v0.3.1 — files: atomic name claim, type verification from bytes

Two defects in files, both harmless only because the admin token is currently the only thing that can write — and both preconditions for ever letting a tenant write.

A name claim was a check followed by a write

files put refuses an existing name unless --overwrite, and that refusal was a Show returning ErrExists followed, some way down, by an unconditional INSERT ... ON CONFLICT DO UPDATE. Two uploads of the same free name both saw it free, both wrote, and the second silently replaced the first.

Nothing looks wrong afterwards, which is what makes it worth fixing: the name still resolves, it just points at the other file. A test runs twelve writers at one name — against the previous code all twelve reported success and eleven files vanished. Now exactly one wins and the rest get already_exists (409).

--verify-type

The allow-list was checked against a string the caller sent: declare Content-Type: image/png over any bytes at all and an image-only namespace accepted them and recorded them as an image.

bkn files ns create avatars --allow-type 'image/*' --verify-type

Off by default, so every existing namespace behaves exactly as before.

The limits are documented rather than hidden, because they decide whether you want it. A sniffer sees bytes, not intentions, so a verifying namespace allow-lists what files look like: a .docx is a zip, a .css sniffs as text/plain. A declared type survives when it is a more specific truth about bytes the sniffer can only call a container (docx over zip yes, image/png over zip no), and bytes resembling no known format sniff as application/octet-stream — the sniffer declining to answer, not evidence of a lie. What it removes is the class the sniffer can name: HTML, JavaScript, SVG, and every text format a browser would act on.

New error: type_mismatch (415).

Upgrading from v0.3.0

One ALTER TABLE file_namespaces ADD COLUMN verify_type. No behaviour changes for existing namespaces, and the previous binary reads a migrated database.