fix(storage): atomic temp files, directory-safe get/delete, list contract docs

src/lib/server/storage/local-fs-store.ts

@@ -1,9 +1,10 @@
+import { randomUUID } from 'node:crypto';
 import { appendFile, copyFile, mkdir, readdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, sep } from 'node:path';
 import { assertValidPath, type BucketStore, type StoreEntry } from './store';
 
-function isEnoent(e: unknown): boolean {
-	return typeof e === 'object' && e !== null && (e as { code?: string }).code === 'ENOENT';
+function hasCode(e: unknown, ...codes: string[]): boolean {
+	return typeof e === 'object' && e !== null && codes.includes((e as { code?: string }).code ?? '');
 }
 
 /** Directory-backed store for local development and tests. Writes are atomic (temp file + rename). */
@@ -19,7 +20,7 @@ export class LocalFsStore implements BucketStore {
 		try {
 			return new Uint8Array(await readFile(this.abs(path)));
 		} catch (e) {
-			if (isEnoent(e)) return null;
+			if (hasCode(e, 'ENOENT', 'EISDIR')) return null;
 			throw e;
 		}
 	}
@@ -27,9 +28,14 @@ export class LocalFsStore implements BucketStore {
 	async put(path: string, bytes: Uint8Array, contentType?: string): Promise<void> {
 		const target = this.abs(path);
 		await mkdir(dirname(target), { recursive: true });
-		const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
-		await writeFile(tmp, bytes);
-		await rename(tmp, target);
+		const tmp = `${target}.${randomUUID()}.tmp`;
+		try {
+			await writeFile(tmp, bytes);
+			await rename(tmp, target);
+		} catch (e) {
+			await rm(tmp, { force: true });
+			throw e;
+		}
 	}
 
 	async append(path: string, bytes: Uint8Array): Promise<void> {
@@ -45,15 +51,18 @@ export class LocalFsStore implements BucketStore {
 			try {
 				entries = await readdir(dir, { withFileTypes: true });
 			} catch (e) {
-				if (isEnoent(e)) return;
+				if (hasCode(e, 'ENOENT')) return;
 				throw e;
 			}
 			for (const ent of entries) {
 				const full = join(dir, ent.name);
+				const rel = relative(this.root, full).split(sep).join('/');
 				if (ent.isDirectory()) {
-					await walk(full);
+					const relDir = `${rel}/`;
+					if (relDir.startsWith(prefix) || prefix.startsWith(relDir)) {
+						await walk(full);
+					}
 				} else if (ent.isFile() && !ent.name.endsWith('.tmp')) {
-					const rel = relative(this.root, full).split(sep).join('/');
 					if (rel.startsWith(prefix)) {
 						const s = await stat(full);
 						out.push({ path: rel, size: s.size, uploadedAt: s.mtime });
@@ -66,12 +75,26 @@ export class LocalFsStore implements BucketStore {
 	}
 
 	async delete(paths: string[]): Promise<void> {
-		for (const p of paths) await rm(this.abs(p), { force: true });
+		for (const p of paths) {
+			try {
+				await rm(this.abs(p), { force: true });
+			} catch (e) {
+				if (hasCode(e, 'EISDIR', 'ERR_FS_EISDIR')) continue;
+				throw e;
+			}
+		}
 	}
 
 	async copy(src: string, dst: string): Promise<void> {
 		const target = this.abs(dst);
 		await mkdir(dirname(target), { recursive: true });
-		await copyFile(this.abs(src), target);
+		const tmp = `${target}.${randomUUID()}.tmp`;
+		try {
+			await copyFile(this.abs(src), tmp);
+			await rename(tmp, target);
+		} catch (e) {
+			await rm(tmp, { force: true });
+			throw e;
+		}
 	}
 }

src/lib/server/storage/prefixed-store.ts

@@ -21,23 +21,23 @@ export class PrefixedStore implements BucketStore {
 		return this.prefix + path;
 	}
 
-	get(path: string): Promise<Uint8Array | null> {
+	async get(path: string): Promise<Uint8Array | null> {
 		return this.inner.get(this.full(path));
 	}
-	put(path: string, bytes: Uint8Array, contentType?: string): Promise<void> {
+	async put(path: string, bytes: Uint8Array, contentType?: string): Promise<void> {
 		return this.inner.put(this.full(path), bytes, contentType);
 	}
-	append(path: string, bytes: Uint8Array): Promise<void> {
+	async append(path: string, bytes: Uint8Array): Promise<void> {
 		return this.inner.append(this.full(path), bytes);
 	}
 	async list(prefix: string): Promise<StoreEntry[]> {
 		const entries = await this.inner.list(this.prefix + prefix);
 		return entries.map((e) => ({ ...e, path: e.path.slice(this.prefix.length) }));
 	}
-	delete(paths: string[]): Promise<void> {
+	async delete(paths: string[]): Promise<void> {
 		return this.inner.delete(paths.map((p) => this.full(p)));
 	}
-	copy(src: string, dst: string): Promise<void> {
+	async copy(src: string, dst: string): Promise<void> {
 		return this.inner.copy(this.full(src), this.full(dst));
 	}
 

src/lib/server/storage/store.ts

@@ -13,9 +13,17 @@ export interface BucketStore {
 	get(path: string): Promise<Uint8Array | null>;
 	/** Creates or overwrites. */
 	put(path: string, bytes: Uint8Array, contentType?: string): Promise<void>;
-	/** Appends bytes to an existing object, creating it if missing. */
+	/**
+	 * Appends bytes to an existing object, creating it if missing. Not atomic on every
+	 * backend: a crash mid-append may leave a truncated final line, so readers must
+	 * tolerate a trailing partial line.
+	 */
 	append(path: string, bytes: Uint8Array): Promise<void>;
-	/** Lists files whose path starts with `prefix`, sorted by path. */
+	/**
+	 * Lists files whose path starts with `prefix`, sorted by path. The prefix is matched
+	 * literally against the full path (`'events'` also matches `eventsX/…`); callers
+	 * should pass a trailing `/` to match only within a directory.
+	 */
 	list(prefix: string): Promise<StoreEntry[]>;
 	/** Deletes objects; missing ones are ignored. */
 	delete(paths: string[]): Promise<void>;
@@ -28,6 +36,7 @@ const SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
 export function assertValidPath(path: string): void {
 	if (path.length === 0 || path.length > 512) throw new Error(`Invalid path: ${path}`);
 	if (path.startsWith('/') || path.endsWith('/')) throw new Error(`Invalid path: ${path}`);
+	if (path.endsWith('.tmp')) throw new Error(`Invalid path: ${path}`);
 	for (const seg of path.split('/')) {
 		if (seg === '' || seg === '.' || seg === '..' || !SEGMENT_RE.test(seg)) throw new Error(`Invalid path: ${path}`);
 	}

tests/unit/storage/local-fs-store.test.ts

@@ -59,4 +59,44 @@ describe('LocalFsStore', () => {
 		expect(() => assertValidPath('a//b')).toThrow();
 		expect(() => assertValidPath('ok/path.json')).not.toThrow();
 	});
+
+	it('enforces path validation on store methods', async () => {
+		await expect(store.get('../x')).rejects.toThrow();
+		await expect(store.put('../x', enc('x'))).rejects.toThrow();
+	});
+
+	it('rejects paths ending in .tmp', async () => {
+		await expect(store.put('note.tmp', enc('x'))).rejects.toThrow();
+	});
+
+	it('handles concurrent puts to the same key', async () => {
+		const values = Array.from({ length: 20 }, (_, i) => `value-${i}`);
+		await Promise.all(values.map((v) => store.put('concurrent.json', enc(v))));
+		const final = dec(await store.get('concurrent.json'));
+		expect(values).toContain(final);
+		const entries = await store.list('');
+		expect(entries.some((e) => e.path.endsWith('.tmp'))).toBe(false);
+	});
+
+	it('leaves no temp file behind when a write fails', async () => {
+		await store.put('obj/x', enc('x'));
+		await expect(store.put('obj', enc('y'))).rejects.toThrow();
+		const entries = await store.list('');
+		expect(entries.some((e) => e.path.endsWith('.tmp'))).toBe(false);
+	});
+
+	it('distinguishes list("events") from list("events/")', async () => {
+		await store.put('events/a.json', enc('a'));
+		await store.put('eventsX/b.json', enc('b'));
+		const withSlash = await store.list('events/');
+		expect(withSlash.map((e) => e.path)).toEqual(['events/a.json']);
+		const withoutSlash = await store.list('events');
+		expect(withoutSlash.map((e) => e.path)).toEqual(['events/a.json', 'eventsX/b.json']);
+	});
+
+	it('treats a directory path as missing for get and delete', async () => {
+		await store.put('adir/x.json', enc('x'));
+		expect(await store.get('adir')).toBeNull();
+		await expect(store.delete(['adir'])).resolves.not.toThrow();
+	});
 });

tests/unit/storage/prefixed-store.test.ts

@@ -57,4 +57,9 @@ describe('PrefixedStore', () => {
 		expect(() => new PrefixedStore(inner, '')).toThrow();
 		expect(() => new PrefixedStore(inner, '../x')).toThrow();
 	});
+
+	it('rejects paths that escape the prefix', async () => {
+		await expect(a.get('../b/z.txt')).rejects.toThrow();
+		await expect(a.put('../../x', encodeText('x'))).rejects.toThrow();
+	});
 });