feat: add image upload for avatar and banner

crates/adapters/storage/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "storage"
+version = "0.1.0"
+edition = "2021"
+
+[features]
+s3 = ["object_store/aws"]
+
+[dependencies]
+domain      = { workspace = true }
+async-trait = { workspace = true }
+bytes       = { workspace = true }
+futures     = { workspace = true }
+anyhow      = { workspace = true }
+object_store = { version = "0.11" }
+
+[dev-dependencies]
+tokio = { workspace = true, features = ["full"] }

crates/adapters/storage/src/adapter.rs

@@ -0,0 +1,237 @@
+use async_trait::async_trait;
+use domain::{
+    errors::DomainError,
+    ports::{DataStream, MediaStore},
+};
+use futures::stream::StreamExt;
+use object_store::{path::Path, Error as OsError, ObjectStore};
+use std::sync::Arc;
+
+pub struct ObjectStorageAdapter {
+    store: Arc<dyn ObjectStore>,
+    prefix: String,
+}
+
+fn validate_key(key: &str) -> Result<(), DomainError> {
+    if key.is_empty() {
+        return Err(DomainError::InvalidInput(
+            "storage key must not be empty".into(),
+        ));
+    }
+    if key.starts_with('/') {
+        return Err(DomainError::InvalidInput(format!(
+            "storage key must not start with '/': {key}"
+        )));
+    }
+    if key.split('/').any(|seg| seg == ".." || seg == ".") {
+        return Err(DomainError::InvalidInput(format!(
+            "storage key contains invalid path segment: {key}"
+        )));
+    }
+    Ok(())
+}
+
+fn map_os_err(e: OsError) -> DomainError {
+    match e {
+        OsError::NotFound { .. } => DomainError::NotFound,
+        e => DomainError::Internal(e.to_string()),
+    }
+}
+
+impl ObjectStorageAdapter {
+    pub fn new(
+        store: Arc<dyn ObjectStore>,
+        prefix: impl Into<String>,
+    ) -> Result<Self, DomainError> {
+        let prefix = prefix.into();
+        if !prefix.is_empty() {
+            validate_key(&prefix)?;
+        }
+        Ok(Self { store, prefix })
+    }
+
+    fn path(&self, key: &str) -> Path {
+        if self.prefix.is_empty() {
+            Path::from(key)
+        } else {
+            Path::from(format!("{}/{key}", self.prefix))
+        }
+    }
+}
+
+#[async_trait]
+impl MediaStore for ObjectStorageAdapter {
+    async fn put(&self, key: &str, data: DataStream) -> Result<(), DomainError> {
+        validate_key(key)?;
+        let path = self.path(key);
+        let mut upload = self
+            .store
+            .put_multipart(&path)
+            .await
+            .map_err(|e| DomainError::Internal(e.to_string()))?;
+        let mut stream = data;
+        while let Some(result) = stream.next().await {
+            match result {
+                Ok(bytes) => {
+                    if let Err(e) = upload.put_part(bytes.into()).await {
+                        let _ = upload.abort().await;
+                        return Err(DomainError::Internal(e.to_string()));
+                    }
+                }
+                Err(e) => {
+                    let _ = upload.abort().await;
+                    return Err(e);
+                }
+            }
+        }
+        upload
+            .complete()
+            .await
+            .map(|_| ())
+            .map_err(|e| DomainError::Internal(e.to_string()))
+    }
+
+    async fn get(&self, key: &str) -> Result<DataStream, DomainError> {
+        validate_key(key)?;
+        let path = self.path(key);
+        let result = self.store.get(&path).await.map_err(map_os_err)?;
+        let s = result
+            .into_stream()
+            .map(|r| r.map_err(|e| DomainError::Internal(e.to_string())));
+        Ok(Box::pin(s))
+    }
+
+    async fn delete(&self, key: &str) -> Result<(), DomainError> {
+        validate_key(key)?;
+        let path = self.path(key);
+        match self.store.delete(&path).await {
+            Ok(()) => Ok(()),
+            Err(OsError::NotFound { .. }) => Ok(()),
+            Err(e) => Err(DomainError::Internal(e.to_string())),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bytes::Bytes;
+    use futures::stream;
+    use object_store::memory::InMemory;
+
+    fn make_adapter() -> ObjectStorageAdapter {
+        ObjectStorageAdapter::new(Arc::new(InMemory::new()), "test").unwrap()
+    }
+
+    fn one_shot(data: &'static [u8]) -> DataStream {
+        Box::pin(stream::once(async move { Ok(Bytes::from(data)) }))
+    }
+
+    #[tokio::test]
+    async fn put_get_roundtrip() {
+        let a = make_adapter();
+        a.put("hello.txt", one_shot(b"world")).await.unwrap();
+        let mut s = a.get("hello.txt").await.unwrap();
+        let mut out = Vec::new();
+        while let Some(chunk) = s.next().await {
+            out.extend_from_slice(&chunk.unwrap());
+        }
+        assert_eq!(out, b"world");
+    }
+
+    #[tokio::test]
+    async fn get_missing_is_not_found() {
+        let a = make_adapter();
+        assert!(matches!(
+            a.get("nope.txt").await,
+            Err(DomainError::NotFound)
+        ));
+    }
+
+    #[tokio::test]
+    async fn delete_is_idempotent() {
+        let a = make_adapter();
+        a.delete("nope.txt").await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn delete_removes_key() {
+        let a = make_adapter();
+        a.put("file.txt", one_shot(b"data")).await.unwrap();
+        a.delete("file.txt").await.unwrap();
+        assert!(matches!(
+            a.get("file.txt").await,
+            Err(DomainError::NotFound)
+        ));
+    }
+
+    #[tokio::test]
+    async fn put_overwrites_existing() {
+        let a = make_adapter();
+        a.put("file.txt", one_shot(b"v1")).await.unwrap();
+        a.put("file.txt", one_shot(b"v2")).await.unwrap();
+        let mut s = a.get("file.txt").await.unwrap();
+        let mut out = Vec::new();
+        while let Some(chunk) = s.next().await {
+            out.extend_from_slice(&chunk.unwrap());
+        }
+        assert_eq!(out, b"v2");
+    }
+
+    #[tokio::test]
+    async fn rejects_empty_key() {
+        let a = make_adapter();
+        assert!(matches!(
+            a.put("", one_shot(b"x")).await,
+            Err(DomainError::InvalidInput(_))
+        ));
+        assert!(matches!(a.get("").await, Err(DomainError::InvalidInput(_))));
+        assert!(matches!(
+            a.delete("").await,
+            Err(DomainError::InvalidInput(_))
+        ));
+    }
+
+    #[tokio::test]
+    async fn rejects_absolute_key() {
+        let a = make_adapter();
+        assert!(matches!(
+            a.put("/etc/passwd", one_shot(b"x")).await,
+            Err(DomainError::InvalidInput(_))
+        ));
+    }
+
+    #[tokio::test]
+    async fn rejects_path_traversal() {
+        let a = make_adapter();
+        assert!(matches!(
+            a.get("../escape").await,
+            Err(DomainError::InvalidInput(_))
+        ));
+        assert!(matches!(
+            a.get("a/../../../etc").await,
+            Err(DomainError::InvalidInput(_))
+        ));
+    }
+
+    #[test]
+    fn new_rejects_traversal_prefix() {
+        assert!(matches!(
+            ObjectStorageAdapter::new(Arc::new(InMemory::new()), "../evil"),
+            Err(DomainError::InvalidInput(_))
+        ));
+    }
+
+    #[test]
+    fn new_rejects_absolute_prefix() {
+        assert!(matches!(
+            ObjectStorageAdapter::new(Arc::new(InMemory::new()), "/root"),
+            Err(DomainError::InvalidInput(_))
+        ));
+    }
+
+    #[test]
+    fn new_accepts_empty_prefix() {
+        assert!(ObjectStorageAdapter::new(Arc::new(InMemory::new()), "").is_ok());
+    }
+}

crates/adapters/storage/src/config.rs

@@ -0,0 +1,67 @@
+use anyhow::{Context, Result};
+use object_store::local::LocalFileSystem;
+use object_store::ObjectStore;
+use std::sync::Arc;
+
+#[derive(Debug, Clone)]
+pub struct StorageConfig {
+    pub backend: String,
+    pub local_path: Option<String>,
+    pub s3_endpoint: Option<String>,
+    pub s3_access_key_id: Option<String>,
+    pub s3_secret_access_key: Option<String>,
+    pub s3_bucket: Option<String>,
+    pub s3_region: Option<String>,
+}
+
+pub fn build_store(config: &StorageConfig) -> Result<Arc<dyn ObjectStore>> {
+    match config.backend.as_str() {
+        "local" => {
+            let path = config
+                .local_path
+                .as_deref()
+                .context("STORAGE_PATH must be set when STORAGE_BACKEND=local")?;
+            std::fs::create_dir_all(path)
+                .with_context(|| format!("failed to create storage dir: {path}"))?;
+            let store = LocalFileSystem::new_with_prefix(path)?;
+            Ok(Arc::new(store))
+        }
+        #[cfg(feature = "s3")]
+        "s3" => {
+            use object_store::aws::AmazonS3Builder;
+            let store = AmazonS3Builder::new()
+                .with_endpoint(
+                    config
+                        .s3_endpoint
+                        .as_deref()
+                        .context("S3_ENDPOINT must be set")?,
+                )
+                .with_access_key_id(
+                    config
+                        .s3_access_key_id
+                        .as_deref()
+                        .context("S3_ACCESS_KEY_ID must be set")?,
+                )
+                .with_secret_access_key(
+                    config
+                        .s3_secret_access_key
+                        .as_deref()
+                        .context("S3_SECRET_ACCESS_KEY must be set")?,
+                )
+                .with_bucket_name(
+                    config
+                        .s3_bucket
+                        .as_deref()
+                        .context("S3_BUCKET must be set")?,
+                )
+                .with_region(config.s3_region.as_deref().unwrap_or("us-east-1"))
+                .with_allow_http(true)
+                .build()?;
+            Ok(Arc::new(store))
+        }
+        other => anyhow::bail!(
+            "unknown STORAGE_BACKEND={other:?}; supported: local{}",
+            if cfg!(feature = "s3") { ", s3" } else { "" },
+        ),
+    }
+}

crates/adapters/storage/src/lib.rs

@@ -0,0 +1,5 @@
+pub mod adapter;
+pub mod config;
+
+pub use adapter::ObjectStorageAdapter;
+pub use config::{build_store, StorageConfig};