payload 3.89.0 → 3.90.0

package/dist/uploads/clientUploadReceipt.js

@@ -0,0 +1,55 @@
+import crypto from 'crypto';
+import { APIError } from '../errors/APIError.js';
+const LIFETIME_MS = 6 * 60 * 60 * 1000;
+const DOMAIN = 'payload-client-upload-receipt-v1';
+export const createClientUploadReceipt = ({ collectionSlug, context, filename, req, user = getUser(req) })=>{
+    const data = {
+        collectionSlug,
+        context,
+        expiresAt: Date.now() + LIFETIME_MS,
+        filename,
+        ...user
+    };
+    const encodedReceipt = Buffer.from(JSON.stringify(data)).toString('base64url');
+    return `${encodedReceipt}.${sign(encodedReceipt, req.payload.secret)}`;
+};
+export const verifyClientUploadReceipt = ({ collectionSlug, req, signedReceipt })=>{
+    const [encodedReceipt, signature, extra] = signedReceipt.split('.');
+    const expected = encodedReceipt ? sign(encodedReceipt, req.payload.secret) : '';
+    if (!encodedReceipt || !signature || extra || !equal(signature, expected)) {
+        throwInvalidReference();
+    }
+    let decodedReceipt;
+    try {
+        decodedReceipt = JSON.parse(Buffer.from(encodedReceipt, 'base64url').toString());
+    } catch  {
+        throwInvalidReference();
+    }
+    const user = getUser(req);
+    if (!isReceipt(decodedReceipt) || decodedReceipt.collectionSlug !== collectionSlug || decodedReceipt.expiresAt <= Date.now() || decodedReceipt.userCollection !== user.userCollection || decodedReceipt.userID !== user.userID) {
+        throwInvalidReference();
+    }
+    return decodedReceipt;
+};
+function throwInvalidReference() {
+    throw new APIError('Invalid or expired client upload reference.', 400);
+}
+const getUser = (req)=>({
+        userCollection: req.user?.collection ?? null,
+        userID: req.user?.id ?? null
+    });
+const sign = (encodedReceipt, secret)=>crypto.createHmac('sha256', `${DOMAIN}:${secret}`).update(encodedReceipt).digest('base64url');
+const equal = (actual, expected)=>{
+    const actualBuffer = Buffer.from(actual);
+    const expectedBuffer = Buffer.from(expected);
+    return actualBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(actualBuffer, expectedBuffer);
+};
+const isReceipt = (value)=>{
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const data = value;
+    return typeof data.collectionSlug === 'string' && Boolean(data.context) && typeof data.context === 'object' && !Array.isArray(data.context) && typeof data.expiresAt === 'number' && Number.isFinite(data.expiresAt) && typeof data.filename === 'string' && (data.userCollection === null || typeof data.userCollection === 'string') && (data.userID === null || typeof data.userID === 'string' || typeof data.userID === 'number' && Number.isFinite(data.userID));
+};
+
+//# sourceMappingURL=clientUploadReceipt.js.map

package/dist/uploads/clientUploadReceipt.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/clientUploadReceipt.ts"],"sourcesContent":["import crypto from 'crypto'\n\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { APIError } from '../errors/APIError.js'\n\nexport type ClientUploadReceipt = {\n  collectionSlug: string\n  context: Record<string, unknown>\n  expiresAt: number\n  filename: string\n  userCollection: null | string\n  userID: null | number | string\n}\n\n// `<base64url payload>.<base64url HMAC signature>`\nexport type SignedClientUploadReceipt = `${string}.${string}`\n\nconst LIFETIME_MS = 6 * 60 * 60 * 1000\nconst DOMAIN = 'payload-client-upload-receipt-v1'\n\nexport const createClientUploadReceipt = ({\n  collectionSlug,\n  context,\n  filename,\n  req,\n  user = getUser(req),\n}: {\n  collectionSlug: string\n  context: Record<string, unknown>\n  filename: string\n  req: PayloadRequest\n  user?: Pick<ClientUploadReceipt, 'userCollection' | 'userID'>\n}): SignedClientUploadReceipt => {\n  const data: ClientUploadReceipt = {\n    collectionSlug,\n    context,\n    expiresAt: Date.now() + LIFETIME_MS,\n    filename,\n    ...user,\n  }\n  const encodedReceipt = Buffer.from(JSON.stringify(data)).toString('base64url')\n\n  return `${encodedReceipt}.${sign(encodedReceipt, req.payload.secret)}`\n}\n\nexport const verifyClientUploadReceipt = ({\n  collectionSlug,\n  req,\n  signedReceipt,\n}: {\n  collectionSlug: string\n  req: PayloadRequest\n  signedReceipt: string\n}): ClientUploadReceipt => {\n  const [encodedReceipt, signature, extra] = signedReceipt.split('.')\n  const expected = encodedReceipt ? sign(encodedReceipt, req.payload.secret) : ''\n\n  if (!encodedReceipt || !signature || extra || !equal(signature, expected)) {\n    throwInvalidReference()\n  }\n\n  let decodedReceipt: unknown\n  try {\n    decodedReceipt = JSON.parse(Buffer.from(encodedReceipt, 'base64url').toString())\n  } catch {\n    throwInvalidReference()\n  }\n\n  const user = getUser(req)\n  if (\n    !isReceipt(decodedReceipt) ||\n    decodedReceipt.collectionSlug !== collectionSlug ||\n    decodedReceipt.expiresAt <= Date.now() ||\n    decodedReceipt.userCollection !== user.userCollection ||\n    decodedReceipt.userID !== user.userID\n  ) {\n    throwInvalidReference()\n  }\n\n  return decodedReceipt\n}\n\nfunction throwInvalidReference(): never {\n  throw new APIError('Invalid or expired client upload reference.', 400)\n}\n\nconst getUser = (req: PayloadRequest) => ({\n  userCollection: req.user?.collection ?? null,\n  userID: req.user?.id ?? null,\n})\n\nconst sign = (encodedReceipt: string, secret: string) =>\n  crypto.createHmac('sha256', `${DOMAIN}:${secret}`).update(encodedReceipt).digest('base64url')\n\nconst equal = (actual: string, expected: string) => {\n  const actualBuffer = Buffer.from(actual)\n  const expectedBuffer = Buffer.from(expected)\n  return (\n    actualBuffer.length === expectedBuffer.length &&\n    crypto.timingSafeEqual(actualBuffer, expectedBuffer)\n  )\n}\n\nconst isReceipt = (value: unknown): value is ClientUploadReceipt => {\n  if (!value || typeof value !== 'object') {\n    return false\n  }\n  const data = value as Partial<ClientUploadReceipt>\n  return (\n    typeof data.collectionSlug === 'string' &&\n    Boolean(data.context) &&\n    typeof data.context === 'object' &&\n    !Array.isArray(data.context) &&\n    typeof data.expiresAt === 'number' &&\n    Number.isFinite(data.expiresAt) &&\n    typeof data.filename === 'string' &&\n    (data.userCollection === null || typeof data.userCollection === 'string') &&\n    (data.userID === null ||\n      typeof data.userID === 'string' ||\n      (typeof data.userID === 'number' && Number.isFinite(data.userID)))\n  )\n}\n"],"names":["crypto","APIError","LIFETIME_MS","DOMAIN","createClientUploadReceipt","collectionSlug","context","filename","req","user","getUser","data","expiresAt","Date","now","encodedReceipt","Buffer","from","JSON","stringify","toString","sign","payload","secret","verifyClientUploadReceipt","signedReceipt","signature","extra","split","expected","equal","throwInvalidReference","decodedReceipt","parse","isReceipt","userCollection","userID","collection","id","createHmac","update","digest","actual","actualBuffer","expectedBuffer","length","timingSafeEqual","value","Boolean","Array","isArray","Number","isFinite"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAI3B,SAASC,QAAQ,QAAQ,wBAAuB;AAchD,MAAMC,cAAc,IAAI,KAAK,KAAK;AAClC,MAAMC,SAAS;AAEf,OAAO,MAAMC,4BAA4B,CAAC,EACxCC,cAAc,EACdC,OAAO,EACPC,QAAQ,EACRC,GAAG,EACHC,OAAOC,QAAQF,IAAI,EAOpB;IACC,MAAMG,OAA4B;QAChCN;QACAC;QACAM,WAAWC,KAAKC,GAAG,KAAKZ;QACxBK;QACA,GAAGE,IAAI;IACT;IACA,MAAMM,iBAAiBC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACR,OAAOS,QAAQ,CAAC;IAElE,OAAO,GAAGL,eAAe,CAAC,EAAEM,KAAKN,gBAAgBP,IAAIc,OAAO,CAACC,MAAM,GAAG;AACxE,EAAC;AAED,OAAO,MAAMC,4BAA4B,CAAC,EACxCnB,cAAc,EACdG,GAAG,EACHiB,aAAa,EAKd;IACC,MAAM,CAACV,gBAAgBW,WAAWC,MAAM,GAAGF,cAAcG,KAAK,CAAC;IAC/D,MAAMC,WAAWd,iBAAiBM,KAAKN,gBAAgBP,IAAIc,OAAO,CAACC,MAAM,IAAI;IAE7E,IAAI,CAACR,kBAAkB,CAACW,aAAaC,SAAS,CAACG,MAAMJ,WAAWG,WAAW;QACzEE;IACF;IAEA,IAAIC;IACJ,IAAI;QACFA,iBAAiBd,KAAKe,KAAK,CAACjB,OAAOC,IAAI,CAACF,gBAAgB,aAAaK,QAAQ;IAC/E,EAAE,OAAM;QACNW;IACF;IAEA,MAAMtB,OAAOC,QAAQF;IACrB,IACE,CAAC0B,UAAUF,mBACXA,eAAe3B,cAAc,KAAKA,kBAClC2B,eAAepB,SAAS,IAAIC,KAAKC,GAAG,MACpCkB,eAAeG,cAAc,KAAK1B,KAAK0B,cAAc,IACrDH,eAAeI,MAAM,KAAK3B,KAAK2B,MAAM,EACrC;QACAL;IACF;IAEA,OAAOC;AACT,EAAC;AAED,SAASD;IACP,MAAM,IAAI9B,SAAS,+CAA+C;AACpE;AAEA,MAAMS,UAAU,CAACF,MAAyB,CAAA;QACxC2B,gBAAgB3B,IAAIC,IAAI,EAAE4B,cAAc;QACxCD,QAAQ5B,IAAIC,IAAI,EAAE6B,MAAM;IAC1B,CAAA;AAEA,MAAMjB,OAAO,CAACN,gBAAwBQ,SACpCvB,OAAOuC,UAAU,CAAC,UAAU,GAAGpC,OAAO,CAAC,EAAEoB,QAAQ,EAAEiB,MAAM,CAACzB,gBAAgB0B,MAAM,CAAC;AAEnF,MAAMX,QAAQ,CAACY,QAAgBb;IAC7B,MAAMc,eAAe3B,OAAOC,IAAI,CAACyB;IACjC,MAAME,iBAAiB5B,OAAOC,IAAI,CAACY;IACnC,OACEc,aAAaE,MAAM,KAAKD,eAAeC,MAAM,IAC7C7C,OAAO8C,eAAe,CAACH,cAAcC;AAEzC;AAEA,MAAMV,YAAY,CAACa;IACjB,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;QACvC,OAAO;IACT;IACA,MAAMpC,OAAOoC;IACb,OACE,OAAOpC,KAAKN,cAAc,KAAK,YAC/B2C,QAAQrC,KAAKL,OAAO,KACpB,OAAOK,KAAKL,OAAO,KAAK,YACxB,CAAC2C,MAAMC,OAAO,CAACvC,KAAKL,OAAO,KAC3B,OAAOK,KAAKC,SAAS,KAAK,YAC1BuC,OAAOC,QAAQ,CAACzC,KAAKC,SAAS,KAC9B,OAAOD,KAAKJ,QAAQ,KAAK,YACxBI,CAAAA,KAAKwB,cAAc,KAAK,QAAQ,OAAOxB,KAAKwB,cAAc,KAAK,QAAO,KACtExB,CAAAA,KAAKyB,MAAM,KAAK,QACf,OAAOzB,KAAKyB,MAAM,KAAK,YACtB,OAAOzB,KAAKyB,MAAM,KAAK,YAAYe,OAAOC,QAAQ,CAACzC,KAAKyB,MAAM,CAAC;AAEtE"}

package/dist/uploads/deleteAssociatedFiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteAssociatedFiles.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteAssociatedFiles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAyC/D,CAAA"}
+{"version":3,"file":"deleteAssociatedFiles.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteAssociatedFiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAuCD,eAAO,MAAM,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAkC/D,CAAA"}

package/dist/uploads/deleteAssociatedFiles.js

@@ -1,17 +1,42 @@
 import fs from 'fs/promises';
+import path from 'path';
 import { ErrorDeletingFile } from '../errors/index.js';
 import { fileExists } from './fileExists.js';
+const isPathWithin = (parentPath, targetPath)=>{
+    const relativePath = path.relative(parentPath, targetPath);
+    return relativePath === '' || !path.isAbsolute(relativePath) && relativePath !== '..' && !relativePath.startsWith(`..${path.sep}`);
+};
+const deleteFile = async ({ filename, staticPath })=>{
+    if (!filename || !staticPath) {
+        return;
+    }
+    const resolvedStaticPath = path.resolve(staticPath);
+    const filePath = path.resolve(resolvedStaticPath, filename);
+    if (!isPathWithin(resolvedStaticPath, filePath)) {
+        throw new Error('Invalid filename');
+    }
+    if (await fileExists(filePath)) {
+        const [canonicalParentPath, canonicalStaticPath] = await Promise.all([
+            fs.realpath(path.dirname(filePath)),
+            fs.realpath(resolvedStaticPath)
+        ]);
+        if (!isPathWithin(canonicalStaticPath, canonicalParentPath)) {
+            throw new Error('Invalid filename');
+        }
+        await fs.unlink(filePath);
+    }
+};
 export const deleteAssociatedFiles = async ({ collectionConfig, doc, files = [], overrideDelete, req })=>{
     if (!collectionConfig.upload) {
         return;
     }
     if (overrideDelete || files.length > 0) {
         const { staticDir: staticPath } = collectionConfig.upload;
-        const fileToDelete = `${staticPath}/${doc.filename}`;
         try {
-            if (await fileExists(fileToDelete)) {
-                await fs.unlink(fileToDelete);
-            }
+            await deleteFile({
+                filename: doc.filename,
+                staticPath
+            });
         } catch (ignore) {
             throw new ErrorDeletingFile(req.t);
         }
@@ -21,11 +46,11 @@ export const deleteAssociatedFiles = async ({ collectionConfig, doc, files = [],
             // happen that two operations will try to delete the same file.
             // To avoid this it is recommended to use "sync" instead
             for (const size of sizes){
-                const sizeToDelete = `${staticPath}/${size.filename}`;
                 try {
-                    if (await fileExists(sizeToDelete)) {
-                        await fs.unlink(sizeToDelete);
-                    }
+                    await deleteFile({
+                        filename: size.filename,
+                        staticPath
+                    });
                 } catch (ignore) {
                     throw new ErrorDeletingFile(req.t);
                 }

package/dist/uploads/deleteAssociatedFiles.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.ts"],"sourcesContent":["import fs from 'fs/promises'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { FileData, FileToSave } from './types.js'\n\nimport { ErrorDeletingFile } from '../errors/index.js'\nimport { fileExists } from './fileExists.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  doc: Record<string, unknown>\n  files?: FileToSave[]\n  overrideDelete: boolean\n  req: PayloadRequest\n}\n\nexport const deleteAssociatedFiles: (args: Args) => Promise<void> = async ({\n  collectionConfig,\n  doc,\n  files = [],\n  overrideDelete,\n  req,\n}) => {\n  if (!collectionConfig.upload) {\n    return\n  }\n  if (overrideDelete || files.length > 0) {\n    const { staticDir: staticPath } = collectionConfig.upload\n\n    const fileToDelete = `${staticPath}/${doc.filename as string}`\n\n    try {\n      if (await fileExists(fileToDelete)) {\n        await fs.unlink(fileToDelete)\n      }\n    } catch (ignore) {\n      throw new ErrorDeletingFile(req.t)\n    }\n\n    if (doc.sizes) {\n      const sizes: FileData[] = Object.values(doc.sizes)\n      // Since forEach will not wait until unlink is finished it could\n      // happen that two operations will try to delete the same file.\n      // To avoid this it is recommended to use \"sync\" instead\n\n      for (const size of sizes) {\n        const sizeToDelete = `${staticPath}/${size.filename}`\n        try {\n          if (await fileExists(sizeToDelete)) {\n            await fs.unlink(sizeToDelete)\n          }\n        } catch (ignore) {\n          throw new ErrorDeletingFile(req.t)\n        }\n      }\n    }\n  }\n}\n"],"names":["fs","ErrorDeletingFile","fileExists","deleteAssociatedFiles","collectionConfig","doc","files","overrideDelete","req","upload","length","staticDir","staticPath","fileToDelete","filename","unlink","ignore","t","sizes","Object","values","size","sizeToDelete"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAO5B,SAASC,iBAAiB,QAAQ,qBAAoB;AACtD,SAASC,UAAU,QAAQ,kBAAiB;AAW5C,OAAO,MAAMC,wBAAuD,OAAO,EACzEC,gBAAgB,EAChBC,GAAG,EACHC,QAAQ,EAAE,EACVC,cAAc,EACdC,GAAG,EACJ;IACC,IAAI,CAACJ,iBAAiBK,MAAM,EAAE;QAC5B;IACF;IACA,IAAIF,kBAAkBD,MAAMI,MAAM,GAAG,GAAG;QACtC,MAAM,EAAEC,WAAWC,UAAU,EAAE,GAAGR,iBAAiBK,MAAM;QAEzD,MAAMI,eAAe,GAAGD,WAAW,CAAC,EAAEP,IAAIS,QAAQ,EAAY;QAE9D,IAAI;YACF,IAAI,MAAMZ,WAAWW,eAAe;gBAClC,MAAMb,GAAGe,MAAM,CAACF;YAClB;QACF,EAAE,OAAOG,QAAQ;YACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;QACnC;QAEA,IAAIZ,IAAIa,KAAK,EAAE;YACb,MAAMA,QAAoBC,OAAOC,MAAM,CAACf,IAAIa,KAAK;YACjD,gEAAgE;YAChE,+DAA+D;YAC/D,wDAAwD;YAExD,KAAK,MAAMG,QAAQH,MAAO;gBACxB,MAAMI,eAAe,GAAGV,WAAW,CAAC,EAAES,KAAKP,QAAQ,EAAE;gBACrD,IAAI;oBACF,IAAI,MAAMZ,WAAWoB,eAAe;wBAClC,MAAMtB,GAAGe,MAAM,CAACO;oBAClB;gBACF,EAAE,OAAON,QAAQ;oBACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;gBACnC;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport path from 'path'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { FileData, FileToSave } from './types.js'\n\nimport { ErrorDeletingFile } from '../errors/index.js'\nimport { fileExists } from './fileExists.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  doc: Record<string, unknown>\n  files?: FileToSave[]\n  overrideDelete: boolean\n  req: PayloadRequest\n}\n\nconst isPathWithin = (parentPath: string, targetPath: string): boolean => {\n  const relativePath = path.relative(parentPath, targetPath)\n\n  return (\n    relativePath === '' ||\n    (!path.isAbsolute(relativePath) &&\n      relativePath !== '..' &&\n      !relativePath.startsWith(`..${path.sep}`))\n  )\n}\n\nconst deleteFile = async ({ filename, staticPath }: { filename?: string; staticPath?: string }) => {\n  if (!filename || !staticPath) {\n    return\n  }\n\n  const resolvedStaticPath = path.resolve(staticPath)\n  const filePath = path.resolve(resolvedStaticPath, filename)\n\n  if (!isPathWithin(resolvedStaticPath, filePath)) {\n    throw new Error('Invalid filename')\n  }\n\n  if (await fileExists(filePath)) {\n    const [canonicalParentPath, canonicalStaticPath] = await Promise.all([\n      fs.realpath(path.dirname(filePath)),\n      fs.realpath(resolvedStaticPath),\n    ])\n\n    if (!isPathWithin(canonicalStaticPath, canonicalParentPath)) {\n      throw new Error('Invalid filename')\n    }\n\n    await fs.unlink(filePath)\n  }\n}\n\nexport const deleteAssociatedFiles: (args: Args) => Promise<void> = async ({\n  collectionConfig,\n  doc,\n  files = [],\n  overrideDelete,\n  req,\n}) => {\n  if (!collectionConfig.upload) {\n    return\n  }\n  if (overrideDelete || files.length > 0) {\n    const { staticDir: staticPath } = collectionConfig.upload\n\n    try {\n      await deleteFile({ filename: doc.filename as string | undefined, staticPath })\n    } catch (ignore) {\n      throw new ErrorDeletingFile(req.t)\n    }\n\n    if (doc.sizes) {\n      const sizes: FileData[] = Object.values(doc.sizes)\n      // Since forEach will not wait until unlink is finished it could\n      // happen that two operations will try to delete the same file.\n      // To avoid this it is recommended to use \"sync\" instead\n\n      for (const size of sizes) {\n        try {\n          await deleteFile({ filename: size.filename, staticPath })\n        } catch (ignore) {\n          throw new ErrorDeletingFile(req.t)\n        }\n      }\n    }\n  }\n}\n"],"names":["fs","path","ErrorDeletingFile","fileExists","isPathWithin","parentPath","targetPath","relativePath","relative","isAbsolute","startsWith","sep","deleteFile","filename","staticPath","resolvedStaticPath","resolve","filePath","Error","canonicalParentPath","canonicalStaticPath","Promise","all","realpath","dirname","unlink","deleteAssociatedFiles","collectionConfig","doc","files","overrideDelete","req","upload","length","staticDir","ignore","t","sizes","Object","values","size"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,UAAU,OAAM;AAOvB,SAASC,iBAAiB,QAAQ,qBAAoB;AACtD,SAASC,UAAU,QAAQ,kBAAiB;AAW5C,MAAMC,eAAe,CAACC,YAAoBC;IACxC,MAAMC,eAAeN,KAAKO,QAAQ,CAACH,YAAYC;IAE/C,OACEC,iBAAiB,MAChB,CAACN,KAAKQ,UAAU,CAACF,iBAChBA,iBAAiB,QACjB,CAACA,aAAaG,UAAU,CAAC,CAAC,EAAE,EAAET,KAAKU,GAAG,EAAE;AAE9C;AAEA,MAAMC,aAAa,OAAO,EAAEC,QAAQ,EAAEC,UAAU,EAA8C;IAC5F,IAAI,CAACD,YAAY,CAACC,YAAY;QAC5B;IACF;IAEA,MAAMC,qBAAqBd,KAAKe,OAAO,CAACF;IACxC,MAAMG,WAAWhB,KAAKe,OAAO,CAACD,oBAAoBF;IAElD,IAAI,CAACT,aAAaW,oBAAoBE,WAAW;QAC/C,MAAM,IAAIC,MAAM;IAClB;IAEA,IAAI,MAAMf,WAAWc,WAAW;QAC9B,MAAM,CAACE,qBAAqBC,oBAAoB,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACnEtB,GAAGuB,QAAQ,CAACtB,KAAKuB,OAAO,CAACP;YACzBjB,GAAGuB,QAAQ,CAACR;SACb;QAED,IAAI,CAACX,aAAagB,qBAAqBD,sBAAsB;YAC3D,MAAM,IAAID,MAAM;QAClB;QAEA,MAAMlB,GAAGyB,MAAM,CAACR;IAClB;AACF;AAEA,OAAO,MAAMS,wBAAuD,OAAO,EACzEC,gBAAgB,EAChBC,GAAG,EACHC,QAAQ,EAAE,EACVC,cAAc,EACdC,GAAG,EACJ;IACC,IAAI,CAACJ,iBAAiBK,MAAM,EAAE;QAC5B;IACF;IACA,IAAIF,kBAAkBD,MAAMI,MAAM,GAAG,GAAG;QACtC,MAAM,EAAEC,WAAWpB,UAAU,EAAE,GAAGa,iBAAiBK,MAAM;QAEzD,IAAI;YACF,MAAMpB,WAAW;gBAAEC,UAAUe,IAAIf,QAAQ;gBAAwBC;YAAW;QAC9E,EAAE,OAAOqB,QAAQ;YACf,MAAM,IAAIjC,kBAAkB6B,IAAIK,CAAC;QACnC;QAEA,IAAIR,IAAIS,KAAK,EAAE;YACb,MAAMA,QAAoBC,OAAOC,MAAM,CAACX,IAAIS,KAAK;YACjD,gEAAgE;YAChE,+DAA+D;YAC/D,wDAAwD;YAExD,KAAK,MAAMG,QAAQH,MAAO;gBACxB,IAAI;oBACF,MAAMzB,WAAW;wBAAEC,UAAU2B,KAAK3B,QAAQ;wBAAEC;oBAAW;gBACzD,EAAE,OAAOqB,QAAQ;oBACf,MAAM,IAAIjC,kBAAkB6B,IAAIK,CAAC;gBACnC;YACF;QACF;IACF;AACF,EAAC"}

package/dist/uploads/deleteAssociatedFiles.spec.js

@@ -0,0 +1,124 @@
+import fs from 'fs/promises';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ErrorDeletingFile } from '../errors/index.js';
+import { deleteAssociatedFiles } from './deleteAssociatedFiles.js';
+describe('deleteAssociatedFiles', ()=>{
+    let testDir;
+    let uploadDir;
+    beforeEach(async ()=>{
+        testDir = await fs.mkdtemp(path.join(os.tmpdir(), 'payload-upload-delete-'));
+        uploadDir = path.join(testDir, 'uploads');
+        await fs.mkdir(uploadDir);
+    });
+    afterEach(async ()=>{
+        await fs.rm(testDir, {
+            force: true,
+            recursive: true
+        });
+    });
+    it('deletes files from the configured upload directory', async ()=>{
+        const filename = 'document.txt';
+        const filePath = path.join(uploadDir, filename);
+        await fs.writeFile(filePath, 'content');
+        await deleteAssociatedFiles({
+            collectionConfig: {
+                upload: {
+                    staticDir: uploadDir
+                }
+            },
+            config: {},
+            doc: {
+                filename
+            },
+            overrideDelete: true,
+            req: {}
+        });
+        await expect(fs.access(filePath)).rejects.toThrow();
+    });
+    it('deletes files from nested directories within the configured upload directory', async ()=>{
+        const filename = path.join('tenant', 'document.txt');
+        const filePath = path.join(uploadDir, filename);
+        await fs.mkdir(path.dirname(filePath));
+        await fs.writeFile(filePath, 'content');
+        await deleteAssociatedFiles({
+            collectionConfig: {
+                upload: {
+                    staticDir: uploadDir
+                }
+            },
+            config: {},
+            doc: {
+                filename
+            },
+            overrideDelete: true,
+            req: {}
+        });
+        await expect(fs.access(filePath)).rejects.toThrow();
+    });
+    it('rejects filenames outside the configured upload directory', async ()=>{
+        const filePath = path.join(testDir, 'document.txt');
+        await fs.writeFile(filePath, 'content');
+        await expect(deleteAssociatedFiles({
+            collectionConfig: {
+                upload: {
+                    staticDir: uploadDir
+                }
+            },
+            config: {},
+            doc: {
+                filename: path.relative(uploadDir, filePath)
+            },
+            overrideDelete: true,
+            req: {}
+        })).rejects.toBeInstanceOf(ErrorDeletingFile);
+        await expect(fs.readFile(filePath, 'utf8')).resolves.toBe('content');
+    });
+    it('rejects generated size filenames outside the configured upload directory', async ()=>{
+        const filePath = path.join(testDir, 'thumbnail.txt');
+        await fs.writeFile(filePath, 'content');
+        await expect(deleteAssociatedFiles({
+            collectionConfig: {
+                upload: {
+                    staticDir: uploadDir
+                }
+            },
+            config: {},
+            doc: {
+                filename: 'document.txt',
+                sizes: {
+                    thumbnail: {
+                        filename: path.relative(uploadDir, filePath)
+                    }
+                }
+            },
+            overrideDelete: true,
+            req: {}
+        })).rejects.toBeInstanceOf(ErrorDeletingFile);
+        await expect(fs.readFile(filePath, 'utf8')).resolves.toBe('content');
+    });
+    it('rejects files reached through linked directories outside the configured upload directory', async ()=>{
+        const externalDir = path.join(testDir, 'documents');
+        const filePath = path.join(externalDir, 'document.txt');
+        await fs.mkdir(externalDir);
+        await fs.writeFile(filePath, 'content');
+        await fs.symlink(externalDir, path.join(uploadDir, 'linked'), 'dir');
+        await expect(deleteAssociatedFiles({
+            collectionConfig: {
+                upload: {
+                    staticDir: uploadDir
+                }
+            },
+            config: {},
+            doc: {
+                filename: path.join('linked', 'document.txt')
+            },
+            overrideDelete: true,
+            req: {}
+        })).rejects.toBeInstanceOf(ErrorDeletingFile);
+        await expect(fs.readFile(filePath, 'utf8')).resolves.toBe('content');
+    });
+});
+
+//# sourceMappingURL=deleteAssociatedFiles.spec.js.map

package/dist/uploads/deleteAssociatedFiles.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.spec.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport os from 'os'\nimport path from 'path'\nimport { afterEach, beforeEach, describe, expect, it } from 'vitest'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { ErrorDeletingFile } from '../errors/index.js'\nimport { deleteAssociatedFiles } from './deleteAssociatedFiles.js'\n\ndescribe('deleteAssociatedFiles', () => {\n  let testDir: string\n  let uploadDir: string\n\n  beforeEach(async () => {\n    testDir = await fs.mkdtemp(path.join(os.tmpdir(), 'payload-upload-delete-'))\n    uploadDir = path.join(testDir, 'uploads')\n    await fs.mkdir(uploadDir)\n  })\n\n  afterEach(async () => {\n    await fs.rm(testDir, { force: true, recursive: true })\n  })\n\n  it('deletes files from the configured upload directory', async () => {\n    const filename = 'document.txt'\n    const filePath = path.join(uploadDir, filename)\n    await fs.writeFile(filePath, 'content')\n\n    await deleteAssociatedFiles({\n      collectionConfig: { upload: { staticDir: uploadDir } } as SanitizedCollectionConfig,\n      config: {} as SanitizedConfig,\n      doc: { filename },\n      overrideDelete: true,\n      req: {} as PayloadRequest,\n    })\n\n    await expect(fs.access(filePath)).rejects.toThrow()\n  })\n\n  it('deletes files from nested directories within the configured upload directory', async () => {\n    const filename = path.join('tenant', 'document.txt')\n    const filePath = path.join(uploadDir, filename)\n    await fs.mkdir(path.dirname(filePath))\n    await fs.writeFile(filePath, 'content')\n\n    await deleteAssociatedFiles({\n      collectionConfig: { upload: { staticDir: uploadDir } } as SanitizedCollectionConfig,\n      config: {} as SanitizedConfig,\n      doc: { filename },\n      overrideDelete: true,\n      req: {} as PayloadRequest,\n    })\n\n    await expect(fs.access(filePath)).rejects.toThrow()\n  })\n\n  it('rejects filenames outside the configured upload directory', async () => {\n    const filePath = path.join(testDir, 'document.txt')\n    await fs.writeFile(filePath, 'content')\n\n    await expect(\n      deleteAssociatedFiles({\n        collectionConfig: { upload: { staticDir: uploadDir } } as SanitizedCollectionConfig,\n        config: {} as SanitizedConfig,\n        doc: { filename: path.relative(uploadDir, filePath) },\n        overrideDelete: true,\n        req: {} as PayloadRequest,\n      }),\n    ).rejects.toBeInstanceOf(ErrorDeletingFile)\n\n    await expect(fs.readFile(filePath, 'utf8')).resolves.toBe('content')\n  })\n\n  it('rejects generated size filenames outside the configured upload directory', async () => {\n    const filePath = path.join(testDir, 'thumbnail.txt')\n    await fs.writeFile(filePath, 'content')\n\n    await expect(\n      deleteAssociatedFiles({\n        collectionConfig: { upload: { staticDir: uploadDir } } as SanitizedCollectionConfig,\n        config: {} as SanitizedConfig,\n        doc: {\n          filename: 'document.txt',\n          sizes: { thumbnail: { filename: path.relative(uploadDir, filePath) } },\n        },\n        overrideDelete: true,\n        req: {} as PayloadRequest,\n      }),\n    ).rejects.toBeInstanceOf(ErrorDeletingFile)\n\n    await expect(fs.readFile(filePath, 'utf8')).resolves.toBe('content')\n  })\n\n  it('rejects files reached through linked directories outside the configured upload directory', async () => {\n    const externalDir = path.join(testDir, 'documents')\n    const filePath = path.join(externalDir, 'document.txt')\n    await fs.mkdir(externalDir)\n    await fs.writeFile(filePath, 'content')\n    await fs.symlink(externalDir, path.join(uploadDir, 'linked'), 'dir')\n\n    await expect(\n      deleteAssociatedFiles({\n        collectionConfig: { upload: { staticDir: uploadDir } } as SanitizedCollectionConfig,\n        config: {} as SanitizedConfig,\n        doc: { filename: path.join('linked', 'document.txt') },\n        overrideDelete: true,\n        req: {} as PayloadRequest,\n      }),\n    ).rejects.toBeInstanceOf(ErrorDeletingFile)\n\n    await expect(fs.readFile(filePath, 'utf8')).resolves.toBe('content')\n  })\n})\n"],"names":["fs","os","path","afterEach","beforeEach","describe","expect","it","ErrorDeletingFile","deleteAssociatedFiles","testDir","uploadDir","mkdtemp","join","tmpdir","mkdir","rm","force","recursive","filename","filePath","writeFile","collectionConfig","upload","staticDir","config","doc","overrideDelete","req","access","rejects","toThrow","dirname","relative","toBeInstanceOf","readFile","resolves","toBe","sizes","thumbnail","externalDir","symlink"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,QAAQ,KAAI;AACnB,OAAOC,UAAU,OAAM;AACvB,SAASC,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAMpE,SAASC,iBAAiB,QAAQ,qBAAoB;AACtD,SAASC,qBAAqB,QAAQ,6BAA4B;AAElEJ,SAAS,yBAAyB;IAChC,IAAIK;IACJ,IAAIC;IAEJP,WAAW;QACTM,UAAU,MAAMV,GAAGY,OAAO,CAACV,KAAKW,IAAI,CAACZ,GAAGa,MAAM,IAAI;QAClDH,YAAYT,KAAKW,IAAI,CAACH,SAAS;QAC/B,MAAMV,GAAGe,KAAK,CAACJ;IACjB;IAEAR,UAAU;QACR,MAAMH,GAAGgB,EAAE,CAACN,SAAS;YAAEO,OAAO;YAAMC,WAAW;QAAK;IACtD;IAEAX,GAAG,sDAAsD;QACvD,MAAMY,WAAW;QACjB,MAAMC,WAAWlB,KAAKW,IAAI,CAACF,WAAWQ;QACtC,MAAMnB,GAAGqB,SAAS,CAACD,UAAU;QAE7B,MAAMX,sBAAsB;YAC1Ba,kBAAkB;gBAAEC,QAAQ;oBAAEC,WAAWb;gBAAU;YAAE;YACrDc,QAAQ,CAAC;YACTC,KAAK;gBAAEP;YAAS;YAChBQ,gBAAgB;YAChBC,KAAK,CAAC;QACR;QAEA,MAAMtB,OAAON,GAAG6B,MAAM,CAACT,WAAWU,OAAO,CAACC,OAAO;IACnD;IAEAxB,GAAG,gFAAgF;QACjF,MAAMY,WAAWjB,KAAKW,IAAI,CAAC,UAAU;QACrC,MAAMO,WAAWlB,KAAKW,IAAI,CAACF,WAAWQ;QACtC,MAAMnB,GAAGe,KAAK,CAACb,KAAK8B,OAAO,CAACZ;QAC5B,MAAMpB,GAAGqB,SAAS,CAACD,UAAU;QAE7B,MAAMX,sBAAsB;YAC1Ba,kBAAkB;gBAAEC,QAAQ;oBAAEC,WAAWb;gBAAU;YAAE;YACrDc,QAAQ,CAAC;YACTC,KAAK;gBAAEP;YAAS;YAChBQ,gBAAgB;YAChBC,KAAK,CAAC;QACR;QAEA,MAAMtB,OAAON,GAAG6B,MAAM,CAACT,WAAWU,OAAO,CAACC,OAAO;IACnD;IAEAxB,GAAG,6DAA6D;QAC9D,MAAMa,WAAWlB,KAAKW,IAAI,CAACH,SAAS;QACpC,MAAMV,GAAGqB,SAAS,CAACD,UAAU;QAE7B,MAAMd,OACJG,sBAAsB;YACpBa,kBAAkB;gBAAEC,QAAQ;oBAAEC,WAAWb;gBAAU;YAAE;YACrDc,QAAQ,CAAC;YACTC,KAAK;gBAAEP,UAAUjB,KAAK+B,QAAQ,CAACtB,WAAWS;YAAU;YACpDO,gBAAgB;YAChBC,KAAK,CAAC;QACR,IACAE,OAAO,CAACI,cAAc,CAAC1B;QAEzB,MAAMF,OAAON,GAAGmC,QAAQ,CAACf,UAAU,SAASgB,QAAQ,CAACC,IAAI,CAAC;IAC5D;IAEA9B,GAAG,4EAA4E;QAC7E,MAAMa,WAAWlB,KAAKW,IAAI,CAACH,SAAS;QACpC,MAAMV,GAAGqB,SAAS,CAACD,UAAU;QAE7B,MAAMd,OACJG,sBAAsB;YACpBa,kBAAkB;gBAAEC,QAAQ;oBAAEC,WAAWb;gBAAU;YAAE;YACrDc,QAAQ,CAAC;YACTC,KAAK;gBACHP,UAAU;gBACVmB,OAAO;oBAAEC,WAAW;wBAAEpB,UAAUjB,KAAK+B,QAAQ,CAACtB,WAAWS;oBAAU;gBAAE;YACvE;YACAO,gBAAgB;YAChBC,KAAK,CAAC;QACR,IACAE,OAAO,CAACI,cAAc,CAAC1B;QAEzB,MAAMF,OAAON,GAAGmC,QAAQ,CAACf,UAAU,SAASgB,QAAQ,CAACC,IAAI,CAAC;IAC5D;IAEA9B,GAAG,4FAA4F;QAC7F,MAAMiC,cAActC,KAAKW,IAAI,CAACH,SAAS;QACvC,MAAMU,WAAWlB,KAAKW,IAAI,CAAC2B,aAAa;QACxC,MAAMxC,GAAGe,KAAK,CAACyB;QACf,MAAMxC,GAAGqB,SAAS,CAACD,UAAU;QAC7B,MAAMpB,GAAGyC,OAAO,CAACD,aAAatC,KAAKW,IAAI,CAACF,WAAW,WAAW;QAE9D,MAAML,OACJG,sBAAsB;YACpBa,kBAAkB;gBAAEC,QAAQ;oBAAEC,WAAWb;gBAAU;YAAE;YACrDc,QAAQ,CAAC;YACTC,KAAK;gBAAEP,UAAUjB,KAAKW,IAAI,CAAC,UAAU;YAAgB;YACrDc,gBAAgB;YAChBC,KAAK,CAAC;QACR,IACAE,OAAO,CAACI,cAAc,CAAC1B;QAEzB,MAAMF,OAAON,GAAGmC,QAAQ,CAACf,UAAU,SAASgB,QAAQ,CAACC,IAAI,CAAC;IAC5D;AACF"}

package/dist/uploads/detectSvgFromXml.d.ts

@@ -1,5 +1,3 @@
-/**
- * Securely detect if an XML buffer contains a valid SVG document
- */
+/** Detect whether an XML document's root element is namespaced SVG. */
 export declare function detectSvgFromXml(buffer: Buffer): boolean;
 //# sourceMappingURL=detectSvgFromXml.d.ts.map

package/dist/uploads/detectSvgFromXml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detectSvgFromXml.d.ts","sourceRoot":"","sources":["../../src/uploads/detectSvgFromXml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA6CxD"}
+{"version":3,"file":"detectSvgFromXml.d.ts","sourceRoot":"","sources":["../../src/uploads/detectSvgFromXml.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/uploads/detectSvgFromXml.js

@@ -1,43 +1,6 @@
-/**
- * Securely detect if an XML buffer contains a valid SVG document
- */ export function detectSvgFromXml(buffer) {
-    try {
-        // Limit buffer size to prevent processing large malicious files
-        const maxSize = 2048;
-        const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize));
-        // Check for XML declaration and extract encoding if present
-        const xmlDeclMatch = content.match(/^<\?xml[^>]*encoding=["']([^"']+)["']/i);
-        const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase();
-        // Only support safe encodings
-        if (declaredEncoding && ![
-            'ascii',
-            'utf-8',
-            'utf8'
-        ].includes(declaredEncoding)) {
-            return false;
-        }
-        // Remove XML declarations, comments, and processing instructions
-        const cleanContent = content.replace(/<\?xml[^>]*\?>/gi, '').replace(/<!--[\s\S]*?-->/g, '').replace(/<\?[^>]*\?>/g, '').trim();
-        // Find the first actual element (root element)
-        const rootElementMatch = cleanContent.match(/^<(\w+)(?:\s|>)/);
-        if (!rootElementMatch || rootElementMatch[1] !== 'svg') {
-            return false;
-        }
-        // Validate SVG namespace - must be present for valid SVG
-        const svgNamespaceRegex = /xmlns=["']http:\/\/www\.w3\.org\/2000\/svg["']/;
-        if (!svgNamespaceRegex.test(content)) {
-            return false;
-        }
-        // Additional validation: ensure it's not malformed
-        const svgOpenTag = content.match(/<svg[\s>]/);
-        if (!svgOpenTag) {
-            return false;
-        }
-        return true;
-    } catch (_error) {
-        // If any error occurs during parsing, treat as not SVG
-        return false;
-    }
+import { inspectSvg } from './validateSvg.js';
+/** Detect whether an XML document's root element is namespaced SVG. */ export function detectSvgFromXml(buffer) {
+    return inspectSvg(buffer).isSvg;
 }
 
 //# sourceMappingURL=detectSvgFromXml.js.map

package/dist/uploads/detectSvgFromXml.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["/**\n * Securely detect if an XML buffer contains a valid SVG document\n */\nexport function detectSvgFromXml(buffer: Buffer): boolean {\n  try {\n    // Limit buffer size to prevent processing large malicious files\n    const maxSize = 2048\n    const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize))\n\n    // Check for XML declaration and extract encoding if present\n    const xmlDeclMatch = content.match(/^<\\?xml[^>]*encoding=[\"']([^\"']+)[\"']/i)\n    const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase()\n\n    // Only support safe encodings\n    if (declaredEncoding && !['ascii', 'utf-8', 'utf8'].includes(declaredEncoding)) {\n      return false\n    }\n\n    // Remove XML declarations, comments, and processing instructions\n    const cleanContent = content\n      .replace(/<\\?xml[^>]*\\?>/gi, '')\n      .replace(/<!--[\\s\\S]*?-->/g, '')\n      .replace(/<\\?[^>]*\\?>/g, '')\n      .trim()\n\n    // Find the first actual element (root element)\n    const rootElementMatch = cleanContent.match(/^<(\\w+)(?:\\s|>)/)\n    if (!rootElementMatch || rootElementMatch[1] !== 'svg') {\n      return false\n    }\n\n    // Validate SVG namespace - must be present for valid SVG\n    const svgNamespaceRegex = /xmlns=[\"']http:\\/\\/www\\.w3\\.org\\/2000\\/svg[\"']/\n    if (!svgNamespaceRegex.test(content)) {\n      return false\n    }\n\n    // Additional validation: ensure it's not malformed\n    const svgOpenTag = content.match(/<svg[\\s>]/)\n    if (!svgOpenTag) {\n      return false\n    }\n\n    return true\n  } catch (_error) {\n    // If any error occurs during parsing, treat as not SVG\n    return false\n  }\n}\n"],"names":["detectSvgFromXml","buffer","maxSize","content","toString","Math","min","length","xmlDeclMatch","match","declaredEncoding","toLowerCase","includes","cleanContent","replace","trim","rootElementMatch","svgNamespaceRegex","test","svgOpenTag","_error"],"mappings":"AAAA;;CAEC,GACD,OAAO,SAASA,iBAAiBC,MAAc;IAC7C,IAAI;QACF,gEAAgE;QAChE,MAAMC,UAAU;QAChB,MAAMC,UAAUF,OAAOG,QAAQ,CAAC,QAAQ,GAAGC,KAAKC,GAAG,CAACL,OAAOM,MAAM,EAAEL;QAEnE,4DAA4D;QAC5D,MAAMM,eAAeL,QAAQM,KAAK,CAAC;QACnC,MAAMC,mBAAmBF,cAAc,CAAC,EAAE,EAAEG;QAE5C,8BAA8B;QAC9B,IAAID,oBAAoB,CAAC;YAAC;YAAS;YAAS;SAAO,CAACE,QAAQ,CAACF,mBAAmB;YAC9E,OAAO;QACT;QAEA,iEAAiE;QACjE,MAAMG,eAAeV,QAClBW,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,gBAAgB,IACxBC,IAAI;QAEP,+CAA+C;QAC/C,MAAMC,mBAAmBH,aAAaJ,KAAK,CAAC;QAC5C,IAAI,CAACO,oBAAoBA,gBAAgB,CAAC,EAAE,KAAK,OAAO;YACtD,OAAO;QACT;QAEA,yDAAyD;QACzD,MAAMC,oBAAoB;QAC1B,IAAI,CAACA,kBAAkBC,IAAI,CAACf,UAAU;YACpC,OAAO;QACT;QAEA,mDAAmD;QACnD,MAAMgB,aAAahB,QAAQM,KAAK,CAAC;QACjC,IAAI,CAACU,YAAY;YACf,OAAO;QACT;QAEA,OAAO;IACT,EAAE,OAAOC,QAAQ;QACf,uDAAuD;QACvD,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["import { inspectSvg } from './validateSvg.js'\n\n/** Detect whether an XML document's root element is namespaced SVG. */\nexport function detectSvgFromXml(buffer: Buffer): boolean {\n  return inspectSvg(buffer).isSvg\n}\n"],"names":["inspectSvg","detectSvgFromXml","buffer","isSvg"],"mappings":"AAAA,SAASA,UAAU,QAAQ,mBAAkB;AAE7C,qEAAqE,GACrE,OAAO,SAASC,iBAAiBC,MAAc;IAC7C,OAAOF,WAAWE,QAAQC,KAAK;AACjC"}

package/dist/uploads/endpoints/getFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFile.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAU3D,eAAO,MAAM,cAAc,EAAE,cA6J5B,CAAA"}
+{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFile.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAY3D,eAAO,MAAM,cAAc,EAAE,cAgK5B,CAAA"}

package/dist/uploads/endpoints/getFile.js

@@ -6,7 +6,9 @@ import { APIError } from '../../errors/APIError.js';
 import { checkFileAccess } from '../../uploads/checkFileAccess.js';
 import { streamFile } from '../../uploads/fetchAPI-stream-file/index.js';
 import { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js';
+import { getFileExtension, isXmlMimeType } from '../../uploads/getFileTypeIdentity.js';
 import { parseRangeHeader } from '../../uploads/parseRangeHeader.js';
+import { UPLOAD_CONTENT_SECURITY_POLICY } from '../../uploads/uploadContentSecurityPolicy.js';
 import { getRequestCollection } from '../../utilities/getRequestEntity.js';
 import { headersWithCors } from '../../utilities/headersWithCors.js';
 export const getFileHandler = async (req)=>{
@@ -80,7 +82,7 @@ export const getFileHandler = async (req)=>{
     }
     const fileTypeResult = await fileTypeFromFile(filePath) || getFileTypeFallback(filePath);
     let mimeType = fileTypeResult.mime;
-    if (filePath.endsWith('.svg') && fileTypeResult.mime === 'application/xml') {
+    if (getFileExtension(filePath).toLowerCase() === 'svg' && fileTypeResult.mime === 'application/xml') {
         mimeType = 'image/svg+xml';
     }
     // Parse Range header for byte range requests
@@ -106,8 +108,8 @@ export const getFileHandler = async (req)=>{
     let headers = new Headers();
     headers.set('Content-Type', mimeType);
     headers.set('Accept-Ranges', 'bytes');
-    if (mimeType === 'image/svg+xml') {
-        headers.set('Content-Security-Policy', "script-src 'none'");
+    if (isXmlMimeType(mimeType)) {
+        headers.set('Content-Security-Policy', UPLOAD_CONTENT_SECURITY_POLICY);
     }
     let data;
     let status;

package/dist/uploads/endpoints/getFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/getFile.ts"],"sourcesContent":["import type { Stats } from 'fs'\n\nimport { fileTypeFromFile } from 'file-type'\nimport fsPromises from 'fs/promises'\nimport { status as httpStatus } from 'http-status'\nimport path from 'path'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { checkFileAccess } from '../../uploads/checkFileAccess.js'\nimport { streamFile } from '../../uploads/fetchAPI-stream-file/index.js'\nimport { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js'\nimport { parseRangeHeader } from '../../uploads/parseRangeHeader.js'\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\n\nexport const getFileHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n\n  const filename = req.routeParams?.filename as string\n  const prefix = req.searchParams?.get('prefix') ?? undefined\n\n  if (!collection.config.upload) {\n    throw new APIError(\n      `This collection is not an upload collection: ${collection.config.slug}`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  const accessResult = (await checkFileAccess({\n    collection,\n    filename,\n    prefix,\n    req,\n  }))!\n\n  if (accessResult instanceof Response) {\n    return accessResult\n  }\n\n  if (collection.config.upload.handlers?.length) {\n    let customResponse: null | Response | void = null\n    const headers = new Headers()\n\n    for (const handler of collection.config.upload.handlers) {\n      customResponse = await handler(req, {\n        doc: accessResult,\n        headers,\n        params: {\n          collection: collection.config.slug,\n          filename,\n          prefix,\n        },\n      })\n      if (customResponse && customResponse instanceof Response) {\n        break\n      }\n    }\n\n    if (customResponse instanceof Response) {\n      return customResponse\n    }\n  }\n\n  // Local filesystem fallback — cloud storage handlers return a Response above\n  // and have their own filename validation via sanitizeFilename.\n  const fileDir = collection.config.upload?.staticDir || collection.config.slug\n  const resolvedDir = path.resolve(fileDir)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!filePath.startsWith(resolvedDir + path.sep)) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  let stats: Stats\n\n  try {\n    stats = await fsPromises.stat(filePath)\n  } catch (err) {\n    if ((err as { code?: string }).code === 'ENOENT') {\n      req.payload.logger.error(\n        `File ${filename} for collection ${collection.config.slug} is missing on the disk. Expected path: ${filePath}`,\n      )\n\n      // Omit going to the routeError handler by returning response instead of\n      // throwing an error to cut down log noise. The response still matches what you get with APIError to not leak details to the user.\n      return Response.json(\n        {\n          errors: [\n            {\n              message: 'Something went wrong.',\n            },\n          ],\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: 500,\n        },\n      )\n    }\n\n    throw err\n  }\n\n  const fileTypeResult = (await fileTypeFromFile(filePath)) || getFileTypeFallback(filePath)\n  let mimeType = fileTypeResult.mime\n\n  if (filePath.endsWith('.svg') && fileTypeResult.mime === 'application/xml') {\n    mimeType = 'image/svg+xml'\n  }\n\n  // Parse Range header for byte range requests\n  const rangeHeader = req.headers.get('range')\n  const rangeResult = parseRangeHeader({\n    fileSize: stats.size,\n    rangeHeader,\n  })\n\n  if (rangeResult.type === 'invalid') {\n    let headers = new Headers()\n    headers.set('Content-Range', `bytes */${stats.size}`)\n    headers = collection.config.upload?.modifyResponseHeaders\n      ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n      : headers\n\n    return new Response(null, {\n      headers: headersWithCors({\n        headers,\n        req,\n      }),\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    })\n  }\n\n  let headers = new Headers()\n  headers.set('Content-Type', mimeType)\n  headers.set('Accept-Ranges', 'bytes')\n\n  if (mimeType === 'image/svg+xml') {\n    headers.set('Content-Security-Policy', \"script-src 'none'\")\n  }\n\n  let data: ReadableStream\n  let status: number\n  const isPartial = rangeResult.type === 'partial'\n  const range = rangeResult.range\n\n  if (isPartial && range) {\n    const contentLength = range.end - range.start + 1\n    headers.set('Content-Length', String(contentLength))\n    headers.set('Content-Range', `bytes ${range.start}-${range.end}/${stats.size}`)\n    data = streamFile({ filePath, options: { end: range.end, start: range.start } })\n    status = httpStatus.PARTIAL_CONTENT\n  } else {\n    headers.set('Content-Length', String(stats.size))\n    data = streamFile({ filePath })\n    status = httpStatus.OK\n  }\n\n  headers = collection.config.upload?.modifyResponseHeaders\n    ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n    : headers\n\n  return new Response(data, {\n    headers: headersWithCors({\n      headers,\n      req,\n    }),\n    status,\n  })\n}\n"],"names":["fileTypeFromFile","fsPromises","status","httpStatus","path","APIError","checkFileAccess","streamFile","getFileTypeFallback","parseRangeHeader","getRequestCollection","headersWithCors","getFileHandler","req","collection","filename","routeParams","prefix","searchParams","get","undefined","config","upload","slug","BAD_REQUEST","accessResult","Response","handlers","length","customResponse","headers","Headers","handler","doc","params","fileDir","staticDir","resolvedDir","resolve","filePath","startsWith","sep","stats","stat","err","code","payload","logger","error","json","errors","message","fileTypeResult","mimeType","mime","endsWith","rangeHeader","rangeResult","fileSize","size","type","set","modifyResponseHeaders","REQUESTED_RANGE_NOT_SATISFIABLE","data","isPartial","range","contentLength","end","start","String","options","PARTIAL_CONTENT","OK"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,YAAW;AAC5C,OAAOC,gBAAgB,cAAa;AACpC,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAClD,OAAOC,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,UAAU,QAAQ,8CAA6C;AACxE,SAASC,mBAAmB,QAAQ,uCAAsC;AAC1E,SAASC,gBAAgB,QAAQ,oCAAmC;AACpE,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AAEpE,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaJ,qBAAqBG;IAExC,MAAME,WAAWF,IAAIG,WAAW,EAAED;IAClC,MAAME,SAASJ,IAAIK,YAAY,EAAEC,IAAI,aAAaC;IAElD,IAAI,CAACN,WAAWO,MAAM,CAACC,MAAM,EAAE;QAC7B,MAAM,IAAIjB,SACR,CAAC,6CAA6C,EAAES,WAAWO,MAAM,CAACE,IAAI,EAAE,EACxEpB,WAAWqB,WAAW;IAE1B;IAEA,MAAMC,eAAgB,MAAMnB,gBAAgB;QAC1CQ;QACAC;QACAE;QACAJ;IACF;IAEA,IAAIY,wBAAwBC,UAAU;QACpC,OAAOD;IACT;IAEA,IAAIX,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,EAAEC,QAAQ;QAC7C,IAAIC,iBAAyC;QAC7C,MAAMC,UAAU,IAAIC;QAEpB,KAAK,MAAMC,WAAWlB,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,CAAE;YACvDE,iBAAiB,MAAMG,QAAQnB,KAAK;gBAClCoB,KAAKR;gBACLK;gBACAI,QAAQ;oBACNpB,YAAYA,WAAWO,MAAM,CAACE,IAAI;oBAClCR;oBACAE;gBACF;YACF;YACA,IAAIY,kBAAkBA,0BAA0BH,UAAU;gBACxD;YACF;QACF;QAEA,IAAIG,0BAA0BH,UAAU;YACtC,OAAOG;QACT;IACF;IAEA,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAMM,UAAUrB,WAAWO,MAAM,CAACC,MAAM,EAAEc,aAAatB,WAAWO,MAAM,CAACE,IAAI;IAC7E,MAAMc,cAAcjC,KAAKkC,OAAO,CAACH;IACjC,MAAMI,WAAWnC,KAAKkC,OAAO,CAACD,aAAatB;IAE3C,IAAI,CAACwB,SAASC,UAAU,CAACH,cAAcjC,KAAKqC,GAAG,GAAG;QAChD,MAAM,IAAIpC,SAAS,qBAAqBF,WAAWqB,WAAW;IAChE;IAEA,IAAIkB;IAEJ,IAAI;QACFA,QAAQ,MAAMzC,WAAW0C,IAAI,CAACJ;IAChC,EAAE,OAAOK,KAAK;QACZ,IAAI,AAACA,IAA0BC,IAAI,KAAK,UAAU;YAChDhC,IAAIiC,OAAO,CAACC,MAAM,CAACC,KAAK,CACtB,CAAC,KAAK,EAAEjC,SAAS,gBAAgB,EAAED,WAAWO,MAAM,CAACE,IAAI,CAAC,wCAAwC,EAAEgB,UAAU;YAGhH,wEAAwE;YACxE,kIAAkI;YAClI,OAAOb,SAASuB,IAAI,CAClB;gBACEC,QAAQ;oBACN;wBACEC,SAAS;oBACX;iBACD;YACH,GACA;gBACErB,SAASnB,gBAAgB;oBACvBmB,SAAS,IAAIC;oBACblB;gBACF;gBACAX,QAAQ;YACV;QAEJ;QAEA,MAAM0C;IACR;IAEA,MAAMQ,iBAAiB,AAAC,MAAMpD,iBAAiBuC,aAAc/B,oBAAoB+B;IACjF,IAAIc,WAAWD,eAAeE,IAAI;IAElC,IAAIf,SAASgB,QAAQ,CAAC,WAAWH,eAAeE,IAAI,KAAK,mBAAmB;QAC1ED,WAAW;IACb;IAEA,6CAA6C;IAC7C,MAAMG,cAAc3C,IAAIiB,OAAO,CAACX,GAAG,CAAC;IACpC,MAAMsC,cAAchD,iBAAiB;QACnCiD,UAAUhB,MAAMiB,IAAI;QACpBH;IACF;IAEA,IAAIC,YAAYG,IAAI,KAAK,WAAW;QAClC,IAAI9B,UAAU,IAAIC;QAClBD,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAEnB,MAAMiB,IAAI,EAAE;QACpD7B,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;YAAEhC;QAAQ,MAAMA,UAC/DA;QAEJ,OAAO,IAAIJ,SAAS,MAAM;YACxBI,SAASnB,gBAAgB;gBACvBmB;gBACAjB;YACF;YACAX,QAAQC,WAAW4D,+BAA+B;QACpD;IACF;IAEA,IAAIjC,UAAU,IAAIC;IAClBD,QAAQ+B,GAAG,CAAC,gBAAgBR;IAC5BvB,QAAQ+B,GAAG,CAAC,iBAAiB;IAE7B,IAAIR,aAAa,iBAAiB;QAChCvB,QAAQ+B,GAAG,CAAC,2BAA2B;IACzC;IAEA,IAAIG;IACJ,IAAI9D;IACJ,MAAM+D,YAAYR,YAAYG,IAAI,KAAK;IACvC,MAAMM,QAAQT,YAAYS,KAAK;IAE/B,IAAID,aAAaC,OAAO;QACtB,MAAMC,gBAAgBD,MAAME,GAAG,GAAGF,MAAMG,KAAK,GAAG;QAChDvC,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAOH;QACrCrC,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAEK,MAAMG,KAAK,CAAC,CAAC,EAAEH,MAAME,GAAG,CAAC,CAAC,EAAE1B,MAAMiB,IAAI,EAAE;QAC9EK,OAAOzD,WAAW;YAAEgC;YAAUgC,SAAS;gBAAEH,KAAKF,MAAME,GAAG;gBAAEC,OAAOH,MAAMG,KAAK;YAAC;QAAE;QAC9EnE,SAASC,WAAWqE,eAAe;IACrC,OAAO;QACL1C,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAO5B,MAAMiB,IAAI;QAC/CK,OAAOzD,WAAW;YAAEgC;QAAS;QAC7BrC,SAASC,WAAWsE,EAAE;IACxB;IAEA3C,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;QAAEhC;IAAQ,MAAMA,UAC/DA;IAEJ,OAAO,IAAIJ,SAASsC,MAAM;QACxBlC,SAASnB,gBAAgB;YACvBmB;YACAjB;QACF;QACAX;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../../src/uploads/endpoints/getFile.ts"],"sourcesContent":["import type { Stats } from 'fs'\n\nimport { fileTypeFromFile } from 'file-type'\nimport fsPromises from 'fs/promises'\nimport { status as httpStatus } from 'http-status'\nimport path from 'path'\n\nimport type { PayloadHandler } from '../../config/types.js'\n\nimport { APIError } from '../../errors/APIError.js'\nimport { checkFileAccess } from '../../uploads/checkFileAccess.js'\nimport { streamFile } from '../../uploads/fetchAPI-stream-file/index.js'\nimport { getFileTypeFallback } from '../../uploads/getFileTypeFallback.js'\nimport { getFileExtension, isXmlMimeType } from '../../uploads/getFileTypeIdentity.js'\nimport { parseRangeHeader } from '../../uploads/parseRangeHeader.js'\nimport { UPLOAD_CONTENT_SECURITY_POLICY } from '../../uploads/uploadContentSecurityPolicy.js'\nimport { getRequestCollection } from '../../utilities/getRequestEntity.js'\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\n\nexport const getFileHandler: PayloadHandler = async (req) => {\n  const collection = getRequestCollection(req)\n\n  const filename = req.routeParams?.filename as string\n  const prefix = req.searchParams?.get('prefix') ?? undefined\n\n  if (!collection.config.upload) {\n    throw new APIError(\n      `This collection is not an upload collection: ${collection.config.slug}`,\n      httpStatus.BAD_REQUEST,\n    )\n  }\n\n  const accessResult = (await checkFileAccess({\n    collection,\n    filename,\n    prefix,\n    req,\n  }))!\n\n  if (accessResult instanceof Response) {\n    return accessResult\n  }\n\n  if (collection.config.upload.handlers?.length) {\n    let customResponse: null | Response | void = null\n    const headers = new Headers()\n\n    for (const handler of collection.config.upload.handlers) {\n      customResponse = await handler(req, {\n        doc: accessResult,\n        headers,\n        params: {\n          collection: collection.config.slug,\n          filename,\n          prefix,\n        },\n      })\n      if (customResponse && customResponse instanceof Response) {\n        break\n      }\n    }\n\n    if (customResponse instanceof Response) {\n      return customResponse\n    }\n  }\n\n  // Local filesystem fallback — cloud storage handlers return a Response above\n  // and have their own filename validation via sanitizeFilename.\n  const fileDir = collection.config.upload?.staticDir || collection.config.slug\n  const resolvedDir = path.resolve(fileDir)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!filePath.startsWith(resolvedDir + path.sep)) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  let stats: Stats\n\n  try {\n    stats = await fsPromises.stat(filePath)\n  } catch (err) {\n    if ((err as { code?: string }).code === 'ENOENT') {\n      req.payload.logger.error(\n        `File ${filename} for collection ${collection.config.slug} is missing on the disk. Expected path: ${filePath}`,\n      )\n\n      // Omit going to the routeError handler by returning response instead of\n      // throwing an error to cut down log noise. The response still matches what you get with APIError to not leak details to the user.\n      return Response.json(\n        {\n          errors: [\n            {\n              message: 'Something went wrong.',\n            },\n          ],\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: 500,\n        },\n      )\n    }\n\n    throw err\n  }\n\n  const fileTypeResult = (await fileTypeFromFile(filePath)) || getFileTypeFallback(filePath)\n  let mimeType = fileTypeResult.mime\n\n  if (\n    getFileExtension(filePath).toLowerCase() === 'svg' &&\n    fileTypeResult.mime === 'application/xml'\n  ) {\n    mimeType = 'image/svg+xml'\n  }\n\n  // Parse Range header for byte range requests\n  const rangeHeader = req.headers.get('range')\n  const rangeResult = parseRangeHeader({\n    fileSize: stats.size,\n    rangeHeader,\n  })\n\n  if (rangeResult.type === 'invalid') {\n    let headers = new Headers()\n    headers.set('Content-Range', `bytes */${stats.size}`)\n    headers = collection.config.upload?.modifyResponseHeaders\n      ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n      : headers\n\n    return new Response(null, {\n      headers: headersWithCors({\n        headers,\n        req,\n      }),\n      status: httpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,\n    })\n  }\n\n  let headers = new Headers()\n  headers.set('Content-Type', mimeType)\n  headers.set('Accept-Ranges', 'bytes')\n\n  if (isXmlMimeType(mimeType)) {\n    headers.set('Content-Security-Policy', UPLOAD_CONTENT_SECURITY_POLICY)\n  }\n\n  let data: ReadableStream\n  let status: number\n  const isPartial = rangeResult.type === 'partial'\n  const range = rangeResult.range\n\n  if (isPartial && range) {\n    const contentLength = range.end - range.start + 1\n    headers.set('Content-Length', String(contentLength))\n    headers.set('Content-Range', `bytes ${range.start}-${range.end}/${stats.size}`)\n    data = streamFile({ filePath, options: { end: range.end, start: range.start } })\n    status = httpStatus.PARTIAL_CONTENT\n  } else {\n    headers.set('Content-Length', String(stats.size))\n    data = streamFile({ filePath })\n    status = httpStatus.OK\n  }\n\n  headers = collection.config.upload?.modifyResponseHeaders\n    ? collection.config.upload.modifyResponseHeaders({ headers }) || headers\n    : headers\n\n  return new Response(data, {\n    headers: headersWithCors({\n      headers,\n      req,\n    }),\n    status,\n  })\n}\n"],"names":["fileTypeFromFile","fsPromises","status","httpStatus","path","APIError","checkFileAccess","streamFile","getFileTypeFallback","getFileExtension","isXmlMimeType","parseRangeHeader","UPLOAD_CONTENT_SECURITY_POLICY","getRequestCollection","headersWithCors","getFileHandler","req","collection","filename","routeParams","prefix","searchParams","get","undefined","config","upload","slug","BAD_REQUEST","accessResult","Response","handlers","length","customResponse","headers","Headers","handler","doc","params","fileDir","staticDir","resolvedDir","resolve","filePath","startsWith","sep","stats","stat","err","code","payload","logger","error","json","errors","message","fileTypeResult","mimeType","mime","toLowerCase","rangeHeader","rangeResult","fileSize","size","type","set","modifyResponseHeaders","REQUESTED_RANGE_NOT_SATISFIABLE","data","isPartial","range","contentLength","end","start","String","options","PARTIAL_CONTENT","OK"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,YAAW;AAC5C,OAAOC,gBAAgB,cAAa;AACpC,SAASC,UAAUC,UAAU,QAAQ,cAAa;AAClD,OAAOC,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,UAAU,QAAQ,8CAA6C;AACxE,SAASC,mBAAmB,QAAQ,uCAAsC;AAC1E,SAASC,gBAAgB,EAAEC,aAAa,QAAQ,uCAAsC;AACtF,SAASC,gBAAgB,QAAQ,oCAAmC;AACpE,SAASC,8BAA8B,QAAQ,+CAA8C;AAC7F,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,eAAe,QAAQ,qCAAoC;AAEpE,OAAO,MAAMC,iBAAiC,OAAOC;IACnD,MAAMC,aAAaJ,qBAAqBG;IAExC,MAAME,WAAWF,IAAIG,WAAW,EAAED;IAClC,MAAME,SAASJ,IAAIK,YAAY,EAAEC,IAAI,aAAaC;IAElD,IAAI,CAACN,WAAWO,MAAM,CAACC,MAAM,EAAE;QAC7B,MAAM,IAAIpB,SACR,CAAC,6CAA6C,EAAEY,WAAWO,MAAM,CAACE,IAAI,EAAE,EACxEvB,WAAWwB,WAAW;IAE1B;IAEA,MAAMC,eAAgB,MAAMtB,gBAAgB;QAC1CW;QACAC;QACAE;QACAJ;IACF;IAEA,IAAIY,wBAAwBC,UAAU;QACpC,OAAOD;IACT;IAEA,IAAIX,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,EAAEC,QAAQ;QAC7C,IAAIC,iBAAyC;QAC7C,MAAMC,UAAU,IAAIC;QAEpB,KAAK,MAAMC,WAAWlB,WAAWO,MAAM,CAACC,MAAM,CAACK,QAAQ,CAAE;YACvDE,iBAAiB,MAAMG,QAAQnB,KAAK;gBAClCoB,KAAKR;gBACLK;gBACAI,QAAQ;oBACNpB,YAAYA,WAAWO,MAAM,CAACE,IAAI;oBAClCR;oBACAE;gBACF;YACF;YACA,IAAIY,kBAAkBA,0BAA0BH,UAAU;gBACxD;YACF;QACF;QAEA,IAAIG,0BAA0BH,UAAU;YACtC,OAAOG;QACT;IACF;IAEA,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAMM,UAAUrB,WAAWO,MAAM,CAACC,MAAM,EAAEc,aAAatB,WAAWO,MAAM,CAACE,IAAI;IAC7E,MAAMc,cAAcpC,KAAKqC,OAAO,CAACH;IACjC,MAAMI,WAAWtC,KAAKqC,OAAO,CAACD,aAAatB;IAE3C,IAAI,CAACwB,SAASC,UAAU,CAACH,cAAcpC,KAAKwC,GAAG,GAAG;QAChD,MAAM,IAAIvC,SAAS,qBAAqBF,WAAWwB,WAAW;IAChE;IAEA,IAAIkB;IAEJ,IAAI;QACFA,QAAQ,MAAM5C,WAAW6C,IAAI,CAACJ;IAChC,EAAE,OAAOK,KAAK;QACZ,IAAI,AAACA,IAA0BC,IAAI,KAAK,UAAU;YAChDhC,IAAIiC,OAAO,CAACC,MAAM,CAACC,KAAK,CACtB,CAAC,KAAK,EAAEjC,SAAS,gBAAgB,EAAED,WAAWO,MAAM,CAACE,IAAI,CAAC,wCAAwC,EAAEgB,UAAU;YAGhH,wEAAwE;YACxE,kIAAkI;YAClI,OAAOb,SAASuB,IAAI,CAClB;gBACEC,QAAQ;oBACN;wBACEC,SAAS;oBACX;iBACD;YACH,GACA;gBACErB,SAASnB,gBAAgB;oBACvBmB,SAAS,IAAIC;oBACblB;gBACF;gBACAd,QAAQ;YACV;QAEJ;QAEA,MAAM6C;IACR;IAEA,MAAMQ,iBAAiB,AAAC,MAAMvD,iBAAiB0C,aAAclC,oBAAoBkC;IACjF,IAAIc,WAAWD,eAAeE,IAAI;IAElC,IACEhD,iBAAiBiC,UAAUgB,WAAW,OAAO,SAC7CH,eAAeE,IAAI,KAAK,mBACxB;QACAD,WAAW;IACb;IAEA,6CAA6C;IAC7C,MAAMG,cAAc3C,IAAIiB,OAAO,CAACX,GAAG,CAAC;IACpC,MAAMsC,cAAcjD,iBAAiB;QACnCkD,UAAUhB,MAAMiB,IAAI;QACpBH;IACF;IAEA,IAAIC,YAAYG,IAAI,KAAK,WAAW;QAClC,IAAI9B,UAAU,IAAIC;QAClBD,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAEnB,MAAMiB,IAAI,EAAE;QACpD7B,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;YAAEhC;QAAQ,MAAMA,UAC/DA;QAEJ,OAAO,IAAIJ,SAAS,MAAM;YACxBI,SAASnB,gBAAgB;gBACvBmB;gBACAjB;YACF;YACAd,QAAQC,WAAW+D,+BAA+B;QACpD;IACF;IAEA,IAAIjC,UAAU,IAAIC;IAClBD,QAAQ+B,GAAG,CAAC,gBAAgBR;IAC5BvB,QAAQ+B,GAAG,CAAC,iBAAiB;IAE7B,IAAItD,cAAc8C,WAAW;QAC3BvB,QAAQ+B,GAAG,CAAC,2BAA2BpD;IACzC;IAEA,IAAIuD;IACJ,IAAIjE;IACJ,MAAMkE,YAAYR,YAAYG,IAAI,KAAK;IACvC,MAAMM,QAAQT,YAAYS,KAAK;IAE/B,IAAID,aAAaC,OAAO;QACtB,MAAMC,gBAAgBD,MAAME,GAAG,GAAGF,MAAMG,KAAK,GAAG;QAChDvC,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAOH;QACrCrC,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAEK,MAAMG,KAAK,CAAC,CAAC,EAAEH,MAAME,GAAG,CAAC,CAAC,EAAE1B,MAAMiB,IAAI,EAAE;QAC9EK,OAAO5D,WAAW;YAAEmC;YAAUgC,SAAS;gBAAEH,KAAKF,MAAME,GAAG;gBAAEC,OAAOH,MAAMG,KAAK;YAAC;QAAE;QAC9EtE,SAASC,WAAWwE,eAAe;IACrC,OAAO;QACL1C,QAAQ+B,GAAG,CAAC,kBAAkBS,OAAO5B,MAAMiB,IAAI;QAC/CK,OAAO5D,WAAW;YAAEmC;QAAS;QAC7BxC,SAASC,WAAWyE,EAAE;IACxB;IAEA3C,UAAUhB,WAAWO,MAAM,CAACC,MAAM,EAAEwC,wBAChChD,WAAWO,MAAM,CAACC,MAAM,CAACwC,qBAAqB,CAAC;QAAEhC;IAAQ,MAAMA,UAC/DA;IAEJ,OAAO,IAAIJ,SAASsC,MAAM;QACxBlC,SAASnB,gBAAgB;YACvBmB;YACAjB;QACF;QACAd;IACF;AACF,EAAC"}

package/dist/uploads/fetchAPI-multipart/handlers.d.ts

@@ -1,8 +1,8 @@
 import type { FetchAPIFileUploadOptions } from '../../config/types.js';
 type Handler = (options: FetchAPIFileUploadOptions, fieldname: string, filename: string) => {
-    cleanup: () => void;
+    cleanup: () => Promise<void> | void;
     complete: () => Buffer;
-    dataHandler: (data: Buffer) => void;
+    dataHandler: (data: Buffer) => Promise<void> | void;
     getFilePath: () => string;
     getFileSize: () => number;
     getHash: () => string;

package/dist/uploads/fetchAPI-multipart/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAItE,KAAK,OAAO,GAAG,CACb,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,KACb;IACH,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,QAAQ,EAAE,MAAM,MAAM,CAAA;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,OAAO,EAAE,MAAM,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,OAuD7B,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,OAgCxB,CAAA"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAItE,KAAK,OAAO,GAAG,CACb,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,KACb;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACnC,QAAQ,EAAE,MAAM,MAAM,CAAA;IACtB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACnD,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,OAAO,EAAE,MAAM,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,OA6D7B,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,OAmCxB,CAAA"}

package/dist/uploads/fetchAPI-multipart/handlers.js

@@ -15,6 +15,7 @@ export const tempFileHandler = (options, fieldname, filename)=>{
     const writeStream = fs.createWriteStream(tempFilePath);
     const writePromise = new Promise((resolve, reject)=>{
         writeStream.on('finish', ()=>resolve(true));
+        writeStream.on('close', ()=>resolve(false));
         writeStream.on('error', (err)=>{
             debugLog(options, `Error write temp file: ${err}`);
             reject(err);
@@ -23,9 +24,15 @@ export const tempFileHandler = (options, fieldname, filename)=>{
     return {
         cleanup: ()=>{
             completed = true;
-            debugLog(options, `Cleaning up temporary file ${tempFilePath}...`);
-            writeStream.end();
-            deleteFile(tempFilePath, (err)=>err ? debugLog(options, `Cleaning up temporary file ${tempFilePath} failed: ${err}`) : debugLog(options, `Cleaning up temporary file ${tempFilePath} done.`));
+            return new Promise((resolve)=>{
+                const remove = ()=>deleteFile(tempFilePath, ()=>resolve());
+                if (writeStream.closed) {
+                    remove();
+                } else {
+                    writeStream.once('close', remove);
+                    writeStream.destroy();
+                }
+            });
         },
         complete: ()=>{
             completed = true;
@@ -41,10 +48,13 @@ export const tempFileHandler = (options, fieldname, filename)=>{
                 debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`);
                 return;
             }
-            writeStream.write(data);
+            const ready = writeStream.write(data);
             hash.update(data);
             fileSize += data.length;
             debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`);
+            if (!ready) {
+                return new Promise((resolve)=>writeStream.once('drain', resolve));
+            }
         },
         getFilePath: ()=>tempFilePath,
         getFileSize: ()=>fileSize,
@@ -61,11 +71,14 @@ export const memHandler = (options, fieldname, filename)=>{
     return {
         cleanup: ()=>{
             completed = true;
+            buffers.length = 0;
         },
         complete: ()=>{
             debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`);
             completed = true;
-            return getBuffer();
+            const buffer = getBuffer();
+            buffers.length = 0;
+            return buffer;
         },
         dataHandler: (data)=>{
             if (completed === true) {

package/dist/uploads/fetchAPI-multipart/handlers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"sourcesContent":["import crypto from 'crypto'\nimport fs, { WriteStream } from 'fs'\nimport path from 'path'\n\nimport type { FetchAPIFileUploadOptions } from '../../config/types.js'\n\nimport { checkAndMakeDir, debugLog, deleteFile, getTempFilename } from './utilities.js'\n\ntype Handler = (\n  options: FetchAPIFileUploadOptions,\n  fieldname: string,\n  filename: string,\n) => {\n  cleanup: () => void\n  complete: () => Buffer\n  dataHandler: (data: Buffer) => void\n  getFilePath: () => string\n  getFileSize: () => number\n  getHash: () => string\n  getWritePromise: () => Promise<boolean>\n}\n\nexport const tempFileHandler: Handler = (options, fieldname, filename) => {\n  const tempFilePath = path.resolve(options.tempFileDir!, getTempFilename())\n  checkAndMakeDir({ createParentPath: true }, tempFilePath)\n\n  debugLog(options, `Temporary file path is ${tempFilePath}`)\n\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  debugLog(options, `Opening write stream for ${fieldname}->${filename}...`)\n  const writeStream = fs.createWriteStream(tempFilePath)\n  const writePromise = new Promise<boolean>((resolve, reject) => {\n    writeStream.on('finish', () => resolve(true))\n    writeStream.on('error', (err) => {\n      debugLog(options, `Error write temp file: ${err}`)\n      reject(err)\n    })\n  })\n\n  return {\n    cleanup: () => {\n      completed = true\n      debugLog(options, `Cleaning up temporary file ${tempFilePath}...`)\n      writeStream.end()\n      deleteFile(tempFilePath, (err) =>\n        err\n          ? debugLog(options, `Cleaning up temporary file ${tempFilePath} failed: ${err}`)\n          : debugLog(options, `Cleaning up temporary file ${tempFilePath} done.`),\n      )\n    },\n    complete: () => {\n      completed = true\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      if (writeStream instanceof WriteStream) {\n        writeStream.end()\n      }\n      // Return empty buff since data was uploaded into a temp file.\n      return Buffer.concat([])\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      writeStream.write(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n    },\n    getFilePath: () => tempFilePath,\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => writePromise,\n  }\n}\n\nexport const memHandler: Handler = (options, fieldname, filename) => {\n  const buffers: Buffer[] = []\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  const getBuffer = () => Buffer.concat(buffers, fileSize)\n\n  return {\n    cleanup: () => {\n      completed = true\n    },\n    complete: () => {\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      completed = true\n      return getBuffer()\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      buffers.push(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n    },\n    getFilePath: () => '',\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => Promise.resolve(true),\n  }\n}\n"],"names":["crypto","fs","WriteStream","path","checkAndMakeDir","debugLog","deleteFile","getTempFilename","tempFileHandler","options","fieldname","filename","tempFilePath","resolve","tempFileDir","createParentPath","hash","createHash","fileSize","completed","writeStream","createWriteStream","writePromise","Promise","reject","on","err","cleanup","end","complete","Buffer","concat","dataHandler","data","write","update","length","getFilePath","getFileSize","getHash","digest","getWritePromise","memHandler","buffers","getBuffer","push"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,OAAOC,MAAMC,WAAW,QAAQ,KAAI;AACpC,OAAOC,UAAU,OAAM;AAIvB,SAASC,eAAe,EAAEC,QAAQ,EAAEC,UAAU,EAAEC,eAAe,QAAQ,iBAAgB;AAgBvF,OAAO,MAAMC,kBAA2B,CAACC,SAASC,WAAWC;IAC3D,MAAMC,eAAeT,KAAKU,OAAO,CAACJ,QAAQK,WAAW,EAAGP;IACxDH,gBAAgB;QAAEW,kBAAkB;IAAK,GAAGH;IAE5CP,SAASI,SAAS,CAAC,uBAAuB,EAAEG,cAAc;IAE1D,MAAMI,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhBd,SAASI,SAAS,CAAC,yBAAyB,EAAEC,UAAU,EAAE,EAAEC,SAAS,GAAG,CAAC;IACzE,MAAMS,cAAcnB,GAAGoB,iBAAiB,CAACT;IACzC,MAAMU,eAAe,IAAIC,QAAiB,CAACV,SAASW;QAClDJ,YAAYK,EAAE,CAAC,UAAU,IAAMZ,QAAQ;QACvCO,YAAYK,EAAE,CAAC,SAAS,CAACC;YACvBrB,SAASI,SAAS,CAAC,uBAAuB,EAAEiB,KAAK;YACjDF,OAAOE;QACT;IACF;IAEA,OAAO;QACLC,SAAS;YACPR,YAAY;YACZd,SAASI,SAAS,CAAC,2BAA2B,EAAEG,aAAa,GAAG,CAAC;YACjEQ,YAAYQ,GAAG;YACftB,WAAWM,cAAc,CAACc,MACxBA,MACIrB,SAASI,SAAS,CAAC,2BAA2B,EAAEG,aAAa,SAAS,EAAEc,KAAK,IAC7ErB,SAASI,SAAS,CAAC,2BAA2B,EAAEG,aAAa,MAAM,CAAC;QAE5E;QACAiB,UAAU;YACRV,YAAY;YACZd,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClF,IAAIE,uBAAuBlB,aAAa;gBACtCkB,YAAYQ,GAAG;YACjB;YACA,8DAA8D;YAC9D,OAAOE,OAAOC,MAAM,CAAC,EAAE;QACzB;QACAC,aAAa,CAACC;YACZ,IAAId,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACAS,YAAYc,KAAK,CAACD;YAClBjB,KAAKmB,MAAM,CAACF;YACZf,YAAYe,KAAKG,MAAM;YACvB/B,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;QAC/E;QACAmB,aAAa,IAAMzB;QACnB0B,aAAa,IAAMpB;QACnBqB,SAAS,IAAMvB,KAAKwB,MAAM,CAAC;QAC3BC,iBAAiB,IAAMnB;IACzB;AACF,EAAC;AAED,OAAO,MAAMoB,aAAsB,CAACjC,SAASC,WAAWC;IACtD,MAAMgC,UAAoB,EAAE;IAC5B,MAAM3B,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhB,MAAMyB,YAAY,IAAMd,OAAOC,MAAM,CAACY,SAASzB;IAE/C,OAAO;QACLS,SAAS;YACPR,YAAY;QACd;QACAU,UAAU;YACRxB,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClFC,YAAY;YACZ,OAAOyB;QACT;QACAZ,aAAa,CAACC;YACZ,IAAId,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACAgC,QAAQE,IAAI,CAACZ;YACbjB,KAAKmB,MAAM,CAACF;YACZf,YAAYe,KAAKG,MAAM;YACvB/B,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;QAC/E;QACAmB,aAAa,IAAM;QACnBC,aAAa,IAAMpB;QACnBqB,SAAS,IAAMvB,KAAKwB,MAAM,CAAC;QAC3BC,iBAAiB,IAAMlB,QAAQV,OAAO,CAAC;IACzC;AACF,EAAC"}
+{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/handlers.ts"],"sourcesContent":["import crypto from 'crypto'\nimport fs, { WriteStream } from 'fs'\nimport path from 'path'\n\nimport type { FetchAPIFileUploadOptions } from '../../config/types.js'\n\nimport { checkAndMakeDir, debugLog, deleteFile, getTempFilename } from './utilities.js'\n\ntype Handler = (\n  options: FetchAPIFileUploadOptions,\n  fieldname: string,\n  filename: string,\n) => {\n  cleanup: () => Promise<void> | void\n  complete: () => Buffer\n  dataHandler: (data: Buffer) => Promise<void> | void\n  getFilePath: () => string\n  getFileSize: () => number\n  getHash: () => string\n  getWritePromise: () => Promise<boolean>\n}\n\nexport const tempFileHandler: Handler = (options, fieldname, filename) => {\n  const tempFilePath = path.resolve(options.tempFileDir!, getTempFilename())\n  checkAndMakeDir({ createParentPath: true }, tempFilePath)\n\n  debugLog(options, `Temporary file path is ${tempFilePath}`)\n\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  debugLog(options, `Opening write stream for ${fieldname}->${filename}...`)\n  const writeStream = fs.createWriteStream(tempFilePath)\n  const writePromise = new Promise<boolean>((resolve, reject) => {\n    writeStream.on('finish', () => resolve(true))\n    writeStream.on('close', () => resolve(false))\n    writeStream.on('error', (err) => {\n      debugLog(options, `Error write temp file: ${err}`)\n      reject(err)\n    })\n  })\n\n  return {\n    cleanup: () => {\n      completed = true\n      return new Promise<void>((resolve) => {\n        const remove = () => deleteFile(tempFilePath, () => resolve())\n        if (writeStream.closed) {\n          remove()\n        } else {\n          writeStream.once('close', remove)\n          writeStream.destroy()\n        }\n      })\n    },\n    complete: () => {\n      completed = true\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      if (writeStream instanceof WriteStream) {\n        writeStream.end()\n      }\n      // Return empty buff since data was uploaded into a temp file.\n      return Buffer.concat([])\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      const ready = writeStream.write(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n      if (!ready) {\n        return new Promise<void>((resolve) => writeStream.once('drain', resolve))\n      }\n    },\n    getFilePath: () => tempFilePath,\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => writePromise,\n  }\n}\n\nexport const memHandler: Handler = (options, fieldname, filename) => {\n  const buffers: Buffer[] = []\n  const hash = crypto.createHash('md5')\n  let fileSize = 0\n  let completed = false\n\n  const getBuffer = () => Buffer.concat(buffers, fileSize)\n\n  return {\n    cleanup: () => {\n      completed = true\n      buffers.length = 0\n    },\n    complete: () => {\n      debugLog(options, `Upload ${fieldname}->${filename} completed, bytes:${fileSize}.`)\n      completed = true\n      const buffer = getBuffer()\n      buffers.length = 0\n      return buffer\n    },\n    dataHandler: (data) => {\n      if (completed === true) {\n        debugLog(options, `Error: got ${fieldname}->${filename} data chunk for completed upload!`)\n        return\n      }\n      buffers.push(data)\n      hash.update(data)\n      fileSize += data.length\n      debugLog(options, `Uploading ${fieldname}->${filename}, bytes:${fileSize}...`)\n    },\n    getFilePath: () => '',\n    getFileSize: () => fileSize,\n    getHash: () => hash.digest('hex'),\n    getWritePromise: () => Promise.resolve(true),\n  }\n}\n"],"names":["crypto","fs","WriteStream","path","checkAndMakeDir","debugLog","deleteFile","getTempFilename","tempFileHandler","options","fieldname","filename","tempFilePath","resolve","tempFileDir","createParentPath","hash","createHash","fileSize","completed","writeStream","createWriteStream","writePromise","Promise","reject","on","err","cleanup","remove","closed","once","destroy","complete","end","Buffer","concat","dataHandler","data","ready","write","update","length","getFilePath","getFileSize","getHash","digest","getWritePromise","memHandler","buffers","getBuffer","buffer","push"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,OAAOC,MAAMC,WAAW,QAAQ,KAAI;AACpC,OAAOC,UAAU,OAAM;AAIvB,SAASC,eAAe,EAAEC,QAAQ,EAAEC,UAAU,EAAEC,eAAe,QAAQ,iBAAgB;AAgBvF,OAAO,MAAMC,kBAA2B,CAACC,SAASC,WAAWC;IAC3D,MAAMC,eAAeT,KAAKU,OAAO,CAACJ,QAAQK,WAAW,EAAGP;IACxDH,gBAAgB;QAAEW,kBAAkB;IAAK,GAAGH;IAE5CP,SAASI,SAAS,CAAC,uBAAuB,EAAEG,cAAc;IAE1D,MAAMI,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhBd,SAASI,SAAS,CAAC,yBAAyB,EAAEC,UAAU,EAAE,EAAEC,SAAS,GAAG,CAAC;IACzE,MAAMS,cAAcnB,GAAGoB,iBAAiB,CAACT;IACzC,MAAMU,eAAe,IAAIC,QAAiB,CAACV,SAASW;QAClDJ,YAAYK,EAAE,CAAC,UAAU,IAAMZ,QAAQ;QACvCO,YAAYK,EAAE,CAAC,SAAS,IAAMZ,QAAQ;QACtCO,YAAYK,EAAE,CAAC,SAAS,CAACC;YACvBrB,SAASI,SAAS,CAAC,uBAAuB,EAAEiB,KAAK;YACjDF,OAAOE;QACT;IACF;IAEA,OAAO;QACLC,SAAS;YACPR,YAAY;YACZ,OAAO,IAAII,QAAc,CAACV;gBACxB,MAAMe,SAAS,IAAMtB,WAAWM,cAAc,IAAMC;gBACpD,IAAIO,YAAYS,MAAM,EAAE;oBACtBD;gBACF,OAAO;oBACLR,YAAYU,IAAI,CAAC,SAASF;oBAC1BR,YAAYW,OAAO;gBACrB;YACF;QACF;QACAC,UAAU;YACRb,YAAY;YACZd,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClF,IAAIE,uBAAuBlB,aAAa;gBACtCkB,YAAYa,GAAG;YACjB;YACA,8DAA8D;YAC9D,OAAOC,OAAOC,MAAM,CAAC,EAAE;QACzB;QACAC,aAAa,CAACC;YACZ,IAAIlB,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACA,MAAM2B,QAAQlB,YAAYmB,KAAK,CAACF;YAChCrB,KAAKwB,MAAM,CAACH;YACZnB,YAAYmB,KAAKI,MAAM;YACvBpC,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;YAC7E,IAAI,CAACoB,OAAO;gBACV,OAAO,IAAIf,QAAc,CAACV,UAAYO,YAAYU,IAAI,CAAC,SAASjB;YAClE;QACF;QACA6B,aAAa,IAAM9B;QACnB+B,aAAa,IAAMzB;QACnB0B,SAAS,IAAM5B,KAAK6B,MAAM,CAAC;QAC3BC,iBAAiB,IAAMxB;IACzB;AACF,EAAC;AAED,OAAO,MAAMyB,aAAsB,CAACtC,SAASC,WAAWC;IACtD,MAAMqC,UAAoB,EAAE;IAC5B,MAAMhC,OAAOhB,OAAOiB,UAAU,CAAC;IAC/B,IAAIC,WAAW;IACf,IAAIC,YAAY;IAEhB,MAAM8B,YAAY,IAAMf,OAAOC,MAAM,CAACa,SAAS9B;IAE/C,OAAO;QACLS,SAAS;YACPR,YAAY;YACZ6B,QAAQP,MAAM,GAAG;QACnB;QACAT,UAAU;YACR3B,SAASI,SAAS,CAAC,OAAO,EAAEC,UAAU,EAAE,EAAEC,SAAS,kBAAkB,EAAEO,SAAS,CAAC,CAAC;YAClFC,YAAY;YACZ,MAAM+B,SAASD;YACfD,QAAQP,MAAM,GAAG;YACjB,OAAOS;QACT;QACAd,aAAa,CAACC;YACZ,IAAIlB,cAAc,MAAM;gBACtBd,SAASI,SAAS,CAAC,WAAW,EAAEC,UAAU,EAAE,EAAEC,SAAS,iCAAiC,CAAC;gBACzF;YACF;YACAqC,QAAQG,IAAI,CAACd;YACbrB,KAAKwB,MAAM,CAACH;YACZnB,YAAYmB,KAAKI,MAAM;YACvBpC,SAASI,SAAS,CAAC,UAAU,EAAEC,UAAU,EAAE,EAAEC,SAAS,QAAQ,EAAEO,SAAS,GAAG,CAAC;QAC/E;QACAwB,aAAa,IAAM;QACnBC,aAAa,IAAMzB;QACnB0B,SAAS,IAAM5B,KAAK6B,MAAM,CAAC;QAC3BC,iBAAiB,IAAMvB,QAAQV,OAAO,CAAC;IACzC;AACF,EAAC"}

package/dist/uploads/fetchAPI-multipart/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAqBnD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;CACnB,CAAA;AAED,KAAK,8BAA8B,GAAG;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAA;CACtD,CAAA;AAED,KAAK,kBAAkB,GAAG,CAAC,IAAI,EAAE;IAC/B,OAAO,CAAC,EAAE,yBAAyB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;AAEzC,eAAO,MAAM,wBAAwB,EAAE,kBAiBtC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/uploads/fetchAPI-multipart/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAyBnD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;CACnB,CAAA;AAED,KAAK,8BAA8B,GAAG;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAA;CACtD,CAAA;AAED,KAAK,kBAAkB,GAAG,CAAC,IAAI,EAAE;IAC/B,OAAO,CAAC,EAAE,yBAAyB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;AAEzC,eAAO,MAAM,wBAAwB,EAAE,kBA2CtC,CAAA"}