feat: v0.7.0

Author: chloecinders

Cargo.lock

@@ -3,7 +3,7 @@ name = "emunex-server"
 description = "Remote Emulation & Library Management - Server"
 repository = "https://github.com/chloecinders/emuNEX-server"
 authors = ["chloecinders"]
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"
 
 [dependencies]

Cargo.toml

@@ -1,5 +1,3 @@
-use std::{collections::HashMap, path::PathBuf};
-
 use base64::{Engine as _, engine::general_purpose};
 use rocket::{get, post, serde::json::Json};
 use serde::Serialize;
@@ -14,9 +12,16 @@ use crate::{
     utils::s3::{download_object, upload_object},
 };
 
+#[derive(serde::Deserialize)]
+pub struct V1SaveUploadFile {
+    pub hash: String,
+    pub path: String,
+    pub content: String,
+}
+
 #[derive(serde::Deserialize)]
 pub struct V1SaveUploadRequest {
-    pub files: HashMap<String, String>,
+    pub files: Vec<V1SaveUploadFile>,
 }
 
 #[post("/api/v1/roms/<id>/save/<version_id>", data = "<data>")]
@@ -26,18 +31,26 @@ pub async fn upload_save(
     data: Json<V1SaveUploadRequest>,
     user: AuthenticatedUser,
 ) -> V1ApiResponseType<()> {
-    for (file_name, b64_content) in data.files.iter() {
-        let buffer = general_purpose::STANDARD.decode(b64_content).map_err(|e| {
-            error!("Failed to decode base64 for file '{}': {:?}", file_name, e);
-            V1ApiError::BadRequest
-        })?;
-
-        let save_path = format!("/saves/{}/{}/{}/{}", user.id.value(), id, version_id, file_name);
+    for file in data.files.iter() {
+        let buffer = general_purpose::STANDARD
+            .decode(&file.content)
+            .map_err(|e| {
+                error!("Failed to decode base64 for file '{}': {:?}", file.path, e);
+                V1ApiError::BadRequest
+            })?;
+
+        let save_path = format!(
+            "/saves/{}/{}/{}/{}",
+            user.id.value(),
+            id,
+            version_id,
+            file.hash
+        );
 
         upload_object(&save_path, &buffer).await.map_err(|e| {
             error!(
                 "Failed to upload save file '{}' to '{}': {:?}",
-                file_name, save_path, e
+                file.path, save_path, e
             );
             V1ApiError::InternalError
         })?;
@@ -51,15 +64,15 @@ pub async fn upload_save(
             user.id.value(),
             id,
             version_id,
-            file_name,
+            file.path,
             save_path
         )
         .execute(&*SQL)
         .await
         .map_err(|e| {
             error!(
                 "Database error inserting save file '{}': {:?}",
-                file_name, e
+                file.path, e
             );
             V1ApiError::InternalError
         })?;
@@ -68,14 +81,19 @@ pub async fn upload_save(
     Ok(V1ApiResponse(()))
 }
 
-#[get("/api/v1/roms/<id>/save/<version_id>/<file_name>", rank = 1)]
+#[derive(serde::Deserialize)]
+pub struct V1SaveDownloadRequest {
+    pub path: String,
+}
+
+#[post("/api/v1/roms/<id>/save/<version_id>/download", data = "<data>")]
 pub async fn download_save_file(
     id: String,
     version_id: i64,
-    file_name: PathBuf,
+    data: Json<V1SaveDownloadRequest>,
     user: AuthenticatedUser,
 ) -> Result<Vec<u8>, V1ApiError> {
-    let file_name_str = file_name.to_str().ok_or(V1ApiError::BadRequest)?;
+    let file_name_str = &data.path;
 
     let record = sqlx::query!(
         "SELECT save_path FROM user_save_files

src/routes/api/v1/saves.rs

@@ -12,6 +12,10 @@ pub async fn storage(file: std::path::PathBuf) -> Result<Vec<u8>, Status> {
     let display_path = file.display().to_string().replace("\\", "/");
     let key = format!("/{}", display_path);
 
+    if key.starts_with("/saves/") {
+        return Err(Status::Forbidden);
+    }
+
     let is_small_cover = key.starts_with("/covers_small/");
     let is_large_cover = key.starts_with("/covers/");
     let is_icon = key.starts_with("/icons/");