692 lines
19 KiB
JavaScript
692 lines
19 KiB
JavaScript
const express = require("express");
|
|
const router = express.Router();
|
|
const multer = require("multer");
|
|
const path = require("path");
|
|
const fs = require("fs").promises;
|
|
const { requireAuth } = require("../middleware/auth");
|
|
const { pool } = require("../config/database");
|
|
const logger = require("../config/logger");
|
|
const { uploadLimiter } = require("../config/rateLimiter");
|
|
require("dotenv").config();
|
|
|
|
// Magic bytes for image file validation
|
|
const MAGIC_BYTES = {
|
|
jpeg: [0xff, 0xd8, 0xff],
|
|
png: [0x89, 0x50, 0x4e, 0x47],
|
|
gif: [0x47, 0x49, 0x46],
|
|
webp: [0x52, 0x49, 0x46, 0x46],
|
|
};
|
|
|
|
// Validate file content by checking magic bytes
|
|
const validateFileContent = async (filePath, mimetype) => {
|
|
try {
|
|
const buffer = Buffer.alloc(8);
|
|
const fd = await fs.open(filePath, "r");
|
|
await fd.read(buffer, 0, 8, 0);
|
|
await fd.close();
|
|
|
|
// Check JPEG
|
|
if (mimetype === "image/jpeg" || mimetype === "image/jpg") {
|
|
return buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff;
|
|
}
|
|
// Check PNG
|
|
if (mimetype === "image/png") {
|
|
return (
|
|
buffer[0] === 0x89 &&
|
|
buffer[1] === 0x50 &&
|
|
buffer[2] === 0x4e &&
|
|
buffer[3] === 0x47
|
|
);
|
|
}
|
|
// Check GIF
|
|
if (mimetype === "image/gif") {
|
|
return buffer[0] === 0x47 && buffer[1] === 0x49 && buffer[2] === 0x46;
|
|
}
|
|
// Check WebP
|
|
if (mimetype === "image/webp") {
|
|
return (
|
|
buffer[0] === 0x52 &&
|
|
buffer[1] === 0x49 &&
|
|
buffer[2] === 0x46 &&
|
|
buffer[3] === 0x46
|
|
);
|
|
}
|
|
return false;
|
|
} catch (error) {
|
|
logger.error("Magic byte validation error:", error);
|
|
return false;
|
|
}
|
|
};
|
|
|
|
// Allowed file types
|
|
const ALLOWED_MIME_TYPES = (
|
|
process.env.ALLOWED_FILE_TYPES || "image/jpeg,image/png,image/gif,image/webp"
|
|
).split(",");
|
|
const MAX_FILE_SIZE = parseInt(process.env.MAX_FILE_SIZE) || 5 * 1024 * 1024; // 5MB default
|
|
|
|
// Configure multer for file uploads
|
|
const storage = multer.diskStorage({
|
|
destination: async function (req, file, cb) {
|
|
const uploadDir = path.join(__dirname, "..", "..", "website", "uploads");
|
|
try {
|
|
await fs.mkdir(uploadDir, { recursive: true });
|
|
cb(null, uploadDir);
|
|
} catch (error) {
|
|
logger.error("Error creating upload directory:", error);
|
|
cb(error);
|
|
}
|
|
},
|
|
filename: function (req, file, cb) {
|
|
// Generate unique filename
|
|
const uniqueSuffix = Date.now() + "-" + Math.round(Math.random() * 1e9);
|
|
const ext = path.extname(file.originalname).toLowerCase();
|
|
const name = path
|
|
.basename(file.originalname, ext)
|
|
.replace(/[^a-z0-9]/gi, "-")
|
|
.toLowerCase()
|
|
.substring(0, 50); // Limit filename length
|
|
cb(null, name + "-" + uniqueSuffix + ext);
|
|
},
|
|
});
|
|
|
|
const upload = multer({
|
|
storage: storage,
|
|
limits: {
|
|
fileSize: MAX_FILE_SIZE,
|
|
files: 10, // Max 10 files per request
|
|
},
|
|
fileFilter: function (req, file, cb) {
|
|
// Validate MIME type
|
|
if (!ALLOWED_MIME_TYPES.includes(file.mimetype)) {
|
|
logger.warn("File upload rejected - invalid type", {
|
|
mimetype: file.mimetype,
|
|
userId: req.session?.user?.id,
|
|
});
|
|
return cb(
|
|
new Error(
|
|
`File type not allowed. Allowed types: ${ALLOWED_MIME_TYPES.join(
|
|
", "
|
|
)}`
|
|
),
|
|
false
|
|
);
|
|
}
|
|
|
|
// Validate file extension
|
|
const ext = path.extname(file.originalname).toLowerCase();
|
|
const allowedExtensions = [".jpg", ".jpeg", ".png", ".gif", ".webp"];
|
|
if (!allowedExtensions.includes(ext)) {
|
|
logger.warn("File upload rejected - invalid extension", {
|
|
extension: ext,
|
|
userId: req.session?.user?.id,
|
|
});
|
|
return cb(new Error("Invalid file extension"), false);
|
|
}
|
|
|
|
cb(null, true);
|
|
},
|
|
});
|
|
|
|
// Upload multiple files
|
|
router.post(
|
|
"/upload",
|
|
requireAuth,
|
|
uploadLimiter,
|
|
upload.array("files", 10),
|
|
async (req, res, next) => {
|
|
try {
|
|
if (!req.files || req.files.length === 0) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
message: "No files uploaded",
|
|
});
|
|
}
|
|
|
|
const uploadedBy = req.session.user?.id || null;
|
|
const folderId = req.body.folder_id ? parseInt(req.body.folder_id) : null;
|
|
const files = [];
|
|
|
|
// Validate file content with magic bytes
|
|
for (const file of req.files) {
|
|
const isValid = await validateFileContent(file.path, file.mimetype);
|
|
if (!isValid) {
|
|
logger.warn("File upload rejected - magic byte mismatch", {
|
|
filename: file.filename,
|
|
mimetype: file.mimetype,
|
|
userId: uploadedBy,
|
|
});
|
|
// Clean up invalid file
|
|
await fs
|
|
.unlink(file.path)
|
|
.catch((err) =>
|
|
logger.error("Failed to clean up invalid file:", err)
|
|
);
|
|
return res.status(400).json({
|
|
success: false,
|
|
message: `File ${file.originalname} failed security validation`,
|
|
});
|
|
}
|
|
}
|
|
|
|
// Insert each file into database
|
|
for (const file of req.files) {
|
|
try {
|
|
const result = await pool.query(
|
|
`INSERT INTO uploads
|
|
(filename, original_name, file_path, file_size, mime_type, uploaded_by, folder_id, created_at, updated_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, NOW(), NOW())
|
|
RETURNING id, filename, original_name, file_path, file_size, mime_type, folder_id, created_at`,
|
|
[
|
|
file.filename,
|
|
file.originalname,
|
|
`/uploads/${file.filename}`,
|
|
file.size,
|
|
file.mimetype,
|
|
uploadedBy,
|
|
folderId,
|
|
]
|
|
);
|
|
|
|
files.push({
|
|
id: result.rows[0].id,
|
|
filename: result.rows[0].filename,
|
|
originalName: result.rows[0].original_name,
|
|
size: result.rows[0].file_size,
|
|
mimetype: result.rows[0].mime_type,
|
|
path: result.rows[0].file_path,
|
|
uploadDate: result.rows[0].created_at,
|
|
folderId: result.rows[0].folder_id,
|
|
});
|
|
|
|
logger.info("File uploaded successfully", {
|
|
fileId: result.rows[0].id,
|
|
filename: file.filename,
|
|
userId: uploadedBy,
|
|
});
|
|
} catch (dbError) {
|
|
logger.error("Database insert failed for file:", {
|
|
filename: file.filename,
|
|
error: dbError.message,
|
|
});
|
|
// Clean up this specific file
|
|
await fs
|
|
.unlink(file.path)
|
|
.catch((err) => logger.error("Failed to clean up file:", err));
|
|
}
|
|
}
|
|
|
|
if (files.length === 0) {
|
|
return res.status(500).json({
|
|
success: false,
|
|
message: "Failed to save uploaded files",
|
|
});
|
|
}
|
|
|
|
res.json({
|
|
success: true,
|
|
message: `${files.length} file(s) uploaded successfully`,
|
|
files: files,
|
|
});
|
|
} catch (error) {
|
|
logger.error("Upload error:", error);
|
|
|
|
// Clean up all uploaded files on error
|
|
if (req.files) {
|
|
for (const file of req.files) {
|
|
try {
|
|
await fs.unlink(file.path);
|
|
} catch (unlinkError) {
|
|
logger.error("Error cleaning up file:", unlinkError);
|
|
}
|
|
}
|
|
}
|
|
next(error);
|
|
}
|
|
}
|
|
);
|
|
|
|
// Get all uploaded files
|
|
router.get("/uploads", requireAuth, async (req, res) => {
|
|
try {
|
|
const folderId = req.query.folder_id;
|
|
|
|
let query = `SELECT
|
|
id,
|
|
filename,
|
|
original_name,
|
|
file_path,
|
|
file_size,
|
|
mime_type,
|
|
uploaded_by,
|
|
folder_id,
|
|
created_at,
|
|
updated_at,
|
|
used_in_type,
|
|
used_in_id
|
|
FROM uploads`;
|
|
|
|
const params = [];
|
|
|
|
if (folderId !== undefined) {
|
|
if (folderId === "null" || folderId === "") {
|
|
query += ` WHERE folder_id IS NULL`;
|
|
} else {
|
|
query += ` WHERE folder_id = $1`;
|
|
params.push(parseInt(folderId));
|
|
}
|
|
}
|
|
|
|
query += ` ORDER BY created_at DESC`;
|
|
|
|
const result = await pool.query(query, params);
|
|
|
|
const files = result.rows.map((row) => ({
|
|
id: row.id,
|
|
filename: row.filename,
|
|
originalName: row.original_name,
|
|
size: row.file_size,
|
|
mimetype: row.mime_type,
|
|
path: row.file_path,
|
|
uploadDate: row.created_at,
|
|
uploadedBy: row.uploaded_by,
|
|
folderId: row.folder_id,
|
|
usedInType: row.used_in_type,
|
|
usedInId: row.used_in_id,
|
|
}));
|
|
|
|
res.json({
|
|
success: true,
|
|
files: files,
|
|
});
|
|
} catch (error) {
|
|
logger.error("Error listing files:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
// Delete a file
|
|
router.delete("/uploads/:filename", requireAuth, async (req, res) => {
|
|
try {
|
|
const filename = req.params.filename;
|
|
const uploadDir = path.join(__dirname, "..", "..", "website", "uploads");
|
|
const filePath = path.join(uploadDir, filename);
|
|
|
|
// Security check: ensure file is within uploads directory
|
|
if (!filePath.startsWith(uploadDir)) {
|
|
return res.status(403).json({
|
|
success: false,
|
|
error: "Invalid file path",
|
|
});
|
|
}
|
|
|
|
// Start transaction: delete from database first
|
|
const result = await pool.query(
|
|
"DELETE FROM uploads WHERE filename = $1 RETURNING id",
|
|
[filename]
|
|
);
|
|
|
|
if (result.rowCount === 0) {
|
|
return res.status(404).json({
|
|
success: false,
|
|
error: "File not found in database",
|
|
});
|
|
}
|
|
|
|
// Then delete physical file
|
|
try {
|
|
await fs.unlink(filePath);
|
|
} catch (fileError) {
|
|
logger.warn("File already deleted from disk:", filename);
|
|
// Continue anyway since database record is deleted
|
|
}
|
|
|
|
res.json({
|
|
success: true,
|
|
message: "File deleted successfully",
|
|
});
|
|
} catch (error) {
|
|
logger.error("Error deleting file:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
// Delete file by ID
|
|
router.delete("/uploads/id/:id", requireAuth, async (req, res) => {
|
|
try {
|
|
const fileId = parseInt(req.params.id);
|
|
|
|
// Get file info first
|
|
const fileResult = await pool.query(
|
|
"SELECT filename FROM uploads WHERE id = $1",
|
|
[fileId]
|
|
);
|
|
|
|
if (fileResult.rows.length === 0) {
|
|
return res.status(404).json({
|
|
success: false,
|
|
error: "File not found",
|
|
});
|
|
}
|
|
|
|
const filename = fileResult.rows[0].filename;
|
|
const uploadDir = path.join(__dirname, "..", "..", "website", "uploads");
|
|
const filePath = path.join(uploadDir, filename);
|
|
|
|
// Delete from database
|
|
await pool.query("DELETE FROM uploads WHERE id = $1", [fileId]);
|
|
|
|
// Delete physical file
|
|
try {
|
|
await fs.unlink(filePath);
|
|
} catch (fileError) {
|
|
logger.warn("File already deleted from disk:", filename);
|
|
}
|
|
|
|
res.json({
|
|
success: true,
|
|
message: "File deleted successfully",
|
|
});
|
|
} catch (error) {
|
|
logger.error("Error deleting file:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
// ===== FOLDER MANAGEMENT ROUTES =====
|
|
|
|
// Create a new folder
|
|
router.post("/folders", requireAuth, async (req, res) => {
|
|
try {
|
|
const { name, parent_id } = req.body;
|
|
|
|
if (!name || name.trim() === "") {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "Folder name is required",
|
|
});
|
|
}
|
|
|
|
// Sanitize folder name
|
|
const sanitizedName = name.trim().replace(/[^a-zA-Z0-9\s\-_]/g, "");
|
|
|
|
// Build path
|
|
let path = `/${sanitizedName}`;
|
|
if (parent_id) {
|
|
const parentResult = await pool.query(
|
|
"SELECT path FROM media_folders WHERE id = $1",
|
|
[parent_id]
|
|
);
|
|
|
|
if (parentResult.rows.length === 0) {
|
|
return res.status(404).json({
|
|
success: false,
|
|
error: "Parent folder not found",
|
|
});
|
|
}
|
|
|
|
path = `${parentResult.rows[0].path}/${sanitizedName}`;
|
|
}
|
|
|
|
const createdBy = req.session.user?.id || null;
|
|
|
|
const result = await pool.query(
|
|
`INSERT INTO media_folders (name, parent_id, path, created_by)
|
|
VALUES ($1, $2, $3, $4)
|
|
RETURNING id, name, parent_id, path, created_at`,
|
|
[sanitizedName, parent_id || null, path, createdBy]
|
|
);
|
|
|
|
res.json({
|
|
success: true,
|
|
folder: {
|
|
id: result.rows[0].id,
|
|
name: result.rows[0].name,
|
|
parentId: result.rows[0].parent_id,
|
|
path: result.rows[0].path,
|
|
createdAt: result.rows[0].created_at,
|
|
},
|
|
});
|
|
} catch (error) {
|
|
if (error.code === "23505") {
|
|
// Unique constraint violation
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "A folder with this name already exists in this location",
|
|
});
|
|
}
|
|
logger.error("Error creating folder:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
// Get all folders
|
|
router.get("/folders", requireAuth, async (req, res) => {
|
|
try {
|
|
const result = await pool.query(
|
|
`SELECT
|
|
f.id,
|
|
f.name,
|
|
f.parent_id,
|
|
f.path,
|
|
f.created_at,
|
|
(SELECT COUNT(*) FROM uploads WHERE folder_id = f.id) as file_count,
|
|
(SELECT COUNT(*) FROM media_folders WHERE parent_id = f.id) as subfolder_count
|
|
FROM media_folders f
|
|
ORDER BY f.path ASC`
|
|
);
|
|
|
|
const folders = result.rows.map((row) => ({
|
|
id: row.id,
|
|
name: row.name,
|
|
parentId: row.parent_id,
|
|
path: row.path,
|
|
createdAt: row.created_at,
|
|
fileCount: parseInt(row.file_count),
|
|
subfolderCount: parseInt(row.subfolder_count),
|
|
}));
|
|
|
|
res.json({
|
|
success: true,
|
|
folders: folders,
|
|
});
|
|
} catch (error) {
|
|
logger.error("Error listing folders:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
// Delete a folder (and optionally its contents)
|
|
router.delete("/folders/:id", requireAuth, async (req, res) => {
|
|
try {
|
|
const folderId = parseInt(req.params.id);
|
|
const deleteContents = req.query.delete_contents === "true";
|
|
|
|
// Check if folder exists
|
|
const folderResult = await pool.query(
|
|
"SELECT id, name FROM media_folders WHERE id = $1",
|
|
[folderId]
|
|
);
|
|
|
|
if (folderResult.rows.length === 0) {
|
|
return res.status(404).json({
|
|
success: false,
|
|
error: "Folder not found",
|
|
});
|
|
}
|
|
|
|
if (deleteContents) {
|
|
// Delete all files in this folder and subfolders
|
|
const filesResult = await pool.query(
|
|
`SELECT u.filename FROM uploads u
|
|
WHERE u.folder_id = $1 OR u.folder_id IN (
|
|
SELECT id FROM media_folders WHERE path LIKE (
|
|
SELECT path || '%' FROM media_folders WHERE id = $1
|
|
)
|
|
)`,
|
|
[folderId]
|
|
);
|
|
|
|
// Delete physical files
|
|
const uploadDir = path.join(__dirname, "..", "..", "website", "uploads");
|
|
for (const row of filesResult.rows) {
|
|
try {
|
|
await fs.unlink(path.join(uploadDir, row.filename));
|
|
} catch (err) {
|
|
logger.warn(`Could not delete file: ${row.filename}`, err);
|
|
}
|
|
}
|
|
|
|
// Delete folder (cascade will delete subfolders and DB records)
|
|
await pool.query("DELETE FROM media_folders WHERE id = $1", [folderId]);
|
|
} else {
|
|
// Check if folder has contents
|
|
const contentsCheck = await pool.query(
|
|
`SELECT
|
|
(SELECT COUNT(*) FROM uploads WHERE folder_id = $1) as file_count,
|
|
(SELECT COUNT(*) FROM media_folders WHERE parent_id = $1) as subfolder_count`,
|
|
[folderId]
|
|
);
|
|
|
|
const fileCount = parseInt(contentsCheck.rows[0].file_count);
|
|
const subfolderCount = parseInt(contentsCheck.rows[0].subfolder_count);
|
|
|
|
if (fileCount > 0 || subfolderCount > 0) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: `Folder contains ${fileCount} file(s) and ${subfolderCount} subfolder(s). Delete contents first or use delete_contents=true`,
|
|
});
|
|
}
|
|
|
|
await pool.query("DELETE FROM media_folders WHERE id = $1", [folderId]);
|
|
}
|
|
|
|
res.json({
|
|
success: true,
|
|
message: "Folder deleted successfully",
|
|
});
|
|
} catch (error) {
|
|
logger.error("Error deleting folder:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
// Move files to a folder
|
|
router.patch("/uploads/move", requireAuth, async (req, res) => {
|
|
try {
|
|
const { file_ids, folder_id } = req.body;
|
|
|
|
if (!Array.isArray(file_ids) || file_ids.length === 0) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "file_ids array is required",
|
|
});
|
|
}
|
|
|
|
const targetFolderId = folder_id || null;
|
|
|
|
// Verify folder exists if provided
|
|
if (targetFolderId) {
|
|
const folderCheck = await pool.query(
|
|
"SELECT id FROM media_folders WHERE id = $1",
|
|
[targetFolderId]
|
|
);
|
|
|
|
if (folderCheck.rows.length === 0) {
|
|
return res.status(404).json({
|
|
success: false,
|
|
error: "Target folder not found",
|
|
});
|
|
}
|
|
}
|
|
|
|
// Move files
|
|
const result = await pool.query(
|
|
`UPDATE uploads
|
|
SET folder_id = $1, updated_at = NOW()
|
|
WHERE id = ANY($2::int[])
|
|
RETURNING id`,
|
|
[targetFolderId, file_ids]
|
|
);
|
|
|
|
res.json({
|
|
success: true,
|
|
message: `${result.rowCount} file(s) moved successfully`,
|
|
movedCount: result.rowCount,
|
|
});
|
|
} catch (error) {
|
|
logger.error("Error moving files:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
// Bulk delete files
|
|
router.post("/uploads/bulk-delete", requireAuth, async (req, res) => {
|
|
try {
|
|
const { file_ids } = req.body;
|
|
|
|
if (!Array.isArray(file_ids) || file_ids.length === 0) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "file_ids array is required",
|
|
});
|
|
}
|
|
|
|
// Get filenames first
|
|
const filesResult = await pool.query(
|
|
"SELECT filename FROM uploads WHERE id = ANY($1::int[])",
|
|
[file_ids]
|
|
);
|
|
|
|
// Delete from database
|
|
const result = await pool.query(
|
|
"DELETE FROM uploads WHERE id = ANY($1::int[])",
|
|
[file_ids]
|
|
);
|
|
|
|
// Delete physical files
|
|
const uploadDir = path.join(__dirname, "..", "..", "website", "uploads");
|
|
for (const row of filesResult.rows) {
|
|
try {
|
|
await fs.unlink(path.join(uploadDir, row.filename));
|
|
} catch (err) {
|
|
logger.warn(`Could not delete file: ${row.filename}`, err);
|
|
}
|
|
}
|
|
|
|
res.json({
|
|
success: true,
|
|
message: `${result.rowCount} file(s) deleted successfully`,
|
|
deletedCount: result.rowCount,
|
|
});
|
|
} catch (error) {
|
|
logger.error("Error bulk deleting files:", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error: error.message,
|
|
});
|
|
}
|
|
});
|
|
|
|
module.exports = router;
|