mbkbucket 1.5.0 → 2.0.0

package/lib/routes/view.js

@@ -1,6 +1,6 @@
 import express from "express";
 import { validateSessionAndRole } from "mbkauthe";
-import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, generateSignedUrl } from "../s3.js";
+import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, generateSignedUrl, resolveBucketName } from "../s3.js";
 import { mbkbucketVar } from "../config/index.js";
 import rateLimit from "express-rate-limit";
 
@@ -63,9 +63,44 @@ function pviewSecurity(req, res, next) {
 
 const router = express.Router();
 
+function classifyViewError(error, fallbackMessage = 'Request failed') {
+  const message = String(error?.message || fallbackMessage);
+  const lower = message.toLowerCase();
+
+  if (lower.includes('no bucket selected') || lower.includes('not found in bucketconnection')) {
+    return { status: 400, code: 'INVALID_BUCKET', message };
+  }
+  if (lower.includes('access denied')) {
+    return { status: 403, code: 'ACCESS_DENIED', message };
+  }
+  if (lower.includes('not found')) {
+    return { status: 404, code: 'NOT_FOUND', message };
+  }
+  if (lower.includes('invalid') || lower.includes('required')) {
+    return { status: 400, code: 'VALIDATION_ERROR', message };
+  }
+  return { status: 500, code: 'INTERNAL_ERROR', message };
+}
+
+function sendViewError(res, error, fallbackMessage = 'Request failed') {
+  const mapped = classifyViewError(error, fallbackMessage);
+  return res.status(mapped.status).json({ code: mapped.code, message: mapped.message });
+}
+
+// Central bucket guard for view routes except public view (forced default bucket).
+router.use((req, res, next) => {
+  if (req.path.startsWith('/p_view/')) return next();
+  if (req.bucketResolveError) return sendViewError(res, req.bucketResolveError, 'Invalid bucket selection');
+  if (!req.activeBucket) {
+    return sendViewError(res, new Error('No bucket selected. Provide ?bucket=<name> or configure a default bucket in mbkautheVar.bucket.'));
+  }
+  next();
+});
+
 // New: lightweight player page for robust playback in browsers
 router.get('/player/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
   try {
+    const bucketName = req.activeBucket;
     const key = req.params.key;
     let keyToUse;
     try {
@@ -76,6 +111,7 @@ router.get('/player/:key(*)', validateSessionAndRole('SuperAdmin'), async (req,
     const encoded = encodeURIComponent(keyToUse);
     const fileName = keyToUse.split('/').pop();
 
+    const bucketQuery = `?bucket=${encodeURIComponent(bucketName)}`;
     const html = `<!doctype html>
       <html lang="en">
       <head>
@@ -93,7 +129,7 @@ router.get('/player/:key(*)', validateSessionAndRole('SuperAdmin'), async (req,
       <body>
         <div class="file-name">${fileName}</div>
         <div class="player-container">
-          <video controls preload="metadata" src="/mbkbucket/view/${encoded}">
+          <video controls preload="metadata" src="/mbkbucket/view/${encoded}${bucketQuery}">
             Your browser does not support the video tag.
           </video>
         </div>
@@ -160,7 +196,28 @@ const MIME_TYPES = {
 // Options:
 //   noindex {boolean} – adds X-Robots-Tag: noindex, nofollow (default false)
 // ---------------------------------------------------------------------------
-async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
+function isSensitiveTextType(contentType = '') {
+  const type = String(contentType || '').toLowerCase();
+  return type.startsWith('text/')
+    || type.includes('json')
+    || type.includes('xml')
+    || type.includes('javascript')
+    || type.includes('typescript');
+}
+
+function buildCacheControl(contentType, { isStaticAsset = false, supportsRanges = false, publicCache = false } = {}) {
+  if (publicCache) {
+    if (isStaticAsset) return 'public, max-age=3600, immutable';
+    if (supportsRanges) return 'public, max-age=86400, must-revalidate';
+    return 'public, max-age=300, must-revalidate';
+  }
+
+  if (isSensitiveTextType(contentType)) return 'private, no-store';
+  if (supportsRanges) return 'private, max-age=1800, must-revalidate';
+  return 'private, max-age=300, must-revalidate';
+}
+
+async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName, publicCache = false } = {}) {
   const fileName = keyToUse.split('/').pop();
   const fileExtension = fileName.includes('.') ? fileName.split('.').pop().toLowerCase() : '';
 
@@ -193,7 +250,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
     console.log(`[mbkbucket] Processing range request: ${rangeHeader} for ${fileName}`);
     let meta;
     try {
-      meta = await getFileMetadata(keyToUse);
+      meta = await getFileMetadata(keyToUse, bucketName);
     } catch (err) {
       console.error('[mbkbucket] serveFileInline metadata error:', err);
       return res.status(500).json({ message: 'Failed to fetch file metadata', error: err.message });
@@ -249,7 +306,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
       const chunksize = end - start + 1;
 
       try {
-        const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}` });
+        const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName });
 
         if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
           console.warn(`Range size mismatch for ${keyToUse}: expected=${chunksize} got=${rangeResult.ContentLength}`);
@@ -261,7 +318,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
         res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
         res.setHeader('Content-Length', chunksize);
         res.setHeader('Content-Type', contentType);
-        res.setHeader('Cache-Control', 'public, max-age=86400, must-revalidate');
+        res.setHeader('Cache-Control', buildCacheControl(contentType, { supportsRanges: true, publicCache }));
         res.setHeader('ETag', etag);
         res.setHeader('Accept-Ranges', 'bytes');
         if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
@@ -308,7 +365,8 @@ async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
   // ---------------------------------------------------------------------------
   const downloadOptions = {
     ...(ifNoneMatch && { ifNoneMatch }),
-    ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) })
+    ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) }),
+    bucketName
   };
 
   if (isPdf) {
@@ -346,14 +404,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
   }
   if (supportsRanges) res.setHeader('Accept-Ranges', 'bytes');
 
-  if (isStaticAsset) {
-    res.setHeader('Cache-Control', 'public, max-age=3600, immutable');
-  } else if (supportsRanges) {
-    // For video, audio, and PDF - enable caching with revalidation
-    res.setHeader('Cache-Control', 'public, max-age=86400, must-revalidate');
-  } else {
-    res.setHeader('Cache-Control', 'public, max-age=300');
-  }
+  res.setHeader('Cache-Control', buildCacheControl(contentType, { isStaticAsset, supportsRanges, publicCache }));
 
   res.status(200);
 
@@ -393,6 +444,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
 
 router.get('/view/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
   try {
+    const bucketName = req.activeBucket;
     let keyToUse;
     try {
       keyToUse = ensureKeyHasAppPrefix(req.params.key);
@@ -400,7 +452,7 @@ router.get('/view/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, re
       return res.status(400).json({ message: e.message });
     }
 
-    await serveFileInline(req, res, keyToUse, { noindex: true });
+    await serveFileInline(req, res, keyToUse, { noindex: true, bucketName, publicCache: false });
 
   } catch (error) {
     console.error("Error viewing file:", error);
@@ -417,6 +469,7 @@ router.get('/view/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, re
 if (mbkbucketVar?.publiView_enabled) {
   router.get('/p_view/:key(*)', pviewRateLimit, pviewSecurity, async (req, res) => {
     try {
+      const bucketName = resolveBucketName();
       const key = req.params.key;
 
       // No directory indexing — reject folder-like or empty keys
@@ -438,7 +491,7 @@ if (mbkbucketVar?.publiView_enabled) {
       if (!p_view_inline) {
         // Signed URL mode — redirect to a pre-signed S3 URL (1 hour expiry)
         try {
-          const signed = await generateSignedUrl(keyToUse, 'getObject', 3600);
+          const signed = await generateSignedUrl(keyToUse, 'getObject', 3600, bucketName);
           return res.redirect(302, signed.url);
         } catch (err) {
           console.error('[mbkbucket] p_view signed URL error:', err);
@@ -447,7 +500,7 @@ if (mbkbucketVar?.publiView_enabled) {
       }
 
       // Direct serve mode — stream file inline (with noindex header)
-      await serveFileInline(req, res, keyToUse, { noindex: true });
+      await serveFileInline(req, res, keyToUse, { noindex: true, bucketName, publicCache: true });
     } catch (error) {
       console.error('[mbkbucket] p_view error:', error);
       res.status(500).json({ message: 'Internal server error', error: error.message });

package/lib/s3.js

@@ -19,6 +19,10 @@ function parseJsonEnv(envVar, fallback = {}) {
 // Parse BucketConnection JSON that contains all bucket configurations
 const allBucketConfigs = parseJsonEnv(process.env.BucketConnection, {});
 
+export function getAvailableBucketNames() {
+  return Object.keys(allBucketConfigs || {});
+}
+
 // Helper to get default bucket name
 function getDefaultBucketName() {
   // First priority: use mbkautheVar.bucket if configured
@@ -36,6 +40,26 @@ function getDefaultBucketName() {
   return null;
 }
 
+export function resolveBucketName(bucketName) {
+  const candidate = (bucketName === undefined || bucketName === null)
+    ? getDefaultBucketName()
+    : String(bucketName).trim();
+
+  if (!candidate) {
+    throw new Error('No bucket selected. Provide ?bucket=<name> or configure a default bucket in mbkautheVar.bucket.');
+  }
+
+  if (!allBucketConfigs || Object.keys(allBucketConfigs).length === 0) {
+    throw new Error('BucketConnection environment variable is not set or empty. Please configure it with your bucket connections.');
+  }
+
+  if (!allBucketConfigs[candidate]) {
+    throw new Error(`Bucket '${candidate}' not found in BucketConnection. Available buckets: ${Object.keys(allBucketConfigs).join(', ')}`);
+  }
+
+  return candidate;
+}
+
 // (bucketClient singleton exported below, after cache setup)
 
 // Helper: get configured APP_NAME; prefer mbkautheVar, then env var
@@ -44,9 +68,12 @@ export function getAppName() {
   return (typeof app === 'string' && app.trim()) ? app.trim() : '';
 }
 
+function isRootModeApp(appName) {
+  return String(appName || '').trim().toLowerCase() === 'portal';
+}
+
 export function ensureKeyHasAppPrefix(key = '') {
   const app = getAppName();
-  if (!app) throw new Error('APP_NAME is not configured; set mbkautheVar.APP_NAME or MBKAUTHE_APP_NAME');
   if (!key) throw new Error('Key is required');
   
   // Security: Detect path traversal attempts
@@ -60,6 +87,14 @@ export function ensureKeyHasAppPrefix(key = '') {
   }
   
   let cleaned = String(key).replace(/^\/+/, '');
+
+  // Special case: APP_NAME=portal means operate from bucket root.
+  if (isRootModeApp(app)) {
+    return cleaned;
+  }
+
+  if (!app) throw new Error('APP_NAME is not configured; set mbkautheVar.APP_NAME or MBKAUTHE_APP_NAME');
+
   // Collapse repeated app prefixes (app/app/... -> app/...)
   const appPrefixRegex = new RegExp(`^(?:${app}\/)+`);
   if (!cleaned.startsWith(`${app}/`)) {
@@ -73,7 +108,6 @@ export function ensureKeyHasAppPrefix(key = '') {
 
 export function ensurePrefix(prefix = '') {
   const app = getAppName();
-  if (!app) throw new Error('APP_NAME is not configured; set mbkautheVar.APP_NAME or MBKAUTHE_APP_NAME');
   
   // Security: Detect path traversal attempts
   if (prefix && (prefix.includes('../') || prefix.includes('..\\') || /\.\.[\\/]/.test(prefix))) {
@@ -87,6 +121,13 @@ export function ensurePrefix(prefix = '') {
   
   // Only strip LEADING slashes. Preserve trailing slashes for directory listing.
   let p = String(prefix || '').replace(/^\/+/, '');
+
+  // Special case: APP_NAME=portal means operate from bucket root.
+  if (isRootModeApp(app)) {
+    return p;
+  }
+
+  if (!app) throw new Error('APP_NAME is not configured; set mbkautheVar.APP_NAME or MBKAUTHE_APP_NAME');
   
   if (!p) return `${app}`;
   
@@ -110,13 +151,7 @@ const _clientCache = new Map();
 const _configCache = new Map();
 
 export function getBucketConfig(bucketName) {
-  // Resolve default bucket name if not provided
-  if (!bucketName) {
-    bucketName = getDefaultBucketName();
-    if (!bucketName) {
-      throw new Error('No bucket name provided and no default bucket configured. Please set mbkautheVar.bucket or configure BucketConnection.');
-    }
-  }
+  bucketName = resolveBucketName(bucketName);
   
   const cacheKey = bucketName;
   if (_configCache.has(cacheKey)) return _configCache.get(cacheKey);
@@ -144,10 +179,7 @@ export function getBucketConfig(bucketName) {
 
 // Function to get S3 client for specific bucket — returns cached singleton
 export function getBucketClient(bucketName) {
-  // Resolve default bucket name if not provided
-  if (!bucketName) {
-    bucketName = getDefaultBucketName();
-  }
+  bucketName = resolveBucketName(bucketName);
   
   if (_clientCache.has(bucketName)) return _clientCache.get(bucketName);
 
@@ -619,10 +651,10 @@ export { checkHealth };
 /**
  * Initiate a multipart upload. Returns the S3 UploadId.
  */
-export async function createMultipartUpload(key, contentType = 'application/octet-stream', metadata = {}) {
+export async function createMultipartUpload(key, contentType = 'application/octet-stream', metadata = {}, bucketName) {
   const keyToUse = ensureKeyHasAppPrefix(key);
-  const cfg = getBucketConfig();
-  const client = getBucketClient();
+  const cfg = getBucketConfig(bucketName);
+  const client = getBucketClient(bucketName);
   const command = new CreateMultipartUploadCommand({
     Bucket: cfg.BUCKET_NAME,
     Key: keyToUse,
@@ -641,10 +673,10 @@ export async function createMultipartUpload(key, contentType = 'application/octe
  * Upload a single part. partNumber is 1-based.
  * Returns the ETag needed for CompleteMultipartUpload.
  */
-export async function uploadPart(key, uploadId, partNumber, buffer) {
+export async function uploadPart(key, uploadId, partNumber, buffer, bucketName) {
   const keyToUse = ensureKeyHasAppPrefix(key);
-  const cfg = getBucketConfig();
-  const client = getBucketClient();
+  const cfg = getBucketConfig(bucketName);
+  const client = getBucketClient(bucketName);
   const command = new UploadPartCommand({
     Bucket: cfg.BUCKET_NAME,
     Key: keyToUse,
@@ -661,10 +693,10 @@ export async function uploadPart(key, uploadId, partNumber, buffer) {
  * Complete a multipart upload.
  * parts must be an array of { partNumber, ETag } sorted ascending by partNumber.
  */
-export async function completeMultipartUpload(key, uploadId, parts) {
+export async function completeMultipartUpload(key, uploadId, parts, bucketName) {
   const keyToUse = ensureKeyHasAppPrefix(key);
-  const cfg = getBucketConfig();
-  const client = getBucketClient();
+  const cfg = getBucketConfig(bucketName);
+  const client = getBucketClient(bucketName);
   const sorted = [...parts].sort((a, b) => a.partNumber - b.partNumber);
   const command = new CompleteMultipartUploadCommand({
     Bucket: cfg.BUCKET_NAME,
@@ -681,10 +713,10 @@ export async function completeMultipartUpload(key, uploadId, parts) {
 /**
  * Abort an in-progress multipart upload, freeing all stored parts.
  */
-export async function abortMultipartUpload(key, uploadId) {
+export async function abortMultipartUpload(key, uploadId, bucketName) {
   const keyToUse = ensureKeyHasAppPrefix(key);
-  const cfg = getBucketConfig();
-  const client = getBucketClient();
+  const cfg = getBucketConfig(bucketName);
+  const client = getBucketClient(bucketName);
   const command = new AbortMultipartUploadCommand({
     Bucket: cfg.BUCKET_NAME,
     Key: keyToUse,
@@ -695,26 +727,26 @@ export async function abortMultipartUpload(key, uploadId) {
 }
 
 // Generate signed URL for temporary access
-export async function generateSignedUrl(key, operation = 'getObject', expiresIn = 3600) {
+export async function generateSignedUrl(key, operation = 'getObject', expiresIn = 3600, bucketName) {
   try {
     const { getSignedUrl } = await import('@aws-sdk/s3-request-presigner');
     const keyToUse = ensureKeyHasAppPrefix(key);
     
     let command;
-    const cfg = getBucketConfig();
-    const bucketName = cfg.BUCKET_NAME;
+    const cfg = getBucketConfig(bucketName);
+    const resolvedBucketName = cfg.BUCKET_NAME;
     switch (operation) {
       case 'getObject':
-        command = new GetObjectCommand({ Bucket: bucketName, Key: keyToUse });
+        command = new GetObjectCommand({ Bucket: resolvedBucketName, Key: keyToUse });
         break;
       case 'putObject':
-        command = new PutObjectCommand({ Bucket: bucketName, Key: keyToUse });
+        command = new PutObjectCommand({ Bucket: resolvedBucketName, Key: keyToUse });
         break;
       default:
         throw new Error(`Unsupported operation: ${operation}`);
     }
     
-    const signedUrl = await getSignedUrl(bucketClient, command, { expiresIn });
+    const signedUrl = await getSignedUrl(getBucketClient(bucketName), command, { expiresIn });
     
     return {
       url: signedUrl,
@@ -742,7 +774,7 @@ export async function generateSignedUrl(key, operation = 'getObject', expiresIn
  */
 export async function listIncompleteMultipartUploads(prefix = '', bucketName) {
   try {
-    const effectivePrefix = prefix ? ensurePrefix(prefix) : getAppName();
+    const effectivePrefix = ensurePrefix(prefix || '');
     const cfg = getBucketConfig(bucketName);
     const client = getBucketClient(bucketName);
     

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkbucket",
-  "version": "1.5.0",
+  "version": "2.0.0",
   "description": "Flexible S3/R2 bucket management library and Express router for mbktech.org applications, providing upload, download, listing, and multipart utilities with built-in configuration validation and health checks",
   "author": "Muhammad Bin Khalid",
   "homepage": "https://github.com/MIbnEKhalid/mbkbucket#readme",
@@ -10,7 +10,7 @@
   "types": "index.d.ts",
   "scripts": {
     "dev": "cross-env mbkbucket_test=dev nodemon index.js",
-    "test": "echo \\\"Error: no test specified\\\" && exit 1"
+    "test": "node --test"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.968.0",