feat: move validation to python side, mount rustfs properly

Author: baseplate-admin

docker-compose.yml

@@ -28,22 +28,33 @@ services:
       - postgres
   rustfs:
     image: rustfs/rustfs:latest
+    security_opt:
+      - "no-new-privileges:true"
     container_name: rustfs
     restart: unless-stopped
     ports:
       - "9000:9000"
       - "9001:9001"
     volumes:
-      - ${PWD}/data:/data
+      - ./data:/data
     environment:
-      RUSTFS_ACCESS_KEY: rustfsadmin
-      RUSTFS_SECRET_KEY: rustfsadmin
+      RUSTFS_ADDRESS: "0.0.0.0:9000"
+      RUSTFS_CONSOLE_ADDRESS: "0.0.0.0:9001"
+      RUSTFS_VOLUMES: "/data/rustfs{0..3}"
+      RUSTFS_ACCESS_KEY: "rustfsadmin"
+      RUSTFS_SECRET_KEY: "rustfsadmin"
       RUSTFS_CONSOLE_ENABLE: "true"
-    command:
-      - --address
-      - :9000
-      - --console-enable
-      - /data
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "sh", "-c",
+          "curl -f http://localhost:9000/health && curl -f http://localhost:9001/rustfs/console/health"
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
 
 volumes:
   postgres_data:

src/backend/alembic/versions/cb303129bc56_.py

@@ -58,93 +58,12 @@ def upgrade() -> None:
         sa.PrimaryKeyConstraint("id"),
     )
 
-    # 3. Trigger Function: Sync defaults into arrays
-    op.execute("""
-        CREATE OR REPLACE FUNCTION sync_config_defaults()
-        RETURNS trigger AS $$
-        BEGIN
-            IF NEW.download_configs IS NULL THEN
-                NEW.download_configs := ARRAY[NEW.default_number_of_downloads];
-            ELSIF NOT (NEW.default_number_of_downloads = ANY(NEW.download_configs)) THEN
-                NEW.download_configs := array_append(NEW.download_configs, NEW.default_number_of_downloads);
-            END IF;
-
-            IF NEW.time_configs IS NULL THEN
-                NEW.time_configs := ARRAY[NEW.default_expiry];
-            ELSIF NOT (NEW.default_expiry = ANY(NEW.time_configs)) THEN
-                NEW.time_configs := array_append(NEW.time_configs, NEW.default_expiry);
-            END IF;
-
-            RETURN NEW;
-        END;
-        $$ LANGUAGE plpgsql;
-    """)
-
-    # 4. Trigger Function: Singleton
-    op.execute("""
-        CREATE OR REPLACE FUNCTION enforce_singleton()
-        RETURNS trigger AS $$
-        BEGIN
-            IF (SELECT COUNT(*) FROM config) >= 1 THEN
-                RAISE EXCEPTION 'Only one row is allowed in config';
-            END IF;
-            RETURN NEW;
-        END;
-        $$ LANGUAGE plpgsql;
-    """)
-
-    # 5. Trigger Function: Delete Prevention
-    op.execute("""
-        CREATE OR REPLACE FUNCTION prevent_config_deletion()
-        RETURNS trigger AS $$
-        BEGIN
-            RAISE EXCEPTION 'The configuration record cannot be deleted';
-        END;
-        $$ LANGUAGE plpgsql;
-    """)
-
-    # 6. Trigger Function: Validate File Type Exclusivity
-    # Uses the Postgres overlap operator (&&) to check for common elements
-    op.execute("""
-        CREATE OR REPLACE FUNCTION validate_file_types()
-        RETURNS trigger AS $$
-        BEGIN
-            IF NEW.allowed_file_types && NEW.banned_file_types THEN
-                RAISE EXCEPTION 'Conflict: allowed_file_types and banned_file_types cannot share common extensions';
-            END IF;
-            RETURN NEW;
-        END;
-        $$ LANGUAGE plpgsql;
-    """)
-
-    # 7. Apply Triggers
-    op.execute(
-        "CREATE TRIGGER sync_defaults_trigger BEFORE INSERT OR UPDATE ON config FOR EACH ROW EXECUTE FUNCTION sync_config_defaults();"
-    )
-    op.execute(
-        "CREATE TRIGGER singleton_trigger BEFORE INSERT ON config FOR EACH ROW EXECUTE FUNCTION enforce_singleton();"
-    )
-    op.execute(
-        "CREATE TRIGGER prevent_deletion_trigger BEFORE DELETE ON config FOR EACH ROW EXECUTE FUNCTION prevent_config_deletion();"
-    )
-    op.execute(
-        "CREATE TRIGGER validate_file_types_trigger BEFORE INSERT OR UPDATE ON config FOR EACH ROW EXECUTE FUNCTION validate_file_types();"
-    )
-
-    # 8. Seed Initial Data
+    # 3. Seed Initial Data
     config_instance = Config()
     data = config_instance.model_dump(exclude={"id"})
     op.bulk_insert(sa.table("config", *[sa.column(k) for k in data.keys()]), [data])
 
 
 def downgrade() -> None:
-    op.execute("DROP TRIGGER IF EXISTS validate_file_types_trigger ON config;")
-    op.execute("DROP TRIGGER IF EXISTS prevent_deletion_trigger ON config;")
-    op.execute("DROP TRIGGER IF EXISTS singleton_trigger ON config;")
-    op.execute("DROP TRIGGER IF EXISTS sync_defaults_trigger ON config;")
-    op.execute("DROP FUNCTION IF EXISTS validate_file_types();")
-    op.execute("DROP FUNCTION IF EXISTS prevent_config_deletion();")
-    op.execute("DROP FUNCTION IF EXISTS enforce_singleton();")
-    op.execute("DROP FUNCTION IF EXISTS sync_config_defaults();")
     op.drop_table("file")
     op.drop_table("config")

src/backend/alembic/versions/dfb12aeef438_.py

@@ -0,0 +1,48 @@
+"""empty message
+
+Revision ID: dfb12aeef438
+Revises: 6d1b8bb8ce78
+Create Date: 2025-12-31 14:43:50.158958
+
+"""
+
+from typing import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "dfb12aeef438"
+down_revision: str | Sequence[str] | None = "6d1b8bb8ce78"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column(
+        "file",
+        "created_at",
+        existing_type=postgresql.TIMESTAMP(timezone=True),
+        type_=sa.DateTime(),
+        existing_nullable=False,
+        existing_server_default=sa.text("CURRENT_TIMESTAMP"),
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column(
+        "file",
+        "created_at",
+        existing_type=sa.DateTime(),
+        type_=postgresql.TIMESTAMP(timezone=True),
+        existing_nullable=False,
+        existing_server_default=sa.text("CURRENT_TIMESTAMP"),
+    )
+    # ### end Alembic commands ###

src/backend/app/main.py

@@ -37,3 +37,7 @@
 from app.routes.user import router as user_router
 
 app.include_router(user_router)
+
+from app.routes.upload import router as upload_router
+
+app.include_router(upload_router)

src/backend/app/models/config.py

@@ -1,8 +1,10 @@
 from datetime import timedelta
 from uuid import UUID
 
-from sqlalchemy import BigInteger, Integer, String, text
+from pydantic import model_validator
+from sqlalchemy import BigInteger, Connection, Integer, String, event, text
 from sqlalchemy.dialects.postgresql import ARRAY
+from sqlalchemy.orm import Mapper
 from sqlmodel import Column, Field, SQLModel
 
 from app.converter.bytes import ByteSize
@@ -37,6 +39,27 @@ class ConfigIn(SQLModel):
     allowed_file_types: list[str] = Field(default=[], sa_column=Column(ARRAY(String)))
     banned_file_types: list[str] = Field(default=[], sa_column=Column(ARRAY(String)))
 
+    @model_validator(mode="after")
+    def sync_defaults(self) -> ConfigIn:
+        if self.default_number_of_downloads not in self.download_configs:
+            raise ValueError(
+                "Conflict: default_number_of_downloads must be one of the values in download_configs"
+            )
+
+        if self.default_expiry not in self.time_configs:
+            raise ValueError(
+                "Conflict: default_expiry must be one of the values in time_configs"
+            )
+        return self
+
+    @model_validator(mode="after")
+    def validate_file_types_consistency(self) -> "ConfigIn":
+        if set(self.allowed_file_types) & set(self.banned_file_types):
+            raise ValueError(
+                "Conflict: allowed_file_types and banned_file_types cannot share common extensions"
+            )
+        return self
+
 
 class Config(ConfigIn, table=True):
     id: UUID = Field(
@@ -48,3 +71,15 @@ class Config(ConfigIn, table=True):
             )
         },
     )
+
+
+@event.listens_for(Config, "before_insert")
+def enforce_singleton(mapper: Mapper, connection: Connection, target: Config):
+    result = connection.execute(text("SELECT 1 FROM config LIMIT 1"))
+    if result.fetchone() is not None:
+        raise ValueError("Only one row is allowed in config")
+
+
+@event.listens_for(Config, "before_delete")
+def prevent_config_deletion(mapper: Mapper, connection: Connection, target: Config):
+    raise ValueError("The configuration record cannot be deleted")

src/backend/app/models/files.py

@@ -1,7 +1,8 @@
 from datetime import datetime
 from uuid import UUID
 
-from sqlalchemy import Column, DateTime, func, text
+from pydantic import model_validator
+from sqlalchemy import text
 from sqlmodel import Field, SQLModel
 
 
@@ -18,10 +19,10 @@ class File(SQLModel, table=True):
 
     # Tracking downloads
     download_count: int = 0
-    created_at: datetime = Field(
-        sa_column=Column(
-            DateTime(timezone=True),
-            server_default=func.now(),
-            nullable=False,
-        )
-    )
+    created_at: datetime = Field()
+
+    @model_validator(mode="after")
+    def validate_expire(self) -> "File":
+        if self.expires_at < self.created_at:
+            raise ValueError("Expiration time cannot be earlier than creation time")
+        return self

src/backend/app/routes/upload.py

@@ -1,24 +1,21 @@
+from typing import Annotated
 from http import HTTPStatus
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, UploadFile, Form
 from sqlmodel import select
 
-from app.deps import CurrentUser, SessionDep
+from app.deps import S3Dep
 from app.models import User
 from app.models.user import UserOut
 
 router = APIRouter()
 
 
-@router.get("/upload", response_model=UserOut)
+@router.get("/upload")
 async def get_current_user(
-    user: CurrentUser,
-    session: SessionDep,
+    file: UploadFile,
+    expire_after_n_download: Annotated[int, Form()],
+    expire_after: Annotated[int, Form()],
+    s3: S3Dep,
 ):
-    user_object = select(User).where(User.id == user.id)
-    result = await session.exec(user_object)
-    item = result.first()
-    if not item:
-        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="User not found")
-
-    return item
+    pass