texlite 0.5.5 → 0.6.5

package/dist/server/archive.js

@@ -1,19 +1,23 @@
 import fs from "node:fs";
 import path from "node:path";
+import { pipeline } from "node:stream/promises";
 import { ZipFile } from "yazl";
-import { sourceRoot } from "./files.js";
+import { assertNoSourceSymlinks, sourceRoot, symbolicLinkError } from "./files.js";
 export function createProjectArchive(config, projectId) {
     const root = sourceRoot(config, projectId);
+    assertNoSourceSymlinks(config, projectId);
     const archive = new ZipFile();
     const addDirectory = (directory, prefix) => {
         const entries = fs.readdirSync(directory, { withFileTypes: true });
         if (entries.length === 0 && prefix)
             archive.addEmptyDirectory(`${prefix}/`);
         for (const entry of entries) {
-            if (entry.name === ".git" || entry.isSymbolicLink())
-                continue;
             const absolute = path.join(directory, entry.name);
             const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (entry.isSymbolicLink())
+                throw symbolicLinkError(relative);
+            if (entry.name === ".git")
+                continue;
             if (entry.isDirectory())
                 addDirectory(absolute, relative);
             else if (entry.isFile())
@@ -24,3 +28,16 @@ export function createProjectArchive(config, projectId) {
     archive.end();
     return archive;
 }
+/**
+ * Materialize an archive before releasing the project read lock.
+ *
+ * yazl reads added files asynchronously. Returning its output stream directly
+ * from a route would therefore release the project lock while the ZIP is
+ * still being assembled, allowing a concurrent write to produce a mixed
+ * archive. Writing to a private temporary file makes the bytes immutable
+ * before the caller starts the HTTP stream.
+ */
+export async function writeProjectArchive(config, projectId, destination) {
+    const archive = createProjectArchive(config, projectId);
+    await pipeline(archive.outputStream, fs.createWriteStream(destination, { mode: 0o600 }));
+}

package/dist/server/auth.js

@@ -11,16 +11,27 @@ export function publicUser(user) {
         createdAt: user.created_at
     };
 }
+const requestUserCache = new WeakMap();
+export function clearCurrentUserCache(request) {
+    requestUserCache.delete(request);
+}
 export function currentUser(request, db) {
+    if (requestUserCache.has(request)) {
+        return requestUserCache.get(request) ?? null;
+    }
     const token = request.cookies.texlite_session;
-    if (!token)
+    if (!token) {
+        requestUserCache.set(request, null);
         return null;
+    }
     const row = db.prepare(`
     SELECT u.* FROM sessions s
     JOIN users u ON u.id = s.user_id
     WHERE s.id = ? AND s.expires_at > ? AND u.disabled = 0
   `).get(digestToken(token), new Date().toISOString());
-    return row ?? null;
+    const user = row ?? null;
+    requestUserCache.set(request, user);
+    return user;
 }
 export function requireUser(request, reply, db) {
     const user = currentUser(request, db);