mbkbucket 3.3.0 → 3.3.2

package/{src → lib/src}/controllers/view.controller.js

@@ -1,28 +1,12 @@
-import {
-  downloadFile, getFileMetadata, ensureKeyHasAppPrefix,
-  generateSignedUrl, resolveBucketName
-} from "../services/s3.service.js";
+import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, generateSignedUrl, resolveBucketName } from "../services/s3.service.js";
 import { mbkbucketVar } from "../config/index.js";
-import {
-  escapeHtml, getBaseName, VIEWABLE_TYPES, VIEWABLE_TYPES_SORTED,
-  STATIC_ASSET_TYPES, VIDEO_TYPES, AUDIO_TYPES, MIME_TYPES,
-  buildCacheControl, parseRangeHeader, renderPlayerPage
-} from "../utils/helpers.js";
-import { createLogger } from "../utils/logger.js";
+import { escapeHtml, getBaseName, getFileExt, getMimeType, normalizeKeyParam, destroyStream, VIEWABLE_TYPES, VIEWABLE_TYPES_SORTED, STATIC_ASSET_TYPES, VIDEO_TYPES, AUDIO_TYPES, buildCacheControl, parseRangeHeader, renderPlayerPage } from "../utils/helpers.js";
+import { createLogger } from "#logger";
 
 const debugView = createLogger('view');
 
-// ---------------------------------------------------------------------------
-// Stream helpers
-// ---------------------------------------------------------------------------
-
 function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
-  const cleanup = () => {
-    if (stream && typeof stream.destroy === 'function') {
-      stream.removeAllListeners();
-      stream.destroy();
-    }
-  };
+  const cleanup = () => destroyStream(stream);
 
   stream.on('error', (err) => {
     console.error('Stream error:', err);
@@ -32,25 +16,18 @@ function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
 
   req.on('close', cleanup);
   req.on('aborted', cleanup);
-
   req.setTimeout(timeoutMs, () => {
     console.error('Request timeout for stream');
     cleanup();
     if (!res.headersSent) res.status(408).end('Request timeout');
   });
-
   res.on('finish', cleanup);
   res.on('close', cleanup);
 }
 
-// ---------------------------------------------------------------------------
-// Inline file serving (used by /view/:key and /p_view/:key)
-// ---------------------------------------------------------------------------
-
 async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName, publicCache = false } = {}) {
   const fileName = getBaseName(keyToUse);
-  const dotIndex = fileName.lastIndexOf('.');
-  const fileExtension = dotIndex === -1 ? '' : fileName.substring(dotIndex + 1).toLowerCase();
+  const fileExtension = getFileExt(fileName);
 
   debugView('Request for %s (type: %s, range: %s)', fileName, fileExtension, req.headers.range || 'none');
 
@@ -70,7 +47,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   const isAudio = AUDIO_TYPES.has(fileExtension);
   const isPdf = fileExtension === 'pdf';
   const supportsRanges = isVideo || isAudio || isPdf;
-  const contentType = MIME_TYPES[fileExtension] || 'application/octet-stream';
+  const contentType = getMimeType(fileName);
 
   // Fast path for range requests (video / audio / PDF streaming)
   if (supportsRanges && rangeHeader) {
@@ -83,7 +60,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
       return res.status(500).json({ message: 'Failed to fetch file metadata', error: err.message });
     }
 
-    if (!meta || !meta.exists) {
+    if (!meta?.exists) {
       return res.status(404).json({ message: 'File not found', key: keyToUse });
     }
 
@@ -91,21 +68,16 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
     if (ifNoneMatch === etag) return res.status(304).end();
 
     const total = Number(meta.ContentLength);
-    if (!total) {
-      // No content-length — fall through to full-file path
-    } else {
+    if (total) {
       const range = parseRangeHeader(rangeHeader, total);
       if (!range) {
-        // Invalid or unsatisfiable range
         res.status(416).setHeader('Content-Range', `bytes */${total}`);
         return res.end();
       }
 
       const { start, end, size: chunksize } = range;
-
       try {
         const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName });
-
         if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
           debugView('Range size mismatch for %s: expected=%s got=%s', keyToUse, chunksize, rangeResult.ContentLength);
         }
@@ -125,10 +97,8 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
 
         attachStreamCleanup(req, res, rangeResult.Body);
         return rangeResult.Body.pipe(res);
-
       } catch (rangeError) {
         console.error('Range request failed:', rangeError);
-        // fall through to full-file path
       }
     }
   }
@@ -140,9 +110,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
     bucketName
   };
 
-  if (isPdf) {
-    debugView('Serving full PDF (no range header) for %s', fileName);
-  }
+  if (isPdf) debugView('Serving full PDF (no range header) for %s', fileName);
 
   let result;
   try {
@@ -150,14 +118,15 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   } catch (err) {
     if (err.name === 'NoSuchKey' || err.name === 'NotFound') {
       return res.status(404).json({ message: 'File not found', key: keyToUse });
-    } else if (err.name === 'AccessDenied') {
+    }
+    if (err.name === 'AccessDenied') {
       return res.status(403).json({ message: 'Access denied' });
     }
     console.error('[mbkbucket] serveFileInline download error:', err);
     return res.status(500).json({ message: 'Failed to fetch file', error: err.message });
   }
 
-  if (result && result.notModified) return res.status(304).end();
+  if (result?.notModified) return res.status(304).end();
 
   const etag = `"${result.LastModified?.getTime() || Date.now()}-${result.ContentLength || 0}"`;
   if (ifNoneMatch === etag) return res.status(304).end();
@@ -174,26 +143,17 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
     res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none'; object-src 'none';");
   }
   if (supportsRanges) res.setHeader('Accept-Ranges', 'bytes');
-
   res.setHeader('Cache-Control', buildCacheControl(contentType, { isStaticAsset, supportsRanges, publicCache }));
-
   res.status(200);
 
   const timeoutDuration = result.ContentLength > 50 * 1024 * 1024 ? 300000 : 120000;
   attachStreamCleanup(req, res, result.Body, timeoutDuration);
-
   result.Body.pipe(res);
 }
 
-// ---------------------------------------------------------------------------
-// Controller handlers
-// ---------------------------------------------------------------------------
-
 export async function viewFile(req, res) {
   try {
-    const bucketName = req.activeBucket;
-    const rawKey = req.params.key;
-    const key = Array.isArray(rawKey) ? rawKey.join('/') : (rawKey || '');
+    const key = normalizeKeyParam(req.params.key);
     let keyToUse;
     try {
       keyToUse = ensureKeyHasAppPrefix(key);
@@ -201,8 +161,7 @@ export async function viewFile(req, res) {
       return res.status(400).json({ message: e.message });
     }
 
-    await serveFileInline(req, res, keyToUse, { noindex: true, bucketName, publicCache: false });
-
+    await serveFileInline(req, res, keyToUse, { noindex: true, bucketName: req.activeBucket, publicCache: false });
   } catch (error) {
     console.error("Error viewing file:", error);
     if (error.name === 'NoSuchKey' || error.name === 'NotFound') {
@@ -217,19 +176,19 @@ export async function viewFile(req, res) {
 
 export async function playerPage(req, res) {
   try {
-    const bucketName = req.activeBucket;
-    const rawKey = req.params.key;
-    const key = Array.isArray(rawKey) ? rawKey.join('/') : (rawKey || '');
+    const key = normalizeKeyParam(req.params.key);
     let keyToUse;
     try {
       keyToUse = ensureKeyHasAppPrefix(key);
     } catch (e) {
       return res.status(400).send(e.message);
     }
-    const encoded = encodeURIComponent(keyToUse);
-    const safeFileName = escapeHtml(getBaseName(keyToUse));
-    const bucketQuery = `?bucket=${encodeURIComponent(bucketName)}`;
-    const html = renderPlayerPage(safeFileName, encoded, bucketQuery);
+
+    const html = renderPlayerPage(
+      escapeHtml(getBaseName(keyToUse)),
+      encodeURIComponent(keyToUse),
+      `?bucket=${encodeURIComponent(req.activeBucket)}`
+    );
 
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
     res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -243,10 +202,8 @@ export async function playerPage(req, res) {
 export async function publicView(req, res) {
   try {
     const bucketName = resolveBucketName();
-    const rawKey = req.params.key;
-    const key = Array.isArray(rawKey) ? rawKey.join('/') : (rawKey || '');
+    const key = normalizeKeyParam(req.params.key);
 
-    // No directory indexing
     if (!key || key.endsWith('/')) {
       return res.status(403).json({ message: 'Directory indexing is not allowed' });
     }
@@ -258,10 +215,7 @@ export async function publicView(req, res) {
       return res.status(400).json({ message: e.message });
     }
 
-    let p_view_inline = !!mbkbucketVar?.p_view_inline;
-
-    if (!p_view_inline) {
-      // Signed URL mode
+    if (!mbkbucketVar?.p_view_inline) {
       try {
         const signed = await generateSignedUrl(keyToUse, 'getObject', 3600, bucketName);
         return res.redirect(302, signed.url);
@@ -271,7 +225,6 @@ export async function publicView(req, res) {
       }
     }
 
-    // Direct serve mode
     await serveFileInline(req, res, keyToUse, { noindex: true, bucketName, publicCache: true });
   } catch (error) {
     console.error('[mbkbucket] p_view error:', error);

package/{src → lib/src}/middleware/async-handler.js

@@ -1,30 +1,15 @@
 /**
  * Wraps an async Express route handler so that any thrown/rejected errors
  * are forwarded to `next(err)` instead of crashing the process.
- *
- * Usage:
- *   router.get('/path', wrap(myAsyncHandler));
- *
- * If a custom error handler is provided, it receives (error, req, res, next)
- * and can send a custom response instead of forwarding to Express error middleware.
  */
 export function wrap(handler, onError) {
   return (req, res, next) => {
-    const result = handler(req, res, next);
-    if (result && typeof result.catch === 'function') {
-      result.catch((err) => {
-        if (onError) {
-          return onError(err, req, res, next);
-        }
-        next(err);
-      });
-    }
+    Promise.resolve(handler(req, res, next)).catch(err => (onError ? onError(err, req, res, next) : next(err)));
   };
 }
 
 /**
  * Combines wrap() with a standard JSON error response for API routes.
- * The `fallbackMessage` is used when the error has no message.
  */
 export function wrapApi(handler, fallbackMessage = 'Request failed') {
   return wrap(handler, (err, _req, res) => {

package/{src → lib/src}/middleware/bucket-resolver.js

@@ -1,9 +1,10 @@
 import { resolveBucketName } from "../services/s3.service.js";
 import { sendApiError, sendViewError } from "../utils/errors.js";
 
+const NO_BUCKET_MSG = 'No bucket selected. Provide ?bucket=<name> or configure a default bucket in mbkautheVar.bucket.';
+
 /**
- * Middleware that resolves `?bucket=<name>` query param and attaches
- * `req.activeBucket` and `req.bucketResolveError` to every request under /mbkbucket.
+ * Resolves `?bucket=<name>` query param and attaches `req.activeBucket` and `req.bucketResolveError`.
  */
 export function bucketResolver(req, _res, next) {
   try {
@@ -20,24 +21,17 @@ export function bucketResolver(req, _res, next) {
  * Guard middleware for API routes — returns 400/503 JSON if bucket is invalid.
  */
 export function requireBucketApi(req, res, next) {
-  if (req.bucketResolveError) {
-    return sendApiError(res, req.bucketResolveError, 'Invalid bucket selection');
-  }
-  if (!req.activeBucket) {
-    return sendApiError(res, new Error('No bucket selected. Provide ?bucket=<name> or configure a default bucket in mbkautheVar.bucket.'));
-  }
+  if (req.bucketResolveError) return sendApiError(res, req.bucketResolveError, 'Invalid bucket selection');
+  if (!req.activeBucket) return sendApiError(res, new Error(NO_BUCKET_MSG));
   next();
 }
 
 /**
- * Guard middleware for view routes — returns 400/503 JSON if bucket is invalid.
- * Skips public view routes (/p_view/...) which use the default bucket.
+ * Guard middleware for view routes — returns 400/503 JSON if bucket is invalid (skips /p_view/...).
  */
 export function requireBucketView(req, res, next) {
   if (req.path.startsWith('/p_view/')) return next();
   if (req.bucketResolveError) return sendViewError(res, req.bucketResolveError, 'Invalid bucket selection');
-  if (!req.activeBucket) {
-    return sendViewError(res, new Error('No bucket selected. Provide ?bucket=<name> or configure a default bucket in mbkautheVar.bucket.'));
-  }
+  if (!req.activeBucket) return sendViewError(res, new Error(NO_BUCKET_MSG));
   next();
 }

package/{src → lib/src}/middleware/error-handler.js

@@ -1,34 +1,26 @@
-import { createLogger } from "../utils/logger.js";
+import { createLogger } from "#logger";
 
 const debugServer = createLogger('server');
 
-/**
- * Global 404 handler — renders error page via Handlebars.
- */
+const BASE_ERROR_DATA = { layout: false, pagename: "Home", page: "/" };
+
 export function notFoundHandler(req, res) {
   debugServer("Path not found: %s %s", req.method, req.url);
   return res.status(404).render("Error/dError.handlebars", {
-    layout: false,
+    ...BASE_ERROR_DATA,
     code: 404,
     error: "Not Found",
     message: "The requested page was not found.",
-    pagename: "Home",
-    page: "/",
   });
 }
 
-/**
- * Global error handler — catches unhandled errors from routes/middleware.
- */
-export function globalErrorHandler(err, req, res, _next) {
+export function globalErrorHandler(err, _req, res, _next) {
   console.error(`[mbkbucket] ${err.stack}`);
   return res.status(500).render("Error/dError.handlebars", {
-    layout: false,
+    ...BASE_ERROR_DATA,
     code: 500,
     error: "Internal app Error",
     message: "An unexpected error occurred on the app.",
     details: err.message,
-    pagename: "Home",
-    page: "/",
   });
 }

package/{src → lib/src}/middleware/rate-limiter.js

@@ -1,29 +1,21 @@
 import rateLimit from "express-rate-limit";
 
-/**
- * General rate limiter for typical browsing/API usage.
- * 150 requests per 2 minutes per IP.
- */
 export const generalLimiter = rateLimit({
   windowMs: 2 * 60 * 1000, // 2 minutes
   max: 150,
   standardHeaders: true,
   legacyHeaders: false,
-  handler: (req, res) => {
+  handler: (_req, res) => {
     res.status(429).render('error.handlebars', { message: 'Too many requests from your IP. Try again later.', code: 429 });
   }
 });
 
-/**
- * Stricter rate limiter for public view (p_view) routes.
- * 10 requests per minute per IP.
- */
 export const pviewRateLimit = rateLimit({
   windowMs: 60 * 1000, // 1 minute
   max: 10,
   standardHeaders: 'draft-7',
   legacyHeaders: false,
-  keyGenerator: (req) => req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress || 'unknown',
+  keyGenerator: req => req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress || 'unknown',
   handler: (_req, res) => {
     res.status(429).json({ message: 'Too many requests. Please slow down and try again later.' });
   }

package/{src → lib/src}/middleware/security.js

@@ -11,29 +11,13 @@ const SUSPICIOUS_HEADERS = [
   'x-automated-tool'
 ];
 
-/**
- * p_view security middleware: blocks bots, sets security headers.
- */
 export function pviewSecurity(req, res, next) {
   const ua = req.headers['user-agent'] || '';
 
-  // Block empty or obviously automated UAs
-  if (!ua || BLOCKED_UA_PATTERNS.test(ua)) {
-    return res.status(403).json({ message: 'Forbidden' });
-  }
-
-  // Block suspicious headers that indicate automation
-  const hasSuspiciousHeaders = SUSPICIOUS_HEADERS.some(header => header in req.headers);
-  if (hasSuspiciousHeaders) {
-    return res.status(403).json({ message: 'Forbidden' });
-  }
-
-  // Verify Accept header is present (legitimate browsers always send this)
-  if (!req.headers['accept']) {
+  if (!ua || BLOCKED_UA_PATTERNS.test(ua) || !req.headers.accept || SUSPICIOUS_HEADERS.some(h => h in req.headers)) {
     return res.status(403).json({ message: 'Forbidden' });
   }
 
-  // Set security headers for the public view response
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'SAMEORIGIN');
   res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');

package/lib/src/routes/api.routes.js

@@ -0,0 +1,40 @@
+import express from "express";
+import { sessRole } from "mbkauthe";
+import multer from "multer";
+import { requireBucketApi } from "../middleware/bucket-resolver.js";
+import { cleanupUploads, listIncompleteUploads, listFiles, uploadSingleFile, initiateMultipartUpload, uploadChunk, completeUpload, abortUpload, createFolder, deleteItems, downloadFileHandler } from "../controllers/api.controller.js";
+
+const router = express.Router();
+const MAX_CHUNK_SIZE = 50 * 1024 * 1024; // 50 MB
+const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: MAX_CHUNK_SIZE } });
+
+const uploadChunkMiddleware = (req, res, next) => {
+  upload.single('chunk')(req, res, (err) => {
+    if (err?.code === 'LIMIT_FILE_SIZE') {
+      return res.status(413).json({
+        success: false,
+        error: `Chunk too large (max ${Math.round(MAX_CHUNK_SIZE / (1024 * 1024))} MB).`,
+      });
+    }
+    if (err) return next(err);
+    next();
+  });
+};
+
+const adminAuth = sessRole('SuperAdmin');
+
+router.use(requireBucketApi);
+
+router.post('/api/cleanup-uploads', adminAuth, cleanupUploads);
+router.get('/api/incomplete-uploads', adminAuth, listIncompleteUploads);
+router.get('/api/files', adminAuth, listFiles);
+router.post('/upload', adminAuth, upload.single('file'), uploadSingleFile);
+router.post('/upload-init', adminAuth, initiateMultipartUpload);
+router.post('/upload-chunk', adminAuth, uploadChunkMiddleware, uploadChunk);
+router.post('/upload-complete', adminAuth, completeUpload);
+router.post('/upload-abort', adminAuth, abortUpload);
+router.post('/create-folder', adminAuth, createFolder);
+router.post('/delete', adminAuth, deleteItems);
+router.get('/download/*key', adminAuth, downloadFileHandler);
+
+export default router;

package/{src → lib/src}/routes/index.js

@@ -8,15 +8,7 @@ import apiRoutes from "./api.routes.js";
 
 const router = express.Router();
 
-// Dashboard home
 router.get('/mbkbucket', sessRole('SuperAdmin'), renderBucketDashboard);
-
-// Central bucket resolution for all /mbkbucket subroutes
-router.use('/mbkbucket', bucketResolver);
-
-// Mount sub-routers
-router.use("/mbkbucket", infoRoutes);
-router.use("/mbkbucket", viewRoutes);
-router.use("/mbkbucket", apiRoutes);
+router.use('/mbkbucket', bucketResolver, infoRoutes, viewRoutes, apiRoutes);
 
 export default router;

package/{src → lib/src}/routes/info.routes.js

@@ -1,10 +1,9 @@
 import express from "express";
-import { sessRole } from "mbkauthe";
 import { infoPage, infoJson } from "../controllers/info.controller.js";
 
 const router = express.Router();
 
-router.get(['/info', "/i"], infoPage);
-router.get(['/info.json', "/i.json"], infoJson);
+router.get(['/info', '/i'], infoPage);
+router.get(['/info.json', '/i.json'], infoJson);
 
 export default router;

package/{src → lib/src}/routes/view.routes.js

@@ -7,17 +7,12 @@ import { pviewSecurity } from "../middleware/security.js";
 import { viewFile, playerPage, publicView } from "../controllers/view.controller.js";
 
 const router = express.Router();
+const adminAuth = sessRole('SuperAdmin');
 
-// Bucket guard for view routes (skips p_view)
 router.use(requireBucketView);
+router.get('/player/*key', adminAuth, playerPage);
+router.get('/view/*key', adminAuth, viewFile);
 
-// Player page for video/audio
-router.get('/player/*key', sessRole('SuperAdmin'), playerPage);
-
-// Inline file view
-router.get('/view/*key', sessRole('SuperAdmin'), viewFile);
-
-// Public view (conditionally enabled)
 if (mbkbucketVar?.publiView_enabled) {
   router.get('/p_view/*key', pviewRateLimit, pviewSecurity, publicView);
 }