Squahsed history
This commit is contained in:
Ravi Khadiwala
commit
4a41801f5c
34
.eslintrc.json
Normal file
34
.eslintrc.json
Normal file
@ -0,0 +1,34 @@
|
||||
{
|
||||
"env": {
|
||||
"browser": true,
|
||||
"es2021": true
|
||||
},
|
||||
"extends": [
|
||||
"eslint:recommended",
|
||||
"plugin:@typescript-eslint/recommended"
|
||||
],
|
||||
"overrides": [
|
||||
],
|
||||
"parser": "@typescript-eslint/parser",
|
||||
"parserOptions": {
|
||||
"ecmaVersion": "latest",
|
||||
"sourceType": "module"
|
||||
},
|
||||
"plugins": [
|
||||
"@typescript-eslint"
|
||||
],
|
||||
"rules": {
|
||||
"semi": [2, "always"],
|
||||
"quotes": ["error", "single"],
|
||||
"no-unused-vars": "off",
|
||||
"prefer-const": ["error", {"destructuring": "all"}],
|
||||
"@typescript-eslint/no-unused-vars": [
|
||||
"warn",
|
||||
{
|
||||
"argsIgnorePattern": "^_",
|
||||
"varsIgnorePattern": "^_",
|
||||
"caughtErrorsIgnorePattern": "^_"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
23
.github/workflows/ci.yml
vendored
Normal file
23
.github/workflows/ci.yml
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ ravi/initial-commit ]
|
||||
pull_request:
|
||||
branches: [ ravi/initial-commit ]
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
NODE_OPTIONS: --experimental-vm-modules
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Use Node.js version
|
||||
uses: actions/setup-node@v3
|
||||
with:
|
||||
node-version: 18.16.1
|
||||
cache: 'npm'
|
||||
- run: npm ci
|
||||
- run: npm run build
|
||||
- run: npm test
|
||||
175
.gitignore
vendored
Normal file
175
.gitignore
vendored
Normal file
@ -0,0 +1,175 @@
|
||||
# Logs
|
||||
|
||||
logs
|
||||
_.log
|
||||
npm-debug.log_
|
||||
yarn-debug.log*
|
||||
yarn-error.log*
|
||||
lerna-debug.log*
|
||||
.pnpm-debug.log*
|
||||
|
||||
# Diagnostic reports (https://nodejs.org/api/report.html)
|
||||
|
||||
report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
|
||||
|
||||
# Runtime data
|
||||
|
||||
pids
|
||||
_.pid
|
||||
_.seed
|
||||
\*.pid.lock
|
||||
|
||||
# Directory for instrumented libs generated by jscoverage/JSCover
|
||||
|
||||
lib-cov
|
||||
|
||||
# Coverage directory used by tools like istanbul
|
||||
|
||||
coverage
|
||||
\*.lcov
|
||||
|
||||
# nyc test coverage
|
||||
|
||||
.nyc_output
|
||||
|
||||
# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
|
||||
|
||||
.grunt
|
||||
|
||||
# Bower dependency directory (https://bower.io/)
|
||||
|
||||
bower_components
|
||||
|
||||
# node-waf configuration
|
||||
|
||||
.lock-wscript
|
||||
|
||||
# Compiled binary addons (https://nodejs.org/api/addons.html)
|
||||
|
||||
build/Release
|
||||
|
||||
# Dependency directories
|
||||
|
||||
node_modules/
|
||||
jspm_packages/
|
||||
|
||||
# Snowpack dependency directory (https://snowpack.dev/)
|
||||
|
||||
web_modules/
|
||||
|
||||
# TypeScript cache
|
||||
|
||||
\*.tsbuildinfo
|
||||
|
||||
# Optional npm cache directory
|
||||
|
||||
.npm
|
||||
|
||||
# Optional eslint cache
|
||||
|
||||
.eslintcache
|
||||
|
||||
# Optional stylelint cache
|
||||
|
||||
.stylelintcache
|
||||
|
||||
# Microbundle cache
|
||||
|
||||
.rpt2_cache/
|
||||
.rts2_cache_cjs/
|
||||
.rts2_cache_es/
|
||||
.rts2_cache_umd/
|
||||
|
||||
# Optional REPL history
|
||||
|
||||
.node_repl_history
|
||||
|
||||
# Output of 'npm pack'
|
||||
|
||||
\*.tgz
|
||||
|
||||
# Yarn Integrity file
|
||||
|
||||
.yarn-integrity
|
||||
|
||||
# dotenv environment variable files
|
||||
|
||||
.env
|
||||
.env.development.local
|
||||
.env.test.local
|
||||
.env.production.local
|
||||
.env.local
|
||||
|
||||
# parcel-bundler cache (https://parceljs.org/)
|
||||
|
||||
.cache
|
||||
.parcel-cache
|
||||
|
||||
# Next.js build output
|
||||
|
||||
.next
|
||||
out
|
||||
|
||||
# Nuxt.js build / generate output
|
||||
|
||||
.nuxt
|
||||
dist
|
||||
|
||||
# Gatsby files
|
||||
|
||||
.cache/
|
||||
|
||||
# Comment in the public line in if your project uses Gatsby and not Next.js
|
||||
|
||||
# https://nextjs.org/blog/next-9-1#public-directory-support
|
||||
|
||||
# public
|
||||
|
||||
# vuepress build output
|
||||
|
||||
.vuepress/dist
|
||||
|
||||
# vuepress v2.x temp and cache directory
|
||||
|
||||
.temp
|
||||
.cache
|
||||
|
||||
# Docusaurus cache and generated files
|
||||
|
||||
.docusaurus
|
||||
|
||||
# Serverless directories
|
||||
|
||||
.serverless/
|
||||
|
||||
# FuseBox cache
|
||||
|
||||
.fusebox/
|
||||
|
||||
# DynamoDB Local files
|
||||
|
||||
.dynamodb/
|
||||
|
||||
# TernJS port file
|
||||
|
||||
.tern-port
|
||||
|
||||
# Stores VSCode versions used for testing VSCode extensions
|
||||
|
||||
.vscode-test
|
||||
|
||||
# yarn v2
|
||||
|
||||
.yarn/cache
|
||||
.yarn/unplugged
|
||||
.yarn/build-state.yml
|
||||
.yarn/install-state.gz
|
||||
.pnp.\*
|
||||
|
||||
# wrangler project
|
||||
|
||||
.dev.vars
|
||||
.wrangler/
|
||||
|
||||
.idea
|
||||
.vscode/*
|
||||
619
LICENSE
Normal file
619
LICENSE
Normal file
@ -0,0 +1,619 @@
|
||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
Version 3, 19 November 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing under
|
||||
this license.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your version
|
||||
supports such interaction) an opportunity to receive the Corresponding
|
||||
Source of your version by providing access to the Corresponding Source
|
||||
from a network server at no charge, through some standard or customary
|
||||
means of facilitating copying of software. This Corresponding Source
|
||||
shall include the Corresponding Source for any work covered by version 3
|
||||
of the GNU General Public License that is incorporated pursuant to the
|
||||
following paragraph.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU Affero General Public License from time to time. Such new versions
|
||||
will be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
51
README.md
Normal file
51
README.md
Normal file
@ -0,0 +1,51 @@
|
||||
# Overview
|
||||
|
||||
tus-server provides an implementation of the [TUS protocol](https://tus.io) for resumable uploads built on [cloudflare workers](https://www.cloudflare.com/products/workers/) and [R2](https://www.cloudflare.com/products/r2/).
|
||||
|
||||
# Building
|
||||
You'll need [Node.js](https://nodejs.org/). If you use [nvm](https://github.com/creationix/nvm) run
|
||||
```
|
||||
nvm use
|
||||
```
|
||||
|
||||
To install dependencies,
|
||||
```
|
||||
npm install
|
||||
```
|
||||
|
||||
In order to deploy to cloudflare or use non-local dev mode, use the [`wrangler`](https://developers.cloudflare.com/workers/wrangler/install-and-update/) utility. Follow those instructions to authenticate with your cloudflare account.
|
||||
|
||||
# Testing
|
||||
|
||||
The server assumes an authentication is provided via a signature using a shared secret. You can provide one for development by setting `SHARED_AUTH_SECRET` in `.dev.vars`, e.g.
|
||||
```
|
||||
> cat .dev.vars
|
||||
SHARED_AUTH_SECRET = "test"
|
||||
```
|
||||
|
||||
To run a dev server you can interact with over localhost
|
||||
```
|
||||
wrangler dev
|
||||
```
|
||||
|
||||
To run unit tests,
|
||||
```
|
||||
NODE_OPTIONS=--experimental-vm-modules npm test
|
||||
```
|
||||
|
||||
# Deploying
|
||||
|
||||
## One time setup
|
||||
1. Create an R2 bucket and update the binding in `wrangler.toml`
|
||||
2. Add a base64 encoded shared auth secret with `wrangler secret put SHARED_AUTH_SECRET`
|
||||
|
||||
```
|
||||
wrangler deploy -e <staging|production>
|
||||
```
|
||||
|
||||
# License
|
||||
|
||||
Copyright 2023 Signal Messenger, LLC
|
||||
|
||||
Licensed under the [AGPLv3](LICENSE)
|
||||
|
||||
7553
package-lock.json
generated
Normal file
7553
package-lock.json
generated
Normal file
File diff suppressed because it is too large
Load Diff
28
package.json
Normal file
28
package.json
Normal file
@ -0,0 +1,28 @@
|
||||
{
|
||||
"name": "attachments",
|
||||
"version": "0.0.0",
|
||||
"type": "module",
|
||||
"module": "./dist/index.js",
|
||||
"devDependencies": {
|
||||
"@cloudflare/workers-types": "^4.20230419.0",
|
||||
"@typescript-eslint/eslint-plugin": "^5.59.6",
|
||||
"@typescript-eslint/parser": "^5.59.6",
|
||||
"eslint": "^8.40.0",
|
||||
"tus-js-client": "^3.1.0",
|
||||
"typescript": "^5.0.4",
|
||||
"vitest": "^0.31.1",
|
||||
"vitest-environment-miniflare": "^2.14.0",
|
||||
"wrangler": "^2.20.0"
|
||||
},
|
||||
"private": true,
|
||||
"scripts": {
|
||||
"start": "wrangler dev",
|
||||
"deploy": "wrangler publish",
|
||||
"build": "wrangler build",
|
||||
"pretest": "wrangler build",
|
||||
"test": "vitest"
|
||||
},
|
||||
"dependencies": {
|
||||
"itty-router": "^4.0.9"
|
||||
}
|
||||
}
|
||||
33
src/auth.test.ts
Normal file
33
src/auth.test.ts
Normal file
@ -0,0 +1,33 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {describe, expect, it} from 'vitest';
|
||||
import {createAuthWithClock} from './auth';
|
||||
|
||||
describe('Auth', async () => {
|
||||
const user = 'test';
|
||||
const secret = 'secret';
|
||||
const maxAge = 10;
|
||||
|
||||
async function generatePassAt(user: string, time: number): Promise<string> {
|
||||
const auth = await createAuthWithClock(secret, maxAge, () => time);
|
||||
return await auth.generatePass(user);
|
||||
}
|
||||
|
||||
async function validateAt(user: string, password: string, time: number): Promise<boolean> {
|
||||
const auth = await createAuthWithClock(secret, maxAge, () => time);
|
||||
return await auth.validateCredentials(user, password);
|
||||
}
|
||||
|
||||
it('rejects expired credentials', async () => {
|
||||
expect(await validateAt(user, await generatePassAt(user, 1), 12)).toBe(false);
|
||||
});
|
||||
|
||||
it('passes valid credentials', async () => {
|
||||
expect(await validateAt(user, await generatePassAt(user, 1), 11)).toBe(true);
|
||||
});
|
||||
|
||||
it('rejects wrong-user credentials', async () => {
|
||||
expect(await validateAt(user, await generatePassAt(user + 'a', 1), 1)).toBe(false);
|
||||
});
|
||||
});
|
||||
53
src/auth.ts
Normal file
53
src/auth.ts
Normal file
@ -0,0 +1,53 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {Buffer} from 'node:buffer';
|
||||
|
||||
export interface Auth {
|
||||
generatePass(username: string): Promise<string>;
|
||||
|
||||
validateCredentials(username: string, password: string): Promise<boolean>;
|
||||
}
|
||||
|
||||
interface UnixTime {
|
||||
(): number;
|
||||
}
|
||||
|
||||
export async function createAuthWithClock(secret: string, maxAgeSeconds: number, clock: UnixTime): Promise<Auth> {
|
||||
const keyBytes = Buffer.from(secret, 'base64');
|
||||
const macKey = await crypto.subtle.importKey(
|
||||
'raw',
|
||||
keyBytes,
|
||||
{name: 'HMAC', hash: 'SHA-256'},
|
||||
false,
|
||||
['sign', 'verify']
|
||||
);
|
||||
return {
|
||||
async generatePass(username: string): Promise<string> {
|
||||
const now = clock().toString();
|
||||
const data = Buffer.from(username + ':' + now, 'utf-8');
|
||||
const sig = (await crypto.subtle.sign('HMAC', macKey, data)).slice(0, 10);
|
||||
return `${now}:${Buffer.from(sig).toString('hex')}`;
|
||||
},
|
||||
|
||||
async validateCredentials(username: string, password: string): Promise<boolean> {
|
||||
const [ts, sig] = password.split(':');
|
||||
const data = Buffer.from(username + ':' + ts, 'utf-8');
|
||||
const expected = (await crypto.subtle.sign('HMAC', macKey, data)).slice(0, 10);
|
||||
const actual = Buffer.from(sig, 'hex');
|
||||
if (!crypto.subtle.timingSafeEqual(actual, expected)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const now = clock();
|
||||
const tsSecs = parseInt(ts);
|
||||
return tsSecs + maxAgeSeconds >= now;
|
||||
}
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
export async function createAuth(secret: string, maxAgeSeconds: number): Promise<Auth> {
|
||||
return await createAuthWithClock(secret, maxAgeSeconds, () => Math.floor(new Date().getTime() / 1000));
|
||||
}
|
||||
|
||||
33
src/digest.ts
Normal file
33
src/digest.ts
Normal file
@ -0,0 +1,33 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
export interface Digester {
|
||||
update(bytes: ArrayBuffer | ArrayBufferView): Promise<void>;
|
||||
|
||||
digest(): Promise<ArrayBuffer | undefined>;
|
||||
}
|
||||
|
||||
export function noopDigester(): Digester {
|
||||
return {
|
||||
async update(_bytes: Uint8Array): Promise<void> {
|
||||
return Promise.resolve();
|
||||
},
|
||||
async digest(): Promise<Uint8Array | undefined> {
|
||||
return undefined;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
export function sha256Digester(): Digester {
|
||||
const stream = new crypto.DigestStream('SHA-256');
|
||||
const writer = stream.getWriter();
|
||||
return {
|
||||
async update(bytes: ArrayBuffer | ArrayBufferView): Promise<void> {
|
||||
return await writer.write(bytes);
|
||||
},
|
||||
async digest(): Promise<ArrayBuffer | undefined> {
|
||||
await writer.close();
|
||||
return await stream.digest;
|
||||
}
|
||||
};
|
||||
}
|
||||
466
src/index.test.ts
Normal file
466
src/index.test.ts
Normal file
@ -0,0 +1,466 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {expect, it, beforeAll, afterAll, describe, test} from 'vitest';
|
||||
import {createAuth} from './auth';
|
||||
import * as tus from 'tus-js-client';
|
||||
import {unstable_dev, UnstableDevWorker} from 'wrangler';
|
||||
import {X_SIGNAL_CHECKSUM_SHA256} from './uploadHandler';
|
||||
import {toBase64} from './util';
|
||||
|
||||
const prefix = 'bucket';
|
||||
const secret = 'test';
|
||||
const auth = await createAuth(secret, 100);
|
||||
|
||||
const PART_SIZE = 1024 * 1024 * 5;
|
||||
|
||||
let worker: UnstableDevWorker;
|
||||
|
||||
beforeAll(async () => {
|
||||
worker = await unstable_dev('src/index.ts', {
|
||||
experimental: {disableExperimentalWarning: true},
|
||||
vars: {
|
||||
SHARED_AUTH_SECRET: secret,
|
||||
PATH_PREFIX: prefix
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await worker.stop();
|
||||
});
|
||||
|
||||
describe('worker auth', () => {
|
||||
it('rejects un-authd request', async () => {
|
||||
const res = await worker.fetch(`http://localhost/upload/${prefix}/`, {
|
||||
method: 'POST',
|
||||
headers: {'Upload-Metadata': `filename ${btoa('test')}`}
|
||||
});
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('rejects misformated auth', async () => {
|
||||
const res = await worker.fetch(`http://localhost/upload/${prefix}/`, {
|
||||
method: 'POST',
|
||||
headers: {'Authorization': 'Complex zzzzz'}
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('accepts valid auth', async () => {
|
||||
const res = await worker.fetch(`http://localhost/upload/${prefix}/`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Upload-Metadata': `filename ${btoa('abc')}`,
|
||||
'Authorization': await headerFor('abc'),
|
||||
'Upload-Length': '1'
|
||||
}
|
||||
});
|
||||
expect(await res.text()).toBe('');
|
||||
expect(res.status).toBe(201);
|
||||
});
|
||||
});
|
||||
|
||||
describe('request validation', () => {
|
||||
it('rejects bad checksum', async () => {
|
||||
const res = await worker.fetch(`http://localhost/upload/${prefix}/`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Upload-Metadata': `filename ${btoa('abc')}`,
|
||||
'Authorization': await headerFor('abc'),
|
||||
'Upload-Length': '1',
|
||||
[X_SIGNAL_CHECKSUM_SHA256]: 'AAAA'
|
||||
}
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('rejects no upload-length', async () => {
|
||||
const res = await worker.fetch(`http://localhost/upload/${prefix}/`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Upload-Metadata': `filename ${btoa('abc')}`,
|
||||
'Authorization': await headerFor('abc'),
|
||||
}
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
describe('Tus', () => {
|
||||
const name = 'test123';
|
||||
|
||||
interface CreateOptions {
|
||||
uploadLength?: number;
|
||||
body?: string;
|
||||
checksum?: Uint8Array;
|
||||
}
|
||||
|
||||
async function createRequest(opts?: CreateOptions) {
|
||||
const headers: Record<string, string> = {
|
||||
'Authorization': await headerFor(name),
|
||||
'Tus-Resumable': '1.0.0',
|
||||
'Upload-Metadata': `filename ${btoa(name)}`
|
||||
};
|
||||
if (opts?.uploadLength != null) {
|
||||
headers['Upload-Length'] = opts.uploadLength.toString();
|
||||
} else {
|
||||
headers['Upload-Defer-Length'] = '1';
|
||||
}
|
||||
if (opts?.checksum != null) {
|
||||
headers[X_SIGNAL_CHECKSUM_SHA256] = toBase64(opts?.checksum);
|
||||
}
|
||||
if (opts?.body != null) {
|
||||
headers['Content-Type'] = 'application/offset+octet-stream';
|
||||
}
|
||||
return await worker.fetch(`http://localhost/upload/${prefix}/`, {
|
||||
method: 'POST',
|
||||
headers: headers,
|
||||
body: opts?.body
|
||||
});
|
||||
}
|
||||
|
||||
async function patchRequest(uploadOffset: number, body?: string | ReadableStream<Uint8Array>, headers?: Record<string, string>) {
|
||||
const h = headers || {};
|
||||
Object.assign(h, {
|
||||
'Authorization': await headerFor(name),
|
||||
'Upload-Offset': uploadOffset.toString(),
|
||||
'Content-Type': 'application/offset+octet-stream',
|
||||
'Tus-Resumable': '1.0.0'
|
||||
});
|
||||
|
||||
return await worker.fetch(`http://localhost/upload/${prefix}/${name}`, {
|
||||
method: 'PATCH',
|
||||
headers: h,
|
||||
duplex: 'half',
|
||||
body: body
|
||||
});
|
||||
}
|
||||
|
||||
async function headRequest() {
|
||||
return worker.fetch(`http://localhost/upload/${prefix}/${name}`, {
|
||||
method: 'HEAD',
|
||||
headers: {
|
||||
'Authorization': await headerFor(name),
|
||||
'Tus-Resumable': '1.0.0'
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
async function getRequest() {
|
||||
return await worker.fetch(`http://localhost/${prefix}/${name}`, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Authorization': await headerFor(name),
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
it('accepts an upload', async () => {
|
||||
const create = await createRequest({uploadLength: 4});
|
||||
expect(await create.text()).toBe('');
|
||||
expect(create.status).toBe(201);
|
||||
|
||||
const upload = await patchRequest(0, 'test');
|
||||
expect(await upload.text()).toBe('');
|
||||
expect(upload.status).toBe(204);
|
||||
expect(upload.headers.get('Upload-Offset')).toBe('4');
|
||||
});
|
||||
|
||||
it('can defer length', async () => {
|
||||
const create = await createRequest();
|
||||
|
||||
expect(await create.text()).toBe('');
|
||||
expect(create.status).toBe(201);
|
||||
|
||||
const upload1 = await patchRequest(0, 'test');
|
||||
expect(upload1.status).toBe(204);
|
||||
const upload2 = await patchRequest(4, 'test');
|
||||
expect(upload2.status).toBe(204);
|
||||
const upload3 = await patchRequest(8, 'test', {'Upload-Length': '12'});
|
||||
expect(upload3.status).toBe(204);
|
||||
|
||||
const get = await getRequest();
|
||||
expect(await get.text()).toBe('testtesttest');
|
||||
expect(get.status).toBe(200);
|
||||
});
|
||||
|
||||
it('can defer length and finish with an empty body', async () => {
|
||||
const create = await createRequest();
|
||||
|
||||
expect(await create.text()).toBe('');
|
||||
expect(create.status).toBe(201);
|
||||
|
||||
const upload1 = await patchRequest(0, 'test');
|
||||
expect(upload1.status).toBe(204);
|
||||
expect(upload1.headers.get('Upload-Offset')).toBe('4');
|
||||
|
||||
const upload2 = await patchRequest(4, '', {'Upload-Length': '4'});
|
||||
expect(upload2.status).toBe(204);
|
||||
expect(upload2.headers.get('Upload-Offset')).toBe('4');
|
||||
|
||||
const get = await getRequest();
|
||||
expect(await get.text()).toBe('test');
|
||||
expect(get.status).toBe(200);
|
||||
});
|
||||
|
||||
it('can upload in chunks', async () => {
|
||||
const create = await createRequest({uploadLength: 8});
|
||||
expect(create.status).toBe(201);
|
||||
|
||||
let upload = await patchRequest(0, 'test');
|
||||
expect(upload.status).toBe(204);
|
||||
expect(upload.headers.get('Upload-Offset')).toBe('4');
|
||||
|
||||
const head = await headRequest();
|
||||
expect(head.status).toBe(200);
|
||||
expect(head.headers.get('Upload-Offset')).toBe('4');
|
||||
|
||||
upload = await patchRequest(4, 'test');
|
||||
expect(upload.statusText).toBe('No Content');
|
||||
expect(upload.status).toBe(204);
|
||||
|
||||
const get = await getRequest();
|
||||
expect(await get.text()).toBe('testtest');
|
||||
expect(get.status).toBe(200);
|
||||
});
|
||||
|
||||
it('can resume after interruption', async () => {
|
||||
const create = await createRequest({uploadLength: 16});
|
||||
expect(create.status).toBe(201);
|
||||
|
||||
// body errors after first 8 bytes
|
||||
await expect(() => patchRequest(0, body(8, {
|
||||
pattern: 'test',
|
||||
error: 'injected error',
|
||||
// write small chunks so the reader reads something before the error
|
||||
targetChunkSize: 4
|
||||
}))).rejects.toThrowError();
|
||||
|
||||
const head = await headRequest();
|
||||
expect(head.status).toBe(200);
|
||||
expect(head.headers.get('Upload-Offset')).toBe('8');
|
||||
|
||||
// upload the rest
|
||||
const upload = await patchRequest(8, 'testtest');
|
||||
expect(upload.status).toBe(204);
|
||||
|
||||
const get = await getRequest();
|
||||
expect(await get.text()).toBe('testtesttesttest');
|
||||
});
|
||||
|
||||
it('can do a partial upload during creation', async () => {
|
||||
const create = await createRequest({uploadLength: 6, body: 'foo'});
|
||||
expect(create.status).toBe(201);
|
||||
expect(create.headers.get('Upload-Offset')).toBe('3');
|
||||
expect((await headRequest()).headers.get('Upload-Offset')).toBe('3');
|
||||
|
||||
const upload = await patchRequest(3, 'bar');
|
||||
expect(upload.status).toBe(204);
|
||||
|
||||
const get = await getRequest();
|
||||
expect(await get.text()).toBe('foobar');
|
||||
});
|
||||
|
||||
it('rejects bad upload-offset', async () => {
|
||||
const create = await createRequest({uploadLength: 6, body: 'foo'});
|
||||
expect(create.status).toBe(201);
|
||||
expect(create.headers.get('Upload-Offset')).toBe('3');
|
||||
|
||||
const upload = await patchRequest(4, 'ba');
|
||||
expect(upload.status).toBe(409);
|
||||
|
||||
await patchRequest(3, 'bar');
|
||||
expect(await (await getRequest()).text()).toBe('foobar');
|
||||
});
|
||||
|
||||
test.each(
|
||||
[0, 1, PART_SIZE - 1, PART_SIZE, PART_SIZE + 1]
|
||||
)('rejects incorrect checksum for length=%s', async (bodySize: number) => {
|
||||
await createRequest({uploadLength: bodySize, checksum: new Uint8Array(32)});
|
||||
const upload = await patchRequest(0, body(bodySize, {pattern: 'test'}));
|
||||
expect(upload.status).toBe(415);
|
||||
|
||||
// should delete the in-progress upload
|
||||
expect((await headRequest()).status).toBe(404);
|
||||
});
|
||||
|
||||
test.each(
|
||||
[
|
||||
[100, false],
|
||||
[100, true],
|
||||
[PART_SIZE + 1, false],
|
||||
[PART_SIZE + 1, true]
|
||||
]
|
||||
)('accepts correct checksum for length=%s, multiple-patches=%s)',
|
||||
async (bodySize: number, multiplePatches: boolean) => {
|
||||
const digestStream = new crypto.DigestStream('SHA-256');
|
||||
await body(bodySize, {pattern: 'test'}).pipeTo(digestStream);
|
||||
const expectedChecksum = await digestStream.digest;
|
||||
|
||||
await createRequest({uploadLength: bodySize, checksum: new Uint8Array(expectedChecksum)});
|
||||
if (multiplePatches) {
|
||||
await patchRequest(0, body(4, {pattern: 'test'}));
|
||||
await patchRequest(4, body(bodySize - 4, {pattern: 'test'}));
|
||||
|
||||
} else {
|
||||
await patchRequest(0, body(bodySize, {pattern: 'test'}));
|
||||
}
|
||||
|
||||
// make sure the checksum is also returned on GET
|
||||
const get = await getRequest();
|
||||
const actualChecksum = Buffer.from(get.headers.get(X_SIGNAL_CHECKSUM_SHA256) || '', 'base64');
|
||||
expect(actualChecksum.buffer).toEqual(expectedChecksum);
|
||||
});
|
||||
|
||||
// parameterized test of boundary conditions
|
||||
test.each(
|
||||
[0, 1, PART_SIZE - 1, PART_SIZE, PART_SIZE + 1, PART_SIZE * 10 + 1]
|
||||
)('upload(%s bytes)',
|
||||
async (uploadSize) => {
|
||||
const create = await createRequest({uploadLength: uploadSize});
|
||||
expect(create.status).toBe(201);
|
||||
|
||||
const upload = await patchRequest(0, body(uploadSize, {pattern: 'test'}));
|
||||
expect(upload.status).toBe(204);
|
||||
expect(upload.headers.get('Upload-Offset')).toBe(uploadSize.toString());
|
||||
|
||||
const get = await getRequest();
|
||||
const read = await get.text();
|
||||
expect(bodyMatchesPattern(read, 'test')).toBe(true);
|
||||
|
||||
const expectedEtag = await s3Etag(body(uploadSize, {pattern: 'test'}));
|
||||
expect(get.headers.get('etag')).toBe(expectedEtag);
|
||||
});
|
||||
|
||||
});
|
||||
|
||||
|
||||
describe('tus-js-client', () => {
|
||||
const name = 'test-client-obj';
|
||||
|
||||
test.each([false, true])('uploads creation-with-upload=%s',
|
||||
async (uploadDataDuringCreation: boolean) => {
|
||||
const blob = Buffer.from('test', 'utf-8');
|
||||
const authHeader = await headerFor(name);
|
||||
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
// node tus.Upload takes Buffer but typescript bindings are wrong
|
||||
const upload = new tus.Upload(blob as never as Blob, {
|
||||
endpoint: `http://${worker.address}:${worker.port}/upload/${prefix}/`,
|
||||
metadata: {'filename': name},
|
||||
headers: {'Authorization': authHeader},
|
||||
onError: reject,
|
||||
onSuccess: resolve,
|
||||
uploadSize: 4,
|
||||
uploadDataDuringCreation: uploadDataDuringCreation
|
||||
});
|
||||
upload.start();
|
||||
});
|
||||
|
||||
const resp = await fetch(`http://${worker.address}:${worker.port}/${prefix}/${name}`);
|
||||
expect(await resp.text()).toBe('test');
|
||||
}, {timeout: 10000});
|
||||
});
|
||||
|
||||
async function headerFor(key: string): Promise<string> {
|
||||
const user = `${prefix}/${key}`;
|
||||
const pass = await auth.generatePass(user);
|
||||
return `Basic ${Buffer.from(`${user}:${pass}`).toString('base64')}`;
|
||||
}
|
||||
|
||||
function fillPattern(targetSize: number, pattern: string): Uint8Array {
|
||||
const patternBytes = new TextEncoder().encode(pattern);
|
||||
if (patternBytes.byteLength >= targetSize) {
|
||||
return patternBytes;
|
||||
}
|
||||
|
||||
const repeatCount = Math.floor(targetSize / pattern.length);
|
||||
const chunk = new Uint8Array(repeatCount * patternBytes.byteLength);
|
||||
for (let i = 0; i < repeatCount; i++) {
|
||||
chunk.set(patternBytes, i * patternBytes.byteLength);
|
||||
}
|
||||
return chunk;
|
||||
}
|
||||
|
||||
function bodyMatchesPattern(body: string, pattern: string): boolean {
|
||||
for (let offset = 0; offset < body.length; offset += pattern.length) {
|
||||
const remaining = body.length - offset;
|
||||
if (body.slice(offset, offset + pattern.length) !== pattern.slice(0, remaining)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
interface BodyOptions {
|
||||
error?: string,
|
||||
pattern?: string,
|
||||
targetChunkSize?: number
|
||||
}
|
||||
|
||||
function body(numBytes: number, bodyOptions?: BodyOptions): ReadableStream<Uint8Array> {
|
||||
const chunkSize = bodyOptions?.targetChunkSize || 4096;
|
||||
const chunk = bodyOptions?.pattern == null
|
||||
? new Uint8Array(chunkSize)
|
||||
: fillPattern(chunkSize, bodyOptions.pattern);
|
||||
|
||||
const queueChunk = (controller: ReadableStreamDefaultController) => {
|
||||
if (numBytes >= chunk.length) {
|
||||
numBytes -= chunk.length;
|
||||
controller.enqueue(chunk);
|
||||
return;
|
||||
}
|
||||
|
||||
if (numBytes > 0) {
|
||||
controller.enqueue(chunk.subarray(0, numBytes));
|
||||
}
|
||||
if (bodyOptions?.error != null) {
|
||||
controller.error(bodyOptions?.error);
|
||||
} else {
|
||||
controller.close();
|
||||
}
|
||||
};
|
||||
|
||||
return new ReadableStream({
|
||||
start(controller) {
|
||||
queueChunk(controller);
|
||||
},
|
||||
pull(controller) {
|
||||
queueChunk(controller);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// This implements the undocumented but de-facto standard algorithm S3 (and R2) uses
|
||||
// to compute etags. If the object was uploaded without multi-part upload, it is
|
||||
// the hex md5 of the object's bytes. If it was uploaded with multi-part, it is
|
||||
// hex(md5(md5(part 1), md5(part 2) ...))-numParts
|
||||
async function s3Etag(body: ReadableStream<Uint8Array>): Promise<string> {
|
||||
const md5sums: ArrayBuffer[] = [];
|
||||
const mem = new Uint8Array(PART_SIZE);
|
||||
let offset = 0;
|
||||
for await (let chunk of body) {
|
||||
while (chunk.byteLength > 0) {
|
||||
const toCopy = Math.min(PART_SIZE - offset, chunk.byteLength);
|
||||
mem.set(chunk.subarray(0, toCopy), offset);
|
||||
offset += toCopy;
|
||||
chunk = chunk.subarray(toCopy, chunk.byteLength);
|
||||
if (offset === PART_SIZE && chunk.byteLength > 0) {
|
||||
md5sums.push(await crypto.subtle.digest('MD5', mem));
|
||||
offset = 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
md5sums.push(await crypto.subtle.digest('md5', mem.subarray(0, offset)));
|
||||
if (md5sums.length == 1) {
|
||||
return `"${Buffer.from(md5sums[0]).toString('hex')}"`;
|
||||
}
|
||||
const nestedMd5 = await crypto.subtle.digest('MD5', await new Blob(md5sums).arrayBuffer());
|
||||
return `"${Buffer.from(nestedMd5).toString('hex')}-${md5sums.length}"`;
|
||||
}
|
||||
|
||||
|
||||
|
||||
190
src/index.ts
Normal file
190
src/index.ts
Normal file
@ -0,0 +1,190 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {error, IRequest, json, Router} from 'itty-router';
|
||||
import {Auth, createAuth} from './auth';
|
||||
import {Buffer} from 'node:buffer';
|
||||
import {MAX_UPLOAD_LENGTH_BYTES, TUS_VERSION, X_SIGNAL_CHECKSUM_SHA256} from './uploadHandler';
|
||||
import {toBase64} from './util';
|
||||
import {parseUploadMetadata} from './parse';
|
||||
|
||||
export {UploadHandler} from './uploadHandler';
|
||||
|
||||
const DO_CALL_TIMEOUT = 1000 * 60 * 30; // 20 minutes
|
||||
|
||||
export interface Env {
|
||||
BUCKET: R2Bucket;
|
||||
|
||||
SHARED_AUTH_SECRET: string;
|
||||
|
||||
UPLOAD_HANDLER: DurableObjectNamespace;
|
||||
|
||||
PATH_PREFIX: string;
|
||||
}
|
||||
|
||||
|
||||
// lazy init because it requires env but is expensive to create
|
||||
let auth: Auth | undefined;
|
||||
|
||||
const router = Router();
|
||||
router
|
||||
// read the object :id directly from R2
|
||||
.get('/:bucket/:id', getHandler)
|
||||
|
||||
// TUS protocol operation, dispatched to an UploadHandler durable object
|
||||
.post('/upload/:bucket', withAuthenticatedKeyFromMetadata, uploadHandler)
|
||||
|
||||
// TUS protocol operation, dispatched to an UploadHandler durable object
|
||||
.patch('/upload/:bucket/:id', withAuthenticatedKey, uploadHandler)
|
||||
|
||||
// TUS protocol operation, dispatched to an UploadHandler durable object
|
||||
.head('/upload/:bucket/:id', withAuthenticatedKey, uploadHandler)
|
||||
|
||||
// Describes what TUS features we support
|
||||
.options('/upload/:bucket', optionsHandler)
|
||||
|
||||
.all('*', () => error(404));
|
||||
|
||||
export default {
|
||||
async fetch(
|
||||
request: Request,
|
||||
env: Env,
|
||||
_ctx: ExecutionContext
|
||||
): Promise<Response> {
|
||||
return await router.handle(request, env).catch(e => {
|
||||
console.log('error: ' + e.stack);
|
||||
return error(e);
|
||||
}).then(json);
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
async function getHandler(request: IRequest, env: Env): Promise<Response> {
|
||||
const requestId = request.params.id;
|
||||
if (request.params.bucket !== env.PATH_PREFIX) {
|
||||
return error(404);
|
||||
}
|
||||
|
||||
const object = await env.BUCKET.get(requestId);
|
||||
|
||||
if (object === null) {
|
||||
return error(404);
|
||||
}
|
||||
|
||||
const headers = new Headers();
|
||||
object.writeHttpMetadata(headers);
|
||||
headers.set('etag', object.httpEtag);
|
||||
|
||||
// the sha256 checksum was provided to R2 in the upload
|
||||
if (object.checksums.sha256 != null) {
|
||||
headers.set(X_SIGNAL_CHECKSUM_SHA256, toBase64(object.checksums.sha256));
|
||||
}
|
||||
|
||||
// it was a multipart upload so we were forced to write a sha256 checksum as a custom header
|
||||
if (object.customMetadata?.[X_SIGNAL_CHECKSUM_SHA256] != null) {
|
||||
headers.set(X_SIGNAL_CHECKSUM_SHA256, object.customMetadata[X_SIGNAL_CHECKSUM_SHA256]);
|
||||
}
|
||||
|
||||
return new Response(object.body, {headers});
|
||||
|
||||
}
|
||||
|
||||
async function optionsHandler(_request: IRequest, _env: Env): Promise<Response> {
|
||||
return new Response(null, {
|
||||
status: 204,
|
||||
headers: new Headers({
|
||||
'Tus-Resumable': TUS_VERSION,
|
||||
'Tus-Version': TUS_VERSION,
|
||||
'Tus-Max-Size': MAX_UPLOAD_LENGTH_BYTES.toString(),
|
||||
'Tus-Extension': 'creation,creation-defer-length,creation-with-upload,expiration'
|
||||
})
|
||||
});
|
||||
}
|
||||
|
||||
// TUS protocol requests (POST/PATCH/HEAD) that get forwarded to a durable object
|
||||
async function uploadHandler(request: IRequest, env: Env): Promise<Response> {
|
||||
const requestId: string = request.key;
|
||||
// The id of the DurableObject is derived from the authenticated upload id provided by the requester
|
||||
const handler = env.UPLOAD_HANDLER.get(env.UPLOAD_HANDLER.idFromName(requestId));
|
||||
return await handler.fetch(request.url, {
|
||||
body: request.body,
|
||||
method: request.method,
|
||||
headers: request.headers,
|
||||
signal: AbortSignal.timeout(DO_CALL_TIMEOUT)
|
||||
});
|
||||
}
|
||||
|
||||
interface ParseError {
|
||||
state: 'error',
|
||||
error: Response
|
||||
}
|
||||
|
||||
interface Credentials {
|
||||
state: 'success',
|
||||
user: string,
|
||||
password: string
|
||||
}
|
||||
|
||||
function parseBasicAuth(auth: string): Credentials | ParseError {
|
||||
const prefix = 'Basic ';
|
||||
if (!auth.startsWith(prefix)) {
|
||||
return {state: 'error', error: error(400, 'auth should be Basic ')};
|
||||
}
|
||||
const cred = auth.slice(prefix.length);
|
||||
const decoded = Buffer.from(cred, 'base64').toString('utf8');
|
||||
|
||||
const [username, ...rest] = decoded.split(':');
|
||||
const password = rest.join(':');
|
||||
if (!password) {
|
||||
return {state: 'error', error: error(400, 'invalid auth format')};
|
||||
}
|
||||
return {state: 'success', user: username, password: password};
|
||||
}
|
||||
|
||||
// Checks the request is authenticated for the name provided in the request path :id segment
|
||||
async function withAuthenticatedKey(request: IRequest, env: Env): Promise<Response | undefined> {
|
||||
return await authAgainstUploadName(request, env, request.params.bucket, request.params.id);
|
||||
}
|
||||
|
||||
// Checks the request is authenticated for the name provided in the TUS upload-metadata
|
||||
async function withAuthenticatedKeyFromMetadata(request: IRequest, env: Env): Promise<Response | undefined> {
|
||||
const key = parseUploadMetadata(request.headers).filename;
|
||||
if (key == null) {
|
||||
return error(400, 'upload-metadata filename required');
|
||||
}
|
||||
return await authAgainstUploadName(request, env, request.params.bucket, key);
|
||||
}
|
||||
|
||||
// Checks the request is authenticated for key
|
||||
async function authAgainstUploadName(request: IRequest, env: Env, bucket: string, key: string): Promise<Response | undefined> {
|
||||
auth = auth || await createAuth(env.SHARED_AUTH_SECRET, 3600 * 24 * 7);
|
||||
|
||||
if (bucket !== env.PATH_PREFIX) {
|
||||
return error(404);
|
||||
}
|
||||
|
||||
const authHeader = request.headers.get('Authorization');
|
||||
if (!authHeader) {
|
||||
return error(401, 'missing credentials');
|
||||
}
|
||||
|
||||
const parsed = parseBasicAuth(authHeader);
|
||||
if (parsed.state === 'error') {
|
||||
return parsed.error;
|
||||
}
|
||||
|
||||
const valid = await auth.validateCredentials(parsed.user, parsed.password);
|
||||
if (!valid) {
|
||||
return error(401, 'invalid credentials');
|
||||
}
|
||||
|
||||
if (key === '') {
|
||||
return error(400, 'invalid upload name');
|
||||
}
|
||||
|
||||
if (parsed.user !== bucket + '/' + key) {
|
||||
return error(401, 'invalid credentials for upload name');
|
||||
}
|
||||
request.key = key;
|
||||
}
|
||||
|
||||
59
src/parse.test.ts
Normal file
59
src/parse.test.ts
Normal file
@ -0,0 +1,59 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {describe, expect, it} from 'vitest';
|
||||
import {parseUploadMetadata} from './parse';
|
||||
import {StatusError} from 'itty-router';
|
||||
|
||||
describe('upload-metadata parsing', () => {
|
||||
it('parses valid data', () => {
|
||||
const checksum = new Uint8Array(32);
|
||||
crypto.getRandomValues(checksum);
|
||||
const uploadMetadata = parseUploadMetadata(new Headers({
|
||||
'Upload-Metadata': createUploadMetadata({'filename': 'name'})
|
||||
}));
|
||||
expect(uploadMetadata.filename).toBe('name');
|
||||
});
|
||||
|
||||
it('rejects empty key', () => {
|
||||
expect(() => parseUploadMetadata(new Headers({
|
||||
'Upload-Metadata': ',filename abc'
|
||||
}))).toSatisfy(throwsStatusCode(400));
|
||||
});
|
||||
|
||||
it('handles empty value', () => {
|
||||
expect(parseUploadMetadata(new Headers({
|
||||
'Upload-Metadata': `ignored,filename ${btoa('hello')}`
|
||||
})).filename).toBe('hello');
|
||||
});
|
||||
|
||||
it('ignores unknown fields', () => {
|
||||
expect(parseUploadMetadata(new Headers({
|
||||
'Upload-Metadata': `ignored hi,filename ${btoa('hello')}`
|
||||
})).filename).toBe('hello');
|
||||
});
|
||||
|
||||
function throwsStatusCode(statusCode: number): (value: (() => void)) => boolean {
|
||||
return f => {
|
||||
try {
|
||||
f();
|
||||
return false;
|
||||
} catch (e) {
|
||||
console.log(`expected error: ${e}`);
|
||||
return e instanceof StatusError && e.status == statusCode;
|
||||
}
|
||||
};
|
||||
}
|
||||
});
|
||||
|
||||
function createUploadMetadata(metadata: Record<string, string | Uint8Array>): string {
|
||||
return Object.entries(metadata)
|
||||
.map(([key, value]) => {
|
||||
if (typeof value === 'string') {
|
||||
return `${key} ${btoa(value)}`;
|
||||
} else {
|
||||
return `${key} ${Buffer.from(value).toString('base64')}`;
|
||||
}
|
||||
})
|
||||
.join(',');
|
||||
}
|
||||
59
src/parse.ts
Normal file
59
src/parse.ts
Normal file
@ -0,0 +1,59 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {StatusError} from 'itty-router';
|
||||
import {fromBase64} from './util';
|
||||
import {X_SIGNAL_CHECKSUM_SHA256} from './uploadHandler';
|
||||
|
||||
export interface UploadMetadata {
|
||||
filename?: string,
|
||||
}
|
||||
|
||||
// Parse "Upload-Metadata" header as described in the TUS creation extension
|
||||
// https://tus.io/protocols/resumable-upload#upload-metadata
|
||||
export function parseUploadMetadata(headers: Headers): UploadMetadata {
|
||||
const uploadMetadata: string | null = headers.get('Upload-Metadata');
|
||||
if (uploadMetadata == null) {
|
||||
return {};
|
||||
}
|
||||
const ret: UploadMetadata = {};
|
||||
const pairs = uploadMetadata.split(',');
|
||||
for (const pair of pairs) {
|
||||
const [key, value] = pair.split(' ', 2);
|
||||
if (key == null || key === '') {
|
||||
throw new StatusError(400, 'upload-metadata entries must have keys');
|
||||
}
|
||||
|
||||
if (value == null) {
|
||||
// skip: leaving the value off is in spec, but none of the keys we care about allow it
|
||||
continue;
|
||||
}
|
||||
|
||||
const valueBytes: Uint8Array | undefined = fromBase64(value);
|
||||
if (valueBytes == null) {
|
||||
throw new StatusError(400, 'upload metadata must be base64 encoded');
|
||||
}
|
||||
|
||||
if (key === 'filename') {
|
||||
ret.filename = new TextDecoder().decode(valueBytes);
|
||||
}
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
export function parseChecksum(headers: Headers): Uint8Array | undefined {
|
||||
const checksum = headers.get(X_SIGNAL_CHECKSUM_SHA256);
|
||||
if (checksum == null) {
|
||||
return;
|
||||
}
|
||||
|
||||
const bytes = fromBase64(checksum);
|
||||
if (bytes == null) {
|
||||
throw new StatusError(400, 'checksum should be base64');
|
||||
}
|
||||
|
||||
if (bytes.length !== 32) {
|
||||
throw new StatusError(400, 'SHA-256 checksum should be 32 bytes');
|
||||
}
|
||||
return bytes;
|
||||
}
|
||||
170
src/uploadHandler.test.ts
Normal file
170
src/uploadHandler.test.ts
Normal file
@ -0,0 +1,170 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {expect, it, test} from 'vitest';
|
||||
import {UploadHandler} from './uploadHandler';
|
||||
import {Env} from './index';
|
||||
|
||||
const describe = setupMiniflareIsolatedStorage();
|
||||
|
||||
const PART_SIZE = 1024 * 1024 * 5;
|
||||
|
||||
describe('uploadHandler', () => {
|
||||
const env: Env = getMiniflareBindings() as Env;
|
||||
const r2: R2Bucket = env.BUCKET;
|
||||
|
||||
it('cleans after alarms', async () => {
|
||||
const id = env.UPLOAD_HANDLER.newUniqueId();
|
||||
const stub = env.UPLOAD_HANDLER.get(id);
|
||||
|
||||
const resp = await stub.fetch('http://localhost/upload/bucket/', {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Upload-Metadata': `filename ${btoa('test123')}`,
|
||||
'Upload-Length': '10'
|
||||
}
|
||||
});
|
||||
const storage = await getMiniflareDurableObjectStorage(id);
|
||||
expect(await storage.get('upload-info')).toMatchObject({uploadLength: 10});
|
||||
expect(await storage.get('upload-offset')).toBe(0);
|
||||
await flushMiniflareDurableObjectAlarms();
|
||||
expect((await storage.list()).size).toBe(0);
|
||||
});
|
||||
|
||||
it('cleans after unrecoverable failure', async () => {
|
||||
const id = env.UPLOAD_HANDLER.idFromName('test123');
|
||||
const stub = env.UPLOAD_HANDLER.get(id);
|
||||
const storage = await getMiniflareDurableObjectStorage(id);
|
||||
|
||||
// invalid state: temp object should be length 5, is only length 1
|
||||
const tempkey = `temporary/${id.toString()}`;
|
||||
await r2.put(tempkey, '1');
|
||||
await storage.put('upload-info', {uploadLength: 10});
|
||||
await storage.put('upload-offset', 5);
|
||||
|
||||
await expect(() => stub.fetch('http://localhost/upload/bucket/test123', {
|
||||
method: 'PATCH',
|
||||
headers: {'Upload-Offset': '5'},
|
||||
body: '6789!'
|
||||
})).rejects.toThrowError();
|
||||
|
||||
// should clean up after unrecoverable error
|
||||
expect((await storage.list()).size).toBe(0);
|
||||
});
|
||||
|
||||
it('hydrates from cold storage', async () => {
|
||||
const id = env.UPLOAD_HANDLER.idFromName('test123');
|
||||
const stub = env.UPLOAD_HANDLER.get(id);
|
||||
const storage = await getMiniflareDurableObjectStorage(id);
|
||||
|
||||
const tempkey = `temporary/${id.toString()}`;
|
||||
|
||||
await r2.put(tempkey, '12345');
|
||||
await storage.put('upload-info', {uploadLength: 10});
|
||||
await storage.put('upload-offset', 5);
|
||||
|
||||
const resp = await stub.fetch('http://localhost/upload/bucket/test123', {
|
||||
method: 'PATCH',
|
||||
headers: {'Upload-Offset': '5'},
|
||||
body: '6789!'
|
||||
});
|
||||
expect(resp.status).toBe(204);
|
||||
|
||||
const obj = await r2.get('test123');
|
||||
expect(obj).toBeTruthy();
|
||||
expect(await obj?.text()).toBe('123456789!');
|
||||
|
||||
// temporary should be gone
|
||||
expect(await r2.get(tempkey)).toBeNull();
|
||||
// all keys should be gone after success
|
||||
expect((await storage.list()).size).toBe(0);
|
||||
});
|
||||
|
||||
it('hydrates tx parts from cold storage', async () => {
|
||||
const id = env.UPLOAD_HANDLER.idFromName('test123');
|
||||
const stub = env.UPLOAD_HANDLER.get(id);
|
||||
const storage = await getMiniflareDurableObjectStorage(id);
|
||||
|
||||
const partBody = new Uint8Array(PART_SIZE);
|
||||
const tempkey = `temporary/${id.toString()}`;
|
||||
const mp = await r2.createMultipartUpload('test123');
|
||||
const part1 = await mp.uploadPart(1, partBody);
|
||||
await r2.put(tempkey, '12345');
|
||||
|
||||
await storage.put('upload-offset', partBody.length + 5);
|
||||
await storage.put('upload-info', {
|
||||
uploadLength: partBody.length + 10,
|
||||
multipartUploadId: mp.uploadId
|
||||
});
|
||||
await storage.put('1', {
|
||||
part: part1,
|
||||
length: partBody.byteLength
|
||||
});
|
||||
|
||||
const resp = await stub.fetch('http://localhost/upload/bucket/test123', {
|
||||
method: 'PATCH',
|
||||
headers: {'Upload-Offset': (partBody.byteLength + 5).toString()},
|
||||
body: '6789!'
|
||||
});
|
||||
expect(resp.status).toBe(204);
|
||||
|
||||
const obj = await r2.get('test123');
|
||||
expect(obj).toBeTruthy();
|
||||
const read = await obj?.text();
|
||||
expect(read?.length).toBe(partBody.byteLength + 10);
|
||||
expect(read?.slice(partBody.length, partBody.length + 10)).toBe('123456789!');
|
||||
|
||||
// temporary should be gone
|
||||
expect(await r2.get(tempkey)).toBeNull();
|
||||
// all keys should be gone after success
|
||||
expect((await storage.list()).size).toBe(0);
|
||||
});
|
||||
|
||||
test.each(
|
||||
[
|
||||
[PART_SIZE, 1, 1],
|
||||
[PART_SIZE + 1, PART_SIZE, 1],
|
||||
[0, PART_SIZE + 1, 1],
|
||||
[0, 10, 10],
|
||||
[0, 10, PART_SIZE]
|
||||
]
|
||||
)('resumes from storage for chunks=[%s,%s,%s]', async (chunk1Size, chunk2Size, chunk3Size) => {
|
||||
const id = env.UPLOAD_HANDLER.idFromName('test123');
|
||||
const state = await getMiniflareDurableObjectState(id);
|
||||
|
||||
const firstChunk = new Uint8Array(chunk1Size);
|
||||
const secondChunk = new Uint8Array(chunk2Size);
|
||||
const thirdChunk = new Uint8Array(chunk3Size);
|
||||
|
||||
const totalLength = firstChunk.length + secondChunk.length + thirdChunk.length;
|
||||
|
||||
const oldObj = new UploadHandler(state, env);
|
||||
await runWithMiniflareDurableObjectGates(state, () => oldObj.fetch(new Request('http://localhost/upload/bucket', {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Upload-Metadata': `filename ${btoa('test123')}`,
|
||||
'Upload-Length': totalLength.toString(),
|
||||
'Content-Type': 'application/offset+octet-stream'
|
||||
},
|
||||
body: firstChunk
|
||||
})));
|
||||
|
||||
await runWithMiniflareDurableObjectGates(state, () => oldObj.fetch(new Request('http://localhost/upload/bucket/test123', {
|
||||
method: 'PATCH',
|
||||
headers: {'Upload-Offset': firstChunk.length.toString()},
|
||||
body: secondChunk
|
||||
})));
|
||||
|
||||
// create a new object from the same state
|
||||
const newObj = new UploadHandler(state, env);
|
||||
await runWithMiniflareDurableObjectGates(state, () =>
|
||||
newObj.fetch(new Request('http://localhost/upload/bucket/test123', {
|
||||
method: 'PATCH',
|
||||
body: thirdChunk,
|
||||
headers: {'Upload-Offset': (firstChunk.length + secondChunk.length).toString()}
|
||||
})));
|
||||
|
||||
const obj = await r2.get('test123');
|
||||
expect((await obj?.text())?.length).toBe(totalLength);
|
||||
});
|
||||
});
|
||||
551
src/uploadHandler.ts
Normal file
551
src/uploadHandler.ts
Normal file
@ -0,0 +1,551 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {error, IRequest, json, Router, RouterType, StatusError} from 'itty-router';
|
||||
import {Buffer} from 'node:buffer';
|
||||
import {AsyncLock, generateParts, readIntFromHeader, toBase64, WritableStreamBuffer} from './util';
|
||||
import {Env} from './index';
|
||||
import {Digester, noopDigester, sha256Digester} from './digest';
|
||||
import {parseChecksum, parseUploadMetadata} from './parse';
|
||||
|
||||
export const TUS_VERSION = '1.0.0';
|
||||
|
||||
// uploads larger than this will be rejected
|
||||
export const MAX_UPLOAD_LENGTH_BYTES = 1024 * 1024 * 100;
|
||||
|
||||
export const X_SIGNAL_CHECKSUM_SHA256 = 'X-Signal-Checksum-Sha256';
|
||||
|
||||
// how long an unfinished upload lives in ms
|
||||
const UPLOAD_EXPIRATION_MS = 7 * 24 * 60 * 60 * 1000;
|
||||
|
||||
// how much we'll buffer in memory, must be greater than or equal to R2's min part size
|
||||
// https://developers.cloudflare.com/r2/objects/multipart-objects/#limitations
|
||||
const BUFFER_SIZE = 1024 * 1024 * 5;
|
||||
|
||||
// how much of the upload we've written
|
||||
const UPLOAD_OFFSET_KEY = 'upload-offset';
|
||||
|
||||
// key for StoredUploadInfo
|
||||
const UPLOAD_INFO_KEY = 'upload-info';
|
||||
|
||||
// Stored for each part with the key of the multipart part number. Part numbers start with 1
|
||||
interface StoredR2Part {
|
||||
part: R2UploadedPart,
|
||||
|
||||
// the length of the part
|
||||
length: number
|
||||
}
|
||||
|
||||
// Infrequently changing information about the upload
|
||||
interface StoredUploadInfo {
|
||||
uploadLength?: number,
|
||||
checksum?: Uint8Array,
|
||||
multipartUploadId?: string
|
||||
}
|
||||
|
||||
|
||||
// UploadHandlers represent an in-progress resumable upload to cloudflare R2.
|
||||
//
|
||||
// This class is a 'template' for a cloudflare durable object, which are
|
||||
// created by upstream workers for each unique object upload. See
|
||||
// https://developers.cloudflare.com/workers/runtime-apis/durable-objects/
|
||||
//
|
||||
// Uploads use the TUS protocol https://tus.io/protocols/resumable-upload.
|
||||
// When a client interacts with a particular upload name, all requests are
|
||||
// routed to the durable object id derived from that name (or a new durable
|
||||
// object is created if it doesn't already exist). POSTs initialize the
|
||||
// upload, and subsequent PATCH requests append to it. If a client gets
|
||||
// disconnected, a HEAD returns the current upload offset for the upload so
|
||||
// the upload can be resumed.
|
||||
//
|
||||
// Uploads are staged via R2 multipart upload, which is completed when the
|
||||
// client uploads the last byte. Multipart upload only supports 5MB boundaries,
|
||||
// which is more than we'd like clients to have to reupload. If a client does
|
||||
// not complete the upload in a single request (either because of a disconnect
|
||||
// or because the request is broken into multiple patches), the remainder after
|
||||
// the last 5MB boundary is saved in a temporary R2 object, which is then read
|
||||
// on a subsequent PATCH.
|
||||
export class UploadHandler {
|
||||
state: DurableObjectState;
|
||||
env: Env;
|
||||
router: RouterType;
|
||||
parts: StoredR2Part[];
|
||||
multipart: R2MultipartUpload | undefined;
|
||||
|
||||
// only allow a single request to operate at a time
|
||||
requestGate: AsyncLock;
|
||||
|
||||
|
||||
constructor(state: DurableObjectState, env: Env) {
|
||||
this.state = state;
|
||||
this.env = env;
|
||||
this.parts = [];
|
||||
this.requestGate = new AsyncLock();
|
||||
this.router = Router()
|
||||
.post('/upload/:bucket', this.exclusive(this.create))
|
||||
.patch('/upload/:bucket/:id', this.exclusive(this.patch))
|
||||
.head('/upload/:bucket/:id', this.exclusive(this.head))
|
||||
.all('*', () => error(404));
|
||||
}
|
||||
|
||||
// forbid concurrent requests while running clsMethod
|
||||
exclusive(clsMethod: (r: IRequest) => Promise<Response>): (r: IRequest) => Promise<Response> {
|
||||
return async request => {
|
||||
const release = await this.requestGate.lock();
|
||||
try {
|
||||
return await clsMethod.bind(this)(request);
|
||||
} catch (e) {
|
||||
if (e instanceof UnrecoverableError) {
|
||||
try {
|
||||
const r2Key = (e as UnrecoverableError).r2Key;
|
||||
// this upload can never make progress, try to clean up
|
||||
await this.cleanup(r2Key);
|
||||
} catch (cleanupError) {
|
||||
// ignore errors cleaning up
|
||||
console.error('error cleaning up ' + cleanupError);
|
||||
}
|
||||
}
|
||||
throw e;
|
||||
} finally {
|
||||
release();
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
fetch(request: Request): Promise<Response> {
|
||||
return this.router.handle(request).then(json).catch(e => {
|
||||
if (e instanceof StatusError) {
|
||||
return error(e);
|
||||
}
|
||||
console.error('server error processing request: ' + e);
|
||||
throw e;
|
||||
});
|
||||
}
|
||||
|
||||
async alarm() {
|
||||
return await this.cleanup();
|
||||
}
|
||||
|
||||
// create a new TUS upload
|
||||
async create(request: IRequest): Promise<Response> {
|
||||
const uploadMetadata = parseUploadMetadata(request.headers);
|
||||
const checksum = parseChecksum(request.headers);
|
||||
|
||||
const r2Key = uploadMetadata.filename;
|
||||
if (r2Key == null) {
|
||||
return error(400, 'bad filename metadata');
|
||||
}
|
||||
|
||||
const existingUploadOffset: number | undefined = await this.state.storage.get(UPLOAD_OFFSET_KEY);
|
||||
if (existingUploadOffset != null && existingUploadOffset > 0) {
|
||||
console.log('duplicate object creation');
|
||||
await this.cleanup(r2Key);
|
||||
return error(409, 'object already exists');
|
||||
}
|
||||
|
||||
// The client may provide an initial request body (creation-with-upload)
|
||||
const contentType = request.headers.get('Content-Type');
|
||||
if (contentType != null && contentType !== 'application/offset+octet-stream') {
|
||||
return error(415, 'body requires application/offset+octet-stream content-type');
|
||||
}
|
||||
|
||||
const hasContent = request.body != null && contentType != null;
|
||||
const uploadLength = readIntFromHeader(request.headers, 'Upload-Length');
|
||||
const uploadDeferLength = readIntFromHeader(request.headers, 'Upload-Defer-Length');
|
||||
if (isNaN(uploadLength) && isNaN(uploadDeferLength)) {
|
||||
return error(400, 'must contain Upload-Length or Upload-Defer-Length header');
|
||||
}
|
||||
|
||||
if (!isNaN(uploadDeferLength) && uploadDeferLength !== 1) {
|
||||
return error(400, 'bad Upload-Defer-Length');
|
||||
}
|
||||
|
||||
const uploadInfo: StoredUploadInfo = {};
|
||||
|
||||
const expiration = new Date(Date.now() + UPLOAD_EXPIRATION_MS);
|
||||
await this.state.storage.setAlarm(expiration);
|
||||
if (!isNaN(uploadLength)) {
|
||||
uploadInfo.uploadLength = uploadLength;
|
||||
}
|
||||
if (checksum != null) {
|
||||
uploadInfo.checksum = checksum;
|
||||
}
|
||||
await this.state.storage.put(UPLOAD_OFFSET_KEY, 0);
|
||||
await this.state.storage.put(UPLOAD_INFO_KEY, uploadInfo);
|
||||
|
||||
const uploadLocation = new URL(r2Key, request.url);
|
||||
|
||||
const uploadOffset = hasContent
|
||||
? await this.appendBody(r2Key, request.body, 0, uploadInfo)
|
||||
: 0;
|
||||
return new Response(null, {
|
||||
status: 201,
|
||||
headers: new Headers({
|
||||
'Location': uploadLocation.href,
|
||||
'Upload-Expires': expiration.toString(),
|
||||
'Upload-Offset': uploadOffset.toString(),
|
||||
'Tus-Resumable': TUS_VERSION
|
||||
})
|
||||
});
|
||||
}
|
||||
|
||||
// get the current upload offset to resume an upload
|
||||
async head(_request: IRequest): Promise<Response> {
|
||||
const offset: number | undefined = await this.state.storage.get(UPLOAD_OFFSET_KEY);
|
||||
if (offset == null) {
|
||||
return error(404);
|
||||
}
|
||||
|
||||
return new Response('', {
|
||||
headers: new Headers({
|
||||
'Upload-Offset': offset.toString(),
|
||||
'Upload-Expires': (await this.expirationTime()).toString(),
|
||||
'Cache-Control': 'no-store',
|
||||
'Tus-Resumable': TUS_VERSION
|
||||
})
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
// append to the upload at the current upload offset
|
||||
async patch(request: IRequest): Promise<Response> {
|
||||
const r2Key = request.params.id;
|
||||
|
||||
let uploadOffset: number | undefined = await this.state.storage.get(UPLOAD_OFFSET_KEY);
|
||||
if (uploadOffset == null) {
|
||||
return error(404);
|
||||
}
|
||||
|
||||
const headerOffset = readIntFromHeader(request.headers, 'Upload-Offset');
|
||||
if (uploadOffset !== headerOffset) {
|
||||
return error(409, 'incorrect upload offset');
|
||||
}
|
||||
|
||||
const uploadInfo: StoredUploadInfo | undefined = await this.state.storage.get(UPLOAD_INFO_KEY);
|
||||
if (uploadInfo == null) {
|
||||
throw new UnrecoverableError('existing upload should have had uploadInfo', r2Key);
|
||||
}
|
||||
const headerUploadLength = readIntFromHeader(request.headers, 'Upload-Length');
|
||||
if (uploadInfo.uploadLength != null && !isNaN(headerUploadLength) && uploadInfo.uploadLength !== headerUploadLength) {
|
||||
return error(400, 'upload length cannot change');
|
||||
}
|
||||
|
||||
// check if we now know the upload length
|
||||
if (uploadInfo.uploadLength == null && !isNaN(headerUploadLength)) {
|
||||
uploadInfo.uploadLength = headerUploadLength;
|
||||
await this.state.storage.put(UPLOAD_INFO_KEY, uploadInfo);
|
||||
}
|
||||
|
||||
if (request.body == null) {
|
||||
return error(400, 'Must provide request body');
|
||||
}
|
||||
|
||||
uploadOffset = await this.appendBody(r2Key, request.body, uploadOffset, uploadInfo);
|
||||
|
||||
return new Response(null, {
|
||||
status: 204, headers: new Headers({
|
||||
'Upload-Offset': uploadOffset.toString(),
|
||||
'Upload-Expires': (await this.expirationTime()).toString(),
|
||||
'Tus-Resumable': TUS_VERSION
|
||||
})
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
// Append body to the upload starting at uploadOffset. Returns the new uploadOffset
|
||||
//
|
||||
// The body is streamed into a fixed length buffer. If the object fits into a single
|
||||
// buffer, it's uploaded directly. Otherwise, each full buffer is uploaded to a
|
||||
// multipart transaction.
|
||||
//
|
||||
// If the stream ends but we have not hit uploadLength (either due to an error or a
|
||||
// partial upload), the remaining buffer is written to a temporary object. When
|
||||
// the upload is resumed, we retrieve the temporary and repopulate the buffer.
|
||||
//
|
||||
// If the client provides a checksum we need to do two things:
|
||||
// A. Reject the upload if it doesn't match the provided checksum
|
||||
// B. Once the object is uploaded, return the checksum on subsequent GET/HEAD requests
|
||||
//
|
||||
// Depending on how the object is uploaded, we achieve A and B different ways. If the object can be uploaded without
|
||||
// using mulitpart upload, R2 provides support for A and B directly. Otherwise, we support B by
|
||||
// adding custom metadata to the object when we create the multipart upload. For A, if the client manages to upload
|
||||
// the object in one-shot we calculate the digest as it comes in. Otherwise, after the multipart upload is
|
||||
// finished, we retrieve the object from R2 and recompute the digest.
|
||||
async appendBody(r2Key: string, body: ReadableStream<Uint8Array>, uploadOffset: number, uploadInfo: StoredUploadInfo): Promise<number> {
|
||||
const uploadLength = uploadInfo.uploadLength;
|
||||
if ((uploadLength || 0) > MAX_UPLOAD_LENGTH_BYTES) {
|
||||
await this.cleanup(r2Key);
|
||||
throw new StatusError(413, 'Upload-Length exceeds maximum upload size');
|
||||
}
|
||||
|
||||
// We'll repeatedly use this to buffer data we'll send to R2
|
||||
const mem = new WritableStreamBuffer(new ArrayBuffer(BUFFER_SIZE));
|
||||
|
||||
uploadOffset = await this.resumeUpload(r2Key, uploadOffset, uploadInfo, mem);
|
||||
|
||||
const isSinglePart = uploadLength != null && uploadLength <= BUFFER_SIZE;
|
||||
const checksum: Uint8Array | undefined = uploadInfo.checksum;
|
||||
// optimization: only bother calculating the stream’s checksum if the client provided it, and we’re not resuming
|
||||
const digester: Digester = checksum != null && uploadOffset == 0 && !isSinglePart ? sha256Digester() : noopDigester();
|
||||
|
||||
for await (const part of generateParts(body, mem)) {
|
||||
const newLength = uploadOffset + part.bytes.byteLength;
|
||||
if (uploadLength != null && newLength > uploadLength) {
|
||||
await this.cleanup(r2Key);
|
||||
throw new StatusError(413, 'body exceeds Upload-Length');
|
||||
}
|
||||
if (newLength > MAX_UPLOAD_LENGTH_BYTES) {
|
||||
await this.cleanup(r2Key);
|
||||
throw new StatusError(413, 'body exceeds maximum upload size');
|
||||
}
|
||||
|
||||
await digester.update(part.bytes);
|
||||
|
||||
switch (part.kind) {
|
||||
case 'intermediate': {
|
||||
if (this.multipart == null) {
|
||||
this.multipart = await this.r2CreateMultipartUpload(r2Key, uploadInfo);
|
||||
}
|
||||
this.parts.push({
|
||||
part: await this.multipart.uploadPart(this.parts.length + 1, part.bytes),
|
||||
length: part.bytes.byteLength
|
||||
});
|
||||
uploadOffset += part.bytes.byteLength;
|
||||
const writePart = this.state.storage.put(this.parts.length.toString(), this.parts.at(-1));
|
||||
const writeOffset = this.state.storage.put(UPLOAD_OFFSET_KEY, uploadOffset);
|
||||
await Promise.all([writePart, writeOffset]);
|
||||
break;
|
||||
}
|
||||
case 'final':
|
||||
case 'error': {
|
||||
const finished = uploadLength != null && uploadOffset + part.bytes.byteLength === uploadLength;
|
||||
if (!finished) {
|
||||
// write the partial part to a temporary object so we can rehydrate it
|
||||
// later, and then we're done
|
||||
await this.env.BUCKET.put(this.tempkey(), part.bytes);
|
||||
uploadOffset += part.bytes.byteLength;
|
||||
await this.state.storage.put(UPLOAD_OFFSET_KEY, uploadOffset);
|
||||
} else if (!this.multipart) {
|
||||
// all the bytes fit into a single in memory buffer, so we can just upload
|
||||
// it directly without using multipart
|
||||
await this.r2Put(r2Key, part.bytes, checksum);
|
||||
uploadOffset += part.bytes.byteLength;
|
||||
await this.cleanup();
|
||||
} else {
|
||||
// upload the last part (can be less than the 5mb min part size), then complete the upload
|
||||
const uploadedPart = await this.multipart.uploadPart(this.parts.length + 1, part.bytes);
|
||||
this.parts.push({part: uploadedPart, length: part.bytes.byteLength});
|
||||
await this.r2CompleteMultipartUpload(r2Key, await digester.digest(), checksum);
|
||||
uploadOffset += part.bytes.byteLength;
|
||||
await this.cleanup();
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
return uploadOffset;
|
||||
}
|
||||
|
||||
// Check a checksum, throwing a 415 if the checksum does not match
|
||||
async checkChecksum(r2Key: string, expected: Uint8Array, actual: ArrayBuffer) {
|
||||
if (!Buffer.from(actual).equals(expected)) {
|
||||
await this.cleanup(r2Key);
|
||||
throw new StatusError(415, `The SHA-256 checksum you specified ${toBase64(actual)} did not match what we received ${toBase64(expected)}.`);
|
||||
}
|
||||
}
|
||||
|
||||
// Compute the SHA-256 checksum of a remote r2 object
|
||||
async retrieveChecksum(r2Key: string): Promise<ArrayBuffer> {
|
||||
const body = await this.env.BUCKET.get(r2Key);
|
||||
if (body == null) {
|
||||
throw new UnrecoverableError(`Object ${r2Key} not found directly after uploading`, r2Key);
|
||||
}
|
||||
const digest = new crypto.DigestStream('SHA-256');
|
||||
await body.body.pipeTo(digest);
|
||||
return await digest.digest;
|
||||
}
|
||||
|
||||
|
||||
// Prepare to begin uploading from uploadOffset.
|
||||
// Resume any ongoing multipart upload, and fetch stashed temporary object from R2 into mem.
|
||||
//
|
||||
// Return the uploadOffset for the first byte of mem
|
||||
async resumeUpload(r2Key: string, uploadOffset: number, uploadInfo: StoredUploadInfo, mem: WritableStreamBuffer): Promise<number> {
|
||||
if (uploadOffset === 0) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
// Resume any existing multipart upload
|
||||
const partOffset = await this.hydrateParts(r2Key, uploadOffset, uploadInfo);
|
||||
if (partOffset === uploadOffset) {
|
||||
// the uploadOffset the client is starting at picks up exactly at the end
|
||||
// of the last multipart part we uploaded
|
||||
return partOffset;
|
||||
}
|
||||
|
||||
// Otherwise, we should have stashed a temporary object in R2 with whatever was
|
||||
// left-over after the last part we uploaded
|
||||
const tempobj = await this.env.BUCKET.get(this.tempkey());
|
||||
if (tempobj == null) {
|
||||
throw new UnrecoverableError(`we claimed to have ${uploadOffset} bytes, only had ${partOffset}`, r2Key);
|
||||
}
|
||||
if (partOffset + tempobj.size !== uploadOffset) {
|
||||
throw new UnrecoverableError(`we claimed to have ${uploadOffset} bytes, had ${partOffset + tempobj.size}`, r2Key);
|
||||
}
|
||||
|
||||
// Fill mem with the temporary object
|
||||
if (tempobj.size > mem.buf.byteLength) {
|
||||
throw new UnrecoverableError(`bad temp object ${this.tempkey()} of length ${tempobj.size}`, r2Key);
|
||||
}
|
||||
|
||||
// copy into our temp buffer
|
||||
await tempobj.body.pipeTo(new WritableStream({
|
||||
write(chunk) {
|
||||
return mem.write(chunk);
|
||||
}
|
||||
}));
|
||||
|
||||
// return the location in the overall upload where our memory buffer starts
|
||||
return uploadOffset - tempobj.size;
|
||||
}
|
||||
|
||||
// load part infos from durable object storage
|
||||
async hydrateParts(r2Key: string, uploadOffset: number, uploadInfo: StoredUploadInfo): Promise<number> {
|
||||
if (this.multipart != null) {
|
||||
return this.parts
|
||||
.map(p => p.length)
|
||||
.reduce((a, b) => a + b);
|
||||
}
|
||||
|
||||
let partOffset = 0;
|
||||
for (; ;) {
|
||||
const part: StoredR2Part | undefined = await this.state.storage.get((this.parts.length + 1).toString());
|
||||
if (part == null) {
|
||||
break;
|
||||
}
|
||||
partOffset += part.length;
|
||||
if (partOffset > uploadOffset) {
|
||||
// this part is past where we've told the client to start uploading
|
||||
break;
|
||||
}
|
||||
this.parts.push(part);
|
||||
}
|
||||
if (this.parts.length > 0) {
|
||||
if (uploadInfo.multipartUploadId == null) {
|
||||
throw new UnrecoverableError(`had ${this.parts.length} stored parts but no stored multipartUploadId`, r2Key);
|
||||
}
|
||||
this.multipart = this.env.BUCKET.resumeMultipartUpload(r2Key, uploadInfo.multipartUploadId);
|
||||
}
|
||||
return partOffset;
|
||||
}
|
||||
|
||||
async r2CreateMultipartUpload(r2Key: string, uploadInfo: StoredUploadInfo): Promise<R2MultipartUpload> {
|
||||
const customMetadata: Record<string, string> = {};
|
||||
if (uploadInfo.checksum != null) {
|
||||
customMetadata[X_SIGNAL_CHECKSUM_SHA256] = toBase64(uploadInfo.checksum);
|
||||
}
|
||||
const upload = await this.env.BUCKET.createMultipartUpload(r2Key, {customMetadata});
|
||||
uploadInfo.multipartUploadId = upload.uploadId;
|
||||
await this.state.storage.put(UPLOAD_INFO_KEY, uploadInfo);
|
||||
return upload;
|
||||
}
|
||||
|
||||
async r2Put(r2Key: string, bytes: Uint8Array, checksum?: Uint8Array) {
|
||||
try {
|
||||
await this.env.BUCKET.put(r2Key, bytes, {sha256: checksum});
|
||||
} catch (e) {
|
||||
// R2 bindings currently has no structured errors :( . We need to check for expected errors
|
||||
// by searching error messages. These usually contain a numeric error code, but not always
|
||||
if (e != null && e instanceof Object && Object.prototype.hasOwnProperty.call(e, 'message')) {
|
||||
const msg: string = (e as { message: string }).message;
|
||||
|
||||
// "put: The SHA-256 checksum you specified did not match what we received.
|
||||
// You provided a SHA-256 checksum with value: <sha>
|
||||
// Actual SHA-256 was: <sha> (10037)"
|
||||
if (msg.toLowerCase().includes('sha-256') || msg.includes('10037')) {
|
||||
console.error(`checksum failure: ${msg}`);
|
||||
await this.cleanup();
|
||||
throw new StatusError(415, msg);
|
||||
}
|
||||
}
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
|
||||
async r2CompleteMultipartUpload(r2Key: string, actualChecksum?: ArrayBuffer, expectedChecksum?: Uint8Array) {
|
||||
if (this.multipart == null) {
|
||||
throw new UnrecoverableError('cannot call complete multipart with no multipart upload', r2Key);
|
||||
}
|
||||
|
||||
// If we were able to calculate the streaming digest, we can accept or reject now.
|
||||
if (actualChecksum != null && expectedChecksum != null) {
|
||||
await this.checkChecksum(r2Key, expectedChecksum, actualChecksum);
|
||||
}
|
||||
|
||||
await this.multipart.complete(this.parts.map(storedPart => storedPart.part));
|
||||
|
||||
// Otherwise we have to compute the digest from the finished upload
|
||||
if (actualChecksum == null && expectedChecksum != null) {
|
||||
await this.checkChecksum(r2Key, expectedChecksum, await this.retrieveChecksum(r2Key));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
tempkey(): string {
|
||||
return 'temporary/' + this.state.id.toString();
|
||||
}
|
||||
|
||||
// Cleanup the state for this durable object. If r2Key is provided, the method will make
|
||||
// a best-effort attempt to clean any temporary R2 objects that may exist.
|
||||
//
|
||||
// Cleanup should be called when:
|
||||
// 1. The upload is successfully completed
|
||||
// 2. The server experiences an error condition where retrying would be futile. Cleanup ensures a subsequent retry
|
||||
// will hit a 404.
|
||||
// 3. The client has made a mistake uploading that cannot be fixed by retrying with different arguments. e.g.,
|
||||
// an upload with an incorrect checksum.
|
||||
async cleanup(r2Key?: string): Promise<void> {
|
||||
// try our best to clean up R2 state we may have left around, but
|
||||
// if we fail these objects/transactions will eventually expire
|
||||
try {
|
||||
await this.env.BUCKET.delete(this.tempkey());
|
||||
if (r2Key != null) {
|
||||
await this.hydrateParts(
|
||||
r2Key,
|
||||
await this.state.storage.get(UPLOAD_OFFSET_KEY) || 0,
|
||||
await this.state.storage.get(UPLOAD_INFO_KEY) || {});
|
||||
if (this.multipart != null) {
|
||||
await this.multipart.abort();
|
||||
}
|
||||
}
|
||||
} catch (e) {
|
||||
console.log('failed to cleanup R2 state: ' + e);
|
||||
}
|
||||
|
||||
this.multipart = undefined;
|
||||
this.parts = [];
|
||||
await this.state.storage.deleteAll();
|
||||
await this.state.storage.deleteAlarm();
|
||||
}
|
||||
|
||||
// After this time, the upload can no longer be used
|
||||
async expirationTime(): Promise<Date> {
|
||||
const expiration = await this.state.storage.getAlarm();
|
||||
if (expiration == null) {
|
||||
return new Date();
|
||||
}
|
||||
return new Date(expiration);
|
||||
}
|
||||
}
|
||||
|
||||
class UnrecoverableError extends Error {
|
||||
r2Key: string;
|
||||
|
||||
constructor(message: string, r2Key: string) {
|
||||
super(message);
|
||||
this.name = this.constructor.name;
|
||||
this.r2Key = r2Key;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
56
src/util.test.ts
Normal file
56
src/util.test.ts
Normal file
@ -0,0 +1,56 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {describe, expect, it} from 'vitest';
|
||||
import {AsyncLock, Release, WritableStreamBuffer} from './util';
|
||||
|
||||
describe('WritableStreamBuffer', () => {
|
||||
it('copies what fits', async () => {
|
||||
const st = new WritableStreamBuffer(new ArrayBuffer(10));
|
||||
const written = st.writeUpTo(new Uint8Array(new ArrayBuffer(11)));
|
||||
expect(written).toBe(10);
|
||||
expect(st.offset).toBe(10);
|
||||
|
||||
expect(st.writeUpTo(new Uint8Array(new ArrayBuffer(1)))).toBe(0);
|
||||
expect(st.offset).toBe(10);
|
||||
});
|
||||
});
|
||||
|
||||
describe('AsyncLock', () => {
|
||||
it('only lets one through', async () => {
|
||||
const lock = new AsyncLock();
|
||||
const release = await lock.lock();
|
||||
const queued = lock.lock();
|
||||
let done = false;
|
||||
queued.then(() => done = true);
|
||||
|
||||
expect(done).toBeFalsy();
|
||||
release();
|
||||
await queued;
|
||||
expect(done).toBeTruthy();
|
||||
});
|
||||
|
||||
it('can queue waiters', async () => {
|
||||
const lock = new AsyncLock();
|
||||
let release = await lock.lock();
|
||||
|
||||
// queue up 10 requests behind currently executing one
|
||||
const waiters: { promise: Promise<Release>, done: boolean }[] = [];
|
||||
for (let i = 0; i < 10; i++) {
|
||||
const waiter = {
|
||||
promise: lock.lock(),
|
||||
done: false
|
||||
};
|
||||
waiter.promise.then(() => waiter.done = true);
|
||||
waiters.push(waiter);
|
||||
}
|
||||
expect(waiters.every(waiter => !waiter.done)).toBeTruthy();
|
||||
|
||||
// finishing previous request should allow next one to proceed
|
||||
for (let i = 0; i < 10; i++) {
|
||||
release();
|
||||
release = await (waiters[i].promise);
|
||||
expect(waiters.slice(i + 1).every(waiter => !waiter.done)).toBeTruthy();
|
||||
}
|
||||
});
|
||||
});
|
||||
144
src/util.ts
Normal file
144
src/util.ts
Normal file
@ -0,0 +1,144 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {Buffer} from 'node:buffer';
|
||||
import {StatusError} from 'itty-router';
|
||||
|
||||
export function readIntFromHeader(headers: Headers, name: string): number {
|
||||
const headerString = headers.get(name);
|
||||
if (headerString == null) {
|
||||
return NaN;
|
||||
}
|
||||
return parseInt(headerString);
|
||||
}
|
||||
|
||||
export function toBase64(v: Uint8Array | ArrayBuffer): string {
|
||||
if (v instanceof Uint8Array) {
|
||||
return Buffer.from(v.buffer, v.byteOffset, v.byteLength).toString('base64');
|
||||
} else {
|
||||
return Buffer.from(v).toString('base64');
|
||||
}
|
||||
}
|
||||
|
||||
// Parse binary data from a base64 string
|
||||
export function fromBase64(s: string): Uint8Array | undefined {
|
||||
try {
|
||||
return Buffer.from(s, 'base64');
|
||||
} catch (err) {
|
||||
return undefined;
|
||||
}
|
||||
}
|
||||
|
||||
export class WritableStreamBuffer {
|
||||
buf: ArrayBuffer;
|
||||
offset: number;
|
||||
|
||||
constructor(buf: ArrayBuffer) {
|
||||
this.buf = buf;
|
||||
this.offset = 0;
|
||||
}
|
||||
|
||||
write(chunk: Uint8Array) {
|
||||
const remaining = this.buf.byteLength - this.offset;
|
||||
if (chunk.byteLength > remaining) {
|
||||
throw new RangeError('chunk does not fit');
|
||||
}
|
||||
this.writeUpTo(chunk);
|
||||
}
|
||||
|
||||
writeUpTo(chunk: Uint8Array): number {
|
||||
const remaining = this.buf.byteLength - this.offset;
|
||||
const toWrite = Math.min(remaining, chunk.byteLength);
|
||||
new Uint8Array(this.buf, this.offset).set(chunk.subarray(0, toWrite));
|
||||
this.offset += toWrite;
|
||||
return toWrite;
|
||||
}
|
||||
|
||||
view(): Uint8Array {
|
||||
return new Uint8Array(this.buf, 0, this.offset);
|
||||
}
|
||||
|
||||
reset() {
|
||||
this.offset = 0;
|
||||
}
|
||||
}
|
||||
|
||||
export interface IntermediatePart {
|
||||
kind: 'intermediate',
|
||||
bytes: Uint8Array
|
||||
}
|
||||
|
||||
export interface FinalPart {
|
||||
kind: 'final',
|
||||
bytes: Uint8Array
|
||||
}
|
||||
|
||||
export interface ErrorPart {
|
||||
kind: 'error',
|
||||
error: StatusError,
|
||||
bytes: Uint8Array
|
||||
}
|
||||
|
||||
export type Part = IntermediatePart | FinalPart | ErrorPart
|
||||
|
||||
// Take an arbitrary length stream and fill an in-memory buffer, emitting a view of the buffer every time the buffer
|
||||
// is filled. After emitting an item the buffer is reused, so the caller must finish using the buffer before it
|
||||
// continues iterating.
|
||||
//
|
||||
// If an error is encountered reading the stream, the final part generated by the stream will be an error part
|
||||
// containing whatever was read before the error was encountered.
|
||||
export async function* generateParts(body: ReadableStream<Uint8Array>, mem: WritableStreamBuffer): AsyncGenerator<Part> {
|
||||
try {
|
||||
for await (let chunk of body) {
|
||||
|
||||
while (chunk.byteLength > 0) {
|
||||
const copied = mem.writeUpTo(chunk);
|
||||
chunk = chunk.subarray(copied, chunk.byteLength);
|
||||
|
||||
// When we've filled mem, we want to emit a part. But we should only do it if we know
|
||||
// there's more body to write. Otherwise, if the upload size is exactly the part size
|
||||
// we would end up emitting an empty 'final' part which is unnecessary.
|
||||
if (chunk.byteLength > 0 && mem.offset >= mem.buf.byteLength) {
|
||||
// the memory buffer's position is at its total length
|
||||
yield {kind: 'intermediate', bytes: mem.view()};
|
||||
mem.reset();
|
||||
}
|
||||
}
|
||||
}
|
||||
yield {kind: 'final', bytes: mem.view()};
|
||||
} catch (e) {
|
||||
const msg = `error reading request body: ${e}`;
|
||||
console.debug(msg);
|
||||
yield {kind: 'error', bytes: mem.view(), error: new StatusError(400, msg)};
|
||||
}
|
||||
mem.reset();
|
||||
}
|
||||
|
||||
export type Release = () => void;
|
||||
|
||||
export class AsyncLock {
|
||||
p: Promise<void> | null;
|
||||
|
||||
constructor() {
|
||||
this.p = null;
|
||||
}
|
||||
|
||||
// Asynchronously wait for our turn to execute. Returns Release which should be called
|
||||
// when the critical section has completed
|
||||
async lock(): Promise<Release> {
|
||||
// If there is no active promise we can acquire the lock. We loop since
|
||||
// someone else may grab the lock before us, in that case we go back
|
||||
// to waiting
|
||||
while (this.p != null) {
|
||||
await this.p;
|
||||
}
|
||||
let resolver: (value: (void | PromiseLike<void>)) => void;
|
||||
this.p = new Promise(resolve => {
|
||||
resolver = resolve;
|
||||
});
|
||||
return () => {
|
||||
this.p = null;
|
||||
resolver();
|
||||
};
|
||||
}
|
||||
}
|
||||
106
tsconfig.json
Normal file
106
tsconfig.json
Normal file
@ -0,0 +1,106 @@
|
||||
{
|
||||
"compilerOptions": {
|
||||
/* Visit https://aka.ms/tsconfig.json to read more about this file */
|
||||
|
||||
/* Projects */
|
||||
// "incremental": true, /* Enable incremental compilation */
|
||||
// "composite": true, /* Enable constraints that allow a TypeScript project to be used with project references. */
|
||||
// "tsBuildInfoFile": "./", /* Specify the folder for .tsbuildinfo incremental compilation files. */
|
||||
// "disableSourceOfProjectReferenceRedirect": true, /* Disable preferring source files instead of declaration files when referencing composite projects */
|
||||
// "disableSolutionSearching": true, /* Opt a project out of multi-project reference checking when editing. */
|
||||
// "disableReferencedProjectLoad": true, /* Reduce the number of projects loaded automatically by TypeScript. */
|
||||
|
||||
/* Language and Environment */
|
||||
"target": "es2021" /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */,
|
||||
"lib": [
|
||||
"es2021"
|
||||
] /* Specify a set of bundled library declaration files that describe the target runtime environment. */,
|
||||
"jsx": "react" /* Specify what JSX code is generated. */,
|
||||
// "experimentalDecorators": true, /* Enable experimental support for TC39 stage 2 draft decorators. */
|
||||
// "emitDecoratorMetadata": true, /* Emit design-type metadata for decorated declarations in source files. */
|
||||
// "jsxFactory": "", /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h' */
|
||||
// "jsxFragmentFactory": "", /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
|
||||
// "jsxImportSource": "", /* Specify module specifier used to import the JSX factory functions when using `jsx: react-jsx*`.` */
|
||||
// "reactNamespace": "", /* Specify the object invoked for `createElement`. This only applies when targeting `react` JSX emit. */
|
||||
// "noLib": true, /* Disable including any library files, including the default lib.d.ts. */
|
||||
// "useDefineForClassFields": true, /* Emit ECMAScript-standard-compliant class fields. */
|
||||
|
||||
/* Modules */
|
||||
"module": "es2022" /* Specify what module code is generated. */,
|
||||
// "rootDir": "./", /* Specify the root folder within your source files. */
|
||||
"moduleResolution": "node" /* Specify how TypeScript looks up a file from a given module specifier. */,
|
||||
// "baseUrl": "./", /* Specify the base directory to resolve non-relative module names. */
|
||||
// "paths": {}, /* Specify a set of entries that re-map imports to additional lookup locations. */
|
||||
// "rootDirs": [], /* Allow multiple folders to be treated as one when resolving modules. */
|
||||
// "typeRoots": [], /* Specify multiple folders that act like `./node_modules/@types`. */
|
||||
"types": [
|
||||
"@cloudflare/workers-types",
|
||||
"vitest-environment-miniflare/globals"
|
||||
] /* Specify type package names to be included without being referenced in a source file. */,
|
||||
// "allowUmdGlobalAccess": true, /* Allow accessing UMD globals from modules. */
|
||||
"resolveJsonModule": true /* Enable importing .json files */,
|
||||
// "noResolve": true, /* Disallow `import`s, `require`s or `<reference>`s from expanding the number of files TypeScript should add to a project. */
|
||||
|
||||
/* JavaScript Support */
|
||||
"allowJs": true /* Allow JavaScript files to be a part of your program. Use the `checkJS` option to get errors from these files. */,
|
||||
"checkJs": false /* Enable error reporting in type-checked JavaScript files. */,
|
||||
// "maxNodeModuleJsDepth": 1, /* Specify the maximum folder depth used for checking JavaScript files from `node_modules`. Only applicable with `allowJs`. */
|
||||
|
||||
/* Emit */
|
||||
// "declaration": true, /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
|
||||
// "declarationMap": true, /* Create sourcemaps for d.ts files. */
|
||||
// "emitDeclarationOnly": true, /* Only output d.ts files and not JavaScript files. */
|
||||
// "sourceMap": true, /* Create source map files for emitted JavaScript files. */
|
||||
// "outFile": "./", /* Specify a file that bundles all outputs into one JavaScript file. If `declaration` is true, also designates a file that bundles all .d.ts output. */
|
||||
// "outDir": "./", /* Specify an output folder for all emitted files. */
|
||||
// "removeComments": true, /* Disable emitting comments. */
|
||||
"noEmit": true /* Disable emitting files from a compilation. */,
|
||||
// "importHelpers": true, /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
|
||||
// "importsNotUsedAsValues": "remove", /* Specify emit/checking behavior for imports that are only used for types */
|
||||
// "downlevelIteration": true, /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
|
||||
// "sourceRoot": "", /* Specify the root path for debuggers to find the reference source code. */
|
||||
// "mapRoot": "", /* Specify the location where debugger should locate map files instead of generated locations. */
|
||||
// "inlineSourceMap": true, /* Include sourcemap files inside the emitted JavaScript. */
|
||||
// "inlineSources": true, /* Include source code in the sourcemaps inside the emitted JavaScript. */
|
||||
// "emitBOM": true, /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
|
||||
// "newLine": "crlf", /* Set the newline character for emitting files. */
|
||||
// "stripInternal": true, /* Disable emitting declarations that have `@internal` in their JSDoc comments. */
|
||||
// "noEmitHelpers": true, /* Disable generating custom helper functions like `__extends` in compiled output. */
|
||||
// "noEmitOnError": true, /* Disable emitting files if any type checking errors are reported. */
|
||||
// "preserveConstEnums": true, /* Disable erasing `const enum` declarations in generated code. */
|
||||
// "declarationDir": "./", /* Specify the output directory for generated declaration files. */
|
||||
// "preserveValueImports": true, /* Preserve unused imported values in the JavaScript output that would otherwise be removed. */
|
||||
|
||||
/* Interop Constraints */
|
||||
"isolatedModules": true /* Ensure that each file can be safely transpiled without relying on other imports. */,
|
||||
"allowSyntheticDefaultImports": true /* Allow 'import x from y' when a module doesn't have a default export. */,
|
||||
// "esModuleInterop": true /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables `allowSyntheticDefaultImports` for type compatibility. */,
|
||||
// "preserveSymlinks": true, /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
|
||||
"forceConsistentCasingInFileNames": true /* Ensure that casing is correct in imports. */,
|
||||
|
||||
/* Type Checking */
|
||||
"strict": true /* Enable all strict type-checking options. */,
|
||||
// "noImplicitAny": true, /* Enable error reporting for expressions and declarations with an implied `any` type.. */
|
||||
// "strictNullChecks": true, /* When type checking, take into account `null` and `undefined`. */
|
||||
// "strictFunctionTypes": true, /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
|
||||
// "strictBindCallApply": true, /* Check that the arguments for `bind`, `call`, and `apply` methods match the original function. */
|
||||
// "strictPropertyInitialization": true, /* Check for class properties that are declared but not set in the constructor. */
|
||||
// "noImplicitThis": true, /* Enable error reporting when `this` is given the type `any`. */
|
||||
// "useUnknownInCatchVariables": true, /* Type catch clause variables as 'unknown' instead of 'any'. */
|
||||
// "alwaysStrict": true, /* Ensure 'use strict' is always emitted. */
|
||||
// "noUnusedLocals": true, /* Enable error reporting when a local variables aren't read. */
|
||||
// "noUnusedParameters": true, /* Raise an error when a function parameter isn't read */
|
||||
// "exactOptionalPropertyTypes": true, /* Interpret optional property types as written, rather than adding 'undefined'. */
|
||||
// "noImplicitReturns": true, /* Enable error reporting for codepaths that do not explicitly return in a function. */
|
||||
// "noFallthroughCasesInSwitch": true, /* Enable error reporting for fallthrough cases in switch statements. */
|
||||
// "noUncheckedIndexedAccess": true, /* Include 'undefined' in index signature results */
|
||||
// "noImplicitOverride": true, /* Ensure overriding members in derived classes are marked with an override modifier. */
|
||||
// "noPropertyAccessFromIndexSignature": true, /* Enforces using indexed accessors for keys declared using an indexed type */
|
||||
// "allowUnusedLabels": true, /* Disable error reporting for unused labels. */
|
||||
// "allowUnreachableCode": true, /* Disable error reporting for unreachable code. */
|
||||
|
||||
/* Completeness */
|
||||
// "skipDefaultLibCheck": true, /* Skip type checking .d.ts files that are included with TypeScript. */
|
||||
"skipLibCheck": true /* Skip type checking all .d.ts files. */
|
||||
}
|
||||
}
|
||||
17
vitest.config.ts
Normal file
17
vitest.config.ts
Normal file
@ -0,0 +1,17 @@
|
||||
// Copyright 2023 Signal Messenger, LLC
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
import {defineConfig} from 'vitest/config';
|
||||
|
||||
export default defineConfig({
|
||||
test: {
|
||||
environment: 'miniflare',
|
||||
environmentOptions: {
|
||||
modules: true,
|
||||
scriptPath: './dist/index.js',
|
||||
durableObjects: {
|
||||
UPLOAD_HANDLER: 'UploadHandler',
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
31
wrangler.toml
Normal file
31
wrangler.toml
Normal file
@ -0,0 +1,31 @@
|
||||
name = "cdn3-dev"
|
||||
main = "src/index.ts"
|
||||
compatibility_date = "2023-05-10"
|
||||
compatibility_flags = [ "nodejs_compat" ]
|
||||
logpush = true
|
||||
|
||||
# Specifies the r2 buckets. r2 bucket names are scoped to your account (not global). The buckets should be publicly inaccessible.
|
||||
r2_buckets = [{ binding = "BUCKET", bucket_name = "attachments-staging", preview_bucket_name = "attachments-staging" }]
|
||||
|
||||
# The path prefix for uploads/downloads, ex. localhost/upload/<PATH_PREFIX>/<object-id>
|
||||
vars.PATH_PREFIX = "attachments"
|
||||
durable_objects.bindings = [{name = "UPLOAD_HANDLER", class_name = "UploadHandler"}]
|
||||
|
||||
[[migrations]]
|
||||
tag = "v1"
|
||||
new_classes = ["UploadHandler"]
|
||||
|
||||
[env.production]
|
||||
name = "cdn3"
|
||||
durable_objects.bindings = [{name = "UPLOAD_HANDLER", class_name = "UploadHandler"}]
|
||||
r2_buckets = [{ binding = "BUCKET", bucket_name = "attachments", preview_bucket_name = "attachments" }]
|
||||
vars.PATH_PREFIX = "attachments"
|
||||
|
||||
[env.staging]
|
||||
name = "cdn3-staging"
|
||||
durable_objects.bindings = [{name = "UPLOAD_HANDLER", class_name = "UploadHandler"}]
|
||||
r2_buckets = [{ binding = "BUCKET", bucket_name = "attachments-staging", preview_bucket_name = "attachments-staging" }]
|
||||
vars.PATH_PREFIX = "attachments"
|
||||
|
||||
# To set an auth secret,
|
||||
# wrangler secrets put SHARED_AUTH_SECRET
|
||||
Loading…
Reference in New Issue
Block a user