212 lines
11 KiB
TypeScript
212 lines
11 KiB
TypeScript
import type { FastifyPluginAsync } from 'fastify'
|
|
import multipart from '@fastify/multipart'
|
|
import { PaginationSchema } from '@lunarfront/shared/schemas'
|
|
import { StorageFolderService, StorageFileService, StoragePermissionService } from '../../services/storage.service.js'
|
|
import { ValidationError } from '../../lib/errors.js'
|
|
|
|
export const storageRoutes: FastifyPluginAsync = async (app) => {
|
|
await app.register(multipart, {
|
|
limits: { fileSize: 50 * 1024 * 1024, files: 1 },
|
|
})
|
|
|
|
// --- Folders ---
|
|
|
|
app.post('/storage/folders', { preHandler: [app.authenticate, app.requirePermission('files.upload')] }, async (request, reply) => {
|
|
const { name, parentId, isPublic } = request.body as { name?: string; parentId?: string; isPublic?: boolean }
|
|
if (!name?.trim()) throw new ValidationError('Folder name is required')
|
|
|
|
// Check parent access if creating subfolder — require at least edit (not traverse or view)
|
|
if (parentId) {
|
|
const hasEdit = await StoragePermissionService.hasAccess(app.db, parentId, request.user.id, 'edit')
|
|
if (!hasEdit) {
|
|
return reply.status(403).send({ error: { message: 'No edit access to parent folder', statusCode: 403 } })
|
|
}
|
|
}
|
|
|
|
const folder = await StorageFolderService.create(app.db, { name: name.trim(), parentId, isPublic, createdBy: request.user.id })
|
|
return reply.status(201).send(folder)
|
|
})
|
|
|
|
app.get('/storage/folders', { preHandler: [app.authenticate, app.requirePermission('files.view')] }, async (request, reply) => {
|
|
const { parentId } = request.query as { parentId?: string }
|
|
const allChildren = parentId
|
|
? await StorageFolderService.listChildren(app.db, parentId)
|
|
: await StorageFolderService.listChildren(app.db, null)
|
|
// Filter to only folders the user can access (at least traverse)
|
|
const accessible = []
|
|
for (const folder of allChildren) {
|
|
const level = await StoragePermissionService.getAccessLevel(app.db, folder.id, request.user.id)
|
|
if (level) accessible.push(folder)
|
|
}
|
|
return reply.send({ data: accessible })
|
|
})
|
|
|
|
app.get('/storage/folders/tree', { preHandler: [app.authenticate, app.requirePermission('files.view')] }, async (request, reply) => {
|
|
const folders = await StorageFolderService.listAllAccessible(app.db, request.user.id)
|
|
return reply.send({ data: folders })
|
|
})
|
|
|
|
app.get('/storage/folders/:id', { preHandler: [app.authenticate, app.requirePermission('files.view')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
const folder = await StorageFolderService.getById(app.db, id)
|
|
if (!folder) return reply.status(404).send({ error: { message: 'Folder not found', statusCode: 404 } })
|
|
|
|
const accessLevel = await StoragePermissionService.getAccessLevel(app.db, id, request.user.id)
|
|
if (!accessLevel) return reply.status(403).send({ error: { message: 'Access denied', statusCode: 403 } })
|
|
|
|
const breadcrumbs = await StorageFolderService.getBreadcrumbs(app.db, id)
|
|
return reply.send({ ...folder, breadcrumbs, accessLevel })
|
|
})
|
|
|
|
app.patch('/storage/folders/:id', { preHandler: [app.authenticate, app.requirePermission('files.upload')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
const { name, isPublic } = request.body as { name?: string; isPublic?: boolean }
|
|
|
|
const hasEdit = await StoragePermissionService.hasAccess(app.db, id, request.user.id, 'edit')
|
|
if (!hasEdit) {
|
|
return reply.status(403).send({ error: { message: 'No edit access', statusCode: 403 } })
|
|
}
|
|
|
|
const folder = await StorageFolderService.update(app.db, id, { name, isPublic })
|
|
if (!folder) return reply.status(404).send({ error: { message: 'Folder not found', statusCode: 404 } })
|
|
return reply.send(folder)
|
|
})
|
|
|
|
app.delete('/storage/folders/:id', { preHandler: [app.authenticate, app.requirePermission('files.delete')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
|
|
const accessLevel = await StoragePermissionService.getAccessLevel(app.db, id, request.user.id)
|
|
if (accessLevel !== 'admin') {
|
|
return reply.status(403).send({ error: { message: 'Admin access required', statusCode: 403 } })
|
|
}
|
|
|
|
const folder = await StorageFolderService.delete(app.db, id)
|
|
if (!folder) return reply.status(404).send({ error: { message: 'Folder not found', statusCode: 404 } })
|
|
return reply.send(folder)
|
|
})
|
|
|
|
// --- Folder Permissions ---
|
|
|
|
app.get('/storage/folders/:id/permissions', { preHandler: [app.authenticate, app.requirePermission('files.view')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
// Only folder admins can view permission details
|
|
const hasAdmin = await StoragePermissionService.hasAccess(app.db, id, request.user.id, 'admin')
|
|
if (!hasAdmin) return reply.status(403).send({ error: { message: 'Admin access required', statusCode: 403 } })
|
|
const permissions = await StoragePermissionService.listPermissions(app.db, id)
|
|
return reply.send({ data: permissions })
|
|
})
|
|
|
|
app.post('/storage/folders/:id/permissions', { preHandler: [app.authenticate, app.requirePermission('files.upload')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
const { roleId, userId, accessLevel } = request.body as { roleId?: string; userId?: string; accessLevel?: string }
|
|
|
|
const myAccess = await StoragePermissionService.getAccessLevel(app.db, id, request.user.id)
|
|
if (myAccess !== 'admin') {
|
|
return reply.status(403).send({ error: { message: 'Admin access required to manage permissions', statusCode: 403 } })
|
|
}
|
|
|
|
if (!roleId && !userId) throw new ValidationError('Either roleId or userId is required')
|
|
if (!accessLevel || !['traverse', 'view', 'edit', 'admin'].includes(accessLevel)) throw new ValidationError('accessLevel must be traverse, view, edit, or admin')
|
|
|
|
const perm = await StoragePermissionService.setPermission(app.db, id, roleId, userId, accessLevel)
|
|
return reply.status(201).send(perm)
|
|
})
|
|
|
|
app.delete('/storage/folder-permissions/:id', { preHandler: [app.authenticate, app.requirePermission('files.delete')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
// Look up the permission to find which folder it belongs to
|
|
// listPermissions takes folderId, we need to find by perm id — use removePermission which fetches first
|
|
const perm = await StoragePermissionService.getPermissionById(app.db, id)
|
|
if (!perm) return reply.status(404).send({ error: { message: 'Permission not found', statusCode: 404 } })
|
|
|
|
// Verify admin access on the folder this permission belongs to
|
|
const hasAdmin = await StoragePermissionService.hasAccess(app.db, perm.folderId, request.user.id, 'admin')
|
|
if (!hasAdmin) return reply.status(403).send({ error: { message: 'Admin access required', statusCode: 403 } })
|
|
|
|
const deleted = await StoragePermissionService.removePermission(app.db, id)
|
|
return reply.send(deleted)
|
|
})
|
|
|
|
// --- Files ---
|
|
|
|
app.post('/storage/folders/:folderId/files', { preHandler: [app.authenticate, app.requirePermission('files.upload')] }, async (request, reply) => {
|
|
const { folderId } = request.params as { folderId: string }
|
|
|
|
const hasEdit = await StoragePermissionService.hasAccess(app.db, folderId, request.user.id, 'edit')
|
|
if (!hasEdit) {
|
|
return reply.status(403).send({ error: { message: 'No edit access to this folder', statusCode: 403 } })
|
|
}
|
|
|
|
const data = await request.file()
|
|
if (!data) throw new ValidationError('No file provided')
|
|
|
|
const buffer = await data.toBuffer()
|
|
|
|
const file = await StorageFileService.upload(app.db, app.storage, {
|
|
folderId,
|
|
data: buffer,
|
|
filename: data.filename,
|
|
contentType: data.mimetype,
|
|
uploadedBy: request.user.id,
|
|
})
|
|
|
|
return reply.status(201).send(file)
|
|
})
|
|
|
|
app.get('/storage/folders/:folderId/files', { preHandler: [app.authenticate, app.requirePermission('files.view')] }, async (request, reply) => {
|
|
const { folderId } = request.params as { folderId: string }
|
|
|
|
// traverse only allows navigating folders, not viewing files
|
|
const accessLevel = await StoragePermissionService.getAccessLevel(app.db, folderId, request.user.id)
|
|
if (!accessLevel || accessLevel === 'traverse') return reply.status(403).send({ error: { message: 'Access denied', statusCode: 403 } })
|
|
|
|
const params = PaginationSchema.parse(request.query)
|
|
const result = await StorageFileService.listByFolder(app.db, folderId, params)
|
|
return reply.send(result)
|
|
})
|
|
|
|
app.delete('/storage/files/:id', { preHandler: [app.authenticate, app.requirePermission('files.delete')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
const file = await StorageFileService.getById(app.db, id)
|
|
if (!file) return reply.status(404).send({ error: { message: 'File not found', statusCode: 404 } })
|
|
|
|
const hasEdit = await StoragePermissionService.hasAccess(app.db, file.folderId, request.user.id, 'edit')
|
|
if (!hasEdit) {
|
|
return reply.status(403).send({ error: { message: 'No edit access', statusCode: 403 } })
|
|
}
|
|
|
|
const deleted = await StorageFileService.delete(app.db, app.storage, id)
|
|
return reply.send(deleted)
|
|
})
|
|
|
|
app.get('/storage/files/:id/signed-url', { preHandler: [app.authenticate, app.requirePermission('files.view')] }, async (request, reply) => {
|
|
const { id } = request.params as { id: string }
|
|
const file = await StorageFileService.getById(app.db, id)
|
|
if (!file) return reply.status(404).send({ error: { message: 'File not found', statusCode: 404 } })
|
|
|
|
const hasView = await StoragePermissionService.hasAccess(app.db, file.folderId, request.user.id, 'view')
|
|
if (!hasView) return reply.status(403).send({ error: { message: 'Access denied', statusCode: 403 } })
|
|
|
|
const token = app.jwt.sign({ path: file.path, purpose: 'file-access' } as any, { expiresIn: '15m' })
|
|
const signedUrl = `/v1/files/s/${file.path}?token=${token}`
|
|
return reply.send({ url: signedUrl })
|
|
})
|
|
|
|
app.get('/storage/files/search', { preHandler: [app.authenticate, app.requirePermission('files.view')] }, async (request, reply) => {
|
|
const { q } = request.query as { q?: string }
|
|
if (!q) return reply.send({ data: [], pagination: { page: 1, limit: 25, total: 0, totalPages: 0 } })
|
|
|
|
const params = PaginationSchema.parse(request.query)
|
|
const result = await StorageFileService.search(app.db, q, params)
|
|
|
|
// Filter results to only files the user has at least view access to
|
|
const filtered = []
|
|
for (const file of result.data) {
|
|
const hasView = await StoragePermissionService.hasAccess(app.db, (file as any).folderId, request.user.id, 'view')
|
|
if (hasView) filtered.push(file)
|
|
}
|
|
|
|
return reply.send({ data: filtered, pagination: { ...result.pagination, total: filtered.length } })
|
|
})
|
|
}
|