| 1 | import { |
| 2 | Controller, |
| 3 | Delete, |
| 4 | Get, |
| 5 | HttpCode, |
| 6 | HttpStatus, |
| 7 | Param, |
| 8 | Post, |
| 9 | Query, |
| 10 | Req, |
| 11 | Res, |
| 12 | Session, |
| 13 | StreamableFile, |
| 14 | } from '@nestjs/common'; |
| 15 | import { |
| 16 | ApiBadRequestResponse, |
| 17 | ApiBody, |
| 18 | ApiConflictResponse, |
| 19 | ApiConsumes, |
| 20 | ApiCreatedResponse, |
| 21 | ApiForbiddenResponse, |
| 22 | ApiNoContentResponse, |
| 23 | ApiNotFoundResponse, |
| 24 | ApiOkResponse, |
| 25 | ApiOperation, |
| 26 | ApiPayloadTooLargeResponse, |
| 27 | ApiTags, |
| 28 | ApiUnsupportedMediaTypeResponse, |
| 29 | } from '@nestjs/swagger'; |
| 30 | import { OptionalAuth, type |
| 31 | import type { Request, |
| 32 | |
| 33 | import { ErrorResponseDTO } |
| 34 | import { UploadNotOctetStreamError } |
| 35 | import { |
| 36 | ReleaseAssetDTO, |
| 37 | UploadReleaseAssetQueryDTO, |
| 38 | } from './dto/release.dto.js'; |
| 39 | import { ReleaseAssetsService } |
| 40 | |
| 41 | @Controller('repositories/:username/:repo/releases') |
| 42 | @ApiTags('Releases') |
| 43 | export class ReleaseAssetsController |
| 44 | constructor(private readonly |
| 45 | |
| 46 | @Post(':id/assets' |
| 47 | @ApiOperation({ |
| 48 | summary: 'Upload a release asset', |
| 49 | description: |
| 50 | "Needs write access. Takes the raw file bytes as `application/octet-stream` with a `Content-Length`; the file's own type goes in `type`. The file counts against the storage quota of the repository's owner, when the instance sets one.", |
| 51 | }) |
| 52 | @ApiConsumes('application/octet-stream' |
| 53 | @ApiBody({ schema |
| 54 | @ApiCreatedResponse({ type |
| 55 | @ApiBadRequestResponse({ |
| 56 | description: 'The file name is not a plain file name.', |
| 57 | type: ErrorResponseDTO, |
| 58 | }) |
| 59 | @ApiForbiddenResponse({ type |
| 60 | @ApiNotFoundResponse({ type |
| 61 | @ApiConflictResponse({ |
| 62 | description: 'The release already has an asset with this name.', |
| 63 | type: ErrorResponseDTO, |
| 64 | }) |
| 65 | @ApiPayloadTooLargeResponse({ |
| 66 | description: |
| 67 | 'The file is over the per-file limit, or would take the owner over their storage quota.', |
| 68 | type: ErrorResponseDTO, |
| 69 | }) |
| 70 | @ApiUnsupportedMediaTypeResponse({ |
| 71 | description: 'The body was not sent as `application/octet-stream`.', |
| 72 | type: ErrorResponseDTO, |
| 73 | }) |
| 74 | uploadReleaseAsset( |
| 75 | @Param('username' |
| 76 | @Param('repo' |
| 77 | @Param('id' |
| 78 | @Query() query |
| 79 | // read off the request rather than `@Headers()`, which would publish them as parameters a browser is not allowed to set |
| 80 | @Req() request |
| 81 | @Session() session |
| 82 | ): Promise<ReleaseAssetDTO |
| 83 | // JSON and form bodies are parsed before any handler runs, so their bytes are gone by the time they could be streamed |
| 84 | if ( |
| 85 | request.headers['content-type |
| 86 | 'application/octet-stream' |
| 87 | ) |
| 88 | throw new UploadNotOctetStreamError() |
| 89 | return this.assets |
| 90 | username, |
| 91 | repo, |
| 92 | requesterId: session.user |
| 93 | releaseId, |
| 94 | name: query.name |
| 95 | type: query.type |
| 96 | contentLength: request.headers |
| 97 | body: request, |
| 98 | }); |
| 99 | } |
| 100 | |
| 101 | @Get('tags/:tag/assets/:name' |
| 102 | @OptionalAuth() |
| 103 | @ApiOperation({ |
| 104 | summary: 'Download a release asset', |
| 105 | description: |
| 106 | 'Always served as an attachment. A tag or name containing `/` is sent percent-encoded.', |
| 107 | }) |
| 108 | @ApiOkResponse({ |
| 109 | content: { |
| 110 | 'application/octet-stream': { |
| 111 | schema: { type: ' |
| 112 | }, |
| 113 | }, |
| 114 | }) |
| 115 | @ApiNotFoundResponse({ type |
| 116 | async downloadReleaseAsset( |
| 117 | @Param('username' |
| 118 | @Param('repo' |
| 119 | @Param('tag' |
| 120 | @Param('name' |
| 121 | @Session() session |
| 122 | @Res({ passthrough |
| 123 | ): Promise<StreamableFile |
| 124 | const asset = |
| 125 | username, |
| 126 | repo, |
| 127 | requesterId: session?.user |
| 128 | asset: { tagName, |
| 129 | }); |
| 130 | |
| 131 | response.set({ |
| 132 | 'Content-Type': asset. |
| 133 | 'Content-Length': String( |
| 134 | 'Content-Disposition': `attachment; filename*=UTF-8''${encodeURIComponent |
| 135 | // the bytes are user-controlled: never sniffed, never scripted |
| 136 | 'X-Content-Type-Options': 'nosniff', |
| 137 | 'Content-Security-Policy': "default-src 'none'; sandbox", |
| 138 | 'Cache-Control': 'private, no-cache', |
| 139 | }); |
| 140 | |
| 141 | return new StreamableFile |
| 142 | } |
| 143 | |
| 144 | @Delete('assets/:assetId' |
| 145 | @HttpCode(HttpStatus. |
| 146 | @ApiOperation({ |
| 147 | summary: 'Delete a release asset', |
| 148 | description: 'Needs write access.', |
| 149 | }) |
| 150 | @ApiNoContentResponse() |
| 151 | @ApiForbiddenResponse({ type |
| 152 | @ApiNotFoundResponse({ type |
| 153 | deleteReleaseAsset( |
| 154 | @Param('username' |
| 155 | @Param('repo' |
| 156 | @Param('assetId' |
| 157 | @Session() session |
| 158 | ): Promise<void |
| 159 | return this.assets |
| 160 | username, |
| 161 | repo, |
| 162 | requesterId: session.user |
| 163 | assetId, |
| 164 | }); |
| 165 | } |
| 166 | } |