VYBECODEDDDDDDDDD

src/routes/delete.ts

@@ -0,0 +1,23 @@
+import { json, notFound } from "../http";
+import { log } from "../log";
+import { ID_PATTERN, KEY_PATTERN, secretMatches } from "../security";
+import type { Storage } from "../storage";
+
+export async function handleDelete(
+  req: Request,
+  storage: Storage,
+  rawId: string,
+): Promise<Response> {
+  if (!ID_PATTERN.test(rawId)) return notFound();
+
+  const meta = await storage.readMetadata(rawId);
+  if (!meta) return notFound();
+
+  const key = req.headers.get("x-delete-key");
+  if (!key || !KEY_PATTERN.test(key)) return notFound();
+  if (!secretMatches(meta.downloadKeyHash, key)) return notFound();
+
+  await storage.delete(rawId);
+  log("info", `deleted id=${rawId} name=${JSON.stringify(meta.originalName)}`);
+  return json({ ok: true });
+}

src/routes/download.ts

@@ -0,0 +1,42 @@
+import { lstat } from "node:fs/promises";
+import { notFound } from "../http";
+import { log } from "../log";
+import { contentDisposition, fileIdFromKey, KEY_PATTERN, secretMatches } from "../security";
+import type { Storage } from "../storage";
+
+export async function handleDownload(
+  req: Request,
+  storage: Storage,
+  rawKey: string,
+): Promise<Response> {
+  if (!KEY_PATTERN.test(rawKey)) return notFound();
+  const id = fileIdFromKey(rawKey);
+  if (!id) return notFound();
+
+  const meta = await storage.readMetadata(id);
+  if (!meta) return notFound();
+  if (!secretMatches(meta.downloadKeyHash, rawKey)) return notFound();
+
+  const filePath = storage.filePath(id);
+  let fileStat;
+  try {
+    fileStat = await lstat(filePath);
+  } catch {
+    return notFound();
+  }
+  if (!fileStat.isFile()) return notFound();
+
+  const headers = new Headers({
+    "content-type": meta.mimeType || "application/octet-stream",
+    "content-length": String(fileStat.size),
+    "content-disposition": contentDisposition(meta.originalName),
+    "cache-control": "private, no-store",
+    "x-content-type-options": "nosniff",
+    "referrer-policy": "no-referrer",
+  });
+
+  if (req.method === "HEAD") return new Response(null, { status: 200, headers });
+
+  log("info", `download id=${id} size=${fileStat.size}`);
+  return new Response(Bun.file(filePath).stream(), { status: 200, headers });
+}

src/routes/upload.ts

@@ -0,0 +1,66 @@
+import { json, jsonError } from "../http";
+import { log } from "../log";
+import { getBoundary, MultipartError, multipartParts } from "../multipart";
+import { hashSecret, newDownloadKey, newFileId, sanitizeMime, sanitizeOriginalName } from "../security";
+import { UploadTooLargeError, type Storage } from "../storage";
+
+export async function handleUpload(
+  req: Request,
+  storage: Storage,
+  maxFileSize: number,
+): Promise<Response> {
+  const contentType = req.headers.get("content-type");
+  const boundary = contentType ? getBoundary(contentType) : null;
+  if (!boundary || !req.body) return jsonError(400, "expected a multipart/form-data upload");
+
+  const id = newFileId();
+  const key = id + newDownloadKey();
+
+  try {
+    let filename = "";
+    let mime = "application/octet-stream";
+    let size = 0;
+    let hasFile = false;
+
+    for await (const part of multipartParts(req.body, boundary)) {
+      if (!hasFile) {
+        hasFile = true;
+        filename = part.filename;
+        mime = sanitizeMime(part.contentType);
+        size = await storage.saveFile(id, part.chunks, maxFileSize);
+        break;
+      }
+      for await (const _ of part.chunks) {
+        void _;
+      }
+    }
+
+    if (!hasFile) return jsonError(400, "no file part in the upload");
+
+    const originalName = sanitizeOriginalName(filename);
+    await storage.writeMetadata({
+      id,
+      originalName,
+      size,
+      mimeType: mime,
+      downloadKeyHash: hashSecret(key),
+      createdAt: new Date().toISOString(),
+    });
+
+    log("info", `upload ok id=${id} size=${size} name=${JSON.stringify(originalName)}`);
+    return json({ id, key, url: `/d/${key}`, originalName, size });
+  } catch (err) {
+    await storage.delete(id);
+    await storage.deletePartial(id);
+    if (err instanceof UploadTooLargeError) {
+      log("warn", `upload rejected id=${id} exceeding max size ${maxFileSize}`);
+      return jsonError(413, "file too large");
+    }
+    if (err instanceof MultipartError) {
+      log("warn", `upload rejected id=${id}: ${err.message}`);
+      return jsonError(400, "invalid multipart body");
+    }
+    log("error", `upload failed id=${id}: ${err instanceof Error ? err.message : String(err)}`);
+    return jsonError(500, "upload failed");
+  }
+}