anolilab/lunora/lunora-setup-storage

lunora add storage                          # asks for the R2 bucket name
lunora add storage --bucket my-app-uploads
lunora registry add storage                 # low-level: writes bucket_name "replace-me-uploads"

import { isSafeHeaderValue } from "@lunora/server";
import { verifySignedUrl } from "@lunora/storage";
/** Cap what a single signed PUT may store. */
const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
/**
 * Origins allowed to upload cross-origin. Leave it empty when
 * `STORAGE_PUBLIC_BASE_URL` is your app's own origin — then `cors` is inert and
 * no browser ever preflights these routes.
 */
const ALLOWED_ORIGINS = new Set(["https://app.example.com"]);
/**
 * Types safe to render in the browser. Everything else downloads — an uploader
 * who pinned `text/html` or `image/svg+xml` must never get a same-origin script.
 * (`serveStorageObject` applies this same list.)
 */
const INLINE_SAFE = new Set([
    "audio/mpeg",
    "audio/ogg",
    "audio/wav",
    "image/apng",
    "image/avif",
    "image/gif",
    "image/jpeg",
    "image/png",
    "image/webp",
    "video/mp4",
    "video/webm",
]);
export default {
    async fetch(request: Request, env: Env): Promise<Response> {
        const url = new URL(request.url);
        if (url.pathname.startsWith("/storage/")) {
            const origin = request.headers.get("origin");
            // `vary` rides on EVERY response, allowed origin or not: a shared
            // cache keyed on the URL alone would otherwise replay one origin's
            // `access-control-allow-origin` to another.
            const cors = {
                vary: "origin",
                ...(origin !== null && ALLOWED_ORIGINS.has(origin)
                    ? { "access-control-allow-headers": "content-type", "access-control-allow-methods": "GET, PUT", "access-control-allow-origin": origin }
                    : {}),
            };
            // Before the verb check and the signature check: a preflight carries
            // neither the signed method nor any credentials, so answering it
            // later would 405 every cross-origin upload.
            if (request.method === "OPTIONS") {
                return new Response(null, { headers: cors, status: 204 });
            }
            // The method is signed, so a GET URL cannot be replayed as a PUT —
            // check the verb anyway rather than relying on that alone.
            if (request.method !== (url.searchParams.get("method") ?? "GET")) {
                return new Response("method not allowed", { status: 405 });
            }
            const result = await verifySignedUrl(url, env.STORAGE_SIGNING_SECRET);
            if (!result.valid || result.key === undefined) {
                // Expose only `valid` — a precise reason is a signing oracle.
                return new Response("forbidden", { status: 403 });
            }
            if (request.method === "PUT") {
                // Store the content type the SIGNATURE pins, never the request's
                // own header: the allowlist ran when the URL was minted, so
                // trusting the header lets a caller mint for `image/png` and PUT
                // `text/html` — stored XSS on this origin.
                if (result.contentType === undefined) {
                    return new Response("upload URL carries no content type", { status: 400 });
                }
                // A declared length is the contract: R2 takes `request.body` as a
                // stream, so there is nothing to measure before the write, and
                // treating an ABSENT header as oversized would 413 every valid
                // streamed upload. Demand it (411) and enforce it (413).
                const declared = request.headers.get("content-length");
                if (declared === null) {
                    return new Response("content-length required", { status: 411 });
                }
                const length = Number(declared);
                if (!Number.isFinite(length) || length > MAX_UPLOAD_BYTES) {
                    return new Response("upload too large", { status: 413 });
                }
                await env.UPLOADS.put(result.key, request.body, { httpMetadata: { contentType: result.contentType } });
                // The preflight's answer does not carry over: without CORS
                // headers HERE too the browser passes preflight and then rejects
                // the actual response.
                return new Response(null, { headers: cors, status: 204 });
            }
            const object = await env.UPLOADS.get(result.key);
            if (!object) {
                return new Response("not found", { status: 404 });
            }
            // The stored content type came off an uploader-signed URL, so it is
            // attacker-influenced: a CR/LF/NUL in it either throws inside
            // `Headers` (an unhandled 500) or, on a permissive runtime, splits
            // the response. Reject the value rather than reflect it — this is
            // exactly what `isSafeHeaderValue` does inside `serveStorageObject`.
            const rawContentType = object.httpMetadata?.contentType;
            const contentType = rawContentType !== undefined && isSafeHeaderValue(rawContentType) ? rawContentType : "application/octet-stream";
            return new Response(object.body, {
                headers: {
                    ...cors,
                    // The URL expires; a cached copy would not. Without this a
                    // browser or CDN can keep serving private bytes past `exp`,
                    // with `verifySignedUrl` never consulted again.
                    "cache-control": "private, no-store",
                    ...(INLINE_SAFE.has(contentType.split(";")[0]?.trim().toLowerCase() ?? "") ? {} : { "content-disposition": "attachment" }),
                    "content-type": contentType,
                    "x-content-type-options": "nosniff",
                },
            });
        }
        // ... your Lunora handler
        return new Response("not found", { status: 404 });
    },
};

import { api } from "../lunora/_generated/api"; // path relative to your client file
// 1. Mint a signed PUT URL. contentType must be in ALLOWED_UPLOAD_CONTENT_TYPES
//    in lunora/storage/index.ts. The type is pinned into the signature, and the
//    route stores that pinned value, not the request header.
const { key, url } = await client.action(api.storage.generateUploadUrl, { key: "avatar.png", contentType: file.type });
// 2. Upload straight to the Worker's /storage/* route.
await fetch(url, { method: "PUT", headers: { "content-type": file.type }, body: file });
// 3. Later, mint a signed GET URL to display it.
const { url: downloadUrl } = await client.action(api.storage.getDownloadUrl, { key: "avatar.png" });