Arnaud
12c2ec213a
Support form now accepts up to 5 attachments (images, PDF, text, JSON, zip; 10MB each) via the existing S3/MinIO presigned-upload flow. New support_ticket_attachments table; attachment links get folded into the Gitea issue body and shown as thumbnails in both the user's ticket history and the admin support view. New presign endpoint (/api/v1/support/attachments/presign, rate-limited 20/hr) scoped to the uploading user rather than a ticket id, since the ticket doesn't exist yet at upload time. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
96 lines
3.9 KiB
TypeScript
96 lines
3.9 KiB
TypeScript
import { S3Client, DeleteObjectCommand } from "@aws-sdk/client-s3";
|
|
import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
|
|
|
|
const bucket = process.env["STORAGE_BUCKET"] || "epicure-uploads";
|
|
const endpoint = process.env["STORAGE_ENDPOINT"] || "http://localhost:9000";
|
|
const publicUrl = process.env["STORAGE_PUBLIC_URL"] || "http://localhost:9000";
|
|
// getPublicUrl() below runs in the browser too — non-NEXT_PUBLIC_ vars are never
|
|
// inlined into the client bundle, so it needs its own NEXT_PUBLIC_ copy of the value.
|
|
const clientPublicUrl = process.env.NEXT_PUBLIC_STORAGE_PUBLIC_URL || "http://localhost:9000";
|
|
|
|
const credentials = {
|
|
accessKeyId: process.env["STORAGE_ACCESS_KEY"] ?? "minioadmin",
|
|
secretAccessKey: process.env["STORAGE_SECRET_KEY"] ?? "minioadmin",
|
|
};
|
|
|
|
const s3 = new S3Client({
|
|
region: process.env["STORAGE_REGION"] ?? "us-east-1",
|
|
endpoint,
|
|
forcePathStyle: true,
|
|
credentials,
|
|
});
|
|
|
|
// Presigned URLs are PUT/GET directly by the browser, so they must be signed
|
|
// against an endpoint the browser can actually resolve — not the internal
|
|
// docker hostname `s3` (and `endpoint`) use for server-to-server calls. Signing
|
|
// is pure crypto (no network call), so a second client pointed at the public
|
|
// URL is safe even though it's never used to make a real request itself.
|
|
const presignS3 = new S3Client({
|
|
region: process.env["STORAGE_REGION"] ?? "us-east-1",
|
|
endpoint: publicUrl,
|
|
forcePathStyle: true,
|
|
credentials,
|
|
});
|
|
|
|
/**
|
|
* A presigned PUT URL only signs Bucket/Key/ContentType — nothing binds the
|
|
* actual request body size to what the caller declared when it asked for the
|
|
* URL (and was charged storage-tier quota for), so a client could declare
|
|
* 1 byte and then PUT an arbitrarily large object. S3/MinIO's POST-policy
|
|
* upload flow is the fix: `content-length-range` is a *signed* condition,
|
|
* enforced by the storage server itself when it receives the upload — a
|
|
* mismatched Content-Length is rejected before the bytes are ever accepted,
|
|
* not just checked against something the client also controls.
|
|
*/
|
|
export async function createPresignedUploadPost(
|
|
key: string,
|
|
contentType: string,
|
|
maxBytes: number
|
|
): Promise<{ url: string; fields: Record<string, string> }> {
|
|
return createPresignedPost(presignS3, {
|
|
Bucket: bucket,
|
|
Key: key,
|
|
Conditions: [
|
|
["content-length-range", 0, maxBytes],
|
|
{ "Content-Type": contentType },
|
|
],
|
|
Fields: { "Content-Type": contentType },
|
|
Expires: 300,
|
|
});
|
|
}
|
|
|
|
export async function deleteObject(key: string): Promise<void> {
|
|
await s3.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
|
|
}
|
|
|
|
export function getPublicUrl(key: string): string {
|
|
return `${clientPublicUrl}/${bucket}/${key}`;
|
|
}
|
|
|
|
/**
|
|
* A recipe/review photo's storage key is only trustworthy if it matches the
|
|
* exact prefix issued by /api/v1/upload/presign for this recipe + user +
|
|
* purpose — otherwise a client could submit another user's key (discoverable
|
|
* from a public recipe's rendered <Image> src, or a review's photoKey in API
|
|
* responses) and have it adopted, then later evicted, triggering
|
|
* deleteObject() against an object it never owned.
|
|
*/
|
|
export function isOwnedRecipePhotoKey(key: string, recipeId: string, userId: string): boolean {
|
|
return key.startsWith(`recipes/${recipeId}/photos/${userId}-`);
|
|
}
|
|
|
|
export function isOwnedReviewPhotoKey(key: string, recipeId: string, userId: string): boolean {
|
|
return key.startsWith(`recipes/${recipeId}/reviews/${userId}-`);
|
|
}
|
|
|
|
/** Same rationale as isOwnedRecipePhotoKey, for the avatar-presign key prefix. */
|
|
export function isOwnedAvatarKey(key: string, userId: string): boolean {
|
|
return key.startsWith(`user-avatars/${userId}/`);
|
|
}
|
|
|
|
/** Same rationale as isOwnedRecipePhotoKey — a support ticket doesn't exist yet
|
|
* at upload time, so ownership is scoped to the uploading user, not a ticket id. */
|
|
export function isOwnedSupportAttachmentKey(key: string, userId: string): boolean {
|
|
return key.startsWith(`support/${userId}/`);
|
|
}
|