meleki/feuerwerk
1
0 Fork 0
Code Issues 38 Actions Projects 1 Wiki Activity

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)
game-maker / gate (push) Successful in 3m53s
Details
game-maker / suite (push) Successful in 11m55s
Details

Browse Source 
Recurring cleanup round over the code since round 7 (bc688f3). The
issue now also asks to fix bugs and small inconsistencies found on the
way, so unlike the rounds before, this one changes behaviour in a few
places. Duplicated code in api went from 23 clones with 228 lines to
none (jscpd, at least 50 tokens). In src it stays at 22 clones with
271 lines, the same before and after.

Bugs:
- nginx served project and snapshot files as they were, so anyone who
  knew a project id could read it without signing in. Every file the
  API writes now goes through AtomicFile (temp file, mode, rename).
  Projects, snapshots, releases, accounts and sessions are 0640, and
  nginx answers 403 for them.
- Any signed-in account could delete a shared image, font or sound,
  which projects of other accounts may wear. Deleting one is now for
  administrators only. The editor never deleted a file, so the
  client's delete is gone.
- Two saves of one project could run at once. The lock file was
  removed after each save, so a waiting save and the next one locked
  different files. The lock file now stays, and deleting a project
  takes the lock as well.
- Bytes that are no picture got a 500 instead of a 422, because the
  error handler also threw for warnings silenced with @.
- A session file was rewritten in place. A request reading it at that
  moment found it empty and was signed out. It is replaced atomically.
- Delete did nothing for a shape picked in the vector art list. Delete
  now goes through removeSelection, one case per kind of selection,
  and a kind without a case fails the type check.

Inconsistencies:
- Escape on a question does what its Cancel does. Cancel on "Delete
  project?" and "Restore snapshot?" leads back to the picker or the
  list like the other questions did, and so does deleting a project.
- Editor texts use American spelling throughout, like the port names:
  48 British spellings in 45 lines (colour, centre, initialised).
- objectName and groupName replace eleven copies of "own name, else
  the asset's" and three of "Group". One copy fell back to the object
  id instead of "?".

Duplicates, dead code, comments:
- routeFiles serves images, fonts and sounds instead of three copies.
  HashedFileStore holds what the three stores shared: keeping a file
  under its hash with its name, listing and deleting. The stores keep
  only which bytes they take and what a record says.
- AtomicFile replaces nine copies of temp file plus rename.
- removeShapes is the one way the canvas, the inspector button and
  Delete take shapes out.
- GraphInterpreter.fire was called by tests only. The 54 calls use a
  helper in tests/helpers.ts now.
- FileStore.delete, HttpFileStore.delete and the PluginApi type were
  unused. A doc comment in actions.ts sat above the wrong function.

Checked and left as is:
- solidCells is used by tests only. It is the per-cell view before the
  merge into rectangles, the one place the largest-scale rule shows.
- An undo checker ran all 124 commands of the unit tests and compared
  the project before and after undo. The only differences are empty
  ports, groups and notes lists where there were none, which the file
  format drops anyway.

Docs:
- README: the check sum.
- Wiki, own commit: API (admin-only deletes, 422, file modes, lock
  file), Home (the "Not yet" list named three things that exist),
  Concepts, Keyboard, Vector art, Architecture and Development, and
  the 38 characters Gitea flagged as ambiguous on eight pages.
- .gitignore: the lock files, and pasted-*.png in any folder, which
  keeps the screenshot archive out.

Tests:
- ./check.sh: 195 files, 2817 tests, exit 0 (+2 for the name helpers).
- PHP: accounts 52 in the web container and 53 in the CI image with
  the race test (+2), snapshots 15 (+1), releases 20.
- Full e2e run: ALL PASSED, 1586 checks (+6 in 12, 47, 49 and 50).
- Smokes jumprun, tetris, actor: 24, 19 and 21 checks. The example
  project files were restored byte for byte afterwards.
- The file stores of HEAD and of this commit give byte-identical
  output for the live folders and for store, list and delete in a
  throwaway folder.
- Counter-checks, all fail as expected: a 500 for bad bytes fails 12,
  no admin check fails 49, removing the lock file again loses saves
  in 3 of 3 runs (151 to 170 of 321), Delete ignoring shapes fails 47,
  Escape that only closes fails 50, and dropping the shape case fails
  the type check (TS2366).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adminandClaude Opus 5.5 committed 2026-09-29 18:12:55 +02:00
1 parent bc688f3efc
commit 14972d057f
81 files changed
+663 -577
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

api/index.php
+63 -81
View File
@@ -51,15 +51,15 @@ declare(strict_types=1);
*
* GET ?r=textures → [{file,name,width,height,bytes,updatedAt}]
* POST ?r=textures&name=x.png raw image bytes → {file,name,width,height,bytes}
* DELETE ?r=textures/{file} → 204
* DELETE ?r=textures/{file} → 204 (administrators only, 403 for everybody else)
*
* GET ?r=fonts → [{file,name,bytes,updatedAt}]
* POST ?r=fonts&name=x.ttf raw font bytes → {file,name,bytes}
* DELETE ?r=fonts/{file} → 204
* DELETE ?r=fonts/{file} → 204 (administrators only)
*
* GET ?r=sounds → [{file,name,bytes,updatedAt}]
* POST ?r=sounds&name=x.wav raw sound bytes → {file,name,bytes}
* DELETE ?r=sounds/{file} → 204
* DELETE ?r=sounds/{file} → 204 (administrators only)
*
* POST ?r=pixels raw cel bytes → {file,bytes} (pixel art, #130)
*
@@ -74,7 +74,9 @@ declare(strict_types=1);
*/
require __DIR__ . '/lib/AccountRules.php';
require __DIR__ . '/lib/AtomicFile.php';
require __DIR__ . '/lib/Auth.php';
require __DIR__ . '/lib/HashedFileStore.php'; // before the font, sound and texture stores built on it
require __DIR__ . '/lib/FontStore.php';
require __DIR__ . '/lib/OriginalName.php';
require __DIR__ . '/lib/PixelStore.php';
@@ -101,6 +103,11 @@ const MAX_FONT_BYTES = 4 * 1024 * 1024;
const MAX_SOUND_BYTES = 16 * 1024 * 1024;
set_error_handler(static function (int $severity, string $message, string $file, int $line): bool {
// PHP calls the handler for a call silenced with `@` as well, only with less reported: that
// warning was expected and is answered where it happens (an unreadable image is a 422).
if ((error_reporting() & $severity) === 0) {
return false;
}
throw new ErrorException($message, 0, $severity, $file, $line);
});
@@ -467,23 +474,38 @@ function routeUsers(array $parts, string $method, Auth $auth, UserStore $users):
Response::error('Method not allowed', 405);
}
/** @param list<string> $parts */
function routeTextures(array $parts, string $method): never
{
$store = new TextureStore(dirname(__DIR__) . '/data/textures');
/**
* Images, fonts and sounds: shared between the accounts and stored under the hash of their bytes.
* Everybody signed in uploads and lists them. Deleting one is for administrators only, because a
* project of another account may be wearing it – the editor itself never deletes a file.
*
* @param list<string> $parts
* @param class-string<RuntimeException> $invalid what the store throws for bytes it cannot take
*/
function routeFiles(
array $parts,
string $method,
Auth $auth,
HashedFileStore $store,
int $maxBytes,
string $noun,
string $invalid,
): never {
if (count($parts) === 1) {
if ($method === 'GET') {
Response::json($store->list());
}
if ($method === 'POST') {
$bytes = Response::rawBody();
if (strlen($bytes) > MAX_TEXTURE_BYTES) {
Response::error('Image must be at most ' . (MAX_TEXTURE_BYTES / 1024 / 1024) . ' MB', 413);
if (strlen($bytes) > $maxBytes) {
Response::error("{$noun} must be at most " . ($maxBytes / 1024 / 1024) . ' MB', 413);
}
try {
Response::json($store->store($bytes, (string) ($_GET['name'] ?? '')), 201);
} catch (InvalidImageException $e) {
} catch (RuntimeException $e) {
if (!$e instanceof $invalid) {
throw $e;
}
Response::error($e->getMessage(), 422);
}
}
@@ -491,74 +513,9 @@ function routeTextures(array $parts, string $method): never
}
if ($method === 'DELETE') {
$auth->requireAdmin();
if (!$store->delete($parts[1])) {
Response::error('Texture not found', 404);
}
Response::noContent();
}
Response::error('Method not allowed', 405);
}
/** @param list<string> $parts */
function routeFonts(array $parts, string $method): never
{
$store = new FontStore(dirname(__DIR__) . '/data/fonts');
if (count($parts) === 1) {
if ($method === 'GET') {
Response::json($store->list());
}
if ($method === 'POST') {
$bytes = Response::rawBody();
if (strlen($bytes) > MAX_FONT_BYTES) {
Response::error('Font must be at most ' . (MAX_FONT_BYTES / 1024 / 1024) . ' MB', 413);
}
try {
Response::json($store->store($bytes, (string) ($_GET['name'] ?? '')), 201);
} catch (InvalidFontException $e) {
Response::error($e->getMessage(), 422);
}
}
Response::error('Method not allowed', 405);
}
if ($method === 'DELETE') {
if (!$store->delete($parts[1])) {
Response::error('Font not found', 404);
}
Response::noContent();
}
Response::error('Method not allowed', 405);
}
/** @param list<string> $parts */
function routeSounds(array $parts, string $method): never
{
$store = new SoundStore(dirname(__DIR__) . '/data/sounds');
if (count($parts) === 1) {
if ($method === 'GET') {
Response::json($store->list());
}
if ($method === 'POST') {
$bytes = Response::rawBody();
if (strlen($bytes) > MAX_SOUND_BYTES) {
Response::error('Sound must be at most ' . (MAX_SOUND_BYTES / 1024 / 1024) . ' MB', 413);
}
try {
Response::json($store->store($bytes, (string) ($_GET['name'] ?? '')), 201);
} catch (InvalidSoundException $e) {
Response::error($e->getMessage(), 422);
}
}
Response::error('Method not allowed', 405);
}
if ($method === 'DELETE') {
if (!$store->delete($parts[1])) {
Response::error('Sound not found', 404);
Response::error("{$noun} not found", 404);
}
Response::noContent();
}
@@ -642,12 +599,37 @@ try {
// Images, fonts, sounds, cels and plugins are shared between accounts; being signed in is still the
// price of admission, so an uploaded file cannot be dropped in by a stranger.
$user = $auth->require();
$data = dirname(__DIR__) . '/data';
match ($parts[0]) {
'projects' => routeProjects($parts, $method, $user, $auth->role($user) === 'admin'),
'textures' => routeTextures($parts, $method),
'fonts' => routeFonts($parts, $method),
'sounds' => routeSounds($parts, $method),
'textures' => routeFiles(
$parts,
$method,
$auth,
new TextureStore("{$data}/textures"),
MAX_TEXTURE_BYTES,
'Image',
InvalidImageException::class,
),
'fonts' => routeFiles(
$parts,
$method,
$auth,
new FontStore("{$data}/fonts"),
MAX_FONT_BYTES,
'Font',
InvalidFontException::class,
),
'sounds' => routeFiles(
$parts,
$method,
$auth,
new SoundStore("{$data}/sounds"),
MAX_SOUND_BYTES,
'Sound',
InvalidSoundException::class,
),
'pixels' => routePixels($parts, $method),
'plugins' => routePlugins($parts, $method),
default => Response::error('Not found', 404),
api/lib/AtomicFile.php
+27
View File
@@ -0,0 +1,27 @@
<?php
declare(strict_types=1);
/**
* Every file the API writes goes through here: into a temp file beside it, given its mode, then
* renamed over the old one. A reader never sees half a file, and the name never shows up with the
* wrong mode – the web server serves `data/` as static files, so a private file that is readable
* for a moment is readable.
*/
final class AtomicFile
{
/** Read by PHP only: projects, snapshots, releases, accounts and sessions. */
public const HIDDEN = 0640;
/** Handed out by the web server as they are: images, fonts, sounds, cels and their names. */
public const SERVED = 0664;
/** @throws RuntimeException naming `$what` when the file cannot be written */
public static function write(string $path, string $bytes, int $mode, string $what): void
{
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $bytes, LOCK_EX) === false || !chmod($tmp, $mode) || !rename($tmp, $path)) {
@unlink($tmp);
throw new RuntimeException("Cannot write {$what}");
}
}
}
api/lib/FontStore.php
+5 -72
View File
@@ -2,15 +2,13 @@
declare(strict_types=1);
/**
* Content-addressed font store: `data/fonts/{sha256}.{ext}` – the image store's twin, for the
* same reasons (see TextureStore): one file per typeface however often it is uploaded, a URL
* that can be cached forever, and deleting a font asset stays undoable because nothing here
* is removed when the last project stops referencing it.
* Content-addressed font store: `data/fonts/{sha256}.{ext}` (see HashedFileStore).
*
* A font is stored byte for byte. There is no re-encoding step as there is for images, so what
* the browser loads is exactly what was picked.
* the browser loads is exactly what was picked. The picker shows each face by rendering with it,
* so a record has nothing to read out of the file.
*/
final class FontStore
final class FontStore extends HashedFileStore
{
/**
* Accepted formats, keyed by the four bytes every one of them starts with. Bitmap and
@@ -25,14 +23,6 @@ final class FontStore
'wOF2' => 'woff2',
];
public function __construct(private readonly string $dir)
{
if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
throw new RuntimeException("Cannot create font directory {$this->dir}");
}
}
/** A stored file name, as it appears in a project document. */
public static function isValidName(string $name): bool
{
return (bool) preg_match('/^[a-f0-9]{64}\.(ttf|otf|woff|woff2)$/', $name);
@@ -63,64 +53,7 @@ final class FontStore
throw new InvalidFontException('Font file is truncated');
}
$file = hash('sha256', $bytes) . '.' . $extension;
$path = $this->dir . '/' . $file;
if (!is_file($path)) {
$this->writeFile($path, $bytes);
}
OriginalName::write($this->dir, $file, $originalName);
return ['file' => $file, 'name' => OriginalName::read($this->dir, $file), 'bytes' => strlen($bytes)];
}
/**
* Every stored file, newest first – what the font picker offers. Unlike an image there is
* nothing to read out of the header here: the picker shows each face by rendering with it.
*
* @return list<array{file:string,name:string,bytes:int,updatedAt:string}>
*/
public function list(): array
{
$items = [];
foreach (glob($this->dir . '/*.*') ?: [] as $path) {
$file = basename($path);
// Sidecars share the directory and are skipped: `{hash}.ttf.json` is not a valid name.
if (!self::isValidName($file)) {
continue;
}
$items[] = [
'file' => $file,
'name' => OriginalName::read($this->dir, $file),
'bytes' => (int) filesize($path),
'updatedAt' => gmdate('c', (int) filemtime($path)),
];
}
usort($items, static fn(array $a, array $b): int => strcmp($b['updatedAt'], $a['updatedAt']));
return $items;
}
public function delete(string $file): bool
{
if (!self::isValidName($file)) {
return false;
}
$path = $this->dir . '/' . $file;
if (!is_file($path) || !unlink($path)) {
return false;
}
OriginalName::delete($this->dir, $file);
return true;
}
/** Temp file plus rename, so a reader never sees a half-written font (see TextureStore). */
private function writeFile(string $path, string $bytes): void
{
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $bytes, LOCK_EX) === false || !rename($tmp, $path)) {
@unlink($tmp);
throw new RuntimeException('Cannot write font file');
}
@chmod($path, 0664);
return $this->keep($bytes, $extension, $originalName);
}
}
api/lib/HashedFileStore.php
+94
View File
@@ -0,0 +1,94 @@
<?php
declare(strict_types=1);
/**
* The shared half of the image, font and sound stores: `{dir}/{sha256}.{ext}`.
*
* The name of a file is the hash of its bytes, which buys four things at once: uploading the same
* file twice costs one file, a stored file can be cached forever (its URL cannot ever mean
* different bytes), projects reference a short string instead of embedding megabytes of base64,
* and deleting an asset is undoable for free because nothing here is removed when it stops being
* referenced. What a store adds is which bytes it takes, and what its records say beyond the name.
*/
abstract class HashedFileStore
{
public function __construct(private readonly string $dir)
{
if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
throw new RuntimeException("Cannot create directory {$this->dir}");
}
}
/** A stored file name, as it appears in a project document. */
abstract public static function isValidName(string $name): bool;
/**
* Every stored file, newest first – what the picker of its kind offers.
*
* @return list<array<string,string|int>>
*/
public function list(): array
{
$items = [];
foreach (glob($this->dir . '/*.*') ?: [] as $path) {
$file = basename($path);
// Sidecars share the directory and are skipped: `{hash}.png.json` is not a valid name.
if (!static::isValidName($file)) {
continue;
}
$items[] = [
'file' => $file,
'name' => OriginalName::read($this->dir, $file),
...$this->details($path),
'bytes' => (int) filesize($path),
'updatedAt' => gmdate('c', (int) filemtime($path)),
];
}
usort($items, static fn(array $a, array $b): int => strcmp($b['updatedAt'], $a['updatedAt']));
return $items;
}
public function delete(string $file): bool
{
if (!static::isValidName($file)) {
return false;
}
$path = $this->dir . '/' . $file;
if (!is_file($path) || !unlink($path)) {
return false;
}
OriginalName::delete($this->dir, $file);
return true;
}
/**
* Keeps bytes that passed the store's checks under their hash, with `$originalName` beside them
* as a caption (see OriginalName), and returns the record. Bytes stored before are not written
* again; a new name renames them.
*
* @param array<string,int> $details what the record says between the name and the size
* @return array<string,string|int>
*/
protected function keep(string $bytes, string $extension, string $originalName, array $details = []): array
{
$file = hash('sha256', $bytes) . '.' . $extension;
$path = $this->dir . '/' . $file;
if (!is_file($path)) {
AtomicFile::write($path, $bytes, AtomicFile::SERVED, 'stored file');
}
OriginalName::write($this->dir, $file, $originalName);
return ['file' => $file, 'name' => OriginalName::read($this->dir, $file), ...$details, 'bytes' => strlen($bytes)];
}
/**
* What a record of a stored file says between its name and its size. An image reads its pixel
* size here; a font or a sound has nothing to read without decoding it.
*
* @return array<string,int>
*/
protected function details(string $path): array
{
return [];
}
}
api/lib/OriginalName.php
+7 -8
View File
@@ -70,16 +70,15 @@ final class OriginalName
if ($clean === '') {
return;
}
$path = $dir . '/' . $file . '.json';
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
$json = json_encode(['name' => $clean], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
if ($json === false || file_put_contents($tmp, $json, LOCK_EX) === false || !rename($tmp, $path)) {
if (is_file($tmp)) {
unlink($tmp);
}
return; // A nameless file is a small loss; failing the upload over it would be worse.
if ($json === false) {
return;
}
try {
AtomicFile::write($dir . '/' . $file . '.json', $json, AtomicFile::SERVED, 'name file');
} catch (RuntimeException) {
// A nameless file is a small loss; failing the upload over it would be worse.
}
chmod($path, 0664);
}
/** Removing a file that has no sidecar is the normal case, not a failure. */
api/lib/PixelStore.php
+1 -8
View File
@@ -54,14 +54,7 @@ final class PixelStore
$file = hash('sha256', $bytes) . '.px';
$path = $this->dir . '/' . $file;
if (!is_file($path)) {
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $bytes, LOCK_EX) === false || !rename($tmp, $path)) {
if (is_file($tmp)) {
unlink($tmp);
}
throw new RuntimeException('Cannot write pixel file');
}
chmod($path, 0664);
AtomicFile::write($path, $bytes, AtomicFile::SERVED, 'pixel file');
}
return ['file' => $file, 'bytes' => $length];
}
api/lib/ReleaseStore.php
+1 -10
View File
@@ -146,15 +146,6 @@ final class ReleaseStore
if ($json === false) {
throw new RuntimeException('Cannot encode release');
}
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $json, LOCK_EX) === false) {
@unlink($tmp);
throw new RuntimeException('Cannot write release file');
}
chmod($tmp, 0640);
if (!rename($tmp, $path)) {
@unlink($tmp);
throw new RuntimeException('Cannot write release file');
}
AtomicFile::write($path, $json, AtomicFile::HIDDEN, 'release file');
}
}
api/lib/SessionStore.php
+5 -3
View File
@@ -110,9 +110,11 @@ final class SessionStore
throw new RuntimeException('Invalid session token');
}
$json = json_encode($data, JSON_UNESCAPED_SLASHES);
if ($json === false || file_put_contents($path, $json, LOCK_EX) === false) {
throw new RuntimeException('Cannot write session file');
if ($json === false) {
throw new RuntimeException('Cannot encode session');
}
@chmod($path, 0640);
// Replaced rather than rewritten in place: a request reading it meanwhile would find it
// empty, and an empty session is a signed-out one.
AtomicFile::write($path, $json, AtomicFile::HIDDEN, 'session file');
}
}
api/lib/SnapshotStore.php
+1 -6
View File
@@ -59,12 +59,7 @@ final class SnapshotStore
if ($json === false) {
throw new RuntimeException('Cannot encode snapshot');
}
$path = $this->path($projectId, $id);
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $json, LOCK_EX) === false || !rename($tmp, $path)) {
@unlink($tmp);
throw new RuntimeException('Cannot write snapshot file');
}
AtomicFile::write($this->path($projectId, $id), $json, AtomicFile::HIDDEN, 'snapshot file');
return self::summary($snapshot);
}
api/lib/SoundStore.php
+5 -72
View File
@@ -2,15 +2,13 @@
declare(strict_types=1);
/**
* Content-addressed sound store: `data/sounds/{sha256}.{ext}` – the font store's twin (see
* FontStore), for the same reasons: one file per sound however often it is uploaded, a URL that
* can be cached forever, and deleting a sound asset stays undoable because nothing here is
* removed when the last project stops referencing it.
* Content-addressed sound store: `data/sounds/{sha256}.{ext}` (see HashedFileStore).
*
* A sound is stored byte for byte. There is no re-encoding step as there is for images: the
* browser decodes what was picked, and nothing here could encode audio anyway.
* browser decodes what was picked, and nothing here could encode audio anyway. The picker plays a
* sound instead of showing it, and its length is not read, since only a decoder knows it.
*/
final class SoundStore
final class SoundStore extends HashedFileStore
{
/**
* Accepted formats, keyed by the bytes they start with. MP3 is the exception with no single
@@ -22,14 +20,6 @@ final class SoundStore
'ID3' => 'mp3',
];
public function __construct(private readonly string $dir)
{
if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
throw new RuntimeException("Cannot create sound directory {$this->dir}");
}
}
/** A stored file name, as it appears in a project document. */
public static function isValidName(string $name): bool
{
return (bool) preg_match('/^[a-f0-9]{64}\.(mp3|ogg|wav|m4a)$/', $name);
@@ -55,53 +45,7 @@ final class SoundStore
throw new InvalidSoundException('Not a sound file – use MP3, OGG, WAV or M4A');
}
$file = hash('sha256', $bytes) . '.' . $extension;
$path = $this->dir . '/' . $file;
if (!is_file($path)) {
$this->writeFile($path, $bytes);
}
OriginalName::write($this->dir, $file, $originalName);
return ['file' => $file, 'name' => OriginalName::read($this->dir, $file), 'bytes' => strlen($bytes)];
}
/**
* Every stored file, newest first – what the sound picker offers. A sound has nothing to show,
* so the picker plays it instead; length is not read here, since only a decoder knows it.
*
* @return list<array{file:string,name:string,bytes:int,updatedAt:string}>
*/
public function list(): array
{
$items = [];
foreach (glob($this->dir . '/*.*') ?: [] as $path) {
$file = basename($path);
// Sidecars share the directory and are skipped: `{hash}.mp3.json` is not a valid name.
if (!self::isValidName($file)) {
continue;
}
$items[] = [
'file' => $file,
'name' => OriginalName::read($this->dir, $file),
'bytes' => (int) filesize($path),
'updatedAt' => gmdate('c', (int) filemtime($path)),
];
}
usort($items, static fn(array $a, array $b): int => strcmp($b['updatedAt'], $a['updatedAt']));
return $items;
}
public function delete(string $file): bool
{
if (!self::isValidName($file)) {
return false;
}
$path = $this->dir . '/' . $file;
if (!is_file($path) || !unlink($path)) {
return false;
}
OriginalName::delete($this->dir, $file);
return true;
return $this->keep($bytes, $extension, $originalName);
}
/** The format these bytes are, `''` when they are none we take. */
@@ -138,17 +82,6 @@ final class SoundStore
$version = ($second >> 3) & 0b11;
return $first === 0xFF && ($second & 0xE0) === 0xE0 && $version !== 0b01 ? 'mp3' : '';
}
/** Temp file plus rename, so a reader never sees a half-written sound (see TextureStore). */
private function writeFile(string $path, string $bytes): void
{
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $bytes, LOCK_EX) === false || !rename($tmp, $path)) {
@unlink($tmp);
throw new RuntimeException('Cannot write sound file');
}
@chmod($path, 0664);
}
}
/** Thrown by SoundStore::store when the uploaded bytes are not a usable sound. */
api/lib/Store.php
+11 -10
View File
@@ -123,11 +123,14 @@ final class Store
public function delete(string $id): bool
{
if ($this->load($id) === null) {
return false;
}
$path = $this->path($id);
return file_exists($path) && unlink($path);
// Under the save lock, or a save running at the same time writes the project back.
$deleted = $this->locked($path, fn(): bool => $this->load($id) !== null && unlink($path));
if ($deleted) {
// Whoever still waits for the lock finds no project and writes nothing.
@unlink($path . '.lock');
}
return $deleted;
}
/**
@@ -154,6 +157,9 @@ final class Store
}
/**
* The lock file stays when the work is done. Removing it would let two saves in at once: one
* still waiting holds the removed file, while the next one creates a new file and locks that.
*
* @template T
* @param callable():T $work
* @return T
@@ -169,7 +175,6 @@ final class Store
} finally {
flock($lock, LOCK_UN);
fclose($lock);
@unlink($path . '.lock');
}
}
@@ -221,10 +226,6 @@ final class Store
if ($json === false) {
throw new RuntimeException('Cannot encode project');
}
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $json, LOCK_EX) === false || !rename($tmp, $path)) {
@unlink($tmp);
throw new RuntimeException('Cannot write project file');
}
AtomicFile::write($path, $json, AtomicFile::HIDDEN, 'project file');
}
}
api/lib/TextureStore.php
+13 -87
View File
@@ -2,19 +2,13 @@
declare(strict_types=1);
/**
* Content-addressed image store: `data/textures/{sha256}.{ext}`.
* Content-addressed image store: `data/textures/{sha256}.{ext}` (see HashedFileStore).
*
* The name of a file is the hash of its bytes, which buys four things at once:
* uploading the same image twice costs one file, a stored file can be cached forever
* (its URL cannot ever mean different bytes), projects reference a short string instead
* of embedding megabytes of base64, and deleting a texture asset is undoable for free
* because nothing here is removed when it stops being referenced.
*
* The flip side is that files outlive the projects that used them: nothing collects the
* unreferenced ones. They stay pickable instead – `GET ?r=textures` is what the editor's
* image picker offers, so a picture one project dropped is still there for the next.
* The flip side of hashed names is that files outlive the projects that used them: nothing
* collects the unreferenced ones. They stay pickable instead – `GET ?r=textures` is what the
* editor's image picker offers, so a picture one project dropped is still there for the next.
*/
final class TextureStore
final class TextureStore extends HashedFileStore
{
/** Accepted formats. SVG is deliberately absent: it can carry script. */
private const EXTENSIONS = [
@@ -38,14 +32,6 @@ final class TextureStore
*/
private const MAX_DIMENSION = 8192;
public function __construct(private readonly string $dir)
{
if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
throw new RuntimeException("Cannot create texture directory {$this->dir}");
}
}
/** A stored file name, as it appears in a project document. */
public static function isValidName(string $name): bool
{
return (bool) preg_match('/^[a-f0-9]{64}\.(png|jpg|webp|gif)$/', $name);
@@ -87,80 +73,20 @@ final class TextureStore
throw new InvalidImageException('Image must be between 1 and ' . self::MAX_DIMENSION . ' pixels per side');
}
$file = hash('sha256', $bytes) . '.' . $extension;
$path = $this->dir . '/' . $file;
if (!is_file($path)) {
$this->writeFile($path, $bytes);
}
OriginalName::write($this->dir, $file, $originalName);
return [
'file' => $file,
'name' => OriginalName::read($this->dir, $file),
'width' => $width,
'height' => $height,
'bytes' => strlen($bytes),
];
return $this->keep($bytes, $extension, $originalName, ['width' => $width, 'height' => $height]);
}
/**
* Every stored file, newest first – what the image picker offers.
* The pixel size, read from each header rather than left to the client: a texture asset records
* the size, so a picker that only knew the file name could not create one without decoding the
* picture first. An unreadable file reports 0 × 0 and the picker skips it.
*
* The pixel size is read from each header rather than left to the client: a texture asset
* records the size, so a picker that only knew the file name could not create one without
* decoding the picture first. An unreadable file reports 0 × 0 and the picker skips it.
*
* @return list<array{file:string,name:string,width:int,height:int,bytes:int,updatedAt:string}>
* @return array{width:int,height:int}
*/
public function list(): array
protected function details(string $path): array
{
$items = [];
foreach (glob($this->dir . '/*.*') ?: [] as $path) {
$file = basename($path);
// Sidecars live in the same directory and are skipped here: `{hash}.png.json` is not
// a valid stored name.
if (!self::isValidName($file)) {
continue;
}
$size = @getimagesize($path);
$items[] = [
'file' => $file,
'name' => OriginalName::read($this->dir, $file),
'width' => (int) ($size[0] ?? 0),
'height' => (int) ($size[1] ?? 0),
'bytes' => (int) filesize($path),
'updatedAt' => gmdate('c', (int) filemtime($path)),
];
}
usort($items, static fn(array $a, array $b): int => strcmp($b['updatedAt'], $a['updatedAt']));
return $items;
}
public function delete(string $file): bool
{
if (!self::isValidName($file)) {
return false;
}
$path = $this->dir . '/' . $file;
if (!is_file($path) || !unlink($path)) {
return false;
}
OriginalName::delete($this->dir, $file);
return true;
}
/**
* Writes via a temp file in the same directory, so a reader never sees a half-written
* image: the name only ever appears once the bytes behind it are complete.
*/
private function writeFile(string $path, string $bytes): void
{
$tmp = $path . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $bytes, LOCK_EX) === false || !rename($tmp, $path)) {
@unlink($tmp);
throw new RuntimeException('Cannot write texture file');
}
@chmod($path, 0664);
$size = @getimagesize($path);
return ['width' => (int) ($size[0] ?? 0), 'height' => (int) ($size[1] ?? 0)];
}
}
api/lib/UserStore.php
+1 -6
View File
@@ -216,11 +216,6 @@ final class UserStore
if ($json === false) {
throw new RuntimeException('Cannot encode users');
}
$tmp = $this->file . '.' . bin2hex(random_bytes(4)) . '.tmp';
if (file_put_contents($tmp, $json, LOCK_EX) === false || !rename($tmp, $this->file)) {
@unlink($tmp);
throw new RuntimeException('Cannot write users file');
}
@chmod($this->file, 0640);
AtomicFile::write($this->file, $json, AtomicFile::HIDDEN, 'users file');
}
}