feat: dedup wave 3 — constant + streamToTemp utility

- ♻️ randomUUID() → nanoid() di s3-object.ts (eliminasi node:crypto)
- ✨ DEFAULT_FILE_TYPE constant, ganti 8× hardcoded 'document'
- ✨ streamToTemp() shared utility (src/shared/utils/temp-stream.ts)
- ♻️ 3× streaming-to-temp pattern di s3-controller, upload-controller,
  web-api-controller → pake streamToTemp()
- Lint ✅ Build ✅

src/interfaces/http/controllers/s3-controller.ts

@@ -12,7 +12,13 @@ import {
 } from '../../../infrastructure/di';
 import { botPool } from '../../../infrastructure/telegram/bot-pool';
 import logger from '../../../shared/logger/index';
-import { cleanupTempFile, ensureExtension, getErrorMessage } from '../../../shared/utils/file';
+import {
+  cleanupTempFile,
+  DEFAULT_FILE_TYPE,
+  ensureExtension,
+  getErrorMessage,
+} from '../../../shared/utils/file';
+import { streamToTemp } from '../../../shared/utils/temp-stream';
 import { verifyBodyHash, verifyPresignedUrl, verifySignature } from '../../s3/auth';
 import { S3_CORS_HEADERS, s3Headers } from '../../s3/headers';
 import { createGetObjectResponse, type ObjectPartSource } from '../../s3/object-stream';
@@ -818,17 +824,10 @@ const streamBodyToTemp = async (
 ): Promise<{
   tempPath: string;
   fileHash: string;
-  md5Hash: string;
+  md5Hash?: string;
   sizeBytes: number;
   signatureBuffer: Buffer;
 }> => {
-  const tempPath = `/tmp/filedrop-s3-${nanoid()}`;
-  const writer = Bun.file(tempPath).writer();
-  const sha256 = new Bun.CryptoHasher('sha256');
-  const md5 = new Bun.CryptoHasher('md5');
-  let writerFailed = false;
-
-  // Handle body being null (GET/HEAD/DELETE or empty PUT)
   const reader = (
     body ??
     new ReadableStream({
@@ -836,56 +835,8 @@ const streamBodyToTemp = async (
         c.close();
       },
     })
-  ).getReader();
-  const SIGNATURE_BYTES = 16;
-  const signatureChunks: Buffer[] = [];
-  let signatureBytes = 0;
-  let sizeBytes = 0;
-
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      const chunk = Buffer.from(value);
-      sizeBytes += chunk.byteLength;
-      sha256.update(chunk);
-      md5.update(chunk);
-      writer.write(chunk);
-
-      if (signatureBytes < SIGNATURE_BYTES) {
-        const remaining = SIGNATURE_BYTES - signatureBytes;
-        const sigChunk = chunk.subarray(0, remaining);
-        signatureChunks.push(sigChunk);
-        signatureBytes += sigChunk.byteLength;
-      }
-    }
-
-    try {
-      writer.end();
-    } catch {
-      writerFailed = true;
-    }
-
-    return {
-      tempPath,
-      fileHash: sha256.digest('hex'),
-      md5Hash: md5.digest('base64'),
-      sizeBytes,
-      signatureBuffer: Buffer.concat(signatureChunks, signatureBytes),
-    };
-  } catch (error) {
-    if (!writerFailed) {
-      try {
-        writer.end();
-      } catch {
-        /* writer may already be errored */
-      }
-    }
-    await cleanupTempFile(tempPath);
-    throw error;
-  } finally {
-    reader.releaseLock();
-  }
+  ).getReader() as ReadableStreamDefaultReader<Uint8Array>;
+  return streamToTemp(reader, { computeMd5: true, prefix: '/tmp/filedrop-s3-' });
 };
 
 /**
@@ -1049,7 +1000,7 @@ const storeFileFromTemp = async (
       fileName: finalFileName,
       mimeType,
       sizeBytes: streamed.sizeBytes,
-      fileType: 'document',
+      fileType: DEFAULT_FILE_TYPE,
       uploaderId: 0,
       bucketId,
       s3Key: key,
@@ -1080,7 +1031,7 @@ const storeFileFromTemp = async (
       fileName: finalFileName,
       mimeType,
       sizeBytes: streamed.sizeBytes,
-      fileType: 'document',
+      fileType: DEFAULT_FILE_TYPE,
       uploaderId: 0,
       fileHash: streamed.fileHash,
       bucketId,
@@ -1687,7 +1638,7 @@ const handleCompleteMultipartUpload = async (
       fileName: key.split('/').pop() || 'file',
       mimeType,
       sizeBytes: totalSize,
-      fileType: 'document',
+      fileType: DEFAULT_FILE_TYPE,
       uploaderId: 0,
       bucketId: multipart.bucketId,
       s3Key: key,

src/interfaces/http/controllers/upload-controller.ts

@@ -1,4 +1,3 @@
-import { createWriteStream } from 'node:fs';
 import { nanoid } from 'nanoid';
 import { config } from '../../../env';
 import { chunkedStorage, fileRepository, uploadBatcher } from '../../../infrastructure/di';
@@ -15,6 +14,7 @@ import {
   getErrorMessage,
   getFileType,
 } from '../../../shared/utils/file';
+import { streamToTemp } from '../../../shared/utils/temp-stream';
 
 /**
  * Maximum allowed size (in bytes) for a base64 JSON upload.
@@ -93,7 +93,7 @@ const rejectOversizedRequest = (req: Request): Response | null => {
  * Streams a multipart `File` to a temporary file on disk while computing
  * its SHA-256 hash and extracting the signature (first 16 bytes).
  *
- * Backpressure from the write stream is respected via the drain event.
+ * Delegates to the shared {@link streamToTemp} utility.
  *
  * @param file - The multipart `File` object.
  * @param maxSizeBytes - Maximum allowed file size; an error is thrown if
@@ -102,67 +102,8 @@ const rejectOversizedRequest = (req: Request): Response | null => {
  * @throws {Error} When the file size exceeds `maxSizeBytes`.
  */
 const streamFileToTemp = async (file: File, maxSizeBytes: number): Promise<PreparedUpload> => {
-  const tempPath = `/tmp/filedrop-${nanoid()}`;
-  const writer = createWriteStream(tempPath);
-  const hasher = new Bun.CryptoHasher('sha256');
-  const reader = file.stream().getReader();
-  const signatureChunks: Buffer[] = [];
-  let signatureBytes = 0;
-  let sizeBytes = 0;
-
-  const writeChunk = async (chunk: Buffer): Promise<void> => {
-    if (!writer.write(chunk)) {
-      await new Promise<void>((resolve, reject) => {
-        writer.once('drain', resolve);
-        writer.once('error', reject);
-      });
-    }
-  };
-
-  const finishWriter = async (): Promise<void> => {
-    await new Promise<void>((resolve, reject) => {
-      writer.end(() => resolve());
-      writer.once('error', reject);
-    });
-  };
-
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-
-      const chunk = Buffer.from(value);
-      sizeBytes += chunk.byteLength;
-      if (sizeBytes > maxSizeBytes) {
-        throw new Error('File size exceeds upload limit');
-      }
-
-      hasher.update(chunk);
-      await writeChunk(chunk);
-
-      if (signatureBytes < SIGNATURE_BYTES) {
-        const remaining = SIGNATURE_BYTES - signatureBytes;
-        const signatureChunk = chunk.subarray(0, remaining);
-        signatureChunks.push(signatureChunk);
-        signatureBytes += signatureChunk.byteLength;
-      }
-    }
-
-    await finishWriter();
-
-    return {
-      tempPath,
-      fileHash: hasher.digest('hex'),
-      sizeBytes,
-      signatureBuffer: Buffer.concat(signatureChunks, signatureBytes),
-    };
-  } catch (error) {
-    writer.destroy();
-    await cleanupTempFile(tempPath);
-    throw error;
-  } finally {
-    reader.releaseLock();
-  }
+  const result = await streamToTemp(file.stream().getReader(), { maxSizeBytes });
+  return result;
 };
 
 /**

src/interfaces/http/controllers/web-api-controller.ts

@@ -5,7 +5,13 @@ import { config } from '../../../env';
 import { bucketRepository, chunkedStorage, fileRepository } from '../../../infrastructure/di';
 import { botPool } from '../../../infrastructure/telegram/bot-pool';
 import logger from '../../../shared/logger/index';
-import { cleanupTempFile, ensureExtension, getErrorMessage } from '../../../shared/utils/file';
+import {
+  cleanupTempFile,
+  DEFAULT_FILE_TYPE,
+  ensureExtension,
+  getErrorMessage,
+} from '../../../shared/utils/file';
+import { streamToTemp } from '../../../shared/utils/temp-stream';
 
 /**
  * Route parameters extracted from the URL path.
@@ -163,67 +169,33 @@ export const handleUploadObjectV1 = async (
   }
 
   const key = (formData.get('key') as string) || file.name;
-  const tempPath = `/tmp/filedrop-web-${nanoid()}`;
-  const writer = Bun.file(tempPath).writer();
-  const reader = file.stream().getReader();
-  const hasher = new Bun.CryptoHasher('sha256');
-  const SIGNATURE_BYTES = 16;
-  const signatureChunks: Buffer[] = [];
-  let signatureBytes = 0;
-  let sizeBytes = 0;
-
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      const chunk = Buffer.from(value);
-      sizeBytes += chunk.byteLength;
-      hasher.update(chunk);
-      writer.write(chunk);
-      if (signatureBytes < SIGNATURE_BYTES) {
-        const remaining = SIGNATURE_BYTES - signatureBytes;
-        const sigChunk = chunk.subarray(0, remaining);
-        signatureChunks.push(sigChunk);
-        signatureBytes += sigChunk.byteLength;
-      }
-    }
-    writer.end();
-  } catch (error) {
-    writer.end();
-    await cleanupTempFile(tempPath);
-    throw error;
-  } finally {
-    reader.releaseLock();
-  }
-
-  const hash = hasher.digest('hex');
-  const signatureBuffer = Buffer.concat(signatureChunks, signatureBytes);
+  const streamed = await streamToTemp(file.stream().getReader(), { prefix: '/tmp/filedrop-web-' });
   const { fileName: finalFileName, mimeType } = ensureExtension(
     key.split('/').pop() || 'file',
-    signatureBuffer,
+    streamed.signatureBuffer,
     file.type || 'application/octet-stream',
   );
 
   const partFileNamePrefix = `s3-${bucket.name}-${key.replace(/\//g, '_')}`;
 
-  if (sizeBytes > config.telegramChunkSizeBytes) {
+  if (streamed.sizeBytes > config.telegramChunkSizeBytes) {
     const uploadedFile = await chunkedStorage.storeFileInTelegramChunks({
-      tempPath,
+      tempPath: streamed.tempPath,
       partFileNamePrefix,
       fileName: finalFileName,
       mimeType,
-      sizeBytes,
-      fileType: 'document',
+      sizeBytes: streamed.sizeBytes,
+      fileType: DEFAULT_FILE_TYPE,
       uploaderId: 0,
       bucketId: bucket.id,
       s3Key: key,
     });
-    await cleanupTempFile(tempPath);
+    await cleanupTempFile(streamed.tempPath);
     return json(
       {
         key,
-        size: sizeBytes,
-        etag: hash,
+        size: streamed.sizeBytes,
+        etag: streamed.fileHash,
         downloadUrl: `${config.baseUrl}/f/${uploadedFile.publicId}`,
       },
       201,
@@ -231,7 +203,7 @@ export const handleUploadObjectV1 = async (
   }
 
   const forwardResult = await botPool.forwardToStorage(
-    createReadStream(tempPath),
+    createReadStream(streamed.tempPath),
     partFileNamePrefix,
     'document',
   );
@@ -247,20 +219,25 @@ export const handleUploadObjectV1 = async (
       storageMessageId: forwardResult.storageMessageId,
       fileName: finalFileName,
       mimeType,
-      sizeBytes,
-      fileType: 'document',
+      sizeBytes: streamed.sizeBytes,
+      fileType: DEFAULT_FILE_TYPE,
       uploaderId: 0,
-      fileHash: hash,
+      fileHash: streamed.fileHash,
       bucketId: bucket.id,
       s3Key: key,
       storageBackend: 'telegram',
     }),
   );
 
-  await cleanupTempFile(tempPath);
+  await cleanupTempFile(streamed.tempPath);
 
   return json(
-    { key, size: sizeBytes, etag: hash, downloadUrl: `${config.baseUrl}/f/${publicId}` },
+    {
+      key,
+      size: streamed.sizeBytes,
+      etag: streamed.fileHash,
+      downloadUrl: `${config.baseUrl}/f/${publicId}`,
+    },
     201,
   );
 };