Building a Multi-Tenant Image Service Platform

1
import crypto from "crypto"

1
-- Organizations (Top-level tenants)
2
CREATE TABLE organizations (
3
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
4
    slug VARCHAR(100) UNIQUE NOT NULL,
5
    name VARCHAR(255) NOT NULL,
6
    status VARCHAR(20) DEFAULT 'active',
7

8
    -- Metadata
9
    created_at TIMESTAMPTZ DEFAULT NOW(),
10
    updated_at TIMESTAMPTZ DEFAULT NOW(),
11
    deleted_at TIMESTAMPTZ NULL
12
);
13

14
-- Tenants (Optional subdivision within org)
15
CREATE TABLE tenants (
16
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
17
    organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
18
    slug VARCHAR(100) NOT NULL,
19
    name VARCHAR(255) NOT NULL,
20
    status VARCHAR(20) DEFAULT 'active',
21

22
    -- Metadata
23
    created_at TIMESTAMPTZ DEFAULT NOW(),
24
    updated_at TIMESTAMPTZ DEFAULT NOW(),
25
    deleted_at TIMESTAMPTZ NULL,
26

27
    UNIQUE(organization_id, slug)
28
);
29

30
-- Spaces (Projects within tenant)
31
CREATE TABLE spaces (
32
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
33
    organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
34
    tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
35
    slug VARCHAR(100) NOT NULL,
36
    name VARCHAR(255) NOT NULL,
37

38
    -- Default policies (inherit from tenant/org if NULL)
39
    default_access VARCHAR(20) DEFAULT 'private', -- 'public' or 'private'
40

41
    -- Metadata
42
    created_at TIMESTAMPTZ DEFAULT NOW(),
43
    updated_at TIMESTAMPTZ DEFAULT NOW(),
44
    deleted_at TIMESTAMPTZ NULL,
45

46
    UNIQUE(tenant_id, slug),
47
    CONSTRAINT valid_access CHECK (default_access IN ('public', 'private'))
48
);
49

50
-- Policies (Hierarchical configuration)
51
CREATE TABLE policies (
52
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
53

54
    -- Scope (org, tenant, or space)
55
    scope_type VARCHAR(20) NOT NULL, -- 'organization', 'tenant', 'space'
56
    scope_id UUID NOT NULL,
57

58
    -- Policy data
59
    key VARCHAR(100) NOT NULL,
60
    value JSONB NOT NULL,
61

62
    -- Metadata
63
    updated_at TIMESTAMPTZ DEFAULT NOW(),
64

65
    UNIQUE(scope_type, scope_id, key),
66
    CONSTRAINT valid_scope_type CHECK (scope_type IN ('organization', 'tenant', 'space'))
67
);
68

69
-- API Keys for authentication
70
CREATE TABLE api_keys (
71
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
72
    organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
73
    tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
74

75
    -- Key identity
76
    key_id VARCHAR(50) UNIQUE NOT NULL, -- kid for rotation
77
    name VARCHAR(255) NOT NULL,
78
    secret_hash VARCHAR(255) NOT NULL, -- bcrypt/argon2
79

80
    -- Permissions
81
    scopes TEXT[] DEFAULT ARRAY['image:read']::TEXT[],
82

83
    -- Status
84
    status VARCHAR(20) DEFAULT 'active',
85
    expires_at TIMESTAMPTZ NULL,
86
    last_used_at TIMESTAMPTZ NULL,
87

88
    -- Metadata
89
    created_at TIMESTAMPTZ DEFAULT NOW(),
90
    rotated_at TIMESTAMPTZ NULL
91
);
92

93
-- Assets (Original uploaded images)
94
CREATE TABLE assets (
95
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
96
    organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
97
    tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
98
    space_id UUID NOT NULL REFERENCES spaces(id) ON DELETE CASCADE,
99

100
    -- Versioning
101
    version INTEGER NOT NULL DEFAULT 1,
102

103
    -- File info
104
    filename VARCHAR(500) NOT NULL,
105
    original_filename VARCHAR(500) NOT NULL,
106
    mime_type VARCHAR(100) NOT NULL,
107

108
    -- Storage
109
    storage_provider VARCHAR(50) NOT NULL, -- 'aws', 'gcp', 'azure', 'minio'
110
    storage_key VARCHAR(1000) NOT NULL UNIQUE,
111

112
    -- Content
113
    size_bytes BIGINT NOT NULL,
114
    content_hash VARCHAR(64) NOT NULL, -- SHA-256 for deduplication
115

116
    -- Image metadata
117
    width INTEGER,
118
    height INTEGER,
119
    format VARCHAR(10),
120
    color_space VARCHAR(20),
121
    has_alpha BOOLEAN,
122

123
    -- Organization
124
    tags TEXT[] DEFAULT ARRAY[]::TEXT[],
125
    folder VARCHAR(1000) DEFAULT '/',
126

127
    -- Access control
128
    access_policy VARCHAR(20) NOT NULL DEFAULT 'private',
129

130
    -- EXIF and metadata
131
    exif JSONB,
132

133
    -- Upload info
134
    uploaded_by UUID, -- Reference to user
135
    uploaded_at TIMESTAMPTZ DEFAULT NOW(),
136

137
    -- Metadata
138
    created_at TIMESTAMPTZ DEFAULT NOW(),
139
    updated_at TIMESTAMPTZ DEFAULT NOW(),
140
    deleted_at TIMESTAMPTZ NULL,
141

142
    CONSTRAINT valid_access_policy CHECK (access_policy IN ('public', 'private'))
143
);
144

145
-- Transformation Presets (Named transformation templates)
146
CREATE TABLE presets (
147
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
148
    organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
149
    tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
150
    space_id UUID REFERENCES spaces(id) ON DELETE CASCADE,
151

152
    -- Preset identity
153
    name VARCHAR(100) NOT NULL,
154
    slug VARCHAR(100) NOT NULL,
155
    description TEXT,
156

157
    -- Transformation definition
158
    operations JSONB NOT NULL,
159
    /*
160
    Example:
161
    {
162
        "resize": {"width": 800, "height": 600, "fit": "cover"},
163
        "format": "webp",
164
        "quality": 85,
165
        "sharpen": 1
166
    }
167
    */
168

169
    -- Auto-generation rules
170
    auto_generate BOOLEAN DEFAULT false,
171
    match_tags TEXT[] DEFAULT NULL,
172
    match_folders TEXT[] DEFAULT NULL,
173

174
    -- Metadata
175
    created_at TIMESTAMPTZ DEFAULT NOW(),
176
    updated_at TIMESTAMPTZ DEFAULT NOW(),
177

178
    UNIQUE(organization_id, tenant_id, space_id, slug)
179
);
180

181
-- Derived Assets (Transformed images)
182
CREATE TABLE derived_assets (
183
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
184
    asset_id UUID NOT NULL REFERENCES assets(id) ON DELETE CASCADE,
185

186
    -- Transformation identity
187
    operations_canonical VARCHAR(500) NOT NULL, -- Canonical string representation
188
    operations_hash VARCHAR(64) NOT NULL, -- SHA-256 of (canonical_ops + asset.content_hash)
189

190
    -- Output
191
    output_format VARCHAR(10) NOT NULL,
192

193
    -- Storage
194
    storage_provider VARCHAR(50) NOT NULL,
195
    storage_key VARCHAR(1000) NOT NULL UNIQUE,
196

197
    -- Content
198
    size_bytes BIGINT NOT NULL,
199
    content_hash VARCHAR(64) NOT NULL,
200

201
    -- Image metadata
202
    width INTEGER,
203
    height INTEGER,
204

205
    -- Performance tracking
206
    processing_time_ms INTEGER,
207
    access_count BIGINT DEFAULT 0,
208
    last_accessed_at TIMESTAMPTZ,
209

210
    -- Cache tier for lifecycle
211
    cache_tier VARCHAR(20) DEFAULT 'hot', -- 'hot', 'warm', 'cold'
212

213
    -- Metadata
214
    created_at TIMESTAMPTZ DEFAULT NOW(),
215
    updated_at TIMESTAMPTZ DEFAULT NOW(),
216

217
    UNIQUE(asset_id, operations_hash)
218
);
219

220
-- Transform Cache (Fast lookup for existing transforms)
221
CREATE TABLE transform_cache (
222
    asset_id UUID NOT NULL REFERENCES assets(id) ON DELETE CASCADE,
223
    operations_hash VARCHAR(64) NOT NULL,
224
    derived_asset_id UUID NOT NULL REFERENCES derived_assets(id) ON DELETE CASCADE,
225

226
    -- Metadata
227
    created_at TIMESTAMPTZ DEFAULT NOW(),
228

229
    PRIMARY KEY(asset_id, operations_hash)
230
);
231

232
-- Usage tracking (for cost and analytics)
233
CREATE TABLE usage_metrics (
234
    id BIGSERIAL PRIMARY KEY,
235
    date DATE NOT NULL,
236
    organization_id UUID NOT NULL,
237
    tenant_id UUID NOT NULL,
238
    space_id UUID NOT NULL,
239

240
    -- Metrics
241
    request_count BIGINT DEFAULT 0,
242
    bandwidth_bytes BIGINT DEFAULT 0,
243
    storage_bytes BIGINT DEFAULT 0,
244
    transform_count BIGINT DEFAULT 0,
245
    transform_cpu_ms BIGINT DEFAULT 0,
246

247
    UNIQUE(date, organization_id, tenant_id, space_id)
248
);
249

250
-- Audit logs
251
CREATE TABLE audit_logs (
252
    id BIGSERIAL PRIMARY KEY,
253
    organization_id UUID NOT NULL,
254
    tenant_id UUID,
255

256
    -- Actor
257
    actor_type VARCHAR(20) NOT NULL, -- 'user', 'api_key', 'system'
258
    actor_id UUID NOT NULL,
259

260
    -- Action
261
    action VARCHAR(100) NOT NULL, -- 'asset.upload', 'asset.delete', etc.
262
    resource_type VARCHAR(50) NOT NULL,
263
    resource_id UUID,
264

265
    -- Context
266
    metadata JSONB,
267
    ip_address INET,
268
    user_agent TEXT,
269

270
    -- Timestamp
271
    created_at TIMESTAMPTZ DEFAULT NOW()
272
);
273

274
-- Indexes for performance
275
CREATE INDEX idx_tenants_org ON tenants(organization_id);
276
CREATE INDEX idx_spaces_tenant ON spaces(tenant_id);
277
CREATE INDEX idx_spaces_org ON spaces(organization_id);
278
CREATE INDEX idx_policies_scope ON policies(scope_type, scope_id);
279

280
CREATE INDEX idx_assets_space ON assets(space_id) WHERE deleted_at IS NULL;
281
CREATE INDEX idx_assets_org ON assets(organization_id) WHERE deleted_at IS NULL;
282
CREATE INDEX idx_assets_hash ON assets(content_hash);
283
CREATE INDEX idx_assets_tags ON assets USING GIN(tags);
284
CREATE INDEX idx_assets_folder ON assets(folder);
285

286
CREATE INDEX idx_derived_asset ON derived_assets(asset_id);
287
CREATE INDEX idx_derived_hash ON derived_assets(operations_hash);
288
CREATE INDEX idx_derived_tier ON derived_assets(cache_tier);
289
CREATE INDEX idx_derived_access ON derived_assets(last_accessed_at);
290

291
CREATE INDEX idx_usage_date_org ON usage_metrics(date, organization_id);
292
CREATE INDEX idx_audit_org_time ON audit_logs(organization_id, created_at);

1
Format:
2
https://{cdn-domain}/v1/pub/{org}/{tenant}/{space}/img/{asset-id}/v{version}/{operations}.{ext}
3

4
Examples:
5
- Original:
6
  https://img.example.com/v1/pub/acme/website/marketing/img/01JBXYZ.../v1/original.jpg
7

8
- Resized:
9
  https://img.example.com/v1/pub/acme/website/marketing/img/01JBXYZ.../v1/w_800-h_600-f_cover.webp
10

11
- With preset:
12
  https://img.example.com/v1/pub/acme/website/marketing/img/01JBXYZ.../v1/preset_thumbnail.webp
13

14
- Format auto-negotiation:
15
  https://img.example.com/v1/pub/acme/website/marketing/img/01JBXYZ.../v1/w_1200-f_auto-q_auto.jpg

1
Format:
2
https://{cdn-domain}/v1/priv/{org}/{tenant}/{space}/img/{asset-id}/v{version}/{operations}.{ext}
3

4
Example:
5
https://img.example.com/v1/priv/acme/internal/confidential/img/01JBXYZ.../v1/w_800-h_600.jpg

1
Format:
2
{base-url}?sig={signature}&exp={unix-timestamp}&kid={key-id}
3

4
Example:
5
https://img.example.com/v1/priv/acme/internal/confidential/img/01JBXYZ.../v1/w_800-h_600.jpg?sig=dGVzdHNpZ25hdHVyZQ&exp=1731427200&kid=key_123
6

7
Components:
8
- sig: Base64URL-encoded HMAC-SHA256 signature
9
- exp: Unix timestamp (seconds) when URL expires
10
- kid: Key ID for signature rotation support

1
Parameter Format: {key}_{value}
2

3
Supported Parameters:
4
- w_{pixels}         : Width (e.g., w_800)
5
- h_{pixels}         : Height (e.g., h_600)
6
- f_{mode}           : Fit mode - cover, contain, fill, inside, outside, pad
7
- q_{quality}        : Quality 1-100 or 'auto' (e.g., q_85)
8
- fmt_{format}       : Format - jpg, png, webp, avif, gif, 'auto'
9
- r_{degrees}        : Rotation - 90, 180, 270
10
- g_{gravity}        : Crop gravity - center, north, south, east, west, etc.
11
- b_{color}          : Background color for pad (e.g., b_ffffff)
12
- blur_{radius}      : Blur radius 0.3-1000 (e.g., blur_5)
13
- sharpen_{amount}   : Sharpen amount 0-10 (e.g., sharpen_2)
14
- bw                 : Convert to black & white (grayscale)
15
- flip               : Flip horizontal
16
- flop               : Flip vertical
17
- preset_{name}      : Apply named preset
18

19
Examples:
20
- w_800-h_600-f_cover-q_85
21
- w_400-h_400-f_contain-fmt_webp
22
- preset_thumbnail
23
- w_1200-sharpen_2-fmt_webp-q_90
24
- w_800-h_600-f_pad-b_ffffff

1
/**
2
 * Canonicalizes transformation operations to ensure consistent cache keys
3
 */
4
function canonicalizeOperations(opsString) {
5
  const ops = parseOperations(opsString)
6

7
  // Apply defaults
8
  if (!ops.quality && ops.format !== "png") ops.quality = 85
9
  if (!ops.fit && (ops.width || ops.height)) ops.fit = "cover"
10

11
  // Normalize values
12
  if (ops.quality) ops.quality = Math.max(1, Math.min(100, ops.quality))
13
  if (ops.width) ops.width = Math.floor(ops.width)
14
  if (ops.height) ops.height = Math.floor(ops.height)
15

16
  // Canonical order: fmt, w, h, f, g, b, q, r, sharpen, blur, bw, flip, flop
17
  const order = ["fmt", "w", "h", "f", "g", "b", "q", "r", "sharpen", "blur", "bw", "flip", "flop"]
18

19
  return order
20
    .filter((key) => ops[key] !== undefined)
21
    .map((key) => `${key}_${ops[key]}`)
22
    .join("-")
23
}

1
import sharp from "sharp"
2
import crypto from "crypto"
3

4
/**
5
 * Transform Engine - Core image processing service
6
 */
7
class TransformEngine {
8
  constructor(storage, registry, cache, lockManager) {
9
    this.storage = storage
10
    this.registry = registry
11
    this.cache = cache
12
    this.lockManager = lockManager
13
  }
14

15
  /**
16
   * Process image transformation with deduplication
17
   */
18
  async transform(assetId, operations, acceptHeader) {
19
    // 1. Canonicalize operations
20
    const canonicalOps = this.canonicalizeOps(operations)
21
    const outputFormat = this.determineFormat(operations.format, acceptHeader)
22

23
    // 2. Generate transformation hash (content-addressed)
24
    const asset = await this.registry.getAsset(assetId)
25
    const opsHash = this.generateOpsHash(canonicalOps, asset.contentHash, outputFormat)
26

27
    // 3. Check multi-layer cache
28
    const cacheKey = `transform:${assetId}:${opsHash}`
29

30
    // Layer 1: Redis cache
31
    const cached = await this.cache.get(cacheKey)
32
    if (cached) {
33
      return {
34
        buffer: Buffer.from(cached.buffer, "base64"),
35
        contentType: cached.contentType,
36
        fromCache: "redis",
37
      }
38
    }
39

40
    // Layer 2: Database + Storage
41
    const derived = await this.registry.getDerivedAsset(assetId, opsHash)
42
    if (derived) {
43
      const buffer = await this.storage.get(derived.storageKey)
44

45
      // Populate Redis cache
46
      await this.cache.set(
47
        cacheKey,
48
        {
49
          buffer: buffer.toString("base64"),
50
          contentType: `image/${derived.outputFormat}`,
51
        },
52
        3600,
53
      ) // 1 hour TTL
54

55
      // Update access metrics
56
      await this.registry.incrementAccessCount(derived.id)
57

58
      return {
59
        buffer,
60
        contentType: `image/${derived.outputFormat}`,
61
        fromCache: "storage",
62
      }
63
    }
64

65
    // Layer 3: Process new transformation (with distributed locking)
66
    const lockKey = `lock:transform:${assetId}:${opsHash}`
67
    const lock = await this.lockManager.acquire(lockKey, 60000) // 60s TTL
68

69
    try {
70
      // Double-check after acquiring lock
71
      const doubleCheck = await this.registry.getDerivedAsset(assetId, opsHash)
72
      if (doubleCheck) {
73
        const buffer = await this.storage.get(doubleCheck.storageKey)
74
        return {
75
          buffer,
76
          contentType: `image/${doubleCheck.outputFormat}`,
77
          fromCache: "concurrent",
78
        }
79
      }
80

81
      // Process transformation
82
      const startTime = Date.now()
83

84
      // Fetch original
85
      const originalBuffer = await this.storage.get(asset.storageKey)
86

87
      // Apply transformations
88
      const processedBuffer = await this.applyTransformations(originalBuffer, canonicalOps, outputFormat)
89

90
      const processingTime = Date.now() - startTime
91

92
      // Get metadata of processed image
93
      const metadata = await sharp(processedBuffer).metadata()
94

95
      // Generate storage key
96
      const storageKey = `derived/${asset.organizationId}/${asset.tenantId}/${asset.spaceId}/${assetId}/v${asset.version}/${opsHash}.${outputFormat}`
97

98
      // Store processed image
99
      await this.storage.put(storageKey, processedBuffer, `image/${outputFormat}`)
100

101
      // Compute content hash
102
      const contentHash = crypto.createHash("sha256").update(processedBuffer).digest("hex")
103

104
      // Save to database
105
      const derivedAsset = await this.registry.createDerivedAsset({
106
        assetId,
107
        operationsCanonical: canonicalOps,
108
        operationsHash: opsHash,
109
        outputFormat,
110
        storageProvider: this.storage.provider,
111
        storageKey,
112
        sizeBytes: processedBuffer.length,
113
        contentHash,
114
        width: metadata.width,
115
        height: metadata.height,
116
        processingTimeMs: processingTime,
117
      })
118

119
      // Update transform cache index
120
      await this.registry.cacheTransform(assetId, opsHash, derivedAsset.id)
121

122
      // Populate Redis cache
123
      await this.cache.set(
124
        cacheKey,
125
        {
126
          buffer: processedBuffer.toString("base64"),
127
          contentType: `image/${outputFormat}`,
128
        },
129
        3600,
130
      )
131

132
      return {
133
        buffer: processedBuffer,
134
        contentType: `image/${outputFormat}`,
135
        fromCache: "none",
136
        processingTime,
137
      }
138
    } finally {
139
      await lock.release()
140
    }
141
  }
142

143
  /**
144
   * Apply transformations using Sharp
145
   */
146
  async applyTransformations(inputBuffer, operations, outputFormat) {
147
    let pipeline = sharp(inputBuffer)
148

149
    // Rotation
150
    if (operations.rotation) {
151
      pipeline = pipeline.rotate(operations.rotation)
152
    }
153

154
    // Flip/Flop
155
    if (operations.flip) {
156
      pipeline = pipeline.flip()
157
    }
158
    if (operations.flop) {
159
      pipeline = pipeline.flop()
160
    }
161

162
    // Resize
163
    if (operations.width || operations.height) {
164
      const resizeOptions = {
165
        width: operations.width,
166
        height: operations.height,
167
        fit: operations.fit || "cover",
168
        position: operations.gravity || "centre",
169
        withoutEnlargement: true,
170
      }
171

172
      // Background for 'pad' fit
173
      if (operations.fit === "pad" && operations.background) {
174
        resizeOptions.background = this.parseColor(operations.background)
175
      }
176

177
      pipeline = pipeline.resize(resizeOptions)
178
    }
179

180
    // Effects
181
    if (operations.blur) {
182
      pipeline = pipeline.blur(operations.blur)
183
    }
184

185
    if (operations.sharpen) {
186
      pipeline = pipeline.sharpen(operations.sharpen)
187
    }
188

189
    if (operations.grayscale) {
190
      pipeline = pipeline.grayscale()
191
    }
192

193
    // Format conversion and quality
194
    const quality = operations.quality === "auto" ? this.getAutoQuality(outputFormat) : operations.quality || 85
195

196
    switch (outputFormat) {
197
      case "jpg":
198
      case "jpeg":
199
        pipeline = pipeline.jpeg({
200
          quality,
201
          mozjpeg: true, // Better compression
202
        })
203
        break
204

205
      case "png":
206
        pipeline = pipeline.png({
207
          quality,
208
          compressionLevel: 9,
209
          adaptiveFiltering: true,
210
        })
211
        break
212

213
      case "webp":
214
        pipeline = pipeline.webp({
215
          quality,
216
          effort: 6, // Compression effort (0-6)
217
        })
218
        break
219

220
      case "avif":
221
        pipeline = pipeline.avif({
222
          quality,
223
          effort: 6,
224
        })
225
        break
226

227
      case "gif":
228
        pipeline = pipeline.gif()
229
        break
230
    }
231

232
    return await pipeline.toBuffer()
233
  }
234

235
  /**
236
   * Determine output format based on operations and Accept header
237
   */
238
  determineFormat(requestedFormat, acceptHeader) {
239
    if (requestedFormat && requestedFormat !== "auto") {
240
      return requestedFormat
241
    }
242

243
    // Format negotiation based on Accept header
244
    const accept = (acceptHeader || "").toLowerCase()
245

246
    if (accept.includes("image/avif")) {
247
      return "avif" // Best compression
248
    }
249

250
    if (accept.includes("image/webp")) {
251
      return "webp" // Good compression, wide support
252
    }
253

254
    return "jpg" // Fallback
255
  }
256

257
  /**
258
   * Get automatic quality based on format
259
   */
260
  getAutoQuality(format) {
261
    const qualityMap = {
262
      avif: 75, // AVIF compresses very well
263
      webp: 80, // WebP compresses well
264
      jpg: 85, // JPEG needs higher quality
265
      jpeg: 85,
266
      png: 90, // PNG is lossless
267
    }
268

269
    return qualityMap[format] || 85
270
  }
271

272
  /**
273
   * Generate deterministic hash for transformation
274
   */
275
  generateOpsHash(canonicalOps, assetContentHash, outputFormat) {
276
    const payload = `${canonicalOps};${assetContentHash};fmt=${outputFormat}`
277
    return crypto.createHash("sha256").update(payload).digest("hex")
278
  }
279

280
  /**
281
   * Parse color hex string to RGB object
282
   */
283
  parseColor(hex) {
284
    hex = hex.replace("#", "")
285
    return {
286
      r: parseInt(hex.substr(0, 2), 16),
287
      g: parseInt(hex.substr(2, 2), 16),
288
      b: parseInt(hex.substr(4, 2), 16),
289
    }
290
  }
291

292
  /**
293
   * Canonicalize operations
294
   */
295
  canonicalizeOps(ops) {
296
    // Implementation details...
297
    // Return canonical string like "w_800-h_600-f_cover-q_85-fmt_webp"
298
  }
299
}
300

301
export default TransformEngine

1
import Redlock from "redlock"
2
import Redis from "ioredis"
3

4
/**
5
 * Distributed lock manager using Redlock algorithm
6
 */
7
class LockManager {
8
  constructor(redisClients) {
9
    // Initialize Redlock with multiple Redis instances for reliability
10
    this.redlock = new Redlock(redisClients, {
11
      driftFactor: 0.01,
12
      retryCount: 10,
13
      retryDelay: 200,
14
      retryJitter: 200,
15
      automaticExtensionThreshold: 500,
16
    })
17
  }
18

19
  /**
20
   * Acquire distributed lock
21
   */
22
  async acquire(key, ttl = 30000) {
23
    try {
24
      const lock = await this.redlock.acquire([`lock:${key}`], ttl)
25
      return lock
26
    } catch (error) {
27
      throw new Error(`Failed to acquire lock for ${key}: ${error.message}`)
28
    }
29
  }
30

31
  /**
32
   * Try to acquire lock without waiting
33
   */
34
  async tryAcquire(key, ttl = 30000) {
35
    try {
36
      return await this.redlock.acquire([`lock:${key}`], ttl)
37
    } catch (error) {
38
      return null // Lock not acquired
39
    }
40
  }
41
}
42

43
// Usage
44
const redis1 = new Redis({ host: "redis-1" })
45
const redis2 = new Redis({ host: "redis-2" })
46
const redis3 = new Redis({ host: "redis-3" })
47

48
const lockManager = new LockManager([redis1, redis2, redis3])
49

50
export default LockManager

1
import crypto from "crypto"
2

3
/**
4
 * Signature Service - Generate and verify signed URLs
5
 */
6
class SignatureService {
7
  constructor(registry) {
8
    this.registry = registry
9
  }
10

11
  /**
12
   * Generate signed URL for private images
13
   */
14
  async generateSignedUrl(baseUrl, orgId, tenantId, ttl = null) {
15
    // Get signing key for tenant/org
16
    const apiKey = await this.registry.getSigningKey(orgId, tenantId)
17

18
    // Get effective policy for TTL
19
    const policy = await this.registry.getEffectivePolicy(orgId, tenantId)
20
    const defaultTtl = policy.signed_url_ttl_default_seconds || 3600
21
    const maxTtl = policy.signed_url_ttl_max_seconds || 86400
22

23
    // Calculate expiry
24
    const requestedTtl = ttl || defaultTtl
25
    const effectiveTtl = Math.min(requestedTtl, maxTtl)
26
    const expiresAt = Math.floor(Date.now() / 1000) + effectiveTtl
27

28
    // Create canonical string for signing
29
    const url = new URL(baseUrl)
30
    const canonicalString = this.createCanonicalString(url.pathname, expiresAt, url.hostname, tenantId)
31

32
    // Generate HMAC-SHA256 signature
33
    const signature = crypto.createHmac("sha256", apiKey.secret).update(canonicalString).digest("base64url") // URL-safe base64
34

35
    // Append signature, expiry, and key ID to URL
36
    url.searchParams.set("sig", signature)
37
    url.searchParams.set("exp", expiresAt.toString())
38
    url.searchParams.set("kid", apiKey.keyId)
39

40
    return {
41
      url: url.toString(),
42
      expiresAt: new Date(expiresAt * 1000),
43
      expiresIn: effectiveTtl,
44
    }
45
  }
46

47
  /**
48
   * Verify signed URL
49
   */
50
  async verifySignedUrl(signedUrl, orgId, tenantId) {
51
    const url = new URL(signedUrl)
52

53
    // Extract signature components
54
    const signature = url.searchParams.get("sig")
55
    const expiresAt = parseInt(url.searchParams.get("exp"))
56
    const keyId = url.searchParams.get("kid")
57

58
    if (!signature || !expiresAt || !keyId) {
59
      return {
60
        valid: false,
61
        error: "Missing signature components",
62
      }
63
    }
64

65
    // Check expiration
66
    const now = Math.floor(Date.now() / 1000)
67
    if (now > expiresAt) {
68
      return {
69
        valid: false,
70
        expired: true,
71
        error: "Signature expired",
72
      }
73
    }
74

75
    // Get signing key
76
    const apiKey = await this.registry.getApiKeyById(keyId)
77
    if (!apiKey || apiKey.status !== "active") {
78
      return {
79
        valid: false,
80
        error: "Invalid key ID",
81
      }
82
    }
83

84
    // Verify tenant/org ownership
85
    if (apiKey.organizationId !== orgId || apiKey.tenantId !== tenantId) {
86
      return {
87
        valid: false,
88
        error: "Key does not match tenant",
89
      }
90
    }
91

92
    // Reconstruct canonical string
93
    url.searchParams.delete("sig")
94
    url.searchParams.delete("exp")
95
    url.searchParams.delete("kid")
96

97
    const canonicalString = this.createCanonicalString(url.pathname, expiresAt, url.hostname, tenantId)
98

99
    // Compute expected signature
100
    const expectedSignature = crypto.createHmac("sha256", apiKey.secret).update(canonicalString).digest("base64url")
101

102
    // Constant-time comparison to prevent timing attacks
103
    const valid = crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))
104

105
    return {
106
      valid,
107
      error: valid ? null : "Invalid signature",
108
    }
109
  }
110

111
  /**
112
   * Create canonical string for signing
113
   */
114
  createCanonicalString(pathname, expiresAt, hostname, tenantId) {
115
    return ["GET", pathname, expiresAt, hostname, tenantId].join("\n")
116
  }
117

118
  /**
119
   * Rotate signing keys
120
   */
121
  async rotateSigningKey(orgId, tenantId) {
122
    // Generate new secret
123
    const newSecret = crypto.randomBytes(32).toString("hex")
124
    const newKeyId = `key_${Date.now()}_${crypto.randomBytes(8).toString("hex")}`
125

126
    // Create new key
127
    const newKey = await this.registry.createApiKey({
128
      organizationId: orgId,
129
      tenantId,
130
      keyId: newKeyId,
131
      name: `Signing Key (rotated ${new Date().toISOString()})`,
132
      secret: newSecret,
133
      scopes: ["signing"],
134
    })
135

136
    // Mark old keys for deprecation (keep valid for grace period)
137
    await this.registry.deprecateOldSigningKeys(orgId, tenantId, newKey.id)
138

139
    return newKey
140
  }
141
}
142

143
export default SignatureService