fix(scanner): accept Epson empty write probes

backend/src/modules/scanner-inbox.service.ts

@@ -27,10 +27,14 @@ const objectStorage: ScannerStorage = {
     },
 }
 
-export function validateScannerFile(filename: string, body: Buffer) {
+function validateScannerFilename(filename: string) {
     if (!filename || filename.length > 200 || /[\\/\u0000-\u001f\u007f]/.test(filename) || filename.startsWith(".")) {
         throw scannerError(400, "Bitte einen einzelnen Dateinamen ohne Unterordner verwenden.")
     }
+}
+
+export function validateScannerFile(filename: string, body: Buffer) {
+    validateScannerFilename(filename)
     if (!body.length) throw scannerError(400, "Die Datei ist leer.")
     if (body.length > SCANNER_UPLOAD_LIMIT) throw scannerError(413, "Die Datei überschreitet 100 MB.")
     const extension = filename.split(".").pop()?.toLowerCase()
@@ -135,21 +139,38 @@ export function createScannerInboxService(db: FastifyInstance["db"], storage: Sc
             .where(and(eq(scannerInboxDocuments.fileId, fileId), eq(scannerInboxDocuments.tenantId, tenantId)))
         return { id: fileId, folder: folderId, type: typeId }
     })
+    const assertWritable = async (tx: Pick<FastifyInstance["db"], "select">, identity: ScannerIdentity) => {
+        // Hold these locks until the write or write probe has finished.
+        const [tenant] = await tx.select({ locked: tenants.locked }).from(tenants)
+            .where(eq(tenants.id, identity.tenantId)).for("share")
+        if (!tenant) throw scannerError(401, "Scanner-Zugang ungültig.")
+        if (tenant.locked === "maintenance_tenant") throw scannerError(423, "Der Mandant wird gerade gewartet.")
+        const [active] = await tx.select({ tenantId: scannerInboxConnections.tenantId }).from(scannerInboxConnections)
+            .where(and(eq(scannerInboxConnections.tenantId, identity.tenantId), eq(scannerInboxConnections.username, identity.username),
+                eq(scannerInboxConnections.passwordHash, identity.passwordHash), eq(scannerInboxConnections.active, true))).for("share")
+        if (!active) throw scannerError(401, "Scanner-Zugang ungültig.")
+    }
+    const probe = async (identity: ScannerIdentity, filename: string, onlyIfNew = false) => {
+        validateScannerFilename(filename)
+        if (!/\.(pdf|jpe?g|png|tiff?)$/i.test(filename)) {
+            throw scannerError(415, "Bitte eine vollständige PDF-, JPEG-, PNG- oder TIFF-Datei übertragen.")
+        }
+        await db.transaction(async tx => {
+            await assertWritable(tx, identity)
+            await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtextextended(${`${identity.tenantId}:${filename}`}, 0))`)
+            const [existing] = await tx.select({ fileId: scannerInboxDocuments.fileId }).from(scannerInboxDocuments)
+                .where(and(eq(scannerInboxDocuments.tenantId, identity.tenantId), eq(scannerInboxDocuments.remoteFilename, filename))).limit(1)
+            if (existing) throw scannerError(onlyIfNew ? 412 : 409, "Der Dateiname ist bereits vorhanden.")
+            // Epson probes writability with an empty PUT. No file, receipt or reservation is stored.
+        })
+    }
     const accept = async (identity: ScannerIdentity, filename: string, body: Buffer, onlyIfNew = false) => {
         const contentType = validateScannerFile(filename, body)
         const checksum = digest(body)
         let uploadedKey: string | undefined
         try {
             return await db.transaction(async tx => {
-                // Coordinate with tenant maintenance and credential revocation during the upload.
-                const [tenant] = await tx.select({ locked: tenants.locked }).from(tenants)
-                    .where(eq(tenants.id, identity.tenantId)).for("share")
-                if (!tenant) throw scannerError(401, "Scanner-Zugang ungültig.")
-                if (tenant.locked === "maintenance_tenant") throw scannerError(423, "Der Mandant wird gerade gewartet.")
-                const [active] = await tx.select({ tenantId: scannerInboxConnections.tenantId }).from(scannerInboxConnections)
-                    .where(and(eq(scannerInboxConnections.tenantId, identity.tenantId), eq(scannerInboxConnections.username, identity.username),
-                        eq(scannerInboxConnections.passwordHash, identity.passwordHash), eq(scannerInboxConnections.active, true))).for("share")
-                if (!active) throw scannerError(401, "Scanner-Zugang ungültig.")
+                await assertWritable(tx, identity)
 
                 // Serialise retries across processes; a lost HTTP response must not duplicate a document.
                 await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtextextended(${`${identity.tenantId}:${filename}`}, 0))`)
@@ -178,7 +199,7 @@ export function createScannerInboxService(db: FastifyInstance["db"], storage: Sc
             throw error
         }
     }
-    return { connection, credentials, disable, authenticate, find, list, filingOptions, fileDocument, accept }
+    return { connection, credentials, disable, authenticate, find, list, filingOptions, fileDocument, probe, accept }
 }
 
 export type ScannerInboxService = ReturnType<typeof createScannerInboxService>

backend/src/routes/scannerInboxGateway.ts

@@ -45,6 +45,10 @@ export default async function scannerInboxGateway(server: FastifyInstance, optio
                 throw scannerError(412, "Änderungen an vorhandenen Dokumenten werden nicht unterstützt.")
             }
             const body = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0)
+            if (!body.length && req.headers["content-length"] === "0") {
+                await service.probe(identity, filename, req.headers["if-none-match"] === "*")
+                return reply.code(201).send()
+            }
             const result = await service.accept(identity, filename, body, req.headers["if-none-match"] === "*")
             return reply.header("ETag", `"${result.checksum}"`).code(result.created ? 201 : 204).send()
         }