feat(storage): phase 5 — replace Supabase storage with local filesystem + HMAC evidence serving

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/storage/evidence.ts

@@ -0,0 +1,79 @@
+import 'server-only'
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { fileTypeFromBuffer } from 'file-type'
+
+export type EvidenceStage = 'report' | 'response' | 'investigation' | 'capa' | 'verification'
+
+const ALLOWED_MIME_TYPES = new Set([
+  'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/heic', 'image/avif',
+  'video/mp4', 'video/quicktime', 'video/webm', 'video/x-msvideo',
+  'application/pdf',
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.ms-excel',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+])
+
+function evidenceDir(): string {
+  const dir = process.env.EVIDENCE_DIR
+  if (!dir) throw new Error('EVIDENCE_DIR env var not set')
+  return dir
+}
+
+function hmacSecret(): string {
+  const s = process.env.EVIDENCE_URL_SECRET
+  if (!s) throw new Error('EVIDENCE_URL_SECRET env var not set')
+  return s
+}
+
+export function signEvidencePath(filePath: string): string {
+  return crypto.createHmac('sha256', hmacSecret()).update(filePath).digest('hex')
+}
+
+export function getEvidenceUrl(filePath: string): string {
+  const token = signEvidencePath(filePath)
+  return `/api/evidence/${filePath}?token=${token}`
+}
+
+export async function uploadEvidenceFile(
+  file: File,
+  incidentId: string,
+  stage: EvidenceStage,
+  userId: string,
+): Promise<{ path: string; publicUrl: string; hash: string }> {
+  const isVideo = file.type.startsWith('video/')
+  const maxBytes = isVideo ? 200 * 1024 * 1024 : 10 * 1024 * 1024
+  if (file.size > maxBytes) {
+    throw new Error(`File too large: max ${isVideo ? '200MB' : '10MB'} for this file type`)
+  }
+
+  const buffer = await file.arrayBuffer()
+  const detected = await fileTypeFromBuffer(buffer)
+  const detectedMime = detected?.mime ?? null
+  if (!detectedMime || !ALLOWED_MIME_TYPES.has(detectedMime)) {
+    throw new Error(`File type not allowed: ${detectedMime ?? 'unknown'}`)
+  }
+
+  const ext = detected?.ext ?? file.name.split('.').pop() ?? 'bin'
+  const filename = `${Date.now()}-${crypto.randomBytes(6).toString('hex')}.${ext}`
+  const filePath = `${userId}/${incidentId}/${stage}/${filename}`
+
+  const hash = await computeHashFromBuffer(buffer)
+
+  const fullPath = path.join(evidenceDir(), filePath)
+  fs.mkdirSync(path.dirname(fullPath), { recursive: true })
+  fs.writeFileSync(fullPath, Buffer.from(buffer))
+
+  const publicUrl = getEvidenceUrl(filePath)
+
+  return { path: filePath, publicUrl, hash }
+}
+
+async function computeHashFromBuffer(buffer: ArrayBuffer): Promise<string> {
+  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer)
+  return Array.from(new Uint8Array(hashBuffer))
+    .map(b => b.toString(16).padStart(2, '0'))
+    .join('')
+}