merge: integrate WP5-05 and WP5-06 baseline
# Conflicts: # package.json
This commit is contained in:
suyx
@@ -9,13 +9,16 @@
|
||||
"typecheck": "tsc --noEmit -p tsconfig.json"
|
||||
},
|
||||
"dependencies": {
|
||||
"@dada/asset-release-manifest": "workspace:*",
|
||||
"@dada/shared-contracts": "workspace:*",
|
||||
"@dada/static-sticker-catalog": "workspace:*",
|
||||
"@fastify/multipart": "10.1.0",
|
||||
"@fastify/swagger": "9.8.1",
|
||||
"@sinclair/typebox": "0.34.52",
|
||||
"better-sqlite3": "13.0.1",
|
||||
"drizzle-orm": "0.45.2",
|
||||
"fastify": "5.10.0"
|
||||
"fastify": "5.10.0",
|
||||
"sharp": "0.35.3"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/better-sqlite3": "7.6.13",
|
||||
|
||||
+361
-1
@@ -134,6 +134,7 @@ import {
|
||||
type RegistrationCompleteRequest,
|
||||
type RegistrationSendRequest,
|
||||
} from "@dada/shared-contracts";
|
||||
import type { AssetReleaseReader } from "@dada/asset-release-manifest";
|
||||
import swagger from "@fastify/swagger";
|
||||
import multipart from "@fastify/multipart";
|
||||
import Fastify, { type FastifyReply } from "fastify";
|
||||
@@ -177,6 +178,9 @@ import type { RecentAssetService } from "./recent-assets.js";
|
||||
import type { AmapAdapter } from "./amap-adapter.js";
|
||||
import { ModelConfigurationError } from "./model-configuration.js";
|
||||
import type { ModelConfigurationService } from "./model-configuration.js";
|
||||
import { StickerReleaseError } from "./sticker-release-errors.js";
|
||||
import type { StickerReleaseService } from "./sticker-releases.js";
|
||||
import type { ManagedStorage } from "./managed-storage.js";
|
||||
|
||||
const defaultBootstrap: BootstrapResponse = {
|
||||
app_version: "0.0.0",
|
||||
@@ -192,6 +196,7 @@ const defaultBootstrap: BootstrapResponse = {
|
||||
|
||||
export interface CreateAppOptions {
|
||||
amap?: AmapAdapter;
|
||||
assetReleases?: AssetReleaseReader;
|
||||
bootstrap?: () => BootstrapResponse | Promise<BootstrapResponse>;
|
||||
browserGate?: boolean;
|
||||
browserSupportRelease?: BrowserSupportRelease;
|
||||
@@ -205,7 +210,20 @@ export interface CreateAppOptions {
|
||||
publicAssets?: PublicAssetResolver;
|
||||
recentAssets?: RecentAssetService;
|
||||
projects?: ProjectService;
|
||||
storage?: ManagedStorage;
|
||||
previewAssetAuthorizer?: (input: {
|
||||
releaseVersion: string;
|
||||
resourceId: string;
|
||||
userId: string;
|
||||
}) => boolean | Promise<boolean>;
|
||||
privateAssetAdminAuthorizer?: (input: {
|
||||
adminUserId: string;
|
||||
ownerId: string;
|
||||
releaseVersion: string;
|
||||
resourceId: string;
|
||||
}) => boolean | Promise<boolean>;
|
||||
registration?: RegistrationService;
|
||||
stickers?: StickerReleaseService;
|
||||
}
|
||||
|
||||
const supportGateDirectory = resolve(process.env.DADA_SUPPORT_GATE_ROOT ?? "apps/web/support-gate");
|
||||
@@ -361,6 +379,24 @@ function modelConfigurationFailure(reply: FastifyReply, correlationId: string, e
|
||||
return reply.code(status).send(createErrorEnvelope({ code: error.code, correlationId, details }));
|
||||
}
|
||||
|
||||
function stickerReleaseFailure(reply: FastifyReply, correlationId: string, error: unknown) {
|
||||
if (error instanceof StickerReleaseError) return reply.code(error.httpStatus).send(null);
|
||||
return latestExportFailure(reply, correlationId, error);
|
||||
}
|
||||
|
||||
function assetCleanupFailure(reply: FastifyReply, correlationId: string, error: unknown) {
|
||||
const code = error instanceof Error ? error.message : "";
|
||||
if (code === "ASSET_HISTORY_REFERENCE_CONFLICT" || code === "ASSET_CLEANUP_CANDIDATE_STALE") {
|
||||
return reply.code(409).send(createErrorEnvelope({ code, correlationId }));
|
||||
}
|
||||
if (code === "IDEMPOTENCY_KEY_CONFLICT") {
|
||||
return reply.code(409).send(createErrorEnvelope({ code: "IDEMPOTENCY_KEY_CONFLICT", correlationId }));
|
||||
}
|
||||
if (code === "cleanup_candidates_invalid") return reply.code(400).send(null);
|
||||
if (code === "cleanup_uncommitted") return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId }));
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId }));
|
||||
}
|
||||
|
||||
function generationTaskResponse(task: GenerationTaskView) {
|
||||
return {
|
||||
confirmed_credit_cost: task.confirmedCreditCost,
|
||||
@@ -816,13 +852,232 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
status: "ready",
|
||||
}));
|
||||
|
||||
app.get(
|
||||
"/api/v1/static-stickers/current",
|
||||
{ schema: { hide: true } },
|
||||
async (_request, reply) => {
|
||||
if (!options.stickers) return reply.code(503).send();
|
||||
reply.header("Cache-Control", "no-cache");
|
||||
return options.stickers.listPublic();
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/static-stickers/:resourceVersion",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.stickers) return reply.code(404).send();
|
||||
const { resourceVersion } = request.params as { resourceVersion: string };
|
||||
const catalog = options.stickers.listPublic(resourceVersion);
|
||||
if (!catalog.release_version) return reply.code(404).send();
|
||||
reply.header("Cache-Control", "public, max-age=31536000, immutable");
|
||||
return catalog;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/assets/static-stickers",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration || !options.stickers) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const session = token ? options.registration.readAdminSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
return options.stickers.adminView();
|
||||
},
|
||||
);
|
||||
|
||||
app.post(
|
||||
"/api/v1/admin/assets/static-stickers",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!request.isMultipart()) return reply.code(400).send(null);
|
||||
if (!options.registration || !options.stickers) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const idempotencyKey = headerValue(request.headers["idempotency-key"]);
|
||||
const csrfToken = headerValue(request.headers["x-csrf-token"]);
|
||||
if (!token) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
if (!idempotencyKey || !/^[A-Za-z0-9_-]{32,200}$/.test(idempotencyKey)
|
||||
|| !csrfToken || !/^[A-Za-z0-9_-]{43,64}$/.test(csrfToken)) return reply.code(400).send(null);
|
||||
try {
|
||||
const admin = options.registration.authorizeAdminMutation({ csrfToken, sessionToken: token });
|
||||
const values = new Map<string, string>();
|
||||
const allowedFields = new Set(["enabled", "order", "original_byte_size", "original_sha256", "part", "stable_id"]);
|
||||
let result: Awaited<ReturnType<StickerReleaseService["upload"]>> | undefined;
|
||||
for await (const part of request.parts({ limits: { fileSize: 20 * 1024 * 1024, files: 1, fields: 8, parts: 9 } })) {
|
||||
if (part.type === "field") {
|
||||
if (result || !allowedFields.has(part.fieldname) || values.has(part.fieldname) || typeof part.value !== "string") throw new StickerReleaseError("sticker_upload_invalid");
|
||||
values.set(part.fieldname, part.value);
|
||||
continue;
|
||||
}
|
||||
if (result || part.fieldname !== "sticker_file" || !part.filename
|
||||
|| !new Set(["image/png", "image/webp"]).has(part.mimetype)) throw new StickerReleaseError("sticker_upload_invalid");
|
||||
const stableId = values.get("stable_id");
|
||||
const partValue = Number(values.get("part"));
|
||||
const order = Number(values.get("order"));
|
||||
const enabled = values.get("enabled");
|
||||
const expectedByteSize = Number(values.get("original_byte_size"));
|
||||
const expectedSha256 = values.get("original_sha256");
|
||||
if (!stableId || !expectedSha256 || !new Set(["true", "false"]).has(enabled ?? "")) throw new StickerReleaseError("sticker_upload_invalid");
|
||||
result = await options.stickers.upload({
|
||||
actorId: admin.userId,
|
||||
content: part.file,
|
||||
enabled: enabled === "true",
|
||||
expectedByteSize,
|
||||
expectedMimeType: part.mimetype as "image/png" | "image/webp",
|
||||
expectedSha256,
|
||||
fileName: part.filename,
|
||||
idempotencyKey,
|
||||
order,
|
||||
part: partValue,
|
||||
stableId,
|
||||
});
|
||||
if (part.file.truncated) throw new StickerReleaseError("sticker_upload_invalid");
|
||||
}
|
||||
if (!result) throw new StickerReleaseError("sticker_upload_invalid");
|
||||
return reply.code(result.created ? 201 : 200).send(result);
|
||||
} catch (error) {
|
||||
return error instanceof RegistrationError
|
||||
? registrationFailure(reply, request.id, error)
|
||||
: stickerReleaseFailure(reply, request.id, error);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.patch(
|
||||
"/api/v1/admin/assets/static-stickers/:stableId",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration || !options.stickers) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const csrfToken = headerValue(request.headers["x-csrf-token"]);
|
||||
if (!token || !csrfToken) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
try {
|
||||
const admin = options.registration.authorizeAdminMutation({ csrfToken, sessionToken: token });
|
||||
const body = request.body as { enabled?: boolean; order?: number; part?: number } | undefined;
|
||||
if (!body || Object.keys(body).length === 0 || Object.keys(body).some((key) => !new Set(["enabled", "order", "part"]).has(key))) {
|
||||
throw new StickerReleaseError("sticker_update_invalid");
|
||||
}
|
||||
return options.stickers.update({
|
||||
actorId: admin.userId,
|
||||
...(typeof body.enabled === "boolean" ? { enabled: body.enabled } : {}),
|
||||
...(typeof body.order === "number" ? { order: body.order } : {}),
|
||||
...(typeof body.part === "number" ? { part: body.part } : {}),
|
||||
stableId: (request.params as { stableId: string }).stableId,
|
||||
});
|
||||
} catch (error) {
|
||||
return error instanceof RegistrationError
|
||||
? registrationFailure(reply, request.id, error)
|
||||
: stickerReleaseFailure(reply, request.id, error);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/assets/static-stickers/cleanup/candidates",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration || !options.storage) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const session = token ? options.registration.readAdminSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
try {
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
return options.storage.listAssetCleanupCandidates();
|
||||
} catch (error) {
|
||||
return assetCleanupFailure(reply, request.id, error);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.post(
|
||||
"/api/v1/admin/assets/static-stickers/cleanup/intents",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration || !options.storage) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const csrfToken = headerValue(request.headers["x-csrf-token"]);
|
||||
const idempotencyKey = headerValue(request.headers["idempotency-key"]);
|
||||
if (!token || !csrfToken) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
if (!idempotencyKey || !/^[A-Za-z0-9_-]{32,200}$/.test(idempotencyKey) || !/^[A-Za-z0-9_-]{43,64}$/.test(csrfToken)) return reply.code(400).send(null);
|
||||
try {
|
||||
const admin = options.registration.authorizeAdminMutation({ csrfToken, sessionToken: token });
|
||||
const body = request.body as { file_ids?: string[]; snapshot_version?: string } | undefined;
|
||||
return reply.code(201).send(options.storage.createAssetCleanupIntent({
|
||||
actorId: admin.userId,
|
||||
fileIds: body?.file_ids ?? [],
|
||||
idempotencyKey,
|
||||
snapshotVersion: body?.snapshot_version ?? "",
|
||||
}));
|
||||
} catch (error) {
|
||||
return assetCleanupFailure(reply, request.id, error);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.post(
|
||||
"/api/v1/admin/assets/static-stickers/cleanup/intents/:requestId/confirm",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration || !options.storage) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const csrfToken = headerValue(request.headers["x-csrf-token"]);
|
||||
if (!token || !csrfToken) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
if (!/^[A-Za-z0-9_-]{43,64}$/.test(csrfToken)) return reply.code(400).send(null);
|
||||
try {
|
||||
const admin = options.registration.authorizeAdminMutation({ csrfToken, sessionToken: token });
|
||||
const body = request.body as { confirmation_token?: string } | undefined;
|
||||
const requestId = (request.params as { requestId: string }).requestId;
|
||||
return reply.send(options.storage.confirmAssetCleanupIntent({
|
||||
actorId: admin.userId,
|
||||
confirmationToken: body?.confirmation_token ?? "",
|
||||
requestId,
|
||||
}));
|
||||
} catch (error) {
|
||||
return assetCleanupFailure(reply, request.id, error);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/public/:resourceVersion/manifest",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
const { resourceVersion } = request.params as { resourceVersion: string };
|
||||
const manifest = options.assetReleases?.project("public_release_asset", resourceVersion);
|
||||
if (!manifest) return reply.code(404).send();
|
||||
reply.header("Cache-Control", "public, max-age=31536000, immutable");
|
||||
reply.header("ETag", `"sha256-${manifest.manifest_sha256}"`);
|
||||
return manifest;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/public/:resourceVersion/:assetId",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
const { assetId, resourceVersion } = request.params as { assetId?: string; resourceVersion?: string };
|
||||
const resource = assetId && resourceVersion
|
||||
? options.publicAssets?.read(resourceVersion, assetId)
|
||||
? options.assetReleases?.read("public_release_asset", resourceVersion, assetId)
|
||||
?? options.publicAssets?.read(resourceVersion, assetId)
|
||||
?? options.stickers?.readPublicAsset(
|
||||
resourceVersion,
|
||||
assetId,
|
||||
(request.query as { variant?: string }).variant === "thumbnail" ? "thumbnail" : "original",
|
||||
)
|
||||
: undefined;
|
||||
if (!resource) return reply.code(404).send();
|
||||
reply.type(resource.mimeType);
|
||||
@@ -833,6 +1088,111 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/preview/:resourceVersion/manifest",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const session = token ? options.registration.readUserSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
const { resourceVersion } = request.params as { resourceVersion: string };
|
||||
const available = options.assetReleases?.project("internal_preview_asset", resourceVersion);
|
||||
if (!available || !options.previewAssetAuthorizer) return reply.code(404).send();
|
||||
const authorizedIds: string[] = [];
|
||||
for (const item of available.items) {
|
||||
if (await options.previewAssetAuthorizer({
|
||||
releaseVersion: resourceVersion,
|
||||
resourceId: item.resource_id,
|
||||
userId: session.userId,
|
||||
})) authorizedIds.push(item.resource_id);
|
||||
}
|
||||
if (authorizedIds.length === 0) return reply.code(404).send();
|
||||
const manifest = options.assetReleases?.project("internal_preview_asset", resourceVersion, { resourceIds: authorizedIds });
|
||||
if (!manifest) return reply.code(404).send();
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Vary", "Cookie");
|
||||
return manifest;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/preview/:resourceVersion/:assetId",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const session = token ? options.registration.readUserSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
const { assetId, resourceVersion } = request.params as { assetId: string; resourceVersion: string };
|
||||
const authorized = await options.previewAssetAuthorizer?.({ resourceId: assetId, releaseVersion: resourceVersion, userId: session.userId });
|
||||
const resource = authorized ? options.assetReleases?.read("internal_preview_asset", resourceVersion, assetId) : undefined;
|
||||
if (!resource) return reply.code(404).send();
|
||||
reply.type(resource.mimeType);
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Content-Disposition", "inline");
|
||||
reply.header("Vary", "Cookie");
|
||||
return resource.bytes;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/private-assets/:resourceVersion/manifest",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const session = token ? options.registration.readUserSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
const { resourceVersion } = request.params as { resourceVersion: string };
|
||||
const manifest = options.assetReleases?.project("private_user_asset", resourceVersion, { ownerId: session.userId });
|
||||
if (!manifest) return reply.code(404).send();
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Vary", "Cookie");
|
||||
return manifest;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/private-assets/:resourceVersion/:assetId",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const userToken = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const userSession = userToken ? options.registration.readUserSession(userToken) : undefined;
|
||||
const adminToken = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const adminSession = adminToken ? options.registration.readAdminSession(adminToken) : undefined;
|
||||
if (!userSession && !adminSession) {
|
||||
return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
}
|
||||
const { assetId, resourceVersion } = request.params as { assetId: string; resourceVersion: string };
|
||||
const resource = options.assetReleases?.read("private_user_asset", resourceVersion, assetId);
|
||||
if (!resource?.ownerId) return reply.code(404).send();
|
||||
const controlledAdmin = adminSession
|
||||
? await options.privateAssetAdminAuthorizer?.({
|
||||
adminUserId: adminSession.user_id,
|
||||
ownerId: resource.ownerId,
|
||||
releaseVersion: resource.releaseVersion,
|
||||
resourceId: resource.resourceId,
|
||||
})
|
||||
: false;
|
||||
if (userSession?.userId !== resource.ownerId && !controlledAdmin) return reply.code(404).send();
|
||||
reply.type(resource.mimeType);
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Content-Disposition", "inline");
|
||||
reply.header("Vary", "Cookie");
|
||||
return resource.bytes;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/recent",
|
||||
{
|
||||
|
||||
@@ -18,6 +18,7 @@ import { StructuredJsonlLogger } from "./structured-log.js";
|
||||
import { attachApiSupervisorControl, initializeApiCredentialClients, receiveApiCredentials } from "./supervisor-channel.js";
|
||||
import { ModelConfigurationService } from "./model-configuration.js";
|
||||
import { MockAmapAdapter } from "./amap-adapter.js";
|
||||
import { StickerReleaseService } from "./sticker-releases.js";
|
||||
|
||||
const credentialChannelEnabled = process.argv.includes("--dada-credential-stdin");
|
||||
let registration: RegistrationService | undefined;
|
||||
@@ -27,6 +28,7 @@ let storage: ManagedStorage | undefined;
|
||||
let latestExports: LatestExportService | undefined;
|
||||
let models: ModelConfigurationService | undefined;
|
||||
let recentAssets: RecentAssetService | undefined;
|
||||
let stickers: StickerReleaseService | undefined;
|
||||
const instanceConfigPath = process.env.DADA_INSTANCE_CONFIG_PATH ?? defaultInstanceConfigPath();
|
||||
if (credentialChannelEnabled) {
|
||||
const clients = initializeApiCredentialClients(await receiveApiCredentials());
|
||||
@@ -48,11 +50,14 @@ if (credentialChannelEnabled) {
|
||||
projects = new ProjectService({ databasePath });
|
||||
credits = new CreditService({ databasePath });
|
||||
storage = new ManagedStorage({ dataRoot, databasePath });
|
||||
stickers = new StickerReleaseService({ databasePath, storage });
|
||||
latestExports = new LatestExportService({ databasePath, storage });
|
||||
models = new ModelConfigurationService({ database: registration.database });
|
||||
recentAssets = new RecentAssetService({ database: registration.database });
|
||||
registration.applySecureConfig(readSecureConfigCandidate(instanceConfigPath));
|
||||
} catch (error) {
|
||||
stickers?.close();
|
||||
stickers = undefined;
|
||||
latestExports?.close();
|
||||
latestExports = undefined;
|
||||
storage?.close();
|
||||
@@ -79,6 +84,8 @@ const app = await createApp({
|
||||
...(projects ? { projects } : {}),
|
||||
...(registration ? { registration } : {}),
|
||||
...(recentAssets ? { recentAssets } : {}),
|
||||
...(stickers ? { stickers } : {}),
|
||||
...(storage ? { storage } : {}),
|
||||
});
|
||||
|
||||
await app.listen({
|
||||
@@ -97,6 +104,7 @@ if (controlPipeIndex >= 0) {
|
||||
projects?.close();
|
||||
registration?.close();
|
||||
storage?.close();
|
||||
stickers?.close();
|
||||
});
|
||||
try {
|
||||
const dataRoot = readConfiguredLocalDataRoot(instanceConfigPath);
|
||||
|
||||
@@ -75,6 +75,31 @@ interface CleanupQueueRow {
|
||||
relative_path: string;
|
||||
}
|
||||
|
||||
export interface AssetCleanupCandidateView {
|
||||
byte_size: number;
|
||||
file_id: string;
|
||||
file_kind: "original" | "thumbnail";
|
||||
hash_prefix: string;
|
||||
reference_count: 0;
|
||||
resource_version: string;
|
||||
stable_id: string;
|
||||
}
|
||||
|
||||
export interface AssetCleanupCandidatesView {
|
||||
candidate_snapshot_version: string;
|
||||
expires_at: string;
|
||||
items: AssetCleanupCandidateView[];
|
||||
}
|
||||
|
||||
export interface AssetCleanupIntentView {
|
||||
confirmation_token: string;
|
||||
expires_at: string;
|
||||
file_count: number;
|
||||
request_id: string;
|
||||
status: "pending_confirmation" | "denied" | "queued" | "completed";
|
||||
total_bytes: number;
|
||||
}
|
||||
|
||||
export class StorageCapacityError extends Error {
|
||||
readonly code = "STORAGE_CAPACITY_EXCEEDED";
|
||||
readonly httpStatus = 507;
|
||||
@@ -104,6 +129,10 @@ function auditExpiry(occurredAt: number) {
|
||||
return occurredAt + auditRetentionMilliseconds;
|
||||
}
|
||||
|
||||
function digest(value: string) {
|
||||
return createHash("sha256").update(value, "utf8").digest("hex");
|
||||
}
|
||||
|
||||
function validatePositiveBytes(value: number, name: string) {
|
||||
if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${name}_invalid`);
|
||||
}
|
||||
@@ -255,6 +284,28 @@ export class ManagedStorage {
|
||||
FOREIGN KEY (request_id) REFERENCES asset_cleanup_requests(request_id),
|
||||
FOREIGN KEY (managed_file_id) REFERENCES managed_files(file_id)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS asset_cleanup_candidate_snapshots (
|
||||
snapshot_version TEXT PRIMARY KEY,
|
||||
items_json TEXT NOT NULL,
|
||||
created_at INTEGER NOT NULL,
|
||||
expires_at INTEGER NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS sticker_managed_file_history (
|
||||
managed_file_id TEXT NOT NULL,
|
||||
stable_id TEXT NOT NULL,
|
||||
resource_version TEXT NOT NULL,
|
||||
file_kind TEXT NOT NULL CHECK (file_kind IN ('original', 'thumbnail')),
|
||||
created_at INTEGER NOT NULL,
|
||||
PRIMARY KEY (managed_file_id, file_kind),
|
||||
FOREIGN KEY (managed_file_id) REFERENCES managed_files(file_id)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS project_sticker_asset_refs (
|
||||
reference_id TEXT PRIMARY KEY,
|
||||
project_id TEXT NOT NULL,
|
||||
stable_id TEXT NOT NULL,
|
||||
resource_version TEXT NOT NULL,
|
||||
created_at INTEGER NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS admin_operation_logs (
|
||||
log_id TEXT PRIMARY KEY,
|
||||
actor_type TEXT NOT NULL CHECK (actor_type IN ('system', 'super_admin')),
|
||||
@@ -277,6 +328,49 @@ export class ManagedStorage {
|
||||
if (!managedFileColumns.some((column) => column.name === "owner_ref")) {
|
||||
this.database.exec("ALTER TABLE managed_files ADD COLUMN owner_ref TEXT");
|
||||
}
|
||||
if (!managedFileColumns.some((column) => column.name === "cleanup_status")) {
|
||||
this.database.exec("ALTER TABLE managed_files ADD COLUMN cleanup_status TEXT");
|
||||
}
|
||||
const cleanupRequestColumns = this.database.prepare("PRAGMA table_info(asset_cleanup_requests)").all() as Array<{ name: string }>;
|
||||
const cleanupRequestAdditions: Array<[string, string]> = [
|
||||
["created_by", "TEXT"],
|
||||
["confirmed_by", "TEXT"],
|
||||
["snapshot_version", "TEXT"],
|
||||
["expires_at", "INTEGER"],
|
||||
["confirmation_token_digest", "TEXT"],
|
||||
["idempotency_key_digest", "TEXT"],
|
||||
["request_hash", "TEXT"],
|
||||
["file_count", "INTEGER"],
|
||||
["total_bytes", "INTEGER"],
|
||||
["denied_reason", "TEXT"],
|
||||
];
|
||||
for (const [column, type] of cleanupRequestAdditions) {
|
||||
if (!cleanupRequestColumns.some((item) => item.name === column)) {
|
||||
this.database.exec(`ALTER TABLE asset_cleanup_requests ADD COLUMN ${column} ${type}`);
|
||||
}
|
||||
}
|
||||
const cleanupItemColumns = this.database.prepare("PRAGMA table_info(asset_cleanup_request_items)").all() as Array<{ name: string }>;
|
||||
const cleanupItemAdditions: Array<[string, string]> = [
|
||||
["stable_id", "TEXT"],
|
||||
["resource_version", "TEXT"],
|
||||
["file_kind", "TEXT"],
|
||||
["byte_size", "INTEGER"],
|
||||
["sha256_prefix", "TEXT"],
|
||||
];
|
||||
for (const [column, type] of cleanupItemAdditions) {
|
||||
if (!cleanupItemColumns.some((item) => item.name === column)) {
|
||||
this.database.exec(`ALTER TABLE asset_cleanup_request_items ADD COLUMN ${column} ${type}`);
|
||||
}
|
||||
}
|
||||
this.database.exec(`
|
||||
CREATE UNIQUE INDEX IF NOT EXISTS asset_cleanup_requests_actor_idempotency
|
||||
ON asset_cleanup_requests (created_by, idempotency_key_digest)
|
||||
WHERE created_by IS NOT NULL AND idempotency_key_digest IS NOT NULL;
|
||||
CREATE INDEX IF NOT EXISTS sticker_managed_file_history_lookup
|
||||
ON sticker_managed_file_history (stable_id, resource_version, file_kind);
|
||||
CREATE INDEX IF NOT EXISTS asset_cleanup_candidate_snapshots_expiry
|
||||
ON asset_cleanup_candidate_snapshots (expires_at);
|
||||
`);
|
||||
ensureAdminOperationAuditSchema(this.database, Date.now());
|
||||
const initial = classifyCapacity(0, 0);
|
||||
this.database.prepare(`
|
||||
@@ -299,6 +393,106 @@ export class ManagedStorage {
|
||||
return withReservations;
|
||||
}
|
||||
|
||||
private readAssetCleanupCandidates(): AssetCleanupCandidateView[] {
|
||||
const releaseReferenceClause = this.tableExists("sticker_release_items") ? `
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM sticker_release_items release_items
|
||||
WHERE release_items.original_file_id = mf.file_id OR release_items.thumbnail_file_id = mf.file_id
|
||||
)` : "";
|
||||
return this.database.prepare(`
|
||||
SELECT
|
||||
mf.file_id,
|
||||
mf.byte_size,
|
||||
history.stable_id,
|
||||
history.resource_version,
|
||||
history.file_kind,
|
||||
substr(mf.sha256, 1, 12) AS hash_prefix,
|
||||
0 AS reference_count
|
||||
FROM sticker_managed_file_history history
|
||||
JOIN managed_files mf ON mf.file_id = history.managed_file_id
|
||||
WHERE mf.status = 'committed'
|
||||
AND mf.cleanup_status IS NULL
|
||||
AND mf.file_kind IN ('sticker_original', 'sticker_thumbnail')
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM project_asset_refs refs WHERE refs.managed_file_id = mf.file_id
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM project_sticker_asset_refs project_refs
|
||||
WHERE project_refs.stable_id = history.stable_id
|
||||
AND project_refs.resource_version = history.resource_version
|
||||
)
|
||||
${releaseReferenceClause}
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM asset_cleanup_request_items request_items
|
||||
JOIN asset_cleanup_requests requests ON requests.request_id = request_items.request_id
|
||||
WHERE request_items.managed_file_id = mf.file_id
|
||||
AND requests.status IN ('pending_confirmation', 'queued')
|
||||
)
|
||||
ORDER BY history.stable_id, history.resource_version, history.file_kind, mf.file_id
|
||||
`).all() as AssetCleanupCandidateView[];
|
||||
}
|
||||
|
||||
private assertActiveAdmin(actorId: string) {
|
||||
const admin = this.database.prepare(`
|
||||
SELECT 1 AS allowed FROM users u
|
||||
JOIN admin_access access ON access.user_id = u.user_id
|
||||
WHERE u.user_id = ? AND u.role = 'super_admin' AND u.status = 'active' AND access.allowed = 1
|
||||
`).get(actorId);
|
||||
if (!admin) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
}
|
||||
|
||||
private assetReferenceCount(fileId: string, requestId: string) {
|
||||
const projectOrRelease = (this.database.prepare(`
|
||||
SELECT COUNT(*) AS count FROM project_asset_refs WHERE managed_file_id = ?
|
||||
`).get(fileId) as { count: number }).count;
|
||||
const releaseItems = this.tableExists("sticker_release_items")
|
||||
? (this.database.prepare(`
|
||||
SELECT COUNT(*) AS count FROM sticker_release_items
|
||||
WHERE original_file_id = ? OR thumbnail_file_id = ?
|
||||
`).get(fileId, fileId) as { count: number }).count
|
||||
: 0;
|
||||
const projectStickerRefs = (this.database.prepare(`
|
||||
SELECT COUNT(*) AS count
|
||||
FROM sticker_managed_file_history history
|
||||
JOIN project_sticker_asset_refs refs
|
||||
ON refs.stable_id = history.stable_id AND refs.resource_version = history.resource_version
|
||||
WHERE history.managed_file_id = ?
|
||||
`).get(fileId) as { count: number }).count;
|
||||
const otherCleanup = (this.database.prepare(`
|
||||
SELECT COUNT(*) AS count FROM asset_cleanup_request_items items
|
||||
JOIN asset_cleanup_requests requests ON requests.request_id = items.request_id
|
||||
WHERE items.managed_file_id = ? AND items.request_id <> ?
|
||||
AND requests.status IN ('pending_confirmation', 'queued')
|
||||
`).get(fileId, requestId) as { count: number }).count;
|
||||
return projectOrRelease + releaseItems + projectStickerRefs + otherCleanup;
|
||||
}
|
||||
|
||||
private cleanupConfirmationToken(requestId: string, actorId: string, keyDigest: string) {
|
||||
return digest(`Dada/P0A/asset-cleanup-confirm/v1:${requestId}:${actorId}:${keyDigest}`);
|
||||
}
|
||||
|
||||
private tableExists(name: string) {
|
||||
return Boolean(this.database.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(name));
|
||||
}
|
||||
|
||||
private insertCleanupAudit(input: {
|
||||
actorRef: string;
|
||||
afterSummary: Record<string, unknown>;
|
||||
operationType: string;
|
||||
requestId: string;
|
||||
result: "failed" | "succeeded";
|
||||
}, occurredAt: number) {
|
||||
this.database.prepare(`
|
||||
INSERT INTO admin_operation_logs (
|
||||
log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
|
||||
result, before_summary, after_summary, occurred_at, expires_at
|
||||
) VALUES (?, 'super_admin', ?, ?, 'asset_cleanup_request', ?, ?, NULL, ?, ?, ?)
|
||||
`).run(
|
||||
randomUUID(), input.actorRef, input.operationType, input.requestId, input.result,
|
||||
serializeAuditSummary(input.afterSummary), occurredAt, auditExpiry(occurredAt),
|
||||
);
|
||||
}
|
||||
|
||||
private activeReservationBytes(excludingOperationId?: string) {
|
||||
const row = this.database.prepare(`
|
||||
SELECT COALESCE(SUM(projected_bytes), 0) AS bytes
|
||||
@@ -496,9 +690,11 @@ export class ManagedStorage {
|
||||
}
|
||||
}
|
||||
|
||||
async stagePrivateImage(input: {
|
||||
async stageManagedImage(input: {
|
||||
content: Readable;
|
||||
expectedMimeType: "image/png" | "image/jpeg" | "image/webp";
|
||||
expectedSha256?: string;
|
||||
fileKind: ManagedFileKind;
|
||||
fileName: string;
|
||||
maximumBytes: number;
|
||||
operationId: string;
|
||||
@@ -509,7 +705,7 @@ export class ManagedStorage {
|
||||
const destination = this.destination({
|
||||
content: input.content,
|
||||
expectedMimeType: input.expectedMimeType,
|
||||
fileKind: "reference",
|
||||
fileKind: input.fileKind,
|
||||
fileName: input.fileName,
|
||||
operationId: input.operationId,
|
||||
ownerRef: input.ownerRef,
|
||||
@@ -537,6 +733,8 @@ export class ManagedStorage {
|
||||
await pipeline(input.content, inspect, createWriteStream(stagingPath, { flags: "wx" }));
|
||||
validatePositiveBytes(byteSize, "actual_write_bytes");
|
||||
if (sniffMime(prefix) !== input.expectedMimeType) throw new Error("content_mime_invalid");
|
||||
const sha256 = hash.digest("hex");
|
||||
if (input.expectedSha256 && sha256.toLowerCase() !== input.expectedSha256.toLowerCase()) throw new Error("content_hash_invalid");
|
||||
const state = this.getState();
|
||||
const otherReservations = this.activeReservationBytes(input.operationId);
|
||||
if (state.managed_content_bytes + otherReservations + byteSize > HARD_LIMIT_BYTES) {
|
||||
@@ -549,12 +747,12 @@ export class ManagedStorage {
|
||||
bytes: byteSize,
|
||||
destinationPath: destination.absolutePath,
|
||||
fileId,
|
||||
fileKind: "reference",
|
||||
fileKind: input.fileKind,
|
||||
mimeType: input.expectedMimeType,
|
||||
operationId: input.operationId,
|
||||
ownerRef: input.ownerRef,
|
||||
relativePath: destination.relativePath,
|
||||
sha256: hash.digest("hex"),
|
||||
sha256,
|
||||
stagingDirectory,
|
||||
stagingPath,
|
||||
};
|
||||
@@ -565,6 +763,18 @@ export class ManagedStorage {
|
||||
}
|
||||
}
|
||||
|
||||
async stagePrivateImage(input: {
|
||||
content: Readable;
|
||||
expectedMimeType: "image/png" | "image/jpeg" | "image/webp";
|
||||
fileName: string;
|
||||
maximumBytes: number;
|
||||
operationId: string;
|
||||
ownerRef: string;
|
||||
projectedWriteBytes: number;
|
||||
}): Promise<StagedManagedFile> {
|
||||
return this.stageManagedImage({ ...input, fileKind: "reference" });
|
||||
}
|
||||
|
||||
moveStagedFile(file: StagedManagedFile) {
|
||||
mkdirSync(dirname(file.destinationPath), { recursive: true });
|
||||
renameSync(file.stagingPath, file.destinationPath);
|
||||
@@ -676,6 +886,203 @@ export class ManagedStorage {
|
||||
this.database.prepare("DELETE FROM project_asset_refs WHERE managed_file_id = ?").run(fileId);
|
||||
}
|
||||
|
||||
listAssetCleanupCandidates(): AssetCleanupCandidatesView {
|
||||
const createdAt = Date.now();
|
||||
const expiresAt = createdAt + 5 * 60 * 1_000;
|
||||
const items = this.readAssetCleanupCandidates();
|
||||
const snapshotVersion = digest(JSON.stringify({
|
||||
created_at: createdAt,
|
||||
nonce: randomUUID(),
|
||||
items: items.map((item) => ({ byte_size: item.byte_size, file_id: item.file_id, hash_prefix: item.hash_prefix })),
|
||||
}));
|
||||
this.database.prepare("DELETE FROM asset_cleanup_candidate_snapshots WHERE expires_at <= ?").run(createdAt);
|
||||
this.database.prepare(`
|
||||
INSERT INTO asset_cleanup_candidate_snapshots (
|
||||
snapshot_version, items_json, created_at, expires_at
|
||||
) VALUES (?, ?, ?, ?)
|
||||
`).run(snapshotVersion, JSON.stringify(items), createdAt, expiresAt);
|
||||
return {
|
||||
candidate_snapshot_version: snapshotVersion,
|
||||
expires_at: new Date(expiresAt).toISOString(),
|
||||
items,
|
||||
};
|
||||
}
|
||||
|
||||
createAssetCleanupIntent(input: {
|
||||
actorId: string;
|
||||
fileIds: string[];
|
||||
idempotencyKey: string;
|
||||
snapshotVersion: string;
|
||||
}): AssetCleanupIntentView {
|
||||
if (this.inspectAction("explicit_cleanup") !== "allow") throw new Error("cleanup_uncommitted");
|
||||
const fileIds = [...new Set(input.fileIds)].sort();
|
||||
if (!uuidPattern.test(input.actorId) || fileIds.length === 0 || fileIds.length !== input.fileIds.length
|
||||
|| fileIds.length > 100 || fileIds.some((fileId) => !uuidPattern.test(fileId))
|
||||
|| !/^[A-Za-z0-9_-]{32,200}$/.test(input.idempotencyKey)
|
||||
|| !/^[0-9a-f]{64}$/.test(input.snapshotVersion)) {
|
||||
throw new Error("cleanup_candidates_invalid");
|
||||
}
|
||||
const keyDigest = digest(input.idempotencyKey);
|
||||
const requestHash = digest(JSON.stringify({ file_ids: fileIds, snapshot_version: input.snapshotVersion }));
|
||||
const existing = this.database.prepare(`
|
||||
SELECT request_id, request_hash, expires_at, file_count, total_bytes, status
|
||||
FROM asset_cleanup_requests
|
||||
WHERE created_by = ? AND idempotency_key_digest = ?
|
||||
`).get(input.actorId, keyDigest) as {
|
||||
expires_at: number; file_count: number; request_hash: string; request_id: string; status: AssetCleanupIntentView["status"]; total_bytes: number;
|
||||
} | undefined;
|
||||
if (existing) {
|
||||
if (existing.request_hash !== requestHash) throw new Error("IDEMPOTENCY_KEY_CONFLICT");
|
||||
return {
|
||||
confirmation_token: this.cleanupConfirmationToken(existing.request_id, input.actorId, keyDigest),
|
||||
expires_at: new Date(existing.expires_at).toISOString(),
|
||||
file_count: existing.file_count,
|
||||
request_id: existing.request_id,
|
||||
status: existing.status,
|
||||
total_bytes: existing.total_bytes,
|
||||
};
|
||||
}
|
||||
|
||||
const requestId = randomUUID();
|
||||
const confirmationToken = this.cleanupConfirmationToken(requestId, input.actorId, keyDigest);
|
||||
const createdAt = Date.now();
|
||||
let view!: AssetCleanupIntentView;
|
||||
const transaction = this.database.transaction(() => {
|
||||
this.assertActiveAdmin(input.actorId);
|
||||
const snapshot = this.database.prepare(`
|
||||
SELECT items_json, expires_at FROM asset_cleanup_candidate_snapshots
|
||||
WHERE snapshot_version = ?
|
||||
`).get(input.snapshotVersion) as { expires_at: number; items_json: string } | undefined;
|
||||
if (!snapshot || snapshot.expires_at <= createdAt) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
const snapshotItems = JSON.parse(snapshot.items_json) as AssetCleanupCandidateView[];
|
||||
const byId = new Map(snapshotItems.map((item) => [item.file_id, item]));
|
||||
const selected = fileIds.map((fileId) => byId.get(fileId));
|
||||
if (selected.some((item) => !item)) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
const current = new Map(this.readAssetCleanupCandidates().map((item) => [item.file_id, item]));
|
||||
if (fileIds.some((fileId) => !current.has(fileId))) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
const safeItems = selected as AssetCleanupCandidateView[];
|
||||
const totalBytes = safeItems.reduce((sum, item) => sum + item.byte_size, 0);
|
||||
this.database.prepare(`
|
||||
INSERT INTO asset_cleanup_requests (
|
||||
request_id, status, created_at, confirmed_at, created_by, confirmed_by,
|
||||
snapshot_version, expires_at, confirmation_token_digest,
|
||||
idempotency_key_digest, request_hash, file_count, total_bytes, denied_reason
|
||||
) VALUES (?, 'pending_confirmation', ?, NULL, ?, NULL, ?, ?, ?, ?, ?, ?, ?, NULL)
|
||||
`).run(
|
||||
requestId, new Date(createdAt).toISOString(), input.actorId, input.snapshotVersion,
|
||||
snapshot.expires_at, digest(confirmationToken), keyDigest, requestHash, safeItems.length, totalBytes,
|
||||
);
|
||||
const insert = this.database.prepare(`
|
||||
INSERT INTO asset_cleanup_request_items (
|
||||
request_id, managed_file_id, stable_id, resource_version, file_kind, byte_size, sha256_prefix
|
||||
) VALUES (?, ?, ?, ?, ?, ?, ?)
|
||||
`);
|
||||
for (const item of safeItems) {
|
||||
insert.run(requestId, item.file_id, item.stable_id, item.resource_version, item.file_kind, item.byte_size, item.hash_prefix);
|
||||
}
|
||||
this.insertCleanupAudit({
|
||||
actorRef: input.actorId,
|
||||
afterSummary: { file_count: safeItems.length, snapshot_version: input.snapshotVersion, total_bytes: totalBytes },
|
||||
operationType: "asset_cleanup_requested",
|
||||
requestId,
|
||||
result: "succeeded",
|
||||
}, createdAt);
|
||||
view = {
|
||||
confirmation_token: confirmationToken,
|
||||
expires_at: new Date(snapshot.expires_at).toISOString(),
|
||||
file_count: safeItems.length,
|
||||
request_id: requestId,
|
||||
status: "pending_confirmation",
|
||||
total_bytes: totalBytes,
|
||||
};
|
||||
});
|
||||
transaction.immediate();
|
||||
return view;
|
||||
}
|
||||
|
||||
confirmAssetCleanupIntent(input: { actorId: string; confirmationToken: string; requestId: string }) {
|
||||
if (this.inspectAction("explicit_cleanup") !== "allow") throw new Error("cleanup_uncommitted");
|
||||
if (!uuidPattern.test(input.actorId) || !uuidPattern.test(input.requestId) || !/^[0-9a-f]{64}$/.test(input.confirmationToken)) {
|
||||
throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
}
|
||||
const confirmedAt = Date.now();
|
||||
const outcome = this.database.transaction(() => {
|
||||
this.assertActiveAdmin(input.actorId);
|
||||
const request = this.database.prepare(`
|
||||
SELECT status, created_by, expires_at, confirmation_token_digest, file_count, total_bytes
|
||||
FROM asset_cleanup_requests WHERE request_id = ?
|
||||
`).get(input.requestId) as {
|
||||
confirmation_token_digest: string | null; created_by: string | null; expires_at: number | null;
|
||||
file_count: number | null; status: string; total_bytes: number | null;
|
||||
} | undefined;
|
||||
if (!request || request.status !== "pending_confirmation" || request.created_by !== input.actorId
|
||||
|| !request.expires_at || request.expires_at <= confirmedAt
|
||||
|| request.confirmation_token_digest !== digest(input.confirmationToken)) {
|
||||
throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
}
|
||||
const files = this.database.prepare(`
|
||||
SELECT mf.file_id, mf.file_kind, mf.relative_path, mf.byte_size, mf.status
|
||||
FROM asset_cleanup_request_items items
|
||||
JOIN managed_files mf ON mf.file_id = items.managed_file_id
|
||||
WHERE items.request_id = ? ORDER BY mf.file_id
|
||||
`).all(input.requestId) as ManagedFileRow[];
|
||||
if (files.length !== request.file_count) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
const conflicted = files.some((file) => file.status !== "committed"
|
||||
|| !new Set(["sticker_original", "sticker_thumbnail"]).has(file.file_kind)
|
||||
|| this.assetReferenceCount(file.file_id, input.requestId) > 0);
|
||||
if (conflicted) {
|
||||
this.database.prepare(`
|
||||
UPDATE asset_cleanup_requests
|
||||
SET status = 'denied', confirmed_at = ?, confirmed_by = ?, denied_reason = 'reference_conflict'
|
||||
WHERE request_id = ?
|
||||
`).run(new Date(confirmedAt).toISOString(), input.actorId, input.requestId);
|
||||
this.insertCleanupAudit({
|
||||
actorRef: input.actorId,
|
||||
afterSummary: { file_count: files.length, reason: "reference_conflict", status: "denied" },
|
||||
operationType: "asset_cleanup_reference_denied",
|
||||
requestId: input.requestId,
|
||||
result: "failed",
|
||||
}, confirmedAt);
|
||||
return { conflict: true as const };
|
||||
}
|
||||
|
||||
this.insertCleanupAudit({
|
||||
actorRef: input.actorId,
|
||||
afterSummary: { file_count: files.length, status: "validated" },
|
||||
operationType: "asset_cleanup_validated",
|
||||
requestId: input.requestId,
|
||||
result: "succeeded",
|
||||
}, confirmedAt);
|
||||
for (const file of files) {
|
||||
this.database.prepare(`
|
||||
UPDATE managed_files SET status = 'purged', purged_at = ?, cleanup_status = 'pending_delete'
|
||||
WHERE file_id = ? AND status = 'committed'
|
||||
`).run(new Date(confirmedAt).toISOString(), file.file_id);
|
||||
this.database.prepare(`
|
||||
INSERT INTO file_cleanup_queue (
|
||||
cleanup_id, managed_file_id, relative_path, byte_size, counts_toward_managed,
|
||||
reason, status, created_at, completed_at, last_error
|
||||
) VALUES (?, ?, ?, ?, 1, 'purge', 'pending', ?, NULL, NULL)
|
||||
`).run(randomUUID(), file.file_id, file.relative_path, file.byte_size, new Date(confirmedAt).toISOString());
|
||||
}
|
||||
this.database.prepare(`
|
||||
UPDATE asset_cleanup_requests
|
||||
SET status = 'queued', confirmed_at = ?, confirmed_by = ?
|
||||
WHERE request_id = ?
|
||||
`).run(new Date(confirmedAt).toISOString(), input.actorId, input.requestId);
|
||||
this.insertCleanupAudit({
|
||||
actorRef: input.actorId,
|
||||
afterSummary: { file_count: files.length, status: "queued", total_bytes: request.total_bytes ?? 0 },
|
||||
operationType: "asset_cleanup_scheduled",
|
||||
requestId: input.requestId,
|
||||
result: "succeeded",
|
||||
}, confirmedAt + 1);
|
||||
return { conflict: false as const, file_count: files.length, request_id: input.requestId, status: "queued" as const };
|
||||
}).immediate();
|
||||
if (outcome.conflict) throw new Error("ASSET_HISTORY_REFERENCE_CONFLICT");
|
||||
return outcome;
|
||||
}
|
||||
|
||||
createCleanupIntent(fileIds: string[]) {
|
||||
if (this.inspectAction("explicit_cleanup") !== "allow") throw new Error("cleanup_uncommitted");
|
||||
if (fileIds.length === 0 || new Set(fileIds).size !== fileIds.length) throw new Error("cleanup_candidates_invalid");
|
||||
@@ -761,6 +1168,7 @@ export class ManagedStorage {
|
||||
this.database.prepare("DELETE FROM project_asset_refs WHERE managed_file_id = ?").run(row.managed_file_id);
|
||||
const requests = this.database.prepare("SELECT request_id FROM asset_cleanup_request_items WHERE managed_file_id = ?").all(row.managed_file_id) as Array<{ request_id: string }>;
|
||||
this.database.prepare("DELETE FROM asset_cleanup_request_items WHERE managed_file_id = ?").run(row.managed_file_id);
|
||||
this.database.prepare("DELETE FROM sticker_managed_file_history WHERE managed_file_id = ?").run(row.managed_file_id);
|
||||
this.database.prepare("DELETE FROM managed_files WHERE file_id = ?").run(row.managed_file_id);
|
||||
for (const request of requests) {
|
||||
const pendingItems = this.database.prepare("SELECT COUNT(*) AS count FROM asset_cleanup_request_items WHERE request_id = ?").get(request.request_id) as { count: number };
|
||||
|
||||
@@ -366,6 +366,7 @@ export class ProjectService {
|
||||
throw new ProjectError("project_state_conflict", latest);
|
||||
}
|
||||
this.insertProjectState({ canvasState: canvas, name, projectId: input.projectId, stateVersion: nextVersion }, now);
|
||||
this.rebuildProjectStickerReferences(input.projectId, canvas, now);
|
||||
this.database.prepare(`
|
||||
INSERT INTO project_state_idempotency (
|
||||
owner_id, project_id, idempotency_key, request_hash, response_state_version, created_at
|
||||
@@ -377,6 +378,25 @@ export class ProjectService {
|
||||
return result;
|
||||
}
|
||||
|
||||
private rebuildProjectStickerReferences(projectId: string, canvas: CanvasState, now: number) {
|
||||
if (!this.tableExists("project_sticker_asset_refs")) return;
|
||||
this.database.prepare("DELETE FROM project_sticker_asset_refs WHERE project_id = ?").run(projectId);
|
||||
const insert = this.database.prepare(`
|
||||
INSERT INTO project_sticker_asset_refs (reference_id, project_id, stable_id, resource_version, created_at)
|
||||
VALUES (?, ?, ?, ?, ?)
|
||||
`);
|
||||
for (const element of canvas.elements) {
|
||||
if (element.type !== "static_sticker") continue;
|
||||
insert.run(
|
||||
`project:${projectId}:sticker:${element.element_id}`,
|
||||
projectId,
|
||||
element.template_or_asset_id,
|
||||
element.resource_version,
|
||||
now,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
trashFailedEmpty(ownerId: string, projectIds: string[]) {
|
||||
const uniqueIds = [...new Set(projectIds)];
|
||||
if (uniqueIds.length === 0 || uniqueIds.length > projectLimit) throw new ProjectError("generation_state_invalid");
|
||||
@@ -774,6 +794,16 @@ export class ProjectService {
|
||||
FOREIGN KEY (project_id) REFERENCES projects(project_id) ON DELETE CASCADE
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS project_resource_files_managed ON project_resource_files(managed_file_id, project_id);
|
||||
CREATE TABLE IF NOT EXISTS project_sticker_asset_refs (
|
||||
reference_id TEXT PRIMARY KEY,
|
||||
project_id TEXT NOT NULL,
|
||||
stable_id TEXT NOT NULL,
|
||||
resource_version TEXT NOT NULL,
|
||||
created_at INTEGER NOT NULL,
|
||||
FOREIGN KEY (project_id) REFERENCES projects(project_id) ON DELETE CASCADE
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS project_sticker_asset_refs_lookup
|
||||
ON project_sticker_asset_refs (stable_id, resource_version);
|
||||
CREATE TABLE IF NOT EXISTS latest_exports (
|
||||
project_id TEXT NOT NULL,
|
||||
format TEXT NOT NULL CHECK (format IN ('jpg', 'png')),
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
export class StickerReleaseError extends Error {
|
||||
readonly httpStatus: number;
|
||||
|
||||
constructor(readonly reason: string, httpStatus = 400) {
|
||||
super(reason);
|
||||
this.httpStatus = httpStatus;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,556 @@
|
||||
import { createHash, randomUUID } from "node:crypto";
|
||||
import { readFileSync } from "node:fs";
|
||||
import { createRequire } from "node:module";
|
||||
import { basename, extname } from "node:path";
|
||||
import { Readable } from "node:stream";
|
||||
|
||||
import type BetterSqlite3 from "better-sqlite3";
|
||||
import sharp, { type Metadata } from "sharp";
|
||||
|
||||
import type { StaticStickerCatalogItem } from "@dada/static-sticker-catalog";
|
||||
|
||||
import { ManagedStorage, type StagedManagedFile } from "./managed-storage.js";
|
||||
import { StickerReleaseError } from "./sticker-release-errors.js";
|
||||
import { classifyCapacity } from "./storage-policy.js";
|
||||
|
||||
export { StickerReleaseError } from "./sticker-release-errors.js";
|
||||
|
||||
const require = createRequire(import.meta.url);
|
||||
const Database = require("better-sqlite3") as typeof BetterSqlite3;
|
||||
const stableIdPattern = /^STK([0-9]{4,})$/;
|
||||
const idempotencyPattern = /^[A-Za-z0-9_-]{32,200}$/;
|
||||
const sha256Pattern = /^[0-9a-f]{64}$/i;
|
||||
const maximumOriginalBytes = 20 * 1024 * 1024;
|
||||
const maximumDimension = 8_192;
|
||||
const bundledPartCounts = [203, 36, 27, 48, 38, 75, 37, 67, 48, 24, 40, 30, 27, 51, 62, 19, 36, 45, 92, 53, 69, 31, 36, 30, 183] as const;
|
||||
|
||||
type StickerMime = "image/png" | "image/webp";
|
||||
type StickerVariant = "original" | "thumbnail";
|
||||
|
||||
interface StickerItemRow {
|
||||
enabled: 0 | 1;
|
||||
height: number;
|
||||
mime_type: StickerMime;
|
||||
order_index: number;
|
||||
original_byte_size: number;
|
||||
original_file_id: string;
|
||||
original_filename: string;
|
||||
original_relative_path: string;
|
||||
original_sha256: string;
|
||||
part: number;
|
||||
release_version: string;
|
||||
stable_id: string;
|
||||
thumbnail_byte_size: number;
|
||||
thumbnail_file_id: string;
|
||||
thumbnail_relative_path: string;
|
||||
thumbnail_sha256: string;
|
||||
width: number;
|
||||
}
|
||||
|
||||
export interface StickerUploadInput {
|
||||
actorId: string;
|
||||
content: Readable;
|
||||
enabled: boolean;
|
||||
expectedByteSize: number;
|
||||
expectedMimeType: StickerMime;
|
||||
expectedSha256: string;
|
||||
fileName: string;
|
||||
idempotencyKey: string;
|
||||
order: number;
|
||||
part: number;
|
||||
stableId: string;
|
||||
}
|
||||
|
||||
function digest(value: string) {
|
||||
return createHash("sha256").update(value, "utf8").digest("hex");
|
||||
}
|
||||
|
||||
function stableJson(value: unknown): string {
|
||||
if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
|
||||
if (value && typeof value === "object") {
|
||||
return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
|
||||
}
|
||||
return JSON.stringify(value);
|
||||
}
|
||||
|
||||
function iso(timestamp: number) {
|
||||
return new Date(timestamp).toISOString();
|
||||
}
|
||||
|
||||
function itemView(row: StickerItemRow): StaticStickerCatalogItem {
|
||||
const originalReference = `/api/v1/assets/public/${encodeURIComponent(row.release_version)}/${encodeURIComponent(row.stable_id)}`;
|
||||
return {
|
||||
enabled: row.enabled === 1,
|
||||
height: row.height,
|
||||
mime: row.mime_type,
|
||||
mime_type: row.mime_type,
|
||||
order: row.order_index,
|
||||
original_filename: row.original_filename,
|
||||
original_reference: originalReference,
|
||||
origin: "admin_uploaded",
|
||||
part: row.part,
|
||||
relative_path: `static-stickers/${row.stable_id}${row.mime_type === "image/png" ? ".png" : ".webp"}`,
|
||||
resource_version: row.release_version,
|
||||
sha256: row.original_sha256,
|
||||
stable_id: row.stable_id,
|
||||
thumbnail_reference: {
|
||||
media: "thumbnail",
|
||||
resource_id: row.stable_id,
|
||||
resource_version: row.release_version,
|
||||
url: `${originalReference}?variant=thumbnail`,
|
||||
},
|
||||
width: row.width,
|
||||
};
|
||||
}
|
||||
|
||||
export class StickerReleaseService {
|
||||
private readonly clock: () => number;
|
||||
private readonly database: BetterSqlite3.Database;
|
||||
private readonly storage: ManagedStorage;
|
||||
|
||||
constructor(input: { clock?: () => number; databasePath: string; storage: ManagedStorage }) {
|
||||
this.clock = input.clock ?? Date.now;
|
||||
const nativeBinding = process.env.DADA_SQLITE_NATIVE_BINDING;
|
||||
this.database = new Database(input.databasePath, nativeBinding ? { nativeBinding } : undefined);
|
||||
this.database.pragma("journal_mode = WAL");
|
||||
this.database.pragma("foreign_keys = ON");
|
||||
this.database.pragma("busy_timeout = 5000");
|
||||
this.storage = input.storage;
|
||||
this.migrate();
|
||||
}
|
||||
|
||||
close() {
|
||||
this.database.close();
|
||||
}
|
||||
|
||||
async upload(input: StickerUploadInput) {
|
||||
this.validateUpload(input);
|
||||
const requestHash = digest(stableJson({
|
||||
enabled: input.enabled,
|
||||
expected_byte_size: input.expectedByteSize,
|
||||
expected_mime_type: input.expectedMimeType,
|
||||
expected_sha256: input.expectedSha256.toLowerCase(),
|
||||
order: input.order,
|
||||
part: input.part,
|
||||
stable_id: input.stableId,
|
||||
}));
|
||||
const keyDigest = digest(input.idempotencyKey);
|
||||
const receipt = this.database.prepare(`
|
||||
SELECT request_hash, release_version FROM sticker_upload_receipts
|
||||
WHERE actor_id = ? AND idempotency_key_digest = ?
|
||||
`).get(input.actorId, keyDigest) as { release_version: string; request_hash: string } | undefined;
|
||||
if (receipt) {
|
||||
input.content.destroy();
|
||||
if (receipt.request_hash !== requestHash) throw new StickerReleaseError("sticker_idempotency_conflict", 409);
|
||||
return this.uploadResult(receipt.release_version, input.stableId, false);
|
||||
}
|
||||
this.assertNewPosition(input.stableId, input.part, input.order);
|
||||
|
||||
const staged: StagedManagedFile[] = [];
|
||||
try {
|
||||
const original = await this.storage.stageManagedImage({
|
||||
content: input.content,
|
||||
expectedMimeType: input.expectedMimeType,
|
||||
expectedSha256: input.expectedSha256,
|
||||
fileKind: "sticker_original",
|
||||
fileName: `${input.stableId}${input.expectedMimeType === "image/png" ? ".png" : ".webp"}`,
|
||||
maximumBytes: maximumOriginalBytes,
|
||||
operationId: randomUUID(),
|
||||
ownerRef: input.actorId,
|
||||
projectedWriteBytes: input.expectedByteSize,
|
||||
});
|
||||
staged.push(original);
|
||||
if (original.bytes !== input.expectedByteSize) throw new StickerReleaseError("content_size_invalid");
|
||||
|
||||
let metadata: Metadata;
|
||||
let thumbnail: Buffer;
|
||||
const decoder = sharp(readFileSync(original.stagingPath), { failOn: "warning", limitInputPixels: maximumDimension * maximumDimension });
|
||||
try {
|
||||
metadata = await decoder.metadata();
|
||||
if (metadata.format !== (input.expectedMimeType === "image/png" ? "png" : "webp")
|
||||
|| !metadata.width || !metadata.height || metadata.width > maximumDimension || metadata.height > maximumDimension) {
|
||||
throw new Error("content_decode_invalid");
|
||||
}
|
||||
thumbnail = await decoder
|
||||
.rotate()
|
||||
.resize({ fit: "inside", height: 256, width: 256, withoutEnlargement: true })
|
||||
.png({ adaptiveFiltering: true, compressionLevel: 9 })
|
||||
.toBuffer();
|
||||
} catch {
|
||||
throw new StickerReleaseError("content_decode_invalid");
|
||||
} finally {
|
||||
decoder.destroy();
|
||||
}
|
||||
|
||||
const thumbnailStaged = await this.storage.stageManagedImage({
|
||||
content: Readable.from(thumbnail),
|
||||
expectedMimeType: "image/png",
|
||||
fileKind: "sticker_thumbnail",
|
||||
fileName: `${input.stableId}-thumbnail.png`,
|
||||
maximumBytes: maximumOriginalBytes,
|
||||
operationId: randomUUID(),
|
||||
ownerRef: input.actorId,
|
||||
projectedWriteBytes: thumbnail.byteLength,
|
||||
});
|
||||
staged.push(thumbnailStaged);
|
||||
const releaseVersion = this.immediate(() => this.commitUpload({
|
||||
...input,
|
||||
height: metadata.height!,
|
||||
keyDigest,
|
||||
original,
|
||||
requestHash,
|
||||
thumbnail: thumbnailStaged,
|
||||
width: metadata.width!,
|
||||
}));
|
||||
return this.uploadResult(releaseVersion, input.stableId, true);
|
||||
} catch (error) {
|
||||
for (const file of staged) this.storage.abandonStagedFile(file);
|
||||
if (!(error instanceof StickerReleaseError) && error instanceof Error
|
||||
&& new Set(["content_hash_invalid", "content_mime_invalid", "content_size_invalid", "file_name_invalid"]).has(error.message)) {
|
||||
throw new StickerReleaseError("sticker_upload_invalid");
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
update(input: { actorId: string; enabled?: boolean; order?: number; part?: number; stableId: string }) {
|
||||
const current = this.currentVersion();
|
||||
if (!current) throw new StickerReleaseError("sticker_not_found", 404);
|
||||
const existing = this.readItem(current, input.stableId);
|
||||
if (!existing) throw new StickerReleaseError("sticker_not_found", 404);
|
||||
const part = input.part ?? existing.part;
|
||||
const order = input.order ?? existing.order_index;
|
||||
this.validatePosition(input.stableId, part, order);
|
||||
const releaseVersion = this.immediate(() => {
|
||||
const version = this.nextReleaseVersion();
|
||||
this.copyRelease(current, version);
|
||||
const conflict = this.database.prepare(`
|
||||
SELECT stable_id FROM sticker_release_items
|
||||
WHERE release_version = ? AND part = ? AND order_index = ? AND stable_id <> ?
|
||||
`).get(version, part, order, input.stableId);
|
||||
if (conflict) throw new StickerReleaseError("sticker_order_conflict", 409);
|
||||
this.database.prepare(`
|
||||
UPDATE sticker_release_items SET enabled = ?, part = ?, order_index = ?
|
||||
WHERE release_version = ? AND stable_id = ?
|
||||
`).run((input.enabled ?? existing.enabled === 1) ? 1 : 0, part, order, version, input.stableId);
|
||||
this.finalizeRelease(version, current, input.actorId);
|
||||
return version;
|
||||
});
|
||||
return { item: itemView(this.readItem(releaseVersion, input.stableId)!), release_version: releaseVersion };
|
||||
}
|
||||
|
||||
listPublic(releaseVersion = this.currentVersion()) {
|
||||
if (!releaseVersion) return { count: 0, items: [], release_version: null };
|
||||
const exists = this.database.prepare("SELECT 1 FROM sticker_releases WHERE release_version = ?").get(releaseVersion);
|
||||
if (!exists) return { count: 0, items: [], release_version: null };
|
||||
const items = (this.database.prepare(`
|
||||
SELECT * FROM sticker_release_items WHERE release_version = ? AND enabled = 1
|
||||
ORDER BY part, order_index, stable_id
|
||||
`).all(releaseVersion) as StickerItemRow[]).map(itemView);
|
||||
return { count: items.length, items, release_version: releaseVersion };
|
||||
}
|
||||
|
||||
adminView() {
|
||||
const releaseVersion = this.currentVersion();
|
||||
const items = releaseVersion
|
||||
? (this.database.prepare("SELECT * FROM sticker_release_items WHERE release_version = ? ORDER BY part, order_index, stable_id").all(releaseVersion) as StickerItemRow[])
|
||||
: [];
|
||||
return {
|
||||
count: items.length,
|
||||
items: items.map((row) => ({
|
||||
...itemView(row),
|
||||
file_state: "committed" as const,
|
||||
original_byte_size: row.original_byte_size,
|
||||
thumbnail_byte_size: row.thumbnail_byte_size,
|
||||
})),
|
||||
release_version: releaseVersion,
|
||||
storage: this.storage.getState(),
|
||||
};
|
||||
}
|
||||
|
||||
readPublicAsset(releaseVersion: string, stableId: string, variant: StickerVariant) {
|
||||
const row = this.readItem(releaseVersion, stableId);
|
||||
if (!row || row.enabled !== 1) return undefined;
|
||||
const fileId = variant === "thumbnail" ? row.thumbnail_file_id : row.original_file_id;
|
||||
const path = this.storage.resolveManagedFile(fileId);
|
||||
if (!path) return undefined;
|
||||
return {
|
||||
bytes: readFileSync(path),
|
||||
mimeType: variant === "thumbnail" ? "image/png" as const : row.mime_type,
|
||||
sha256: variant === "thumbnail" ? row.thumbnail_sha256 : row.original_sha256,
|
||||
};
|
||||
}
|
||||
|
||||
inspectCounts() {
|
||||
const count = (table: string) => (this.database.prepare(`SELECT COUNT(*) AS count FROM ${table}`).get() as { count: number }).count;
|
||||
return { items: count("sticker_release_items"), releases: count("sticker_releases"), upload_receipts: count("sticker_upload_receipts") };
|
||||
}
|
||||
|
||||
private uploadResult(releaseVersion: string, stableId: string, created: boolean) {
|
||||
const row = this.readItem(releaseVersion, stableId);
|
||||
if (!row) throw new StickerReleaseError("sticker_not_found", 404);
|
||||
return {
|
||||
created,
|
||||
item: itemView(row),
|
||||
original: { byte_size: row.original_byte_size, file_id: row.original_file_id, sha256: row.original_sha256 },
|
||||
release_version: releaseVersion,
|
||||
thumbnail: { byte_size: row.thumbnail_byte_size, file_id: row.thumbnail_file_id, sha256: row.thumbnail_sha256 },
|
||||
};
|
||||
}
|
||||
|
||||
private commitUpload(input: StickerUploadInput & {
|
||||
height: number;
|
||||
keyDigest: string;
|
||||
original: StagedManagedFile;
|
||||
requestHash: string;
|
||||
thumbnail: StagedManagedFile;
|
||||
width: number;
|
||||
}) {
|
||||
this.assertNewPosition(input.stableId, input.part, input.order);
|
||||
const previous = this.currentVersion();
|
||||
const releaseVersion = this.nextReleaseVersion();
|
||||
if (previous) this.copyRelease(previous, releaseVersion);
|
||||
for (const file of [input.original, input.thumbnail]) {
|
||||
this.storage.moveStagedFile(file);
|
||||
this.database.prepare(`
|
||||
INSERT INTO managed_files (file_id, file_kind, owner_ref, relative_path, byte_size, mime_type, sha256, status, created_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, 'committed', ?)
|
||||
`).run(file.fileId, file.fileKind, file.ownerRef, file.relativePath, file.bytes, file.mimeType, file.sha256, iso(this.clock()));
|
||||
}
|
||||
this.database.prepare(`
|
||||
INSERT INTO sticker_release_items (
|
||||
release_version, stable_id, part, order_index, original_filename, original_relative_path,
|
||||
width, height, mime_type, original_sha256, original_file_id, original_byte_size,
|
||||
thumbnail_file_id, thumbnail_relative_path, thumbnail_sha256, thumbnail_byte_size, enabled
|
||||
) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
|
||||
`).run(
|
||||
releaseVersion, input.stableId, input.part, input.order, input.fileName, input.original.relativePath,
|
||||
input.width, input.height, input.expectedMimeType, input.original.sha256, input.original.fileId, input.original.bytes,
|
||||
input.thumbnail.fileId, input.thumbnail.relativePath, input.thumbnail.sha256, input.thumbnail.bytes, input.enabled ? 1 : 0,
|
||||
);
|
||||
this.database.prepare(`
|
||||
INSERT OR IGNORE INTO sticker_managed_file_history (
|
||||
managed_file_id, stable_id, resource_version, file_kind, created_at
|
||||
) VALUES (?, ?, ?, 'original', ?), (?, ?, ?, 'thumbnail', ?)
|
||||
`).run(
|
||||
input.original.fileId, input.stableId, releaseVersion, this.clock(),
|
||||
input.thumbnail.fileId, input.stableId, releaseVersion, this.clock(),
|
||||
);
|
||||
this.consumeStagedStorage([input.original, input.thumbnail]);
|
||||
this.database.prepare(`
|
||||
INSERT INTO sticker_upload_receipts (actor_id, idempotency_key_digest, request_hash, release_version, stable_id, created_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?)
|
||||
`).run(input.actorId, input.keyDigest, input.requestHash, releaseVersion, input.stableId, iso(this.clock()));
|
||||
this.finalizeRelease(releaseVersion, previous, input.actorId);
|
||||
return releaseVersion;
|
||||
}
|
||||
|
||||
private finalizeRelease(releaseVersion: string, previous: string | null, actorId: string) {
|
||||
const rows = this.database.prepare(`
|
||||
SELECT stable_id, part, order_index, original_sha256, thumbnail_sha256, enabled
|
||||
FROM sticker_release_items WHERE release_version = ? ORDER BY stable_id
|
||||
`).all(releaseVersion);
|
||||
const manifestSha256 = digest(stableJson(rows));
|
||||
this.database.prepare(`
|
||||
INSERT INTO sticker_releases (release_version, previous_release_version, manifest_sha256, published_at, published_by)
|
||||
VALUES (?, ?, ?, ?, ?)
|
||||
`).run(releaseVersion, previous, manifestSha256, iso(this.clock()), actorId);
|
||||
this.database.prepare(`
|
||||
INSERT INTO current_sticker_release (singleton, release_version) VALUES (1, ?)
|
||||
ON CONFLICT(singleton) DO UPDATE SET release_version = excluded.release_version
|
||||
`).run(releaseVersion);
|
||||
const files = this.database.prepare(`
|
||||
SELECT original_file_id AS file_id FROM sticker_release_items WHERE release_version = ?
|
||||
UNION SELECT thumbnail_file_id AS file_id FROM sticker_release_items WHERE release_version = ?
|
||||
`).all(releaseVersion, releaseVersion) as Array<{ file_id: string }>;
|
||||
for (const file of files) {
|
||||
this.database.prepare(`
|
||||
INSERT INTO project_asset_refs (reference_id, managed_file_id, reference_type, created_at)
|
||||
VALUES (?, ?, 'release', ?)
|
||||
`).run(`release:${releaseVersion}:${file.file_id}`, file.file_id, iso(this.clock()));
|
||||
}
|
||||
}
|
||||
|
||||
private copyRelease(from: string, to: string) {
|
||||
this.database.prepare(`
|
||||
INSERT INTO sticker_release_items (
|
||||
release_version, stable_id, part, order_index, original_filename, original_relative_path,
|
||||
width, height, mime_type, original_sha256, original_file_id, original_byte_size,
|
||||
thumbnail_file_id, thumbnail_relative_path, thumbnail_sha256, thumbnail_byte_size, enabled
|
||||
)
|
||||
SELECT ?, stable_id, part, order_index, original_filename, original_relative_path,
|
||||
width, height, mime_type, original_sha256, original_file_id, original_byte_size,
|
||||
thumbnail_file_id, thumbnail_relative_path, thumbnail_sha256, thumbnail_byte_size, enabled
|
||||
FROM sticker_release_items WHERE release_version = ?
|
||||
`).run(to, from);
|
||||
}
|
||||
|
||||
private consumeStagedStorage(files: StagedManagedFile[]) {
|
||||
const timestamp = iso(this.clock());
|
||||
for (const file of files) {
|
||||
this.database.prepare(`
|
||||
UPDATE storage_reservations SET status = 'consumed', resolved_at = ?
|
||||
WHERE operation_id = ? AND status = 'active'
|
||||
`).run(timestamp, file.operationId);
|
||||
}
|
||||
const total = files.reduce((sum, file) => sum + file.bytes, 0);
|
||||
const state = this.database.prepare("SELECT managed_content_bytes FROM local_backend_storage_state WHERE singleton = 1").get() as { managed_content_bytes: number };
|
||||
const active = this.database.prepare("SELECT COALESCE(SUM(projected_bytes), 0) AS bytes FROM storage_reservations WHERE status = 'active'").get() as { bytes: number };
|
||||
const nextBytes = state.managed_content_bytes + total;
|
||||
const classification = classifyCapacity(nextBytes, active.bytes);
|
||||
this.database.prepare(`
|
||||
UPDATE local_backend_storage_state
|
||||
SET managed_content_bytes = ?, capacity_notice_level = ?, storage_status = ?, measured_at = ?, version = version + 1
|
||||
WHERE singleton = 1
|
||||
`).run(nextBytes, classification.capacity_notice_level, classification.storage_status, timestamp);
|
||||
}
|
||||
|
||||
private currentVersion() {
|
||||
return (this.database.prepare("SELECT release_version FROM current_sticker_release WHERE singleton = 1").get() as { release_version: string } | undefined)?.release_version ?? null;
|
||||
}
|
||||
|
||||
private nextReleaseVersion() {
|
||||
const date = new Date(this.clock()).toISOString().slice(0, 10).replaceAll("-", "");
|
||||
const row = this.database.prepare("SELECT next_sequence FROM sticker_release_sequences WHERE release_date = ?").get(date) as { next_sequence: number } | undefined;
|
||||
const sequence = row?.next_sequence ?? 1;
|
||||
this.database.prepare(`
|
||||
INSERT INTO sticker_release_sequences (release_date, next_sequence) VALUES (?, ?)
|
||||
ON CONFLICT(release_date) DO UPDATE SET next_sequence = excluded.next_sequence
|
||||
`).run(date, sequence + 1);
|
||||
return `asset-${date}.${sequence}`;
|
||||
}
|
||||
|
||||
private readItem(releaseVersion: string, stableId: string) {
|
||||
return this.database.prepare("SELECT * FROM sticker_release_items WHERE release_version = ? AND stable_id = ?")
|
||||
.get(releaseVersion, stableId) as StickerItemRow | undefined;
|
||||
}
|
||||
|
||||
private assertNewPosition(stableId: string, part: number, order: number) {
|
||||
this.validatePosition(stableId, part, order);
|
||||
const current = this.currentVersion();
|
||||
if (!current) return;
|
||||
if (this.readItem(current, stableId)) throw new StickerReleaseError("sticker_stable_id_conflict", 409);
|
||||
const conflict = this.database.prepare(`
|
||||
SELECT stable_id FROM sticker_release_items WHERE release_version = ? AND part = ? AND order_index = ?
|
||||
`).get(current, part, order);
|
||||
if (conflict) throw new StickerReleaseError("sticker_order_conflict", 409);
|
||||
}
|
||||
|
||||
private validatePosition(stableId: string, part: number, order: number) {
|
||||
const matched = stableId.match(stableIdPattern);
|
||||
const numericId = matched ? Number(matched[1]) : Number.NaN;
|
||||
if (!matched || !Number.isSafeInteger(numericId) || numericId <= 1_407) throw new StickerReleaseError("sticker_stable_id_invalid");
|
||||
if (!Number.isSafeInteger(part) || part < 1 || part > bundledPartCounts.length
|
||||
|| !Number.isSafeInteger(order) || order <= bundledPartCounts[part - 1]!) {
|
||||
throw new StickerReleaseError("sticker_part_order_invalid");
|
||||
}
|
||||
}
|
||||
|
||||
private validateUpload(input: StickerUploadInput) {
|
||||
this.validatePosition(input.stableId, input.part, input.order);
|
||||
if (!/^[0-9a-f-]{36}$/i.test(input.actorId) || !idempotencyPattern.test(input.idempotencyKey)
|
||||
|| !sha256Pattern.test(input.expectedSha256) || !Number.isSafeInteger(input.expectedByteSize)
|
||||
|| input.expectedByteSize <= 0 || input.expectedByteSize > maximumOriginalBytes
|
||||
|| !new Set(["image/png", "image/webp"]).has(input.expectedMimeType)) {
|
||||
throw new StickerReleaseError("sticker_upload_invalid");
|
||||
}
|
||||
const expectedExtension = input.expectedMimeType === "image/png" ? ".png" : ".webp";
|
||||
if (input.fileName.length > 255 || basename(input.fileName) !== input.fileName || /[\u0000-\u001f]/.test(input.fileName)
|
||||
|| extname(input.fileName).toLowerCase() !== expectedExtension) throw new StickerReleaseError("sticker_upload_invalid");
|
||||
}
|
||||
|
||||
private immediate<T>(action: () => T) {
|
||||
this.database.exec("BEGIN IMMEDIATE");
|
||||
try {
|
||||
const result = action();
|
||||
this.database.exec("COMMIT");
|
||||
return result;
|
||||
} catch (error) {
|
||||
if (this.database.inTransaction) this.database.exec("ROLLBACK");
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
private migrate() {
|
||||
this.database.exec(`
|
||||
CREATE TABLE IF NOT EXISTS sticker_release_sequences (
|
||||
release_date TEXT PRIMARY KEY,
|
||||
next_sequence INTEGER NOT NULL CHECK (next_sequence >= 1)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS sticker_releases (
|
||||
release_version TEXT PRIMARY KEY,
|
||||
previous_release_version TEXT,
|
||||
manifest_sha256 TEXT NOT NULL CHECK (length(manifest_sha256) = 64),
|
||||
published_at TEXT NOT NULL,
|
||||
published_by TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS sticker_release_items (
|
||||
release_version TEXT NOT NULL,
|
||||
stable_id TEXT NOT NULL,
|
||||
part INTEGER NOT NULL CHECK (part BETWEEN 1 AND 25),
|
||||
order_index INTEGER NOT NULL CHECK (order_index > 0),
|
||||
original_filename TEXT NOT NULL,
|
||||
original_relative_path TEXT NOT NULL,
|
||||
width INTEGER NOT NULL CHECK (width > 0),
|
||||
height INTEGER NOT NULL CHECK (height > 0),
|
||||
mime_type TEXT NOT NULL CHECK (mime_type IN ('image/png', 'image/webp')),
|
||||
original_sha256 TEXT NOT NULL CHECK (length(original_sha256) = 64),
|
||||
original_file_id TEXT NOT NULL REFERENCES managed_files(file_id),
|
||||
original_byte_size INTEGER NOT NULL CHECK (original_byte_size > 0),
|
||||
thumbnail_file_id TEXT NOT NULL REFERENCES managed_files(file_id),
|
||||
thumbnail_relative_path TEXT NOT NULL,
|
||||
thumbnail_sha256 TEXT NOT NULL CHECK (length(thumbnail_sha256) = 64),
|
||||
thumbnail_byte_size INTEGER NOT NULL CHECK (thumbnail_byte_size > 0),
|
||||
enabled INTEGER NOT NULL CHECK (enabled IN (0, 1)),
|
||||
PRIMARY KEY (release_version, stable_id),
|
||||
UNIQUE (release_version, part, order_index)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS current_sticker_release (
|
||||
singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
|
||||
release_version TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS sticker_upload_receipts (
|
||||
actor_id TEXT NOT NULL,
|
||||
idempotency_key_digest TEXT NOT NULL CHECK (length(idempotency_key_digest) = 64),
|
||||
request_hash TEXT NOT NULL CHECK (length(request_hash) = 64),
|
||||
release_version TEXT NOT NULL,
|
||||
stable_id TEXT NOT NULL,
|
||||
created_at TEXT NOT NULL,
|
||||
PRIMARY KEY (actor_id, idempotency_key_digest)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS sticker_managed_file_history (
|
||||
managed_file_id TEXT NOT NULL,
|
||||
stable_id TEXT NOT NULL,
|
||||
resource_version TEXT NOT NULL,
|
||||
file_kind TEXT NOT NULL CHECK (file_kind IN ('original', 'thumbnail')),
|
||||
created_at INTEGER NOT NULL,
|
||||
PRIMARY KEY (managed_file_id, file_kind),
|
||||
FOREIGN KEY (managed_file_id) REFERENCES managed_files(file_id)
|
||||
);
|
||||
CREATE TRIGGER IF NOT EXISTS sticker_releases_no_update
|
||||
BEFORE UPDATE ON sticker_releases BEGIN SELECT RAISE(ABORT, 'sticker_releases_immutable'); END;
|
||||
CREATE TRIGGER IF NOT EXISTS sticker_releases_no_delete
|
||||
BEFORE DELETE ON sticker_releases BEGIN SELECT RAISE(ABORT, 'sticker_releases_immutable'); END;
|
||||
CREATE TRIGGER IF NOT EXISTS sticker_release_items_no_update
|
||||
BEFORE UPDATE ON sticker_release_items
|
||||
WHEN EXISTS (SELECT 1 FROM sticker_releases WHERE release_version = OLD.release_version)
|
||||
BEGIN SELECT RAISE(ABORT, 'sticker_release_items_immutable'); END;
|
||||
CREATE TRIGGER IF NOT EXISTS sticker_release_items_no_delete
|
||||
BEFORE DELETE ON sticker_release_items
|
||||
WHEN EXISTS (SELECT 1 FROM sticker_releases WHERE release_version = OLD.release_version)
|
||||
BEGIN SELECT RAISE(ABORT, 'sticker_release_items_immutable'); END;
|
||||
`);
|
||||
this.database.exec(`
|
||||
INSERT OR IGNORE INTO sticker_managed_file_history (
|
||||
managed_file_id, stable_id, resource_version, file_kind, created_at
|
||||
)
|
||||
SELECT original_file_id, stable_id, release_version, 'original', strftime('%s', 'now') * 1000
|
||||
FROM sticker_release_items;
|
||||
INSERT OR IGNORE INTO sticker_managed_file_history (
|
||||
managed_file_id, stable_id, resource_version, file_kind, created_at
|
||||
)
|
||||
SELECT thumbnail_file_id, stable_id, release_version, 'thumbnail', strftime('%s', 'now') * 1000
|
||||
FROM sticker_release_items;
|
||||
`);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
.admin-assets-page { min-height: 100vh; color: #111111; background: #f6f6f4; }
|
||||
.admin-assets-page > main { width: min(1360px, calc(100% - 64px)); margin: 0 auto; padding: 36px 0 80px; }
|
||||
.admin-assets-heading { display: flex; align-items: end; justify-content: space-between; gap: 24px; padding-bottom: 18px; border-bottom: 1px solid #999993; }
|
||||
.admin-assets-heading p { margin: 0 0 4px; font: 700 11px Consolas, monospace; }
|
||||
.admin-assets-heading h1 { margin: 0; font-size: 34px; }
|
||||
.admin-assets-heading > strong { font: 700 13px Consolas, monospace; }
|
||||
.admin-assets-summary { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); margin: 22px 0; border-block: 1px solid #8c8c86; background: #ffffff; }
|
||||
.admin-assets-summary > span { display: grid; min-width: 0; gap: 6px; padding: 17px 18px; border-right: 1px solid #c1c1ba; color: #65655f; font-size: 12px; }
|
||||
.admin-assets-summary > span:last-child { border-right: 0; }
|
||||
.admin-assets-summary strong { color: #111111; font-size: 15px; overflow-wrap: anywhere; }
|
||||
.admin-assets-summary .is-active { color: #1f6639; }
|
||||
.admin-assets-summary .is-full,
|
||||
.admin-assets-summary .is-unavailable { color: #9b2c23; }
|
||||
.admin-assets-upload,
|
||||
.admin-assets-list { margin-top: 22px; border-block: 1px solid #8c8c86; background: #ffffff; }
|
||||
.admin-assets-upload > header,
|
||||
.admin-assets-list > header { display: flex; align-items: center; justify-content: space-between; min-height: 54px; padding: 0 16px; border-bottom: 1px solid #c1c1ba; background: #e7e7e2; }
|
||||
.admin-assets-upload h2,
|
||||
.admin-assets-list h2 { margin: 0; font-size: 16px; }
|
||||
.admin-assets-upload header span,
|
||||
.admin-assets-list header span { font: 700 11px Consolas, monospace; }
|
||||
.admin-assets-form { display: grid; grid-template-columns: minmax(230px, 2fr) minmax(130px, 1fr) 84px 92px 130px auto; align-items: end; gap: 12px; padding: 18px 16px; }
|
||||
.admin-assets-form label { display: grid; gap: 6px; min-width: 0; color: #4c4c47; font-size: 11px; font-weight: 800; }
|
||||
.admin-assets-form input { width: 100%; min-height: 40px; padding: 7px 9px; border: 1px solid #777770; border-radius: 0; background: #ffffff; }
|
||||
.admin-assets-form input[type="file"] { padding: 7px; }
|
||||
.admin-assets-form .admin-assets-enabled { display: flex; min-height: 40px; align-items: center; gap: 8px; color: #111111; }
|
||||
.admin-assets-enabled input { width: 18px; min-height: 18px; }
|
||||
.admin-assets-form button,
|
||||
.admin-assets-alert button { min-height: 42px; padding: 9px 14px; border: 1px solid #111111; border-radius: 0; background: #f2f500; font-weight: 900; }
|
||||
.admin-assets-form button:disabled { color: #777770; background: #dfdfda; cursor: not-allowed; }
|
||||
.admin-assets-blocked { margin: 0; padding: 12px 16px; border-top: 1px solid #e2b8b3; color: #812219; background: #fff1ef; font-weight: 700; }
|
||||
.admin-assets-table-wrap { overflow-x: auto; }
|
||||
.admin-assets-table-wrap table { width: 100%; min-width: 1120px; border-collapse: collapse; table-layout: fixed; }
|
||||
.admin-assets-table-wrap th,
|
||||
.admin-assets-table-wrap td { padding: 12px 10px; border-right: 1px solid #d0d0ca; border-bottom: 1px solid #d0d0ca; text-align: left; vertical-align: middle; font-size: 12px; }
|
||||
.admin-assets-table-wrap thead th { background: #f1f1ed; font-weight: 900; }
|
||||
.admin-assets-table-wrap th:first-child { width: 78px; }
|
||||
.admin-assets-table-wrap th:nth-child(2) { width: 150px; }
|
||||
.admin-assets-table-wrap th:nth-child(3) { width: 140px; }
|
||||
.admin-assets-table-wrap th:nth-child(4) { width: 210px; }
|
||||
.admin-assets-table-wrap th:nth-child(5) { width: 92px; }
|
||||
.admin-assets-table-wrap th:nth-child(6),
|
||||
.admin-assets-table-wrap th:nth-child(7) { width: 92px; }
|
||||
.admin-assets-table-wrap th:last-child { width: 180px; }
|
||||
.admin-assets-table-wrap img { display: block; width: 48px; height: 48px; object-fit: contain; border: 1px solid #c1c1ba; background: #f6f6f4; }
|
||||
.admin-assets-table-wrap strong,
|
||||
.admin-assets-table-wrap small { display: block; }
|
||||
.admin-assets-table-wrap small { margin-top: 4px; color: #65655f; font-size: 10px; overflow-wrap: anywhere; }
|
||||
.admin-assets-table-wrap input[type="number"] { width: 70px; min-height: 34px; margin-top: 5px; padding: 5px 7px; border: 1px solid #777770; border-radius: 0; }
|
||||
.admin-assets-table-wrap td:last-child { display: flex; gap: 6px; }
|
||||
.admin-assets-table-wrap button { min-height: 34px; padding: 6px 8px; border: 1px solid #555550; border-radius: 0; background: #ffffff; font-weight: 800; }
|
||||
.admin-assets-table-wrap button:disabled { color: #8a8a84; background: #ecece8; }
|
||||
.admin-assets-table-wrap .is-enabled { color: #1f6639; font-weight: 800; }
|
||||
.admin-assets-table-wrap .is-disabled { color: #812219; font-weight: 800; }
|
||||
.admin-assets-empty { margin: 0; padding: 34px 16px; color: #65655f; }
|
||||
.admin-assets-notice { margin: 16px 0 0; padding: 13px 16px; border-left: 4px solid #287b45; background: #edf8f0; font-weight: 800; }
|
||||
.admin-assets-alert { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-top: 24px; padding: 16px; border-left: 5px solid #d14a3b; background: #fff1ef; }
|
||||
.admin-assets-loading { display: grid; gap: 10px; margin-top: 24px; }
|
||||
.admin-assets-loading span { display: block; height: 62px; background: #dfdfda; }
|
||||
@media (max-width: 900px) {
|
||||
.admin-assets-page > main { width: 100%; padding-right: 16px; padding-left: 16px; }
|
||||
.admin-assets-summary { grid-template-columns: 1fr; }
|
||||
.admin-assets-summary > span { border-right: 0; border-bottom: 1px solid #c1c1ba; }
|
||||
.admin-assets-form { grid-template-columns: 1fr 1fr; }
|
||||
}
|
||||
@media (max-width: 580px) {
|
||||
.admin-product-header { padding: 0 12px; overflow-x: auto; }
|
||||
.admin-product-header nav a { min-width: 66px; }
|
||||
.admin-assets-form { grid-template-columns: 1fr; }
|
||||
.admin-assets-heading { align-items: start; flex-direction: column; }
|
||||
}
|
||||
@@ -0,0 +1,191 @@
|
||||
import { useEffect, useMemo, useState } from "react";
|
||||
|
||||
import "./admin-assets.css";
|
||||
|
||||
interface AdminSession { csrf_token: string }
|
||||
interface StorageState {
|
||||
capacity_notice_level: "normal" | "warning" | "critical";
|
||||
hard_limit_bytes: number;
|
||||
managed_content_bytes: number;
|
||||
storage_status: "active" | "full" | "unavailable";
|
||||
}
|
||||
interface AdminSticker {
|
||||
enabled: boolean;
|
||||
file_state: "committed";
|
||||
height: number;
|
||||
mime_type: "image/png" | "image/webp";
|
||||
order: number;
|
||||
original_byte_size: number;
|
||||
original_filename: string;
|
||||
part: number;
|
||||
resource_version: string;
|
||||
stable_id: string;
|
||||
thumbnail_byte_size: number;
|
||||
thumbnail_reference: { url: string };
|
||||
width: number;
|
||||
}
|
||||
interface AdminAssetsResponse {
|
||||
count: number;
|
||||
items: AdminSticker[];
|
||||
release_version: string | null;
|
||||
storage: StorageState;
|
||||
}
|
||||
|
||||
function idempotencyKey() {
|
||||
return crypto.randomUUID().replaceAll("-", "") + crypto.randomUUID().replaceAll("-", "");
|
||||
}
|
||||
|
||||
function bytesLabel(bytes: number) {
|
||||
return new Intl.NumberFormat("zh-CN", { maximumFractionDigits: 2, minimumFractionDigits: 2 }).format(bytes / (1024 ** 3));
|
||||
}
|
||||
|
||||
async function loadJson<T>(url: string, init?: RequestInit) {
|
||||
const response = await fetch(url, { credentials: "same-origin", ...init });
|
||||
const body = response.headers.get("content-type")?.includes("application/json") ? await response.json() as T : undefined;
|
||||
return { body, response };
|
||||
}
|
||||
|
||||
export function AdminAssetsPage() {
|
||||
const [session, setSession] = useState<AdminSession>();
|
||||
const [assets, setAssets] = useState<AdminAssetsResponse>();
|
||||
const [loadingFailed, setLoadingFailed] = useState(false);
|
||||
const [busy, setBusy] = useState(false);
|
||||
const [notice, setNotice] = useState("");
|
||||
const [file, setFile] = useState<File>();
|
||||
const [stableId, setStableId] = useState("STK1408");
|
||||
const [part, setPart] = useState(25);
|
||||
const [order, setOrder] = useState(184);
|
||||
const [enabled, setEnabled] = useState(true);
|
||||
const [orderDrafts, setOrderDrafts] = useState<Record<string, number>>({});
|
||||
|
||||
async function load() {
|
||||
setLoadingFailed(false);
|
||||
try {
|
||||
const [sessionResult, assetsResult] = await Promise.all([
|
||||
loadJson<AdminSession>("/api/v1/admin-auth/session"),
|
||||
loadJson<AdminAssetsResponse>("/api/v1/admin/assets/static-stickers"),
|
||||
]);
|
||||
if (!sessionResult.response.ok || !assetsResult.response.ok || !sessionResult.body || !assetsResult.body) throw new Error("load_failed");
|
||||
setSession(sessionResult.body);
|
||||
setAssets(assetsResult.body);
|
||||
setOrderDrafts(Object.fromEntries(assetsResult.body.items.map((item) => [item.stable_id, item.order])));
|
||||
const numericIds = assetsResult.body.items.map((item) => Number(item.stable_id.slice(3))).filter(Number.isFinite);
|
||||
setStableId(`STK${Math.max(1407, ...numericIds) + 1}`);
|
||||
setOrder(Math.max(183, ...assetsResult.body.items.filter((item) => item.part === 25).map((item) => item.order)) + 1);
|
||||
setNotice("");
|
||||
} catch {
|
||||
setLoadingFailed(true);
|
||||
}
|
||||
}
|
||||
|
||||
useEffect(() => { void load(); }, []);
|
||||
|
||||
const uploadBlocked = !assets || assets.storage.storage_status !== "active";
|
||||
const formValid = useMemo(() => Boolean(
|
||||
file && /^(image\/png|image\/webp)$/.test(file.type) && /^STK[0-9]{4,}$/.test(stableId)
|
||||
&& Number.isSafeInteger(part) && part >= 1 && part <= 25 && Number.isSafeInteger(order) && order > 0,
|
||||
), [file, order, part, stableId]);
|
||||
|
||||
async function upload() {
|
||||
if (!file || !session || !formValid || uploadBlocked || busy) return;
|
||||
setBusy(true);
|
||||
setNotice("");
|
||||
try {
|
||||
const sha256 = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", await file.arrayBuffer())))
|
||||
.map((byte) => byte.toString(16).padStart(2, "0")).join("");
|
||||
const form = new FormData();
|
||||
form.append("stable_id", stableId);
|
||||
form.append("part", String(part));
|
||||
form.append("order", String(order));
|
||||
form.append("enabled", String(enabled));
|
||||
form.append("original_byte_size", String(file.size));
|
||||
form.append("original_sha256", sha256);
|
||||
form.append("sticker_file", file, file.name);
|
||||
const response = await fetch("/api/v1/admin/assets/static-stickers", {
|
||||
body: form,
|
||||
credentials: "same-origin",
|
||||
headers: { "Idempotency-Key": idempotencyKey(), "X-CSRF-Token": session.csrf_token },
|
||||
method: "POST",
|
||||
});
|
||||
if (!response.ok) {
|
||||
setNotice(response.status === 507 ? "存储容量已满或暂不可用，未写入任何文件。" : response.status === 409 ? "稳定 ID 或 part 顺序已存在。" : "文件格式、内容或字段校验未通过。");
|
||||
return;
|
||||
}
|
||||
setFile(undefined);
|
||||
await load();
|
||||
setNotice("贴纸已生成缩略图并发布新资源版本。");
|
||||
} catch {
|
||||
setNotice("上传未完成，未发布新资源版本。");
|
||||
} finally {
|
||||
setBusy(false);
|
||||
}
|
||||
}
|
||||
|
||||
async function update(item: AdminSticker, change: { enabled?: boolean; order?: number }) {
|
||||
if (!session || busy) return;
|
||||
setBusy(true);
|
||||
setNotice("");
|
||||
try {
|
||||
const { response } = await loadJson(`/api/v1/admin/assets/static-stickers/${encodeURIComponent(item.stable_id)}`, {
|
||||
body: JSON.stringify(change),
|
||||
headers: { "Content-Type": "application/json", "X-CSRF-Token": session.csrf_token },
|
||||
method: "PATCH",
|
||||
});
|
||||
if (!response.ok) throw new Error("update_failed");
|
||||
await load();
|
||||
setNotice(change.enabled === false ? "贴纸已停用，新项目目录不再显示。" : change.enabled === true ? "贴纸已重新启用。" : "part 顺序已发布到新资源版本。");
|
||||
} catch {
|
||||
setNotice("素材状态未更新。");
|
||||
} finally {
|
||||
setBusy(false);
|
||||
}
|
||||
}
|
||||
|
||||
return <div className="admin-assets-page">
|
||||
<header className="admin-product-header">
|
||||
<a href="/admin">DADA ADMIN</a>
|
||||
<nav aria-label="后台导航"><a href="/admin/users">用户</a><a href="/admin/models">模型</a><a aria-current="page" href="/admin/assets">素材</a><a href="/admin/audit">审计</a></nav>
|
||||
</header>
|
||||
<main>
|
||||
<header className="admin-assets-heading"><div><p>ASSET OPERATIONS</p><h1>普通贴纸</h1></div><strong>{assets?.release_version ?? "尚未发布"}</strong></header>
|
||||
{!assets && !loadingFailed ? <div aria-label="贴纸素材加载中" className="admin-assets-loading"><span /><span /><span /></div> : null}
|
||||
{loadingFailed ? <p className="admin-assets-alert" role="alert">素材状态暂时无法读取。<button onClick={() => void load()} type="button">重试</button></p> : null}
|
||||
{assets ? <>
|
||||
<div className="admin-assets-summary" aria-label="素材存储摘要">
|
||||
<span>后台贴纸<strong>{assets.count}</strong></span>
|
||||
<span>受管内容<strong>{bytesLabel(assets.storage.managed_content_bytes)} / {bytesLabel(assets.storage.hard_limit_bytes)} GB</strong></span>
|
||||
<span>存储状态<strong className={`is-${assets.storage.storage_status}`}>{assets.storage.storage_status}</strong></span>
|
||||
</div>
|
||||
<section className="admin-assets-upload" aria-labelledby="asset-upload-title">
|
||||
<header><h2 id="asset-upload-title">上传并发布</h2><span>PNG / WebP</span></header>
|
||||
<div className="admin-assets-form">
|
||||
<label>文件<input accept="image/png,image/webp" aria-label="贴纸文件" disabled={uploadBlocked || busy} key={file?.name ?? "empty"} onChange={(event) => setFile(event.target.files?.[0])} type="file" /></label>
|
||||
<label>稳定 ID<input aria-label="稳定 ID" disabled={uploadBlocked || busy} onChange={(event) => setStableId(event.target.value.toUpperCase())} value={stableId} /></label>
|
||||
<label>Part<input aria-label="Part" disabled={uploadBlocked || busy} max="25" min="1" onChange={(event) => setPart(Number(event.target.value))} type="number" value={part} /></label>
|
||||
<label>顺序<input aria-label="顺序" disabled={uploadBlocked || busy} min="1" onChange={(event) => setOrder(Number(event.target.value))} type="number" value={order} /></label>
|
||||
<label className="admin-assets-enabled"><input checked={enabled} disabled={uploadBlocked || busy} onChange={(event) => setEnabled(event.target.checked)} type="checkbox" />发布后启用</label>
|
||||
<button disabled={!formValid || uploadBlocked || busy} onClick={() => void upload()} type="button">{busy ? "处理中" : "上传并发布"}</button>
|
||||
</div>
|
||||
{uploadBlocked ? <p className="admin-assets-blocked" role="status">当前存储状态禁止新增原图和缩略图。</p> : null}
|
||||
</section>
|
||||
<section className="admin-assets-list" aria-labelledby="asset-list-title">
|
||||
<header><h2 id="asset-list-title">当前版本</h2><span>{assets.count} 项</span></header>
|
||||
{assets.items.length === 0 ? <p className="admin-assets-empty">当前没有后台上传的普通贴纸。</p> : <div className="admin-assets-table-wrap"><table>
|
||||
<thead><tr><th>预览</th><th>稳定 ID</th><th>Part / 顺序</th><th>原文件</th><th>尺寸</th><th>文件状态</th><th>发布状态</th><th>操作</th></tr></thead>
|
||||
<tbody>{assets.items.map((item) => <tr key={item.stable_id}>
|
||||
<td><img alt="" src={item.thumbnail_reference.url} /></td>
|
||||
<th scope="row"><strong>{item.stable_id}</strong><small>{item.resource_version}</small></th>
|
||||
<td><span>part{item.part}</span><input aria-label={`${item.stable_id} 顺序`} min="1" onChange={(event) => setOrderDrafts((current) => ({ ...current, [item.stable_id]: Number(event.target.value) }))} type="number" value={orderDrafts[item.stable_id] ?? item.order} /></td>
|
||||
<td><span>{item.original_filename}</span><small>{item.mime_type} · {item.original_byte_size.toLocaleString("zh-CN")} B</small></td>
|
||||
<td>{item.width} x {item.height}</td>
|
||||
<td>{item.file_state}</td>
|
||||
<td><span className={item.enabled ? "is-enabled" : "is-disabled"}>{item.enabled ? "已启用" : "已停用"}</span></td>
|
||||
<td><button disabled={busy || (orderDrafts[item.stable_id] ?? item.order) === item.order} onClick={() => void update(item, { order: orderDrafts[item.stable_id] ?? item.order })} type="button">更新顺序</button><button disabled={busy} onClick={() => void update(item, { enabled: !item.enabled })} type="button">{item.enabled ? "停用" : "启用"}</button></td>
|
||||
</tr>)}</tbody>
|
||||
</table></div>}
|
||||
</section>
|
||||
{notice ? <p className="admin-assets-notice" role="status">{notice}</p> : null}
|
||||
</> : null}
|
||||
</main>
|
||||
</div>;
|
||||
}
|
||||
@@ -149,7 +149,7 @@ export function AdminModelsPage() {
|
||||
<div className="admin-models-page">
|
||||
<header className="admin-product-header">
|
||||
<a href="/admin">DADA ADMIN</a>
|
||||
<nav aria-label="后台导航"><a href="/admin/users">用户</a><a aria-current="page" href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
|
||||
<nav aria-label="后台导航"><a href="/admin/users">用户</a><a aria-current="page" href="/admin/models">模型</a><a href="/admin/assets">素材</a><a href="/admin/audit">审计</a></nav>
|
||||
</header>
|
||||
<main>
|
||||
<header className="admin-models-heading">
|
||||
|
||||
@@ -102,7 +102,7 @@ export function AdminUsersPage() {
|
||||
<div className="admin-users-page">
|
||||
<header className="admin-product-header">
|
||||
<a href="/admin">DADA ADMIN</a>
|
||||
<nav aria-label="后台导航"><a aria-current="page" href="/admin/users">用户</a><a href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
|
||||
<nav aria-label="后台导航"><a aria-current="page" href="/admin/users">用户</a><a href="/admin/models">模型</a><a href="/admin/assets">素材</a><a href="/admin/audit">审计</a></nav>
|
||||
</header>
|
||||
<main>
|
||||
<header className="admin-users-heading">
|
||||
|
||||
@@ -49,7 +49,7 @@ import {
|
||||
type DynamicTemplateId,
|
||||
} from "./dynamic-provider.js";
|
||||
import { dynamicFontOptionsFor } from "./dynamic-render-models.js";
|
||||
import { P0A_STATIC_STICKER_CATALOG, P0A_STATIC_STICKER_COUNT, stickerWindow } from "./static-sticker-catalog.js";
|
||||
import { P0A_STATIC_STICKER_CATALOG, stickerWindow, type StaticStickerCatalogItem } from "./static-sticker-catalog.js";
|
||||
import {
|
||||
createColorCardElement,
|
||||
extractPaletteFromImage,
|
||||
@@ -136,6 +136,7 @@ export function EditorPage({ projectId }: { projectId: string }) {
|
||||
const [notice, setNotice] = useState("");
|
||||
const [activePanel, setActivePanel] = useState<EditorAssetPanel>("background");
|
||||
const [stickerScrollTop, setStickerScrollTop] = useState(0);
|
||||
const [stickerCatalog, setStickerCatalog] = useState<StaticStickerCatalogItem[]>(P0A_STATIC_STICKER_CATALOG);
|
||||
const [selectedIds, setSelectedIds] = useState<string[]>([]);
|
||||
const [guides, setGuides] = useState<string[]>([]);
|
||||
const [multiMode, setMultiMode] = useState(false);
|
||||
@@ -187,6 +188,18 @@ export function EditorPage({ projectId }: { projectId: string }) {
|
||||
return () => { active = false; };
|
||||
}, [session?.user.user_id]);
|
||||
|
||||
useEffect(() => {
|
||||
let active = true;
|
||||
readEditorJson<{ items: StaticStickerCatalogItem[] }>("/api/v1/static-stickers/current")
|
||||
.then((response) => {
|
||||
if (!active) return;
|
||||
const uploaded = response.items.filter((item) => item.enabled && item.origin === "admin_uploaded");
|
||||
setStickerCatalog([...P0A_STATIC_STICKER_CATALOG, ...uploaded].sort((left, right) => left.part - right.part || left.order - right.order || left.stable_id.localeCompare(right.stable_id)));
|
||||
})
|
||||
.catch(() => { if (active) setStickerCatalog(P0A_STATIC_STICKER_CATALOG); });
|
||||
return () => { active = false; };
|
||||
}, []);
|
||||
|
||||
useEffect(() => {
|
||||
if (!project || !session || !canvasState) return undefined;
|
||||
const queue = new ProjectAutoSaveQueue({
|
||||
@@ -343,15 +356,15 @@ export function EditorPage({ projectId }: { projectId: string }) {
|
||||
setNotice(message);
|
||||
}
|
||||
|
||||
function addSticker(assetId: string) {
|
||||
function addSticker(sticker: StaticStickerCatalogItem) {
|
||||
const controller = controllerForCurrent();
|
||||
if (!controller || !canvasState) return;
|
||||
try {
|
||||
controller.add(createStaticStickerElement({
|
||||
assetId,
|
||||
assetId: sticker.stable_id,
|
||||
identity: newElementIdentity(),
|
||||
position: { x: 0.5, y: 0.5 },
|
||||
resourceVersion: "fixture-v1",
|
||||
resourceVersion: sticker.resource_version,
|
||||
zIndex: canvasState.elements.length,
|
||||
}));
|
||||
commitElementOperation(controller, "贴纸已加入画布");
|
||||
@@ -832,11 +845,11 @@ export function EditorPage({ projectId }: { projectId: string }) {
|
||||
{...(templateCategory ? { category: templateCategory } : {})}
|
||||
/> : null}
|
||||
{activePanel === "stickers" ? (() => {
|
||||
const visibleStickers = stickerWindow(P0A_STATIC_STICKER_CATALOG, stickerScrollTop, 280);
|
||||
return <section><h2>普通贴纸</h2><p aria-live="polite" className="editor-sticker-count">共 {P0A_STATIC_STICKER_COUNT.toLocaleString("zh-CN")} 张</p><div className="editor-sticker-virtual-list" data-testid="static-sticker-list" onScroll={(event) => setStickerScrollTop(event.currentTarget.scrollTop)} role="list">
|
||||
const visibleStickers = stickerWindow(stickerCatalog, stickerScrollTop, 280);
|
||||
return <section><h2>普通贴纸</h2><p aria-live="polite" className="editor-sticker-count">共 {stickerCatalog.length.toLocaleString("zh-CN")} 张</p><div className="editor-sticker-virtual-list" data-testid="static-sticker-list" onScroll={(event) => setStickerScrollTop(event.currentTarget.scrollTop)} role="list">
|
||||
<div style={{ paddingTop: visibleStickers.top_spacer_px, paddingBottom: visibleStickers.bottom_spacer_px }}>
|
||||
<div className="editor-sticker-grid">
|
||||
{visibleStickers.items.map((sticker) => <button aria-label={`添加贴纸 ${sticker.stable_id}`} data-sticker-id={sticker.stable_id} disabled={!canEdit || canvasState.elements.length >= 50} key={sticker.stable_id} onClick={() => addSticker(sticker.stable_id)} type="button"><img alt="" className="editor-sticker-preview" decoding="async" loading="lazy" src={sticker.thumbnail_reference.url} /><strong>{sticker.stable_id}</strong><span>part{sticker.part} · {sticker.order}</span></button>)}
|
||||
{visibleStickers.items.map((sticker) => <button aria-label={`添加贴纸 ${sticker.stable_id}`} data-sticker-id={sticker.stable_id} disabled={!canEdit || canvasState.elements.length >= 50} key={sticker.stable_id} onClick={() => addSticker(sticker)} type="button"><img alt="" className="editor-sticker-preview" decoding="async" loading="lazy" src={sticker.thumbnail_reference.url} /><strong>{sticker.stable_id}</strong><span>part{sticker.part} · {sticker.order}</span></button>)}
|
||||
</div>
|
||||
</div>
|
||||
</div>{canvasState.elements.length >= 50 ? <p className="editor-limit" role="status">画布最多 50 个元素，请先删除现有元素。</p> : null}</section>;
|
||||
|
||||
@@ -7,6 +7,7 @@ import { UserAuthPage } from "./user-auth.js";
|
||||
import { AccountSettingsPage } from "./account-settings.js";
|
||||
import { AdminUsersPage } from "./admin-users.js";
|
||||
import { AdminModelsPage } from "./admin-models.js";
|
||||
import { AdminAssetsPage } from "./admin-assets.js";
|
||||
import { CreditsPage } from "./credits-page.js";
|
||||
import { ProjectDetailPage, ProjectsPage, WorkspacePage } from "./project-pages.js";
|
||||
import { EditorPage } from "./editor-page.js";
|
||||
@@ -36,6 +37,7 @@ function renderAuthenticationEntry() {
|
||||
else if (window.location.pathname === "/app") authenticationPage = <WorkspacePage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/users") authenticationPage = <AdminUsersPage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/models") authenticationPage = <AdminModelsPage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/assets") authenticationPage = <AdminAssetsPage key={authRevision} />;
|
||||
else if (window.location.pathname.startsWith("/admin")) authenticationPage = <AdminAuthPage key={authRevision} />;
|
||||
else authenticationPage = <UserAuthPage key={authRevision} />;
|
||||
appRoot.render(
|
||||
|
||||
@@ -45,3 +45,4 @@ export function stickerWindow(items: readonly StaticStickerCatalogItem[], scroll
|
||||
}
|
||||
|
||||
export { staticStickerOriginalUrl, staticStickerThumbnailUrl };
|
||||
export type { StaticStickerCatalogItem };
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { rmSync } from "node:fs";
|
||||
import { existsSync, rmSync, statSync } from "node:fs";
|
||||
import { createRequire } from "node:module";
|
||||
import { isAbsolute, relative, resolve } from "node:path";
|
||||
|
||||
@@ -29,6 +29,40 @@ interface FileCleanupRow {
|
||||
const resourceScope = JSON.stringify([
|
||||
"project_state", "generation", "generated_image", "reference", "location", "latest_export",
|
||||
]);
|
||||
const auditRetentionMilliseconds = 180 * 24 * 60 * 60 * 1_000;
|
||||
const auditRefPattern = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/;
|
||||
const forbiddenSummaryKeys = new Set([
|
||||
"absolute_path", "api_key", "body", "code_hmac", "content", "credential", "email", "image",
|
||||
"image_content", "password", "path", "prompt", "secret", "session_token", "verification_code", "whitelist",
|
||||
]);
|
||||
const forbiddenSummaryFragments = ["content", "credential", "email", "image", "password", "path", "prompt", "secret", "token"];
|
||||
|
||||
function isSafeAuditRef(value: unknown) {
|
||||
return typeof value === "string" && auditRefPattern.test(value) ? 1 : 0;
|
||||
}
|
||||
|
||||
function isSafeAuditSummaryJson(value: unknown) {
|
||||
if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > 2_048) return 0;
|
||||
try {
|
||||
const valid = (entry: unknown, depth: number): boolean => {
|
||||
if (depth > 3) return false;
|
||||
if (entry === null || typeof entry === "boolean") return true;
|
||||
if (typeof entry === "number") return Number.isSafeInteger(entry);
|
||||
if (typeof entry === "string") return /^[A-Za-z0-9_.:@-]{1,160}$/.test(entry) && !entry.includes("@");
|
||||
if (Array.isArray(entry)) return entry.length <= 20 && entry.every((item) => valid(item, depth + 1));
|
||||
if (!entry || typeof entry !== "object") return false;
|
||||
return Object.entries(entry).length <= 32 && Object.entries(entry).every(([key, item]) => (
|
||||
auditRefPattern.test(key)
|
||||
&& !forbiddenSummaryKeys.has(key.toLowerCase())
|
||||
&& !forbiddenSummaryFragments.some((fragment) => key.toLowerCase().includes(fragment))
|
||||
&& valid(item, depth + 1)
|
||||
));
|
||||
};
|
||||
return valid(JSON.parse(value), 0) ? 1 : 0;
|
||||
} catch {
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
function iso(timestamp: number) {
|
||||
return new Date(timestamp).toISOString();
|
||||
@@ -47,6 +81,12 @@ export class ProjectPurgeCleanup {
|
||||
this.database.pragma("journal_mode = WAL");
|
||||
this.database.pragma("foreign_keys = ON");
|
||||
this.database.pragma("busy_timeout = 5000");
|
||||
this.database.function("dada_audit_ref_is_safe", { deterministic: true }, isSafeAuditRef);
|
||||
this.database.function("dada_audit_summary_is_safe", { deterministic: true }, isSafeAuditSummaryJson);
|
||||
this.database.function("dada_allow_privacy_purge", { deterministic: false }, () => 0);
|
||||
this.database.function("dada_privacy_purge_subject", { deterministic: false }, () => "");
|
||||
this.database.function("dada_allow_retention_purge", { deterministic: false }, () => 0);
|
||||
this.database.function("dada_retention_purge_now", { deterministic: false }, () => 0);
|
||||
}
|
||||
|
||||
close() {
|
||||
@@ -153,12 +193,16 @@ export class ProjectPurgeCleanup {
|
||||
if (pending.count === 0) {
|
||||
this.database.prepare("UPDATE asset_cleanup_requests SET status = 'completed' WHERE request_id = ? AND status = 'queued'")
|
||||
.run(request.request_id);
|
||||
this.insertAssetCleanupAudit(request.request_id, row.byte_size, this.clock());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if (this.tableExists("sticker_managed_file_history")) {
|
||||
this.database.prepare("DELETE FROM sticker_managed_file_history WHERE managed_file_id = ?").run(row.managed_file_id);
|
||||
}
|
||||
this.database.prepare("DELETE FROM managed_files WHERE file_id = ?").run(row.managed_file_id);
|
||||
if (this.tableExists("local_backend_storage_state")) this.decrementManagedCapacity(row.byte_size);
|
||||
if (this.tableExists("local_backend_storage_state")) this.remeasureManagedCapacity();
|
||||
}
|
||||
this.database.prepare(`
|
||||
UPDATE file_cleanup_queue SET status = 'completed', completed_at = ?, last_error = NULL
|
||||
@@ -238,4 +282,46 @@ export class ProjectPurgeCleanup {
|
||||
WHERE singleton = 1
|
||||
`).run(managed, notice, status, iso(this.clock()));
|
||||
}
|
||||
|
||||
private insertAssetCleanupAudit(requestId: string, deletedBytes: number, occurredAt: number) {
|
||||
if (!this.tableExists("admin_operation_logs")) return;
|
||||
this.database.prepare(`
|
||||
INSERT INTO admin_operation_logs (
|
||||
log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
|
||||
result, before_summary, after_summary, occurred_at, expires_at
|
||||
) VALUES (?, 'system', 'project_purge_worker', 'asset_cleanup_physical_completed', 'asset_cleanup', ?, 'succeeded', NULL, ?, ?, ?)
|
||||
`).run(
|
||||
randomUUID(), requestId, JSON.stringify({ deleted_bytes: deletedBytes, status: "completed" }), occurredAt,
|
||||
occurredAt + auditRetentionMilliseconds,
|
||||
);
|
||||
}
|
||||
|
||||
private remeasureManagedCapacity() {
|
||||
const state = this.database.prepare(`
|
||||
SELECT managed_content_bytes FROM local_backend_storage_state WHERE singleton = 1
|
||||
`).get() as { managed_content_bytes: number } | undefined;
|
||||
if (!state) return;
|
||||
const rows = this.database.prepare(`
|
||||
SELECT relative_path FROM managed_files WHERE status = 'committed'
|
||||
`).all() as Array<{ relative_path: string }>;
|
||||
let managed = 0;
|
||||
for (const row of rows) {
|
||||
try {
|
||||
const path = this.resolveManagedPath(row.relative_path);
|
||||
if (existsSync(path)) managed += statSync(path).size;
|
||||
} catch {
|
||||
// A missing or invalid path is excluded from the measured physical total.
|
||||
}
|
||||
}
|
||||
const reservations = this.tableExists("storage_reservations")
|
||||
? (this.database.prepare("SELECT COALESCE(SUM(projected_bytes), 0) AS bytes FROM storage_reservations WHERE status = 'active'").get() as { bytes: number }).bytes
|
||||
: 0;
|
||||
const notice = managed < 4_294_967_296 ? "normal" : managed < 4_831_838_208 ? "warning" : "critical";
|
||||
const status = managed + reservations >= 5_368_709_120 ? "full" : "active";
|
||||
this.database.prepare(`
|
||||
UPDATE local_backend_storage_state
|
||||
SET managed_content_bytes = ?, capacity_notice_level = ?, storage_status = ?, measured_at = ?, version = version + 1
|
||||
WHERE singleton = 1
|
||||
`).run(managed, notice, status, iso(this.clock()));
|
||||
}
|
||||
}
|
||||
|
||||
+6
-2
@@ -14,7 +14,7 @@
|
||||
"test:integration": "vitest run tests/integration",
|
||||
"test:api": "pnpm check:openapi && vitest run tests/api",
|
||||
"test:worker": "pnpm --filter @dada/worker build && node scripts/worker-smoke.mjs && vitest run tests/worker",
|
||||
"test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts --config playwright.config.ts",
|
||||
"test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts tests/e2e/wp5-04-resource-isolation.spec.ts tests/e2e/wp5-05-admin-assets.spec.ts --config playwright.config.ts",
|
||||
"test:visual": "node scripts/run-wp4-07-layer.mjs visual",
|
||||
"test:performance": "node scripts/run-wp4-07-layer.mjs performance",
|
||||
"test:security": "node scripts/verify-frozen-dependencies.mjs && node scripts/redaction-scan.mjs",
|
||||
@@ -94,7 +94,11 @@
|
||||
"test:wp5-02:red": "node scripts/run-wp5-02-validation.mjs --phase red",
|
||||
"preview:wp5-02": "node scripts/run-wp5-02-manual-preview.mjs",
|
||||
"test:wp5-03": "node scripts/run-wp5-03-validation.mjs",
|
||||
"test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red"
|
||||
"test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red",
|
||||
"test:wp5-04": "node scripts/run-wp5-04-validation.mjs",
|
||||
"test:wp5-04:red": "node scripts/run-wp5-04-validation.mjs --phase red",
|
||||
"test:wp5-05": "node scripts/run-wp5-05-validation.mjs",
|
||||
"test:wp5-05:red": "node scripts/run-wp5-05-validation.mjs --phase red"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@playwright/test": "1.62.0",
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"name": "@dada/asset-release-manifest",
|
||||
"version": "0.0.0",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"exports": {
|
||||
".": "./dist/index.js"
|
||||
},
|
||||
"types": "./dist/index.d.ts",
|
||||
"scripts": {
|
||||
"build": "tsc -p tsconfig.json",
|
||||
"typecheck": "tsc --noEmit -p tsconfig.json"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/node": "24.13.3",
|
||||
"typescript": "7.0.2"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,180 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { posix, win32 } from "node:path";
|
||||
|
||||
export const ASSET_ACCESS_CLASSES = [
|
||||
"public_release_asset",
|
||||
"internal_preview_asset",
|
||||
"private_user_asset",
|
||||
] as const;
|
||||
|
||||
export type AssetAccessClass = typeof ASSET_ACCESS_CLASSES[number];
|
||||
export type PublicAssetCacheKind = "font" | "template_conversion" | "thumbnail";
|
||||
|
||||
export interface AssetReleaseItemInput {
|
||||
access_class: AssetAccessClass;
|
||||
cache_kind?: PublicAssetCacheKind;
|
||||
content: Uint8Array;
|
||||
mime_type: string;
|
||||
owner_id?: string;
|
||||
relative_path: string;
|
||||
resource_id: string;
|
||||
root_ref: string;
|
||||
sha256?: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseManifestInput {
|
||||
items: readonly AssetReleaseItemInput[];
|
||||
release_version: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseManifestItem {
|
||||
access_class: AssetAccessClass;
|
||||
byte_size: number;
|
||||
cache_kind?: PublicAssetCacheKind;
|
||||
mime_type: string;
|
||||
release_version: string;
|
||||
resource_id: string;
|
||||
sha256: string;
|
||||
url: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseManifestProjection {
|
||||
items: readonly AssetReleaseManifestItem[];
|
||||
manifest_sha256: string;
|
||||
release_version: string;
|
||||
schema_version: "AssetReleaseManifest/v1";
|
||||
}
|
||||
|
||||
export interface AssetReleasePayload {
|
||||
accessClass: AssetAccessClass;
|
||||
bytes: Buffer;
|
||||
mimeType: string;
|
||||
ownerId?: string;
|
||||
releaseVersion: string;
|
||||
resourceId: string;
|
||||
sha256: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseReader {
|
||||
project(
|
||||
accessClass: AssetAccessClass,
|
||||
releaseVersion: string,
|
||||
options?: { ownerId?: string; resourceIds?: readonly string[] },
|
||||
): AssetReleaseManifestProjection | undefined;
|
||||
read(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string): AssetReleasePayload | undefined;
|
||||
}
|
||||
|
||||
interface StoredItem {
|
||||
accessClass: AssetAccessClass;
|
||||
bytes: Buffer;
|
||||
cacheKind?: PublicAssetCacheKind;
|
||||
mimeType: string;
|
||||
ownerId?: string;
|
||||
projection: AssetReleaseManifestItem;
|
||||
relativePath: string;
|
||||
rootRef: string;
|
||||
sha256: string;
|
||||
}
|
||||
|
||||
const releaseVersionPattern = /^[a-z0-9][a-z0-9._-]{0,79}$/i;
|
||||
const resourceIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
||||
const sha256Pattern = /^[0-9a-f]{64}$/;
|
||||
const rootRefPattern = /^[a-z0-9][a-z0-9._-]{0,79}$/i;
|
||||
|
||||
function assetUrl(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string) {
|
||||
if (accessClass === "public_release_asset") return `/api/v1/assets/public/${releaseVersion}/${resourceId}`;
|
||||
if (accessClass === "internal_preview_asset") return `/api/v1/assets/preview/${releaseVersion}/${resourceId}`;
|
||||
return `/api/v1/private-assets/${releaseVersion}/${resourceId}`;
|
||||
}
|
||||
|
||||
function isSafeRelativePath(value: string) {
|
||||
if (!value || value.includes("\\") || posix.isAbsolute(value) || win32.isAbsolute(value)) return false;
|
||||
const segments = value.split("/");
|
||||
return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
|
||||
}
|
||||
|
||||
function sha256(value: string | Uint8Array) {
|
||||
return createHash("sha256").update(value).digest("hex");
|
||||
}
|
||||
|
||||
function immutableProjection(input: Omit<AssetReleaseManifestProjection, "manifest_sha256">): AssetReleaseManifestProjection {
|
||||
const items = input.items.map((item) => Object.freeze({ ...item }));
|
||||
const manifestBody = JSON.stringify({ ...input, items });
|
||||
return Object.freeze({ ...input, items: Object.freeze(items), manifest_sha256: sha256(manifestBody) });
|
||||
}
|
||||
|
||||
function validateItem(item: AssetReleaseItemInput, releaseVersion: string, seenIds: Set<string>): StoredItem {
|
||||
if (!ASSET_ACCESS_CLASSES.includes(item.access_class)) throw new Error("asset access class is unsupported");
|
||||
if (!resourceIdPattern.test(item.resource_id) || seenIds.has(item.resource_id)) throw new Error("resource_id must be a unique opaque UUID");
|
||||
seenIds.add(item.resource_id);
|
||||
if (!rootRefPattern.test(item.root_ref)) throw new Error("root_ref is invalid");
|
||||
if (!isSafeRelativePath(item.relative_path)) throw new Error("relative path must stay within its declared root");
|
||||
if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/i.test(item.mime_type)) throw new Error("mime_type is invalid");
|
||||
if (item.access_class === "public_release_asset" && !item.cache_kind) throw new Error("public release asset requires an allowlisted cache kind");
|
||||
if (item.access_class !== "public_release_asset" && item.cache_kind) throw new Error("non-public assets cannot declare a public cache kind");
|
||||
if (item.access_class === "private_user_asset" && !item.owner_id) throw new Error("private user asset requires owner_id");
|
||||
if (item.access_class !== "private_user_asset" && item.owner_id) throw new Error("only private user assets can declare owner_id");
|
||||
|
||||
const bytes = Buffer.from(item.content);
|
||||
const digest = sha256(bytes);
|
||||
if (item.sha256 !== undefined && (!sha256Pattern.test(item.sha256) || item.sha256 !== digest)) {
|
||||
throw new Error("file SHA-256 does not match content");
|
||||
}
|
||||
const projection: AssetReleaseManifestItem = {
|
||||
access_class: item.access_class,
|
||||
byte_size: bytes.byteLength,
|
||||
...(item.cache_kind ? { cache_kind: item.cache_kind } : {}),
|
||||
mime_type: item.mime_type,
|
||||
release_version: releaseVersion,
|
||||
resource_id: item.resource_id,
|
||||
sha256: digest,
|
||||
url: assetUrl(item.access_class, releaseVersion, item.resource_id),
|
||||
};
|
||||
return {
|
||||
accessClass: item.access_class,
|
||||
bytes,
|
||||
...(item.cache_kind ? { cacheKind: item.cache_kind } : {}),
|
||||
mimeType: item.mime_type,
|
||||
...(item.owner_id ? { ownerId: item.owner_id } : {}),
|
||||
projection: Object.freeze(projection),
|
||||
relativePath: item.relative_path,
|
||||
rootRef: item.root_ref,
|
||||
sha256: digest,
|
||||
};
|
||||
}
|
||||
|
||||
export function createAssetReleaseManifest(input: AssetReleaseManifestInput): AssetReleaseReader {
|
||||
if (!releaseVersionPattern.test(input.release_version)) throw new Error("release_version is invalid");
|
||||
const seenIds = new Set<string>();
|
||||
const items = input.items
|
||||
.map((item) => validateItem(item, input.release_version, seenIds))
|
||||
.sort((left, right) => left.projection.resource_id.localeCompare(right.projection.resource_id));
|
||||
|
||||
return Object.freeze({
|
||||
project(accessClass: AssetAccessClass, releaseVersion: string, options: { ownerId?: string; resourceIds?: readonly string[] } = {}) {
|
||||
if (releaseVersion !== input.release_version) return undefined;
|
||||
const selected = items.filter((item) => item.accessClass === accessClass
|
||||
&& (accessClass !== "private_user_asset" || Boolean(options.ownerId) && item.ownerId === options.ownerId)
|
||||
&& (!options.resourceIds || options.resourceIds.includes(item.projection.resource_id)));
|
||||
return immutableProjection({
|
||||
items: selected.map((item) => item.projection),
|
||||
release_version: input.release_version,
|
||||
schema_version: "AssetReleaseManifest/v1",
|
||||
});
|
||||
},
|
||||
read(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string) {
|
||||
if (releaseVersion !== input.release_version) return undefined;
|
||||
const item = items.find((candidate) => candidate.accessClass === accessClass && candidate.projection.resource_id === resourceId);
|
||||
if (!item) return undefined;
|
||||
return {
|
||||
accessClass: item.accessClass,
|
||||
bytes: Buffer.from(item.bytes),
|
||||
mimeType: item.mimeType,
|
||||
...(item.ownerId ? { ownerId: item.ownerId } : {}),
|
||||
releaseVersion,
|
||||
resourceId,
|
||||
sha256: item.sha256,
|
||||
};
|
||||
},
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{
|
||||
"extends": "../../tsconfig.base.json",
|
||||
"compilerOptions": {
|
||||
"module": "NodeNext",
|
||||
"moduleResolution": "NodeNext",
|
||||
"lib": ["ES2024"],
|
||||
"types": ["node"],
|
||||
"declaration": true,
|
||||
"outDir": "dist",
|
||||
"rootDir": "src"
|
||||
},
|
||||
"include": ["src"]
|
||||
}
|
||||
@@ -16,8 +16,8 @@ export interface StaticStickerCatalogItem {
|
||||
relative_path: string;
|
||||
width: number;
|
||||
height: number;
|
||||
mime_type: "image/png";
|
||||
mime: "image/png";
|
||||
mime_type: "image/png" | "image/webp";
|
||||
mime: "image/png" | "image/webp";
|
||||
sha256: string;
|
||||
original_reference: string;
|
||||
thumbnail_reference: StaticStickerThumbnailReference;
|
||||
|
||||
Generated
+328
@@ -38,9 +38,15 @@ importers:
|
||||
|
||||
apps/api:
|
||||
dependencies:
|
||||
'@dada/asset-release-manifest':
|
||||
specifier: workspace:*
|
||||
version: link:../../packages/asset-release-manifest
|
||||
'@dada/shared-contracts':
|
||||
specifier: workspace:*
|
||||
version: link:../../packages/shared-contracts
|
||||
'@dada/static-sticker-catalog':
|
||||
specifier: workspace:*
|
||||
version: link:../../packages/static-sticker-catalog
|
||||
'@fastify/multipart':
|
||||
specifier: 10.1.0
|
||||
version: 10.1.0
|
||||
@@ -59,6 +65,9 @@ importers:
|
||||
fastify:
|
||||
specifier: 5.10.0
|
||||
version: 5.10.0
|
||||
sharp:
|
||||
specifier: 0.35.3
|
||||
version: 0.35.3(@types/node@24.13.3)
|
||||
devDependencies:
|
||||
'@types/better-sqlite3':
|
||||
specifier: 7.6.13
|
||||
@@ -151,6 +160,15 @@ importers:
|
||||
specifier: 7.0.2
|
||||
version: 7.0.2
|
||||
|
||||
packages/asset-release-manifest:
|
||||
devDependencies:
|
||||
'@types/node':
|
||||
specifier: 24.13.3
|
||||
version: 24.13.3
|
||||
typescript:
|
||||
specifier: 7.0.2
|
||||
version: 7.0.2
|
||||
|
||||
packages/asset-renderer:
|
||||
dependencies:
|
||||
'@dada/template-registry':
|
||||
@@ -259,6 +277,168 @@ packages:
|
||||
'@fastify/swagger@9.8.1':
|
||||
resolution: {integrity: sha512-VpHMnqZTY8iBZYJE8WWkbKPrXIYWy2rDfIf5qLr6DzZSpQYZ+KxQVcJFiq/AMlvNwI4gCBd66++iUlxXXGT0IQ==}
|
||||
|
||||
'@img/colour@1.1.0':
|
||||
resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
|
||||
engines: {node: '>=18'}
|
||||
|
||||
'@img/sharp-darwin-arm64@0.35.3':
|
||||
resolution: {integrity: sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [arm64]
|
||||
os: [darwin]
|
||||
|
||||
'@img/sharp-darwin-x64@0.35.3':
|
||||
resolution: {integrity: sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [x64]
|
||||
os: [darwin]
|
||||
|
||||
'@img/sharp-freebsd-wasm32@0.35.3':
|
||||
resolution: {integrity: sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
os: [freebsd]
|
||||
|
||||
'@img/sharp-libvips-darwin-arm64@1.3.2':
|
||||
resolution: {integrity: sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==}
|
||||
cpu: [arm64]
|
||||
os: [darwin]
|
||||
|
||||
'@img/sharp-libvips-darwin-x64@1.3.2':
|
||||
resolution: {integrity: sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==}
|
||||
cpu: [x64]
|
||||
os: [darwin]
|
||||
|
||||
'@img/sharp-libvips-linux-arm64@1.3.2':
|
||||
resolution: {integrity: sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==}
|
||||
cpu: [arm64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-libvips-linux-arm@1.3.2':
|
||||
resolution: {integrity: sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==}
|
||||
cpu: [arm]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-libvips-linux-ppc64@1.3.2':
|
||||
resolution: {integrity: sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==}
|
||||
cpu: [ppc64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-libvips-linux-riscv64@1.3.2':
|
||||
resolution: {integrity: sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==}
|
||||
cpu: [riscv64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-libvips-linux-s390x@1.3.2':
|
||||
resolution: {integrity: sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==}
|
||||
cpu: [s390x]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-libvips-linux-x64@1.3.2':
|
||||
resolution: {integrity: sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==}
|
||||
cpu: [x64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-libvips-linuxmusl-arm64@1.3.2':
|
||||
resolution: {integrity: sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==}
|
||||
cpu: [arm64]
|
||||
os: [linux]
|
||||
libc: [musl]
|
||||
|
||||
'@img/sharp-libvips-linuxmusl-x64@1.3.2':
|
||||
resolution: {integrity: sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==}
|
||||
cpu: [x64]
|
||||
os: [linux]
|
||||
libc: [musl]
|
||||
|
||||
'@img/sharp-linux-arm64@0.35.3':
|
||||
resolution: {integrity: sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [arm64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-linux-arm@0.35.3':
|
||||
resolution: {integrity: sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [arm]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-linux-ppc64@0.35.3':
|
||||
resolution: {integrity: sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [ppc64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-linux-riscv64@0.35.3':
|
||||
resolution: {integrity: sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [riscv64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-linux-s390x@0.35.3':
|
||||
resolution: {integrity: sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [s390x]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-linux-x64@0.35.3':
|
||||
resolution: {integrity: sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [x64]
|
||||
os: [linux]
|
||||
libc: [glibc]
|
||||
|
||||
'@img/sharp-linuxmusl-arm64@0.35.3':
|
||||
resolution: {integrity: sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [arm64]
|
||||
os: [linux]
|
||||
libc: [musl]
|
||||
|
||||
'@img/sharp-linuxmusl-x64@0.35.3':
|
||||
resolution: {integrity: sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [x64]
|
||||
os: [linux]
|
||||
libc: [musl]
|
||||
|
||||
'@img/sharp-wasm32@0.35.3':
|
||||
resolution: {integrity: sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
|
||||
'@img/sharp-webcontainers-wasm32@0.35.3':
|
||||
resolution: {integrity: sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [wasm32]
|
||||
|
||||
'@img/sharp-win32-arm64@0.35.3':
|
||||
resolution: {integrity: sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [arm64]
|
||||
os: [win32]
|
||||
|
||||
'@img/sharp-win32-ia32@0.35.3':
|
||||
resolution: {integrity: sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==}
|
||||
engines: {node: ^20.9.0}
|
||||
cpu: [ia32]
|
||||
os: [win32]
|
||||
|
||||
'@img/sharp-win32-x64@0.35.3':
|
||||
resolution: {integrity: sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
cpu: [x64]
|
||||
os: [win32]
|
||||
|
||||
'@jridgewell/sourcemap-codec@1.5.5':
|
||||
resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
|
||||
|
||||
@@ -1199,6 +1379,15 @@ packages:
|
||||
set-cookie-parser@2.7.2:
|
||||
resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
|
||||
|
||||
sharp@0.35.3:
|
||||
resolution: {integrity: sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==}
|
||||
engines: {node: '>=20.9.0'}
|
||||
peerDependencies:
|
||||
'@types/node': '*'
|
||||
peerDependenciesMeta:
|
||||
'@types/node':
|
||||
optional: true
|
||||
|
||||
siginfo@2.0.0:
|
||||
resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
|
||||
|
||||
@@ -1531,6 +1720,112 @@ snapshots:
|
||||
transitivePeerDependencies:
|
||||
- supports-color
|
||||
|
||||
'@img/colour@1.1.0': {}
|
||||
|
||||
'@img/sharp-darwin-arm64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-darwin-arm64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-darwin-x64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-darwin-x64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-freebsd-wasm32@0.35.3':
|
||||
dependencies:
|
||||
'@img/sharp-wasm32': 0.35.3
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-darwin-arm64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-darwin-x64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linux-arm64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linux-arm@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linux-ppc64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linux-riscv64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linux-s390x@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linux-x64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linuxmusl-arm64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-libvips-linuxmusl-x64@1.3.2':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linux-arm64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linux-arm64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linux-arm@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linux-arm': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linux-ppc64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linux-ppc64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linux-riscv64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linux-riscv64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linux-s390x@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linux-s390x': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linux-x64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linux-x64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linuxmusl-arm64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linuxmusl-arm64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-linuxmusl-x64@0.35.3':
|
||||
optionalDependencies:
|
||||
'@img/sharp-libvips-linuxmusl-x64': 1.3.2
|
||||
optional: true
|
||||
|
||||
'@img/sharp-wasm32@0.35.3':
|
||||
dependencies:
|
||||
'@emnapi/runtime': 1.11.1
|
||||
optional: true
|
||||
|
||||
'@img/sharp-webcontainers-wasm32@0.35.3':
|
||||
dependencies:
|
||||
'@img/sharp-wasm32': 0.35.3
|
||||
optional: true
|
||||
|
||||
'@img/sharp-win32-arm64@0.35.3':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-win32-ia32@0.35.3':
|
||||
optional: true
|
||||
|
||||
'@img/sharp-win32-x64@0.35.3':
|
||||
optional: true
|
||||
|
||||
'@jridgewell/sourcemap-codec@1.5.5': {}
|
||||
|
||||
'@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
|
||||
@@ -2321,6 +2616,39 @@ snapshots:
|
||||
|
||||
set-cookie-parser@2.7.2: {}
|
||||
|
||||
sharp@0.35.3(@types/node@24.13.3):
|
||||
dependencies:
|
||||
'@img/colour': 1.1.0
|
||||
detect-libc: 2.1.2
|
||||
semver: 7.8.5
|
||||
optionalDependencies:
|
||||
'@img/sharp-darwin-arm64': 0.35.3
|
||||
'@img/sharp-darwin-x64': 0.35.3
|
||||
'@img/sharp-freebsd-wasm32': 0.35.3
|
||||
'@img/sharp-libvips-darwin-arm64': 1.3.2
|
||||
'@img/sharp-libvips-darwin-x64': 1.3.2
|
||||
'@img/sharp-libvips-linux-arm': 1.3.2
|
||||
'@img/sharp-libvips-linux-arm64': 1.3.2
|
||||
'@img/sharp-libvips-linux-ppc64': 1.3.2
|
||||
'@img/sharp-libvips-linux-riscv64': 1.3.2
|
||||
'@img/sharp-libvips-linux-s390x': 1.3.2
|
||||
'@img/sharp-libvips-linux-x64': 1.3.2
|
||||
'@img/sharp-libvips-linuxmusl-arm64': 1.3.2
|
||||
'@img/sharp-libvips-linuxmusl-x64': 1.3.2
|
||||
'@img/sharp-linux-arm': 0.35.3
|
||||
'@img/sharp-linux-arm64': 0.35.3
|
||||
'@img/sharp-linux-ppc64': 0.35.3
|
||||
'@img/sharp-linux-riscv64': 0.35.3
|
||||
'@img/sharp-linux-s390x': 0.35.3
|
||||
'@img/sharp-linux-x64': 0.35.3
|
||||
'@img/sharp-linuxmusl-arm64': 0.35.3
|
||||
'@img/sharp-linuxmusl-x64': 0.35.3
|
||||
'@img/sharp-webcontainers-wasm32': 0.35.3
|
||||
'@img/sharp-win32-arm64': 0.35.3
|
||||
'@img/sharp-win32-ia32': 0.35.3
|
||||
'@img/sharp-win32-x64': 0.35.3
|
||||
'@types/node': 24.13.3
|
||||
|
||||
siginfo@2.0.0: {}
|
||||
|
||||
simple-concat@1.0.1:
|
||||
|
||||
@@ -26,12 +26,15 @@ export const frozenPackages = {
|
||||
},
|
||||
"apps/api/package.json": {
|
||||
dependencies: {
|
||||
"@dada/asset-release-manifest": "workspace:*",
|
||||
"@dada/static-sticker-catalog": "workspace:*",
|
||||
"@fastify/multipart": "10.1.0",
|
||||
"@fastify/swagger": "9.8.1",
|
||||
"@sinclair/typebox": "0.34.52",
|
||||
"better-sqlite3": "13.0.1",
|
||||
"drizzle-orm": "0.45.2",
|
||||
fastify: "5.10.0",
|
||||
sharp: "0.35.3",
|
||||
},
|
||||
devDependencies: {
|
||||
typescript: "7.0.2",
|
||||
@@ -46,6 +49,12 @@ export const frozenPackages = {
|
||||
typescript: "7.0.2",
|
||||
},
|
||||
},
|
||||
"packages/asset-release-manifest/package.json": {
|
||||
devDependencies: {
|
||||
"@types/node": "24.13.3",
|
||||
typescript: "7.0.2",
|
||||
},
|
||||
},
|
||||
"packages/shared-contracts/package.json": {
|
||||
dependencies: {
|
||||
"@sinclair/typebox": "0.34.52",
|
||||
|
||||
@@ -13,8 +13,7 @@ function runPnpm(args) {
|
||||
}
|
||||
|
||||
export function buildApiContracts() {
|
||||
runPnpm(["--filter", "@dada/shared-contracts", "build"]);
|
||||
runPnpm(["--filter", "@dada/api", "build"]);
|
||||
runPnpm(["--filter", "@dada/api...", "build"]);
|
||||
}
|
||||
|
||||
export async function createOpenApiDocument() {
|
||||
|
||||
@@ -98,7 +98,11 @@ function copyRuntimeDependencies(sourceRoot, destinationRoot, rootNames) {
|
||||
try {
|
||||
entry = requireFrom.resolve(name);
|
||||
} catch (error) {
|
||||
throw new Error(`Runtime dependency ${name} is unavailable from ${sourceRoot}.`, { cause: error });
|
||||
try {
|
||||
entry = requireFrom.resolve(`${name}/package`);
|
||||
} catch {
|
||||
throw new Error(`Runtime dependency ${name} is unavailable from ${sourceRoot}.`, { cause: error });
|
||||
}
|
||||
}
|
||||
const root = packageRootFromEntry(entry, name);
|
||||
const manifest = json(join(root, "package.json"));
|
||||
@@ -117,6 +121,14 @@ function copyRuntimeDependencies(sourceRoot, destinationRoot, rootNames) {
|
||||
for (const dependency of Object.keys(manifest.dependencies ?? {})) {
|
||||
copyResolved(dependency, nestedRequire, join(destination, "node_modules"), nestedAncestors);
|
||||
}
|
||||
for (const dependency of Object.keys(manifest.optionalDependencies ?? {})) {
|
||||
try {
|
||||
copyResolved(dependency, nestedRequire, join(destination, "node_modules"), nestedAncestors);
|
||||
} catch (error) {
|
||||
if (error?.cause?.code !== "MODULE_NOT_FOUND") throw error;
|
||||
debug(`skip unavailable optional dependency ${dependency}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
const rootRequire = createRequire(join(sourceRoot, "package.json"));
|
||||
for (const name of rootNames) copyResolved(name, rootRequire, join(destinationRoot, "node_modules"), new Set());
|
||||
@@ -306,7 +318,7 @@ export async function buildAndValidatePortablePackage({ evidenceDirectory, outpu
|
||||
|
||||
const serverRoot = join(packageDirectory, "server");
|
||||
debug("copy API application");
|
||||
const apiDependencies = copyApplication(join(repositoryRoot, "apps", "api"), join(serverRoot, "api"), ["@fastify/multipart", "@fastify/swagger", "@sinclair/typebox", "better-sqlite3", "fastify"]);
|
||||
const apiDependencies = copyApplication(join(repositoryRoot, "apps", "api"), join(serverRoot, "api"), ["@fastify/multipart", "@fastify/swagger", "@sinclair/typebox", "better-sqlite3", "fastify", "sharp"]);
|
||||
debug("copy Worker application");
|
||||
const workerDependencies = copyApplication(join(repositoryRoot, "apps", "worker"), join(serverRoot, "worker"), ["better-sqlite3"]);
|
||||
const sharedDestination = join(serverRoot, "api", "node_modules", "@dada", "shared-contracts");
|
||||
|
||||
@@ -0,0 +1,132 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
const phaseIndex = process.argv.indexOf("--phase");
|
||||
const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
|
||||
if (!["red", "green"].includes(phase)) throw new Error(`Unsupported phase: ${phase}`);
|
||||
const runId = process.env.DADA_TDD_RUN_ID ?? `wp5-04-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
|
||||
const runDirectory = resolve("artifacts", "tdd", runId);
|
||||
const casesDirectory = resolve(runDirectory, "cases");
|
||||
if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
|
||||
|
||||
const cases = [
|
||||
{
|
||||
acceptance_criteria: ["AC-42", "AC-48"],
|
||||
evidence: ["response.json", "headers.json", "cache-enumeration.json", "trace.zip"],
|
||||
id: "TDD-WP5-RES-001-three-access-classes",
|
||||
red_reason: "公开 manifest 暴露 internal/private、路径可推导或缓存策略混用",
|
||||
requirements: ["PRIV-02", "PRIV-05"],
|
||||
},
|
||||
{
|
||||
acceptance_criteria: ["AC-46", "AC-48"],
|
||||
evidence: ["cache-enumeration.json", "service-worker.json", "trace.zip"],
|
||||
id: "TDD-WP5-CACHE-001-no-private-client-state",
|
||||
red_reason: "SW 拦截 internal/private 或 IndexedDB 保存私有字段",
|
||||
requirements: ["NFR-07", "PRIV-02"],
|
||||
},
|
||||
];
|
||||
for (const item of cases) mkdirSync(resolve(casesDirectory, item.id), { recursive: true });
|
||||
|
||||
const resourceDirectory = resolve(casesDirectory, cases[0].id);
|
||||
const cacheDirectory = resolve(casesDirectory, cases[1].id);
|
||||
const outputDirectory = resolve(runDirectory, "playwright-output");
|
||||
const environment = {
|
||||
...process.env,
|
||||
DADA_EVIDENCE_DIR_WP5_CACHE: cacheDirectory,
|
||||
DADA_EVIDENCE_DIR_WP5_RES: resourceDirectory,
|
||||
DADA_PLAYWRIGHT_OUTPUT_DIR: outputDirectory,
|
||||
};
|
||||
const commands = phase === "red"
|
||||
? [["red-focused", "pnpm --filter @dada/shared-contracts build && pnpm exec vitest run tests/unit/wp5-04-asset-release-manifest.test.ts tests/api/wp5-04-asset-access.test.ts"]]
|
||||
: [
|
||||
["build-manifest", "pnpm --filter @dada/asset-release-manifest build"],
|
||||
["unit", "pnpm test:unit"],
|
||||
["api", "pnpm test:api"],
|
||||
["e2e", "pnpm test:e2e"],
|
||||
["security", "pnpm test:security"],
|
||||
["package", "pnpm test:package"],
|
||||
["tdd-trace", "pnpm validate:tdd-trace"],
|
||||
];
|
||||
const commandResults = [];
|
||||
for (const [name, command] of commands) {
|
||||
const started_at = new Date().toISOString();
|
||||
const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
|
||||
encoding: "utf8", env: environment, maxBuffer: 40 * 1024 * 1024,
|
||||
});
|
||||
if (result.stdout) process.stdout.write(result.stdout);
|
||||
if (result.stderr) process.stderr.write(result.stderr);
|
||||
commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
|
||||
if (phase === "green" && (result.status ?? 1) !== 0) break;
|
||||
}
|
||||
|
||||
function findFiles(directory, name) {
|
||||
const matches = [];
|
||||
if (!existsSync(directory)) return matches;
|
||||
for (const entry of readdirSync(directory, { withFileTypes: true })) {
|
||||
const path = resolve(directory, entry.name);
|
||||
if (entry.isDirectory()) matches.push(...findFiles(path, name));
|
||||
else if (entry.name === name) matches.push(path);
|
||||
}
|
||||
return matches;
|
||||
}
|
||||
|
||||
if (phase === "green") {
|
||||
const trace = findFiles(outputDirectory, "trace.zip").find((path) => path.toLowerCase().includes("wp5-04"));
|
||||
if (trace) {
|
||||
copyFileSync(trace, resolve(resourceDirectory, "trace.zip"));
|
||||
copyFileSync(trace, resolve(cacheDirectory, "trace.zip"));
|
||||
}
|
||||
}
|
||||
|
||||
const redConfirmed = phase === "red" && commandResults.length === 1 && commandResults[0].exit_code !== 0;
|
||||
if (phase === "red") {
|
||||
for (const item of cases) {
|
||||
writeFileSync(resolve(casesDirectory, item.id, "red-observation.json"), `${JSON.stringify({
|
||||
expected_failure: item.red_reason,
|
||||
observed_command: commandResults[0].command,
|
||||
observed_exit_code: commandResults[0].exit_code,
|
||||
status: redConfirmed ? "red_confirmed" : "failed",
|
||||
}, null, 2)}\n`);
|
||||
}
|
||||
}
|
||||
|
||||
const commandState = phase === "red" ? redConfirmed : commandResults.length === commands.length && commandResults.every((result) => result.exit_code === 0);
|
||||
const manifest = { path: "tasks.manifest.json", sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase() };
|
||||
const commit = spawnSync("git", ["rev-parse", "--short", "HEAD"], { encoding: "utf8" }).stdout.trim();
|
||||
const dirty = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8" }).stdout.trim().length > 0;
|
||||
const summaries = [];
|
||||
for (const item of cases) {
|
||||
const directory = resolve(casesDirectory, item.id);
|
||||
const evidenceRefs = phase === "red" ? ["red-observation.json"] : item.evidence;
|
||||
const missingEvidence = evidenceRefs.filter((file) => !existsSync(resolve(directory, file)));
|
||||
const status = commandState && missingEvidence.length === 0 ? phase === "red" ? "red_confirmed" : "passed" : "failed";
|
||||
writeFileSync(resolve(directory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(directory, "result.json"), `${JSON.stringify({
|
||||
acceptance_criteria: item.acceptance_criteria,
|
||||
automation: ["automated"],
|
||||
commit,
|
||||
evidence_refs: evidenceRefs,
|
||||
layer: ["UNIT", "API", "E2E", "PKG-SEC"],
|
||||
manifest,
|
||||
missing_evidence: missingEvidence,
|
||||
phase,
|
||||
red_reason: item.red_reason,
|
||||
requirements: item.requirements,
|
||||
run_id: runId,
|
||||
status,
|
||||
task_id: "TASK-WP5-04",
|
||||
test_id: item.id,
|
||||
work_package: "WP-5",
|
||||
worktree_under_test: dirty ? "uncommitted implementation" : "clean committed implementation",
|
||||
}, null, 2)}\n`);
|
||||
summaries.push({ missing_evidence: missingEvidence, status, test_id: item.id });
|
||||
}
|
||||
const status = summaries.every((item) => item.status === (phase === "red" ? "red_confirmed" : "passed"))
|
||||
? phase === "red" ? "red_confirmed" : "passed"
|
||||
: "failed";
|
||||
writeFileSync(resolve(runDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: summaries, phase, run_id: runId, status }, null, 2)}\n`);
|
||||
console.log(JSON.stringify({ cases: summaries, phase, run_id: runId, status }, null, 2));
|
||||
if (status === "failed") process.exit(1);
|
||||
@@ -0,0 +1,63 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
const phaseIndex = process.argv.indexOf("--phase");
|
||||
const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
|
||||
if (!new Set(["red", "green"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
|
||||
const runId = process.env.DADA_TDD_RUN_ID ?? `wp5-05-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
|
||||
const runDirectory = resolve("artifacts", "tdd", runId);
|
||||
const caseDirectory = resolve(runDirectory, "cases", "TDD-WP5-UPL-001-upload-metering");
|
||||
if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
|
||||
mkdirSync(caseDirectory, { recursive: true });
|
||||
|
||||
const commands = phase === "red"
|
||||
? [["red-focused", "pnpm --filter @dada/shared-contracts build && pnpm exec vitest run tests/integration/wp5-05-sticker-release.test.ts tests/api/wp5-05-sticker-upload.test.ts"]]
|
||||
: [
|
||||
["unit", "pnpm test:unit"],
|
||||
["integration", "pnpm test:integration"],
|
||||
["api", "pnpm test:api"],
|
||||
["e2e", "pnpm test:e2e"],
|
||||
["security", "pnpm test:security"],
|
||||
["tdd-trace", "pnpm validate:tdd-trace"],
|
||||
];
|
||||
const results = [];
|
||||
for (const [name, command] of commands) {
|
||||
const started_at = new Date().toISOString();
|
||||
const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
|
||||
encoding: "utf8", env: { ...process.env, DADA_EVIDENCE_DIR_WP5_UPL: caseDirectory }, maxBuffer: 40 * 1024 * 1024,
|
||||
});
|
||||
if (result.stdout) process.stdout.write(result.stdout);
|
||||
if (result.stderr) process.stderr.write(result.stderr);
|
||||
results.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
|
||||
if (phase === "green" && (result.status ?? 1) !== 0) break;
|
||||
}
|
||||
|
||||
const redConfirmed = phase === "red" && results.length === 1 && results[0].exit_code !== 0;
|
||||
if (phase === "red") writeFileSync(resolve(caseDirectory, "red-observation.json"), `${JSON.stringify({
|
||||
expected_failure: "后台上传未流式校验、原图/缩略图漏计量或 full 仍写入",
|
||||
observed_command: results[0].command,
|
||||
observed_exit_code: results[0].exit_code,
|
||||
status: redConfirmed ? "red_confirmed" : "failed",
|
||||
}, null, 2)}\n`);
|
||||
const evidenceRefs = phase === "red" ? ["red-observation.json"] : ["response.json", "db-diff.json", "fs-before.json", "fs-after.json"];
|
||||
const missingEvidence = evidenceRefs.filter((name) => !existsSync(resolve(caseDirectory, name)));
|
||||
const commandState = phase === "red" ? redConfirmed : results.length === commands.length && results.every((item) => item.exit_code === 0);
|
||||
const status = commandState && missingEvidence.length === 0 ? phase === "red" ? "red_confirmed" : "passed" : "failed";
|
||||
const manifest = { path: "tasks.manifest.json", sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase() };
|
||||
const commit = spawnSync("git", ["rev-parse", "--short", "HEAD"], { encoding: "utf8" }).stdout.trim();
|
||||
const dirty = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8" }).stdout.trim().length > 0;
|
||||
writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands: results, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify({
|
||||
acceptance_criteria: ["AC-31", "AC-55"], automation: ["automated"], commit,
|
||||
evidence_refs: evidenceRefs, layer: ["INTEGRATION", "API", "E2E", "PKG-SEC"], manifest,
|
||||
missing_evidence: missingEvidence, phase, red_reason: "后台上传未流式校验、原图/缩略图漏计量或 full 仍写入",
|
||||
requirements: ["ADMIN-06"], run_id: runId, status, task_id: "TASK-WP5-05",
|
||||
test_id: "TDD-WP5-UPL-001-upload-metering", work_package: "WP-5",
|
||||
worktree_under_test: dirty ? "uncommitted implementation" : "clean committed implementation",
|
||||
}, null, 2)}\n`);
|
||||
writeFileSync(resolve(runDirectory, "commands.json"), `${JSON.stringify({ commands: results, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: [{ missing_evidence: missingEvidence, status, test_id: "TDD-WP5-UPL-001-upload-metering" }], phase, run_id: runId, status }, null, 2)}\n`);
|
||||
console.log(JSON.stringify({ phase, run_id: runId, status }, null, 2));
|
||||
if (status === "failed") process.exit(1);
|
||||
@@ -0,0 +1,150 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, resolve } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { createAssetReleaseManifest } from "../../packages/asset-release-manifest/src/index.js";
|
||||
|
||||
const now = Date.parse("2026-08-03T10:00:00.000Z");
|
||||
const releaseVersion = "asset-20260803.1";
|
||||
const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
|
||||
const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
|
||||
const ungrantedPreviewId = "d8fe890d-6df4-46a9-a578-96c1f8361ac0";
|
||||
const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
|
||||
const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
const roots: string[] = [];
|
||||
const registrations: RegistrationService[] = [];
|
||||
|
||||
function addUser(registration: RegistrationService, role: "super_admin" | "user") {
|
||||
const userId = randomUUID();
|
||||
registration.database.prepare(`INSERT INTO users (
|
||||
user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at
|
||||
) VALUES (?, ?, ?, 'active', ?, ?, ?)`).run(
|
||||
userId,
|
||||
`${role}-${userId}@example.invalid`,
|
||||
role,
|
||||
role === "user" ? 1 : 0,
|
||||
randomUUID(),
|
||||
now,
|
||||
);
|
||||
if (role === "user") {
|
||||
registration.database.prepare("INSERT INTO user_profiles (user_id, creator_name, social_id) VALUES (?, 'Asset User', '@asset_user')").run(userId);
|
||||
registration.database.prepare("INSERT INTO credit_accounts (user_id, available_balance, reserved_balance, updated_at) VALUES (?, 10, 0, ?)").run(userId, now);
|
||||
} else {
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
|
||||
}
|
||||
return { session: registration.issueAuthenticatedSession(userId, role === "user" ? "user" : "admin"), userId };
|
||||
}
|
||||
|
||||
function evidence(name: string, value: unknown) {
|
||||
const directory = process.env.DADA_EVIDENCE_DIR_WP5_RES;
|
||||
if (!directory) return;
|
||||
mkdirSync(directory, { recursive: true });
|
||||
writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
function harness() {
|
||||
const root = mkdtempSync(join(tmpdir(), "dada-wp5-04-api-"));
|
||||
roots.push(root);
|
||||
const registration = new RegistrationService({
|
||||
challengePepper: Buffer.alloc(32, 0x31), clock: () => now,
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1", databasePath: join(root, "dada.sqlite3"),
|
||||
invitePepper: Buffer.alloc(32, 0x32), resend: new MockResendAdapter(), sessionPepper: Buffer.alloc(32, 0x33),
|
||||
});
|
||||
registrations.push(registration);
|
||||
const owner = addUser(registration, "user");
|
||||
const intruder = addUser(registration, "user");
|
||||
const admin = addUser(registration, "super_admin");
|
||||
const assetReleases = createAssetReleaseManifest({
|
||||
items: [
|
||||
{ access_class: "public_release_asset", cache_kind: "thumbnail", content: Buffer.from("public"), mime_type: "image/png", relative_path: "public/FLOWER001.png", resource_id: publicId, root_ref: "canonical-assets" },
|
||||
{ access_class: "internal_preview_asset", content: Buffer.from("preview"), mime_type: "image/webp", relative_path: "preview/FLOWER009.webp", resource_id: previewId, root_ref: "canonical-assets" },
|
||||
{ access_class: "internal_preview_asset", content: Buffer.from("ungranted-preview"), mime_type: "image/webp", relative_path: "preview/FLOWER010.webp", resource_id: ungrantedPreviewId, root_ref: "canonical-assets" },
|
||||
{ access_class: "private_user_asset", content: Buffer.from("private"), mime_type: "image/png", owner_id: owner.userId, relative_path: "private/generated.png", resource_id: privateId, root_ref: "managed-assets" },
|
||||
],
|
||||
release_version: releaseVersion,
|
||||
});
|
||||
let previewGranted = true;
|
||||
let previewChecks = 0;
|
||||
const appPromise = createApp({
|
||||
assetReleases,
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
previewAssetAuthorizer: ({ resourceId, userId }) => {
|
||||
previewChecks += 1;
|
||||
return previewGranted && userId === owner.userId && resourceId === previewId;
|
||||
},
|
||||
privateAssetAdminAuthorizer: ({ adminUserId, ownerId }) => adminUserId === admin.userId && ownerId === owner.userId,
|
||||
registration,
|
||||
});
|
||||
return { admin, appPromise, intruder, owner, previewChecks: () => previewChecks, revokePreview: () => { previewGranted = false; } };
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const registration of registrations.splice(0)) registration.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TDD-WP5-RES-001 three access classes", () => {
|
||||
it("separates route projections, per-request authorization, and cache headers", async () => {
|
||||
const test = harness();
|
||||
const app = await test.appPromise;
|
||||
const ownerCookie = `dada_session=${test.owner.session.sessionToken}`;
|
||||
const intruderCookie = `dada_session=${test.intruder.session.sessionToken}`;
|
||||
const adminCookie = `dada_admin_session=${test.admin.session.sessionToken}`;
|
||||
|
||||
const publicManifest = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/manifest` });
|
||||
const publicAsset = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/${publicId}` });
|
||||
const previewManifest = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/manifest` });
|
||||
const previewAsset = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${previewId}` });
|
||||
const privateManifest = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/manifest` });
|
||||
const privateAsset = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
|
||||
const deniedPrivate = await app.inject({ headers: { ...headers, cookie: intruderCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
|
||||
const controlledAdmin = await app.inject({ headers: { ...headers, cookie: adminCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
|
||||
|
||||
expect(publicManifest.statusCode).toBe(200);
|
||||
expect(publicManifest.headers["cache-control"]).toBe("public, max-age=31536000, immutable");
|
||||
expect(publicManifest.json().items).toEqual([expect.objectContaining({ access_class: "public_release_asset", resource_id: publicId })]);
|
||||
expect(JSON.stringify(publicManifest.json())).not.toMatch(/preview|private|relative_path|root_ref|[A-Z]:\\\\/i);
|
||||
expect(publicAsset.statusCode).toBe(200);
|
||||
expect(publicAsset.rawPayload).toEqual(Buffer.from("public"));
|
||||
expect(publicAsset.headers["cache-control"]).toBe("public, max-age=31536000, immutable");
|
||||
|
||||
expect(previewManifest.statusCode).toBe(200);
|
||||
expect(previewManifest.headers["cache-control"]).toBe("private, no-store");
|
||||
expect(previewManifest.json().items).toEqual([expect.objectContaining({ resource_id: previewId })]);
|
||||
expect(JSON.stringify(previewManifest.json())).not.toContain(ungrantedPreviewId);
|
||||
expect(previewAsset.statusCode).toBe(200);
|
||||
expect(previewAsset.headers["cache-control"]).toBe("private, no-store");
|
||||
expect(privateManifest.json().items).toEqual([expect.objectContaining({ access_class: "private_user_asset", resource_id: privateId })]);
|
||||
expect(privateAsset.rawPayload).toEqual(Buffer.from("private"));
|
||||
expect(privateAsset.headers["cache-control"]).toBe("private, no-store");
|
||||
expect(deniedPrivate.statusCode).toBe(404);
|
||||
expect(controlledAdmin.statusCode).toBe(200);
|
||||
|
||||
const publicGuess = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/${privateId}` });
|
||||
expect(publicGuess.statusCode).toBe(404);
|
||||
test.revokePreview();
|
||||
const revoked = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${previewId}` });
|
||||
expect(revoked.statusCode).toBe(404);
|
||||
expect(test.previewChecks()).toBe(4);
|
||||
|
||||
evidence("response.json", {
|
||||
controlled_admin_status: controlledAdmin.statusCode,
|
||||
private_intruder_status: deniedPrivate.statusCode,
|
||||
public_guess_status: publicGuess.statusCode,
|
||||
revoked_preview_status: revoked.statusCode,
|
||||
});
|
||||
evidence("headers.json", {
|
||||
private: privateAsset.headers["cache-control"],
|
||||
preview: previewAsset.headers["cache-control"],
|
||||
public: publicAsset.headers["cache-control"],
|
||||
});
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,109 @@
|
||||
import { createHash, randomUUID } from "node:crypto";
|
||||
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, resolve } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { ManagedStorage } from "../../apps/api/src/managed-storage.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { StickerReleaseService } from "../../apps/api/src/sticker-releases.js";
|
||||
|
||||
const now = Date.parse("2026-08-03T12:00:00.000Z");
|
||||
const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
|
||||
const roots: string[] = [];
|
||||
const closeables: Array<{ close(): void }> = [];
|
||||
const baseHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
|
||||
async function multipart() {
|
||||
const form = new FormData();
|
||||
form.append("stable_id", "STK1408");
|
||||
form.append("part", "25");
|
||||
form.append("order", "184");
|
||||
form.append("enabled", "true");
|
||||
form.append("original_byte_size", String(png.byteLength));
|
||||
form.append("original_sha256", createHash("sha256").update(png).digest("hex"));
|
||||
form.append("sticker_file", new Blob([png], { type: "image/png" }), "STK1408.png");
|
||||
const serialized = new Response(form);
|
||||
return { contentType: serialized.headers.get("content-type")!, payload: Buffer.from(await serialized.arrayBuffer()) };
|
||||
}
|
||||
|
||||
function evidence(value: unknown) {
|
||||
const directory = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
|
||||
if (!directory) return;
|
||||
mkdirSync(directory, { recursive: true });
|
||||
writeFileSync(resolve(directory, "response.json"), `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const value of closeables.splice(0).reverse()) value.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TASK-WP5-05 admin sticker API", () => {
|
||||
it("requires admin mutation controls, publishes upload, and exposes current and versioned public resources", async () => {
|
||||
const dataRoot = mkdtempSync(join(tmpdir(), "dada-wp5-05-api-"));
|
||||
roots.push(dataRoot);
|
||||
mkdirSync(join(dataRoot, "db"), { recursive: true });
|
||||
const databasePath = join(dataRoot, "db", "dada.sqlite3");
|
||||
const registration = new RegistrationService({
|
||||
challengePepper: Buffer.alloc(32, 0x41), clock: () => now,
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1", databasePath,
|
||||
invitePepper: Buffer.alloc(32, 0x42), resend: new MockResendAdapter(), sessionPepper: Buffer.alloc(32, 0x43),
|
||||
});
|
||||
const storage = new ManagedStorage({ dataRoot, databasePath });
|
||||
const stickers = new StickerReleaseService({ clock: () => now, databasePath, storage });
|
||||
closeables.push(stickers, storage, registration);
|
||||
const adminId = randomUUID();
|
||||
registration.database.prepare(`INSERT INTO users (
|
||||
user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at
|
||||
) VALUES (?, 'sticker-admin@example.invalid', 'super_admin', 'active', 0, ?, ?)`).run(adminId, randomUUID(), now);
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId);
|
||||
const session = registration.issueAuthenticatedSession(adminId, "admin");
|
||||
const csrf = registration.issueAdminCsrfToken(session.sessionToken);
|
||||
const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration, stickers });
|
||||
const uploadKey = `sticker-${randomUUID()}-${randomUUID()}`;
|
||||
|
||||
const body = await multipart();
|
||||
const denied = await app.inject({ headers: { ...baseHeaders, "content-type": body.contentType }, method: "POST", payload: body.payload, url: "/api/v1/admin/assets/static-stickers" });
|
||||
expect(denied.statusCode).toBe(401);
|
||||
|
||||
const acceptedBody = await multipart();
|
||||
const accepted = await app.inject({
|
||||
headers: {
|
||||
...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}`, "content-type": acceptedBody.contentType,
|
||||
"idempotency-key": uploadKey, "x-csrf-token": csrf,
|
||||
},
|
||||
method: "POST", payload: acceptedBody.payload, url: "/api/v1/admin/assets/static-stickers",
|
||||
});
|
||||
expect(accepted.statusCode).toBe(201);
|
||||
expect(accepted.json()).toMatchObject({ item: { stable_id: "STK1408" }, release_version: "asset-20260803.1" });
|
||||
const replayBody = await multipart();
|
||||
const replay = await app.inject({
|
||||
headers: {
|
||||
...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}`, "content-type": replayBody.contentType,
|
||||
"idempotency-key": uploadKey, "x-csrf-token": csrf,
|
||||
},
|
||||
method: "POST", payload: replayBody.payload, url: "/api/v1/admin/assets/static-stickers",
|
||||
});
|
||||
expect(replay.statusCode).toBe(200);
|
||||
expect(replay.json()).toMatchObject({ created: false, release_version: "asset-20260803.1" });
|
||||
expect(storage.inspectCounts()).toMatchObject({ managed_files: 2 });
|
||||
|
||||
const adminList = await app.inject({ headers: { ...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}` }, method: "GET", url: "/api/v1/admin/assets/static-stickers" });
|
||||
const publicList = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/static-stickers/current" });
|
||||
const original = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/assets/public/asset-20260803.1/STK1408" });
|
||||
const thumbnail = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/assets/public/asset-20260803.1/STK1408?variant=thumbnail" });
|
||||
expect(adminList.statusCode).toBe(200);
|
||||
expect(publicList.json()).toMatchObject({ count: 1, items: [{ stable_id: "STK1408" }] });
|
||||
expect(original.rawPayload).toEqual(png);
|
||||
expect(thumbnail.statusCode).toBe(200);
|
||||
expect(thumbnail.headers["content-type"]).toMatch(/^image\/png/);
|
||||
expect(thumbnail.rawPayload).not.toEqual(png);
|
||||
|
||||
evidence({ admin_list_status: adminList.statusCode, public_count: publicList.json().count, upload_status: accepted.statusCode });
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,149 @@
|
||||
import { mkdirSync, writeFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
import { expect, test } from "@playwright/test";
|
||||
import { createServer, type ViteDevServer } from "vite";
|
||||
|
||||
const releaseVersion = "asset-20260803.1";
|
||||
const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
|
||||
const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
|
||||
const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
|
||||
let vite: ViteDevServer;
|
||||
let webUrl: string;
|
||||
const requestCounts = { preview: 0, private: 0, public: 0 };
|
||||
|
||||
function writeEvidence(directory: string | undefined, name: string, value: unknown) {
|
||||
if (!directory) return;
|
||||
mkdirSync(directory, { recursive: true });
|
||||
writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
test.beforeAll(async () => {
|
||||
vite = await createServer({
|
||||
configFile: false,
|
||||
plugins: [{
|
||||
name: "wp5-04-three-resource-classes",
|
||||
configureServer(server) {
|
||||
server.middlewares.use((request, response, next) => {
|
||||
const routes = [
|
||||
{ access: "public", body: "public-content", id: publicId, prefix: "/api/v1/assets/public/" },
|
||||
{ access: "preview", body: "preview-content", id: previewId, prefix: "/api/v1/assets/preview/" },
|
||||
{ access: "private", body: "private-content", id: privateId, prefix: "/api/v1/private-assets/" },
|
||||
] as const;
|
||||
const route = routes.find((item) => request.url === `${item.prefix}${releaseVersion}/${item.id}`);
|
||||
if (!route) return next();
|
||||
requestCounts[route.access] += 1;
|
||||
response.statusCode = 200;
|
||||
response.setHeader("Cache-Control", route.access === "public" ? "public, max-age=31536000, immutable" : "private, no-store");
|
||||
response.setHeader("Content-Type", "application/octet-stream");
|
||||
response.end(route.body);
|
||||
});
|
||||
},
|
||||
}],
|
||||
publicDir: resolve("apps/web/public"),
|
||||
root: process.cwd(),
|
||||
server: { host: "127.0.0.1", port: 0 },
|
||||
});
|
||||
await vite.listen();
|
||||
const address = vite.httpServer?.address();
|
||||
if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
|
||||
webUrl = `http://127.0.0.1:${address.port}`;
|
||||
});
|
||||
|
||||
test.afterAll(async () => vite.close());
|
||||
|
||||
test("TDD-WP5-04 enumerates no preview or private client state", async ({ context, page }) => {
|
||||
requestCounts.preview = 0;
|
||||
requestCounts.private = 0;
|
||||
requestCounts.public = 0;
|
||||
await page.goto(`${webUrl}/tests/e2e/fixtures/public-asset-cache.html`);
|
||||
await expect(page.locator("#status")).toHaveText("ready");
|
||||
await page.reload();
|
||||
await expect(page.locator("#status")).toHaveText("ready");
|
||||
|
||||
const online = await page.evaluate(async ({ privateId, previewId, publicId, releaseVersion }) => {
|
||||
const cache = window.dadaCacheProbe.cache;
|
||||
await cache.clear();
|
||||
const cached = await cache.cache({
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
release_version: releaseVersion,
|
||||
resource_id: publicId,
|
||||
});
|
||||
const rejected = await Promise.all([
|
||||
cache.cache({ access_class: "internal_preview_asset", cache_kind: "thumbnail", release_version: releaseVersion, resource_id: previewId }),
|
||||
cache.cache({ access_class: "private_user_asset", cache_kind: "thumbnail", release_version: releaseVersion, resource_id: privateId }),
|
||||
]);
|
||||
const preview = await fetch(`/api/v1/assets/preview/${releaseVersion}/${previewId}`);
|
||||
const privateAsset = await fetch(`/api/v1/private-assets/${releaseVersion}/${privateId}`);
|
||||
const inspection = await cache.inspect();
|
||||
const registrations = await navigator.serviceWorker.getRegistrations();
|
||||
const databases = await indexedDB.databases();
|
||||
return {
|
||||
cached,
|
||||
inspection,
|
||||
private_bytes: (await privateAsset.arrayBuffer()).byteLength,
|
||||
private_cache_control: privateAsset.headers.get("cache-control"),
|
||||
preview_bytes: (await preview.arrayBuffer()).byteLength,
|
||||
preview_cache_control: preview.headers.get("cache-control"),
|
||||
rejected,
|
||||
service_workers: registrations.map((registration) => ({
|
||||
active: registration.active?.state,
|
||||
scope: registration.scope,
|
||||
script_url: registration.active?.scriptURL,
|
||||
})),
|
||||
indexed_db_names: databases.map((database) => database.name).filter(Boolean).sort(),
|
||||
local_storage_keys: Object.keys(localStorage),
|
||||
session_storage_keys: Object.keys(sessionStorage),
|
||||
};
|
||||
}, { privateId, previewId, publicId, releaseVersion });
|
||||
|
||||
await context.setOffline(true);
|
||||
const offline = await page.evaluate(async ({ privateId, previewId, publicId, releaseVersion }) => {
|
||||
const read = async (url: string) => {
|
||||
try {
|
||||
const response = await fetch(url);
|
||||
return { body: await response.text(), status: response.status };
|
||||
} catch {
|
||||
return { body: null, status: "network_error" };
|
||||
}
|
||||
};
|
||||
return {
|
||||
preview: await read(`/api/v1/assets/preview/${releaseVersion}/${previewId}`),
|
||||
private: await read(`/api/v1/private-assets/${releaseVersion}/${privateId}`),
|
||||
public: await read(`/api/v1/assets/public/${releaseVersion}/${publicId}`),
|
||||
};
|
||||
}, { privateId, previewId, publicId, releaseVersion });
|
||||
await context.setOffline(false);
|
||||
|
||||
expect(online.cached.status).toBe("cached");
|
||||
expect(online.rejected).toEqual([
|
||||
{ status: "rejected_not_allowlisted" },
|
||||
{ status: "rejected_not_allowlisted" },
|
||||
]);
|
||||
expect(online.preview_cache_control).toBe("private, no-store");
|
||||
expect(online.private_cache_control).toBe("private, no-store");
|
||||
expect(online.inspection.cache_keys).toHaveLength(1);
|
||||
expect(online.inspection.cache_names).toEqual(["dada-public-assets-v1"]);
|
||||
expect(online.inspection.entries).toEqual([expect.objectContaining({ resource_id: publicId })]);
|
||||
expect(JSON.stringify(online.inspection)).not.toContain(previewId);
|
||||
expect(JSON.stringify(online.inspection)).not.toContain(privateId);
|
||||
expect(online.indexed_db_names).toEqual(["dada-public-asset-cache-v1"]);
|
||||
expect(online.local_storage_keys).toEqual([]);
|
||||
expect(online.session_storage_keys).toEqual([]);
|
||||
expect(online.service_workers).toHaveLength(1);
|
||||
expect(offline.public).toEqual({ body: "public-content", status: 200 });
|
||||
expect(offline.preview.status).toBe("network_error");
|
||||
expect(offline.private.status).toBe("network_error");
|
||||
expect(requestCounts).toEqual({ preview: 1, private: 1, public: 1 });
|
||||
|
||||
const cacheEnumeration = {
|
||||
business_database_calls: 0,
|
||||
offline,
|
||||
online,
|
||||
origin_request_counts: { ...requestCounts },
|
||||
};
|
||||
writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_CACHE, "cache-enumeration.json", cacheEnumeration);
|
||||
writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_CACHE, "service-worker.json", { registrations: online.service_workers });
|
||||
writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_RES, "cache-enumeration.json", cacheEnumeration);
|
||||
});
|
||||
@@ -0,0 +1,131 @@
|
||||
import { mkdirSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
import { expect, test, type Page } from "@playwright/test";
|
||||
import { createServer, type ViteDevServer } from "vite";
|
||||
|
||||
let vite: ViteDevServer;
|
||||
let webUrl: string;
|
||||
const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
|
||||
const adminSession = { csrf_token: "csrf-wp5-05-admin-000000000000000000000000000000000" };
|
||||
const projectId = "00000000-0000-4000-8000-000000001405";
|
||||
const userSession = {
|
||||
audience: "user", authenticated: true, credits: { available_balance: 10, reserved_balance: 0 },
|
||||
csrf_token: "csrf-wp5-05-user-0000000000000000000000000000000000",
|
||||
expires_at: "2026-09-03T12:00:00.000Z",
|
||||
user: { creator_name: "Sticker User", role: "user", social_id: "@sticker", status: "active", user_id: projectId },
|
||||
};
|
||||
|
||||
function asset(stableId = "STK1408") {
|
||||
return {
|
||||
enabled: true, file_state: "committed", height: 3, mime: "image/png", mime_type: "image/png", order: 184,
|
||||
original_byte_size: png.byteLength, original_filename: `${stableId}.png`, original_reference: `/api/v1/assets/public/asset-20260803.1/${stableId}`,
|
||||
origin: "admin_uploaded", part: 25, relative_path: `managed-assets/stickers/original/${stableId}.png`, resource_version: "asset-20260803.1",
|
||||
sha256: "0".repeat(64), stable_id: stableId, thumbnail_byte_size: 75,
|
||||
thumbnail_reference: { media: "thumbnail", resource_id: stableId, resource_version: "asset-20260803.1", url: `/api/v1/assets/public/asset-20260803.1/${stableId}?variant=thumbnail` }, width: 4,
|
||||
};
|
||||
}
|
||||
|
||||
function assetsResponse(status: "active" | "full" | "unavailable" = "active", items = [asset()]) {
|
||||
return {
|
||||
count: items.length, items, release_version: items.length ? "asset-20260803.1" : null,
|
||||
storage: { capacity_notice_level: status === "active" ? "normal" : "critical", hard_limit_bytes: 5_368_709_120, managed_content_bytes: status === "full" ? 5_368_709_120 : 150, storage_status: status },
|
||||
};
|
||||
}
|
||||
|
||||
test.beforeAll(async () => {
|
||||
vite = await createServer({ configFile: resolve("apps/web/vite.config.ts"), root: resolve("apps/web"), server: { host: "127.0.0.1", port: 0 } });
|
||||
await vite.listen();
|
||||
const address = vite.httpServer?.address();
|
||||
if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
|
||||
webUrl = `http://127.0.0.1:${address.port}`;
|
||||
});
|
||||
|
||||
test.afterAll(async () => vite.close());
|
||||
|
||||
async function routeAdminSession(page: Page) {
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify(adminSession), contentType: "application/json", status: 200 }));
|
||||
await page.route("**/api/v1/assets/public/**", (route) => route.fulfill({ body: png, contentType: "image/png", status: 200 }));
|
||||
}
|
||||
|
||||
test("TDD-WP5-UPL-001-upload-metering uploads and publishes with stable metadata controls", async ({ page }) => {
|
||||
await routeAdminSession(page);
|
||||
let uploaded = false;
|
||||
let multipartBody = "";
|
||||
await page.route("**/api/v1/admin/assets/static-stickers", async (route) => {
|
||||
if (route.request().method() === "POST") {
|
||||
multipartBody = route.request().postDataBuffer()?.toString("latin1") ?? "";
|
||||
uploaded = true;
|
||||
return route.fulfill({ body: JSON.stringify({ created: true, item: asset(), release_version: "asset-20260803.1" }), contentType: "application/json", status: 201 });
|
||||
}
|
||||
return route.fulfill({ body: JSON.stringify(assetsResponse("active", uploaded ? [asset()] : [])), contentType: "application/json", status: 200 });
|
||||
});
|
||||
|
||||
await page.goto(`${webUrl}/admin/assets`);
|
||||
await expect(page.getByRole("heading", { name: "普通贴纸" })).toBeVisible();
|
||||
await expect(page.getByText("当前没有后台上传的普通贴纸。")).toBeVisible();
|
||||
await page.getByLabel("贴纸文件").setInputFiles({ buffer: png, mimeType: "image/png", name: "STK1408.png" });
|
||||
await page.getByRole("button", { name: "上传并发布" }).click();
|
||||
await expect(page.getByRole("rowheader", { name: /STK1408/ })).toBeVisible();
|
||||
expect(multipartBody).toContain("STK1408");
|
||||
expect(multipartBody).toContain("image/png");
|
||||
expect(multipartBody).toContain("original_sha256");
|
||||
const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
|
||||
if (evidenceRoot) {
|
||||
const directory = resolve(evidenceRoot, "screenshots");
|
||||
mkdirSync(directory, { recursive: true });
|
||||
await page.screenshot({ fullPage: true, path: resolve(directory, "admin-assets-uploaded.png") });
|
||||
}
|
||||
});
|
||||
|
||||
test("storage full disables every upload control and load failure exposes retry", async ({ page }) => {
|
||||
await page.setViewportSize({ height: 844, width: 390 });
|
||||
await routeAdminSession(page);
|
||||
await page.route("**/api/v1/admin/assets/static-stickers", (route) => route.fulfill({ body: JSON.stringify(assetsResponse("full")), contentType: "application/json", status: 200 }));
|
||||
await page.goto(`${webUrl}/admin/assets`);
|
||||
await expect(page.getByText("当前存储状态禁止新增原图和缩略图。")).toBeVisible();
|
||||
await expect(page.getByLabel("贴纸文件")).toBeDisabled();
|
||||
await expect(page.getByRole("button", { name: "上传并发布" })).toBeDisabled();
|
||||
const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
|
||||
if (evidenceRoot) {
|
||||
const directory = resolve(evidenceRoot, "screenshots");
|
||||
mkdirSync(directory, { recursive: true });
|
||||
await page.screenshot({ fullPage: true, path: resolve(directory, "admin-assets-full-mobile.png") });
|
||||
}
|
||||
|
||||
await page.unroute("**/api/v1/admin/assets/static-stickers");
|
||||
await page.route("**/api/v1/admin/assets/static-stickers", (route) => route.fulfill({ status: 503 }));
|
||||
await page.reload();
|
||||
await expect(page.getByRole("alert")).toContainText("素材状态暂时无法读取");
|
||||
await expect(page.getByRole("button", { name: "重试" })).toBeVisible();
|
||||
});
|
||||
|
||||
test("the editor merges the current uploaded release and saves its resource version", async ({ page }) => {
|
||||
let savedResourceVersion = "";
|
||||
let originalRequests = 0;
|
||||
await page.route("**/api/v1/auth/session", (route) => route.fulfill({ body: JSON.stringify(userSession), contentType: "application/json", status: 200 }));
|
||||
await page.route("**/api/v1/static-stickers/current", (route) => route.fulfill({ body: JSON.stringify({ count: 1, items: [asset()], release_version: "asset-20260803.1" }), contentType: "application/json", status: 200 }));
|
||||
await page.route(`**/api/v1/projects/${projectId}`, (route) => route.fulfill({ body: JSON.stringify({
|
||||
canvas_state: { background: { adjustments: { brightness: 0, contrast: 0, crop: null, filter: "none", fit: "fill", saturation: 0, sharpness: 0, temperature: 0 }, asset_id: null }, elements: [], pixel_height: 1440, pixel_width: 1080, ratio: "3:4", schema_version: 1 },
|
||||
created_at: "2026-08-03T12:00:00.000Z", current_image_id: null, images: [], name: "上传贴纸", project_id: projectId, ratio: "3:4", state_version: 1,
|
||||
}), contentType: "application/json", status: 200 }));
|
||||
await page.route(`**/api/v1/projects/${projectId}/state`, async (route) => {
|
||||
const body = route.request().postDataJSON() as { canvas_state: { elements: Array<{ resource_version: string }> } };
|
||||
savedResourceVersion = body.canvas_state.elements[0]?.resource_version ?? "";
|
||||
await route.fulfill({ body: JSON.stringify({ save_status: "saved", state_version: 2 }), contentType: "application/json", status: 200 });
|
||||
});
|
||||
await page.route("**/api/v1/assets/recent?asset_kind=text_template", (route) => route.fulfill({ body: JSON.stringify({ items: [] }), contentType: "application/json", status: 200 }));
|
||||
await page.route("**/api/v1/assets/public/**", async (route) => {
|
||||
if (!new URL(route.request().url()).searchParams.has("variant")) originalRequests += 1;
|
||||
await route.fulfill({ body: png, contentType: "image/png", status: 200 });
|
||||
});
|
||||
|
||||
await page.goto(`${webUrl}/app/projects/${projectId}/editor`);
|
||||
await page.getByRole("button", { name: "普通贴纸", exact: true }).click();
|
||||
await expect(page.getByText("共 1,408 张", { exact: true })).toBeVisible();
|
||||
const list = page.getByTestId("static-sticker-list");
|
||||
await list.evaluate((element) => { element.scrollTop = element.scrollHeight; element.dispatchEvent(new Event("scroll")); });
|
||||
await list.getByRole("button", { name: "添加贴纸 STK1408" }).click();
|
||||
await expect.poll(() => savedResourceVersion).toBe("asset-20260803.1");
|
||||
await expect.poll(() => originalRequests).toBeGreaterThan(0);
|
||||
});
|
||||
@@ -0,0 +1,135 @@
|
||||
import { createHash, randomUUID } from "node:crypto";
|
||||
import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, resolve } from "node:path";
|
||||
import { Readable } from "node:stream";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { HARD_LIMIT_BYTES, ManagedStorage, StorageCapacityError, StorageUnavailableError } from "../../apps/api/src/managed-storage.js";
|
||||
import { StickerReleaseService } from "../../apps/api/src/sticker-releases.js";
|
||||
|
||||
const now = Date.parse("2026-08-03T12:00:00.000Z");
|
||||
const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
|
||||
const webp = Buffer.from("UklGRjoAAABXRUJQVlA4IC4AAADQAQCdASoGAAUAAUAmJaACdLoB+AADsAD+9IiH/pNnibPE2fJI/+Uq8Fjc3wAA", "base64");
|
||||
const roots: string[] = [];
|
||||
const closeables: Array<{ close(): void }> = [];
|
||||
|
||||
function filesBelow(path: string): string[] {
|
||||
if (!existsSync(path)) return [];
|
||||
return readdirSync(path, { withFileTypes: true }).flatMap((entry) => {
|
||||
const child = join(path, entry.name);
|
||||
return entry.isDirectory() ? filesBelow(child) : [child];
|
||||
});
|
||||
}
|
||||
|
||||
function evidence(name: string, value: unknown) {
|
||||
const directory = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
|
||||
if (!directory) return;
|
||||
mkdirSync(directory, { recursive: true });
|
||||
writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
function fixture() {
|
||||
const dataRoot = mkdtempSync(join(tmpdir(), "dada-wp5-05-integration-"));
|
||||
roots.push(dataRoot);
|
||||
mkdirSync(join(dataRoot, "db"), { recursive: true });
|
||||
const databasePath = join(dataRoot, "db", "dada.sqlite3");
|
||||
const storage = new ManagedStorage({ dataRoot, databasePath });
|
||||
const stickers = new StickerReleaseService({ clock: () => now, databasePath, storage });
|
||||
closeables.push(stickers, storage);
|
||||
return { dataRoot, stickers, storage };
|
||||
}
|
||||
|
||||
async function upload(stickers: StickerReleaseService, stableId: string, order: number, bytes = png, mimeType: "image/png" | "image/webp" = "image/png") {
|
||||
return stickers.upload({
|
||||
actorId: randomUUID(),
|
||||
content: Readable.from(bytes),
|
||||
enabled: true,
|
||||
expectedByteSize: bytes.byteLength,
|
||||
expectedMimeType: mimeType,
|
||||
expectedSha256: createHash("sha256").update(bytes).digest("hex"),
|
||||
fileName: mimeType === "image/png" ? `${stableId}.png` : `${stableId}.webp`,
|
||||
idempotencyKey: `upload-${randomUUID()}-${randomUUID()}`,
|
||||
order,
|
||||
part: 25,
|
||||
stableId,
|
||||
});
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const value of closeables.splice(0).reverse()) value.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TDD-WP5-UPL-001 upload metering", () => {
|
||||
it("decodes PNG, publishes an immutable release, meters original and thumbnail, and preserves old release reads", async () => {
|
||||
const test = fixture();
|
||||
const before = { files: filesBelow(join(test.dataRoot, "managed-assets")), state: test.storage.getState() };
|
||||
const published = await upload(test.stickers, "STK1408", 184);
|
||||
const afterUpload = test.storage.getState();
|
||||
|
||||
expect(published.release_version).toBe("asset-20260803.1");
|
||||
expect(published.item).toMatchObject({ enabled: true, height: 3, mime_type: "image/png", origin: "admin_uploaded", stable_id: "STK1408", width: 4 });
|
||||
expect(afterUpload.managed_content_bytes).toBe(published.original.byte_size + published.thumbnail.byte_size);
|
||||
expect(test.storage.inspectCounts()).toMatchObject({ active_reservations: 0, managed_files: 2, pending_cleanup: 0 });
|
||||
expect(filesBelow(join(test.dataRoot, "managed-assets"))).toHaveLength(2);
|
||||
expect(test.stickers.listPublic()).toMatchObject({ count: 1, items: [{ stable_id: "STK1408" }] });
|
||||
|
||||
const disabled = test.stickers.update({ actorId: randomUUID(), enabled: false, stableId: "STK1408" });
|
||||
expect(disabled.release_version).toBe("asset-20260803.2");
|
||||
expect(test.stickers.listPublic().items).toEqual([]);
|
||||
expect(test.stickers.listPublic(published.release_version).items).toHaveLength(1);
|
||||
expect(test.stickers.readPublicAsset(published.release_version, "STK1408", "original")?.bytes).toEqual(png);
|
||||
expect(test.stickers.readPublicAsset(disabled.release_version, "STK1408", "original")).toBeUndefined();
|
||||
|
||||
evidence("fs-before.json", before);
|
||||
evidence("fs-after.json", { files: filesBelow(join(test.dataRoot, "managed-assets")), state: test.storage.getState() });
|
||||
evidence("db-diff.json", { releases: test.stickers.inspectCounts(), storage: test.storage.inspectCounts() });
|
||||
});
|
||||
|
||||
it("allows exact equality then blocks full and unavailable storage without partial files or rows", async () => {
|
||||
const sizing = fixture();
|
||||
const measured = await upload(sizing.stickers, "STK1408", 184);
|
||||
const writeBytes = measured.original.byte_size + measured.thumbnail.byte_size;
|
||||
|
||||
const exact = fixture();
|
||||
exact.storage.applyControlledMeasurement(HARD_LIMIT_BYTES - writeBytes);
|
||||
const exactResult = await upload(exact.stickers, "STK1408", 184);
|
||||
expect(exactResult.original.byte_size + exactResult.thumbnail.byte_size).toBe(writeBytes);
|
||||
expect(exact.storage.getState().storage_status).toBe("full");
|
||||
const filesAtFull = filesBelow(join(exact.dataRoot, "managed-assets"));
|
||||
const countsAtFull = exact.stickers.inspectCounts();
|
||||
await expect(upload(exact.stickers, "STK1409", 185)).rejects.toBeInstanceOf(StorageCapacityError);
|
||||
expect(filesBelow(join(exact.dataRoot, "managed-assets"))).toEqual(filesAtFull);
|
||||
expect(exact.stickers.inspectCounts()).toEqual(countsAtFull);
|
||||
|
||||
const unavailable = fixture();
|
||||
unavailable.storage.setAvailability({ dataRootWritable: false, diskSpaceAvailable: true, sqliteWritable: true });
|
||||
await expect(upload(unavailable.stickers, "STK1408", 184)).rejects.toBeInstanceOf(StorageUnavailableError);
|
||||
expect(filesBelow(join(unavailable.dataRoot, "managed-assets"))).toEqual([]);
|
||||
expect(unavailable.stickers.inspectCounts()).toEqual({ items: 0, releases: 0, upload_receipts: 0 });
|
||||
});
|
||||
|
||||
it("rejects a forged PNG before release or managed-file commit", async () => {
|
||||
const test = fixture();
|
||||
const forged = Buffer.concat([png.subarray(0, 8), Buffer.from("not-a-decodable-png")]);
|
||||
await expect(upload(test.stickers, "STK1408", 184, forged)).rejects.toThrow("content_decode_invalid");
|
||||
expect(test.storage.inspectCounts()).toMatchObject({ active_reservations: 0, managed_files: 0 });
|
||||
expect(test.stickers.inspectCounts()).toEqual({ items: 0, releases: 0, upload_receipts: 0 });
|
||||
expect(filesBelow(join(test.dataRoot, "managed-assets"))).toEqual([]);
|
||||
});
|
||||
|
||||
it("decodes WebP and rejects stable-ID or part-order conflicts without extra writes", async () => {
|
||||
const test = fixture();
|
||||
const published = await upload(test.stickers, "STK1408", 184, webp, "image/webp");
|
||||
expect(published.item).toMatchObject({ height: 5, mime_type: "image/webp", width: 6 });
|
||||
expect(test.stickers.readPublicAsset(published.release_version, "STK1408", "original")?.bytes).toEqual(webp);
|
||||
const files = filesBelow(join(test.dataRoot, "managed-assets"));
|
||||
const counts = test.stickers.inspectCounts();
|
||||
await expect(upload(test.stickers, "STK1408", 185)).rejects.toMatchObject({ httpStatus: 409, reason: "sticker_stable_id_conflict" });
|
||||
await expect(upload(test.stickers, "STK1409", 184)).rejects.toMatchObject({ httpStatus: 409, reason: "sticker_order_conflict" });
|
||||
expect(filesBelow(join(test.dataRoot, "managed-assets"))).toEqual(files);
|
||||
expect(test.stickers.inspectCounts()).toEqual(counts);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,139 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { ManagedStorage } from "../../apps/api/src/managed-storage.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { StickerReleaseService } from "../../apps/api/src/sticker-releases.js";
|
||||
import { ProjectPurgeCleanup } from "../../apps/worker/src/project-purge-cleanup.js";
|
||||
|
||||
const roots: string[] = [];
|
||||
const closeables: Array<{ close(): void }> = [];
|
||||
|
||||
function fixture() {
|
||||
const dataRoot = mkdtempSync(join(tmpdir(), "dada-wp5-06-cleanup-"));
|
||||
roots.push(dataRoot);
|
||||
mkdirSync(join(dataRoot, "db"), { recursive: true });
|
||||
const databasePath = join(dataRoot, "db", "dada.sqlite3");
|
||||
const registration = new RegistrationService({
|
||||
challengePepper: Buffer.alloc(32, 0x61),
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
|
||||
databasePath,
|
||||
invitePepper: Buffer.alloc(32, 0x62),
|
||||
resend: new MockResendAdapter(),
|
||||
sessionPepper: Buffer.alloc(32, 0x63),
|
||||
});
|
||||
const storage = new ManagedStorage({ dataRoot, databasePath });
|
||||
const stickers = new StickerReleaseService({ databasePath, storage });
|
||||
closeables.push(stickers, storage, registration);
|
||||
return { dataRoot, databasePath, database: registration.database, storage };
|
||||
}
|
||||
|
||||
function seedAdmin(database: RegistrationService["database"]) {
|
||||
const adminId = randomUUID();
|
||||
database.prepare(`
|
||||
INSERT INTO users (
|
||||
user_id, normalized_email, role, status, counts_toward_stage_limit,
|
||||
registration_id, created_at
|
||||
) VALUES (?, ?, 'super_admin', 'active', 0, ?, ?)
|
||||
`).run(adminId, `${adminId}@example.invalid`, randomUUID(), Date.now());
|
||||
database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId);
|
||||
return adminId;
|
||||
}
|
||||
|
||||
async function seedHistoricalPair(test: ReturnType<typeof fixture>) {
|
||||
const original = await test.storage.commitBufferFixture("sticker_original", "STK2401.png", Buffer.from("original-history"));
|
||||
const thumbnail = await test.storage.commitBufferFixture("sticker_thumbnail", "STK2401-thumbnail.png", Buffer.from("thumbnail-history"));
|
||||
const insert = test.database.prepare(`
|
||||
INSERT INTO sticker_managed_file_history (
|
||||
managed_file_id, stable_id, resource_version, file_kind, created_at
|
||||
) VALUES (?, 'STK2401', 'asset-20260701.1', ?, ?)
|
||||
`);
|
||||
insert.run(original.file_id, "original", Date.now());
|
||||
insert.run(thumbnail.file_id, "thumbnail", Date.now());
|
||||
return { original, thumbnail };
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const value of closeables.splice(0).reverse()) value.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TDD-WP5-CLN-001 sticker history cleanup", () => {
|
||||
it("denies the whole batch when a reference appears after the candidate snapshot", async () => {
|
||||
const test = fixture();
|
||||
const adminId = seedAdmin(test.database);
|
||||
const files = await seedHistoricalPair(test);
|
||||
const candidates = test.storage.listAssetCleanupCandidates();
|
||||
expect(candidates.items).toEqual(expect.arrayContaining([
|
||||
expect.objectContaining({ file_id: files.original.file_id, file_kind: "original", reference_count: 0, stable_id: "STK2401" }),
|
||||
expect.objectContaining({ file_id: files.thumbnail.file_id, file_kind: "thumbnail", reference_count: 0, stable_id: "STK2401" }),
|
||||
]));
|
||||
const intent = test.storage.createAssetCleanupIntent({
|
||||
actorId: adminId,
|
||||
fileIds: [files.original.file_id, files.thumbnail.file_id],
|
||||
idempotencyKey: `cleanup-${randomUUID()}-${randomUUID()}`,
|
||||
snapshotVersion: candidates.candidate_snapshot_version,
|
||||
});
|
||||
|
||||
test.storage.addAssetReference(files.original.file_id, "release");
|
||||
expect(() => test.storage.confirmAssetCleanupIntent({
|
||||
actorId: adminId,
|
||||
confirmationToken: intent.confirmation_token,
|
||||
requestId: intent.request_id,
|
||||
})).toThrow("ASSET_HISTORY_REFERENCE_CONFLICT");
|
||||
|
||||
expect(test.database.prepare("SELECT status FROM asset_cleanup_requests WHERE request_id = ?").get(intent.request_id)).toEqual({ status: "denied" });
|
||||
expect(test.database.prepare("SELECT COUNT(*) AS count FROM file_cleanup_queue WHERE status = 'pending'").get()).toEqual({ count: 0 });
|
||||
expect(test.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs WHERE target_ref = ? AND result = 'failed'").get(intent.request_id)).toEqual({ count: 1 });
|
||||
});
|
||||
|
||||
it("requires the same admin, queues without reducing capacity, then remeasures after physical deletion", async () => {
|
||||
const test = fixture();
|
||||
const adminId = seedAdmin(test.database);
|
||||
const otherAdminId = seedAdmin(test.database);
|
||||
const files = await seedHistoricalPair(test);
|
||||
const bytesBefore = test.storage.getState().managed_content_bytes;
|
||||
const candidates = test.storage.listAssetCleanupCandidates();
|
||||
const intent = test.storage.createAssetCleanupIntent({
|
||||
actorId: adminId,
|
||||
fileIds: [files.original.file_id, files.thumbnail.file_id],
|
||||
idempotencyKey: `cleanup-${randomUUID()}-${randomUUID()}`,
|
||||
snapshotVersion: candidates.candidate_snapshot_version,
|
||||
});
|
||||
|
||||
expect(() => test.storage.confirmAssetCleanupIntent({
|
||||
actorId: otherAdminId,
|
||||
confirmationToken: intent.confirmation_token,
|
||||
requestId: intent.request_id,
|
||||
})).toThrow("ASSET_CLEANUP_CANDIDATE_STALE");
|
||||
const queued = test.storage.confirmAssetCleanupIntent({
|
||||
actorId: adminId,
|
||||
confirmationToken: intent.confirmation_token,
|
||||
requestId: intent.request_id,
|
||||
});
|
||||
expect(queued).toMatchObject({ file_count: 2, status: "queued" });
|
||||
expect(test.storage.getState().managed_content_bytes).toBe(bytesBefore);
|
||||
expect(existsSync(join(test.dataRoot, files.original.relative_path))).toBe(true);
|
||||
expect(test.database.prepare("SELECT COUNT(*) AS count FROM file_cleanup_queue WHERE status = 'pending'").get()).toEqual({ count: 2 });
|
||||
|
||||
const worker = new ProjectPurgeCleanup({ dataRoot: test.dataRoot, databasePath: test.databasePath });
|
||||
const result = worker.processFileCleanup();
|
||||
worker.close();
|
||||
expect(result).toEqual({ completed: 2, failed: 0 });
|
||||
expect(existsSync(join(test.dataRoot, files.original.relative_path))).toBe(false);
|
||||
expect(existsSync(join(test.dataRoot, files.thumbnail.relative_path))).toBe(false);
|
||||
expect(test.storage.getState()).toMatchObject({ managed_content_bytes: 0, storage_status: "active" });
|
||||
expect(test.database.prepare("SELECT status FROM asset_cleanup_requests WHERE request_id = ?").get(intent.request_id)).toEqual({ status: "completed" });
|
||||
expect(test.database.prepare("SELECT operation_type, result FROM admin_operation_logs WHERE target_ref = ? ORDER BY occurred_at").all(intent.request_id)).toEqual([
|
||||
{ operation_type: "asset_cleanup_requested", result: "succeeded" },
|
||||
{ operation_type: "asset_cleanup_validated", result: "succeeded" },
|
||||
{ operation_type: "asset_cleanup_scheduled", result: "succeeded" },
|
||||
{ operation_type: "asset_cleanup_physical_completed", result: "succeeded" },
|
||||
]);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,101 @@
|
||||
import { createHash } from "node:crypto";
|
||||
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { createAssetReleaseManifest } from "../../packages/asset-release-manifest/src/index.js";
|
||||
|
||||
const releaseVersion = "asset-20260803.1";
|
||||
const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
|
||||
const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
|
||||
const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
|
||||
|
||||
function fixture() {
|
||||
return createAssetReleaseManifest({
|
||||
items: [
|
||||
{
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
content: Buffer.from("public-content"),
|
||||
mime_type: "image/png",
|
||||
relative_path: "public/thumbnails/FLOWER001.png",
|
||||
resource_id: publicId,
|
||||
root_ref: "canonical-assets",
|
||||
},
|
||||
{
|
||||
access_class: "internal_preview_asset",
|
||||
content: Buffer.from("preview-content"),
|
||||
mime_type: "image/webp",
|
||||
relative_path: "preview/batch-7/FLOWER009.webp",
|
||||
resource_id: previewId,
|
||||
root_ref: "canonical-assets",
|
||||
},
|
||||
{
|
||||
access_class: "private_user_asset",
|
||||
content: Buffer.from("private-content"),
|
||||
mime_type: "image/png",
|
||||
owner_id: "owner-1",
|
||||
relative_path: "private/owner-1/generated.png",
|
||||
resource_id: privateId,
|
||||
root_ref: "managed-assets",
|
||||
},
|
||||
],
|
||||
release_version: releaseVersion,
|
||||
});
|
||||
}
|
||||
|
||||
describe("TASK-WP5-04 immutable asset release manifest", () => {
|
||||
it("projects only the selected access class and never exposes source paths", () => {
|
||||
const manifest = fixture();
|
||||
const projected = manifest.project("public_release_asset", releaseVersion);
|
||||
|
||||
expect(Object.isFrozen(projected)).toBe(true);
|
||||
expect(projected?.manifest_sha256).toMatch(/^[0-9a-f]{64}$/);
|
||||
expect(projected?.items).toEqual([expect.objectContaining({
|
||||
access_class: "public_release_asset",
|
||||
resource_id: publicId,
|
||||
sha256: createHash("sha256").update("public-content").digest("hex"),
|
||||
url: `/api/v1/assets/public/${releaseVersion}/${publicId}`,
|
||||
})]);
|
||||
const serialized = JSON.stringify(projected);
|
||||
expect(serialized).not.toContain(previewId);
|
||||
expect(serialized).not.toContain(privateId);
|
||||
expect(serialized).not.toContain("relative_path");
|
||||
expect(serialized).not.toContain("root_ref");
|
||||
expect(serialized).not.toMatch(/[A-Z]:\\\\/i);
|
||||
});
|
||||
|
||||
it("keeps resource identifiers opaque, verifies file hashes, and rejects unsafe manifests", () => {
|
||||
const manifest = fixture();
|
||||
expect(manifest.read("public_release_asset", releaseVersion, publicId)?.bytes).toEqual(Buffer.from("public-content"));
|
||||
expect(manifest.read("public_release_asset", releaseVersion, previewId)).toBeUndefined();
|
||||
expect(manifest.project("private_user_asset", releaseVersion, { ownerId: "owner-1" })?.items)
|
||||
.toEqual([expect.objectContaining({ resource_id: privateId })]);
|
||||
expect(manifest.project("private_user_asset", releaseVersion, { ownerId: "owner-2" })?.items).toEqual([]);
|
||||
|
||||
expect(() => createAssetReleaseManifest({
|
||||
items: [{
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
content: Buffer.from("tampered"),
|
||||
mime_type: "image/png",
|
||||
relative_path: "public/tampered.png",
|
||||
resource_id: publicId,
|
||||
root_ref: "canonical-assets",
|
||||
sha256: "0".repeat(64),
|
||||
}],
|
||||
release_version: releaseVersion,
|
||||
})).toThrow(/sha-?256/i);
|
||||
expect(() => createAssetReleaseManifest({
|
||||
items: [{
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
content: Buffer.from("unsafe"),
|
||||
mime_type: "image/png",
|
||||
relative_path: "/outside/private.png",
|
||||
resource_id: publicId,
|
||||
root_ref: "canonical-assets",
|
||||
}],
|
||||
release_version: releaseVersion,
|
||||
})).toThrow(/relative path/i);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user