mbkbucket 3.5.1 → 3.7.0

package/lib/src/middleware/async-handler.js

@@ -1,23 +1,19 @@
-/**
- * Wraps an async Express route handler so that any thrown/rejected errors
- * are forwarded to `next(err)` instead of crashing the process.
- */
-export function wrap(handler, onError) {
-  return (req, res, next) => {
-    Promise.resolve(handler(req, res, next)).catch(err => (onError ? onError(err, req, res, next) : next(err)));
-  };
-}
-
-/**
- * Combines wrap() with a standard JSON error response for API routes.
- */
-export function wrapApi(handler, fallbackMessage = 'Request failed') {
-  return wrap(handler, (err, _req, res) => {
-    console.error(`[mbkbucket] ${err.stack || err.message}`);
-    res.status(500).json({
-      success: false,
-      code: 'INTERNAL_ERROR',
-      error: err.message || fallbackMessage,
-    });
-  });
-}
+/**
+ * Wraps an async Express route handler so that any thrown/rejected errors
+ * are forwarded to `next(err)` instead of crashing the process.
+ */
+export const wrap = (handler, onError) => (req, res, next) =>
+  Promise.resolve(handler(req, res, next)).catch(err => onError ? onError(err, req, res, next) : next(err));
+
+/**
+ * Combines wrap() with a standard JSON error response for API routes.
+ */
+export const wrapApi = (handler, fallbackMessage = 'Request failed') =>
+  wrap(handler, (err, _req, res) => {
+    console.error(`[mbkbucket] ${err.stack || err.message}`);
+    res.status(500).json({
+      success: false,
+      code: 'INTERNAL_ERROR',
+      error: err.message || fallbackMessage,
+    });
+  });

package/lib/src/middleware/bucket-resolver.js

@@ -1,37 +1,37 @@
-import { resolveBucketName } from "../services/s3.service.js";
-import { sendApiError, sendViewError } from "../utils/errors.js";
-
-const NO_BUCKET_MSG = 'No bucket selected. Provide ?bucket=<name> or configure a default bucket in mbkautheVar.bucket.';
-
-/**
- * Resolves `?bucket=<name>` query param and attaches `req.activeBucket` and `req.bucketResolveError`.
- */
-export function bucketResolver(req, _res, next) {
-  try {
-    req.activeBucket = resolveBucketName(req.query.bucket);
-    req.bucketResolveError = null;
-  } catch (err) {
-    req.activeBucket = null;
-    req.bucketResolveError = err;
-  }
-  next();
-}
-
-/**
- * Guard middleware for API routes — returns 400/503 JSON if bucket is invalid.
- */
-export function requireBucketApi(req, res, next) {
-  if (req.bucketResolveError) return sendApiError(res, req.bucketResolveError, 'Invalid bucket selection');
-  if (!req.activeBucket) return sendApiError(res, new Error(NO_BUCKET_MSG));
-  next();
-}
-
-/**
- * Guard middleware for view routes — returns 400/503 JSON if bucket is invalid (skips /p_view/...).
- */
-export function requireBucketView(req, res, next) {
-  if (req.path.startsWith('/p_view/')) return next();
-  if (req.bucketResolveError) return sendViewError(res, req.bucketResolveError, 'Invalid bucket selection');
-  if (!req.activeBucket) return sendViewError(res, new Error(NO_BUCKET_MSG));
-  next();
-}
+import { resolveBucketName } from "../services/s3.service.js";
+import { sendApiError, sendViewError } from "../utils/errors.js";
+
+const NO_BUCKET_MSG = 'No bucket selected. Provide ?bucket=<name> or configure a default bucket in mbkautheVar.bucket.';
+
+/**
+ * Resolves `?bucket=<name>` query param and attaches `req.activeBucket` and `req.bucketResolveError`.
+ */
+export function bucketResolver(req, _res, next) {
+  try {
+    req.activeBucket = resolveBucketName(req.query.bucket);
+    req.bucketResolveError = null;
+  } catch (err) {
+    req.activeBucket = null;
+    req.bucketResolveError = err;
+  }
+  next();
+}
+
+/**
+ * Guard middleware for API routes — returns 400/503 JSON if bucket is invalid.
+ */
+export function requireBucketApi(req, res, next) {
+  if (req.bucketResolveError) return sendApiError(res, req.bucketResolveError, 'Invalid bucket selection');
+  if (!req.activeBucket) return sendApiError(res, new Error(NO_BUCKET_MSG));
+  next();
+}
+
+/**
+ * Guard middleware for view routes — returns 400/503 JSON if bucket is invalid (skips /p_view/...).
+ */
+export function requireBucketView(req, res, next) {
+  if (req.path.startsWith('/p_view/')) return next();
+  if (req.bucketResolveError) return sendViewError(res, req.bucketResolveError, 'Invalid bucket selection');
+  if (!req.activeBucket) return sendViewError(res, new Error(NO_BUCKET_MSG));
+  next();
+}

package/lib/src/middleware/error-handler.js

@@ -1,54 +1,50 @@
-import { createLogger } from "#logger";
-import { isJsonRequest, sendError, sanitizeErrorDetails } from "mbkauthe";
-
-const debugServer = createLogger('server');
-
-const BASE_ERROR_DATA = { layout: false, pagename: "Home", page: "/" };
-
-export function notFoundHandler(req, res, next) {
-  const url = req.originalUrl || req.url || '';
-  if (!url.startsWith('/mbkbucket') && typeof next === 'function') {
-    return next();
-  }
-
-  debugServer("Path not found: %s %s", req.method, req.url);
-
-  if (isJsonRequest(req)) {
-    return sendError(res, "The requested API route was not found.", {
-      statusCode: 404,
-      code: "ROUTE_NOT_FOUND",
-      req,
-    });
-  }
-
-  return res.status(404).render("Error/dError.handlebars", {
-    ...BASE_ERROR_DATA,
-    code: 404,
-    error: "Not Found",
-    message: "The requested page was not found.",
-  });
-}
-
-export function globalErrorHandler(err, req, res, _next) {
-  console.error(`[mbkbucket] ${err.stack || err}`);
-
-  const statusCode = Number(err.status || err.statusCode || 500);
-
-  if (isJsonRequest(req)) {
-    return sendError(res, err, {
-      statusCode,
-      req,
-      details: process.env.NODE_ENV !== 'production' ? err.stack : undefined,
-    });
-  }
-
-  const sanitizedDetails = err.message ? sanitizeErrorDetails(err.message) : undefined;
-
-  return res.status(statusCode).render("Error/dError.handlebars", {
-    ...BASE_ERROR_DATA,
-    code: statusCode,
-    error: statusCode >= 500 ? "Internal app Error" : (err.name || "Client Error"),
-    message: err.message || "An unexpected error occurred on the app.",
-    ...(sanitizedDetails ? { details: sanitizedDetails } : {}),
-  });
-}
+import { createLogger } from "#logger";
+import { isJsonRequest, sendError, sanitizeErrorDetails } from "mbkauthe";
+
+const debugServer = createLogger('server');
+const BASE_ERROR_DATA = { layout: false, pagename: "Home", page: "/" };
+
+export function notFoundHandler(req, res, next) {
+  const url = req.originalUrl || req.url || '';
+  if (!url.startsWith('/mbkbucket') && typeof next === 'function') return next();
+
+  debugServer("Path not found: %s %s", req.method, req.url);
+
+  if (isJsonRequest(req)) {
+    return sendError(res, "The requested API route was not found.", {
+      statusCode: 404,
+      code: "ROUTE_NOT_FOUND",
+      req,
+    });
+  }
+
+  return res.status(404).render("Error/dError.handlebars", {
+    ...BASE_ERROR_DATA,
+    code: 404,
+    error: "Not Found",
+    message: "The requested page was not found.",
+  });
+}
+
+export function globalErrorHandler(err, req, res, _next) {
+  console.error(`[mbkbucket] ${err.stack || err}`);
+  const statusCode = Number(err.status || err.statusCode || 500);
+
+  if (isJsonRequest(req)) {
+    return sendError(res, err, {
+      statusCode,
+      req,
+      details: process.env.NODE_ENV !== 'production' ? err.stack : undefined,
+    });
+  }
+
+  const sanitizedDetails = err.message ? sanitizeErrorDetails(err.message) : undefined;
+
+  return res.status(statusCode).render("Error/dError.handlebars", {
+    ...BASE_ERROR_DATA,
+    code: statusCode,
+    error: statusCode >= 500 ? "Internal app Error" : (err.name || "Client Error"),
+    message: err.message || "An unexpected error occurred on the app.",
+    ...(sanitizedDetails && { details: sanitizedDetails }),
+  });
+}

package/lib/src/middleware/rate-limiter.js

@@ -1,22 +1,22 @@
-import rateLimit from "express-rate-limit";
-
-export const generalLimiter = rateLimit({
-  windowMs: 2 * 60 * 1000, // 2 minutes
-  max: 150,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req, res) => {
-    res.status(429).render('error.handlebars', { message: 'Too many requests from your IP. Try again later.', code: 429 });
-  }
-});
-
-export const pviewRateLimit = rateLimit({
-  windowMs: 60 * 1000, // 1 minute
-  max: 10,
-  standardHeaders: 'draft-7',
-  legacyHeaders: false,
-  keyGenerator: req => req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress || 'unknown',
-  handler: (_req, res) => {
-    res.status(429).json({ message: 'Too many requests. Please slow down and try again later.' });
-  }
-});
+import rateLimit from "express-rate-limit";
+
+export const generalLimiter = rateLimit({
+  windowMs: 2 * 60 * 1000,
+  max: 150,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (_req, res) => {
+    res.status(429).render('error.handlebars', { message: 'Too many requests from your IP. Try again later.', code: 429 });
+  }
+});
+
+export const pviewRateLimit = rateLimit({
+  windowMs: 60 * 1000,
+  max: 10,
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  keyGenerator: req => req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress || 'unknown',
+  handler: (_req, res) => {
+    res.status(429).json({ message: 'Too many requests. Please slow down and try again later.' });
+  }
+});

package/lib/src/middleware/security.js

@@ -1,27 +1,21 @@
-/**
- * Security middleware for public view (p_view) routes.
- * Blocks bot/scraper User-Agents and sets security headers.
- */
-
-const BLOCKED_UA_PATTERNS = /curl|wget|python-requests|python-urllib|go-http|scrapy|libwww|java\/|bot|crawl|spider|headless|phantom|selenium|puppeteer|playwright|postman|insomnia|httpie/i;
-
-const SUSPICIOUS_HEADERS = [
-  'x-devtools-emulate-network-conditions-client-id',
-  'x-chromedriver-clientid',
-  'x-automated-tool'
-];
-
-export function pviewSecurity(req, res, next) {
-  const ua = req.headers['user-agent'] || '';
-
-  if (!ua || BLOCKED_UA_PATTERNS.test(ua) || !req.headers.accept || SUSPICIOUS_HEADERS.some(h => h in req.headers)) {
-    return res.status(403).json({ message: 'Forbidden' });
-  }
-
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
-  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-  res.removeHeader('Access-Control-Allow-Origin');
-
-  next();
-}
+/**
+ * Security middleware for public view (p_view) routes.
+ * Blocks bot/scraper User-Agents and sets security headers.
+ */
+
+const BLOCKED_UA_PATTERNS = /curl|wget|python-requests|python-urllib|go-http|scrapy|libwww|java\/|bot|crawl|spider|headless|phantom|selenium|puppeteer|playwright|postman|insomnia|httpie/i;
+const SUSPICIOUS_HEADERS = ['x-devtools-emulate-network-conditions-client-id', 'x-chromedriver-clientid', 'x-automated-tool'];
+
+export function pviewSecurity(req, res, next) {
+  const ua = req.headers['user-agent'] || '';
+
+  if (!ua || BLOCKED_UA_PATTERNS.test(ua) || !req.headers.accept || SUSPICIOUS_HEADERS.some(h => h in req.headers)) {
+    return res.status(403).json({ message: 'Forbidden' });
+  }
+
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  res.removeHeader('Access-Control-Allow-Origin');
+  next();
+}

package/lib/src/routes/api.routes.js

@@ -1,40 +1,53 @@
-import express from "express";
-import { sessRole } from "mbkauthe";
-import multer from "multer";
-import { requireBucketApi } from "../middleware/bucket-resolver.js";
-import { cleanupUploads, listIncompleteUploads, listFiles, uploadSingleFile, initiateMultipartUpload, uploadChunk, completeUpload, abortUpload, createFolder, deleteItems, downloadFileHandler } from "../controllers/api.controller.js";
-
-const router = express.Router();
-const MAX_CHUNK_SIZE = 50 * 1024 * 1024; // 50 MB
-const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: MAX_CHUNK_SIZE } });
-
-const uploadChunkMiddleware = (req, res, next) => {
-  upload.single('chunk')(req, res, (err) => {
-    if (err?.code === 'LIMIT_FILE_SIZE') {
-      return res.status(413).json({
-        success: false,
-        error: `Chunk too large (max ${Math.round(MAX_CHUNK_SIZE / (1024 * 1024))} MB).`,
-      });
-    }
-    if (err) return next(err);
-    next();
-  });
-};
-
-const adminAuth = sessRole('superadmin');
-
-router.use(requireBucketApi);
-
-router.post('/api/cleanup-uploads', adminAuth, cleanupUploads);
-router.get('/api/incomplete-uploads', adminAuth, listIncompleteUploads);
-router.get('/api/files', adminAuth, listFiles);
-router.post('/upload', adminAuth, upload.single('file'), uploadSingleFile);
-router.post('/upload-init', adminAuth, initiateMultipartUpload);
-router.post('/upload-chunk', adminAuth, uploadChunkMiddleware, uploadChunk);
-router.post('/upload-complete', adminAuth, completeUpload);
-router.post('/upload-abort', adminAuth, abortUpload);
-router.post('/create-folder', adminAuth, createFolder);
-router.post('/delete', adminAuth, deleteItems);
-router.get('/download/*key', adminAuth, downloadFileHandler);
-
-export default router;
+import express from "express";
+import { sessRole } from "mbkauthe";
+import multer from "multer";
+import { requireBucketApi } from "../middleware/bucket-resolver.js";
+import { cleanupUploads, listIncompleteUploads, listFiles, uploadSingleFile, initiateMultipartUpload, uploadChunk, completeUpload, abortUpload, createFolder, deleteItems, downloadFileHandler } from "../controllers/api.controller.js";
+
+const MAX_CHUNK_SIZE = 50 * 1024 * 1024; // 50 MB
+const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: MAX_CHUNK_SIZE } });
+
+const uploadChunkMiddleware = (req, res, next) => {
+  upload.single('chunk')(req, res, (err) => {
+    if (err?.code === 'LIMIT_FILE_SIZE') {
+      return res.status(413).json({
+        success: false,
+        error: `Chunk too large (max ${Math.round(MAX_CHUNK_SIZE / (1024 * 1024))} MB).`,
+      });
+    }
+    if (err) return next(err);
+    next();
+  });
+};
+
+export function createApiRoutes({
+  authorization,
+  viewAuthorization,
+  uploadAuthorization,
+  deleteAuthorization,
+} = {}) {
+  const apiRouter = express.Router();
+  const defaultAuth = authorization ?? sessRole('superadmin');
+  const viewAuth = viewAuthorization ?? defaultAuth;
+  const uploadAuth = uploadAuthorization ?? defaultAuth;
+  const deleteAuth = deleteAuthorization ?? defaultAuth;
+
+  apiRouter.use(requireBucketApi);
+  apiRouter.post('/api/cleanup-uploads', deleteAuth, cleanupUploads);
+  apiRouter.get('/api/incomplete-uploads', viewAuth, listIncompleteUploads);
+  apiRouter.get('/api/files', viewAuth, listFiles);
+  apiRouter.post('/upload', uploadAuth, upload.single('file'), uploadSingleFile);
+  apiRouter.post('/upload-init', uploadAuth, initiateMultipartUpload);
+  apiRouter.post('/upload-chunk', uploadAuth, uploadChunkMiddleware, uploadChunk);
+  apiRouter.post('/upload-complete', uploadAuth, completeUpload);
+  apiRouter.post('/upload-abort', deleteAuth, abortUpload);
+  apiRouter.post('/create-folder', uploadAuth, createFolder);
+  apiRouter.post('/delete', deleteAuth, deleteItems);
+  apiRouter.get('/download/*key', viewAuth, downloadFileHandler);
+
+  return apiRouter;
+}
+
+const router = createApiRoutes();
+
+export default router;

package/lib/src/routes/index.js

@@ -1,21 +1,60 @@
-/**
- * MBKBucket
- * Copyright (c) 2026 Muhammad Bin Khalid, MBKTech.org and contributors
- * Licensed under the MIT License.
- * Source: https://github.com/MIbnEKhalid/mbkbucket
- */
-
-import express from "express";
-import { sessRole } from "mbkauthe";
-import { bucketResolver } from "../middleware/bucket-resolver.js";
-import { renderBucketDashboard } from "../controllers/dashboard.controller.js";
-import infoRoutes from "./info.routes.js";
-import viewRoutes from "./view.routes.js";
-import apiRoutes from "./api.routes.js";
-
-const router = express.Router();
-
-router.get('/mbkbucket', sessRole('superadmin'), renderBucketDashboard);
-router.use('/mbkbucket', bucketResolver, infoRoutes, viewRoutes, apiRoutes);
-
-export default router;
+/**
+ * MBKBucket
+ * Copyright (c) 2026 Muhammad Bin Khalid, MBKTech.org and contributors
+ * Licensed under the MIT License.
+ * Source: https://github.com/MIbnEKhalid/mbkbucket
+ */
+
+import express from "express";
+import { sessRole } from "mbkauthe";
+import path from "path";
+import { fileURLToPath } from "url";
+import { bucketResolver } from "../middleware/bucket-resolver.js";
+import { renderBucketDashboard } from "../controllers/dashboard.controller.js";
+import infoRoutes from "./info.routes.js";
+import { createViewRoutes } from "./view.routes.js";
+import { createApiRoutes } from "./api.routes.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const publicDir = path.resolve(__dirname, "..", "..", "public");
+
+const serveAsset = (filename) => (_req, res) => {
+  res.set("Cache-Control", "public, max-age=300, must-revalidate");
+  res.sendFile(path.join(publicDir, filename), (err) => {
+    if (err) res.status(err.status || 404).end();
+  });
+};
+
+export function createBucketRouter({ authorization } = {}) {
+  const router = express.Router();
+  const defaultAuth = sessRole('superadmin');
+  const auths = typeof authorization === 'function'
+    ? { view: authorization, upload: authorization, delete: authorization }
+    : authorization ?? {};
+  const viewAuth = auths.view ?? defaultAuth;
+  const uploadAuth = auths.upload ?? defaultAuth;
+  const deleteAuth = auths.delete ?? defaultAuth;
+
+  // Static dashboard & helper assets
+  router.get('/mbkbucket/bucketadmin.css', serveAsset('bucketadmin.css'));
+  router.get('/mbkbucket/bucketadmin.js', serveAsset('bucketadmin.js'));
+  router.get('/mbkbucket/mbkbucket-helper.css', serveAsset('mbkbucket-helper.css'));
+  router.get('/mbkbucket/mbkbucket-helper.js', serveAsset('mbkbucket-helper.js'));
+  router.get('/mbkbucket/helper-demo', serveAsset('mbkbucket-helper-demo.html'));
+
+  router.get('/mbkbucket', viewAuth, renderBucketDashboard);
+  router.use(
+    '/mbkbucket',
+    bucketResolver,
+    infoRoutes,
+    createViewRoutes({ authorization: viewAuth }),
+    createApiRoutes({ viewAuthorization: viewAuth, uploadAuthorization: uploadAuth, deleteAuthorization: deleteAuth })
+  );
+
+  return router;
+}
+
+const router = createBucketRouter();
+
+export default router;

package/lib/src/routes/info.routes.js

@@ -1,9 +1,9 @@
-import express from "express";
-import { infoPage, infoJson } from "../controllers/info.controller.js";
-
-const router = express.Router();
-
-router.get(['/info', '/i'], infoPage);
-router.get(['/info.json', '/i.json'], infoJson);
-
-export default router;
+import express from "express";
+import { infoPage, infoJson } from "../controllers/info.controller.js";
+
+const router = express.Router();
+
+router.get(['/info', '/i'], infoPage);
+router.get(['/info.json', '/i.json'], infoJson);
+
+export default router;

package/lib/src/routes/view.routes.js

@@ -1,20 +1,25 @@
-import express from "express";
-import { sessRole } from "mbkauthe";
-import { mbkbucketVar } from "../config/index.js";
-import { requireBucketView } from "../middleware/bucket-resolver.js";
-import { pviewRateLimit } from "../middleware/rate-limiter.js";
-import { pviewSecurity } from "../middleware/security.js";
-import { viewFile, playerPage, publicView } from "../controllers/view.controller.js";
-
-const router = express.Router();
-const adminAuth = sessRole('superadmin');
-
-router.use(requireBucketView);
-router.get('/player/*key', adminAuth, playerPage);
-router.get('/view/*key', adminAuth, viewFile);
-
-if (mbkbucketVar?.publiView_enabled) {
-  router.get('/p_view/*key', pviewRateLimit, pviewSecurity, publicView);
-}
-
-export default router;
+import express from "express";
+import { sessRole } from "mbkauthe";
+import { mbkbucketVar } from "../config/index.js";
+import { requireBucketView } from "../middleware/bucket-resolver.js";
+import { pviewRateLimit } from "../middleware/rate-limiter.js";
+import { pviewSecurity } from "../middleware/security.js";
+import { viewFile, playerPage, publicView } from "../controllers/view.controller.js";
+
+export function createViewRoutes({ authorization = sessRole('superadmin') } = {}) {
+  const viewRouter = express.Router();
+
+  viewRouter.use(requireBucketView);
+  viewRouter.get('/player/*key', authorization, playerPage);
+  viewRouter.get('/view/*key', authorization, viewFile);
+
+  if (mbkbucketVar?.publiView_enabled) {
+    viewRouter.get('/p_view/*key', pviewRateLimit, pviewSecurity, publicView);
+  }
+
+  return viewRouter;
+}
+
+const router = createViewRoutes();
+
+export default router;