Scope files jobs and plugins to request profile

packages/server/src/services/hermes/upload-paths.ts

@@ -0,0 +1,19 @@
+import { join, resolve } from 'path'
+import { config } from '../../config'
+import { isPathWithin } from './hermes-path'
+
+function safeProfileSegment(profile: string): string {
+  const name = (profile || 'default').trim() || 'default'
+  if (name.includes('/') || name.includes('\\') || name.includes('..')) {
+    throw Object.assign(new Error('Invalid profile name'), { code: 'invalid_profile' })
+  }
+  return name
+}
+
+export function getProfileUploadDir(profile: string): string {
+  return resolve(join(config.uploadDir, safeProfileSegment(profile)))
+}
+
+export function isInProfileUploadDir(filePath: string, profile: string): boolean {
+  return isPathWithin(filePath, getProfileUploadDir(profile))
+}