Spaces:
Paused
Paused
| /** | |
| * Secure Storage Service | |
| * Integrates Supabase Storage with Google OAuth + MongoDB authentication | |
| * Provides secure, user-specific file access with temporary signed URLs | |
| */ | |
| const { createClient } = require('@supabase/supabase-js'); | |
| const jwt = require('jsonwebtoken'); | |
| const { logger } = require('../Middleware/errorHandler'); | |
| class SecureStorageService { | |
| constructor() { | |
| this.supabaseUrl = process.env.SUPABASE_URL; | |
| this.supabaseAnonKey = process.env.SUPABASE_ANON_KEY; | |
| this.supabaseServiceKey = process.env.SUPABASE_SERVICE_KEY; | |
| this.bucketName = process.env.SUPABASE_BUCKET_NAME || 'campverse'; | |
| this.jwtSecret = process.env.JWT_SECRET; | |
| this.baseFolder = 'CampVerse'; | |
| this.initialized = false; | |
| if (this.supabaseUrl && this.supabaseServiceKey) { | |
| // Use service role for admin operations (bypasses RLS) | |
| this.supabaseAdmin = createClient(this.supabaseUrl, this.supabaseServiceKey, { | |
| auth: { | |
| autoRefreshToken: false, | |
| persistSession: false | |
| } | |
| }); | |
| this.initialized = true; | |
| logger.info('Secure Storage Service initialized with admin privileges'); | |
| } else { | |
| logger.error('Supabase credentials missing for secure storage'); | |
| } | |
| } | |
| /** | |
| * Upload file with user-specific access control | |
| */ | |
| async uploadUserFile(fileBuffer, filename, userId, category = 'profiles', mimetype) { | |
| try { | |
| if (!this.initialized) { | |
| throw new Error('Secure Storage Service not initialized'); | |
| } | |
| // Create user-specific file path | |
| const timestamp = Date.now(); | |
| const uniqueId = Math.random().toString(36).substring(2, 8); | |
| const cleanFilename = `${timestamp}_${uniqueId}_${filename}`; | |
| const filePath = `${this.baseFolder}/users/${userId}/${category}/${cleanFilename}`; | |
| // Upload using admin client (bypasses RLS) | |
| const { error } = await this.supabaseAdmin.storage | |
| .from(this.bucketName) | |
| .upload(filePath, fileBuffer, { | |
| contentType: mimetype, | |
| metadata: { | |
| originalName: filename, | |
| uploadedAt: new Date().toISOString(), | |
| userId, | |
| category | |
| } | |
| }); | |
| if (error) { | |
| throw new Error(`Secure upload error: ${error.message}`); | |
| } | |
| logger.info(`Secure file uploaded for user ${userId}: ${filePath}`); | |
| return { | |
| path: filePath, | |
| filename: cleanFilename, | |
| size: fileBuffer.length, | |
| mimetype, | |
| userId, | |
| uploadedAt: new Date().toISOString() | |
| }; | |
| } catch (error) { | |
| logger.error(`Failed to upload secure file for user ${userId}:`, error); | |
| throw error; | |
| } | |
| } | |
| /** | |
| * Generate secure signed URL for authorized user access | |
| */ | |
| async generateSecureUrl(filePath, userId, expiresIn = 3600) { | |
| try { | |
| if (!this.initialized) { | |
| throw new Error('Secure Storage Service not initialized'); | |
| } | |
| // Verify user has access to this file path | |
| if (!filePath.includes(`/users/${userId}/`)) { | |
| throw new Error('Unauthorized access to file'); | |
| } | |
| // Generate signed URL using admin client | |
| const { data, error } = await this.supabaseAdmin.storage | |
| .from(this.bucketName) | |
| .createSignedUrl(filePath, expiresIn); | |
| if (error) { | |
| throw new Error(`Failed to generate secure URL: ${error.message}`); | |
| } | |
| logger.info(`Secure URL generated for user ${userId}: ${filePath}`); | |
| return data.signedUrl; | |
| } catch (error) { | |
| logger.error(`Failed to generate secure URL for user ${userId}:`, error); | |
| throw error; | |
| } | |
| } | |
| /** | |
| * Delete user's file with access control | |
| */ | |
| async deleteUserFile(filePath, userId) { | |
| try { | |
| if (!this.initialized) { | |
| throw new Error('Secure Storage Service not initialized'); | |
| } | |
| // Verify user has access to this file | |
| if (!filePath.includes(`/users/${userId}/`)) { | |
| throw new Error('Unauthorized file deletion attempt'); | |
| } | |
| const { error } = await this.supabaseAdmin.storage | |
| .from(this.bucketName) | |
| .remove([filePath]); | |
| if (error) { | |
| throw new Error(`Failed to delete file: ${error.message}`); | |
| } | |
| logger.info(`Secure file deleted for user ${userId}: ${filePath}`); | |
| return true; | |
| } catch (error) { | |
| logger.error(`Failed to delete secure file for user ${userId}:`, error); | |
| throw error; | |
| } | |
| } | |
| /** | |
| * List user's files with access control | |
| */ | |
| async listUserFiles(userId, category = null) { | |
| try { | |
| if (!this.initialized) { | |
| throw new Error('Secure Storage Service not initialized'); | |
| } | |
| const folderPath = category | |
| ? `${this.baseFolder}/users/${userId}/${category}` | |
| : `${this.baseFolder}/users/${userId}`; | |
| const { data, error } = await this.supabaseAdmin.storage | |
| .from(this.bucketName) | |
| .list(folderPath); | |
| if (error) { | |
| throw new Error(`Failed to list files: ${error.message}`); | |
| } | |
| return data || []; | |
| } catch (error) { | |
| logger.error(`Failed to list files for user ${userId}:`, error); | |
| throw error; | |
| } | |
| } | |
| /** | |
| * Create a secure access token for file access | |
| */ | |
| createFileAccessToken(userId, filePath, expiresIn = '1h') { | |
| const payload = { | |
| userId, | |
| filePath, | |
| type: 'file_access', | |
| iat: Math.floor(Date.now() / 1000) | |
| }; | |
| return jwt.sign(payload, this.jwtSecret, { expiresIn }); | |
| } | |
| /** | |
| * Verify file access token | |
| */ | |
| verifyFileAccessToken(token) { | |
| try { | |
| const payload = jwt.verify(token, this.jwtSecret); | |
| return payload; | |
| } catch (error) { | |
| throw new Error('Invalid or expired file access token'); | |
| } | |
| } | |
| /** | |
| * Health check | |
| */ | |
| async healthCheck() { | |
| try { | |
| if (!this.initialized) { | |
| return { | |
| status: 'error', | |
| message: 'Secure Storage Service not initialized' | |
| }; | |
| } | |
| // Test admin access | |
| const { error } = await this.supabaseAdmin.storage | |
| .from(this.bucketName) | |
| .list('', { limit: 1 }); | |
| if (error) { | |
| return { | |
| status: 'error', | |
| message: `Secure Storage error: ${error.message}` | |
| }; | |
| } | |
| return { | |
| status: 'healthy', | |
| message: 'Secure Storage Service operational', | |
| bucket: this.bucketName, | |
| security: 'enabled' | |
| }; | |
| } catch (error) { | |
| return { | |
| status: 'error', | |
| message: error.message | |
| }; | |
| } | |
| } | |
| } | |
| module.exports = { SecureStorageService }; | |