feat: publish admin sticker releases (TASK-WP5-05)

apps/api/src/managed-storage.ts

@@ -496,9 +496,11 @@ export class ManagedStorage {
     }
   }
 
-  async stagePrivateImage(input: {
+  async stageManagedImage(input: {
     content: Readable;
     expectedMimeType: "image/png" | "image/jpeg" | "image/webp";
+    expectedSha256?: string;
+    fileKind: ManagedFileKind;
     fileName: string;
     maximumBytes: number;
     operationId: string;
@@ -509,7 +511,7 @@ export class ManagedStorage {
     const destination = this.destination({
       content: input.content,
       expectedMimeType: input.expectedMimeType,
-      fileKind: "reference",
+      fileKind: input.fileKind,
       fileName: input.fileName,
       operationId: input.operationId,
       ownerRef: input.ownerRef,
@@ -537,6 +539,8 @@ export class ManagedStorage {
       await pipeline(input.content, inspect, createWriteStream(stagingPath, { flags: "wx" }));
       validatePositiveBytes(byteSize, "actual_write_bytes");
       if (sniffMime(prefix) !== input.expectedMimeType) throw new Error("content_mime_invalid");
+      const sha256 = hash.digest("hex");
+      if (input.expectedSha256 && sha256.toLowerCase() !== input.expectedSha256.toLowerCase()) throw new Error("content_hash_invalid");
       const state = this.getState();
       const otherReservations = this.activeReservationBytes(input.operationId);
       if (state.managed_content_bytes + otherReservations + byteSize > HARD_LIMIT_BYTES) {
@@ -549,12 +553,12 @@ export class ManagedStorage {
         bytes: byteSize,
         destinationPath: destination.absolutePath,
         fileId,
-        fileKind: "reference",
+        fileKind: input.fileKind,
         mimeType: input.expectedMimeType,
         operationId: input.operationId,
         ownerRef: input.ownerRef,
         relativePath: destination.relativePath,
-        sha256: hash.digest("hex"),
+        sha256,
         stagingDirectory,
         stagingPath,
       };
@@ -565,6 +569,18 @@ export class ManagedStorage {
     }
   }
 
+  async stagePrivateImage(input: {
+    content: Readable;
+    expectedMimeType: "image/png" | "image/jpeg" | "image/webp";
+    fileName: string;
+    maximumBytes: number;
+    operationId: string;
+    ownerRef: string;
+    projectedWriteBytes: number;
+  }): Promise<StagedManagedFile> {
+    return this.stageManagedImage({ ...input, fileKind: "reference" });
+  }
+
   moveStagedFile(file: StagedManagedFile) {
     mkdirSync(dirname(file.destinationPath), { recursive: true });
     renameSync(file.stagingPath, file.destinationPath);