most-box 0.1.0 → 0.1.2

package/server/src/config.js

@@ -3,7 +3,7 @@
  */
 
 // 文件大小限制
-export const MAX_FILE_SIZE = 100 * 1024 * 1024 * 1024 // 100 GB
+export const MAX_FILE_SIZE = 10 * 1024 * 1024 * 1024 // 10 GB
 
 // 网络超时（毫秒）
 export const CONNECTION_TIMEOUT = 120000
@@ -28,6 +28,10 @@ export const DOWNLOAD_POLL_INTERVAL_MIN = 500
 export const DOWNLOAD_POLL_INTERVAL_MAX = 2000
 export const DRIVE_UPDATE_INTERVAL = 2000
 
+// 启动时恢复做种 topic 的后台批处理
+export const HOLDING_REJOIN_BATCH_SIZE = 16
+export const HOLDING_REJOIN_BATCH_DELAY = 25
+
 // 进度更新节流间隔（毫秒）
 export const PROGRESS_THROTTLE = 500
 

package/server/src/core/channelAttachment.js

@@ -0,0 +1,68 @@
+import { parseMostLink, validateCidString } from './cid.js'
+import { sanitizeFilename } from '../utils/security.js'
+import { ValidationError } from '../utils/errors.js'
+
+const CHANNEL_ATTACHMENT_KINDS = new Set([
+  'image',
+  'video',
+  'audio',
+  'text',
+  'file',
+])
+
+export function normalizeChannelAttachment(input) {
+  if (input === undefined || input === null) return null
+  if (typeof input !== 'object' || Array.isArray(input)) {
+    throw new ValidationError('attachment must be an object')
+  }
+
+  const kind = String(input.kind || '').trim()
+  if (!CHANNEL_ATTACHMENT_KINDS.has(kind)) {
+    throw new ValidationError('Invalid attachment kind')
+  }
+
+  const cid = String(input.cid || '').trim()
+  const cidValidation = validateCidString(cid)
+  if (!cidValidation.valid) {
+    throw new ValidationError(cidValidation.error)
+  }
+
+  const fileName = sanitizeFilename(String(input.fileName || ''))
+  if (!fileName || fileName === 'unnamed_file') {
+    throw new ValidationError('attachment fileName is required')
+  }
+
+  const parsed = parseMostLink(String(input.link || '').trim())
+  if (parsed.error) {
+    throw new ValidationError(parsed.error)
+  }
+  if (parsed.cid !== cid) {
+    throw new ValidationError('attachment link CID mismatch')
+  }
+
+  const linkFileName = sanitizeFilename(parsed.fileName)
+  if (linkFileName !== fileName) {
+    throw new ValidationError('attachment link filename mismatch')
+  }
+
+  const attachment = {
+    kind,
+    cid,
+    fileName,
+    link: `most://${cid}?filename=${encodeURIComponent(fileName)}`,
+  }
+
+  if (typeof input.mimeType === 'string' && input.mimeType.length <= 100) {
+    attachment.mimeType = input.mimeType
+  }
+
+  if (input.size !== undefined && input.size !== null) {
+    const size = Number(input.size)
+    if (!Number.isFinite(size) || size < 0) {
+      throw new ValidationError('attachment size must be a non-negative number')
+    }
+    attachment.size = Math.floor(size)
+  }
+
+  return attachment
+}

package/server/src/core/cid.js

@@ -7,6 +7,8 @@ import fs from 'node:fs'
 import { Readable } from 'node:stream'
 import { importer } from 'ipfs-unixfs-importer'
 
+export { validateCidString, parseMostLink } from './mostLink.js'
+
 /**
  * 用于 CID 计算的虚拟 Blockstore
  * 不存储任何数据，仅用于流式 CID 计算
@@ -26,19 +28,13 @@ function createDummyBlockstore() {
  * 使用流式方法高效处理大文件
  *
  * @param {string|Buffer|AsyncIterable} content - 文件路径（字符串）、Buffer 或异步迭代器
- * @param {object} options - 计算选项
- * @param {boolean} [options.rawLeaves=true] - 使用原始叶子节点以支持现代 CID
- * @param {number} [options.cidVersion=1] - CID 版本（0 或 1）
- * @param {number} [options.size] - 总字节数（可选，自动检测）
  * @returns {Promise<{cid: import('multiformats/cid').CID, size: number}>}
  */
-export async function calculateCid(content, options = {}) {
-  const { rawLeaves = true, cidVersion = 1, size: providedSize } = options
-
+export async function calculateCid(content) {
   const blockstore = createDummyBlockstore()
 
   let rootCid = null
-  let totalSize = providedSize || 0
+  let totalSize = 0
 
   let source
 
@@ -75,8 +71,8 @@ export async function calculateCid(content, options = {}) {
 
   try {
     for await (const entry of importer(source, blockstore, {
-      cidVersion,
-      rawLeaves,
+      cidVersion: 1,
+      rawLeaves: true,
       wrapWithDirectory: false,
     })) {
       rootCid = entry.cid
@@ -94,64 +90,3 @@ export async function calculateCid(content, options = {}) {
     size: totalSize,
   }
 }
-
-/**
- * 验证 CID 字符串
- * @param {string} cidString - 要验证的 CID 字符串
- * @returns {{ valid: boolean, error?: string }}
- */
-export function validateCidString(cidString) {
-  if (!cidString || typeof cidString !== 'string') {
-    return { valid: false, error: 'CID must be a non-empty string' }
-  }
-
-  if (!cidString.startsWith('b')) {
-    return {
-      valid: false,
-      error: 'Invalid CID format: CID v1 must start with "b"',
-    }
-  }
-
-  return { valid: true }
-}
-
-/**
- * 解析 most:// 链接并提取 CID
- * @param {string} link - most://<cid> 格式的链接
- * @returns {{ cid: string, error?: string }}
- */
-export function parseMostLink(link) {
-  if (!link || typeof link !== 'string') {
-    return { cid: '', error: 'Link must be a non-empty string' }
-  }
-
-  let cidString = link
-
-  if (link.startsWith('most://')) {
-    cidString = link.replace('most://', '')
-  }
-
-  // 移除尾部斜杠和空白
-  cidString = cidString.trim().replace(/\/+$/, '')
-
-  // 移除 query string，提取 filename
-  let fileName = null
-  if (cidString.includes('?')) {
-    const [cidPart, queryPart] = cidString.split('?')
-    cidString = cidPart
-    const params = new URLSearchParams(queryPart)
-    fileName = params.get('filename')
-  }
-
-  // 处理可能的额外路径的 URL 解析
-  if (cidString.includes('/')) {
-    cidString = cidString.split('/')[0]
-  }
-
-  const validation = validateCidString(cidString)
-  if (!validation.valid) {
-    return { cid: '', error: validation.error }
-  }
-
-  return { cid: cidString, fileName }
-}

package/server/src/core/cidTopic.js

@@ -0,0 +1,29 @@
+import b4a from 'b4a'
+import { CID } from 'multiformats/cid'
+import { validateCidString } from './cid.js'
+import { ValidationError } from '../utils/errors.js'
+
+export function getCidInfo(cid) {
+  try {
+    const validation = validateCidString(cid)
+    if (!validation.valid) {
+      throw new ValidationError(validation.error)
+    }
+    const parsedCid = CID.parse(cid)
+    const topic = b4a.from(parsedCid.multihash.digest)
+    if (topic.length !== 32) {
+      throw new ValidationError('CID digest must be 32 bytes')
+    }
+    const topicHex = b4a.toString(topic, 'hex')
+    return {
+      topic,
+      topicHex,
+      driveName: `drive-${topicHex}`,
+    }
+  } catch (err) {
+    if (err instanceof ValidationError) {
+      throw err
+    }
+    throw new ValidationError('Invalid CID format')
+  }
+}

package/server/src/core/mostLink.js

@@ -0,0 +1,88 @@
+import { CID } from 'multiformats/cid'
+
+/**
+ * 验证 CID 字符串
+ * @param {string} cidString - 要验证的 CID 字符串
+ * @returns {{ valid: boolean, error?: string }}
+ */
+export function validateCidString(cidString) {
+  if (!cidString || typeof cidString !== 'string') {
+    return { valid: false, error: 'CID must be a non-empty string' }
+  }
+
+  let parsed
+  try {
+    parsed = CID.parse(cidString)
+  } catch {
+    return {
+      valid: false,
+      error: 'Invalid CID format',
+    }
+  }
+
+  if (parsed.version !== 1) {
+    return {
+      valid: false,
+      error: 'Invalid CID format: CID v1 required',
+    }
+  }
+
+  if (parsed.multihash.digest.length !== 32) {
+    return {
+      valid: false,
+      error: 'CID digest must be 32 bytes',
+    }
+  }
+
+  return { valid: true }
+}
+
+/**
+ * 解析 most:// 链接并提取 CID 与用户可见文件名
+ * @param {string} link - most://<cid>?filename=... 格式的链接
+ * @returns {{ cid: string, fileName?: string, error?: string }}
+ */
+export function parseMostLink(link) {
+  if (!link || typeof link !== 'string') {
+    return { cid: '', error: 'Link must be a non-empty string' }
+  }
+
+  let url
+  try {
+    url = new URL(link)
+  } catch {
+    return { cid: '', error: 'Link must be a valid most:// URL' }
+  }
+
+  if (url.protocol !== 'most:') {
+    return { cid: '', error: 'Link must use most:// protocol' }
+  }
+
+  if (url.pathname && url.pathname !== '/') {
+    return { cid: '', error: 'Link path is not supported' }
+  }
+
+  const cidString = url.hostname
+  const fileName = url.searchParams.get('filename')
+  const unsupportedParam = [...url.searchParams.keys()].find(
+    key => key !== 'filename'
+  )
+
+  const validation = validateCidString(cidString)
+  if (!validation.valid) {
+    return { cid: '', error: validation.error }
+  }
+
+  if (!fileName) {
+    return { cid: '', error: 'filename is required' }
+  }
+
+  if (unsupportedParam) {
+    return {
+      cid: '',
+      error: `Unsupported query parameter: ${unsupportedParam}`,
+    }
+  }
+
+  return { cid: cidString, fileName }
+}

package/server/src/http/access.js

@@ -0,0 +1,123 @@
+const DEFAULT_ALLOWED_ORIGINS = [
+  'http://localhost:3000',
+  'http://127.0.0.1:3000',
+  'https://most.box',
+  'https://most-people.com',
+]
+
+export function getAllowedOrigins(appPort) {
+  return [
+    ...new Set([
+      ...DEFAULT_ALLOWED_ORIGINS,
+      `http://localhost:${appPort}`,
+      `http://127.0.0.1:${appPort}`,
+    ]),
+  ]
+}
+
+export function getRequestPath(c) {
+  return new URL(c.req.url).pathname
+}
+
+function extractHostname(value) {
+  const input = String(value || '').trim()
+  if (!input) return ''
+
+  try {
+    return new URL(input.includes('://') ? input : `http://${input}`).hostname
+  } catch {
+    return ''
+  }
+}
+
+function isLocalHostname(hostname) {
+  const value = String(hostname || '')
+    .trim()
+    .toLowerCase()
+  return ['localhost', '127.0.0.1', '::1', '[::1]'].includes(value)
+}
+
+export function isPublicListenHost(listenHost) {
+  const hostname = extractHostname(listenHost)
+  if (!hostname) return false
+  const value = hostname.toLowerCase()
+  return value === '0.0.0.0' || value === '::' || !isLocalHostname(value)
+}
+
+function isExternalOrigin(origin) {
+  if (!origin) return false
+  const hostname = extractHostname(origin)
+  if (!hostname) {
+    return true
+  }
+  return !isLocalHostname(hostname)
+}
+
+function isLocalRequestHost(hostHeader) {
+  const hostname = extractHostname(hostHeader)
+  if (!hostname) {
+    return false
+  }
+  return isLocalHostname(hostname)
+}
+
+export function isLoopbackRemoteAddress(address) {
+  const value = String(address || '')
+    .trim()
+    .toLowerCase()
+  return (
+    value === 'localhost' ||
+    value === '::1' ||
+    value === '::ffff:localhost' ||
+    value === '127.0.0.1' ||
+    value === '::ffff:127.0.0.1' ||
+    value.startsWith('127.') ||
+    value.startsWith('::ffff:127.')
+  )
+}
+
+export function isLocalRequest(c) {
+  const host = c.req.header('host')
+  if (host) {
+    return isLocalRequestHost(host)
+  }
+  const clientIp =
+    c.req.header('x-forwarded-for') ||
+    c.env?.incoming?.socket?.remoteAddress ||
+    ''
+  return isLoopbackRemoteAddress(clientIp)
+}
+
+export function isLocalUpgradeRequest(req) {
+  if (req.headers.host) {
+    return isLocalRequestHost(req.headers.host)
+  }
+  return isLoopbackRemoteAddress(req.socket?.remoteAddress)
+}
+
+export function isRemoteAccessRequest({ invite, origin, listenHost, local }) {
+  return (
+    Boolean(invite) ||
+    isExternalOrigin(origin) ||
+    (isPublicListenHost(listenHost) && !local)
+  )
+}
+
+export function remoteInviteConfigured(inviteSet) {
+  return inviteSet.size > 0
+}
+
+export function hasValidInvite(inviteSet, invite) {
+  const code = String(invite || '').trim()
+  return remoteInviteConfigured(inviteSet) && code && inviteSet.has(code)
+}
+
+export function getInvalidInviteResponse(c) {
+  return c.json(
+    {
+      error: 'Remote node invite required',
+      code: 'INVALID_INVITE',
+    },
+    403
+  )
+}