feat(transfers): add PicTransfer — cross-event file transfers (#998)
Closes #997. Send original files from any event as a token-protected download link, with an optional client-upload channel. Strictly opt-in behind a new `transfers` feature flag, default OFF. Migrations 170-172 (transfers, transfer_files, transfer_extra_files, transfer_uploads, transfer_recipients, transfer_downloads, default settings and two email templates) — all hasTable/hasColumn-guarded and idempotent, with destructive statements confined to down(). Backend: transferService (CRUD, 256-bit download token, 6-char upload token, cross-event ZIP streaming of originals), admin CRUD routes, and two public token routes. transferCleanupService runs an hourly retention sweep; source-event photos are never touched. All three routers fail closed via requireFeatureFlag('transfers'). Review closed two ownership blockers, both the same root cause — permissions used where ownership was needed: - photoIds arrived from the request body and were validated only for existence, so a scoped admin could bundle any event's originals and hand them out through the public download token. filterOwnedPhotoIds now resolves ids to their events and gates them through filterOwnedEventIds, on both the create and add-files paths. - The transfer list was unscoped and carried each row's download token, so any admin with events.view could read another's token and fetch their originals. The list is now scoped by created_by, the token/url fields are stripped from the list payload, and a single router.use('/:id', requireTransferOwnership) covers all twelve /:id routes, 404ing foreign and missing alike. The admin photo picker filters its event list to the same rule, so the UI stops offering picks the API would discard. Fork-PR workflows had not been approved since the fix commits, so the PR's green checks were stale against the pre-fix head. Verified by dispatching tests.yml against the actual head: backend and frontend both green. Follow-up: neither ownership guard has a regression test yet. Co-authored-by: Luca-Timo <[email protected]>
This commit is contained in:
Luca
@@ -0,0 +1,78 @@
|
||||
/**
|
||||
* Unit tests for the pure gating logic in transferService (PicTransfer, #997).
|
||||
* These exercise the download/upload eligibility rules without touching the DB.
|
||||
*/
|
||||
const transferService = require('../../src/services/transferService');
|
||||
|
||||
const HOUR = 60 * 60 * 1000;
|
||||
|
||||
function make(overrides = {}) {
|
||||
return {
|
||||
id: 1,
|
||||
title: 'T',
|
||||
is_active: true,
|
||||
deleted_at: null,
|
||||
expires_at: new Date(Date.now() + 24 * HOUR),
|
||||
max_downloads: null,
|
||||
download_count: 0,
|
||||
allow_uploads: false,
|
||||
upload_expires_at: null,
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
describe('transferService.downloadsRemaining', () => {
|
||||
it('returns null (unlimited) when no cap or zero cap', () => {
|
||||
expect(transferService.downloadsRemaining(make({ max_downloads: null }))).toBeNull();
|
||||
expect(transferService.downloadsRemaining(make({ max_downloads: 0 }))).toBeNull();
|
||||
});
|
||||
|
||||
it('returns the remaining count and never goes negative', () => {
|
||||
expect(transferService.downloadsRemaining(make({ max_downloads: 5, download_count: 2 }))).toBe(3);
|
||||
expect(transferService.downloadsRemaining(make({ max_downloads: 5, download_count: 9 }))).toBe(0);
|
||||
});
|
||||
});
|
||||
|
||||
describe('transferService.computeStatus', () => {
|
||||
it('is deleted when deleted_at set, regardless of activity', () => {
|
||||
expect(transferService.computeStatus(make({ deleted_at: new Date(), is_active: true }))).toBe('deleted');
|
||||
});
|
||||
it('is expired when inactive or past expiry', () => {
|
||||
expect(transferService.computeStatus(make({ is_active: false }))).toBe('expired');
|
||||
expect(transferService.computeStatus(make({ expires_at: new Date(Date.now() - HOUR) }))).toBe('expired');
|
||||
});
|
||||
it('is active within the window', () => {
|
||||
expect(transferService.computeStatus(make())).toBe('active');
|
||||
});
|
||||
});
|
||||
|
||||
describe('transferService.assertDownloadable', () => {
|
||||
it('allows a live, in-window, uncapped transfer', () => {
|
||||
expect(transferService.assertDownloadable(make()).ok).toBe(true);
|
||||
});
|
||||
it('404s a missing/deleted transfer', () => {
|
||||
expect(transferService.assertDownloadable(null)).toMatchObject({ ok: false, status: 404 });
|
||||
expect(transferService.assertDownloadable(make({ deleted_at: new Date() }))).toMatchObject({ ok: false, status: 404 });
|
||||
});
|
||||
it('410s when disabled or expired', () => {
|
||||
expect(transferService.assertDownloadable(make({ is_active: false }))).toMatchObject({ ok: false, code: 'TRANSFER_DISABLED', status: 410 });
|
||||
expect(transferService.assertDownloadable(make({ expires_at: new Date(Date.now() - HOUR) }))).toMatchObject({ ok: false, code: 'TRANSFER_EXPIRED', status: 410 });
|
||||
});
|
||||
it('410s when the download cap is reached', () => {
|
||||
expect(transferService.assertDownloadable(make({ max_downloads: 2, download_count: 2 })))
|
||||
.toMatchObject({ ok: false, code: 'DOWNLOAD_LIMIT_REACHED', status: 410 });
|
||||
});
|
||||
});
|
||||
|
||||
describe('transferService.assertUploadable', () => {
|
||||
it('403s when uploads are disabled', () => {
|
||||
expect(transferService.assertUploadable(make({ allow_uploads: false }))).toMatchObject({ ok: false, code: 'UPLOADS_DISABLED', status: 403 });
|
||||
});
|
||||
it('allows when uploads enabled and not expired', () => {
|
||||
expect(transferService.assertUploadable(make({ allow_uploads: true })).ok).toBe(true);
|
||||
});
|
||||
it('410s when the upload window has passed', () => {
|
||||
expect(transferService.assertUploadable(make({ allow_uploads: true, upload_expires_at: new Date(Date.now() - HOUR) })))
|
||||
.toMatchObject({ ok: false, code: 'UPLOAD_EXPIRED', status: 410 });
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,244 @@
|
||||
/**
|
||||
* Migration 170: PicTransfer — cross-event file transfers (#997).
|
||||
*
|
||||
* Adds the tables that back the "send these files to someone" feature:
|
||||
*
|
||||
* transfers One share link. Bundles photos picked from ANY event,
|
||||
* protected by a 64-hex recipient token. Optionally opens
|
||||
* a 6-char upload token so the client can send files back
|
||||
* (logos etc.). Disabled after `expires_at`; files are
|
||||
* kept `grace_days` days past disable, then hard-deleted.
|
||||
* transfer_files Join rows: which photos are in a transfer (cross-event).
|
||||
* photo_id → photos CASCADE, so removing the underlying
|
||||
* photo just drops it from the transfer; the reverse
|
||||
* (deleting a transfer) never touches the source photos.
|
||||
* transfer_uploads Files the client uploaded through the upload token.
|
||||
* These have their own bytes on disk (uploads/transfers/…)
|
||||
* and are what the retention sweep deletes.
|
||||
* transfer_downloads Lightweight audit of recipient downloads (count + IP).
|
||||
*
|
||||
* Downloads always serve ORIGINAL files (never watermarked) — a transfer is a
|
||||
* deliberate "here are your files" hand-off. Reuses the same original-file
|
||||
* resolution + archiver streaming as the gallery download-all path.
|
||||
*/
|
||||
|
||||
exports.up = async function (knex) {
|
||||
if (!(await knex.schema.hasTable('transfers'))) {
|
||||
await knex.schema.createTable('transfers', (table) => {
|
||||
table.increments('id').primary();
|
||||
// Recipient download token — 64 hex chars = 32 bytes = 256 bits.
|
||||
table.string('token', 64).notNullable().unique();
|
||||
table.string('title', 255).notNullable().defaultTo('');
|
||||
table.text('message');
|
||||
table.integer('created_by').unsigned()
|
||||
.references('id').inTable('admin_users').onDelete('SET NULL');
|
||||
// Link is disabled once this passes (the "set time period" cap).
|
||||
table.timestamp('expires_at').notNullable();
|
||||
// Optional download cap. NULL or 0 = unlimited within the window.
|
||||
table.integer('max_downloads');
|
||||
table.integer('download_count').notNullable().defaultTo(0);
|
||||
table.boolean('is_active').notNullable().defaultTo(true);
|
||||
// When the link flipped inactive — starts the retention clock.
|
||||
table.timestamp('disabled_at');
|
||||
// Keep files this many days after disable, then hard-delete.
|
||||
table.integer('grace_days').notNullable().defaultTo(7);
|
||||
table.timestamp('admin_notified_at');
|
||||
table.timestamp('deleted_at');
|
||||
// Optional client-upload channel (6-char token).
|
||||
table.boolean('allow_uploads').notNullable().defaultTo(false);
|
||||
table.string('upload_token', 16).unique();
|
||||
table.timestamp('upload_expires_at');
|
||||
table.timestamp('created_at').defaultTo(knex.fn.now());
|
||||
table.timestamp('updated_at').defaultTo(knex.fn.now());
|
||||
table.index(['is_active', 'expires_at'], 'transfers_active_expiry_idx');
|
||||
table.index(['deleted_at'], 'transfers_deleted_idx');
|
||||
});
|
||||
}
|
||||
|
||||
if (!(await knex.schema.hasTable('transfer_files'))) {
|
||||
await knex.schema.createTable('transfer_files', (table) => {
|
||||
table.increments('id').primary();
|
||||
table.integer('transfer_id').unsigned().notNullable()
|
||||
.references('id').inTable('transfers').onDelete('CASCADE');
|
||||
table.integer('photo_id').unsigned().notNullable()
|
||||
.references('id').inTable('photos').onDelete('CASCADE');
|
||||
table.integer('sort_order').notNullable().defaultTo(0);
|
||||
table.timestamp('created_at').defaultTo(knex.fn.now());
|
||||
table.index(['transfer_id'], 'transfer_files_transfer_idx');
|
||||
// A photo can only appear once per transfer.
|
||||
table.unique(['transfer_id', 'photo_id'], 'transfer_files_unique');
|
||||
});
|
||||
}
|
||||
|
||||
if (!(await knex.schema.hasTable('transfer_uploads'))) {
|
||||
await knex.schema.createTable('transfer_uploads', (table) => {
|
||||
table.increments('id').primary();
|
||||
table.integer('transfer_id').unsigned().notNullable()
|
||||
.references('id').inTable('transfers').onDelete('CASCADE');
|
||||
table.string('original_filename', 512).notNullable();
|
||||
// Storage-relative key, e.g. uploads/transfers/{id}/{stored-name}.
|
||||
table.string('stored_path', 1024).notNullable();
|
||||
table.integer('size_bytes');
|
||||
table.string('mime_type', 100);
|
||||
table.string('uploader_ip', 45);
|
||||
table.timestamp('uploaded_at').defaultTo(knex.fn.now());
|
||||
table.index(['transfer_id'], 'transfer_uploads_transfer_idx');
|
||||
});
|
||||
}
|
||||
|
||||
if (!(await knex.schema.hasTable('transfer_downloads'))) {
|
||||
await knex.schema.createTable('transfer_downloads', (table) => {
|
||||
table.increments('id').primary();
|
||||
table.integer('transfer_id').unsigned().notNullable()
|
||||
.references('id').inTable('transfers').onDelete('CASCADE');
|
||||
table.string('kind', 20).notNullable().defaultTo('all'); // 'all' | 'single'
|
||||
table.integer('photo_id').unsigned();
|
||||
table.string('ip', 45);
|
||||
table.timestamp('downloaded_at').defaultTo(knex.fn.now());
|
||||
table.index(['transfer_id'], 'transfer_downloads_transfer_idx');
|
||||
});
|
||||
}
|
||||
|
||||
// Defaults for the create-transfer form + retention/upload behaviour.
|
||||
const settings = [
|
||||
{ setting_key: 'transfer_default_expiry_days', setting_value: JSON.stringify(14), setting_type: 'number' },
|
||||
{ setting_key: 'transfer_default_grace_days', setting_value: JSON.stringify(7), setting_type: 'number' },
|
||||
{ setting_key: 'transfer_default_max_downloads', setting_value: JSON.stringify(0), setting_type: 'number' },
|
||||
{ setting_key: 'transfer_max_upload_size_mb', setting_value: JSON.stringify(50), setting_type: 'number' },
|
||||
{
|
||||
setting_key: 'transfer_upload_allowed_mime',
|
||||
setting_value: JSON.stringify([
|
||||
'image/jpeg', 'image/png', 'image/webp', 'image/gif',
|
||||
'image/tiff', 'application/pdf', 'application/zip',
|
||||
]),
|
||||
setting_type: 'general',
|
||||
},
|
||||
];
|
||||
for (const s of settings) {
|
||||
const exists = await knex('app_settings').where('setting_key', s.setting_key).first();
|
||||
if (!exists) {
|
||||
await knex('app_settings').insert({ ...s, updated_at: knex.fn.now() });
|
||||
}
|
||||
}
|
||||
|
||||
// Feature flag — PicTransfer is a strictly opt-in module like slideshow /
|
||||
// workflows: the sidebar entry, the /admin/transfers area and every
|
||||
// transfer route (admin + public) stay dark until an admin turns it on
|
||||
// under Settings → Features. Default OFF; idempotent seed.
|
||||
if (await knex.schema.hasTable('feature_flags')) {
|
||||
const existingFlag = await knex('feature_flags').where({ key: 'transfers' }).first();
|
||||
if (!existingFlag) {
|
||||
await knex('feature_flags').insert({ key: 'transfers', value: false });
|
||||
}
|
||||
}
|
||||
|
||||
// Admin notification when a transfer link expires (EN + DE, matching the
|
||||
// convention of the other admin-notification templates — see migration 087).
|
||||
const existingTemplate = await knex('email_templates')
|
||||
.where('template_key', 'transfer_link_expired')
|
||||
.first();
|
||||
if (!existingTemplate) {
|
||||
await knex('email_templates').insert({
|
||||
template_key: 'transfer_link_expired',
|
||||
subject_en: 'A transfer link has expired — {{transfer_title}}',
|
||||
subject_de: 'Ein Transfer-Link ist abgelaufen — {{transfer_title}}',
|
||||
body_html_en: `
|
||||
<h2>A transfer link has expired</h2>
|
||||
|
||||
<p>The following file transfer is no longer downloadable by its recipient:</p>
|
||||
|
||||
<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
|
||||
<p style="margin: 0;"><strong>Transfer:</strong> {{transfer_title}}</p>
|
||||
<p style="margin: 10px 0 0 0;"><strong>Expired at:</strong> {{expiry_date}}</p>
|
||||
<p style="margin: 10px 0 0 0;"><strong>Files included:</strong> {{file_count}}</p>
|
||||
<p style="margin: 10px 0 0 0;"><strong>Client uploads received:</strong> {{upload_count}}</p>
|
||||
</div>
|
||||
|
||||
<p>The files will be kept for {{grace_days}} more days (until {{delete_date}})
|
||||
so you can re-share or retrieve anything you still need, then they are
|
||||
automatically deleted.</p>
|
||||
|
||||
<p><a href="{{admin_url}}">Open PicTransfer in the admin area</a></p>
|
||||
|
||||
<p>Best regards,<br>
|
||||
Your PicPeak Installation</p>`,
|
||||
body_text_en: `A transfer link has expired
|
||||
|
||||
The following file transfer is no longer downloadable by its recipient:
|
||||
|
||||
Transfer: {{transfer_title}}
|
||||
Expired at: {{expiry_date}}
|
||||
Files included: {{file_count}}
|
||||
Client uploads received: {{upload_count}}
|
||||
|
||||
The files will be kept for {{grace_days}} more days (until {{delete_date}}) so
|
||||
you can re-share or retrieve anything you still need, then they are
|
||||
automatically deleted.
|
||||
|
||||
Open PicTransfer in the admin area: {{admin_url}}
|
||||
|
||||
Best regards,
|
||||
Your PicPeak Installation`,
|
||||
body_html_de: `
|
||||
<h2>Ein Transfer-Link ist abgelaufen</h2>
|
||||
|
||||
<p>Der folgende Datei-Transfer kann vom Empfänger nicht mehr heruntergeladen werden:</p>
|
||||
|
||||
<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
|
||||
<p style="margin: 0;"><strong>Transfer:</strong> {{transfer_title}}</p>
|
||||
<p style="margin: 10px 0 0 0;"><strong>Abgelaufen am:</strong> {{expiry_date}}</p>
|
||||
<p style="margin: 10px 0 0 0;"><strong>Enthaltene Dateien:</strong> {{file_count}}</p>
|
||||
<p style="margin: 10px 0 0 0;"><strong>Empfangene Kunden-Uploads:</strong> {{upload_count}}</p>
|
||||
</div>
|
||||
|
||||
<p>Die Dateien werden noch {{grace_days}} Tage aufbewahrt (bis {{delete_date}}),
|
||||
damit Sie alles Benötigte erneut teilen oder abrufen können; danach werden sie
|
||||
automatisch gelöscht.</p>
|
||||
|
||||
<p><a href="{{admin_url}}">PicTransfer im Admin-Bereich öffnen</a></p>
|
||||
|
||||
<p>Mit freundlichen Grüßen,<br>
|
||||
Ihre PicPeak-Installation</p>`,
|
||||
body_text_de: `Ein Transfer-Link ist abgelaufen
|
||||
|
||||
Der folgende Datei-Transfer kann vom Empfänger nicht mehr heruntergeladen werden:
|
||||
|
||||
Transfer: {{transfer_title}}
|
||||
Abgelaufen am: {{expiry_date}}
|
||||
Enthaltene Dateien: {{file_count}}
|
||||
Empfangene Kunden-Uploads: {{upload_count}}
|
||||
|
||||
Die Dateien werden noch {{grace_days}} Tage aufbewahrt (bis {{delete_date}}),
|
||||
danach werden sie automatisch gelöscht.
|
||||
|
||||
PicTransfer im Admin-Bereich öffnen: {{admin_url}}
|
||||
|
||||
Mit freundlichen Grüßen,
|
||||
Ihre PicPeak-Installation`,
|
||||
variables: JSON.stringify([
|
||||
'transfer_title', 'expiry_date', 'file_count', 'upload_count',
|
||||
'grace_days', 'delete_date', 'admin_url',
|
||||
]),
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
exports.down = async function (knex) {
|
||||
if (await knex.schema.hasTable('feature_flags')) {
|
||||
await knex('feature_flags').where({ key: 'transfers' }).del();
|
||||
}
|
||||
await knex('email_templates').where('template_key', 'transfer_link_expired').del();
|
||||
await knex('app_settings')
|
||||
.whereIn('setting_key', [
|
||||
'transfer_default_expiry_days',
|
||||
'transfer_default_grace_days',
|
||||
'transfer_default_max_downloads',
|
||||
'transfer_max_upload_size_mb',
|
||||
'transfer_upload_allowed_mime',
|
||||
])
|
||||
.del();
|
||||
await knex.schema.dropTableIfExists('transfer_downloads');
|
||||
await knex.schema.dropTableIfExists('transfer_uploads');
|
||||
await knex.schema.dropTableIfExists('transfer_files');
|
||||
await knex.schema.dropTableIfExists('transfers');
|
||||
};
|
||||
@@ -0,0 +1,157 @@
|
||||
/**
|
||||
* Migration 171: PicTransfer — admin-uploaded deliverable files + email delivery
|
||||
* (follow-up to #997).
|
||||
*
|
||||
* 170 shipped the base feature; this adds two things the create flow now needs:
|
||||
*
|
||||
* transfer_extra_files Files the ADMIN uploads straight into a transfer at
|
||||
* creation (or later), stored as the transfer's own
|
||||
* bytes under `transfers/{id}/files/…`. Unlike
|
||||
* transfer_files (which reference gallery `photos`),
|
||||
* these have no event/photo — they are the operator's
|
||||
* own attachments and are part of the recipient's
|
||||
* download alongside the picked event photos. Deleted
|
||||
* with the transfer (retention sweep / hard delete).
|
||||
* transfer_recipients When a transfer is delivered by email, the recipient
|
||||
* address(es) it was sent to (audit + "sent to …" in the
|
||||
* detail panel). CASCADE with the transfer.
|
||||
*
|
||||
* Plus `transfers.delivery_method` ('link' | 'email', default 'link') and a
|
||||
* recipient-facing `transfer_ready` email template (EN/DE).
|
||||
*
|
||||
* 170 is already applied on existing installs, so this is a separate, additive
|
||||
* migration (Knex won't re-run 170). Fully guarded + idempotent.
|
||||
*/
|
||||
|
||||
exports.up = async function (knex) {
|
||||
if (!(await knex.schema.hasTable('transfer_extra_files'))) {
|
||||
await knex.schema.createTable('transfer_extra_files', (table) => {
|
||||
table.increments('id').primary();
|
||||
table.integer('transfer_id').unsigned().notNullable()
|
||||
.references('id').inTable('transfers').onDelete('CASCADE');
|
||||
table.string('original_filename', 512).notNullable();
|
||||
// Storage-relative key, e.g. transfers/{id}/files/{stored-name}.
|
||||
table.string('stored_path', 1024).notNullable();
|
||||
table.integer('size_bytes');
|
||||
table.string('mime_type', 100);
|
||||
table.integer('sort_order').notNullable().defaultTo(0);
|
||||
table.timestamp('created_at').defaultTo(knex.fn.now());
|
||||
table.index(['transfer_id'], 'transfer_extra_files_transfer_idx');
|
||||
});
|
||||
}
|
||||
|
||||
if (!(await knex.schema.hasTable('transfer_recipients'))) {
|
||||
await knex.schema.createTable('transfer_recipients', (table) => {
|
||||
table.increments('id').primary();
|
||||
table.integer('transfer_id').unsigned().notNullable()
|
||||
.references('id').inTable('transfers').onDelete('CASCADE');
|
||||
table.string('email', 320).notNullable();
|
||||
table.timestamp('created_at').defaultTo(knex.fn.now());
|
||||
table.timestamp('last_sent_at');
|
||||
table.index(['transfer_id'], 'transfer_recipients_transfer_idx');
|
||||
});
|
||||
}
|
||||
|
||||
const hasDeliveryMethod = await knex.schema.hasColumn('transfers', 'delivery_method');
|
||||
if (!hasDeliveryMethod) {
|
||||
await knex.schema.alterTable('transfers', (table) => {
|
||||
// 'link' (default — the operator copies/shares the link themselves) or
|
||||
// 'email' (PicPeak emailed the download link to transfer_recipients).
|
||||
table.string('delivery_method', 10).notNullable().defaultTo('link');
|
||||
});
|
||||
}
|
||||
|
||||
// Recipient-facing "your files are ready" email (EN + DE), sent when a
|
||||
// transfer is created with delivery_method='email'. Mirrors the convention
|
||||
// of the existing transfer_link_expired admin template (migration 170).
|
||||
const existingTemplate = await knex('email_templates')
|
||||
.where('template_key', 'transfer_ready')
|
||||
.first();
|
||||
if (!existingTemplate) {
|
||||
await knex('email_templates').insert({
|
||||
template_key: 'transfer_ready',
|
||||
subject_en: 'Your files are ready — {{transfer_title}}',
|
||||
subject_de: 'Ihre Dateien sind bereit — {{transfer_title}}',
|
||||
body_html_en: `
|
||||
<h2>Your files are ready</h2>
|
||||
|
||||
<p>{{transfer_title}} has been shared with you.</p>
|
||||
|
||||
<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
|
||||
<p style="margin: 0;">{{message}}</p>
|
||||
</div>
|
||||
|
||||
<p style="margin: 24px 0;">
|
||||
<a href="{{download_url}}" class="button">Download your files</a>
|
||||
</p>
|
||||
|
||||
<p><strong>Files:</strong> {{file_count}}<br>
|
||||
<strong>Available until:</strong> {{expiry_date}}</p>
|
||||
|
||||
<p style="color: #888; font-size: 13px;">If the button doesn't work, copy this link into your browser:<br>{{download_url}}</p>
|
||||
|
||||
<p>Best regards,<br>
|
||||
Your PicPeak Installation</p>`,
|
||||
body_text_en: `Your files are ready
|
||||
|
||||
{{transfer_title}} has been shared with you.
|
||||
|
||||
{{message}}
|
||||
|
||||
Download your files: {{download_url}}
|
||||
|
||||
Files: {{file_count}}
|
||||
Available until: {{expiry_date}}
|
||||
|
||||
Best regards,
|
||||
Your PicPeak Installation`,
|
||||
body_html_de: `
|
||||
<h2>Ihre Dateien sind bereit</h2>
|
||||
|
||||
<p>{{transfer_title}} wurde mit Ihnen geteilt.</p>
|
||||
|
||||
<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
|
||||
<p style="margin: 0;">{{message}}</p>
|
||||
</div>
|
||||
|
||||
<p style="margin: 24px 0;">
|
||||
<a href="{{download_url}}" class="button">Dateien herunterladen</a>
|
||||
</p>
|
||||
|
||||
<p><strong>Dateien:</strong> {{file_count}}<br>
|
||||
<strong>Verfügbar bis:</strong> {{expiry_date}}</p>
|
||||
|
||||
<p style="color: #888; font-size: 13px;">Falls die Schaltfläche nicht funktioniert, kopieren Sie diesen Link in Ihren Browser:<br>{{download_url}}</p>
|
||||
|
||||
<p>Mit freundlichen Grüßen,<br>
|
||||
Ihre PicPeak-Installation</p>`,
|
||||
body_text_de: `Ihre Dateien sind bereit
|
||||
|
||||
{{transfer_title}} wurde mit Ihnen geteilt.
|
||||
|
||||
{{message}}
|
||||
|
||||
Dateien herunterladen: {{download_url}}
|
||||
|
||||
Dateien: {{file_count}}
|
||||
Verfügbar bis: {{expiry_date}}
|
||||
|
||||
Mit freundlichen Grüßen,
|
||||
Ihre PicPeak-Installation`,
|
||||
variables: JSON.stringify([
|
||||
'transfer_title', 'message', 'download_url', 'file_count', 'expiry_date',
|
||||
]),
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
exports.down = async function (knex) {
|
||||
await knex('email_templates').where('template_key', 'transfer_ready').del();
|
||||
if (await knex.schema.hasColumn('transfers', 'delivery_method')) {
|
||||
await knex.schema.alterTable('transfers', (table) => {
|
||||
table.dropColumn('delivery_method');
|
||||
});
|
||||
}
|
||||
await knex.schema.dropTableIfExists('transfer_recipients');
|
||||
await knex.schema.dropTableIfExists('transfer_extra_files');
|
||||
};
|
||||
@@ -0,0 +1,109 @@
|
||||
/**
|
||||
* Migration 172: reword the recipient `transfer_ready` email (follow-up to 171).
|
||||
*
|
||||
* Two fixes to the copy seeded in 171:
|
||||
* 1. Warmer, less robotic wording (greeting + natural phrasing + friendly
|
||||
* sign-off) instead of the terse "has been shared with you" notice.
|
||||
* 2. The message block is wrapped in `{{#if message}}` so a transfer sent
|
||||
* WITHOUT a personal note no longer renders an empty coloured box (the
|
||||
* "grey bar" some clients showed for the always-present empty <div>).
|
||||
*
|
||||
* This is a content UPDATE rather than an edit to 171 because 171 has already
|
||||
* been applied on existing installs — Knex won't re-run it, so the seeded row
|
||||
* would otherwise keep the old copy. UPDATE reaches both existing rows and
|
||||
* fresh installs (which run 171's insert first, then this).
|
||||
*/
|
||||
|
||||
const HTML_EN = `
|
||||
<h2>Your files are ready</h2>
|
||||
|
||||
<p>Hi,</p>
|
||||
|
||||
<p>{{transfer_title}} is ready for you — you can grab everything with a single click below.</p>
|
||||
|
||||
{{#if message}}
|
||||
<div style="background-color: #f6f6f4; border-left: 4px solid #5C8762; padding: 16px 20px; margin: 20px 0; border-radius: 4px; white-space: pre-line;">{{message}}</div>
|
||||
{{/if}}
|
||||
|
||||
<p style="margin: 28px 0;">
|
||||
<a href="{{download_url}}" class="button">Download your files</a>
|
||||
</p>
|
||||
|
||||
<p style="color: #555555;">The link stays active until {{expiry_date}} and includes {{file_count}} file(s).</p>
|
||||
|
||||
<p style="color: #999999; font-size: 13px;">Button not working? Just copy this link into your browser:<br>{{download_url}}</p>
|
||||
|
||||
<p>Enjoy your photos!</p>`;
|
||||
|
||||
const TEXT_EN = `Your files are ready
|
||||
|
||||
Hi,
|
||||
|
||||
{{transfer_title}} is ready for you — grab everything with the link below.
|
||||
{{#if message}}
|
||||
|
||||
{{message}}
|
||||
{{/if}}
|
||||
|
||||
Download your files:
|
||||
{{download_url}}
|
||||
|
||||
The link stays active until {{expiry_date}} and includes {{file_count}} file(s).
|
||||
|
||||
Enjoy your photos!`;
|
||||
|
||||
const HTML_DE = `
|
||||
<h2>Ihre Dateien sind bereit</h2>
|
||||
|
||||
<p>Hallo,</p>
|
||||
|
||||
<p>{{transfer_title}} ist für Sie bereit — mit einem Klick unten können Sie alles herunterladen.</p>
|
||||
|
||||
{{#if message}}
|
||||
<div style="background-color: #f6f6f4; border-left: 4px solid #5C8762; padding: 16px 20px; margin: 20px 0; border-radius: 4px; white-space: pre-line;">{{message}}</div>
|
||||
{{/if}}
|
||||
|
||||
<p style="margin: 28px 0;">
|
||||
<a href="{{download_url}}" class="button">Dateien herunterladen</a>
|
||||
</p>
|
||||
|
||||
<p style="color: #555555;">Der Link ist bis zum {{expiry_date}} gültig und enthält {{file_count}} Datei(en).</p>
|
||||
|
||||
<p style="color: #999999; font-size: 13px;">Funktioniert die Schaltfläche nicht? Kopieren Sie einfach diesen Link in Ihren Browser:<br>{{download_url}}</p>
|
||||
|
||||
<p>Viel Freude mit Ihren Fotos!</p>`;
|
||||
|
||||
const TEXT_DE = `Ihre Dateien sind bereit
|
||||
|
||||
Hallo,
|
||||
|
||||
{{transfer_title}} ist für Sie bereit — laden Sie alles über den Link unten herunter.
|
||||
{{#if message}}
|
||||
|
||||
{{message}}
|
||||
{{/if}}
|
||||
|
||||
Dateien herunterladen:
|
||||
{{download_url}}
|
||||
|
||||
Der Link ist bis zum {{expiry_date}} gültig und enthält {{file_count}} Datei(en).
|
||||
|
||||
Viel Freude mit Ihren Fotos!`;
|
||||
|
||||
exports.up = async function (knex) {
|
||||
if (!(await knex.schema.hasTable('email_templates'))) return;
|
||||
await knex('email_templates')
|
||||
.where('template_key', 'transfer_ready')
|
||||
.update({
|
||||
subject_en: '{{transfer_title}} — your files are ready to download',
|
||||
subject_de: '{{transfer_title}} — Ihre Dateien stehen bereit',
|
||||
body_html_en: HTML_EN,
|
||||
body_text_en: TEXT_EN,
|
||||
body_html_de: HTML_DE,
|
||||
body_text_de: TEXT_DE,
|
||||
});
|
||||
};
|
||||
|
||||
// Content-only refresh — nothing structural to reverse. The previous copy is
|
||||
// preserved in migration 171's insert for reference.
|
||||
exports.down = async function () {};
|
||||
@@ -20,6 +20,7 @@ const path = require('path');
|
||||
const { initializeDatabase, db } = require('./src/database/db');
|
||||
const { startFileWatcher } = require('./src/services/fileWatcher');
|
||||
const { startExpirationChecker } = require('./src/services/expirationChecker');
|
||||
const { startTransferCleanup } = require('./src/services/transferCleanupService');
|
||||
const { startRevealScheduler } = require('./src/services/revealScheduler');
|
||||
const { startInvoiceScheduler } = require('./src/services/invoiceSchedulerService');
|
||||
const { initializeTransporter, startEmailQueueProcessor } = require('./src/services/emailProcessor');
|
||||
@@ -785,8 +786,12 @@ app.use('/api/admin/ledger', require('./src/routes/adminLedger'));
|
||||
app.use('/api/admin/vat-codes', require('./src/routes/adminVatCodes'));
|
||||
app.use('/api/admin/system-health', require('./src/routes/adminSystemHealth'));
|
||||
app.use('/api/admin/dev', require('./src/routes/adminDev'));
|
||||
app.use('/api/admin/transfers', require('./src/routes/adminTransfers'));
|
||||
app.use('/api/public/quotes', require('./src/routes/publicQuotes'));
|
||||
app.use('/api/public/contracts', require('./src/routes/publicContracts'));
|
||||
// PicTransfer (#997): recipient download + client upload, token-authenticated.
|
||||
app.use('/api/public/transfer', require('./src/routes/publicTransfer'));
|
||||
app.use('/api/public/transfer-upload', require('./src/routes/publicTransferUpload'));
|
||||
app.use('/api/public/payment-check', require('./src/routes/publicPaymentCheck'));
|
||||
app.use('/api/public/workflow-approvals', require('./src/routes/publicWorkflowApprovals'));
|
||||
app.use('/api/admin/event-types', require('./src/routes/adminEventTypes'));
|
||||
@@ -904,6 +909,9 @@ async function startServer() {
|
||||
|
||||
// Start expiration checker
|
||||
startExpirationChecker();
|
||||
// PicTransfer retention sweep (#997): expire links, notify admins, and
|
||||
// hard-delete client uploads once the grace window elapses.
|
||||
startTransferCleanup();
|
||||
// Reveal-mode scheduler (#838): minutely stamp for scheduled reveals.
|
||||
startRevealScheduler();
|
||||
// CRM invoice scheduler: hourly tick to flush scheduled-send invoices
|
||||
|
||||
@@ -88,6 +88,11 @@ const KNOWN_FLAGS = [
|
||||
// per-event-type presets and global watermark defaults tab. Strictly opt-in;
|
||||
// gates all slideshow admin UI (per-event card, type preset, settings tab).
|
||||
'slideshow',
|
||||
// PicTransfer (migration 170) — cross-event file transfers
|
||||
// (recipient download link + optional client-upload channel). Strictly
|
||||
// opt-in; gates the sidebar entry, the /admin/transfers area AND every
|
||||
// transfer route (admin + public token routes).
|
||||
'transfers',
|
||||
// Workflow / automation engine — admin-configurable visual flows (triggers,
|
||||
// conditions, branches, loops, approval gates). Strictly opt-in; master
|
||||
// kill-switch for the Workflows admin area AND the engine's runtime side
|
||||
@@ -122,6 +127,7 @@ const DEFAULT_FLAGS = {
|
||||
projects: false,
|
||||
whatsapp: false,
|
||||
slideshow: false,
|
||||
transfers: false,
|
||||
workflows: false,
|
||||
};
|
||||
|
||||
|
||||
@@ -0,0 +1,394 @@
|
||||
/**
|
||||
* Admin → Transfers routes (PicTransfer, #997).
|
||||
*
|
||||
* Mounted at /api/admin/transfers. A transfer bundles ORIGINAL photos picked
|
||||
* from any event into a token-protected download link, and can optionally open
|
||||
* a short upload token so the client can send files back.
|
||||
*
|
||||
* Read = `events.view`; write = `events.edit` (transfers are an
|
||||
* events/photos-adjacent admin tool, so they ride the same permissions as the
|
||||
* projects cockpit rather than inventing a new permission).
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const { body, param } = require('express-validator');
|
||||
const multer = require('multer');
|
||||
const path = require('path');
|
||||
const { adminAuth } = require('../middleware/auth');
|
||||
const { requirePermission } = require('../middleware/permissions');
|
||||
const { requireFeatureFlag } = require('../middleware/requireFeatureFlag');
|
||||
const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
|
||||
const { validateFileType } = require('../utils/fileSecurityUtils');
|
||||
const { sanitizeFilename } = require('../utils/filenameSanitizer');
|
||||
const { getAppSetting } = require('../utils/appSettings');
|
||||
const { getStorage } = require('../services/storage');
|
||||
const transferService = require('../services/transferService');
|
||||
const logger = require('../utils/logger');
|
||||
const fs = require('fs');
|
||||
|
||||
const router = express.Router();
|
||||
|
||||
// --- Admin deliverable-file upload (the files dropped into a transfer) --------
|
||||
// Bytes are written to a temp dir, handed to the storage backend (so S3 works),
|
||||
// then the temp copy is removed — same shape as the public client-upload route.
|
||||
const ADMIN_MAX_FILES = 50;
|
||||
const DEFAULT_ALLOWED = ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/tiff', 'application/pdf', 'application/zip'];
|
||||
const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
|
||||
|
||||
const tempStorage = multer.diskStorage({
|
||||
destination: (req, file, cb) => {
|
||||
const dir = path.join(getStoragePath(), 'temp', 'transfer-admin-uploads');
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
cb(null, dir);
|
||||
},
|
||||
filename: (req, file, cb) => {
|
||||
const safe = sanitizeFilename(path.basename(file.originalname), 80) || 'file';
|
||||
cb(null, `${Date.now()}-${Math.round(Math.random() * 1e6)}-${safe}`);
|
||||
},
|
||||
});
|
||||
|
||||
function buildAdminUploader(maxSizeBytes, allowed) {
|
||||
return multer({
|
||||
storage: tempStorage,
|
||||
limits: { fileSize: maxSizeBytes, files: ADMIN_MAX_FILES },
|
||||
fileFilter: (req, file, cb) => {
|
||||
if (validateFileType(file.originalname, file.mimetype, allowed)) return cb(null, true);
|
||||
return cb(new Error('This file type is not allowed'));
|
||||
},
|
||||
}).array('files', ADMIN_MAX_FILES);
|
||||
}
|
||||
|
||||
/**
|
||||
* Run multer for a transfer request, reading the size/type limits from settings.
|
||||
* Resolves { ok:true } or sends a 4xx and resolves { ok:false }.
|
||||
*/
|
||||
async function runAdminUpload(req, res) {
|
||||
const maxSizeMb = Number(await getAppSetting('transfer_max_upload_size_mb', 50)) || 50;
|
||||
const allowedSetting = await getAppSetting('transfer_upload_allowed_mime', DEFAULT_ALLOWED);
|
||||
const allowed = Array.isArray(allowedSetting) ? allowedSetting : DEFAULT_ALLOWED;
|
||||
const uploader = buildAdminUploader(maxSizeMb * 1024 * 1024, allowed);
|
||||
try {
|
||||
await new Promise((resolve, reject) => uploader(req, res, (err) => (err ? reject(err) : resolve())));
|
||||
return { ok: true };
|
||||
} catch (err) {
|
||||
const msg = err && err.code === 'LIMIT_FILE_SIZE'
|
||||
? `Each file must be ${maxSizeMb} MB or smaller`
|
||||
: (err && err.message) || 'Upload failed';
|
||||
if (!res.headersSent) res.status(400).json({ error: msg, code: 'UPLOAD_REJECTED' });
|
||||
return { ok: false };
|
||||
}
|
||||
}
|
||||
|
||||
/** Persist the uploaded temp files as the transfer's deliverable extra files. */
|
||||
async function storeExtraFiles(transferId, files) {
|
||||
if (!files || !files.length) return;
|
||||
const storage = getStorage();
|
||||
let i = 0;
|
||||
for (const file of files) {
|
||||
i += 1;
|
||||
const safeName = sanitizeFilename(path.basename(file.originalname), 120) || 'file';
|
||||
const key = path.posix.join(transferService.extraFilesDirKey(transferId), `${Date.now()}-${i}-${safeName}`);
|
||||
try {
|
||||
await storage.putFromFile(key, file.path);
|
||||
await transferService.addExtraFile(transferId, {
|
||||
originalFilename: file.originalname,
|
||||
storedPath: key,
|
||||
sizeBytes: file.size,
|
||||
mimeType: file.mimetype,
|
||||
});
|
||||
} catch (err) {
|
||||
logger.error('adminTransfers: failed to store deliverable file', { transferId, error: err.message });
|
||||
} finally {
|
||||
try { if (fs.existsSync(file.path)) fs.unlinkSync(file.path); } catch (_) { /* noop */ }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Parse a multipart field that carries a JSON array (photoIds, recipientEmails). */
|
||||
function parseJsonArrayField(value) {
|
||||
if (Array.isArray(value)) return value;
|
||||
if (typeof value !== 'string' || !value.trim()) return [];
|
||||
try {
|
||||
const parsed = JSON.parse(value);
|
||||
return Array.isArray(parsed) ? parsed : [];
|
||||
} catch (_) {
|
||||
// Fallback: comma-separated (e.g. a raw "[email protected], [email protected]" email field).
|
||||
return value.split(',').map((s) => s.trim()).filter(Boolean);
|
||||
}
|
||||
}
|
||||
|
||||
router.use(adminAuth);
|
||||
// PicTransfer is a strictly opt-in module — refuse every admin transfer route
|
||||
// when the `transfers` feature flag is off, so a disabled feature is never
|
||||
// actable even by a direct API hit (the sidebar already hides the surface).
|
||||
router.use(requireFeatureFlag('transfers'));
|
||||
|
||||
/**
|
||||
* Ownership guard for every `/:id` route. A non-super_admin may only touch a
|
||||
* transfer they created (or an ownerless legacy row). Foreign AND missing ids
|
||||
* both 404 so the endpoint isn't an existence oracle — the same posture
|
||||
* filterOwnedEventIds takes. super_admin is unrestricted.
|
||||
*/
|
||||
async function requireTransferOwnership(req, res, next) {
|
||||
try {
|
||||
if (req.admin.roleName === 'super_admin') return next();
|
||||
const id = parseInt(req.params.id, 10);
|
||||
if (!Number.isInteger(id) || id < 1) return res.status(400).json({ error: 'Invalid id' });
|
||||
const owner = await transferService.getTransferOwner(id);
|
||||
if (!owner) return res.status(404).json({ error: 'Transfer not found' });
|
||||
if (owner.created_by != null && owner.created_by !== req.admin.id) {
|
||||
return res.status(404).json({ error: 'Transfer not found' });
|
||||
}
|
||||
return next();
|
||||
} catch (err) {
|
||||
return next(err);
|
||||
}
|
||||
}
|
||||
|
||||
// List
|
||||
router.get('/', requirePermission('events.view'), handleAsync(async (req, res) => {
|
||||
const transfers = await transferService.listTransfers({ search: req.query.q || '', admin: req.admin });
|
||||
return successResponse(res, { transfers });
|
||||
}));
|
||||
|
||||
// Create. multipart/form-data: text fields + optional `files` (the operator's
|
||||
// own deliverable files) + `photoIds`/`recipientEmails` as JSON-array fields.
|
||||
// Uploaded files land as transfer_extra_files; delivery_method='email' emails
|
||||
// the recipients the download link.
|
||||
router.post('/',
|
||||
requirePermission('events.edit'),
|
||||
handleAsync(async (req, res) => {
|
||||
const up = await runAdminUpload(req, res);
|
||||
if (!up.ok) return; // 4xx already sent
|
||||
|
||||
const b = req.body || {};
|
||||
const photoIds = parseJsonArrayField(b.photoIds)
|
||||
.map(Number).filter((n) => Number.isInteger(n) && n > 0).slice(0, 5000);
|
||||
const recipientEmails = parseJsonArrayField(b.recipientEmails)
|
||||
.map((e) => String(e || '').trim()).filter(Boolean).slice(0, 100);
|
||||
const deliveryMethod = b.deliveryMethod === 'email' ? 'email' : 'link';
|
||||
|
||||
const transfer = await transferService.createTransfer({
|
||||
title: b.title,
|
||||
message: b.message,
|
||||
expiresInDays: b.expiresInDays,
|
||||
maxDownloads: b.maxDownloads,
|
||||
graceDays: b.graceDays,
|
||||
allowUploads: b.allowUploads === 'true' || b.allowUploads === true,
|
||||
uploadExpiresInDays: b.uploadExpiresInDays,
|
||||
photoIds,
|
||||
deliveryMethod,
|
||||
}, req.admin);
|
||||
|
||||
await storeExtraFiles(transfer.id, req.files);
|
||||
|
||||
if (deliveryMethod === 'email' && recipientEmails.length) {
|
||||
await transferService.sendTransferEmails(transfer.id, recipientEmails);
|
||||
}
|
||||
|
||||
const fresh = await transferService.getTransfer(transfer.id);
|
||||
return successResponse(res, { transfer: fresh }, 201, 'Transfer created');
|
||||
}),
|
||||
);
|
||||
|
||||
// Ownership guard for every `/:id`, `/:id/files`, `/:id/download`, … route.
|
||||
// One mount covers them all — the POST `/` create + GET `/` list above are not
|
||||
// matched (no :id), and each route keeps its own requirePermission.
|
||||
router.use('/:id', requireTransferOwnership);
|
||||
|
||||
// Detail
|
||||
router.get('/:id',
|
||||
requirePermission('events.view'),
|
||||
[param('id').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.getTransfer(parseInt(req.params.id, 10));
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
return successResponse(res, { transfer });
|
||||
}),
|
||||
);
|
||||
|
||||
// Update
|
||||
router.patch('/:id',
|
||||
requirePermission('events.edit'),
|
||||
[
|
||||
param('id').isInt({ min: 1 }),
|
||||
body('title').optional({ nullable: true }).isString().isLength({ max: 255 }),
|
||||
body('message').optional({ nullable: true }).isString().isLength({ max: 5000 }),
|
||||
body('maxDownloads').optional({ nullable: true }).isInt({ min: 0, max: 1000000 }),
|
||||
body('graceDays').optional({ nullable: true }).isInt({ min: 0, max: 365 }),
|
||||
body('expiresInDays').optional({ nullable: true }).isInt({ min: 1, max: 3650 }),
|
||||
body('expiresAt').optional({ nullable: true }).isISO8601(),
|
||||
body('isActive').optional().isBoolean(),
|
||||
],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.updateTransfer(parseInt(req.params.id, 10), {
|
||||
title: req.body.title,
|
||||
message: req.body.message,
|
||||
maxDownloads: req.body.maxDownloads,
|
||||
graceDays: req.body.graceDays,
|
||||
expiresInDays: req.body.expiresInDays,
|
||||
expiresAt: req.body.expiresAt,
|
||||
isActive: req.body.isActive,
|
||||
});
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
return successResponse(res, { transfer }, 200, 'Transfer updated');
|
||||
}),
|
||||
);
|
||||
|
||||
// Delete
|
||||
router.delete('/:id',
|
||||
requirePermission('events.edit'),
|
||||
[param('id').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const ok = await transferService.deleteTransfer(parseInt(req.params.id, 10));
|
||||
if (!ok) return res.status(404).json({ error: 'Transfer not found' });
|
||||
return successResponse(res, { deleted: true }, 200, 'Transfer deleted');
|
||||
}),
|
||||
);
|
||||
|
||||
// Add photos (cross-event) to a transfer
|
||||
router.post('/:id/files',
|
||||
requirePermission('events.edit'),
|
||||
[
|
||||
param('id').isInt({ min: 1 }),
|
||||
body('photoIds').isArray({ min: 1, max: 5000 }),
|
||||
body('photoIds.*').isInt({ min: 1 }),
|
||||
],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const existing = await transferService.getTransfer(parseInt(req.params.id, 10));
|
||||
if (!existing) return res.status(404).json({ error: 'Transfer not found' });
|
||||
const transfer = await transferService.addFiles(parseInt(req.params.id, 10), req.body.photoIds, req.admin);
|
||||
return successResponse(res, { transfer }, 200, 'Files added');
|
||||
}),
|
||||
);
|
||||
|
||||
// Remove one file from a transfer
|
||||
router.delete('/:id/files/:fileId',
|
||||
requirePermission('events.edit'),
|
||||
[param('id').isInt({ min: 1 }), param('fileId').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.removeFile(
|
||||
parseInt(req.params.id, 10), parseInt(req.params.fileId, 10),
|
||||
);
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
return successResponse(res, { transfer }, 200, 'File removed');
|
||||
}),
|
||||
);
|
||||
|
||||
// Upload deliverable files into an existing transfer (multipart `files`).
|
||||
router.post('/:id/upload-files',
|
||||
requirePermission('events.edit'),
|
||||
handleAsync(async (req, res) => {
|
||||
const id = parseInt(req.params.id, 10);
|
||||
if (!Number.isInteger(id) || id < 1) return res.status(400).json({ error: 'Invalid id' });
|
||||
const existing = await transferService.getTransfer(id);
|
||||
if (!existing) return res.status(404).json({ error: 'Transfer not found' });
|
||||
const up = await runAdminUpload(req, res);
|
||||
if (!up.ok) return;
|
||||
if (!req.files || !req.files.length) {
|
||||
return res.status(400).json({ error: 'No files uploaded', code: 'NO_FILES' });
|
||||
}
|
||||
await storeExtraFiles(id, req.files);
|
||||
const transfer = await transferService.getTransfer(id);
|
||||
return successResponse(res, { transfer }, 200, 'Files added');
|
||||
}),
|
||||
);
|
||||
|
||||
// Remove one admin-uploaded deliverable file from a transfer
|
||||
router.delete('/:id/extra-files/:extraId',
|
||||
requirePermission('events.edit'),
|
||||
[param('id').isInt({ min: 1 }), param('extraId').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.removeExtraFile(
|
||||
parseInt(req.params.id, 10), parseInt(req.params.extraId, 10),
|
||||
);
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
return successResponse(res, { transfer }, 200, 'File removed');
|
||||
}),
|
||||
);
|
||||
|
||||
// Admin download of a single admin-uploaded deliverable file
|
||||
router.get('/:id/extra-files/:extraId/download',
|
||||
requirePermission('events.view'),
|
||||
[param('id').isInt({ min: 1 }), param('extraId').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.getTransfer(parseInt(req.params.id, 10));
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
const ok = await transferService.streamTransferExtraFile(
|
||||
{ id: transfer.id }, parseInt(req.params.extraId, 10), res,
|
||||
);
|
||||
if (!ok && !res.headersSent) return res.status(404).json({ error: 'File not found' });
|
||||
}),
|
||||
);
|
||||
|
||||
// Enable / regenerate the client-upload link
|
||||
router.post('/:id/upload-link',
|
||||
requirePermission('events.edit'),
|
||||
[param('id').isInt({ min: 1 }), body('uploadExpiresInDays').optional({ nullable: true }).isInt({ min: 1, max: 3650 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.enableUploads(
|
||||
parseInt(req.params.id, 10), { uploadExpiresInDays: req.body.uploadExpiresInDays },
|
||||
);
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
return successResponse(res, { transfer }, 200, 'Upload link enabled');
|
||||
}),
|
||||
);
|
||||
|
||||
// Disable the client-upload link
|
||||
router.delete('/:id/upload-link',
|
||||
requirePermission('events.edit'),
|
||||
[param('id').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.disableUploads(parseInt(req.params.id, 10));
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
return successResponse(res, { transfer }, 200, 'Upload link disabled');
|
||||
}),
|
||||
);
|
||||
|
||||
// Admin download of the whole transfer (ZIP of originals). No expiry/limit
|
||||
// gate — this is the operator retrieving their own bundle.
|
||||
router.get('/:id/download',
|
||||
requirePermission('photos.download'),
|
||||
[param('id').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.getTransfer(parseInt(req.params.id, 10));
|
||||
if (!transfer) return res.status(404).json({ error: 'Transfer not found' });
|
||||
// getTransfer returns the serialized view; streamTransferArchive only needs
|
||||
// { id, title }, both present on it.
|
||||
await transferService.streamTransferArchive(transfer, res);
|
||||
}),
|
||||
);
|
||||
|
||||
// Admin download of a single client-uploaded file
|
||||
router.get('/:id/uploads/:uploadId/download',
|
||||
requirePermission('events.view'),
|
||||
[param('id').isInt({ min: 1 }), param('uploadId').isInt({ min: 1 })],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const upload = await transferService.getUpload(
|
||||
parseInt(req.params.id, 10), parseInt(req.params.uploadId, 10),
|
||||
);
|
||||
if (!upload) return res.status(404).json({ error: 'Upload not found' });
|
||||
res.setHeader('Content-Type', upload.mime_type || 'application/octet-stream');
|
||||
res.setHeader('Content-Disposition', `attachment; filename="${encodeURIComponent(upload.original_filename)}"`);
|
||||
if (upload.localPath && fs.existsSync(upload.localPath)) {
|
||||
return fs.createReadStream(upload.localPath).pipe(res);
|
||||
}
|
||||
// S3 / non-local backend: stream via the storage abstraction.
|
||||
const { getStorage } = require('../services/storage');
|
||||
const stream = await getStorage().get(upload.stored_path);
|
||||
return stream.pipe(res);
|
||||
}),
|
||||
);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,97 @@
|
||||
/**
|
||||
* Public → Transfer download routes (PicTransfer, #997).
|
||||
*
|
||||
* Mounted at /api/public/transfer. NO authentication — the 64-hex token in the
|
||||
* recipient's link is the only secret. The recipient page has NO thumbnails by
|
||||
* design; this API exposes filenames + sizes only, never image URLs.
|
||||
*
|
||||
* Surface:
|
||||
* GET /:token metadata view (title, message, file list, expiry)
|
||||
* GET /:token/download ZIP of all ORIGINAL files
|
||||
* GET /:token/download/:fileId single ORIGINAL file
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const rateLimit = require('express-rate-limit');
|
||||
const { param } = require('express-validator');
|
||||
const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
|
||||
const { requireFeatureFlag } = require('../middleware/requireFeatureFlag');
|
||||
const { clientIpForAudit } = require('../utils/clientIp');
|
||||
const transferService = require('../services/transferService');
|
||||
|
||||
const router = express.Router();
|
||||
|
||||
// Belt-and-braces: a recipient link must stop resolving the moment an admin
|
||||
// turns PicTransfer off under Settings → Features, same as every other gated
|
||||
// module. The token is still the only secret; this just fails closed.
|
||||
router.use(requireFeatureFlag('transfers'));
|
||||
|
||||
const viewLimiter = rateLimit({ windowMs: 60 * 1000, max: 60, standardHeaders: true, legacyHeaders: false });
|
||||
const downloadLimiter = rateLimit({ windowMs: 60 * 1000, max: 20, standardHeaders: true, legacyHeaders: false });
|
||||
|
||||
const tokenValidator = [param('token').isString().isLength({ min: 64, max: 64 }).matches(/^[a-f0-9]+$/i)];
|
||||
|
||||
// Recipient view. Always resolves for a live (non-deleted) transfer so the page
|
||||
// can render an "expired" state; file list is only included while downloadable.
|
||||
router.get('/:token', viewLimiter, tokenValidator, handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.getTransferByToken(req.params.token);
|
||||
if (!transfer) return res.status(404).json({ error: 'Not found', code: 'NOT_FOUND' });
|
||||
|
||||
const gate = transferService.assertDownloadable(transfer);
|
||||
if (!gate.ok) {
|
||||
return successResponse(res, {
|
||||
transfer: {
|
||||
title: transfer.title || 'Transfer',
|
||||
status: gate.code === 'DOWNLOAD_LIMIT_REACHED' ? 'limit_reached' : 'expired',
|
||||
expires_at: transfer.expires_at,
|
||||
downloadable: false,
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
const view = await transferService.getPublicView(transfer);
|
||||
return successResponse(res, { transfer: { ...view, status: 'active', downloadable: true } });
|
||||
}));
|
||||
|
||||
// Download all as a ZIP of originals.
|
||||
router.get('/:token/download', downloadLimiter, tokenValidator, handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.getTransferByToken(req.params.token);
|
||||
const gate = transferService.assertDownloadable(transfer);
|
||||
if (!gate.ok) {
|
||||
return res.status(gate.status).json({ error: 'This link is no longer available', code: gate.code });
|
||||
}
|
||||
// Count the download BEFORE streaming so a mid-stream disconnect still
|
||||
// counts against the cap (matches the "disable after N downloads" intent).
|
||||
await transferService.recordDownload(transfer, { kind: 'all', ip: clientIpForAudit(req) });
|
||||
await transferService.streamTransferArchive(transfer, res);
|
||||
}));
|
||||
|
||||
// Download a single original file. The file id is prefixed — `p<id>` for a
|
||||
// referenced gallery photo, `x<id>` for an admin-uploaded deliverable file (a
|
||||
// bare number is tolerated as a photo id) — so the service reads the right table.
|
||||
router.get('/:token/download/:fileId', downloadLimiter,
|
||||
[...tokenValidator, param('fileId').matches(/^[px]?[0-9]{1,15}$/i)],
|
||||
handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await transferService.getTransferByToken(req.params.token);
|
||||
const gate = transferService.assertDownloadable(transfer);
|
||||
if (!gate.ok) {
|
||||
return res.status(gate.status).json({ error: 'This link is no longer available', code: gate.code });
|
||||
}
|
||||
const ok = await transferService.streamTransferFile(
|
||||
transfer, req.params.fileId, res,
|
||||
);
|
||||
if (!ok && !res.headersSent) {
|
||||
return res.status(404).json({ error: 'File not found', code: 'FILE_NOT_FOUND' });
|
||||
}
|
||||
if (ok) {
|
||||
await transferService.recordDownload(transfer, {
|
||||
kind: 'single', photoId: null, ip: clientIpForAudit(req),
|
||||
});
|
||||
}
|
||||
}),
|
||||
);
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,187 @@
|
||||
/**
|
||||
* Public → Transfer upload routes (PicTransfer client uploads, #997).
|
||||
*
|
||||
* Mounted at /api/public/transfer-upload. NO authentication — a short (6-char)
|
||||
* upload token in the link is the only secret. This lets a photographer send a
|
||||
* client "here's a code, upload your logo / files here". Because the token is
|
||||
* low-entropy, brute force is mitigated by a tight per-route rate limiter plus
|
||||
* the shared per-IP bad-attempt lockout, and the guard runs BEFORE multer so a
|
||||
* bad token never costs a disk write.
|
||||
*
|
||||
* Surface:
|
||||
* GET /:token metadata (transfer title, allowed types, size limit)
|
||||
* POST /:token multipart upload (field name: files)
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const multer = require('multer');
|
||||
const rateLimit = require('express-rate-limit');
|
||||
const { param } = require('express-validator');
|
||||
const { handleAsync, validateRequest, successResponse } = require('../utils/routeHelpers');
|
||||
const { requireFeatureFlag } = require('../middleware/requireFeatureFlag');
|
||||
const { clientIpForAudit } = require('../utils/clientIp');
|
||||
const { validateFileType } = require('../utils/fileSecurityUtils');
|
||||
const { sanitizeFilename } = require('../utils/filenameSanitizer');
|
||||
const { getAppSetting } = require('../utils/appSettings');
|
||||
const { getStorage } = require('../services/storage');
|
||||
const transferService = require('../services/transferService');
|
||||
const { _internal: tokenLock } = require('../utils/publicTokenGuards');
|
||||
const logger = require('../utils/logger');
|
||||
|
||||
const router = express.Router();
|
||||
|
||||
// Fail closed when PicTransfer is off — no client upload accepted (or even
|
||||
// probed) once an admin disables the feature under Settings → Features.
|
||||
router.use(requireFeatureFlag('transfers'));
|
||||
|
||||
const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
|
||||
const MAX_FILES_PER_UPLOAD = 25;
|
||||
const DEFAULT_ALLOWED = ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/tiff', 'application/pdf', 'application/zip'];
|
||||
|
||||
const infoLimiter = rateLimit({ windowMs: 60 * 1000, max: 30, standardHeaders: true, legacyHeaders: false });
|
||||
const uploadLimiter = rateLimit({ windowMs: 60 * 1000, max: 10, standardHeaders: true, legacyHeaders: false });
|
||||
|
||||
// Upload tokens are drawn from an unambiguous alphabet (see transferService).
|
||||
// Accept a small range of lengths so a future longer token still validates.
|
||||
const TOKEN_RE = /^[A-Za-z0-9]{4,16}$/;
|
||||
|
||||
async function loadUploadTransfer(req, res) {
|
||||
const ip = clientIpForAudit(req);
|
||||
if (tokenLock.isIpLocked(ip)) {
|
||||
res.status(429).json({ error: 'Too many invalid attempts. Try again later.', code: 'TOKEN_LOOKUP_LOCKED' });
|
||||
return null;
|
||||
}
|
||||
const token = req.params.token;
|
||||
if (!token || !TOKEN_RE.test(token)) {
|
||||
res.status(400).json({ error: 'Invalid token format', code: 'BAD_TOKEN' });
|
||||
return null;
|
||||
}
|
||||
const transfer = await transferService.getTransferByUploadToken(token);
|
||||
if (!transfer) {
|
||||
tokenLock.recordBadAttempt(ip);
|
||||
res.status(404).json({ error: 'Not found', code: 'NOT_FOUND' });
|
||||
return null;
|
||||
}
|
||||
const gate = transferService.assertUploadable(transfer);
|
||||
if (!gate.ok) {
|
||||
res.status(gate.status).json({ error: 'This upload link is no longer available', code: gate.code });
|
||||
return null;
|
||||
}
|
||||
return transfer;
|
||||
}
|
||||
|
||||
// Metadata for the upload page.
|
||||
router.get('/:token', infoLimiter, [param('token').matches(TOKEN_RE)], handleAsync(async (req, res) => {
|
||||
validateRequest(req);
|
||||
const transfer = await loadUploadTransfer(req, res);
|
||||
if (!transfer) return;
|
||||
const maxSizeMb = Number(await getAppSetting('transfer_max_upload_size_mb', 50)) || 50;
|
||||
const allowed = await getAppSetting('transfer_upload_allowed_mime', DEFAULT_ALLOWED);
|
||||
return successResponse(res, {
|
||||
transfer: {
|
||||
title: transfer.title || 'Upload',
|
||||
message: transfer.message || null,
|
||||
expires_at: transfer.upload_expires_at || transfer.expires_at,
|
||||
max_size_mb: maxSizeMb,
|
||||
max_files: MAX_FILES_PER_UPLOAD,
|
||||
allowed_mime: Array.isArray(allowed) ? allowed : DEFAULT_ALLOWED,
|
||||
},
|
||||
});
|
||||
}));
|
||||
|
||||
// Pre-multer guard: validates the token + upload eligibility BEFORE any bytes
|
||||
// touch disk, and stashes the transfer for the destination/handler.
|
||||
async function preUploadGuard(req, res, next) {
|
||||
try {
|
||||
const transfer = await loadUploadTransfer(req, res);
|
||||
if (!transfer) return; // response already sent
|
||||
req.transferRow = transfer;
|
||||
next();
|
||||
} catch (err) {
|
||||
logger.error('preUploadGuard error', { error: err.message });
|
||||
if (!res.headersSent) res.status(500).json({ error: 'Internal error' });
|
||||
}
|
||||
}
|
||||
|
||||
// Multer writes to a per-transfer temp dir; we then hand files to the storage
|
||||
// backend (so S3 works too) and delete the temp copy.
|
||||
const tempStorage = multer.diskStorage({
|
||||
destination: (req, file, cb) => {
|
||||
const dir = path.join(getStoragePath(), 'temp', 'transfer-uploads');
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
cb(null, dir);
|
||||
},
|
||||
filename: (req, file, cb) => {
|
||||
const safe = sanitizeFilename(path.basename(file.originalname), 60) || 'file';
|
||||
cb(null, `${Date.now()}-${Math.round(Math.random() * 1e6)}-${safe}`);
|
||||
},
|
||||
});
|
||||
|
||||
function buildUploader(maxSizeBytes, allowed) {
|
||||
return multer({
|
||||
storage: tempStorage,
|
||||
limits: { fileSize: maxSizeBytes, files: MAX_FILES_PER_UPLOAD },
|
||||
fileFilter: (req, file, cb) => {
|
||||
if (validateFileType(file.originalname, file.mimetype, allowed)) return cb(null, true);
|
||||
return cb(new Error('This file type is not allowed'));
|
||||
},
|
||||
}).array('files', MAX_FILES_PER_UPLOAD);
|
||||
}
|
||||
|
||||
router.post('/:token', uploadLimiter, [param('token').matches(TOKEN_RE)], preUploadGuard, handleAsync(async (req, res) => {
|
||||
const transfer = req.transferRow;
|
||||
const maxSizeMb = Number(await getAppSetting('transfer_max_upload_size_mb', 50)) || 50;
|
||||
const allowedSetting = await getAppSetting('transfer_upload_allowed_mime', DEFAULT_ALLOWED);
|
||||
const allowed = Array.isArray(allowedSetting) ? allowedSetting : DEFAULT_ALLOWED;
|
||||
const uploader = buildUploader(maxSizeMb * 1024 * 1024, allowed);
|
||||
|
||||
try {
|
||||
await new Promise((resolve, reject) => {
|
||||
uploader(req, res, (err) => (err ? reject(err) : resolve()));
|
||||
});
|
||||
} catch (err) {
|
||||
// Translate multer errors to a clean 4xx.
|
||||
const msg = err && err.code === 'LIMIT_FILE_SIZE'
|
||||
? `Each file must be ${maxSizeMb} MB or smaller`
|
||||
: (err && err.message) || 'Upload failed';
|
||||
if (!res.headersSent) res.status(400).json({ error: msg, code: 'UPLOAD_REJECTED' });
|
||||
return;
|
||||
}
|
||||
|
||||
if (!req.files || !req.files.length) {
|
||||
return res.status(400).json({ error: 'No files uploaded', code: 'NO_FILES' });
|
||||
}
|
||||
|
||||
const storage = getStorage();
|
||||
const ip = clientIpForAudit(req);
|
||||
const saved = [];
|
||||
for (const file of req.files) {
|
||||
const safeName = sanitizeFilename(path.basename(file.originalname), 120) || 'file';
|
||||
const key = path.posix.join(transferService.uploadDirKey(transfer.id), `${Date.now()}-${saved.length}-${safeName}`);
|
||||
try {
|
||||
await storage.putFromFile(key, file.path);
|
||||
await transferService.addUpload(transfer.id, {
|
||||
originalFilename: file.originalname,
|
||||
storedPath: key,
|
||||
sizeBytes: file.size,
|
||||
mimeType: file.mimetype,
|
||||
ip,
|
||||
});
|
||||
saved.push({ filename: file.originalname, size_bytes: file.size });
|
||||
} catch (err) {
|
||||
logger.error('transfer upload: failed to store file', { transferId: transfer.id, error: err.message });
|
||||
} finally {
|
||||
// Remove the temp copy regardless of outcome.
|
||||
try { if (fs.existsSync(file.path)) fs.unlinkSync(file.path); } catch (_) { /* noop */ }
|
||||
}
|
||||
}
|
||||
|
||||
if (!saved.length) {
|
||||
return res.status(500).json({ error: 'Could not store the uploaded files', code: 'STORE_FAILED' });
|
||||
}
|
||||
return successResponse(res, { uploaded: saved.length, files: saved }, 201, 'Files uploaded');
|
||||
}));
|
||||
|
||||
module.exports = router;
|
||||
@@ -0,0 +1,147 @@
|
||||
/**
|
||||
* transferCleanupService — retention lifecycle for PicTransfer (#997).
|
||||
*
|
||||
* Runs hourly (offset from the gallery expiration checker so the two don't
|
||||
* collide) and drives three transitions:
|
||||
*
|
||||
* 1. Expire — an active transfer past `expires_at` is disabled
|
||||
* (is_active=false, disabled_at=now). This is the "disable the
|
||||
* link after the set time period" behaviour. A transfer
|
||||
* disabled early by its download cap is already in this state.
|
||||
* 2. Notify — the admin is emailed once when a transfer becomes inactive
|
||||
* (admin_notified_at stamped so it never repeats).
|
||||
* 3. Delete — `grace_days` after disable, the client-uploaded files are
|
||||
* removed and the transfer record is dropped. (The gallery
|
||||
* originals a transfer pointed at are owned by their events and
|
||||
* are never touched — only the transfer's own ad-hoc uploads
|
||||
* are deleted, which is what the retention cap is about.)
|
||||
*/
|
||||
|
||||
const cron = require('node-cron');
|
||||
const { db } = require('../database/db');
|
||||
const logger = require('../utils/logger');
|
||||
const { formatBoolean } = require('../utils/dbCompat');
|
||||
const { sendTemplateEmail } = require('./emailProcessor');
|
||||
const transferService = require('./transferService');
|
||||
|
||||
const DAY_MS = 24 * 60 * 60 * 1000;
|
||||
|
||||
function startTransferCleanup() {
|
||||
// Hourly at :15 — staggered from the gallery expiration checker (:00).
|
||||
cron.schedule('15 * * * *', async () => {
|
||||
await runTransferCleanup();
|
||||
});
|
||||
logger.info('Transfer cleanup scheduler started');
|
||||
}
|
||||
|
||||
async function runTransferCleanup() {
|
||||
try {
|
||||
await expireTransfers();
|
||||
await notifyExpiredTransfers();
|
||||
await deleteRetiredTransfers();
|
||||
} catch (err) {
|
||||
logger.error('Transfer cleanup error', { error: err.message });
|
||||
}
|
||||
}
|
||||
|
||||
/** Disable links whose time window has passed. */
|
||||
async function expireTransfers() {
|
||||
const now = new Date();
|
||||
const due = await db('transfers')
|
||||
.where('is_active', formatBoolean(true))
|
||||
.whereNull('deleted_at')
|
||||
.whereNotNull('expires_at')
|
||||
.where('expires_at', '<=', now);
|
||||
|
||||
for (const t of due) {
|
||||
await db('transfers').where({ id: t.id }).update({
|
||||
is_active: formatBoolean(false),
|
||||
disabled_at: t.disabled_at || now,
|
||||
updated_at: now,
|
||||
});
|
||||
logger.info(`Transfer ${t.id} expired`);
|
||||
}
|
||||
}
|
||||
|
||||
/** Email the admin(s) once per transfer that has become inactive. */
|
||||
async function notifyExpiredTransfers() {
|
||||
const pending = await db('transfers')
|
||||
.where('is_active', formatBoolean(false))
|
||||
.whereNull('deleted_at')
|
||||
.whereNull('admin_notified_at')
|
||||
.whereNotNull('disabled_at');
|
||||
|
||||
if (!pending.length) return;
|
||||
|
||||
const admins = await db('admin_users')
|
||||
.where('is_active', formatBoolean(true))
|
||||
.whereNotNull('email')
|
||||
.select('email');
|
||||
const adminUrl = `${transferService.getFrontendUrl()}/admin/transfers`;
|
||||
|
||||
for (const t of pending) {
|
||||
const fileCount = await db('transfer_files').where('transfer_id', t.id).count('* as c').first();
|
||||
const uploadCount = await db('transfer_uploads').where('transfer_id', t.id).count('* as c').first();
|
||||
const grace = Number(t.grace_days) || 0;
|
||||
const deleteDate = new Date(new Date(t.disabled_at).getTime() + grace * DAY_MS);
|
||||
|
||||
const vars = {
|
||||
transfer_title: t.title || `Transfer #${t.id}`,
|
||||
expiry_date: new Date(t.disabled_at).toISOString().slice(0, 10),
|
||||
file_count: String(Number(fileCount?.c) || 0),
|
||||
upload_count: String(Number(uploadCount?.c) || 0),
|
||||
grace_days: String(grace),
|
||||
delete_date: deleteDate.toISOString().slice(0, 10),
|
||||
admin_url: adminUrl,
|
||||
};
|
||||
|
||||
let sent = false;
|
||||
for (const { email } of admins) {
|
||||
try {
|
||||
await sendTemplateEmail(email, 'transfer_link_expired', vars);
|
||||
sent = true;
|
||||
} catch (err) {
|
||||
// Email not configured / SMTP down — don't spin forever retrying; just
|
||||
// stamp so the sweep moves on. The transfer still expires + deletes.
|
||||
logger.warn('Failed to send transfer_link_expired notification', {
|
||||
transferId: t.id, email, error: err.message,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Stamp regardless so we notify at most once even if delivery failed
|
||||
// (avoids an unbounded retry loop every hour).
|
||||
await db('transfers').where({ id: t.id }).update({ admin_notified_at: new Date() });
|
||||
if (sent) logger.info(`Notified admins that transfer ${t.id} expired`);
|
||||
}
|
||||
}
|
||||
|
||||
/** Hard-delete transfers whose retention window has fully elapsed. */
|
||||
async function deleteRetiredTransfers() {
|
||||
const candidates = await db('transfers')
|
||||
.where('is_active', formatBoolean(false))
|
||||
.whereNull('deleted_at')
|
||||
.whereNotNull('disabled_at');
|
||||
|
||||
const now = Date.now();
|
||||
for (const t of candidates) {
|
||||
const grace = Number(t.grace_days) || 0;
|
||||
const deleteAt = new Date(t.disabled_at).getTime() + grace * DAY_MS;
|
||||
if (deleteAt > now) continue;
|
||||
try {
|
||||
await transferService.deleteTransfer(t.id);
|
||||
logger.info(`Transfer ${t.id} deleted after ${grace}-day retention`);
|
||||
} catch (err) {
|
||||
logger.error('Failed to delete retired transfer', { transferId: t.id, error: err.message });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
startTransferCleanup,
|
||||
// exported for tests / manual invocation
|
||||
runTransferCleanup,
|
||||
expireTransfers,
|
||||
notifyExpiredTransfers,
|
||||
deleteRetiredTransfers,
|
||||
};
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user