feat: filesystem blob storage & oauth fix #3

.env.example

This file has not been changed.

.sqlx/query-06eb7c6e1983b6121526ba63612236391290c2e63d37d2bb1cd89ea822950a82.json

This file has not been changed.

.sqlx/query-5031b96c65078d6c54954ce6e57ff9cbba4c48dd8a7546882ab5647114ffab4a.json

This file has not been changed.

.sqlx/query-6258398accee69e0c5f455a3c0ecc273b3da6ef5bb4d8660adafe63d8e3cd2d4.json

This file has not been changed.

.sqlx/query-a4dc8fb22bd094d414c55b9da20b610f7b122b485ab0fd0d0646d68ae8e64fe6.json

This file has not been changed.

.sqlx/query-dec3a21a8e60cc8d2c5dad727750bc88f5535dedae244f7b6e4afa95769b8f1a.json

This file has not been changed.

Cargo.lock

This file has not been changed.

README.md

This file has not been changed.

crates/tranquil-infra/src/lib.rs

This file has not been changed.

crates/tranquil-pds/Cargo.toml

This file has not been changed.

crates/tranquil-pds/src/api/backup.rs

This file has not been changed.

crates/tranquil-pds/src/api/repo/blob.rs

This file has not been changed.

crates/tranquil-pds/src/api/server/reauth.rs

This file has not been changed.

crates/tranquil-pds/src/auth/mod.rs

This file has not been changed.

crates/tranquil-pds/src/oauth/endpoints/authorize.rs

This file has not been changed.

crates/tranquil-pds/src/oauth/endpoints/delegation.rs

This file has not been changed.

crates/tranquil-pds/src/scheduled.rs

This file has not been changed.

crates/tranquil-pds/src/sso/endpoints.rs

This file has not been changed.

crates/tranquil-pds/src/state.rs

This file has not been changed.

crates/tranquil-pds/src/storage/mod.rs

This file has not been changed.

crates/tranquil-pds/tests/common/mod.rs

This file has not been changed.

crates/tranquil-pds/tests/oauth.rs

This file has not been changed.

crates/tranquil-pds/tests/oauth_security.rs

This file has not been changed.

crates/tranquil-storage/Cargo.toml

This file has not been changed.

+88 -1

crates/tranquil-storage/src/lib.rs

··· 19 19 20 20 const MIN_PART_SIZE: usize = 5 * 1024 * 1024; 21 21 const EXDEV: i32 = 18; 22 22 + const CID_HASH_OFFSET: usize = 7; 23 23 + const SHARD_LENGTH: usize = 2; 22 24 25 25 + fn extract_cid_shard(key: &str) -> Option<&str> { 26 26 + let min_len = CID_HASH_OFFSET + SHARD_LENGTH; 27 27 + let is_cid = key.get(..3).map_or(false, |p| p.eq_ignore_ascii_case("baf")); 28 28 + (key.len() >= min_len && is_cid).then(|| &key[CID_HASH_OFFSET..CID_HASH_OFFSET + SHARD_LENGTH]) 29 29 + } 30 30 + 23 31 fn validate_key(key: &str) -> Result<(), StorageError> { 24 32 let dominated_by_traversal = key 25 33 .split('/') ··· 483 491 484 492 fn resolve_path(&self, key: &str) -> Result<PathBuf, StorageError> { 485 493 validate_key(key)?; 486 486 - Ok(self.base_path.join(key)) 494 494 + Ok(extract_cid_shard(key).map_or_else( 495 495 + || self.base_path.join(key), 496 496 + |shard| self.base_path.join(shard).join(key), 497 497 + )) 487 498 } 488 499 489 500 async fn atomic_write(&self, path: &Path, data: &[u8]) -> Result<(), StorageError> { ··· 751 762 } 752 763 753 764 impl<T> Pipe for T {} 765 765 + 766 766 + #[cfg(test)] 767 767 + mod tests { 768 768 + use super::*; 769 769 + 770 770 + #[test] 771 771 + fn extract_shard_from_raw_blob_cid() { 772 772 + let cid = "bafkreihdwdcefgh4dqkjv67uzcmw7ojee6xedzdetojuzjevtenxquvyku"; 773 773 + assert_eq!(extract_cid_shard(cid), Some("hd")); 774 774 + } 775 775 + 776 776 + #[test] 777 777 + fn extract_shard_from_dag_cbor_cid() { 778 778 + let cid = "bafyreigdmqpykrgxyaxtlafqpqhzrb7qy2rh75nldvfd4tucqmqqme5yje"; 779 779 + assert_eq!(extract_cid_shard(cid), Some("gd")); 780 780 + } 781 781 + 782 782 + #[test] 783 783 + fn no_shard_for_temp_keys() { 784 784 + assert_eq!(extract_cid_shard("temp/abc123"), None); 785 785 + } 786 786 + 787 787 + #[test] 788 788 + fn no_shard_for_short_keys() { 789 789 + assert_eq!(extract_cid_shard("bafkrei"), None); 790 790 + assert_eq!(extract_cid_shard("baf"), None); 791 791 + assert_eq!(extract_cid_shard("ba"), None); 792 792 + assert_eq!(extract_cid_shard(""), None); 793 793 + } 794 794 + 795 795 + #[test] 796 796 + fn no_shard_for_non_cid_keys() { 797 797 + assert_eq!(extract_cid_shard("something/else/entirely"), None); 798 798 + assert_eq!(extract_cid_shard("Qmabcdefghijklmnop"), None); 799 799 + } 800 800 + 801 801 + #[test] 802 802 + fn extract_shard_case_insensitive() { 803 803 + let upper = "BAFKREIHDWDCEFGH4DQKJV67UZCMW7OJEE6XEDZDETOJUZJEVTENXQUVYKU"; 804 804 + let mixed = "BaFkReIhDwDcEfGh4DqKjV67UzCmW7OjEe6XeDzDeTojUzJevTeNxQuVyKu"; 805 805 + assert_eq!(extract_cid_shard(upper), Some("HD")); 806 806 + assert_eq!(extract_cid_shard(mixed), Some("hD")); 807 807 + } 808 808 + 809 809 + #[test] 810 810 + fn shard_at_minimum_length() { 811 811 + let cid = "bafkreiab"; 812 812 + assert_eq!(extract_cid_shard(cid), Some("ab")); 813 813 + } 814 814 + 815 815 + #[test] 816 816 + fn resolve_path_shards_cid_keys() { 817 817 + let base = PathBuf::from("/blobs"); 818 818 + let cid = "bafkreihdwdcefgh4dqkjv67uzcmw7ojee6xedzdetojuzjevtenxquvyku"; 819 819 + 820 820 + let expected = PathBuf::from("/blobs/hd/bafkreihdwdcefgh4dqkjv67uzcmw7ojee6xedzdetojuzjevtenxquvyku"); 821 821 + let result = extract_cid_shard(cid).map_or_else( 822 822 + || base.join(cid), 823 823 + |shard| base.join(shard).join(cid), 824 824 + ); 825 825 + assert_eq!(result, expected); 826 826 + } 827 827 + 828 828 + #[test] 829 829 + fn resolve_path_no_shard_for_temp() { 830 830 + let base = PathBuf::from("/blobs"); 831 831 + let key = "temp/abc123"; 832 832 + 833 833 + let expected = PathBuf::from("/blobs/temp/abc123"); 834 834 + let result = extract_cid_shard(key).map_or_else( 835 835 + || base.join(key), 836 836 + |shard| base.join(shard).join(key), 837 837 + ); 838 838 + assert_eq!(result, expected); 839 839 + } 840 840 + }

docs/install-containers.md

This file has not been changed.

docs/install-debian.md

This file has not been changed.

docs/install-kubernetes.md

This file has not been changed.

frontend/src/routes/OAuthDelegation.svelte

This file has not been changed.

frontend/src/routes/OAuthRegister.svelte

This file has not been changed.

frontend/src/routes/OAuthSsoRegister.svelte

This file has not been changed.

frontend/src/routes/RegisterPasskey.svelte

This file has not been changed.

scripts/install-debian.sh

This file has not been changed.