Some checks failed
CI / Lint, typecheck, test (pull_request) Successful in 6m12s
CI / Build container images (pull_request) Successful in 3m4s
CI / Auth e2e pack (pull_request) Successful in 8m35s
CI / Import/export fidelity gate (pull_request) Successful in 1m2s
CI / Import/export fidelity gate (push) Blocked by required conditions
CD / Build and push images (push) Successful in 29s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m35s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m10s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Has been cancelled
Every upload stores the SHA-256 of its bytes, computed from the in-memory buffer that is written — never by re-reading disk. Every download re-hashes the stored object BEFORE the first byte leaves (memory bounded by the max_file_bytes quota that gated the upload) and fails closed on mismatch with attachment_integrity_failure; the mismatch lands in the audit trail as file.integrity_failed with both hashes. Detection of payload manipulation is the one integrity duty par. 52 VSA leaves with the application — only it knows what the file should be. Pre-#199 rows are hashed by a bounded, idempotent backfill that rides the existing nightly orphan-file-sweep job (no new scheduler job, job fence untouched); unreadable files are logged and retried, never silently skipped, and null-hash rows are served unverified only until the backfill reaches them. Operator runbook note in security.md (restore from backup, re-download, audit entry carries both hashes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ
44 lines
1.6 KiB
TypeScript
44 lines
1.6 KiB
TypeScript
import { Module, OnModuleInit } from '@nestjs/common';
|
|
|
|
import { CommonModule } from '../common/common.module';
|
|
import { PondsModule } from '../ponds/ponds.module';
|
|
import { QuotasModule } from '../quotas/quotas.module';
|
|
import { SchedulerModule } from '../scheduler/scheduler.module';
|
|
import { SchedulerService } from '../scheduler/scheduler.service';
|
|
|
|
import { FileStorageService } from './file-storage.service';
|
|
import { FilesController } from './files.controller';
|
|
import { FilesService } from './files.service';
|
|
import { OrphanSweepService } from './orphan-sweep.service';
|
|
|
|
/** Nightly, per operations.md's maintenance-jobs table (issue #194). */
|
|
const ORPHAN_SWEEP_CADENCE_SECONDS = 24 * 60 * 60;
|
|
|
|
@Module({
|
|
imports: [CommonModule, PondsModule, QuotasModule, SchedulerModule],
|
|
controllers: [FilesController],
|
|
providers: [FilesService, FileStorageService, OrphanSweepService],
|
|
exports: [FileStorageService, FilesService],
|
|
})
|
|
export class FilesModule implements OnModuleInit {
|
|
constructor(
|
|
private readonly scheduler: SchedulerService,
|
|
private readonly sweep: OrphanSweepService,
|
|
private readonly files: FilesService,
|
|
) {}
|
|
|
|
onModuleInit(): void {
|
|
this.scheduler.register({
|
|
name: 'orphan-file-sweep',
|
|
cadenceSeconds: ORPHAN_SWEEP_CADENCE_SECONDS,
|
|
run: async () => {
|
|
await this.sweep.sweep();
|
|
// Same nightly volume walk, same domain: hash rows that predate
|
|
// #199 until none remain (idempotent, bounded batch) — a separate
|
|
// scheduled job would outlive its purpose.
|
|
await this.files.backfillHashes();
|
|
},
|
|
});
|
|
}
|
|
}
|