3.${this.region}.amazonaws.com/${key}`;
+    90	    } else {
+    91	      // For private files, you might return a signed URL
+    92	      return await this.getSignedUrl(key);
+    93	    }
+    94	    */
+    95	  }
+    96	
+    97	  /**
+    98	   * Delete a file from S3
+    99	   * @param {string} url - URL returned by upload()
+   100	   * @returns {Promise<void>}
+   101	   */
+   102	  async delete (url) {
+   103	    // Extract key from URL
+   104	    const urlObj = new URL(url)
+   105	    const key = urlObj.pathname.substring(1) // Remove leading /
+   106	
+   107	    if (this.mockMode) {
+   108	      // Mock mode - just simulate deletion
+   109	      await new Promise(resolve => setTimeout(resolve, 50))
+   110	    }
+   111	
+   112	    // Real S3 delete would go here
+   113	    /*
+   114	    const { DeleteObjectCommand } = require('@aws-sdk/client-s3');
+   115	
+   116	    const command = new DeleteObjectCommand({
+   117	      Bucket: this.bucket,
+   118	      Key: key
+   119	    });
+   120	
+   121	    await this.s3.send(command);
+   122	    */
+   123	  }
+   124	}

package/audit/evidence/code/critical-pass1/json-rest-schema__src__CorePlugin.js.txt

@@ -0,0 +1,269 @@
+     1	/**
+     2	 * @file Contains all the built-in type and validator handlers for the schema library.
+     3	 */
+     4	
+     5	import * as flatted from 'flatted'
+     6	
+     7	/**
+     8	 * @typedef {import('./Schema.js').ValidationContext} ValidationContext
+     9	 */
+    10	
+    11	/**
+    12	 * The CorePlugin provides the default set of types and validators.
+    13	 */
+    14	const CorePlugin = {
+    15	  /**
+    16	   * Installs the core types and validators.
+    17	   * @param {{addType: Function, addValidator: Function}} api - An object containing registration functions.
+    18	   */
+    19	  install (api) {
+    20	    const { addType, addValidator } = api // Destructure the API functions
+    21	
+    22	    // --- Type Handlers ---
+    23	
+    24	    addType('none', context => context.value)
+    25	
+    26	    addType('file', context => {
+    27	      const val = context.value
+    28	      if (val === undefined || val === null) context.throwTypeError()
+    29	
+    30	      // Only attempt to convert primitives. Fail on complex objects/arrays.
+    31	      // A file is expected to be just a file handle
+    32	      const valType = typeof val
+    33	      if (valType === 'string' || valType === 'number' || valType === 'boolean') {
+    34	        const s = val.toString()
+    35	        return context.definition.noTrim ? s : s.trim()
+    36	      }
+    37	
+    38	      // If it's not a primitive that can be safely converted, it's a type error.
+    39	      context.throwTypeError()
+    40	    })
+    41	
+    42	    addType('string', context => {
+    43	      const val = context.value
+    44	      if (val === undefined || val === null) return ''
+    45	
+    46	      // Only attempt to convert primitives. Fail on complex objects/arrays.
+    47	      const valType = typeof val
+    48	      if (valType === 'string' || valType === 'number' || valType === 'boolean') {
+    49	        const s = val.toString()
+    50	        return context.definition.noTrim ? s : s.trim()
+    51	      }
+    52	
+    53	      // If it's not a primitive that can be safely converted, it's a type error.
+    54	      context.throwTypeError()
+    55	    })
+    56	
+    57	    addType('blob', context => context.value)
+    58	    addType('number', context => {
+    59	      if (context.value === undefined || context.value === null || context.value === '') return 0
+    60	      const r = Number(context.value)
+    61	      if (isNaN(r)) context.throwTypeError()
+    62	      return r
+    63	    })
+    64	    addType('timestamp', context => {
+    65	      const r = Number(context.value)
+    66	      if (isNaN(r)) context.throwTypeError()
+    67	      if (!r && context.computedOptions.nullable) return null
+    68	      return r
+    69	    })
+    70	    addType('dateTime', context => {
+    71	      if (!context.value || context.value === '') return null
+    72	
+    73	      // If already a Date object, return it
+    74	      if (context.value instanceof Date) {
+    75	        return isNaN(context.value.getTime()) ? null : context.value
+    76	      }
+    77	
+    78	      // Handle string values
+    79	      if (typeof context.value === 'string') {
+    80	        // Detect MySQL datetime format: 'YYYY-MM-DD HH:MM:SS'
+    81	        const isMySQLFormat = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}/.test(context.value) &&
+    82	                             !context.value.includes('T') &&
+    83	                             !context.value.includes('Z')
+    84	
+    85	        if (isMySQLFormat) {
+    86	          // Convert to ISO format and force UTC interpretation
+    87	          const d = new Date(context.value.replace(' ', 'T') + 'Z')
+    88	          if (isNaN(d.getTime())) {
+    89	            context.throwTypeError()
+    90	          }
+    91	          return d
+    92	        }
+    93	      }
+    94	
+    95	      // Try to parse the value normally
+    96	      const d = new Date(context.value)
+    97	      if (isNaN(d.getTime())) {
+    98	        return null
+    99	      }
+   100	
+   101	      // Return the Date object directly - let Knex handle the database formatting
+   102	      return d
+   103	    })
+   104	    addType('date', context => {
+   105	      if (!context.value || context.value === '') return null
+   106	
+   107	      // Parse the input value to a Date object
+   108	      let d
+   109	      if (context.value instanceof Date) {
+   110	        d = context.value
+   111	      } else {
+   112	        let dateStr = String(context.value)
+   113	
+   114	        // If it's just a date (YYYY-MM-DD), add time at UTC midnight
+   115	        if (/^\d{4}-\d{2}-\d{2}$/.test(dateStr)) {
+   116	          dateStr += 'T00:00:00Z'
+   117	        }
+   118	
+   119	        d = new Date(dateStr)
+   120	      }
+   121	
+   122	      if (isNaN(d.getTime())) {
+   123	        context.throwTypeError()
+   124	      }
+   125	
+   126	      // Normalize to midnight UTC
+   127	      const normalized = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()))
+   128	      return normalized
+   129	    })
+   130	    addType('time', context => {
+   131	      if (!context.value || context.value === '') return null
+   132	
+   133	      // Try to parse as time string (HH:MM:SS or HH:MM)
+   134	      if (typeof context.value === 'string') {
+   135	        // Match HH:MM:SS or HH:MM format
+   136	        const timeMatch = context.value.match(/^(\d{1,2}):(\d{2})(?::(\d{2}))?$/)
+   137	        if (timeMatch) {
+   138	          const hours = parseInt(timeMatch[1], 10)
+   139	          const minutes = parseInt(timeMatch[2], 10)
+   140	          const seconds = timeMatch[3] ? parseInt(timeMatch[3], 10) : 0
+   141	
+   142	          // Validate ranges
+   143	          if (hours >= 0 && hours <= 23 && minutes >= 0 && minutes <= 59 && seconds >= 0 && seconds <= 59) {
+   144	            // Return normalized HH:MM:SS format as string
+   145	            // Note: We return string because most databases don't have a true time-only type
+   146	            return `${hours.toString().padStart(2, '0')}:${minutes.toString().padStart(2, '0')}:${seconds.toString().padStart(2, '0')}`
+   147	          }
+   148	        }
+   149	      }
+   150	
+   151	      // Try to extract time from a Date object or datetime string
+   152	      try {
+   153	        const d = new Date(context.value)
+   154	        if (!isNaN(d.getTime())) {
+   155	          // Extract time portion in HH:MM:SS format
+   156	          return d.toISOString().slice(11, 19)
+   157	        }
+   158	      } catch (e) {
+   159	        // Invalid date
+   160	      }
+   161	
+   162	      context.throwTypeError()
+   163	    })
+   164	    addType('array', context => {
+   165	      if (context.definition.type === 'array' && !Array.isArray(context.value)) {
+   166	        return [context.value]
+   167	      }
+   168	      return context.value
+   169	    })
+   170	    addType('object', context => context.value)
+   171	    addType('serialize', context => {
+   172	      try {
+   173	        // First try regular JSON.stringify for non-circular objects
+   174	        return JSON.stringify(context.value)
+   175	      } catch (e) {
+   176	        // If that fails (likely circular reference), use flatted
+   177	        try {
+   178	          return flatted.stringify(context.value)
+   179	        } catch (e2) {
+   180	          context.throwTypeError()
+   181	        }
+   182	      }
+   183	    })
+   184	    addType('boolean', context => {
+   185	      if (typeof context.value === 'string') {
+   186	        const falseVal = context.definition.stringFalseWhen || 'false'
+   187	        const trueVal = context.definition.stringTrueWhen || 'true'
+   188	        const lowerValue = context.value.toLowerCase()
+   189	        if (lowerValue === falseVal) return false
+   190	        if ([trueVal, 'on'].includes(lowerValue)) return true
+   191	        return false
+   192	      }
+   193	      return !!context.value
+   194	    })
+   195	    addType('id', context => {
+   196	      const n = parseInt(context.value, 10)
+   197	      if (isNaN(n)) context.throwTypeError()
+   198	      return n
+   199	    })
+   200	
+   201	    // --- Validator Handlers ---
+   202	    addValidator('minLength', context => {
+   203	      if (context.value === undefined) return
+   204	      if (context.definition.type === 'string' && context.value.toString && context.value.toString().length < context.parameterValue) {
+   205	        context.throwParamError('MIN_LENGTH', `Length must be at least ${context.parameterValue} characters.`, { min: context.parameterValue, actual: context.value.toString().length })
+   206	      }
+   207	    })
+   208	
+   209	    addValidator('min', context => {
+   210	      if (context.value === undefined) return
+   211	      if (context.definition.type === 'number' && typeof context.value === 'number' && context.value < context.parameterValue) {
+   212	        context.throwParamError('MIN_VALUE', `Value must be at least ${context.parameterValue}.`, { min: context.parameterValue, actual: context.value })
+   213	      }
+   214	    })
+   215	    addValidator('maxLength', context => {
+   216	      if (context.value === undefined) return
+   217	      if (context.definition.type === 'string' && context.value.toString && context.value.toString().length > context.parameterValue) {
+   218	        context.throwParamError('MAX_LENGTH', `Length must be no more than ${context.parameterValue} characters.`, { max: context.parameterValue, actual: context.value.toString().length })
+   219	      }
+   220	    })
+   221	
+   222	    addValidator('max', context => {
+   223	      if (context.value === undefined) return
+   224	      if (context.definition.type === 'number' && typeof context.value === 'number' && context.value > context.parameterValue) {
+   225	        context.throwParamError('MAX_VALUE', `Value must be no more than ${context.parameterValue}.`, { max: context.parameterValue, actual: context.value })
+   226	      }
+   227	    })
+   228	    addValidator('validator', async context => {
+   229	      if (typeof context.parameterValue !== 'function') {
+   230	        throw new Error(`Validator for ${context.fieldName} must be a function.`)
+   231	      }
+   232	      const r = await context.parameterValue(context.value, context.object, context)
+   233	      if (typeof r === 'string') {
+   234	        context.throwParamError('CUSTOM_VALIDATOR_FAILED', r)
+   235	      }
+   236	    })
+   237	    addValidator('uppercase', context => {
+   238	      if (typeof context.value === 'string') return context.value.toUpperCase()
+   239	    })
+   240	    addValidator('lowercase', context => {
+   241	      if (typeof context.value === 'string') return context.value.toLowerCase()
+   242	    })
+   243	    addValidator('length', context => {
+   244	      if (typeof context.value === 'string') {
+   245	        return context.value.substr(0, context.parameterValue)
+   246	      } else if (Number.isInteger(Number(context.valueBeforeCast)) && String(context.valueBeforeCast).length > context.parameterValue) {
+   247	        context.throwParamError('RANGE_EXCEEDED', 'Numeric value is out of the allowed character range.', { max: context.parameterValue, actual: String(context.valueBeforeCast).length })
+   248	      }
+   249	    })
+   250	    addValidator('notEmpty', context => {
+   251	      const bc = context.valueBeforeCast
+   252	      const bcs = (bc !== undefined && bc !== null && bc.toString) ? bc.toString() : ''
+   253	      if (context.parameterValue && !Array.isArray(context.value) && bc !== undefined && bcs === '') {
+   254	        context.throwParamError('NOT_EMPTY', 'Field cannot be empty.')
+   255	      }
+   256	    })
+   257	    addValidator('required', () => {}) // Stays as a no-op, logic is handled in _validateField
+   258	
+   259	    // Add new validators for database alignment
+   260	    addValidator('unsigned', () => {}) // No-op, used for schema metadata
+   261	    addValidator('precision', () => {}) // No-op, used for schema metadata
+   262	    addValidator('scale', () => {}) // No-op, used for schema metadata
+   263	    addValidator('nullable', () => {}) // No-op, handled in Schema.js
+   264	    addValidator('nullOnEmpty', () => {}) // No-op, handled in Schema.js
+   265	    addValidator('defaultTo', () => {}) // No-op, handled in Schema.js
+   266	  }
+   267	}
+   268	
+   269	export default CorePlugin