1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
import { zValidator } from "@hono/zod-validator";
import { TRPCError } from "@trpc/server";
import { eq } from "drizzle-orm";
import { Hono } from "hono";
import { z } from "zod";
import { assets } from "@karakeep/db/schema";
import { BareBookmark } from "@karakeep/trpc/models/bookmarks";
import { authMiddleware } from "../middlewares/auth";
import { serveAsset } from "../utils/assets";
import { uploadAsset } from "../utils/upload";
const app = new Hono()
.use(authMiddleware)
.post(
"/",
zValidator(
"form",
z
.object({ file: z.instanceof(File) })
.or(z.object({ image: z.instanceof(File) })),
),
async (c) => {
const body = c.req.valid("form");
const up = await uploadAsset(c.var.ctx.user, c.var.ctx.db, body);
if ("error" in up) {
return c.json({ error: up.error }, up.status);
}
return c.json({
assetId: up.assetId,
contentType: up.contentType,
size: up.size,
fileName: up.fileName,
});
},
)
.get("/:assetId", async (c) => {
const assetId = c.req.param("assetId");
const assetDb = await c.var.ctx.db.query.assets.findFirst({
where: eq(assets.id, assetId),
columns: {
id: true,
userId: true,
bookmarkId: true,
},
});
if (!assetDb) {
return c.json({ error: "Asset not found" }, { status: 404 });
}
// If asset is not attached to a bookmark yet, only owner can access it
if (!assetDb.bookmarkId) {
if (assetDb.userId !== c.var.ctx.user.id) {
return c.json({ error: "Asset not found" }, { status: 404 });
}
return await serveAsset(c, assetId, assetDb.userId);
}
// If asset is attached to a bookmark, check bookmark access permissions
try {
// This throws if the user doesn't have access to the bookmark
await BareBookmark.bareFromId(c.var.ctx, assetDb.bookmarkId);
} catch (e) {
if (e instanceof TRPCError && e.code === "FORBIDDEN") {
return c.json({ error: "Asset not found" }, { status: 404 });
}
throw e;
}
return await serveAsset(c, assetId, assetDb.userId);
});
export default app;
|
