| 1 | import { |
| 2 | Controller, |
| 3 | Delete, |
| 4 | Get, |
| 5 | HttpCode, |
| 6 | HttpStatus, |
| 7 | Param, |
| 8 | Post, |
| 9 | Query, |
| 10 | Req, |
| 11 | Res, |
| 12 | Session, |
| 13 | StreamableFile, |
| 14 | } from '@nestjs/common'; |
| 15 | import { |
| 16 | ApiBadRequestResponse, |
| 17 | ApiBody, |
| 18 | ApiConflictResponse, |
| 19 | ApiConsumes, |
| 20 | ApiCreatedResponse, |
| 21 | ApiForbiddenResponse, |
| 22 | ApiNoContentResponse, |
| 23 | ApiNotFoundResponse, |
| 24 | ApiOkResponse, |
| 25 | ApiOperation, |
| 26 | ApiPayloadTooLargeResponse, |
| 27 | ApiTags, |
| 28 | ApiUnsupportedMediaTypeResponse, |
| 29 | } from '@nestjs/swagger'; |
| 30 | import { OptionalAuth, type |
| 31 | import type { Request, |
| 32 | |
| 33 | import { ErrorResponseDTO } |
| 34 | import { |
| 35 | ReleaseAssetDTO, |
| 36 | UploadReleaseAssetQueryDTO, |
| 37 | } from './dto/release.dto.js'; |
| 38 | import { ReleaseAssetsService } |
| 39 | |
| 40 | @Controller('repositories/:username/:repo/releases') |
| 41 | @ApiTags('Releases') |
| 42 | export class ReleaseAssetsController |
| 43 | constructor(private readonly |
| 44 | |
| 45 | @Post(':id/assets' |
| 46 | @ApiOperation({ |
| 47 | summary: 'Upload a release asset', |
| 48 | description: |
| 49 | "Needs write access. Takes the raw file bytes as `application/octet-stream` with a `Content-Length`; the file's own type goes in `type`. The file counts against the storage quota of the repository's owner, when the instance sets one.", |
| 50 | }) |
| 51 | @ApiConsumes('application/octet-stream' |
| 52 | @ApiBody({ schema |
| 53 | @ApiCreatedResponse({ type |
| 54 | @ApiBadRequestResponse({ |
| 55 | description: 'The file name is not a plain file name.', |
| 56 | type: ErrorResponseDTO, |
| 57 | }) |
| 58 | @ApiForbiddenResponse({ type |
| 59 | @ApiNotFoundResponse({ type |
| 60 | @ApiConflictResponse({ |
| 61 | description: 'The release already has an asset with this name.', |
| 62 | type: ErrorResponseDTO, |
| 63 | }) |
| 64 | @ApiPayloadTooLargeResponse({ |
| 65 | description: |
| 66 | 'The file is over the per-file limit, or would take the owner over their storage quota.', |
| 67 | type: ErrorResponseDTO, |
| 68 | }) |
| 69 | @ApiUnsupportedMediaTypeResponse({ |
| 70 | description: 'The body was not sent as `application/octet-stream`.', |
| 71 | type: ErrorResponseDTO, |
| 72 | }) |
| 73 | uploadReleaseAsset( |
| 74 | @Param('username' |
| 75 | @Param('repo' |
| 76 | @Param('id' |
| 77 | @Query() query |
| 78 | // read off the request rather than `@Headers()`, which would publish them as parameters a browser is not allowed to set |
| 79 | @Req() request |
| 80 | @Session() session |
| 81 | ): Promise<ReleaseAssetDTO |
| 82 | return this.assets |
| 83 | username, |
| 84 | repo, |
| 85 | requesterId: session.user |
| 86 | releaseId, |
| 87 | name: query.name |
| 88 | type: query.type |
| 89 | bodyType: request.headers |
| 90 | contentLength: request.headers |
| 91 | body: request, |
| 92 | }); |
| 93 | } |
| 94 | |
| 95 | @Get('tags/:tag/assets/:name' |
| 96 | @OptionalAuth() |
| 97 | @ApiOperation({ |
| 98 | summary: 'Download a release asset', |
| 99 | description: |
| 100 | 'Always served as an attachment. A tag or name containing `/` is sent percent-encoded.', |
| 101 | }) |
| 102 | @ApiOkResponse({ |
| 103 | content: { |
| 104 | 'application/octet-stream': { |
| 105 | schema: { type: ' |
| 106 | }, |
| 107 | }, |
| 108 | }) |
| 109 | @ApiNotFoundResponse({ type |
| 110 | async downloadReleaseAsset( |
| 111 | @Param('username' |
| 112 | @Param('repo' |
| 113 | @Param('tag' |
| 114 | @Param('name' |
| 115 | @Session() session |
| 116 | @Res({ passthrough |
| 117 | ): Promise<StreamableFile |
| 118 | const asset = |
| 119 | username, |
| 120 | repo, |
| 121 | requesterId: session?.user |
| 122 | tagName, |
| 123 | name, |
| 124 | }); |
| 125 | |
| 126 | response.set({ |
| 127 | 'Content-Type': asset. |
| 128 | 'Content-Length': String( |
| 129 | 'Content-Disposition': `attachment; filename*=UTF-8''${encodeURIComponent |
| 130 | // the bytes are user-controlled: never sniffed, never scripted |
| 131 | 'X-Content-Type-Options': 'nosniff', |
| 132 | 'Content-Security-Policy': "default-src 'none'; sandbox", |
| 133 | 'Cache-Control': 'private, no-cache', |
| 134 | }); |
| 135 | |
| 136 | return new StreamableFile |
| 137 | } |
| 138 | |
| 139 | @Delete('assets/:assetId' |
| 140 | @HttpCode(HttpStatus. |
| 141 | @ApiOperation({ |
| 142 | summary: 'Delete a release asset', |
| 143 | description: 'Needs write access.', |
| 144 | }) |
| 145 | @ApiNoContentResponse() |
| 146 | @ApiForbiddenResponse({ type |
| 147 | @ApiNotFoundResponse({ type |
| 148 | deleteReleaseAsset( |
| 149 | @Param('username' |
| 150 | @Param('repo' |
| 151 | @Param('assetId' |
| 152 | @Session() session |
| 153 | ): Promise<void |
| 154 | return this.assets |
| 155 | username, |
| 156 | repo, |
| 157 | requesterId: session.user |
| 158 | assetId, |
| 159 | }); |
| 160 | } |
| 161 | } |