nuxt-file-storage 0.3.0 → 0.3.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2024-Present Nuxt File Storage Project
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+MIT License
+
+Copyright (c) 2024-Present Nuxt File Storage Project
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

package/README.md

@@ -1,193 +1,197 @@
-![Nuxt File Storage Banner](./playground/public/nuxt-file-storage-banner.svg)
-
-# Nuxt File Storage
-
-[![Visits Badge](https://badges.pufler.dev/visits/nyllre/nuxt-file-storage)](https://badges.pufler.dev)
-[![npm version][npm-version-src]][npm-version-href]
-[![npm downloads][npm-downloads-src]][npm-downloads-href]
-[![License][license-src]][license-href]
-[![Nuxt][nuxt-src]][nuxt-href]
-
-Easy solution to store files in your nuxt apps. Be able to upload files from the frontend and receive them from the backend to then save the files in your project.
-
--  [✨  Release Notes](/CHANGELOG.md)
--  [🏀 Online playground](https://stackblitz.com/github/NyllRE/nuxt-file-storage?file=playground%2Fapp.vue)
-<!-- - [📖 &nbsp;Documentation](https://example.com) -->
-
-## Features
-
-<!-- Highlight some of the features your module provide here -->
-
--  📁 &nbsp;Get files from file input and make them ready to send to backend
--  ⚗️ &nbsp;Serialize files in the backend to be able to use them appropriately
--  🖴 &nbsp;Store files in a specified location in your Nuxt backend with Nitro Engine
-
-## Quick Setup
-
-1. Add `nuxt-file-storage` dependency to your project
-
-```bash
-# Using pnpm
-pnpm add -D nuxt-file-storage
-
-# Using yarn
-yarn add --dev nuxt-file-storage
-
-# Using npm
-npm install --save-dev nuxt-file-storage
-```
-
-2. Add `nuxt-file-storage` to the `modules` section of `nuxt.config.ts`
-
-```js
-export default defineNuxtConfig({
-	modules: ['nuxt-file-storage'],
-})
-```
-
-That's it! You can now use Nuxt Storage in your Nuxt app ✨
-
-## Configuration
-
-You can currently configure a single setting of the `nuxt-file-storage` module. Here is the config interface:
-
-```js
-export default defineNuxtConfig({
-	modules: ['nuxt-file-storage'],
-	fileStorage: {
-		// enter the absolute path to the location of your storage
-		mount: '/home/$USR/development/nuxt-file-storage/server/files',
-
-		// {OR} use environment variables (recommended)
-		mount: process.env.mount
-		// you need to set the mount in your .env file at the root of your project
-	},
-})
-```
-
-## Usage
-
-### Handling Files in the frontend
-You can use Nuxt Storage to get the files from the `<input>` tag:
-
-```html
-<template>
-	<input type="file" @input="handleFileInput" />
-</template>
-
-<script setup>
-	// handleFileInput can handle multiple files
-	// clearOldFiles: true by default, each time the user adds files the `files` ref will be cleared
-	const { handleFileInput, files } = useFileStorage({ clearOldFiles: false })
-</script>
-```
-The `files` return a ref object that contains the files
-
-> `handleFileInput` returns a promise in case you need to check if the file input has concluded
-
-<br>
-
-Here's an example of using files to send them to the backend
-```html
-<template>
-	<input type="file" @input="handleFileInput" />
-	<button @click="submit">submit</button>
-</template>
-
-<script setup>
-const { handleFileInput, files } = useFileStorage()
-
-const submit = async () => {
-	const response = await $fetch('/api/files', {
-		method: 'POST',
-		body: {
-			files: files.value
-		}
-	})
-}
-</script>
-```
-<br>
-
-#### Handling multiple file input fields
-You have to create a new instance of `useFileStorage` for each input field
-
-
-```html
-<template>
-	<input type="file" @input="handleFileInput" multiple />   ← | 1 |
-	<input type="file" @input="profileInputHandler" />                 ← | 2 |
-</template>
-
-<script setup>
-	const { handleFileInput, files } = useFileStorage()       ← | 1 |
-
-	const {
-		handleFileInput: profileInputHandler,
-		files: profileImage
-	} = useFileStorage()                                               ← | 2 |
-</script>
-```
-by calling a new `useFileStorage` instance you separate the internal logic between the inputs
-
-### Handling files in the backend
-using Nitro Server Engine, we will make an api route that receives the files and stores them in the folder `userFiles`
-```ts
-import { ServerFile } from "nuxt-file-storage";
-
-export default defineEventHandler(async (event) => {
-	const { files } = await readBody<{ files: ServerFile[] }>(event)
-
-	for ( const file of files ) {
-		await storeFileLocally(
-			file, 		  // the file object
-			8,            // you can add a name for the file or length of Unique ID that will be automatically generated!
-			'/userFiles'  // the folder the file will be stored in
-		)
-
-		// {OR}
-
-		// Parses a data URL and returns an object with the binary data and the file extension.
-		const { binaryString, ext } = parseDataUrl(file.content)
-	}
-
-	// Deleting Files
-	await deleteFile('requiredFile.txt', '/userFiles')
-
-	// Get file path
-	await getFileLocally('requiredFile.txt', '/userFiles')
-	// returns: {AbsolutePath}/userFiles/requiredFile.txt
-
-	// Get all files in a folder
-	await getFilesLocally('/userFiles')
-})
-```
-
-And that's it! Now you can store any file in your nuxt project from the user ✨
-
-## Contribution
-Run into a problem? Open a [new issue](https://github.com/NyllRE/nuxt-file-storage/issues/new). I'll try my best to include all the features requested if it is fitting to the scope of the project.
-
-Want to add some feature? PRs are welcome!
-- Clone this repository
-- install the dependencies
-- prepare the project
-- run dev server
-```bash
-git clone https://github.com/NyllRE/nuxt-file-storage && cd nuxt-file-storage
-npm i
-npm run dev:prepare
-npm run dev
-```
-
-
-<!-- Badges -->
-
-[npm-version-src]: https://img.shields.io/npm/v/nuxt-file-storage/latest.svg?style=flat&colorA=18181B&colorB=28CF8D
-[npm-version-href]: https://npmjs.com/package/nuxt-file-storage
-[npm-downloads-src]: https://img.shields.io/npm/dm/nuxt-file-storage.svg?style=flat&colorA=18181B&colorB=28CF8D
-[npm-downloads-href]: https://npmjs.com/package/nuxt-file-storage
-[license-src]: https://img.shields.io/npm/l/nuxt-file-storage.svg?style=flat&colorA=18181B&colorB=28CF8D
-[license-href]: https://npmjs.com/package/nuxt-file-storage
-[nuxt-src]: https://img.shields.io/badge/Nuxt-18181B?logo=nuxt.js
-[nuxt-href]: https://nuxt.com/modules/nuxt-file-storage
+![Nuxt File Storage Banner](./playground/public/nuxt-file-storage-banner.svg)
+
+# Nuxt File Storage
+
+[![Visits Badge](https://badges.pufler.dev/visits/nyllre/nuxt-file-storage)](https://badges.pufler.dev)
+[![npm version][npm-version-src]][npm-version-href]
+[![npm downloads][npm-downloads-src]][npm-downloads-href]
+[![License][license-src]][license-href]
+[![Nuxt][nuxt-src]][nuxt-href]
+
+Easy solution to store files in your nuxt apps. Be able to upload files from the frontend and receive them from the backend to then save the files in your project.
+
+-  [✨ &nbsp;Release Notes](/CHANGELOG.md)
+-  [🏀 Online playground](https://stackblitz.com/github/NyllRE/nuxt-file-storage?file=playground%2Fapp.vue)
+<!-- - [📖 &nbsp;Documentation](https://example.com) -->
+
+## Features
+
+<!-- Highlight some of the features your module provide here -->
+
+-  📁 &nbsp;Get files from file input and make them ready to send to backend
+-  ⚗️ &nbsp;Serialize files in the backend to be able to use them appropriately
+-  🖴 &nbsp;Store files in a specified location in your Nuxt backend with Nitro Engine
+
+## Quick Setup
+
+1. Add `nuxt-file-storage` dependency to your project
+
+```bash
+# Using pnpm
+pnpm add -D nuxt-file-storage
+
+# Using yarn
+yarn add --dev nuxt-file-storage
+
+# Using npm
+npm install --save-dev nuxt-file-storage
+```
+
+2. Add `nuxt-file-storage` to the `modules` section of `nuxt.config.ts`
+
+```js
+export default defineNuxtConfig({
+	modules: ['nuxt-file-storage'],
+})
+```
+
+That's it! You can now use Nuxt Storage in your Nuxt app ✨
+
+## Configuration
+
+You can currently configure a single setting of the `nuxt-file-storage` module. Here is the config interface:
+
+```js
+export default defineNuxtConfig({
+	modules: ['nuxt-file-storage'],
+	fileStorage: {
+		// enter the absolute path to the location of your storage
+		mount: '/home/$USR/development/nuxt-file-storage/server/files',
+
+		// {OR} use environment variables (recommended)
+		mount: process.env.mount
+		// you need to set the mount in your .env file at the root of your project
+	},
+})
+```
+
+## Usage
+
+### Handling Files in the frontend
+You can use Nuxt Storage to get the files from the `<input>` tag:
+
+```html
+<template>
+	<input type="file" @input="handleFileInput" />
+</template>
+
+<script setup>
+	// handleFileInput can handle multiple files
+	// clearOldFiles: true by default, each time the user adds files the `files` ref will be cleared
+	const { handleFileInput, files } = useFileStorage({ clearOldFiles: false })
+</script>
+```
+The `files` return a ref object that contains the files
+
+> `handleFileInput` returns a promise in case you need to check if the file input has concluded
+
+<br>
+
+Here's an example of using files to send them to the backend
+```html
+<template>
+	<input type="file" @input="handleFileInput" />
+	<button @click="submit">submit</button>
+</template>
+
+<script setup>
+const { handleFileInput, files } = useFileStorage()
+
+const submit = async () => {
+	const response = await $fetch('/api/files', {
+		method: 'POST',
+		body: {
+			files: files.value
+		}
+	})
+}
+</script>
+```
+<br>
+
+#### Handling multiple file input fields
+You have to create a new instance of `useFileStorage` for each input field
+
+
+```html
+<template>
+	<input type="file" @input="handleFileInput" multiple />   ← | 1 |
+	<input type="file" @input="profileInputHandler" />                 ← | 2 |
+</template>
+
+<script setup>
+	const { handleFileInput, files } = useFileStorage()       ← | 1 |
+
+	const {
+		handleFileInput: profileInputHandler,
+		files: profileImage
+	} = useFileStorage()                                               ← | 2 |
+</script>
+```
+by calling a new `useFileStorage` instance you separate the internal logic between the inputs
+
+### Handling files in the backend
+using Nitro Server Engine, we will make an api route that receives the files and stores them in the folder `userFiles`
+```ts
+import { ServerFile } from "nuxt-file-storage";
+
+export default defineEventHandler(async (event) => {
+	const { files } = await readBody<{ files: ServerFile[] }>(event)
+
+	for ( const file of files ) {
+		await storeFileLocally(
+			file, 		  // the file object
+			8,            // you can add a name for the file or length of Unique ID that will be automatically generated!
+			'/userFiles'  // the folder the file will be stored in
+		)
+
+		// {OR}
+
+		// Parses a data URL and returns an object with the binary data and the file extension.
+		const { binaryString, ext } = parseDataUrl(file.content)
+	}
+
+	// Deleting Files
+	await deleteFile('requiredFile.txt', '/userFiles')
+
+	// Get file path
+	return await getFileLocally('requiredFile.txt', '/userFiles')
+	// returns: {AbsolutePath}/userFiles/requiredFile.txt
+
+	// Return a NodeStream of the file
+	// uses getFileLocally internally
+	return await retrieveFileLocally(event, 'requiredFile.txt', '/userFiles')
+
+	// Get all files in a folder
+	return await getFilesLocally('/userFiles')
+})
+```
+
+And that's it! Now you can store any file in your nuxt project from the user ✨
+
+## Contribution
+Run into a problem? Open a [new issue](https://github.com/NyllRE/nuxt-file-storage/issues/new). I'll try my best to include all the features requested if it is fitting to the scope of the project.
+
+Want to add some feature? PRs are welcome!
+- Clone this repository
+- install the dependencies
+- prepare the project
+- run dev server
+```bash
+git clone https://github.com/NyllRE/nuxt-file-storage && cd nuxt-file-storage
+npm i
+npm run dev:prepare
+npm run dev
+```
+
+
+<!-- Badges -->
+
+[npm-version-src]: https://img.shields.io/npm/v/nuxt-file-storage/latest.svg?style=flat&colorA=18181B&colorB=28CF8D
+[npm-version-href]: https://npmjs.com/package/nuxt-file-storage
+[npm-downloads-src]: https://img.shields.io/npm/dm/nuxt-file-storage.svg?style=flat&colorA=18181B&colorB=28CF8D
+[npm-downloads-href]: https://npmjs.com/package/nuxt-file-storage
+[license-src]: https://img.shields.io/npm/l/nuxt-file-storage.svg?style=flat&colorA=18181B&colorB=28CF8D
+[license-href]: https://npmjs.com/package/nuxt-file-storage
+[nuxt-src]: https://img.shields.io/badge/Nuxt-18181B?logo=nuxt.js
+[nuxt-href]: https://nuxt.com/modules/nuxt-file-storage

package/dist/module.d.mts

@@ -1,22 +1,30 @@
 import * as _nuxt_schema from '@nuxt/schema';
 
-interface ServerFile {
-	name: string
-	content: string
-	size: string
-	type: string
-	lastModified: string
-}
-
-interface ClientFile extends Blob {
-	content: string | ArrayBuffer | null | undefined
-	name: string
-	lastModified: number
-}
-
-interface ModuleOptions {
-	mount: string
-	version: string
+interface ServerFile {
+	name: string
+	content: string
+	size: string
+	type: string
+	lastModified: string
+}
+
+interface ClientFile extends Blob {
+	content: string | ArrayBuffer | null | undefined
+	name: string
+	lastModified: number
+}
+
+interface ModuleOptions {
+	mount: string
+	version: string
+}
+
+/**
+ * @description Augment the '#imports' module to include useRuntimeConfig
+ * this is only needed because this package is consumed as a module
+ */
+declare module '#imports' {
+  export function useRuntimeConfig(): any
 }
 
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;

package/dist/module.d.ts

@@ -1,22 +1,30 @@
 import * as _nuxt_schema from '@nuxt/schema';
 
-interface ServerFile {
-	name: string
-	content: string
-	size: string
-	type: string
-	lastModified: string
-}
-
-interface ClientFile extends Blob {
-	content: string | ArrayBuffer | null | undefined
-	name: string
-	lastModified: number
-}
-
-interface ModuleOptions {
-	mount: string
-	version: string
+interface ServerFile {
+	name: string
+	content: string
+	size: string
+	type: string
+	lastModified: string
+}
+
+interface ClientFile extends Blob {
+	content: string | ArrayBuffer | null | undefined
+	name: string
+	lastModified: number
+}
+
+interface ModuleOptions {
+	mount: string
+	version: string
+}
+
+/**
+ * @description Augment the '#imports' module to include useRuntimeConfig
+ * this is only needed because this package is consumed as a module
+ */
+declare module '#imports' {
+  export function useRuntimeConfig(): any
 }
 
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-file-storage",
   "configKey": "fileStorage",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -1,6 +1,15 @@
 import { defineNuxtModule, logger, createResolver, addImportsDir, addServerScanDir } from '@nuxt/kit';
-import defu from 'defu';
+import { defu } from 'defu';
 
+
+
+// -- Unbuild CommonJS Shims --
+import __cjs_url__ from 'url';
+import __cjs_path__ from 'path';
+import __cjs_mod__ from 'module';
+const __filename = __cjs_url__.fileURLToPath(import.meta.url);
+const __dirname = __cjs_path__.dirname(__filename);
+const require = __cjs_mod__.createRequire(import.meta.url);
 const module = defineNuxtModule({
   meta: {
     name: "nuxt-file-storage",
@@ -16,16 +25,8 @@ const module = defineNuxtModule({
     config.public.fileStorage = defu(config.public.fileStorage, {
       ...options
     });
-    if (!config.public.fileStorage.mount) {
-      logger.error(
-        "Please provide a mount path for the file storage module in your nuxt.config.js"
-      );
-    } else {
-      logger.ready(
-        `Nuxt File Storage has mounted successfully`
-      );
-    }
-    const resolve = createResolver(import.meta.url).resolve;
+    logger.ready(`Nuxt File Storage has mounted successfully`);
+    const resolve = createResolver(__dirname).resolve;
     addImportsDir(resolve("runtime/composables"));
     addServerScanDir(resolve("./runtime/server"));
   }

package/dist/runtime/composables/useFileStorage.d.ts

@@ -6,30 +6,32 @@ export default function (options?: Options): {
     files: import("vue").Ref<{
         content: string | {
             readonly byteLength: number;
-            slice: (begin: number, end?: number | undefined) => ArrayBuffer;
-            readonly [Symbol.toStringTag]: string;
+            slice: (begin?: number, end?: number) => ArrayBuffer;
+            readonly [Symbol.toStringTag]: "ArrayBuffer";
         } | null | undefined;
         name: string;
         lastModified: number;
         readonly size: number;
         readonly type: string;
         arrayBuffer: () => Promise<ArrayBuffer>;
-        slice: (start?: number | undefined, end?: number | undefined, contentType?: string | undefined) => Blob;
-        stream: () => ReadableStream<Uint8Array>;
+        bytes: () => Promise<Uint8Array<ArrayBuffer>>;
+        slice: (start?: number, end?: number, contentType?: string) => Blob;
+        stream: () => ReadableStream<Uint8Array<ArrayBuffer>>;
         text: () => Promise<string>;
     }[], ClientFile[] | {
         content: string | {
             readonly byteLength: number;
-            slice: (begin: number, end?: number | undefined) => ArrayBuffer;
-            readonly [Symbol.toStringTag]: string;
+            slice: (begin?: number, end?: number) => ArrayBuffer;
+            readonly [Symbol.toStringTag]: "ArrayBuffer";
         } | null | undefined;
         name: string;
         lastModified: number;
         readonly size: number;
         readonly type: string;
         arrayBuffer: () => Promise<ArrayBuffer>;
-        slice: (start?: number | undefined, end?: number | undefined, contentType?: string | undefined) => Blob;
-        stream: () => ReadableStream<Uint8Array>;
+        bytes: () => Promise<Uint8Array<ArrayBuffer>>;
+        slice: (start?: number, end?: number, contentType?: string) => Blob;
+        stream: () => ReadableStream<Uint8Array<ArrayBuffer>>;
         text: () => Promise<string>;
     }[]>;
     handleFileInput: (event: any) => Promise<void>;

package/dist/runtime/server/utils/path-safety.d.ts

@@ -0,0 +1,9 @@
+export declare const normalizeRelative: (p: string) => string;
+export declare const isSafeBasename: (name: string) => boolean;
+export declare const ensureSafeBasename: (name: string) => string;
+export declare const containsPathTraversal: (p: string) => boolean;
+/**
+ * Resolve a target path relative to a mount and ensure it cannot escape the mount.
+ * Throws on any suspicious input (path traversal, symlink escape, absolute outside mount).
+ */
+export declare const resolveAndEnsureInside: (mount: string, ...parts: string[]) => Promise<string>;

package/dist/runtime/server/utils/path-safety.js

@@ -0,0 +1,69 @@
+import path from "path";
+import { realpath, stat } from "fs/promises";
+import { createError } from "#imports";
+export const normalizeRelative = (p) => {
+  if (!p)
+    return "";
+  return p.replace(/^[/\\]+/, "").replace(/\\/g, "/");
+};
+export const isSafeBasename = (name) => {
+  if (!name)
+    return false;
+  if (name !== path.basename(name))
+    return false;
+  if (name.includes("\0"))
+    return false;
+  if (name === "." || name === "..")
+    return false;
+  if (name.includes("/") || name.includes("\\"))
+    return false;
+  if (name.split(/[/\\]+/).includes(".."))
+    return false;
+  return true;
+};
+export const ensureSafeBasename = (name) => {
+  if (!isSafeBasename(name))
+    throw new Error("Unsafe filename");
+  return name;
+};
+export const containsPathTraversal = (p) => {
+  if (!p)
+    return false;
+  if (/^([\\/]|^)?\.\.([\\/]|$)?/.test(p) || /(^|[\\/])\.\.($|[\\/])/.test(p))
+    return true;
+  const normalized = path.normalize(p);
+  const parts = normalized.split(/[/\\]+/);
+  return parts.includes("..");
+};
+export const resolveAndEnsureInside = async (mount, ...parts) => {
+  if (!mount)
+    throw new Error("Mount path must be provided");
+  const mountResolved = path.resolve(mount);
+  const cleanedParts = parts.map((p) => p.replace(/^[/\\]+/, ""));
+  const targetResolved = path.resolve(mountResolved, ...cleanedParts);
+  const relative = path.relative(mountResolved, targetResolved);
+  if (relative === "" || !relative.startsWith(".." + path.sep) && relative !== "..") {
+    let cur = targetResolved;
+    while (cur) {
+      try {
+        await stat(cur);
+        break;
+      } catch (error) {
+        const parent = path.dirname(cur);
+        if (parent === cur)
+          break;
+        cur = parent;
+      }
+    }
+    const mountReal = await realpath(mountResolved);
+    const curReal = await realpath(cur);
+    if (!curReal.startsWith(mountReal)) {
+      throw new Error("Resolved path escapes configured mount (symlink detected)");
+    }
+    return targetResolved;
+  }
+  throw createError({
+    statusCode: 400,
+    statusMessage: "Resolved path is outside of configured mount"
+  });
+};

package/dist/runtime/server/utils/storage.d.ts

@@ -1,6 +1,5 @@
-/// <reference types="node" />
-/// <reference types="node" />
 import type { ServerFile } from '../../../types.js';
+import type { H3Event, EventHandlerRequest } from 'h3';
 /**
  * @description Will store the file in the specified directory
  * @param file provide the file object
@@ -14,11 +13,12 @@ import type { ServerFile } from '../../../types.js';
  *
  * @example
  * ```ts
- * import { ServerFile } from "nuxt-file-storage";
+ * import type { ServerFile } from "nuxt-file-storage";
  *
- * const { file } = await readBody<{ files: ServerFile }>(event)
-
- * await storeFileLocally( file, 8, '/userFiles' )
+ * export default defineEventHandler(async (event) => {
+ * 	const { file } = await readBody<{ file: ServerFile }>(event);
+ * 	await storeFileLocally( file, 8, '/userFiles' );
+ * })
  * ```
  */
 export declare const storeFileLocally: (file: ServerFile, fileNameOrIdLength: string | number, filelocation?: string) => Promise<string>;
@@ -58,3 +58,11 @@ export declare const parseDataUrl: (file: string) => {
     binaryString: Buffer;
     ext: string;
 };
+/**
+ * Retrieve a file as a readable stream from local storage
+ * @param event H3 event to set response headers
+ * @param filename name of the file to retrieve
+ * @param filelocation folder where the file is located
+ * @returns Readable stream of the file
+ */
+export declare const retrieveFileLocally: (event: H3Event<EventHandlerRequest>, filename: string, filelocation?: string) => Promise<NodeJS.ReadableStream>;

package/dist/runtime/server/utils/storage.js

@@ -1,31 +1,75 @@
 import { writeFile, rm, mkdir, readdir } from "fs/promises";
-import { useRuntimeConfig } from "#imports";
-import { join } from "path";
+import path from "path";
+import {
+  normalizeRelative,
+  ensureSafeBasename,
+  resolveAndEnsureInside
+} from "./path-safety.js";
+import { createError, useRuntimeConfig } from "#imports";
+import { createReadStream, promises as fsPromises } from "fs";
+const getMount = () => {
+  try {
+    return useRuntimeConfig().public.fileStorage.mount;
+  } catch (err) {
+    return process.env.FILE_STORAGE_MOUNT || process.env.NUXT_FILE_STORAGE_MOUNT;
+  }
+};
 export const storeFileLocally = async (file, fileNameOrIdLength, filelocation = "") => {
   const { binaryString, ext } = parseDataUrl(file.content);
-  const location = useRuntimeConfig().public.fileStorage.mount;
+  const location = getMount();
+  if (!location)
+    throw new Error("fileStorage.mount is not configured");
   const originalExt = file.name.toString().split(".").pop() || ext;
-  const filename = typeof fileNameOrIdLength == "number" ? `${generateRandomId(fileNameOrIdLength)}.${originalExt}` : `${fileNameOrIdLength}.${originalExt}`;
-  await mkdir(join(location, filelocation), { recursive: true });
-  await writeFile(join(location, filelocation, filename), binaryString, {
+  const safeExt = originalExt.replace(/[^a-zA-Z0-9]/g, "") || ext;
+  let filename;
+  if (typeof fileNameOrIdLength === "number") {
+    filename = `${generateRandomId(fileNameOrIdLength)}.${safeExt}`;
+  } else {
+    ensureSafeBasename(fileNameOrIdLength);
+    filename = `${fileNameOrIdLength}.${safeExt}`;
+  }
+  const normalizedFilelocation = normalizeRelative(filelocation);
+  const dirPath = await resolveAndEnsureInside(location, normalizedFilelocation);
+  await mkdir(dirPath, { recursive: true });
+  const targetPath = await resolveAndEnsureInside(location, normalizedFilelocation, filename);
+  await writeFile(targetPath, binaryString, {
     flag: "w"
   });
   return filename;
 };
 export const getFileLocally = (filename, filelocation = "") => {
-  const location = useRuntimeConfig().public.fileStorage.mount;
-  const normalizedFilelocation = filelocation.startsWith("/") ? filelocation.slice(1) : filelocation;
-  return join(location, normalizedFilelocation, filename);
+  const location = getMount();
+  if (!location)
+    throw new Error("fileStorage.mount is not configured");
+  ensureSafeBasename(filename);
+  const normalizedFilelocation = normalizeRelative(filelocation);
+  const resolved = path.resolve(location, normalizedFilelocation, filename);
+  const mountResolved = path.resolve(location);
+  const relative = path.relative(mountResolved, resolved);
+  if (relative === "" || !relative.startsWith(".." + path.sep) && relative !== "..") {
+    return resolved;
+  }
+  throw createError({
+    statusCode: 400,
+    statusMessage: "Resolved path is outside of configured mount"
+  });
 };
 export const getFilesLocally = async (filelocation = "") => {
-  const location = useRuntimeConfig().public.fileStorage.mount;
-  const normalizedFilelocation = filelocation.startsWith("/") ? filelocation.slice(1) : filelocation;
-  return await readdir(join(location, normalizedFilelocation)).catch(() => []);
+  const location = getMount();
+  if (!location)
+    return [];
+  const normalizedFilelocation = normalizeRelative(filelocation);
+  const dirPath = await resolveAndEnsureInside(location, normalizedFilelocation);
+  return await readdir(dirPath).catch(() => []);
 };
 export const deleteFile = async (filename, filelocation = "") => {
-  const location = useRuntimeConfig().public.fileStorage.mount;
-  const normalizedFilelocation = filelocation.startsWith("/") ? filelocation.slice(1) : filelocation;
-  await rm(join(location, normalizedFilelocation, filename));
+  const location = getMount();
+  if (!location)
+    throw new Error("fileStorage.mount is not configured");
+  ensureSafeBasename(filename);
+  const normalizedFilelocation = normalizeRelative(filelocation);
+  const targetPath = await resolveAndEnsureInside(location, normalizedFilelocation, filename);
+  await rm(targetPath);
 };
 const generateRandomId = (length) => {
   const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
@@ -47,3 +91,32 @@ export const parseDataUrl = (file) => {
   const ext = mime.split("/")[1];
   return { binaryString, ext };
 };
+export const retrieveFileLocally = async (event, filename, filelocation = "") => {
+  const filePath = getFileLocally(filename, filelocation);
+  let stats;
+  try {
+    stats = await fsPromises.stat(filePath);
+    if (!stats.isFile()) {
+      throw createError({ statusCode: 404, statusMessage: "Not Found" });
+    }
+  } catch (err) {
+    throw createError({ statusCode: 404, statusMessage: "Not Found" });
+  }
+  const ext = path.extname(filePath).slice(1).toLowerCase();
+  const mimeMap = {
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    svg: "image/svg+xml",
+    pdf: "application/pdf",
+    txt: "text/plain",
+    html: "text/html",
+    json: "application/json"
+  };
+  const contentType = mimeMap[ext] || "application/octet-stream";
+  event.node.res.setHeader("Content-Type", contentType);
+  event.node.res.setHeader("Content-Length", String(stats.size));
+  event.node.res.setHeader("Content-Disposition", `inline; filename="${path.basename(filePath)}"`);
+  return createReadStream(filePath);
+};

package/dist/types.d.mts

@@ -1 +1 @@
-export { type ClientFile, type ModuleOptions, type ServerFile, default } from './module.js'
+export { type useRuntimeConfig } from './module.js'

package/dist/types.d.ts

@@ -1 +1 @@
-export { type ClientFile, type ModuleOptions, type ServerFile, default } from './module'
+export { type useRuntimeConfig } from './module'

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nuxt-file-storage",
-	"version": "0.3.0",
+	"version": "0.3.1",
 	"description": "Easy solution to store files in your nuxt apps. Be able to upload files from the frontend and recieve them from the backend to then save the files in your project.",
 	"repository": "NyllRE/nuxt-file-storage",
 	"license": "MIT",
@@ -22,7 +22,8 @@
 		"dev": "nuxi dev playground",
 		"dev:build": "nuxi build playground",
 		"dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
-		"release": "npm run lint && npm run prepack && changelogen && npm publish && git push --follow-tags",
+		"bump": "npm version patch -m \"chore(release): %s\"",
+		"release": "npm run lint && npm run bump && npm run prepack && changelogen && git push --follow-tags && npm publish",
 		"lint": "eslint .",
 		"test": "vitest run",
 		"test:watch": "vitest watch"
@@ -36,11 +37,16 @@
 		"@nuxt/eslint-config": "^0.2.0",
 		"@nuxt/module-builder": "^0.8.4",
 		"@nuxt/schema": "^3.15.4",
-		"@nuxt/test-utils": "^3.17.0",
+		"@nuxt/test-utils": "^3.21.0",
 		"@types/node": "^20.17.19",
+		"@vitest/ui": "4.0.16",
+		"@vue/test-utils": "^2.4.6",
 		"changelogen": "^0.5.7",
 		"eslint": "^8.57.1",
+		"happy-dom": "^20.0.11",
 		"nuxt": "^3.15.4",
-		"vitest": "^1.6.1"
+		"playwright-core": "^1.57.0",
+		"typescript": "^5.9.3",
+		"vitest": "^4.0.16"
 	}
 }