chore: path validation before policy check

Author: atilafassina

packages/appkit/src/plugins/files/plugin.ts

@@ -98,17 +98,12 @@ export class FilesPlugin extends Plugin {
     }));
   }
 
-  /** Whether a volume has a policy attached. */
-  private _hasPolicy(volumeKey: string): boolean {
-    return typeof this.volumeConfigs[volumeKey]?.policy === "function";
-  }
-
   /**
    * Extract user identity from the request.
    * Falls back to `getCurrentUserId()` in development mode.
    */
   private _extractUser(req: express.Request): FilePolicyUser {
-    const userId = req.header("x-forwarded-user");
+    const userId = req.header("x-forwarded-user")?.trim();
     if (userId) return { id: userId };
     if (process.env.NODE_ENV === "development") {
       logger.warn(
@@ -167,8 +162,6 @@ export class FilesPlugin extends Plugin {
     path: string,
     resourceOverrides?: Partial<FileResource>,
   ): Promise<boolean> {
-    if (!this._hasPolicy(volumeKey)) return true;
-
     let user: FilePolicyUser;
     try {
       user = this._extractUser(req);
@@ -553,14 +546,14 @@ export class FilesPlugin extends Plugin {
   ): Promise<void> {
     const path = req.query.path as string;
 
-    if (!(await this._enforcePolicy(req, res, volumeKey, "read", path))) return;
-
     const valid = this._isValidPath(path);
     if (valid !== true) {
       res.status(400).json({ error: valid, plugin: this.name });
       return;
     }
 
+    if (!(await this._enforcePolicy(req, res, volumeKey, "read", path))) return;
+
     try {
       const result = await this.execute(
         async () => connector.read(getWorkspaceClient(), path),
@@ -616,15 +609,15 @@ export class FilesPlugin extends Plugin {
   ): Promise<void> {
     const path = req.query.path as string;
 
-    if (!(await this._enforcePolicy(req, res, volumeKey, opts.mode, path)))
-      return;
-
     const valid = this._isValidPath(path);
     if (valid !== true) {
       res.status(400).json({ error: valid, plugin: this.name });
       return;
     }
 
+    if (!(await this._enforcePolicy(req, res, volumeKey, opts.mode, path)))
+      return;
+
     const label = opts.mode === "download" ? "Download" : "Raw fetch";
     const volumeCfg = this.volumeConfigs[volumeKey];
 
@@ -698,15 +691,15 @@ export class FilesPlugin extends Plugin {
   ): Promise<void> {
     const path = req.query.path as string;
 
-    if (!(await this._enforcePolicy(req, res, volumeKey, "exists", path)))
-      return;
-
     const valid = this._isValidPath(path);
     if (valid !== true) {
       res.status(400).json({ error: valid, plugin: this.name });
       return;
     }
 
+    if (!(await this._enforcePolicy(req, res, volumeKey, "exists", path)))
+      return;
+
     try {
       const result = await this.execute(
         async () => connector.exists(getWorkspaceClient(), path),
@@ -736,15 +729,15 @@ export class FilesPlugin extends Plugin {
   ): Promise<void> {
     const path = req.query.path as string;
 
-    if (!(await this._enforcePolicy(req, res, volumeKey, "metadata", path)))
-      return;
-
     const valid = this._isValidPath(path);
     if (valid !== true) {
       res.status(400).json({ error: valid, plugin: this.name });
       return;
     }
 
+    if (!(await this._enforcePolicy(req, res, volumeKey, "metadata", path)))
+      return;
+
     try {
       const result = await this.execute(
         async () => connector.metadata(getWorkspaceClient(), path),
@@ -774,15 +767,15 @@ export class FilesPlugin extends Plugin {
   ): Promise<void> {
     const path = req.query.path as string;
 
-    if (!(await this._enforcePolicy(req, res, volumeKey, "preview", path)))
-      return;
-
     const valid = this._isValidPath(path);
     if (valid !== true) {
       res.status(400).json({ error: valid, plugin: this.name });
       return;
     }
 
+    if (!(await this._enforcePolicy(req, res, volumeKey, "preview", path)))
+      return;
+
     try {
       const result = await this.execute(
         async () => connector.preview(getWorkspaceClient(), path),
@@ -918,17 +911,15 @@ export class FilesPlugin extends Plugin {
     const dirPath =
       typeof req.body?.path === "string" ? req.body.path : undefined;
 
-    if (
-      !(await this._enforcePolicy(req, res, volumeKey, "mkdir", dirPath ?? "/"))
-    )
-      return;
-
     const valid = this._isValidPath(dirPath);
     if (valid !== true) {
       res.status(400).json({ error: valid, plugin: this.name });
       return;
     }
 
+    if (!(await this._enforcePolicy(req, res, volumeKey, "mkdir", dirPath)))
+      return;
+
     try {
       const settings: PluginExecutionSettings = {
         default: FILES_WRITE_DEFAULTS,
@@ -963,24 +954,16 @@ export class FilesPlugin extends Plugin {
   ): Promise<void> {
     const rawPath = req.query.path as string | undefined;
 
-    if (
-      !(await this._enforcePolicy(
-        req,
-        res,
-        volumeKey,
-        "delete",
-        rawPath ?? "/",
-      ))
-    )
-      return;
-
     const valid = this._isValidPath(rawPath);
     if (valid !== true) {
       res.status(400).json({ error: valid, plugin: this.name });
       return;
     }
     const path = rawPath as string;
 
+    if (!(await this._enforcePolicy(req, res, volumeKey, "delete", path)))
+      return;
+
     try {
       const settings: PluginExecutionSettings = {
         default: FILES_WRITE_DEFAULTS,