pn-new-crm/src/app/api/storage/[token]/route.ts

/**
 * Filesystem-backend download proxy.
 *
 * The `FilesystemBackend.presignDownload(...)` returns a CRM-internal URL of
 * the form `/api/storage/<hmac-signed-token>`. This route verifies the HMAC,
 * checks expiry, enforces single-use via a short Redis cache, then streams
 * the file out with explicit `Content-Type` + `Content-Disposition`.
 *
 * §14.9a mitigations exercised here:
 * - HMAC verification (timingSafeEqual via filesystem.verifyProxyToken)
 * - expiry check (token includes `e` epoch seconds)
 * - single-use replay protection via short Redis SET-NX
 * - Node runtime only (no edge); explicit headers so Next.js doesn't try to
 *   process the bytes (no image optimization, no streaming transforms)
 */

import { createReadStream } from 'node:fs';
import * as fs from 'node:fs/promises';
import { Readable } from 'node:stream';

import { NextRequest, NextResponse } from 'next/server';

import { logger } from '@/lib/logger';
import { redis } from '@/lib/redis';
import { FilesystemBackend, getStorageBackend } from '@/lib/storage';
import { verifyProxyToken } from '@/lib/storage/filesystem';

export const runtime = 'nodejs';
export const dynamic = 'force-dynamic';

const REPLAY_TTL_SECONDS = 60 * 30; // 30min — longer than any presign expiry default.

export async function GET(
  _req: NextRequest,
  ctx: { params: Promise<{ token: string }> },
): Promise<NextResponse> {
  const { token } = await ctx.params;

  const backend = await getStorageBackend();
  if (!(backend instanceof FilesystemBackend)) {
    return NextResponse.json(
      { error: 'Storage proxy is only available in filesystem mode' },
      { status: 404 },
    );
  }

  const result = verifyProxyToken(token, backend.getHmacSecret());
  if (!result.ok) {
    logger.warn({ reason: result.reason }, 'Storage proxy token rejected');
    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 403 });
  }
  const { payload } = result;

  // Single-use enforcement. SET NX with a TTL longer than the token itself.
  // Using the body half of the token as the dedup key (signature included
  // would also work but body is enough — a reused token has the same body).
  const replayKey = `storage:proxy:seen:${token.split('.')[0]}`;
  const setOk = await redis.set(replayKey, '1', 'EX', REPLAY_TTL_SECONDS, 'NX');
  if (setOk !== 'OK') {
    logger.warn({ key: payload.k }, 'Storage proxy token replay rejected');
    return NextResponse.json({ error: 'Token already used' }, { status: 403 });
  }

  let absolutePath: string;
  try {
    absolutePath = backend.resolveKeyForProxy(payload.k);
  } catch (err) {
    logger.warn({ err, key: payload.k }, 'Storage proxy key resolution failed');
    return NextResponse.json({ error: 'Invalid key' }, { status: 400 });
  }

  let size: number;
  try {
    const stat = await fs.stat(absolutePath);
    if (!stat.isFile()) {
      return NextResponse.json({ error: 'Not found' }, { status: 404 });
    }
    size = stat.size;
  } catch (err) {
    const code = (err as NodeJS.ErrnoException).code;
    if (code === 'ENOENT') {
      return NextResponse.json({ error: 'Not found' }, { status: 404 });
    }
    throw err;
  }

  // Convert the Node Readable into a Web ReadableStream for NextResponse.
  const nodeStream = createReadStream(absolutePath);
  const webStream = Readable.toWeb(nodeStream) as unknown as ReadableStream<Uint8Array>;

  const headers = new Headers();
  headers.set('Content-Type', payload.c ?? 'application/octet-stream');
  headers.set('Content-Length', String(size));
  if (payload.f) {
    // RFC 5987 — quote the filename and provide a UTF-8 fallback.
    const safe = payload.f.replace(/"/g, '');
    headers.set(
      'Content-Disposition',
      `attachment; filename="${safe}"; filename*=UTF-8''${encodeURIComponent(payload.f)}`,
    );
  }
  headers.set('Cache-Control', 'private, no-store');
  headers.set('X-Content-Type-Options', 'nosniff');

  return new NextResponse(webStream, { status: 200, headers });
}