json-rest-api 1.0.22 → 1.0.24

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__storage__local-storage.js.txt

@@ -1,218 +0,0 @@
-     1	/**
-     2	 * Local File Storage Adapter
-     3	 *
-     4	 * Production-ready local storage with secure filename handling
-     5	 */
-     6	
-     7	import { promises as fs } from 'fs'
-     8	import path from 'path'
-     9	import crypto from 'crypto'
-    10	
-    11	export class LocalStorage {
-    12	  constructor (options = {}) {
-    13	    this.directory = path.resolve(options.directory || './uploads')
-    14	    this.fileBaseUrl = options.fileBaseUrl || '/uploads'
-    15	    this.nameStrategy = options.nameStrategy || 'hash' // 'hash', 'timestamp', 'original', 'custom'
-    16	    this.nameGenerator = options.nameGenerator // Custom function
-    17	    this.preserveExtension = options.preserveExtension !== false
-    18	    this.allowedExtensions = options.allowedExtensions // Whitelist
-    19	    this.maxFilenameLength = options.maxFilenameLength || 255
-    20	  }
-    21	
-    22	  /**
-    23	   * Generate a safe filename
-    24	   */
-    25	  async generateFilename (file) {
-    26	    let basename, extension
-    27	
-    28	    // Extract and validate extension
-    29	    const originalExt = path.extname(file.filename).toLowerCase()
-    30	    if (this.preserveExtension && originalExt) {
-    31	      // Validate extension against whitelist if provided
-    32	      if (this.allowedExtensions && !this.allowedExtensions.includes(originalExt)) {
-    33	        throw new Error(`File extension '${originalExt}' is not allowed`)
-    34	      }
-    35	      extension = originalExt
-    36	    } else {
-    37	      // Determine extension from MIME type for safety
-    38	      extension = this.getExtensionFromMimeType(file.mimetype)
-    39	    }
-    40	
-    41	    // Generate basename based on strategy
-    42	    switch (this.nameStrategy) {
-    43	      case 'hash':
-    44	        // Cryptographically secure random name
-    45	        basename = crypto.randomBytes(16).toString('hex')
-    46	        break
-    47	
-    48	      case 'timestamp':
-    49	        // Timestamp + random suffix to prevent collisions
-    50	        basename = `${Date.now()}_${crypto.randomBytes(4).toString('hex')}`
-    51	        break
-    52	
-    53	      case 'original':
-    54	        // Sanitized original filename
-    55	        basename = this.sanitizeFilename(
-    56	          path.basename(file.filename, originalExt)
-    57	        )
-    58	        break
-    59	
-    60	      case 'custom':
-    61	        if (!this.nameGenerator) {
-    62	          throw new Error('nameGenerator function required for custom strategy')
-    63	        }
-    64	        basename = await this.nameGenerator(file)
-    65	        break
-    66	
-    67	      default:
-    68	        throw new Error(`Unknown name strategy: ${this.nameStrategy}`)
-    69	    }
-    70	
-    71	    // Combine basename and extension
-    72	    let filename = extension ? `${basename}${extension}` : basename
-    73	
-    74	    // Ensure filename doesn't exceed max length
-    75	    if (filename.length > this.maxFilenameLength) {
-    76	      // Truncate basename to fit
-    77	      const maxBasename = this.maxFilenameLength - (extension?.length || 0)
-    78	      basename = basename.substring(0, maxBasename)
-    79	      filename = extension ? `${basename}${extension}` : basename
-    80	    }
-    81	
-    82	    // Handle duplicates
-    83	    filename = await this.ensureUnique(filename)
-    84	
-    85	    return filename
-    86	  }
-    87	
-    88	  /**
-    89	   * Sanitize filename for safe storage
-    90	   */
-    91	  sanitizeFilename (filename) {
-    92	    return filename
-    93	      // Remove path traversal attempts
-    94	      .replace(/\.\./g, '')
-    95	      .replace(/[\/\\]/g, '')
-    96	      // Remove control characters and special chars
-    97	      .replace(/[^\w\s.-]/g, '_')
-    98	      // Remove leading/trailing dots and spaces
-    99	      .replace(/^[\s.]+|[\s.]+$/g, '')
-   100	      // Collapse multiple underscores
-   101	      .replace(/_+/g, '_') ||
-   102	      // Default if empty
-   103	      'unnamed'
-   104	  }
-   105	
-   106	  /**
-   107	   * Ensure filename is unique
-   108	   */
-   109	  async ensureUnique (filename) {
-   110	    const filepath = path.join(this.directory, filename)
-   111	
-   112	    try {
-   113	      await fs.access(filepath)
-   114	      // File exists, generate unique name
-   115	      const ext = path.extname(filename)
-   116	      const base = path.basename(filename, ext)
-   117	      let counter = 1
-   118	      let newFilename
-   119	
-   120	      do {
-   121	        newFilename = `${base}_${counter}${ext}`
-   122	        counter++
-   123	      } while (await this.fileExists(path.join(this.directory, newFilename)))
-   124	
-   125	      return newFilename
-   126	    } catch (error) {
-   127	      // File doesn't exist, name is unique
-   128	      return filename
-   129	    }
-   130	  }
-   131	
-   132	  /**
-   133	   * Check if file exists
-   134	   */
-   135	  async fileExists (filepath) {
-   136	    try {
-   137	      await fs.access(filepath)
-   138	      return true
-   139	    } catch {
-   140	      return false
-   141	    }
-   142	  }
-   143	
-   144	  /**
-   145	   * Get safe extension from MIME type
-   146	   */
-   147	  getExtensionFromMimeType (mimetype) {
-   148	    // Safe mappings only
-   149	    const mimeToExt = {
-   150	      'image/jpeg': '.jpg',
-   151	      'image/png': '.png',
-   152	      'image/gif': '.gif',
-   153	      'image/webp': '.webp',
-   154	      'application/pdf': '.pdf',
-   155	      'text/plain': '.txt',
-   156	      'application/json': '.json',
-   157	      'video/mp4': '.mp4',
-   158	      'audio/mpeg': '.mp3',
-   159	      'application/zip': '.zip'
-   160	    }
-   161	
-   162	    return mimeToExt[mimetype] || '.bin'
-   163	  }
-   164	
-   165	  /**
-   166	   * Upload file with secure filename
-   167	   */
-   168	  async upload (file) {
-   169	    // Ensure directory exists
-   170	    await fs.mkdir(this.directory, { recursive: true })
-   171	
-   172	    // Generate secure filename
-   173	    const filename = await this.generateFilename(file)
-   174	    const filepath = path.join(this.directory, filename)
-   175	
-   176	    // Ensure we're not writing outside our directory (defense in depth)
-   177	    const resolvedPath = path.resolve(filepath)
-   178	    const resolvedDir = path.resolve(this.directory)
-   179	    if (!resolvedPath.startsWith(resolvedDir)) {
-   180	      throw new Error('Invalid file path')
-   181	    }
-   182	
-   183	    // Write file
-   184	    if (file.data) {
-   185	      await fs.writeFile(filepath, file.data)
-   186	    } else if (file.filepath) {
-   187	      await fs.rename(file.filepath, filepath)
-   188	    } else {
-   189	      throw new Error('File has no data or filepath')
-   190	    }
-   191	
-   192	    // Return public URL
-   193	    return `${this.fileBaseUrl}/${filename}`
-   194	  }
-   195	
-   196	  /**
-   197	   * Delete a file
-   198	   */
-   199	  async delete (url) {
-   200	    const filename = path.basename(url)
-   201	    const filepath = path.join(this.directory, filename)
-   202	
-   203	    // Security check
-   204	    const resolvedPath = path.resolve(filepath)
-   205	    const resolvedDir = path.resolve(this.directory)
-   206	    if (!resolvedPath.startsWith(resolvedDir)) {
-   207	      throw new Error('Invalid file path')
-   208	    }
-   209	
-   210	    try {
-   211	      await fs.unlink(filepath)
-   212	    } catch (error) {
-   213	      if (error.code !== 'ENOENT') {
-   214	        throw error
-   215	      }
-   216	    }
-   217	  }
-   218	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__storage__s3-storage.js.txt

@@ -1,124 +0,0 @@
-     1	/**
-     2	 * S3 Storage Adapter
-     3	 *
-     4	 * Stores uploaded files in Amazon S3 or S3-compatible storage.
-     5	 *
-     6	 * Usage:
-     7	 * ```javascript
-     8	 * import { S3Storage } from 'jsonrestapi/lib/storage/s3-storage.js';
-     9	 *
-    10	 * const storage = new S3Storage({
-    11	 *   bucket: 'my-uploads',
-    12	 *   region: 'us-east-1',
-    13	 *   accessKeyId: process.env.AWS_ACCESS_KEY_ID,
-    14	 *   secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
-    15	 *   prefix: 'uploads/' // optional path prefix
-    16	 * });
-    17	 *
-    18	 * const schema = {
-    19	 *   image: { type: 'file', storage }
-    20	 * };
-    21	 * ```
-    22	 */
-    23	
-    24	import crypto from 'crypto'
-    25	import path from 'path'
-    26	
-    27	export class S3Storage {
-    28	  constructor (options = {}) {
-    29	    this.bucket = options.bucket
-    30	    this.region = options.region || 'us-east-1'
-    31	    this.prefix = options.prefix || ''
-    32	    this.acl = options.acl || 'public-read'
-    33	
-    34	    if (!this.bucket) {
-    35	      throw new Error('S3Storage requires a bucket name')
-    36	    }
-    37	
-    38	    // Note: In a real implementation, you would initialize the AWS SDK here
-    39	    // For this example, we'll just mock the behavior
-    40	    this.mockMode = options.mockMode !== false // Default to mock mode
-    41	
-    42	    if (!this.mockMode) {
-    43	      // Real S3 initialization would go here
-    44	      // const { S3Client } = require('@aws-sdk/client-s3');
-    45	      // this.s3 = new S3Client({ region: this.region });
-    46	    }
-    47	  }
-    48	
-    49	  /**
-    50	   * Upload a file to S3
-    51	   * @param {Object} file - File object from detector
-    52	   * @returns {Promise<string>} URL of the uploaded file
-    53	   */
-    54	  async upload (file) {
-    55	    // Generate S3 key
-    56	    const ext = path.extname(file.filename)
-    57	    const hash = crypto.randomBytes(16).toString('hex')
-    58	    const key = `${this.prefix}${hash}${ext}`
-    59	
-    60	    if (this.mockMode) {
-    61	      // Mock mode - just return a fake URL
-    62	      const url = `https://${this.bucket}.s3.${this.region}.amazonaws.com/${key}`
-    63	
-    64	      // Simulate upload delay
-    65	      await new Promise(resolve => setTimeout(resolve, 100))
-    66	
-    67	      return url
-    68	    }
-    69	
-    70	    // Real S3 upload would go here
-    71	    /*
-    72	    const { PutObjectCommand } = require('@aws-sdk/client-s3');
-    73	
-    74	    const command = new PutObjectCommand({
-    75	      Bucket: this.bucket,
-    76	      Key: key,
-    77	      Body: file.data,
-    78	      ContentType: file.mimetype,
-    79	      ACL: this.acl,
-    80	      Metadata: {
-    81	        originalName: file.filename
-    82	      }
-    83	    });
-    84	
-    85	    await this.s3.send(command);
-    86	
-    87	    // Return public URL
-    88	    if (this.acl === 'public-read') {
-    89	      return `https://${this.bucket}.s3.${this.region}.amazonaws.com/${key}`;
-    90	    } else {
-    91	      // For private files, you might return a signed URL
-    92	      return await this.getSignedUrl(key);
-    93	    }
-    94	    */
-    95	  }
-    96	
-    97	  /**
-    98	   * Delete a file from S3
-    99	   * @param {string} url - URL returned by upload()
-   100	   * @returns {Promise<void>}
-   101	   */
-   102	  async delete (url) {
-   103	    // Extract key from URL
-   104	    const urlObj = new URL(url)
-   105	    const key = urlObj.pathname.substring(1) // Remove leading /
-   106	
-   107	    if (this.mockMode) {
-   108	      // Mock mode - just simulate deletion
-   109	      await new Promise(resolve => setTimeout(resolve, 50))
-   110	    }
-   111	
-   112	    // Real S3 delete would go here
-   113	    /*
-   114	    const { DeleteObjectCommand } = require('@aws-sdk/client-s3');
-   115	
-   116	    const command = new DeleteObjectCommand({
-   117	      Bucket: this.bucket,
-   118	      Key: key
-   119	    });
-   120	
-   121	    await this.s3.send(command);
-   122	    */
-   123	  }
-   124	}

package/audit/evidence/code/critical-pass1/json-rest-schema__src__CorePlugin.js.txt

@@ -1,269 +0,0 @@
-     1	/**
-     2	 * @file Contains all the built-in type and validator handlers for the schema library.
-     3	 */
-     4	
-     5	import * as flatted from 'flatted'
-     6	
-     7	/**
-     8	 * @typedef {import('./Schema.js').ValidationContext} ValidationContext
-     9	 */
-    10	
-    11	/**
-    12	 * The CorePlugin provides the default set of types and validators.
-    13	 */
-    14	const CorePlugin = {
-    15	  /**
-    16	   * Installs the core types and validators.
-    17	   * @param {{addType: Function, addValidator: Function}} api - An object containing registration functions.
-    18	   */
-    19	  install (api) {
-    20	    const { addType, addValidator } = api // Destructure the API functions
-    21	
-    22	    // --- Type Handlers ---
-    23	
-    24	    addType('none', context => context.value)
-    25	
-    26	    addType('file', context => {
-    27	      const val = context.value
-    28	      if (val === undefined || val === null) context.throwTypeError()
-    29	
-    30	      // Only attempt to convert primitives. Fail on complex objects/arrays.
-    31	      // A file is expected to be just a file handle
-    32	      const valType = typeof val
-    33	      if (valType === 'string' || valType === 'number' || valType === 'boolean') {
-    34	        const s = val.toString()
-    35	        return context.definition.noTrim ? s : s.trim()
-    36	      }
-    37	
-    38	      // If it's not a primitive that can be safely converted, it's a type error.
-    39	      context.throwTypeError()
-    40	    })
-    41	
-    42	    addType('string', context => {
-    43	      const val = context.value
-    44	      if (val === undefined || val === null) return ''
-    45	
-    46	      // Only attempt to convert primitives. Fail on complex objects/arrays.
-    47	      const valType = typeof val
-    48	      if (valType === 'string' || valType === 'number' || valType === 'boolean') {
-    49	        const s = val.toString()
-    50	        return context.definition.noTrim ? s : s.trim()
-    51	      }
-    52	
-    53	      // If it's not a primitive that can be safely converted, it's a type error.
-    54	      context.throwTypeError()
-    55	    })
-    56	
-    57	    addType('blob', context => context.value)
-    58	    addType('number', context => {
-    59	      if (context.value === undefined || context.value === null || context.value === '') return 0
-    60	      const r = Number(context.value)
-    61	      if (isNaN(r)) context.throwTypeError()
-    62	      return r
-    63	    })
-    64	    addType('timestamp', context => {
-    65	      const r = Number(context.value)
-    66	      if (isNaN(r)) context.throwTypeError()
-    67	      if (!r && context.computedOptions.nullable) return null
-    68	      return r
-    69	    })
-    70	    addType('dateTime', context => {
-    71	      if (!context.value || context.value === '') return null
-    72	
-    73	      // If already a Date object, return it
-    74	      if (context.value instanceof Date) {
-    75	        return isNaN(context.value.getTime()) ? null : context.value
-    76	      }
-    77	
-    78	      // Handle string values
-    79	      if (typeof context.value === 'string') {
-    80	        // Detect MySQL datetime format: 'YYYY-MM-DD HH:MM:SS'
-    81	        const isMySQLFormat = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}/.test(context.value) &&
-    82	                             !context.value.includes('T') &&
-    83	                             !context.value.includes('Z')
-    84	
-    85	        if (isMySQLFormat) {
-    86	          // Convert to ISO format and force UTC interpretation
-    87	          const d = new Date(context.value.replace(' ', 'T') + 'Z')
-    88	          if (isNaN(d.getTime())) {
-    89	            context.throwTypeError()
-    90	          }
-    91	          return d
-    92	        }
-    93	      }
-    94	
-    95	      // Try to parse the value normally
-    96	      const d = new Date(context.value)
-    97	      if (isNaN(d.getTime())) {
-    98	        return null
-    99	      }
-   100	
-   101	      // Return the Date object directly - let Knex handle the database formatting
-   102	      return d
-   103	    })
-   104	    addType('date', context => {
-   105	      if (!context.value || context.value === '') return null
-   106	
-   107	      // Parse the input value to a Date object
-   108	      let d
-   109	      if (context.value instanceof Date) {
-   110	        d = context.value
-   111	      } else {
-   112	        let dateStr = String(context.value)
-   113	
-   114	        // If it's just a date (YYYY-MM-DD), add time at UTC midnight
-   115	        if (/^\d{4}-\d{2}-\d{2}$/.test(dateStr)) {
-   116	          dateStr += 'T00:00:00Z'
-   117	        }
-   118	
-   119	        d = new Date(dateStr)
-   120	      }
-   121	
-   122	      if (isNaN(d.getTime())) {
-   123	        context.throwTypeError()
-   124	      }
-   125	
-   126	      // Normalize to midnight UTC
-   127	      const normalized = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()))
-   128	      return normalized
-   129	    })
-   130	    addType('time', context => {
-   131	      if (!context.value || context.value === '') return null
-   132	
-   133	      // Try to parse as time string (HH:MM:SS or HH:MM)
-   134	      if (typeof context.value === 'string') {
-   135	        // Match HH:MM:SS or HH:MM format
-   136	        const timeMatch = context.value.match(/^(\d{1,2}):(\d{2})(?::(\d{2}))?$/)
-   137	        if (timeMatch) {
-   138	          const hours = parseInt(timeMatch[1], 10)
-   139	          const minutes = parseInt(timeMatch[2], 10)
-   140	          const seconds = timeMatch[3] ? parseInt(timeMatch[3], 10) : 0
-   141	
-   142	          // Validate ranges
-   143	          if (hours >= 0 && hours <= 23 && minutes >= 0 && minutes <= 59 && seconds >= 0 && seconds <= 59) {
-   144	            // Return normalized HH:MM:SS format as string
-   145	            // Note: We return string because most databases don't have a true time-only type
-   146	            return `${hours.toString().padStart(2, '0')}:${minutes.toString().padStart(2, '0')}:${seconds.toString().padStart(2, '0')}`
-   147	          }
-   148	        }
-   149	      }
-   150	
-   151	      // Try to extract time from a Date object or datetime string
-   152	      try {
-   153	        const d = new Date(context.value)
-   154	        if (!isNaN(d.getTime())) {
-   155	          // Extract time portion in HH:MM:SS format
-   156	          return d.toISOString().slice(11, 19)
-   157	        }
-   158	      } catch (e) {
-   159	        // Invalid date
-   160	      }
-   161	
-   162	      context.throwTypeError()
-   163	    })
-   164	    addType('array', context => {
-   165	      if (context.definition.type === 'array' && !Array.isArray(context.value)) {
-   166	        return [context.value]
-   167	      }
-   168	      return context.value
-   169	    })
-   170	    addType('object', context => context.value)
-   171	    addType('serialize', context => {
-   172	      try {
-   173	        // First try regular JSON.stringify for non-circular objects
-   174	        return JSON.stringify(context.value)
-   175	      } catch (e) {
-   176	        // If that fails (likely circular reference), use flatted
-   177	        try {
-   178	          return flatted.stringify(context.value)
-   179	        } catch (e2) {
-   180	          context.throwTypeError()
-   181	        }
-   182	      }
-   183	    })
-   184	    addType('boolean', context => {
-   185	      if (typeof context.value === 'string') {
-   186	        const falseVal = context.definition.stringFalseWhen || 'false'
-   187	        const trueVal = context.definition.stringTrueWhen || 'true'
-   188	        const lowerValue = context.value.toLowerCase()
-   189	        if (lowerValue === falseVal) return false
-   190	        if ([trueVal, 'on'].includes(lowerValue)) return true
-   191	        return false
-   192	      }
-   193	      return !!context.value
-   194	    })
-   195	    addType('id', context => {
-   196	      const n = parseInt(context.value, 10)
-   197	      if (isNaN(n)) context.throwTypeError()
-   198	      return n
-   199	    })
-   200	
-   201	    // --- Validator Handlers ---
-   202	    addValidator('minLength', context => {
-   203	      if (context.value === undefined) return
-   204	      if (context.definition.type === 'string' && context.value.toString && context.value.toString().length < context.parameterValue) {
-   205	        context.throwParamError('MIN_LENGTH', `Length must be at least ${context.parameterValue} characters.`, { min: context.parameterValue, actual: context.value.toString().length })
-   206	      }
-   207	    })
-   208	
-   209	    addValidator('min', context => {
-   210	      if (context.value === undefined) return
-   211	      if (context.definition.type === 'number' && typeof context.value === 'number' && context.value < context.parameterValue) {
-   212	        context.throwParamError('MIN_VALUE', `Value must be at least ${context.parameterValue}.`, { min: context.parameterValue, actual: context.value })
-   213	      }
-   214	    })
-   215	    addValidator('maxLength', context => {
-   216	      if (context.value === undefined) return
-   217	      if (context.definition.type === 'string' && context.value.toString && context.value.toString().length > context.parameterValue) {
-   218	        context.throwParamError('MAX_LENGTH', `Length must be no more than ${context.parameterValue} characters.`, { max: context.parameterValue, actual: context.value.toString().length })
-   219	      }
-   220	    })
-   221	
-   222	    addValidator('max', context => {
-   223	      if (context.value === undefined) return
-   224	      if (context.definition.type === 'number' && typeof context.value === 'number' && context.value > context.parameterValue) {
-   225	        context.throwParamError('MAX_VALUE', `Value must be no more than ${context.parameterValue}.`, { max: context.parameterValue, actual: context.value })
-   226	      }
-   227	    })
-   228	    addValidator('validator', async context => {
-   229	      if (typeof context.parameterValue !== 'function') {
-   230	        throw new Error(`Validator for ${context.fieldName} must be a function.`)
-   231	      }
-   232	      const r = await context.parameterValue(context.value, context.object, context)
-   233	      if (typeof r === 'string') {
-   234	        context.throwParamError('CUSTOM_VALIDATOR_FAILED', r)
-   235	      }
-   236	    })
-   237	    addValidator('uppercase', context => {
-   238	      if (typeof context.value === 'string') return context.value.toUpperCase()
-   239	    })
-   240	    addValidator('lowercase', context => {
-   241	      if (typeof context.value === 'string') return context.value.toLowerCase()
-   242	    })
-   243	    addValidator('length', context => {
-   244	      if (typeof context.value === 'string') {
-   245	        return context.value.substr(0, context.parameterValue)
-   246	      } else if (Number.isInteger(Number(context.valueBeforeCast)) && String(context.valueBeforeCast).length > context.parameterValue) {
-   247	        context.throwParamError('RANGE_EXCEEDED', 'Numeric value is out of the allowed character range.', { max: context.parameterValue, actual: String(context.valueBeforeCast).length })
-   248	      }
-   249	    })
-   250	    addValidator('notEmpty', context => {
-   251	      const bc = context.valueBeforeCast
-   252	      const bcs = (bc !== undefined && bc !== null && bc.toString) ? bc.toString() : ''
-   253	      if (context.parameterValue && !Array.isArray(context.value) && bc !== undefined && bcs === '') {
-   254	        context.throwParamError('NOT_EMPTY', 'Field cannot be empty.')
-   255	      }
-   256	    })
-   257	    addValidator('required', () => {}) // Stays as a no-op, logic is handled in _validateField
-   258	
-   259	    // Add new validators for database alignment
-   260	    addValidator('unsigned', () => {}) // No-op, used for schema metadata
-   261	    addValidator('precision', () => {}) // No-op, used for schema metadata
-   262	    addValidator('scale', () => {}) // No-op, used for schema metadata
-   263	    addValidator('nullable', () => {}) // No-op, handled in Schema.js
-   264	    addValidator('nullOnEmpty', () => {}) // No-op, handled in Schema.js
-   265	    addValidator('defaultTo', () => {}) // No-op, handled in Schema.js
-   266	  }
-   267	}
-   268	
-   269	export default CorePlugin