fix: files.create permissions (#5877)

* fix: files.create permissions

* test

* new

server/models/Attachment.ts

@@ -116,12 +116,12 @@ class Attachment extends IdModel {
 
   /**
    * Store the given file in storage at the location specified by the attachment key.
-   * If the attachment already exists, it will be overwritten.
+   * If the attachment already exists, an error will be thrown.
    *
    * @param file The file to store
    * @returns A promise resolving to the attachment
    */
-  async overwriteFile(file: File) {
+  async writeFile(file: File) {
     return FileStorage.store({
       body: createReadStream(file.filepath),
       contentLength: file.size,

server/storage/files/LocalStorage.ts

@@ -1,19 +1,20 @@
 import { Blob } from "buffer";
-import {
-  ReadStream,
-  closeSync,
-  createReadStream,
-  createWriteStream,
-  existsSync,
-  openSync,
-} from "fs";
 import { mkdir, unlink } from "fs/promises";
 import path from "path";
 import { Readable } from "stream";
+import {
+  ReadStream,
+  close,
+  pathExists,
+  createReadStream,
+  createWriteStream,
+  open,
+} from "fs-extra";
 import invariant from "invariant";
 import JWT from "jsonwebtoken";
 import safeResolvePath from "resolve-path";
 import env from "@server/env";
+import { ValidationError } from "@server/errors";
 import Logger from "@server/logging/Logger";
 import BaseStorage from "./BaseStorage";
 
@@ -53,13 +54,15 @@ export default class LocalStorage extends BaseStorage {
     key: string;
     acl?: string;
   }) => {
-    const subdir = key.split("/").slice(0, -1).join("/");
-    if (!existsSync(path.join(env.FILE_STORAGE_LOCAL_ROOT_DIR, subdir))) {
-      await mkdir(path.join(env.FILE_STORAGE_LOCAL_ROOT_DIR, subdir), {
-        recursive: true,
-      });
+    const exists = await pathExists(this.getFilePath(key));
+    if (exists) {
+      throw ValidationError(`File already exists at ${key}`);
     }
 
+    await mkdir(this.getFilePath(path.dirname(key)), {
+      recursive: true,
+    });
+
     let src: NodeJS.ReadableStream;
     if (body instanceof ReadStream) {
       src = body;
@@ -70,7 +73,9 @@ export default class LocalStorage extends BaseStorage {
     }
 
     const filePath = this.getFilePath(key);
-    closeSync(openSync(filePath, "w"));
+
+    // Create the file on disk first
+    await open(filePath, "w").then(close);
 
     return new Promise<string>((resolve, reject) => {
       const dest = createWriteStream(filePath)