fix: harden additive asset publication

This commit is contained in:
2026-09-04 22:22:28 +03:00
parent c06fc18cad
commit 5bdeeaa433
3 changed files with 410 additions and 43 deletions

View File

@@ -1,5 +1,6 @@
const idPattern = /^[a-z][a-z0-9-]{0,63}$/u;
const fileNamePattern = /^[a-z0-9][a-z0-9-]*\.(avif|jpg|png|svg|webp|mp4|webm|opus|mp3)$/u;
const managedFileNamePattern = /^(?:project|social)-[a-z0-9][a-z0-9-]*\.(?:avif|jpg|png|svg|webp|mp4|webm)$/u;
const sha256Pattern = /^[a-f0-9]{64}$/u;
const assertSafeRecord = (asset) => {
@@ -21,7 +22,8 @@ export const mergeAssetRecords = (baseAssets, generatedAssets, managedIds) => {
throw new Error('ASSET-MERGE-RECORD-001');
}
}
const retained = baseAssets.filter(({ id }) => !managedIds.has(id));
const retained = baseAssets.filter(({ id, fileName }) =>
!managedIds.has(id) || !managedFileNamePattern.test(fileName));
const combined = [...retained, ...generatedAssets];
const ids = new Set();
const names = new Set();