most-box 0.1.1 → 0.1.3

package/server/src/config.js

@@ -3,7 +3,7 @@
  */
 
 // 文件大小限制
-export const MAX_FILE_SIZE = 100 * 1024 * 1024 * 1024 // 100 GB
+export const MAX_FILE_SIZE = 10 * 1024 * 1024 * 1024 // 10 GB
 
 // 网络超时（毫秒）
 export const CONNECTION_TIMEOUT = 120000

package/server/src/core/channelAttachment.js

@@ -0,0 +1,68 @@
+import { parseMostLink, validateCidString } from './cid.js'
+import { sanitizeFilename } from '../utils/security.js'
+import { ValidationError } from '../utils/errors.js'
+
+const CHANNEL_ATTACHMENT_KINDS = new Set([
+  'image',
+  'video',
+  'audio',
+  'text',
+  'file',
+])
+
+export function normalizeChannelAttachment(input) {
+  if (input === undefined || input === null) return null
+  if (typeof input !== 'object' || Array.isArray(input)) {
+    throw new ValidationError('attachment must be an object')
+  }
+
+  const kind = String(input.kind || '').trim()
+  if (!CHANNEL_ATTACHMENT_KINDS.has(kind)) {
+    throw new ValidationError('Invalid attachment kind')
+  }
+
+  const cid = String(input.cid || '').trim()
+  const cidValidation = validateCidString(cid)
+  if (!cidValidation.valid) {
+    throw new ValidationError(cidValidation.error)
+  }
+
+  const fileName = sanitizeFilename(String(input.fileName || ''))
+  if (!fileName || fileName === 'unnamed_file') {
+    throw new ValidationError('attachment fileName is required')
+  }
+
+  const parsed = parseMostLink(String(input.link || '').trim())
+  if (parsed.error) {
+    throw new ValidationError(parsed.error)
+  }
+  if (parsed.cid !== cid) {
+    throw new ValidationError('attachment link CID mismatch')
+  }
+
+  const linkFileName = sanitizeFilename(parsed.fileName)
+  if (linkFileName !== fileName) {
+    throw new ValidationError('attachment link filename mismatch')
+  }
+
+  const attachment = {
+    kind,
+    cid,
+    fileName,
+    link: `most://${cid}?filename=${encodeURIComponent(fileName)}`,
+  }
+
+  if (typeof input.mimeType === 'string' && input.mimeType.length <= 100) {
+    attachment.mimeType = input.mimeType
+  }
+
+  if (input.size !== undefined && input.size !== null) {
+    const size = Number(input.size)
+    if (!Number.isFinite(size) || size < 0) {
+      throw new ValidationError('attachment size must be a non-negative number')
+    }
+    attachment.size = Math.floor(size)
+  }
+
+  return attachment
+}

package/server/src/core/cid.js

@@ -6,7 +6,8 @@
 import fs from 'node:fs'
 import { Readable } from 'node:stream'
 import { importer } from 'ipfs-unixfs-importer'
-import { CID } from 'multiformats/cid'
+
+export { validateCidString, parseMostLink } from './mostLink.js'
 
 /**
  * 用于 CID 计算的虚拟 Blockstore
@@ -89,90 +90,3 @@ export async function calculateCid(content) {
     size: totalSize,
   }
 }
-
-/**
- * 验证 CID 字符串
- * @param {string} cidString - 要验证的 CID 字符串
- * @returns {{ valid: boolean, error?: string }}
- */
-export function validateCidString(cidString) {
-  if (!cidString || typeof cidString !== 'string') {
-    return { valid: false, error: 'CID must be a non-empty string' }
-  }
-
-  let parsed
-  try {
-    parsed = CID.parse(cidString)
-  } catch {
-    return {
-      valid: false,
-      error: 'Invalid CID format',
-    }
-  }
-
-  if (parsed.version !== 1) {
-    return {
-      valid: false,
-      error: 'Invalid CID format: CID v1 required',
-    }
-  }
-
-  if (parsed.multihash.digest.length !== 32) {
-    return {
-      valid: false,
-      error: 'CID digest must be 32 bytes',
-    }
-  }
-
-  return { valid: true }
-}
-
-/**
- * 解析 most:// 链接并提取 CID 与用户可见文件名
- * @param {string} link - most://<cid>?filename=... 格式的链接
- * @returns {{ cid: string, fileName?: string, error?: string }}
- */
-export function parseMostLink(link) {
-  if (!link || typeof link !== 'string') {
-    return { cid: '', error: 'Link must be a non-empty string' }
-  }
-
-  let url
-  try {
-    url = new URL(link)
-  } catch {
-    return { cid: '', error: 'Link must be a valid most:// URL' }
-  }
-
-  if (url.protocol !== 'most:') {
-    return { cid: '', error: 'Link must use most:// protocol' }
-  }
-
-  if (url.pathname && url.pathname !== '/') {
-    return { cid: '', error: 'Link path is not supported' }
-  }
-
-  const cidString = url.hostname
-  const fileName = url.searchParams.get('filename')
-  const unsupportedParam = [...url.searchParams.keys()].find(
-    key => key !== 'filename'
-  )
-
-  const validation = validateCidString(cidString)
-  if (!validation.valid) {
-    return { cid: '', error: validation.error }
-  }
-
-  if (!fileName) {
-    return { cid: '', error: 'filename is required' }
-  }
-
-  if (unsupportedParam) {
-    return {
-      cid: '',
-      error: `Unsupported query parameter: ${unsupportedParam}`,
-    }
-  }
-
-  return { cid: cidString, fileName }
-}

package/server/src/core/cidTopic.js

@@ -0,0 +1,29 @@
+import b4a from 'b4a'
+import { CID } from 'multiformats/cid'
+import { validateCidString } from './cid.js'
+import { ValidationError } from '../utils/errors.js'
+
+export function getCidInfo(cid) {
+  try {
+    const validation = validateCidString(cid)
+    if (!validation.valid) {
+      throw new ValidationError(validation.error)
+    }
+    const parsedCid = CID.parse(cid)
+    const topic = b4a.from(parsedCid.multihash.digest)
+    if (topic.length !== 32) {
+      throw new ValidationError('CID digest must be 32 bytes')
+    }
+    const topicHex = b4a.toString(topic, 'hex')
+    return {
+      topic,
+      topicHex,
+      driveName: `drive-${topicHex}`,
+    }
+  } catch (err) {
+    if (err instanceof ValidationError) {
+      throw err
+    }
+    throw new ValidationError('Invalid CID format')
+  }
+}

package/server/src/core/mostLink.js

@@ -0,0 +1,88 @@
+import { CID } from 'multiformats/cid'
+
+/**
+ * 验证 CID 字符串
+ * @param {string} cidString - 要验证的 CID 字符串
+ * @returns {{ valid: boolean, error?: string }}
+ */
+export function validateCidString(cidString) {
+  if (!cidString || typeof cidString !== 'string') {
+    return { valid: false, error: 'CID must be a non-empty string' }
+  }
+
+  let parsed
+  try {
+    parsed = CID.parse(cidString)
+  } catch {
+    return {
+      valid: false,
+      error: 'Invalid CID format',
+    }
+  }
+
+  if (parsed.version !== 1) {
+    return {
+      valid: false,
+      error: 'Invalid CID format: CID v1 required',
+    }
+  }
+
+  if (parsed.multihash.digest.length !== 32) {
+    return {
+      valid: false,
+      error: 'CID digest must be 32 bytes',
+    }
+  }
+
+  return { valid: true }
+}
+
+/**
+ * 解析 most:// 链接并提取 CID 与用户可见文件名
+ * @param {string} link - most://<cid>?filename=... 格式的链接
+ * @returns {{ cid: string, fileName?: string, error?: string }}
+ */
+export function parseMostLink(link) {
+  if (!link || typeof link !== 'string') {
+    return { cid: '', error: 'Link must be a non-empty string' }
+  }
+
+  let url
+  try {
+    url = new URL(link)
+  } catch {
+    return { cid: '', error: 'Link must be a valid most:// URL' }
+  }
+
+  if (url.protocol !== 'most:') {
+    return { cid: '', error: 'Link must use most:// protocol' }
+  }
+
+  if (url.pathname && url.pathname !== '/') {
+    return { cid: '', error: 'Link path is not supported' }
+  }
+
+  const cidString = url.hostname
+  const fileName = url.searchParams.get('filename')
+  const unsupportedParam = [...url.searchParams.keys()].find(
+    key => key !== 'filename'
+  )
+
+  const validation = validateCidString(cidString)
+  if (!validation.valid) {
+    return { cid: '', error: validation.error }
+  }
+
+  if (!fileName) {
+    return { cid: '', error: 'filename is required' }
+  }
+
+  if (unsupportedParam) {
+    return {
+      cid: '',
+      error: `Unsupported query parameter: ${unsupportedParam}`,
+    }
+  }
+
+  return { cid: cidString, fileName }
+}