feat(attachments): depolama soyutlaması, içerikten tür tespiti, sharp/HEIC dönüşümü ve yetkili dosya servisi

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/lib/storage/local.test.ts

@@ -0,0 +1,35 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterAll, describe, expect, it } from "vitest";
+import { createLocalDriver } from "./local";
+import { isValidStorageKey } from "./types";
+
+const dirs: string[] = [];
+afterAll(() => Promise.all(dirs.map((d) => rm(d, { recursive: true, force: true }))));
+
+describe("yerel depolama", () => {
+  it("anahtar biçimi: yol geçişi ve beklenmeyen uzantılar reddedilir", () => {
+    expect(isValidStorageKey("ab/0123456789abcdef0123.webp")).toBe(true);
+    expect(isValidStorageKey("ab/0123456789abcdef0123.thumb.webp")).toBe(true);
+    expect(isValidStorageKey("ab/0123456789abcdef0123.pdf")).toBe(true);
+    expect(isValidStorageKey("../0123456789abcdef0123.webp")).toBe(false);
+    expect(isValidStorageKey("ab/../../etc/passwd")).toBe(false);
+    expect(isValidStorageKey("/ab/0123456789abcdef0123.webp")).toBe(false);
+    expect(isValidStorageKey("ab/0123456789abcdef0123.html")).toBe(false);
+  });
+
+  it("put/get/delete", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "butcem-storage-"));
+    dirs.push(dir);
+    const s = createLocalDriver(dir);
+    const key = "cd/cdef0123456789abcdef.pdf";
+    expect(await s.get(key)).toBeNull();
+    await s.put(key, new TextEncoder().encode("merhaba"));
+    expect((await s.get(key))!.toString()).toBe("merhaba");
+    await s.delete(key);
+    await s.delete(key);
+    expect(await s.get(key)).toBeNull();
+    await expect(s.put("../x.pdf", new Uint8Array())).rejects.toThrow();
+  });
+});