상위 디렉터리 및 카테고리의 소유권을 검증하지 않던 문제 등 버그 수정 및 Vitest 기반 테스트 추가

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/lib/server/db/category.ts

@@ -14,6 +14,26 @@ interface Category {
 
 export type NewCategory = Omit<Category, "id">;
 
+export const ensureCategoryExists = async (
+  trx: typeof db,
+  userId: number,
+  categoryId: CategoryId,
+) => {
+  if (categoryId === "root") return;
+
+  const category = await trx
+    .selectFrom("category")
+    .select("id")
+    .where("id", "=", categoryId)
+    .where("user_id", "=", userId)
+    .limit(1)
+    .forShare()
+    .executeTakeFirst();
+  if (!category) {
+    throw new IntegrityError("Category not found");
+  }
+};
+
 export const registerCategory = async (params: NewCategory) => {
   await db.transaction().execute(async (trx) => {
     const mek = await trx
@@ -28,6 +48,8 @@ export const registerCategory = async (params: NewCategory) => {
       throw new IntegrityError("Inactive MEK version");
     }
 
+    await ensureCategoryExists(trx, params.userId, params.parentId);
+
     const { categoryId } = await trx
       .insertInto("category")
       .values({

src/lib/server/db/directory.ts

@@ -25,6 +25,26 @@ const toDirectory = (row: Selectable<DirectoryTable>): Directory => ({
   isFavorite: row.is_favorite,
 });
 
+export const ensureDirectoryExists = async (
+  trx: typeof db,
+  userId: number,
+  directoryId: DirectoryId,
+) => {
+  if (directoryId === "root") return;
+
+  const directory = await trx
+    .selectFrom("directory")
+    .select("id")
+    .where("id", "=", directoryId)
+    .where("user_id", "=", userId)
+    .limit(1)
+    .forShare()
+    .executeTakeFirst();
+  if (!directory) {
+    throw new IntegrityError("Directory not found");
+  }
+};
+
 export const registerDirectory = async (params: Omit<Directory, "id" | "isFavorite">) => {
   await db.transaction().execute(async (trx) => {
     const mek = await trx
@@ -39,6 +59,8 @@ export const registerDirectory = async (params: Omit<Directory, "id" | "isFavori
       throw new IntegrityError("Inactive MEK version");
     }
 
+    await ensureDirectoryExists(trx, params.userId, params.parentId);
+
     const { directoryId } = await trx
       .insertInto("directory")
       .values({

src/lib/server/db/upload.ts

@@ -1,5 +1,6 @@
 import { sql } from "kysely";
 import { IntegrityError } from "./error";
+import { ensureDirectoryExists } from "./directory";
 import db from "./kysely";
 import type { Ciphertext } from "./schema";
 
@@ -62,6 +63,8 @@ export const createFileUploadSession = async (
       }
     }
 
+    await ensureDirectoryExists(trx, params.userId, params.parentId);
+
     await trx
       .insertInto("upload_session")
       .values({

src/lib/server/services/file.ts

@@ -4,7 +4,7 @@ import { stat } from "fs/promises";
 import { Readable } from "stream";
 import { FileRepo, MediaRepo } from "#lib/server/db/index.js";
 
-const createEncContentStream = async (
+export const createEncContentStream = async (
   path: string,
   iv?: Buffer,
   range?: { start?: number; end?: number },
@@ -36,6 +36,7 @@ const createEncContentStream = async (
       ),
     ),
     range: { start, end, total: totalSize },
+    isRangeRequest: !!range,
   };
 };
 

src/lib/server/services/upload.ts

@@ -7,7 +7,7 @@ import { safeUnlink } from "#lib/server/modules/filesystem.js";
 
 const chunkLocks = new Set<string>();
 
-const isChunkUploaded = (bitmap: Buffer, chunkIndex: number) => {
+export const isChunkUploaded = (bitmap: Buffer, chunkIndex: number) => {
   chunkIndex -= 1;
   const byte = bitmap[Math.floor(chunkIndex / 8)];
   return !!byte && (byte & (1 << (chunkIndex % 8))) !== 0; // Postgres sucks