feat: publish admin sticker releases (TASK-WP5-05)

apps/api/src/app.ts

@@ -178,6 +178,8 @@ import type { RecentAssetService } from "./recent-assets.js";
 import type { AmapAdapter } from "./amap-adapter.js";
 import { ModelConfigurationError } from "./model-configuration.js";
 import type { ModelConfigurationService } from "./model-configuration.js";
+import { StickerReleaseError } from "./sticker-release-errors.js";
+import type { StickerReleaseService } from "./sticker-releases.js";
 
 const defaultBootstrap: BootstrapResponse = {
   app_version: "0.0.0",
@@ -219,6 +221,7 @@ export interface CreateAppOptions {
     resourceId: string;
   }) => boolean | Promise<boolean>;
   registration?: RegistrationService;
+  stickers?: StickerReleaseService;
 }
 
 const supportGateDirectory = resolve(process.env.DADA_SUPPORT_GATE_ROOT ?? "apps/web/support-gate");
@@ -374,6 +377,11 @@ function modelConfigurationFailure(reply: FastifyReply, correlationId: string, e
   return reply.code(status).send(createErrorEnvelope({ code: error.code, correlationId, details }));
 }
 
+function stickerReleaseFailure(reply: FastifyReply, correlationId: string, error: unknown) {
+  if (error instanceof StickerReleaseError) return reply.code(error.httpStatus).send(null);
+  return latestExportFailure(reply, correlationId, error);
+}
+
 function generationTaskResponse(task: GenerationTaskView) {
   return {
     confirmed_credit_cost: task.confirmedCreditCost,
@@ -829,6 +837,134 @@ export async function createApp(options: CreateAppOptions = {}) {
     status: "ready",
   }));
 
+  app.get(
+    "/api/v1/static-stickers/current",
+    { schema: { hide: true } },
+    async (_request, reply) => {
+      if (!options.stickers) return reply.code(503).send();
+      reply.header("Cache-Control", "no-cache");
+      return options.stickers.listPublic();
+    },
+  );
+
+  app.get(
+    "/api/v1/static-stickers/:resourceVersion",
+    { schema: { hide: true } },
+    async (request, reply) => {
+      if (!options.stickers) return reply.code(404).send();
+      const { resourceVersion } = request.params as { resourceVersion: string };
+      const catalog = options.stickers.listPublic(resourceVersion);
+      if (!catalog.release_version) return reply.code(404).send();
+      reply.header("Cache-Control", "public, max-age=31536000, immutable");
+      return catalog;
+    },
+  );
+
+  app.get(
+    "/api/v1/admin/assets/static-stickers",
+    { schema: { hide: true } },
+    async (request, reply) => {
+      if (!options.registration || !options.stickers) {
+        return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      }
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      const session = token ? options.registration.readAdminSession(token) : undefined;
+      if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      reply.header("Cache-Control", "private, no-store");
+      return options.stickers.adminView();
+    },
+  );
+
+  app.post(
+    "/api/v1/admin/assets/static-stickers",
+    { schema: { hide: true } },
+    async (request, reply) => {
+      if (!request.isMultipart()) return reply.code(400).send(null);
+      if (!options.registration || !options.stickers) {
+        return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      }
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      const idempotencyKey = headerValue(request.headers["idempotency-key"]);
+      const csrfToken = headerValue(request.headers["x-csrf-token"]);
+      if (!token) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      if (!idempotencyKey || !/^[A-Za-z0-9_-]{32,200}$/.test(idempotencyKey)
+        || !csrfToken || !/^[A-Za-z0-9_-]{43,64}$/.test(csrfToken)) return reply.code(400).send(null);
+      try {
+        const admin = options.registration.authorizeAdminMutation({ csrfToken, sessionToken: token });
+        const values = new Map<string, string>();
+        const allowedFields = new Set(["enabled", "order", "original_byte_size", "original_sha256", "part", "stable_id"]);
+        let result: Awaited<ReturnType<StickerReleaseService["upload"]>> | undefined;
+        for await (const part of request.parts({ limits: { fileSize: 20 * 1024 * 1024, files: 1, fields: 8, parts: 9 } })) {
+          if (part.type === "field") {
+            if (result || !allowedFields.has(part.fieldname) || values.has(part.fieldname) || typeof part.value !== "string") throw new StickerReleaseError("sticker_upload_invalid");
+            values.set(part.fieldname, part.value);
+            continue;
+          }
+          if (result || part.fieldname !== "sticker_file" || !part.filename
+            || !new Set(["image/png", "image/webp"]).has(part.mimetype)) throw new StickerReleaseError("sticker_upload_invalid");
+          const stableId = values.get("stable_id");
+          const partValue = Number(values.get("part"));
+          const order = Number(values.get("order"));
+          const enabled = values.get("enabled");
+          const expectedByteSize = Number(values.get("original_byte_size"));
+          const expectedSha256 = values.get("original_sha256");
+          if (!stableId || !expectedSha256 || !new Set(["true", "false"]).has(enabled ?? "")) throw new StickerReleaseError("sticker_upload_invalid");
+          result = await options.stickers.upload({
+            actorId: admin.userId,
+            content: part.file,
+            enabled: enabled === "true",
+            expectedByteSize,
+            expectedMimeType: part.mimetype as "image/png" | "image/webp",
+            expectedSha256,
+            fileName: part.filename,
+            idempotencyKey,
+            order,
+            part: partValue,
+            stableId,
+          });
+          if (part.file.truncated) throw new StickerReleaseError("sticker_upload_invalid");
+        }
+        if (!result) throw new StickerReleaseError("sticker_upload_invalid");
+        return reply.code(result.created ? 201 : 200).send(result);
+      } catch (error) {
+        return error instanceof RegistrationError
+          ? registrationFailure(reply, request.id, error)
+          : stickerReleaseFailure(reply, request.id, error);
+      }
+    },
+  );
+
+  app.patch(
+    "/api/v1/admin/assets/static-stickers/:stableId",
+    { schema: { hide: true } },
+    async (request, reply) => {
+      if (!options.registration || !options.stickers) {
+        return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      }
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      const csrfToken = headerValue(request.headers["x-csrf-token"]);
+      if (!token || !csrfToken) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      try {
+        const admin = options.registration.authorizeAdminMutation({ csrfToken, sessionToken: token });
+        const body = request.body as { enabled?: boolean; order?: number; part?: number } | undefined;
+        if (!body || Object.keys(body).length === 0 || Object.keys(body).some((key) => !new Set(["enabled", "order", "part"]).has(key))) {
+          throw new StickerReleaseError("sticker_update_invalid");
+        }
+        return options.stickers.update({
+          actorId: admin.userId,
+          ...(typeof body.enabled === "boolean" ? { enabled: body.enabled } : {}),
+          ...(typeof body.order === "number" ? { order: body.order } : {}),
+          ...(typeof body.part === "number" ? { part: body.part } : {}),
+          stableId: (request.params as { stableId: string }).stableId,
+        });
+      } catch (error) {
+        return error instanceof RegistrationError
+          ? registrationFailure(reply, request.id, error)
+          : stickerReleaseFailure(reply, request.id, error);
+      }
+    },
+  );
+
   app.get(
     "/api/v1/assets/public/:resourceVersion/manifest",
     { schema: { hide: true } },
@@ -850,6 +986,11 @@ export async function createApp(options: CreateAppOptions = {}) {
       const resource = assetId && resourceVersion
         ? options.assetReleases?.read("public_release_asset", resourceVersion, assetId)
           ?? options.publicAssets?.read(resourceVersion, assetId)
+          ?? options.stickers?.readPublicAsset(
+            resourceVersion,
+            assetId,
+            (request.query as { variant?: string }).variant === "thumbnail" ? "thumbnail" : "original",
+          )
         : undefined;
       if (!resource) return reply.code(404).send();
       reply.type(resource.mimeType);