- 8 repository/port doc comments pointed at long-gone src/db/*
layout; now reference the real drizzle repository paths
- test:unit and test:s3 now include test/s3-routing.test.ts
(was passing but never wired into any script)
Zero importers in src/ and test/ (verified by grep). Live DTOs:
auth (authenticate use-case + controller) and upload (upload-file
use-case). Build + biome green; full test:unit green.
- web-api create-bucket and s3 virtual-host now use BucketNameSchema
(single canonical validator; no inline regex left in src/)
- routes '/': HEAD/DELETE/POST now check shouldHandleS3 with headers
like every other branch (non-S3 -> 404, never S3-direct blind)
- s3-routing.test.ts: 3 new tests locking the fixed root verbs
- files.test.ts: 302-redirect expectation replaced with 200-proxy
assertion (bot token only in server-side fetch, never Location)
- deploy-config.test.ts: retarget from deleted .gitea workflow to
.github/workflows/deploy.yml (CI migrated to GitHub Actions in
811a688); asserts nix build + VPS deploy shape
- upload-file use-case is now the single save path with dedup policy
(hash / bucket-key / none), partPrefix + signatureBuffer inputs,
fileHash in UploadOutput, and owned temp-file cleanup; pass temp
path (not open stream) to telegram service for testability
- upload-controller (multipart + JSON) and web-api upload delegate
to the use-case; JSON body via JsonUploadPayloadSchema; responses
built from use-case output via buildUploadResponse
- web-api download 302 redirect -> proxy stream (closes bot_token
leak); shared CORS + sanitizeFilenameHeader
- file-controller drops double file-info cache layer (pool caches)
- bot handler uses DI singletons instead of direct construction
- get-file RedirectRetrieval.redirectUrl marked deprecated, URL via
shared builder; chunked-storage URL via buildTelegramFileUrl
(no inline api.telegram.org/file/bot left in src/)
PUT streaming assert now reads s3/s3-object-write.ts and UploadPart
assert reads s3/s3-multipart-handlers.ts (s3-controller.ts is a thin
facade since the split). No behavior change.
- routes: GET / teruskan headers ke shouldHandleS3; OPTIONS jawab
204 CORS generik bila bukan S3, handleS3Direct bila S3; komentar
bypass rate-limit S3 dipertahankan (registry abort pada 429)
- auth-controller: readLoginBody via LoginBodySchema; handleMe sederhanakan
(getAuthSession sudah cek bearer); import AuthSession dari dto
- swagger: pindah src/routes -> src/interfaces/http/swagger; tambah path
auth, /api/v1, /{bucket}, /{bucket}/{key}; version dari config.appVersion
- index: unref ketiga setInterval agar tak menahan process
- env: PORT fail-fast via PositiveIntSchema (default 4000 bila tak diset);
log config turun ke debug
- metrics: dokumentasikan uploadThroughput/queueSize/botUtilization
- test baru test/s3-routing.test.ts (GET / S3 vs home, OPTIONS 204 CORS)
- Add zod dep; new src/shared/validation/schemas.ts (BucketName,
JsonUploadPayload, LoginBody, DeleteObjects, CompleteMultipart,
clampMaxKeys, parseOrNull) + test/validation.test.ts
- Dedup timingSafeCompare -> src/shared/utils/crypto.ts (auth
middleware, authenticate use-case, s3/auth now import it)
- Dedup AuthSession -> single type in dto/auth.ts
- Dedup telegram file URL builder + filename sanitizer to shared
modules (file-controller now imports the canonical ones)
- Remove duplicate controllers/home.html (canonical: src/home.html)
- Fix stale bootstrap mocks to real module paths; bootstrap now
asserts public GET vs guarded POST separately
- Fix health assertion to include version field
- package.json: test -> test:unit alias; new test:quarantine for
network/live tests; register previously unlisted test files
The health endpoint was returning version 0.0.0 because readPackageVersion()
tried import.meta.require on a JSON path that Bun cannot bundle and the
package.json never shipped into the Nix store (installPhase only copied
dist/, home.html, schema.sql).
- flake.nix installPhase now copies package.json into $out/share/teleuploader/
- readPackageVersion() reads import.meta.dir/../package.json (bundle) or
process.cwd()/package.json (dev) via readFileSync at runtime
Verified local resolution to 1.2.1; after this fixes deploy it will expose
the live semver on GET /health.
dispatch.mjs dispatches deploy.yml via workflow_dispatch, which requires
actions: write. Without it the success hook hit HTTP 403 (Resource not
accessible by integration), same trap as the mytheclipse pipeline, and the
auto deploy never ran for v1.2.1.
prepare.mjs previously replaced the FIRST version="X" string in flake.nix,
which is the Bun overlay override (line ~17), not the TeleUploader package
version (pname = "teleuploader", line ~30). Store path derives from the
TeleUploader version, so the Bun override got clobbered to the app version
while the store path stayed at 1.1.1 -> deploy reused the old derivation and
the VPS profile never advanced.
Now prepare.mjs anchors on pname = "teleuploader" and bumps that block only,
leaving the Bun 1.3.14 override intact. Verified: flake.nix keeps
bun version=1.3.14, teleuploader version becomes the semver-version.
Also restores bun overlay version=1.3.14 (was overwritten to 1.2.0).
GitHub disables workflow re-triggering for GITHUB_TOKEN pushes (the release
commit), so the push trigger in deploy.yml never runs for release commits.
This adds @semantic-release/exec successCmd -> .semrel/dispatch.mjs which
dispatches deploy.yml for every released version, completing the auto loop:
fix/feat -> semantic-release bump -> release commit+tag -> deploy.
Reads application version from package.json via env.ts readPackageVersion()
and returns it alongside status so deploy verification is instant:
curl https://upload.asepharyana.my.id/health -> {status: ok, version: X.Y.Z}
- .releaserc.json: commit-analyzer + release-notes-generator + changelog
+ exec (prepare) + git + github plugins.
- .semrel/prepare.mjs: syncs next release version into package.json AND
flake.nix before the release commit — guarantees a fresh Nix store path
on every deploy (fixes the trap where a source change without a version
bump reused the same store path and CI silently deployed stale code).
- release.yml: runs semantic-release on main push (GITHUB_TOKEN,
isolated /tmp/sr-tools install so package.json/bun.lock stay clean).
- Release commit (no [skip ci]) triggers deploy.yml → auto build+deploy.
- Baseline tag v1.1.1 backfilled at current HEAD.
Force a fresh Nix store path so the Buffer-from-gzip fix actually reaches
the VPS. The 1.1.0 store path hash was reused by Nix (identical derivation
inputs from Nix's perspective), so a version bump guarantees the fixed
dist bundle is copied and the profile is switched.
Root cause of '400: Bad Request: there is no document in the request' on
chunked uploads of compressible files (MP4, zip, text, etc.):
Bun.gzipSync() returns a plain Uint8Array, NOT a Buffer. Telegraf
(sendDocument/sendVideo) only recognises Buffer/Blob/stream sources as
file uploads — a plain Uint8Array produces an empty multipart body and
Telegram rejects the request.
Verified via isolated forwardToStorage probes:
- raw Buffer chunk (.bin, MP4) -> OK
- plain Uint8Array chunk -> FAIL: there is no document
- Buffer.from(gzip) chunk -> OK (after fix)
- .gz extension on Uint8Array did NOT help (rules out MIME/extension)
This only affected chunked uploads of compressible files; incompressible
files (random .bin) worked by accident because gzip didn't shrink them so
the raw Buffer was forwarded unchanged.
Fixes browser CORS error when frontend fetches audio via Web Audio API
(decodeAudio): the 302 redirected to api.telegram.org which lacks
Access-Control-Allow-Origin, blocking fetch/XHR. Now the file bytes are
proxied server-side with CORS headers + proper Content-Type, so the
browser stays same-origin. Also adds CORS to chunked/archive streams.
Bun 1.4.0 (upgraded 0deb607) breaks Telegraf 4.15 sendDocument with
'The socket connection was closed unexpectedly' — reproduced with the same
libraries: Telegraf 4.15.0 on Bun 1.4.0 fails exactly like prod, on Bun 1.3.14
it returns a proper HTTP response. All uploads 500 since the upgrade deployed
(Aug 29 11:06). Pin flake nix override + CI bun-version to 1.3.14.
- Update Nix flake.nix overlay to use Bun 1.4.0 (overrideAttrs)
- Update CI (setup-bun) to pin bun-version: 1.4.0
- Update package.json packageManager/Dockerfile/vercel.json
- sha256: sha256:Poy0vf7yJ/hzk33QiQj5gnshI5Q7dfbaMD7xgwiyDKw=
Add comprehensive unit tests and repair stale tests that referenced the
old (pre-refactor) src/utils/* layout which no longer exists:
- s3-range: expand to 25 cases (suffix, clamping, malformed, zero-size,
invalid totals, content-range formatting)
- s3-object-stream: rewrite against the real interfaces/s3 module; add
multi-part ordering, ranges spanning parts, S3/CORS headers, fetch-error
propagation
- s3-helpers-edge (new): compress heuristics, virtual-host bucket parsing,
S3 route detection, client-IP/trustProxy, S3 response headers
- s3-auth-edge (new): verifyBodyHash, isS3Request, canonical-query-string
encoding/sorting
- chunked-storage: rewrite against the real ChunkedStorage class (was
importing deleted src/utils/chunked-storage) — chunk split, hashing,
compression, size-limit guards, forwarding
- zip: fix stale import + add path-traversal/duplicate sanitization,
locateZipEntry, empty-name fallback
- s3-docker-registry: fix stale src/config import; correct the rate-limit
test to assert S3 routes INTENTIONALLY bypass rate limiting
- temp-stream (new): streamToTemp hashing, MD5, signature bytes, empty and
oversized streams
- package.json: add the S3/unit files to test and test:s3 scripts
All new unit tests pass when run per-file (the project's documented mode to
avoid cross-file mock pollution). s3-sdk.test.ts (live E2E against a running
server) is deliberately excluded from test:s3.
Optimize the S3 GET path for chunked/multipart objects and reduce Telegram
API round-trips:
- object-stream: fetch object parts concurrently (bounded, in-order fan-in)
instead of serializing N sequential Telegram CDN fetches. Response latency
is now ~the slowest part fetch, not the sum of all part fetches.
- bot-pool.getFileInfo: cache file_id -> file_path in the existing in-memory
cache so repeated S3 GET/HEAD of the same object skip the Telegram API call
(file-controller had its own cache wrapper; the S3 path did not).
- chunked-storage + s3-controller: resolve multipart/chunked part CDN URLs
concurrently via Promise.all instead of sequentially.
- s3-controller multipart: await writer.end() before re-reading the temp part
file to avoid a flush race.
Adds object-stream-parallel.test.ts covering in-order fan-in, byte ranges,
and single-part responses even when the slowest part resolves out of order.
asepharyana
semantic-release-bot
asepharyana
asepharyana
mytheclipsebotreview[bot]
dependabot[bot]