synthos 0.7.2 → 0.9.0

package/src/service/useFileRoutes.ts

@@ -0,0 +1,127 @@
+import { Application } from 'express';
+import express from 'express';
+import fs from 'fs/promises';
+import path from 'path';
+import { SynthOSConfig } from '../init';
+import { checkIfExists, ensureFolderExists } from '../files';
+
+export function useFileRoutes(config: SynthOSConfig, app: Application): void {
+    // List files in a page's files/ folder
+    app.get('/api/files/:page', async (req, res) => {
+        try {
+            const folder = filesFolder(config, req.params.page);
+            if (!(await checkIfExists(folder))) {
+                res.json({ files: [] });
+                return;
+            }
+
+            const entries = await fs.readdir(folder);
+            const files: { name: string; size: number }[] = [];
+            for (const entry of entries) {
+                const stat = await fs.stat(path.join(folder, entry));
+                if (stat.isFile()) {
+                    files.push({ name: entry, size: stat.size });
+                }
+            }
+            res.json({ files });
+        } catch (err: unknown) {
+            console.error(err);
+            res.status(500).json({ error: (err as Error).message });
+        }
+    });
+
+    // Download/serve a specific file
+    app.get('/api/files/:page/:filename', async (req, res) => {
+        try {
+            const filePath = safeFilePath(config, req.params.page, req.params.filename);
+            if (!filePath) {
+                res.status(400).json({ error: 'Invalid filename' });
+                return;
+            }
+
+            if (!(await checkIfExists(filePath))) {
+                res.status(404).json({ error: 'File not found' });
+                return;
+            }
+
+            res.sendFile(filePath);
+        } catch (err: unknown) {
+            console.error(err);
+            res.status(500).json({ error: (err as Error).message });
+        }
+    });
+
+    // Upload a file (raw body + x-filename header)
+    app.post('/api/files/:page', express.raw({ type: '*/*', limit: '50mb' }), async (req, res) => {
+        try {
+            const filename = req.headers['x-filename'] as string | undefined;
+            if (!filename || filename.trim().length === 0) {
+                res.status(400).json({ error: 'x-filename header is required' });
+                return;
+            }
+
+            const filePath = safeFilePath(config, req.params.page, filename);
+            if (!filePath) {
+                res.status(400).json({ error: 'Invalid filename' });
+                return;
+            }
+
+            const folder = filesFolder(config, req.params.page);
+            await ensureFolderExists(folder);
+            await fs.writeFile(filePath, req.body as Buffer);
+
+            const stat = await fs.stat(filePath);
+            res.status(201).json({ name: filename, size: stat.size });
+        } catch (err: unknown) {
+            console.error(err);
+            res.status(500).json({ error: (err as Error).message });
+        }
+    });
+
+    // Delete a file
+    app.delete('/api/files/:page/:filename', async (req, res) => {
+        try {
+            const filePath = safeFilePath(config, req.params.page, req.params.filename);
+            if (!filePath) {
+                res.status(400).json({ error: 'Invalid filename' });
+                return;
+            }
+
+            if (!(await checkIfExists(filePath))) {
+                res.status(404).json({ error: 'File not found' });
+                return;
+            }
+
+            await fs.unlink(filePath);
+            res.json({ deleted: true });
+        } catch (err: unknown) {
+            console.error(err);
+            res.status(500).json({ error: (err as Error).message });
+        }
+    });
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function filesFolder(config: SynthOSConfig, page: string): string {
+    return path.join(config.pagesFolder, 'pages', page, 'files');
+}
+
+/**
+ * Resolve a filename inside the page's files/ folder with path-traversal protection.
+ * Returns the absolute path if safe, or null if the filename is invalid.
+ */
+function safeFilePath(config: SynthOSConfig, page: string, filename: string): string | null {
+    // Reject obviously bad filenames
+    if (!filename || filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+        return null;
+    }
+    const folder = filesFolder(config, page);
+    const resolved = path.resolve(folder, filename);
+    if (!resolved.startsWith(path.resolve(folder))) {
+        return null;
+    }
+    return resolved;
+}