dorfteich/apps/api/src/files/files.module.ts
Claude Fable 5 74970f6073
Some checks failed
CI / Lint, typecheck, test (pull_request) Successful in 6m12s
CI / Build container images (pull_request) Successful in 3m4s
CI / Auth e2e pack (pull_request) Successful in 8m35s
CI / Import/export fidelity gate (pull_request) Successful in 1m2s
CI / Import/export fidelity gate (push) Blocked by required conditions
CD / Build and push images (push) Successful in 29s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m35s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m10s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Has been cancelled
#199: SHA-256 integrity hashes for attachments
Every upload stores the SHA-256 of its bytes, computed from the
in-memory buffer that is written — never by re-reading disk. Every
download re-hashes the stored object BEFORE the first byte leaves
(memory bounded by the max_file_bytes quota that gated the upload) and
fails closed on mismatch with attachment_integrity_failure; the
mismatch lands in the audit trail as file.integrity_failed with both
hashes. Detection of payload manipulation is the one integrity duty
par. 52 VSA leaves with the application — only it knows what the file
should be.

Pre-#199 rows are hashed by a bounded, idempotent backfill that rides
the existing nightly orphan-file-sweep job (no new scheduler job, job
fence untouched); unreadable files are logged and retried, never
silently skipped, and null-hash rows are served unverified only until
the backfill reaches them. Operator runbook note in security.md
(restore from backup, re-download, audit entry carries both hashes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ
2026-07-31 04:32:29 +02:00

44 lines
1.6 KiB
TypeScript

import { Module, OnModuleInit } from '@nestjs/common';
import { CommonModule } from '../common/common.module';
import { PondsModule } from '../ponds/ponds.module';
import { QuotasModule } from '../quotas/quotas.module';
import { SchedulerModule } from '../scheduler/scheduler.module';
import { SchedulerService } from '../scheduler/scheduler.service';
import { FileStorageService } from './file-storage.service';
import { FilesController } from './files.controller';
import { FilesService } from './files.service';
import { OrphanSweepService } from './orphan-sweep.service';
/** Nightly, per operations.md's maintenance-jobs table (issue #194). */
const ORPHAN_SWEEP_CADENCE_SECONDS = 24 * 60 * 60;
@Module({
imports: [CommonModule, PondsModule, QuotasModule, SchedulerModule],
controllers: [FilesController],
providers: [FilesService, FileStorageService, OrphanSweepService],
exports: [FileStorageService, FilesService],
})
export class FilesModule implements OnModuleInit {
constructor(
private readonly scheduler: SchedulerService,
private readonly sweep: OrphanSweepService,
private readonly files: FilesService,
) {}
onModuleInit(): void {
this.scheduler.register({
name: 'orphan-file-sweep',
cadenceSeconds: ORPHAN_SWEEP_CADENCE_SECONDS,
run: async () => {
await this.sweep.sweep();
// Same nightly volume walk, same domain: hash rows that predate
// #199 until none remain (idempotent, bounded batch) — a separate
// scheduled job would outlive its purpose.
await this.files.backfillHashes();
},
});
}
}