fix(server): file persistence for local upload provider

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:12.16.3-buster-slim AS build
+FROM node:14.21.3-buster-slim AS build
 WORKDIR /app
 
 COPY package.json yarn.lock ./
@@ -7,7 +7,7 @@ RUN yarn install --frozen-lockfile && yarn cache clean
 COPY . .
 RUN yarn build
 
-FROM node:12.16.3-buster-slim AS run
+FROM node:14.21.3-buster-slim AS run
 WORKDIR /app
 
 COPY --from=build /app/yarn.lock /app/package.json /app/

docker-compose.yml

@@ -13,6 +13,7 @@ services:
       - PORT=80
     volumes:
       - ./conf.d:/app/conf.d
+      - ./data/rctf-uploads:/app/uploads
     depends_on:
       - redis
       - postgres

install/install.sh

@@ -69,7 +69,7 @@ do_install() {
 
   RCTF_GIT_REF="${RCTF_GIT_REF:-"master"}"
 
-  mkdir -p conf.d data/rctf-postgres data/rctf-redis
+  mkdir -p conf.d data/rctf-postgres data/rctf-redis data/rctf-uploads
 
   printf "%s\n" \
   "RCTF_DATABASE_PASSWORD=$(get_key)" \

package.json

@@ -45,7 +45,7 @@
     "fastify": "3.2.0",
     "fastify-cors": "4.1.0",
     "fastify-helmet": "5.0.0",
-    "fastify-static": "3.2.0",
+    "fastify-static": "4.6.1",
     "got": "11.5.2",
     "hyperid": "2.0.5",
     "jss-plugin-global": "10.4.0",

server/providers/uploads/local/index.ts

@@ -6,7 +6,7 @@ import crypto from 'crypto'
 import config from '../../../config/server'
 import { FastifyInstance } from 'fastify'
 import fastifyStatic from 'fastify-static'
-import contentDisposition from 'content-disposition'
+import { ServerResponse } from 'http'
 
 interface LocalProviderOptions {
   uploadDirectory?: string;
@@ -26,8 +26,6 @@ export default class LocalProvider implements Provider {
   private uploadDirectory: string
   private endpoint: string
 
-  private uploadMap: Map<string, Upload>
-
   constructor (options: LocalProviderOptions, app: FastifyInstance) {
     if (options.uploadDirectory === undefined) {
       options.uploadDirectory = path.join(process.cwd(), 'uploads')
@@ -38,49 +36,16 @@ export default class LocalProvider implements Provider {
     this.uploadDirectory = path.resolve(options.uploadDirectory)
     this.endpoint = options.endpoint || '/uploads'
 
-    this.uploadMap = new Map<string, Upload>()
-
-    void app.register(async (fastify) => {
-      void fastify.register(fastifyStatic, {
-        root: this.uploadDirectory,
-        serve: false
-      })
-
-      // Fastify bug #2466
-      // eslint-disable-next-line @typescript-eslint/no-misused-promises
-      fastify.setNotFoundHandler(async (req, res) => {
-        void res.status(404)
-        return 'Not found'
-      })
-
-      fastify.get<{
-        Querystring: RequestQuerystring
-      }>('/', {
-        schema: {
-          querystring: {
-            type: 'object',
-            properties: {
-              key: {
-                type: 'string'
-              }
-            },
-            required: ['key']
-          }
-        }
-      }, async (request, reply) => {
-        const key = request.query.key.toString()
-
-        const upload = this.uploadMap.get(key)
-        if (upload != null) {
-          void reply.header('Cache-Control', 'public, max-age=31557600, immutable')
-          void reply.header('Content-Disposition', contentDisposition(upload.name))
-          void reply.sendFile(path.relative(this.uploadDirectory, upload.filePath))
-        } else {
-          reply.callNotFound()
-        }
-      })
-    }, {
-      prefix: this.endpoint
+    void app.register(fastifyStatic, {
+      root: this.uploadDirectory,
+      prefix: this.endpoint,
+      decorateReply: false,
+      dotfiles: 'allow',
+      index: false,
+      setHeaders: (res: ServerResponse) => {
+        res.setHeader('cache-control', 'public, max-age=31557600, immutable')
+        res.setHeader('content-disposition', 'atttachment')
+      }
     })
   }
 
@@ -89,7 +54,7 @@ export default class LocalProvider implements Provider {
   }
 
   private getUrlPath (key: string): string {
-    return `${this.endpoint}?key=${encodeURIComponent(key)}`
+    return `${this.endpoint}/${key}`
   }
 
   async upload (data: Buffer, name: string): Promise<string> {
@@ -99,21 +64,21 @@ export default class LocalProvider implements Provider {
 
     const key = this.getKey(hash, name)
     const urlPath = this.getUrlPath(key)
-    const filePath = path.join(this.uploadDirectory, hash)
-
-    this.uploadMap.set(key, {
-      filePath,
-      name
-    })
+    const filePath = path.join(this.uploadDirectory, hash, name)
 
+    await fs.promises.mkdir(path.join(this.uploadDirectory, hash))
     await fs.promises.writeFile(filePath, data)
 
     return (config.origin || '') + urlPath
   }
 
   async getUrl (sha256: string, name: string): Promise<string|null> {
     const key = this.getKey(sha256, name)
-    if (!this.uploadMap.has(key)) return null
+    try {
+      await fs.promises.access(path.join(this.uploadDirectory, key))
+    } catch {
+      return null
+    }
 
     return this.getUrlPath(key)
   }