mbkbucket 4.0.1 → 4.1.0

package/lib/src/controllers/info.controller.js

@@ -3,7 +3,7 @@ import { packageJson, getLatestVersion, appVersion, mbkbucketVar } from "../conf
 import { getAvailableBucketNames, getStorageProvider } from "../services/storage.service.js";
 import { storageManager } from "../core/storage/storage-manager.js";
 
-async function getInfoData() {
+async function getInfoData(requestedBucket) {
   let latestVersion = 'unknown';
   try {
     latestVersion = (await getLatestVersion()) || 'unknown';
@@ -12,16 +12,21 @@ async function getInfoData() {
   }
 
   const buckets = getAvailableBucketNames();
-  const defaultBucket = storageManager.getDefaultConnectionName() || (buckets[0] ?? '');
+  let defaultBucket = requestedBucket;
+  if (!defaultBucket || !buckets.includes(defaultBucket)) {
+    defaultBucket = storageManager.getDefaultConnectionName() || (buckets[0] ?? '');
+  }
+
   let providerType = 'S3';
+  let capabilities = {};
   if (defaultBucket) {
     try {
       const provider = getStorageProvider(defaultBucket);
       providerType = (provider?.type || 's3').toUpperCase();
+      capabilities = provider?.capabilities?.toJSON ? provider.capabilities.toJSON() : (provider?.capabilities || {});
     } catch {}
   }
 
-  // Safe subset only - strictly prevent leaking passwords, DB connection strings, OAuth secrets, or storage credentials
   const safeMbkautheVar = {
     APP_NAME: mbkautheVar?.APP_NAME || mbkautheVar?.app_name || "mbkbucket",
   };
@@ -41,24 +46,19 @@ async function getInfoData() {
     mbkbucketVar: safeMbkbucketVar,
     defaultBucket,
     configuredBucketsCount: buckets.length,
-    providerType
+    providerType,
+    capabilities
   };
 }
 
-/**
- * Render the mbkbucket info page (Handlebars).
- */
 export async function infoPage(req, res) {
   renderPage(req, res, "mbkbucket_info.hbs", false, {
     pageTitle: "MBKBucket Information",
     ogUrl: "/mbkbucket/info",
-    ...(await getInfoData())
+    ...(await getInfoData(req.query?.bucket))
   });
 }
 
-/**
- * Return bucket info as JSON.
- */
-export async function infoJson(_req, res) {
-  res.json(await getInfoData());
+export async function infoJson(req, res) {
+  res.json(await getInfoData(req.query?.bucket));
 }

package/lib/src/controllers/view.controller.js

@@ -1,4 +1,4 @@
-import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, generateSignedUrl, resolveStorageName, getStorageProvider } from "../services/storage.service.js";
+import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, resolveStorageName, getStorageProvider } from "../services/storage.service.js";
 import { mbkbucketVar } from "../config/index.js";
 import { escapeHtml, getBaseName, getFileExt, getMimeType, normalizeKeyParam, destroyStream, VIEWABLE_TYPES, VIEWABLE_TYPES_SORTED, STATIC_ASSET_TYPES, VIDEO_TYPES, AUDIO_TYPES, buildCacheControl, parseRangeHeader, renderPlayerPage } from "../utils/helpers.js";
 import { createLogger } from "#logger";
@@ -6,6 +6,7 @@ import { createLogger } from "#logger";
 const debugView = createLogger('view');
 
 function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
+  if (!stream || typeof stream.on !== 'function') return;
   const cleanup = () => destroyStream(stream);
 
   stream.on('error', (err) => {
@@ -25,6 +26,7 @@ function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
   res.on('close', cleanup);
 }
 
+
 async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName, publicCache = false } = {}) {
   const fileName = getBaseName(keyToUse);
   const fileExtension = getFileExt(fileName);
@@ -48,6 +50,8 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   const isPdf = fileExtension === 'pdf';
   const supportsRanges = isVideo || isAudio || isPdf;
   const contentType = getMimeType(fileName);
+  const safeAsciiName = fileName.replace(/["\\]/g, '').replace(/[^\x20-\x7E]/g, '_');
+  const encodedName = encodeURIComponent(fileName);
 
   // Fast path for range requests (video / audio / PDF streaming)
   if (supportsRanges && rangeHeader) {
@@ -86,21 +90,27 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
         res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
         res.setHeader('Content-Length', chunksize);
         res.setHeader('Content-Type', contentType);
+        res.setHeader('Content-Disposition', `inline; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
         res.setHeader('Cache-Control', buildCacheControl(contentType, { supportsRanges: true, publicCache }));
         res.setHeader('ETag', etag);
         res.setHeader('Accept-Ranges', 'bytes');
+        res.setHeader('X-Frame-Options', 'SAMEORIGIN');
         if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
         res.setHeader('X-Content-Type-Options', 'nosniff');
-        if (meta.LastModified) res.setHeader('Last-Modified', new Date(meta.LastModified).toUTCString());
-
-        attachStreamCleanup(req, res, rangeResult.Body);
-        return rangeResult.Body.pipe(res);
+        const stream = rangeResult.Body || rangeResult.stream;
+        attachStreamCleanup(req, res, stream);
+        return stream.pipe(res);
       } catch (rangeError) {
-        console.error('Range request failed:', rangeError);
+        console.error('[mbkbucket] Range request failed for %s:', keyToUse, rangeError);
+        if (!res.headersSent) {
+          return res.status(500).json({ message: 'Range stream failed', error: rangeError.message });
+        }
+        return;
       }
     }
   }
 
+
   // Standard path: full-file download
   const downloadOptions = {
     ...(ifNoneMatch && { ifNoneMatch }),
@@ -130,13 +140,14 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   if (ifNoneMatch === etag) return res.status(304).end();
 
   res.setHeader('Content-Type', contentType);
-  res.setHeader('Content-Disposition', `inline; filename="${fileName}"`);
+  res.setHeader('Content-Disposition', `inline; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
   res.setHeader('ETag', etag);
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'SAMEORIGIN');
   if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
   if (result.ContentLength) res.setHeader('Content-Length', result.ContentLength);
   if (result.LastModified) res.setHeader('Last-Modified', new Date(result.LastModified).toUTCString());
+
   if (fileExtension === 'html' || fileExtension === 'htm') {
     res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none'; object-src 'none';");
   }
@@ -144,11 +155,13 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   res.setHeader('Cache-Control', buildCacheControl(contentType, { isStaticAsset, supportsRanges, publicCache }));
   res.status(200);
 
+  const stream = result.Body || result.stream;
   const timeoutDuration = result.ContentLength > 50 * 1024 * 1024 ? 300000 : 120000;
-  attachStreamCleanup(req, res, result.Body, timeoutDuration);
-  result.Body.pipe(res);
+  attachStreamCleanup(req, res, stream, timeoutDuration);
+  stream.pipe(res);
 }
 
+
 export async function viewFile(req, res) {
   try {
     const key = normalizeKeyParam(req.params.key);
@@ -213,18 +226,6 @@ export async function publicView(req, res) {
       return res.status(400).json({ message: e.message });
     }
 
-    if (!mbkbucketVar?.p_view_inline) {
-      try {
-        const provider = getStorageProvider(bucketName);
-        if (provider.capabilities.presignedUrls) {
-          const signed = await generateSignedUrl(keyToUse, 'getObject', 3600, bucketName);
-          return res.redirect(302, signed.url);
-        }
-      } catch (err) {
-        debugView('Signed URL redirection failed, falling back to inline serve: %s', err.message);
-      }
-    }
-
     await serveFileInline(req, res, keyToUse, { noindex: true, bucketName, publicCache: true });
   } catch (error) {
     console.error('[mbkbucket] p_view error:', error);

package/lib/src/core/metrics.js

@@ -0,0 +1,134 @@
+/**
+ * MBKBucket - Metrics & Observability Registry
+ * Copyright (c) 2026 Muhammad Bin Khalid, MBKTech.org and contributors
+ * Licensed under the MIT License.
+ */
+
+export class MetricsRegistry {
+  constructor() {
+    this.reset();
+  }
+
+  reset() {
+    this.operations = new Map(); // key: "op:provider:status" -> count
+    this.durations = new Map();  // key: "op:provider" -> { totalMs, count, minMs, maxMs }
+    this.bytesTransferred = new Map(); // key: "direction:provider" -> bytes
+    this.errors = new Map(); // key: "op:provider:errorType" -> count
+    this.activeMultipart = 0;
+    this.startedAt = new Date().toISOString();
+  }
+
+  recordOperation(operation, { provider = 'unknown', status = 'success', durationMs = 0, bytes = 0 } = {}) {
+    const opKey = `${operation}:${provider}:${status}`;
+    this.operations.set(opKey, (this.operations.get(opKey) || 0) + 1);
+
+    if (durationMs >= 0) {
+      const durKey = `${operation}:${provider}`;
+      const existing = this.durations.get(durKey) || { totalMs: 0, count: 0, minMs: Infinity, maxMs: 0 };
+      existing.totalMs += durationMs;
+      existing.count += 1;
+      existing.minMs = Math.min(existing.minMs, durationMs);
+      existing.maxMs = Math.max(existing.maxMs, durationMs);
+      this.durations.set(durKey, existing);
+    }
+
+    if (bytes > 0) {
+      const direction = operation.startsWith('download') || operation.startsWith('view') ? 'outbound' : 'inbound';
+      const byteKey = `${direction}:${provider}`;
+      this.bytesTransferred.set(byteKey, (this.bytesTransferred.get(byteKey) || 0) + bytes);
+    }
+  }
+
+  recordError(operation, provider = 'unknown', errorType = 'Error') {
+    const errKey = `${operation}:${provider}:${errorType}`;
+    this.errors.set(errKey, (this.errors.get(errKey) || 0) + 1);
+  }
+
+  incrementActiveMultipart(delta = 1) {
+    this.activeMultipart = Math.max(0, this.activeMultipart + delta);
+  }
+
+  getStats() {
+    const ops = {};
+    for (const [key, count] of this.operations.entries()) {
+      ops[key] = count;
+    }
+
+    const durations = {};
+    for (const [key, d] of this.durations.entries()) {
+      durations[key] = {
+        count: d.count,
+        avgMs: d.count ? Math.round((d.totalMs / d.count) * 100) / 100 : 0,
+        minMs: d.minMs === Infinity ? 0 : d.minMs,
+        maxMs: d.maxMs
+      };
+    }
+
+    const bytes = {};
+    for (const [key, val] of this.bytesTransferred.entries()) {
+      bytes[key] = val;
+    }
+
+    const errs = {};
+    for (const [key, count] of this.errors.entries()) {
+      errs[key] = count;
+    }
+
+    return {
+      startedAt: this.startedAt,
+      activeMultipartUploads: this.activeMultipart,
+      operations: ops,
+      durations,
+      bytesTransferred: bytes,
+      errors: errs,
+      timestamp: new Date().toISOString()
+    };
+  }
+
+  toPrometheusText() {
+    const lines = [
+      '# HELP mbkbucket_operations_total Total number of storage operations executed',
+      '# TYPE mbkbucket_operations_total counter'
+    ];
+
+    for (const [key, count] of this.operations.entries()) {
+      const [operation, provider, status] = key.split(':');
+      lines.push(`mbkbucket_operations_total{operation="${operation}",provider="${provider}",status="${status}"} ${count}`);
+    }
+
+    lines.push('');
+    lines.push('# HELP mbkbucket_operation_duration_seconds Total duration of storage operations');
+    lines.push('# TYPE mbkbucket_operation_duration_seconds summary');
+    for (const [key, d] of this.durations.entries()) {
+      const [operation, provider] = key.split(':');
+      lines.push(`mbkbucket_operation_duration_seconds_count{operation="${operation}",provider="${provider}"} ${d.count}`);
+      lines.push(`mbkbucket_operation_duration_seconds_sum{operation="${operation}",provider="${provider}"} ${(d.totalMs / 1000).toFixed(4)}`);
+    }
+
+    lines.push('');
+    lines.push('# HELP mbkbucket_transferred_bytes_total Total bytes transferred into or out of storage');
+    lines.push('# TYPE mbkbucket_transferred_bytes_total counter');
+    for (const [key, bytes] of this.bytesTransferred.entries()) {
+      const [direction, provider] = key.split(':');
+      lines.push(`mbkbucket_transferred_bytes_total{direction="${direction}",provider="${provider}"} ${bytes}`);
+    }
+
+    lines.push('');
+    lines.push('# HELP mbkbucket_errors_total Total storage errors encountered');
+    lines.push('# TYPE mbkbucket_errors_total counter');
+    for (const [key, count] of this.errors.entries()) {
+      const [operation, provider, errorType] = key.split(':');
+      lines.push(`mbkbucket_errors_total{operation="${operation}",provider="${provider}",error_type="${errorType}"} ${count}`);
+    }
+
+    lines.push('');
+    lines.push('# HELP mbkbucket_active_multipart_uploads Current number of active multipart uploads');
+    lines.push('# TYPE mbkbucket_active_multipart_uploads gauge');
+    lines.push(`mbkbucket_active_multipart_uploads ${this.activeMultipart}`);
+    lines.push('');
+
+    return lines.join('\n');
+  }
+}
+
+export const metricsRegistry = new MetricsRegistry();

package/lib/src/core/storage/capabilities.js

@@ -0,0 +1,58 @@
+/**
+ * MBKBucket - Storage Provider Capabilities
+ * Copyright (c) 2026 Muhammad Bin Khalid, MBKTech.org and contributors
+ * Licensed under the MIT License.
+ */
+
+import { StorageUnsupportedOperationError } from "./errors.js";
+
+export class StorageCapabilities {
+  constructor(flags = {}) {
+    this.multipart = Boolean(flags.multipart);
+    this.resumable = Boolean(flags.resumable ?? flags.multipart);
+    this.nativeFolders = Boolean(flags.nativeFolders);
+    this.ranges = Boolean(flags.ranges ?? true);
+    this.copy = Boolean(flags.copy);
+    this.move = Boolean(flags.move);
+    this.search = Boolean(flags.search);
+    this.directDownloadUrl = Boolean(flags.directDownloadUrl);
+    this.versioning = Boolean(flags.versioning);
+    this.publicUrls = Boolean(flags.publicUrls);
+    this.storageQuota = Boolean(flags.storageQuota);
+    this.deleteBatch = Boolean(flags.deleteBatch ?? true);
+    this.metadata = Boolean(flags.metadata ?? true);
+
+    Object.freeze(this);
+  }
+
+  has(capability) {
+    return Boolean(this[capability]);
+  }
+
+  assert(capability, operationName, providerType = 'storage provider') {
+    if (!this.has(capability)) {
+      const op = operationName || capability;
+      throw new StorageUnsupportedOperationError(
+        `Operation '${op}' is not supported by ${providerType} (missing capability: ${capability})`
+      );
+    }
+  }
+
+  toJSON() {
+    return {
+      multipart: this.multipart,
+      resumable: this.resumable,
+      nativeFolders: this.nativeFolders,
+      ranges: this.ranges,
+      copy: this.copy,
+      move: this.move,
+      search: this.search,
+      directDownloadUrl: this.directDownloadUrl,
+      versioning: this.versioning,
+      publicUrls: this.publicUrls,
+      storageQuota: this.storageQuota,
+      deleteBatch: this.deleteBatch,
+      metadata: this.metadata
+    };
+  }
+}

package/lib/src/core/storage/errors.js

@@ -1,62 +1,57 @@
-/**
- * MBKBucket - Typed Storage Error Hierarchy
- * Copyright (c) 2026 Muhammad Bin Khalid, MBKTech.org and contributors
- * Licensed under the MIT License.
- */
-
-export class StorageError extends Error {
-  /**
-   * @param {string} message
-   * @param {number} [status=500]
-   * @param {string} [code='INTERNAL_STORAGE_ERROR']
-   */
-  constructor(message, status = 500, code = 'INTERNAL_STORAGE_ERROR') {
-    super(message);
-    this.name = this.constructor.name;
-    this.status = status;
-    this.code = code;
-    Error.captureStackTrace?.(this, this.constructor);
-  }
-}
-
-export class StorageNotFoundError extends StorageError {
-  constructor(message = 'File or folder not found') {
-    super(message, 404, 'NOT_FOUND');
-  }
-}
-
-export class StorageAccessDeniedError extends StorageError {
-  constructor(message = 'Access denied') {
-    super(message, 403, 'ACCESS_DENIED');
-  }
-}
-
-export class StorageConflictError extends StorageError {
-  constructor(message = 'Resource already exists') {
-    super(message, 409, 'CONFLICT');
-  }
-}
-
-export class StorageValidationError extends StorageError {
-  constructor(message = 'Validation failed') {
-    super(message, 400, 'VALIDATION_ERROR');
-  }
-}
-
-export class StorageConfigError extends StorageError {
-  constructor(message = 'Storage configuration error') {
-    super(message, 503, 'STORAGE_CONFIG_ERROR');
-  }
-}
-
-export class StorageQuotaExceededError extends StorageError {
-  constructor(message = 'Storage quota exceeded') {
-    super(message, 507, 'QUOTA_EXCEEDED');
-  }
-}
-
-export class StorageUnsupportedOperationError extends StorageError {
-  constructor(message = 'Operation not supported by this storage provider') {
-    super(message, 501, 'NOT_IMPLEMENTED');
-  }
-}
+/**
+ * MBKBucket - Typed Storage Error Hierarchy
+ * Copyright (c) 2026 Muhammad Bin Khalid, MBKTech.org and contributors
+ * Licensed under the MIT License.
+ */
+
+export class StorageError extends Error {
+  constructor(message, status = 500, code = 'INTERNAL_STORAGE_ERROR') {
+    super(message);
+    this.name = this.constructor.name;
+    this.status = status;
+    this.code = code;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+
+export class StorageNotFoundError extends StorageError {
+  constructor(message = 'File or folder not found') {
+    super(message, 404, 'NOT_FOUND');
+  }
+}
+
+export class StorageAccessDeniedError extends StorageError {
+  constructor(message = 'Access denied') {
+    super(message, 403, 'ACCESS_DENIED');
+  }
+}
+
+export class StorageConflictError extends StorageError {
+  constructor(message = 'Resource already exists') {
+    super(message, 409, 'CONFLICT');
+  }
+}
+
+export class StorageValidationError extends StorageError {
+  constructor(message = 'Validation failed') {
+    super(message, 400, 'VALIDATION_ERROR');
+  }
+}
+
+export class StorageConfigError extends StorageError {
+  constructor(message = 'Storage configuration error') {
+    super(message, 503, 'STORAGE_CONFIG_ERROR');
+  }
+}
+
+export class StorageQuotaExceededError extends StorageError {
+  constructor(message = 'Storage quota exceeded') {
+    super(message, 507, 'QUOTA_EXCEEDED');
+  }
+}
+
+export class StorageUnsupportedOperationError extends StorageError {
+  constructor(message = 'Operation not supported by this storage provider') {
+    super(message, 501, 'NOT_IMPLEMENTED');
+  }
+}