Function assertSafeFileId

server/api/import/index.post.ts:299–307

(fileId: unknown)

const FILE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;

function assertSafeFileId(fileId: unknown): void {
  if (typeof fileId !== "string" || !FILE_ID_PATTERN.test(fileId)) {
    throw handleApiError(
      400,
      `Rejected import with invalid fileId: ${JSON.stringify(fileId)}`,
      "Invalid upload identifier.",
    );
  }
}

function assertWithinUserDir(userTempDir: string, targetPath: string): void {
  const base = path.resolve(userTempDir);