$ show psi-4ward/psitransfer
PsiTransfer is a self-hosted file sharing application that allows users to upload and download files without accounts. It uses the tus resumable upload protocol for reliable large file transfers, supports password protection, one-time downloads, and archive downloads (zip/tar.gz). The backend is built with Node.js and Express, with a Vue.js frontend. The architecture is a monolith with a clear separation of concerns: an Express server handles routing, a file store manages disk I/O with path traversal protection, an in-memory database tracks metadata with garbage collection, and a custom tus protocol implementation (tusboy) handles resumable uploads. The codebase demonstrates good security practices (argon2 password hashing, input validation, safe filename handling) and is actively maintained with CI/CD, Docker support, and comprehensive tests.
The LLM identified 5 files worth highlighting for reuse:
Implements a file store with jail path validation to prevent directory traversal. Provides create, append, info, read stream, and delete operations with atomic JSON metadata updates. The getFilename method uses path.relative to ensure resolved paths stay within the configured upload directory, rejecting any traversal attempts. This component is reusable as a secure file storage backend for any Node.js application that needs to store files with metadata.
Provides utility functions for safe filename handling and upload ID validation. toSafeBasename strips control characters, normalizes separators, and enforces length limits. isSafeTusUploadId validates that upload IDs follow the 'sid++uuid' pattern with a safe bucket sid and a proper UUID v4 key. These functions are critical for security and can be extracted and reused in any application that needs to sanitize user-provided filenames or validate compound identifiers.
A reusable Express router that implements the tus resumable upload protocol (v1.0.0). It handles POST (creation), HEAD (status), PATCH (upload), and OPTIONS (CORS) requests. It integrates with any store that implements the tus store interface (create, append, info, del). The component is well-structured with separate handler files and error handling, making it easy to extract and use in other Node.js projects that need resumable uploads.
Provides password hashing using Argon2id with modest parameters suitable for broad hardware (including Raspberry Pi). Includes backward compatibility with legacy plaintext passwords stored in metadata JSON. The verifyPassword function handles both Argon2 hashes and plaintext comparisons using timing-safe equality. This component is a clean, self-contained password hashing utility that can be reused in any Node.js application.
An in-memory database that tracks file metadata with automatic garbage collection for expired files. It syncs from disk on initialization by scanning the upload directory and reading JSON metadata files. Provides methods to add, remove, update, and query files by bucket (sid). The GC runs every minute and removes expired files based on retention settings and max age. This component demonstrates a simple but effective pattern for managing ephemeral file metadata and can be reused in similar file-sharing or temporary storage applications.