fix: harden additive asset publication
This commit is contained in:
@@ -1,5 +1,6 @@
|
||||
const idPattern = /^[a-z][a-z0-9-]{0,63}$/u;
|
||||
const fileNamePattern = /^[a-z0-9][a-z0-9-]*\.(avif|jpg|png|svg|webp|mp4|webm|opus|mp3)$/u;
|
||||
const managedFileNamePattern = /^(?:project|social)-[a-z0-9][a-z0-9-]*\.(?:avif|jpg|png|svg|webp|mp4|webm)$/u;
|
||||
const sha256Pattern = /^[a-f0-9]{64}$/u;
|
||||
|
||||
const assertSafeRecord = (asset) => {
|
||||
@@ -21,7 +22,8 @@ export const mergeAssetRecords = (baseAssets, generatedAssets, managedIds) => {
|
||||
throw new Error('ASSET-MERGE-RECORD-001');
|
||||
}
|
||||
}
|
||||
const retained = baseAssets.filter(({ id }) => !managedIds.has(id));
|
||||
const retained = baseAssets.filter(({ id, fileName }) =>
|
||||
!managedIds.has(id) || !managedFileNamePattern.test(fileName));
|
||||
const combined = [...retained, ...generatedAssets];
|
||||
const ids = new Set();
|
||||
const names = new Set();
|
||||
|
||||
Reference in New Issue
Block a user