25738155938

Committed 12 May 2026 01:38PM UTC coverage: 39.251% (-35.1%) from 74.366%

Build # 25738155938

Build Type

Pull #1094

github

Committed by

web-flow

Commit Message

Merge 0f3efcca0 into defbbb616

Pull Request Pull Request #1094: feat: embedded vector store

Coverage Stats

2188 of 6152 branches covered (35.57%)

Branch coverage included in aggregate %.

88 of 280 new or added lines in 6 files covered. (31.43%)

3689 existing lines in 165 files now uncovered.

4312 of 10408 relevant lines covered (41.43%)

34.74 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

10.0

/src/http/routes/render/renderSignedImage.ts

import { SignedToken, verifyJWT } from '@internal/auth'
import { getJwtSecret, getTenantConfig } from '@internal/database'
import { ERRORS } from '@internal/errors'
import { ImageRenderer } from '@storage/renderer'
import { FastifyInstance } from 'fastify'
import { FromSchema } from 'json-schema-to-ts'
import { getConfig } from '../../../config'
import { ROUTE_OPERATIONS } from '../operations'

const { storageS3Bucket, isMultitenant } = getConfig()

const renderAuthenticatedImageParamsSchema = {
  type: 'object',
  properties: {
    bucketName: { type: 'string', examples: ['avatars'] },
    '*': { type: 'string', examples: ['folder/cat.png'] },
  },
  required: ['bucketName', '*'],
} as const

const renderImageQuerySchema = {
  type: 'object',
  properties: {
    token: {
      type: 'string',
      examples: [
        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJidWNrZXQyL3B1YmxpYy9zYWRjYXQtdXBsb2FkMjMucG5nIiwiaWF0IjoxNjE3NzI2MjczLCJleHAiOjE2MTc3MjcyNzN9.uBQcXzuvXxfw-9WgzWMBfE_nR3VOgpvfZe032sfLSSk',
      ],
    },
    download: { type: 'string', examples: ['filename.png'] },
  },
  required: ['token'],
} as const

interface renderImageRequestInterface {
  Params: FromSchema<typeof renderAuthenticatedImageParamsSchema>
  Querystring: FromSchema<typeof renderImageQuerySchema>
}

export default async function routes(fastify: FastifyInstance) {
  const summary = 'Render an authenticated image with the given transformations'
  fastify.get<renderImageRequestInterface>(
    '/sign/:bucketName/*',
    {
      schema: {
        params: renderAuthenticatedImageParamsSchema,
        querystring: renderImageQuerySchema,
        summary,
        response: { '4xx': { $ref: 'errorSchema#', description: 'Error response' } },
        tags: ['transformation'],
      },
      config: {
        operation: { type: ROUTE_OPERATIONS.RENDER_SIGNED_IMAGE },
      },
    },
    async (request, response) => {
      const { token } = request.query
      const { download } = request.query

      let payload: SignedToken
      const { secret: jwtSecret, jwks } = await getJwtSecret(request.tenantId)

      try {
        payload = (await verifyJWT(token, jwtSecret, jwks)) as SignedToken
      } catch (e) {
        const err = e as Error
        throw ERRORS.InvalidJWT(err)
      }

      const { url, transformations, exp } = payload

      const path = `${request.params.bucketName}/${request.params['*']}`

      if (url !== path) {
        throw ERRORS.InvalidSignature()
      }

      const s3Key = `${request.tenantId}/${url}`

      const [bucketName, ...objParts] = url.split('/')
      const obj = await request.storage
        .asSuperUser()
        .from(bucketName)
        .findObject(objParts.join('/'), 'id,version,metadata')

      const renderer = request.storage.renderer('image') as ImageRenderer

      if (isMultitenant) {
        const tenantConfig = await getTenantConfig(request.tenantId)
        renderer.setLimits({
          maxResolution: tenantConfig.features.imageTransformation.maxResolution,
        })
      }

      return renderer
        .setTransformationsFromString(transformations || '')
        .render(request, response, {
          bucket: storageS3Bucket,
          key: s3Key,
          version: obj.version,
          download,
          expires: new Date(exp * 1000).toUTCString(),
          xRobotsTag: obj.metadata?.['xRobotsTag'] as string | undefined,
          signal: request.signals.disconnect.signal,
        })
    }
  )
}

1	import { SignedToken, verifyJWT } from '@internal/auth'
2	import { getJwtSecret, getTenantConfig } from '@internal/database'
3	import { ERRORS } from '@internal/errors'
4	import { ImageRenderer } from '@storage/renderer'
5	import { FastifyInstance } from 'fastify'
6	import { FromSchema } from 'json-schema-to-ts'
7	import { getConfig } from '../../../config'
8	import { ROUTE_OPERATIONS } from '../operations'
9
10	const { storageS3Bucket, isMultitenant } = getConfig()	2✔
11
12	const renderAuthenticatedImageParamsSchema = {	2✔
13	type: 'object',
14	properties: {
15	bucketName: { type: 'string', examples: ['avatars'] },
16	'*': { type: 'string', examples: ['folder/cat.png'] },
17	},
18	required: ['bucketName', '*'],
19	} as const
20
21	const renderImageQuerySchema = {	2✔
22	type: 'object',
23	properties: {
24	token: {
25	type: 'string',
26	examples: [
27	'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJidWNrZXQyL3B1YmxpYy9zYWRjYXQtdXBsb2FkMjMucG5nIiwiaWF0IjoxNjE3NzI2MjczLCJleHAiOjE2MTc3MjcyNzN9.uBQcXzuvXxfw-9WgzWMBfE_nR3VOgpvfZe032sfLSSk',
28	],
29	},
30	download: { type: 'string', examples: ['filename.png'] },
31	},
32	required: ['token'],
33	} as const
34
35	interface renderImageRequestInterface {
36	Params: FromSchema<typeof renderAuthenticatedImageParamsSchema>
37	Querystring: FromSchema<typeof renderImageQuerySchema>
38	}
39
40	export default async function routes(fastify: FastifyInstance) {
UNCOV 41	const summary = 'Render an authenticated image with the given transformations'	×
UNCOV 42	fastify.get<renderImageRequestInterface>(	×
43	'/sign/:bucketName/*',
44	{
45	schema: {
46	params: renderAuthenticatedImageParamsSchema,
47	querystring: renderImageQuerySchema,
48	summary,
49	response: { '4xx': { $ref: 'errorSchema#', description: 'Error response' } },
50	tags: ['transformation'],
51	},
52	config: {
53	operation: { type: ROUTE_OPERATIONS.RENDER_SIGNED_IMAGE },
54	},
55	},
56	async (request, response) => {
UNCOV 57	const { token } = request.query	×
UNCOV 58	const { download } = request.query	×
59
60	let payload: SignedToken
UNCOV 61	const { secret: jwtSecret, jwks } = await getJwtSecret(request.tenantId)	×
62
UNCOV 63	try {	×
UNCOV 64	payload = (await verifyJWT(token, jwtSecret, jwks)) as SignedToken	×
65	} catch (e) {
UNCOV 66	const err = e as Error	×
UNCOV 67	throw ERRORS.InvalidJWT(err)	×
68	}
69
UNCOV 70	const { url, transformations, exp } = payload	×
71
UNCOV 72	const path = `${request.params.bucketName}/${request.params['*']}`	×
73
UNCOV 74	if (url !== path) {	×
UNCOV 75	throw ERRORS.InvalidSignature()	×
76	}
77
UNCOV 78	const s3Key = `${request.tenantId}/${url}`	×
79
UNCOV 80	const [bucketName, ...objParts] = url.split('/')	×
UNCOV 81	const obj = await request.storage	×
82	.asSuperUser()
83	.from(bucketName)
84	.findObject(objParts.join('/'), 'id,version,metadata')
85
UNCOV 86	const renderer = request.storage.renderer('image') as ImageRenderer	×
87
UNCOV 88	if (isMultitenant) {	×
89	const tenantConfig = await getTenantConfig(request.tenantId)	×
90	renderer.setLimits({	×
91	maxResolution: tenantConfig.features.imageTransformation.maxResolution,
92	})
93	}
94
UNCOV 95	return renderer	×
96	.setTransformationsFromString(transformations \|\| '')	×
97	.render(request, response, {
98	bucket: storageS3Bucket,
99	key: s3Key,
100	version: obj.version,
101	download,
102	expires: new Date(exp * 1000).toUTCString(),
103	xRobotsTag: obj.metadata?.['xRobotsTag'] as string \| undefined,
104	signal: request.signals.disconnect.signal,
105	})
106	}
107	)
108	}

supabase / storage / 25738155938

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous