Local filesystem storage adapter.
Implements IFileStorage for storing files on the local filesystem. Suitable for development and single-server deployments.
Local filesystem storage adapter. Implements IFileStorage for storing files on the local filesystem. Suitable for development and single-server deployments.
(canonical-key file-key)A storage key in the one form signatures are computed over: forward slashes.
path-join yields the platform separator, so on Windows a key is stored
and signed as 2a\photo.jpg while the URL — and therefore the key the
router hands back — carries 2a/photo.jpg. Signing one form and verifying
the other made every freshly issued signed URL 403 on that platform
(BOU-421).
A storage key in the one form signatures are computed over: forward slashes. `path-join` yields the platform separator, so on Windows a key is stored and signed as `2a\photo.jpg` while the URL — and therefore the key the router hands back — carries `2a/photo.jpg`. Signing one form and verifying the other made every freshly issued signed URL 403 on that platform (BOU-421).
(create-local-storage {:keys [base-path url-base signing-secret
create-directories? logger]
:or {create-directories? true}})Create a local filesystem storage adapter.
Options:
<url-base>/<key>, so with :signing-secret set this must be
the public URL of the mounted download route — that route is the only
thing that verifies the signature (BOU-421). Pointing it at a static
server or CDN instead means the signature is never checked.Create a local filesystem storage adapter. Options: - :base-path - Root directory for file storage (required) - :url-base - Public base URL files are reachable at (optional). A URL is emitted as `<url-base>/<key>`, so with :signing-secret set this must be the public URL of the mounted download route — that route is the only thing that verifies the signature (BOU-421). Pointing it at a static server or CDN instead means the signature is never checked. - :signing-secret - HMAC key enabling signed, expiring URLs (optional) - :create-directories? - Create base directory if missing (default: true) - :logger - Logger instance (optional)
(verify-signed-url signing-secret file-key {:keys [expires signature]})Verify a signed local-storage URL. Given the configured signing-secret, the
file-key, and the URL's query params (:expires epoch-seconds, :signature
hex), return true iff the signature matches and the URL has not expired.
The serving route is responsible for calling this before streaming a private file — the local adapter cannot enforce it at the filesystem layer.
Total on any input a query string can produce: Ring gives a repeated
parameter as a vector, and a vector reached (long …) as a
ClassCastException — a 500 where the answer is simply "not a valid
signature" (BOU-421). Anything that is not a single scalar is
invalid, which is also the fail-closed reading of an ambiguous request.
Verify a signed local-storage URL. Given the configured `signing-secret`, the `file-key`, and the URL's query params (`:expires` epoch-seconds, `:signature` hex), return true iff the signature matches and the URL has not expired. The serving route is responsible for calling this before streaming a private file — the local adapter cannot enforce it at the filesystem layer. Total on any input a query string can produce: Ring gives a repeated parameter as a vector, and a vector reached `(long …)` as a ClassCastException — a 500 where the answer is simply "not a valid signature" (BOU-421). Anything that is not a single scalar is invalid, which is also the fail-closed reading of an ambiguous request.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |