71 lines
4.6 KiB
Dart
71 lines
4.6 KiB
Dart
import 'dart:async';
|
|
import 'dart:convert';
|
|
import 'package:flutter/foundation.dart';
|
|
import 'package:http/http.dart' as http;
|
|
|
|
@immutable
|
|
class R2UploadResult {
|
|
final bool success;
|
|
final String? objectKey;
|
|
final int? bytesWritten;
|
|
final String? errorMessage;
|
|
final int? statusCode;
|
|
final bool isRetryable;
|
|
final bool requiresAuth;
|
|
const R2UploadResult({required this.success, this.objectKey, this.bytesWritten, this.errorMessage, this.statusCode, this.isRetryable = true, this.requiresAuth = false});
|
|
const R2UploadResult.success({required String objectKey, int? bytesWritten}) : this(success: true, objectKey: objectKey, bytesWritten: bytesWritten, statusCode: 200, isRetryable: false);
|
|
const R2UploadResult.authRequired(String message, {int statusCode = 401}) : this(success: false, errorMessage: message, statusCode: statusCode, isRetryable: true, requiresAuth: true);
|
|
const R2UploadResult.temporaryFailure(String message, {int? statusCode}) : this(success: false, errorMessage: message, statusCode: statusCode, isRetryable: true);
|
|
const R2UploadResult.permanentFailure(String message, {int? statusCode}) : this(success: false, errorMessage: message, statusCode: statusCode, isRetryable: false);
|
|
}
|
|
|
|
/// Uploads immutable ride telemetry bundles through the authenticated Worker gateway.
|
|
class R2UploadService {
|
|
static const String defaultWorkerUrl = String.fromEnvironment('R2_WORKER_URL', defaultValue: 'https://motorsignal-r2-worker.bponders12.workers.dev');
|
|
final http.Client _client;
|
|
final String _workerBaseUrl;
|
|
R2UploadService({http.Client? client, String? workerBaseUrl}) : _client = client ?? http.Client(), _workerBaseUrl = (workerBaseUrl ?? defaultWorkerUrl).replaceAll(RegExp(r'/+$'), '');
|
|
String get workerBaseUrl => _workerBaseUrl;
|
|
|
|
Future<R2UploadResult> uploadTelemetryBundle({required String idToken, required String remoteRideId, required Uint8List zipBytes, required String sha256Hash, required String appVersion, Duration timeout = const Duration(seconds: 45)}) async {
|
|
if (idToken.trim().isEmpty) return const R2UploadResult.authRequired('Firebase ID token is required for R2 upload.');
|
|
if (zipBytes.isEmpty) return const R2UploadResult.permanentFailure('Telemetry bundle is empty.', statusCode: 400);
|
|
// Prevent path traversal at the client boundary. The Worker remains the
|
|
// authoritative verifier of SHA-256 and Firebase UID ownership.
|
|
if (!RegExp(r'^ride_[A-Za-z0-9_-]+$').hasMatch(remoteRideId)) return const R2UploadResult.permanentFailure('Invalid remote ride identifier.', statusCode: 400);
|
|
if (sha256Hash.trim().isEmpty) return const R2UploadResult.permanentFailure('Telemetry bundle SHA-256 is required.', statusCode: 400);
|
|
|
|
try {
|
|
final response = await _client.put(Uri.parse('$_workerBaseUrl/r2/upload'), headers: {
|
|
'Authorization': 'Bearer ${idToken.trim()}',
|
|
'Content-Type': 'application/zip',
|
|
'X-Remote-Ride-Id': remoteRideId,
|
|
'X-Bundle-Sha256': sha256Hash.trim().toLowerCase(),
|
|
'X-App-Version': appVersion,
|
|
}, body: zipBytes).timeout(timeout);
|
|
final status = response.statusCode;
|
|
if (status >= 200 && status < 300) {
|
|
try {
|
|
final decoded = jsonDecode(response.body);
|
|
if (decoded is! Map) throw const FormatException('Invalid worker response');
|
|
final data = Map<String, dynamic>.from(decoded);
|
|
final objectKey = data['objectKey'];
|
|
if (objectKey is! String || !objectKey.endsWith('/rides/$remoteRideId/telemetry.zip') || !objectKey.startsWith('users/')) return const R2UploadResult.permanentFailure('R2 worker returned an invalid object key.');
|
|
final size = data['size'];
|
|
final bytes = size is num && size >= 0 ? size.toInt() : zipBytes.length;
|
|
return R2UploadResult.success(objectKey: objectKey, bytesWritten: bytes);
|
|
} catch (e) {
|
|
return R2UploadResult.temporaryFailure('R2 upload response could not be verified: $e', statusCode: status);
|
|
}
|
|
}
|
|
if (status == 401 || status == 403) return R2UploadResult.authRequired('R2 Worker authorization denied ($status).', statusCode: status);
|
|
if (status == 400 || status == 404 || status == 409 || status == 422) return R2UploadResult.permanentFailure('R2 Worker rejected the bundle ($status).', statusCode: status);
|
|
return R2UploadResult.temporaryFailure('R2 Worker temporary error ($status).', statusCode: status);
|
|
} on TimeoutException {
|
|
return R2UploadResult.temporaryFailure('Upload to Cloudflare R2 timed out after ${timeout.inSeconds} seconds.');
|
|
} catch (e) {
|
|
return R2UploadResult.temporaryFailure('Network error uploading to Cloudflare R2: $e');
|
|
}
|
|
}
|
|
}
|