🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
Sign In

@isoftdata/file-service

Package Overview
Dependencies
Maintainers
10
Versions
30
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@isoftdata/file-service - npm Package Compare versions

Comparing version
6.1.0
 to
7.0.0
+25
dist/utilities/verifier-selector.d.ts
/**
* A verifier-selector string is a concatenation of two things:
* 1. verifier: a string of n length to qualify the resource
* 2. selector: a number to indicate where the resource is located (typically a table row id)
*
* Example usage: for a file server, we want to allow unauthenticated GET request to get files. But, if the file url
* path is predictable (using row id or even file name), a bad actor could brute force download all of a company's
* files. Using a verifier string (for files we use the md5 checksum), a requester must first know an unpredictable
* string before hand for the request to be verified.
*
* THIS IS NOT SECURITY. What VerifierSelector gets us is a level of obfuscation that prevents brute downloaders.
*/
export declare const VerifierSelector: {
/**
* This method will parse a verifier-selector string into it's constituent parts.
* If invalid, the function will return null.
* @param verifierSelector
* @param verifierLength
*/
parse: (verifierSelector: string, verifierLength?: number) => {
verifier: string;
selector: number;
} | null;
};
export default VerifierSelector;
+32
dist/utilities/verifier-selector.js
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.VerifierSelector = void 0;
/**
* A verifier-selector string is a concatenation of two things:
* 1. verifier: a string of n length to qualify the resource
* 2. selector: a number to indicate where the resource is located (typically a table row id)
*
* Example usage: for a file server, we want to allow unauthenticated GET request to get files. But, if the file url
* path is predictable (using row id or even file name), a bad actor could brute force download all of a company's
* files. Using a verifier string (for files we use the md5 checksum), a requester must first know an unpredictable
* string before hand for the request to be verified.
*
* THIS IS NOT SECURITY. What VerifierSelector gets us is a level of obfuscation that prevents brute downloaders.
*/
exports.VerifierSelector = {
/**
* This method will parse a verifier-selector string into it's constituent parts.
* If invalid, the function will return null.
* @param verifierSelector
* @param verifierLength
*/
parse: (verifierSelector, verifierLength = 32) => {
const verifier = verifierSelector.slice(0, verifierLength).toLowerCase();
const selector = parseInt(verifierSelector.slice(verifierLength), 10);
if ((verifier.length !== verifierLength) || isNaN(selector)) {
return null;
}
return { verifier, selector };
},
};
exports.default = exports.VerifierSelector;
+2
-2
dist/entry/main.js

@@ -12,3 +12,3 @@ import { transformImage } from '../utilities/transform-image.js';

export async function registerFileServiceRoute({ webServer, connection: givenConnection, routePrefix = '/**', sharpOptions, }) {
// eslint-disable-next-line @typescript-eslint/no-explicit-any
// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-misused-promises
webServer.post('/upload', async (req, res) => {

@@ -51,3 +51,3 @@ debug('Starting response...');

// Register the route on the web server
// eslint-disable-next-line @typescript-eslint/no-explicit-any
// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-misused-promises
webServer.get(`:paramRoutePrefix(${routePrefix})/:path/:rest(*)`, async (req, res) => {

@@ -54,0 +54,0 @@ debug('Starting response...');

+3
-4
package.json
{
"name": "@isoftdata/file-service",
"version": "6.1.0",
"version": "7.0.0",
"description": "A generic files service for any ISoft platform.",

@@ -8,3 +8,3 @@ "type": "module",

"engines": {
"node": ">=16.0.0"
"node": ">=20.6.0"
},

@@ -16,3 +16,3 @@ "files": [

"build": "tsc && echo ok || echo not ok",
"start": "node -r dotenv/config dist/entry/server.js",
"start": "node --env-file-if-exists=.env dist/entry/server.js",
"build-start": "npm run build && npm run start",

@@ -44,3 +44,2 @@ "test": "echo \"Error: no test specified\" && exit 1",

"debug": "^4.4.3",
"dotenv": "^17.2.3",
"express": "^4.22.1",

@@ -47,0 +46,0 @@ "express-fileupload": "^1.5.2",

+42
-21
README.md

@@ -12,2 +12,3 @@ # Project Background

> This project is designed with two use cases in mind:
>
> 1. [For use in a project with an existing web server and database connection/pool](#foruseinaprojectwithanexistingwebserver)

@@ -27,2 +28,3 @@ > 2. [As a standalone web server](#asastandlonewebserver)

routePrefix | **String** | The HTTP route from which the image(s) will be served | `/**`
> `connection` Tip: if you give a `Pool` class for the `connection`, a single connection will be pulled from the pool for each individual request and released at the end of that request. The connection won't be released if you pass a `PoolConnection` or `Connection`(of course).

@@ -33,2 +35,3 @@

Example usage:
```ts

@@ -44,10 +47,10 @@ import express from 'express'

const pool = mysql.createPool({
host: 'example.org',
user: 'bob',
password: 'secret',
database: 'my_db',
host: 'example.org',
user: 'bob',
password: 'secret',
database: 'my_db',
})
// This will enable file upload support for the express server.
expressServer.use(fileUpload())
expressServer.use(fileUpload())

@@ -66,2 +69,3 @@ // This adds the `/file` and `/upload` routes to the express server.

3. Create a `.env` file in the root of the project that looks like this, but with valid values filled out:
```

@@ -74,3 +78,5 @@ MYSQL_HOST=

```
4. Run `npm run start`
> The web server will accept requests to any path so long as the path ends in `<md5-checksum-of-the-file><file-id>/<file-name>`.

@@ -83,2 +89,3 @@

When making a request for an image, a few `GET` parameters are available(all optional):
1. `width`

@@ -94,2 +101,3 @@ 2. `height`

The `FileServiceClient` class is exported by this module and can be used to upload images. Example usage:
```ts

@@ -100,15 +108,15 @@ import { FileServiceClient } from '@isoftdata/file-service'

const client = new FileServiceClient({
maxImageHeight: 1024, // optional
maxImageWidth: 1024, // optional
url: 'http://localhost:4000', // wherever the service is
maxImageHeight: 1024, // optional
maxImageWidth: 1024, // optional
url: 'http://localhost:4000', // wherever the service is
})
client.addFile({
name: 'myFile.jpg', // optional
stream: fs.createReadStream('./myFile.jpg'),
name: 'myFile.jpg', // optional
stream: fs.createReadStream('./myFile.jpg'),
})
client.addFile({
// If name is omitted, the express file upload middleware will give it a name.
stream: anyReadableStream,
// If name is omitted, the express file upload middleware will give it a name.
stream: anyReadableStream,
})

@@ -122,3 +130,4 @@

The file service doesn't have any concept or opinions about authentication requirements baked in. If you want to ensure that your files can't be accessed by someone that could guess the MD5 hash + fileid combo, we recommend you write an authentication checking middleware function that you register before the file service. Something like this:
The file service doesn't have any concept or opinions about authentication requirements baked in. If you want to ensure that your files can't be accessed by someone that could guess the MD5 hash + fileid combo, we recommend you write an authentication checking middleware function that you register before the file service. Something like this:
```js

@@ -131,11 +140,12 @@ import express from 'express'

expressServer.use('/files', async(req, res, next) => {
const authenticated = await isAuthenticated(req.cookies.token)
if(!authenticated) {
next(new Error('Not Authenticated'))
} else {
next()
}
const authenticated = await isAuthenticated(req.cookies.token)
if(!authenticated) {
next(new Error('Not Authenticated'))
} else {
next()
}
})
```
```
where the `isAuthenticated` function is from your app and knows how to check if a session is valid/authenticated.

@@ -148,2 +158,3 @@

Tables:
* `file`

@@ -153,2 +164,3 @@ * `filechunk`

Functions:
* `f_get_attachment_data`

@@ -171,1 +183,10 @@

## Version 6
Supports MySQL and MySQL2 through the abstraction layer of the `@isoftdata/utility-db` pool/connection wrappers.
Supports/requires/uses Node 20 and therefore Ubuntu 20 or higher on the host OS.
## Version 7
Drops support for Node versions < 20.6.0 and drops `dotenv` dependency in favor of native `process.loadEnvFile` and the `--env-file-if-exists` CLI flag.
-6
dist/utilities/query-handler.d.ts
import { Connection, PoolConnection } from 'mysql';
export declare const handleQuery: <T = unknown>(options: {
connection: Connection | PoolConnection;
sql: string;
values: unknown[];
}) => Promise<T>;
-11
dist/utilities/query-handler.js
export const handleQuery = (options) => new Promise((resolve, reject) => {
options.connection.query(options.sql, options.values, (err, rows) => {
if (err) {
reject(err);
}
else {
// eslint-disable-next-line @typescript-eslint/no-unsafe-argument
resolve(rows);
}
});
});