serfowiandClaude Opus 5
66dd4ac942
Stands up packages/api so the swipe path stops trusting its caller, and puts the auth library behind an interface we own. - packages/api: tRPC v11 with a Session type WE define, not one re-exported from an auth library. Swapping providers means rewriting one SessionResolver, not touching a router. - Procedure layers: public / protected / client / pro / verifiedPro / admin. Admin routes 404 rather than 403 so they cannot be probed. - deck router replaces the untrusted server action. Ownership is checked on every operation and returns NOT_FOUND, never FORBIDDEN, so job ids cannot be enumerated. 23 tests, mostly authorization. - packages/storage: presigned direct-to-R2 uploads. The server picks the key, so a caller can only write under their own user id. 14 tests. Three defects found and fixed: - The lazy db Proxy failed drizzle's is(db, PgDatabase) because it did not trap getPrototypeOf. Auth adapters dispatch on exactly that check, so this would have failed at runtime inside third-party code. Fixed and pinned with a regression test. - The open-request cap was a read-then-write race: concurrent swipes could both read 4 and both insert. Now one transaction with the job row locked. The cap is checked before the tombstone is written, so a rejected swipe leaves no trace and the card stays on the deck. - superjson was configured in two of the three required places. Without the QueryClient dehydrate/hydrate pair, RSC-prefetched data arrives as a raw envelope with no type error to warn you. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
29 lines
1.1 KiB
TypeScript
29 lines
1.1 KiB
TypeScript
import { TRPCError } from '@trpc/server';
|
|
import { createPresignedUpload, publicUrl, uploadRequestSchema, StorageError } from '@linkder/storage';
|
|
import { protectedProcedure, router } from '../trpc';
|
|
|
|
/**
|
|
* Hands out short-lived presigned PUTs so the browser uploads straight to R2.
|
|
*
|
|
* The server picks the key, so a caller can only ever write under their own
|
|
* user id — they cannot overwrite someone else's document by guessing a path.
|
|
*/
|
|
export const uploadRouter = router({
|
|
presign: protectedProcedure.input(uploadRequestSchema).mutation(async ({ ctx, input }) => {
|
|
try {
|
|
const upload = await createPresignedUpload({ ...input, ownerId: ctx.session.userId });
|
|
return {
|
|
...upload,
|
|
// Credentials are private; the caller stores the key and admins read it
|
|
// through a signed GET rather than a public URL.
|
|
publicUrl: input.kind === 'credential' ? null : publicUrl(upload.key),
|
|
};
|
|
} catch (error) {
|
|
if (error instanceof StorageError) {
|
|
throw new TRPCError({ code: 'BAD_REQUEST', message: error.message });
|
|
}
|
|
throw error;
|
|
}
|
|
}),
|
|
});
|