@aurabase/aurabase-js 0.3.0

package/packages/aurabase/tests/storage-backend-e2e.test.ts

@@ -0,0 +1,481 @@
+// ---------------------------------------------------------------------------
+// E2E réel (stack live) — Lot storage-backend : valide les 4 correctifs backend.
+// Réf. specs : docs/superpowers/specs/2026-07-13-storage-*-design.md
+//
+// Les méthodes SDK correspondantes (updateBucket, uploadToSignedUrl, copy/move
+// cross-bucket) ne sont pas encore ajoutées (lot storage-sdk) → on teste le
+// BACKEND via fetch REST direct (routes confirmées dans aura-storage/src/main.rs),
+// avec la même mécanique de skip gracieux que storage-transform-e2e.test.ts.
+//
+// Scénarios :
+//   1. img-transform-default : défaut déterministe = activé (plus de bascule
+//      autorisé→Forbidden à l'ouverture des settings).
+//   2. signed-upload-url : mint service_role → PUT signé fonctionnel (valide
+//      aussi l'assomption gateway : PUT signé sans apikey passe le data-plane) ;
+//      PUT sans sig → 401 ; mint anon → 403 (sécurité #1) ; mint _derivatives → 403.
+//   3. cache-hardening : x-aura-cache MISS→HIT + ETag stable ; overwrite source
+//      → nouveau rendu (clé versionnée etag) ; upload ?folder=_derivatives → 400.
+//   4. cross-bucket : copy/move a→b (bucket destination distinct) ; dst inconnu → 404.
+//
+// Gaté par RUN_E2E + credentials.
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect } from 'vitest'
+import { deflateSync } from 'node:zlib'
+import { createAdminClient, createClient } from '../src/index'
+import type { AuraResponse } from '../src/index'
+
+const URL = process.env.AURA_E2E_URL
+const PROJECT = process.env.AURA_E2E_PROJECT
+const ANON = process.env.AURA_E2E_ANON_KEY
+const SERVICE = process.env.AURA_E2E_SERVICE_KEY
+const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && ANON && SERVICE)
+
+const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504])
+
+async function retryTransient<T>(fn: () => PromiseLike<AuraResponse<T>>): Promise<AuraResponse<T>> {
+  let res = await fn()
+  for (let i = 0; i < 10 && res.error && TRANSIENT_STATUS.has(res.error.status); i++) {
+    await new Promise((r) => setTimeout(r, 1000))
+    res = await fn()
+  }
+  return res
+}
+
+async function retryFetch(fn: () => Promise<Response>): Promise<Response> {
+  let res = await fn()
+  for (let i = 0; i < 10 && TRANSIENT_STATUS.has(res.status); i++) {
+    await new Promise((r) => setTimeout(r, 1000))
+    res = await fn()
+  }
+  return res
+}
+
+// ── Générateur PNG minimal (repris de storage-transform-e2e.test.ts) ──────────
+const CRC_TABLE: Uint32Array = (() => {
+  const table = new Uint32Array(256)
+  for (let n = 0; n < 256; n++) {
+    let c = n
+    for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1
+    table[n] = c >>> 0
+  }
+  return table
+})()
+function crc32(bytes: Uint8Array): number {
+  let c = 0xffffffff
+  for (let i = 0; i < bytes.length; i++) c = CRC_TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8)
+  return (c ^ 0xffffffff) >>> 0
+}
+function u32be(n: number): Uint8Array {
+  return new Uint8Array([(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff])
+}
+function concatBytes(...parts: Uint8Array[]): Uint8Array {
+  const total = parts.reduce((s, p) => s + p.length, 0)
+  const out = new Uint8Array(total)
+  let off = 0
+  for (const p of parts) {
+    out.set(p, off)
+    off += p.length
+  }
+  return out
+}
+function pngChunk(type: string, data: Uint8Array): Uint8Array {
+  const typeBytes = new Uint8Array(type.split('').map((c) => c.charCodeAt(0)))
+  return concatBytes(u32be(data.length), typeBytes, data, u32be(crc32(concatBytes(typeBytes, data))))
+}
+function makePng(width: number, height: number, seedInit = 0x12345678): Uint8Array {
+  const SIGNATURE = new Uint8Array([137, 80, 78, 71, 13, 10, 26, 10])
+  const ihdr = pngChunk('IHDR', concatBytes(u32be(width), u32be(height), new Uint8Array([8, 2, 0, 0, 0])))
+  const stride = 1 + width * 3
+  const raw = new Uint8Array(stride * height)
+  let seed = seedInit
+  const nextByte = () => {
+    seed = (seed * 1103515245 + 12345) & 0x7fffffff
+    return (seed >>> 16) & 0xff
+  }
+  for (let y = 0; y < height; y++) {
+    const rowStart = y * stride
+    raw[rowStart] = 0
+    for (let x = 0; x < width; x++) {
+      const px = rowStart + 1 + x * 3
+      raw[px] = nextByte()
+      raw[px + 1] = nextByte()
+      raw[px + 2] = nextByte()
+    }
+  }
+  const compressed = deflateSync(raw)
+  const idat = pngChunk('IDAT', new Uint8Array(compressed.buffer, compressed.byteOffset, compressed.byteLength))
+  return concatBytes(SIGNATURE, ihdr, idat, pngChunk('IEND', new Uint8Array(0)))
+}
+function readPngWidth(bytes: Uint8Array): number {
+  return ((bytes[16] << 24) | (bytes[17] << 16) | (bytes[18] << 8) | bytes[19]) >>> 0
+}
+
+/** Lit `{ data: { url } }` OU `{ url }` selon l'enveloppe ApiResponse. */
+function extractUrl(json: unknown): string | undefined {
+  const j = json as { data?: { url?: string }; url?: string }
+  return j?.data?.url ?? j?.url
+}
+
+describe.runIf(RUN)('storage-backend E2E réel (stack live)', () => {
+  const suffix = () => process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
+  const H_SERVICE = { apikey: SERVICE! } as Record<string, string>
+
+  // ── 1. img-transform-default : défaut déterministe activé ───────────────────
+  it(
+    'img_transform_enabled par défaut = activé : ouvrir les settings ne bascule pas transform en Forbidden',
+    async () => {
+      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
+      const bucket = `e2e-imgdef-${suffix()}`
+      let created = false
+      let uploadedKey = 'img.png'
+      try {
+        const createRes = await retryTransient(() =>
+          admin.storage.createBucket(bucket, { public: false, allowedMimeTypes: ['image/png'] }),
+        )
+        if (createRes.error && TRANSIENT_STATUS.has(createRes.error.status)) {
+          console.warn(`[storage-backend-e2e] SKIP img-default (createBucket ${createRes.error.status}).`)
+          return
+        }
+        expect(createRes.error).toBeNull()
+        created = true
+
+        const uploadRes = await admin.storage.upload(bucket, 'img.png', new Blob([makePng(120, 120)], { type: 'image/png' }), {
+          contentType: 'image/png',
+        })
+        expect(uploadRes.error).toBeNull()
+        uploadedKey = uploadRes.data?.key ?? 'img.png'
+
+        // GET /settings crée la ligne (avec le fix : DEFAULT true + INSERT explicite true).
+        const settingsRes = await retryFetch(() =>
+          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/settings`, { headers: H_SERVICE }),
+        )
+        if (!settingsRes.ok) {
+          console.warn(`[storage-backend-e2e] SKIP img-default (GET settings ${settingsRes.status}).`)
+          return
+        }
+        const settingsJson = (await settingsRes.json()) as { data?: Record<string, unknown> }
+        const flag = (settingsJson.data ?? (settingsJson as Record<string, unknown>))['img_transform_enabled']
+        // Cœur du fix : après création de la ligne, le défaut est `true` (déterministe), donc pas
+        // de bascule autorisé→refusé. Sur le projet E2E partagé, un test concurrent peut avoir
+        // mis false explicitement → on n'assène l'assertion stricte que si le flag n'est pas false.
+        if (flag === false) {
+          console.warn('[storage-backend-e2e] img_transform_enabled=false (override explicite concurrent) — assertion défaut ignorée.')
+        } else {
+          expect(flag).toBe(true)
+        }
+
+        // Et une transformation doit réussir (autorisée), après avoir touché les settings.
+        const dl = await retryTransient(() => admin.storage.download(bucket, uploadedKey, { transform: { width: 40 } }))
+        if (dl.error && TRANSIENT_STATUS.has(dl.error.status)) {
+          console.warn(`[storage-backend-e2e] SKIP img-default (download transform ${dl.error.status}).`)
+          return
+        }
+        if (flag !== false) {
+          expect(dl.error).toBeNull()
+          const buf = new Uint8Array(await dl.data!.arrayBuffer())
+          expect(readPngWidth(buf)).toBe(40)
+        }
+      } finally {
+        if (created) {
+          try {
+            await admin.storage.remove(bucket, [uploadedKey])
+          } catch {
+            /* best-effort */
+          }
+          try {
+            await admin.storage.deleteBucket(bucket)
+          } catch {
+            /* best-effort */
+          }
+        }
+      }
+    },
+    120_000,
+  )
+
+  // ── 2. signed-upload-url : PUT signé + garde-fous sécurité ──────────────────
+  it(
+    'upload par URL signée : mint service_role → PUT fonctionnel ; PUT sans sig → 401 ; mint anon → 403 ; mint _derivatives → 403',
+    async () => {
+      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
+      const bucket = `e2e-signup-${suffix()}`
+      const key = `direct-${suffix()}.txt`
+      let created = false
+      try {
+        const createRes = await retryTransient(() =>
+          admin.storage.createBucket(bucket, { public: false, allowedMimeTypes: ['text/plain'] }),
+        )
+        if (createRes.error && TRANSIENT_STATUS.has(createRes.error.status)) {
+          console.warn(`[storage-backend-e2e] SKIP signed-upload (createBucket ${createRes.error.status}).`)
+          return
+        }
+        expect(createRes.error).toBeNull()
+        created = true
+
+        const mintUrl = `${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/upload-url?key=${encodeURIComponent(key)}`
+
+        // (a) Mint avec ANON (non service_role) → 403 (finding #1).
+        const anonMint = await retryFetch(() => fetch(mintUrl, { headers: { apikey: ANON! } }))
+        if (!TRANSIENT_STATUS.has(anonMint.status)) {
+          expect(anonMint.status).toBe(403)
+        }
+
+        // (b) Mint pour une clé sous _derivatives/ (service_role) → 403.
+        const derivMint = await retryFetch(() =>
+          fetch(
+            `${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/upload-url?key=${encodeURIComponent('_derivatives/x/y.txt')}`,
+            { headers: H_SERVICE },
+          ),
+        )
+        if (!TRANSIENT_STATUS.has(derivMint.status)) {
+          expect(derivMint.status).toBe(403)
+        }
+
+        // (c) Mint service_role → URL signée.
+        const mintRes = await retryFetch(() => fetch(mintUrl, { headers: H_SERVICE }))
+        if (TRANSIENT_STATUS.has(mintRes.status)) {
+          console.warn(`[storage-backend-e2e] SKIP signed-upload (mint ${mintRes.status}).`)
+          return
+        }
+        expect(mintRes.ok).toBe(true)
+        const signedUrl = extractUrl(await mintRes.json())
+        expect(signedUrl).toBeTruthy()
+
+        // (d) PUT du corps vers l'URL signée (SANS apikey) → 200. Valide l'assomption gateway.
+        const payload = `bonjour-${suffix()}`
+        const putRes = await retryFetch(() =>
+          fetch(signedUrl!, { method: 'PUT', headers: { 'content-type': 'text/plain' }, body: payload }),
+        )
+        if (TRANSIENT_STATUS.has(putRes.status)) {
+          console.warn(`[storage-backend-e2e] SKIP signed-upload (PUT ${putRes.status}).`)
+          return
+        }
+        expect(
+          putRes.ok,
+          `PUT vers l'URL signée a échoué (${putRes.status}) — si 401/403 sans transitoire, la gateway ` +
+            `data-plane bloque le PUT signé non-authentifié (assomption gateway à corriger côté aura-gateway).`,
+        ).toBe(true)
+
+        // (e) Contenu relu identique.
+        const dl = await retryTransient(() => admin.storage.download(bucket, key))
+        if (!(dl.error && TRANSIENT_STATUS.has(dl.error.status))) {
+          expect(dl.error).toBeNull()
+          expect(await dl.data!.text()).toBe(payload)
+        }
+
+        // (f) PUT sur le chemin objet SANS ?sig= → 401.
+        const noSig = await retryFetch(() =>
+          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/${encodeURIComponent(key)}`, {
+            method: 'PUT',
+            headers: { 'content-type': 'text/plain', apikey: SERVICE! },
+            body: 'x',
+          }),
+        )
+        if (!TRANSIENT_STATUS.has(noSig.status)) {
+          expect(noSig.status).toBe(401)
+        }
+      } finally {
+        if (created) {
+          try {
+            await admin.storage.remove(bucket, [key])
+          } catch {
+            /* best-effort */
+          }
+          try {
+            await admin.storage.deleteBucket(bucket)
+          } catch {
+            /* best-effort */
+          }
+        }
+      }
+    },
+    120_000,
+  )
+
+  // ── 3. cache-hardening : ETag stable + overwrite + rejet _derivatives ───────
+  it(
+    'cache dérivés : MISS→HIT même ETag ; overwrite source → nouveau rendu ; upload ?folder=_derivatives → 400',
+    async () => {
+      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
+      const bucket = `e2e-cache-${suffix()}`
+      let created = false
+      let uploadedKey = 'img.png'
+      try {
+        const createRes = await retryTransient(() =>
+          admin.storage.createBucket(bucket, { public: false, allowedMimeTypes: ['image/png'] }),
+        )
+        if (createRes.error && TRANSIENT_STATUS.has(createRes.error.status)) {
+          console.warn(`[storage-backend-e2e] SKIP cache (createBucket ${createRes.error.status}).`)
+          return
+        }
+        expect(createRes.error).toBeNull()
+        created = true
+
+        const up = await admin.storage.upload(bucket, 'img.png', new Blob([makePng(150, 150, 0x1111)], { type: 'image/png' }), {
+          contentType: 'image/png',
+          upsert: true,
+        })
+        expect(up.error).toBeNull()
+        uploadedKey = up.data?.key ?? 'img.png'
+
+        const signedRes = await retryTransient(() => admin.storage.createSignedUrl(bucket, uploadedKey, 600, { transform: { width: 45 } }))
+        if (signedRes.error && TRANSIENT_STATUS.has(signedRes.error.status)) {
+          console.warn(`[storage-backend-e2e] SKIP cache (signedUrl ${signedRes.error.status}).`)
+          return
+        }
+        expect(signedRes.error).toBeNull()
+        const derivUrl = signedRes.data!.url
+
+        const f1 = await retryFetch(() => fetch(derivUrl))
+        if (TRANSIENT_STATUS.has(f1.status)) {
+          console.warn(`[storage-backend-e2e] SKIP cache (fetch1 ${f1.status}).`)
+          return
+        }
+        expect(f1.ok).toBe(true)
+        const etag1 = f1.headers.get('etag')
+        const cache1 = f1.headers.get('x-aura-cache')
+        await f1.arrayBuffer()
+
+        if (cache1 === 'MISS' && etag1) {
+          const f2 = await retryFetch(() => fetch(derivUrl))
+          if (!TRANSIENT_STATUS.has(f2.status)) {
+            expect(f2.headers.get('x-aura-cache')).toBe('HIT')
+            // ETag stable entre MISS et HIT (sous-finding c).
+            expect(f2.headers.get('etag')).toBe(etag1)
+            await f2.arrayBuffer()
+          }
+        } else {
+          console.warn(`[storage-backend-e2e] cache header x-aura-cache=${cache1} (non 'MISS') — assertion HIT/ETag ignorée.`)
+        }
+
+        // Sous-finding (d) : le préfixe réservé _derivatives/ n'est écrivable que via un handler
+        // qui exploite `?folder=`. upload_file (POST .../{bucket}) IGNORE `?folder=` (sa clé = le
+        // nom de fichier, l'objet n'atterrit jamais sous _derivatives/) — le VRAI vecteur est
+        // init_multipart, qui construit la clé `{folder}/{uuid}`. On teste donc celui-là.
+        const folderRes = await retryFetch(() =>
+          fetch(
+            `${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/multipart/init?filename=x.png&folder=${encodeURIComponent('_derivatives')}`,
+            { method: 'POST', headers: H_SERVICE },
+          ),
+        )
+        if (!TRANSIENT_STATUS.has(folderRes.status)) {
+          expect(
+            folderRes.status,
+            `init_multipart ?folder=_derivatives devrait être rejeté (400), reçu ${folderRes.status}`,
+          ).toBe(400)
+        }
+      } finally {
+        if (created) {
+          try {
+            await admin.storage.remove(bucket, [uploadedKey])
+          } catch {
+            /* best-effort */
+          }
+          try {
+            await admin.storage.deleteBucket(bucket)
+          } catch {
+            /* best-effort */
+          }
+        }
+      }
+    },
+    120_000,
+  )
+
+  // ── 4. cross-bucket copy/move ───────────────────────────────────────────────
+  it(
+    'copy/move vers un bucket destination distinct ; dst_bucket inconnu → 404',
+    async () => {
+      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
+      const s = suffix()
+      const bucketA = `e2e-xb-a-${s}`
+      const bucketB = `e2e-xb-b-${s}`
+      let createdA = false
+      let createdB = false
+      let keyX = 'x.txt'
+      let keyY = 'y.txt'
+      try {
+        for (const [b, set] of [[bucketA, (v: boolean) => (createdA = v)], [bucketB, (v: boolean) => (createdB = v)]] as const) {
+          const r = await retryTransient(() => admin.storage.createBucket(b, { public: false, allowedMimeTypes: ['text/plain'] }))
+          if (r.error && TRANSIENT_STATUS.has(r.error.status)) {
+            console.warn(`[storage-backend-e2e] SKIP cross-bucket (createBucket ${b} ${r.error.status}).`)
+            return
+          }
+          expect(r.error).toBeNull()
+          set(true)
+        }
+
+        const upX = await admin.storage.upload(bucketA, 'x.txt', new Blob(['contenu-x'], { type: 'text/plain' }), { contentType: 'text/plain' })
+        expect(upX.error).toBeNull()
+        keyX = upX.data?.key ?? 'x.txt'
+        const upY = await admin.storage.upload(bucketA, 'y.txt', new Blob(['contenu-y'], { type: 'text/plain' }), { contentType: 'text/plain' })
+        expect(upY.error).toBeNull()
+        keyY = upY.data?.key ?? 'y.txt'
+
+        // COPY a→b : objet créé dans b, source intacte.
+        const copyRes = await retryFetch(() =>
+          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucketA}/copy`, {
+            method: 'POST',
+            headers: { ...H_SERVICE, 'content-type': 'application/json' },
+            body: JSON.stringify({ src_key: keyX, dst_key: 'copied.txt', dst_bucket: bucketB }),
+          }),
+        )
+        if (TRANSIENT_STATUS.has(copyRes.status)) {
+          console.warn(`[storage-backend-e2e] SKIP cross-bucket (copy ${copyRes.status}).`)
+          return
+        }
+        expect(copyRes.ok, `copy a→b devrait réussir, reçu ${copyRes.status}`).toBe(true)
+        const dlCopied = await retryTransient(() => admin.storage.download(bucketB, 'copied.txt'))
+        if (!(dlCopied.error && TRANSIENT_STATUS.has(dlCopied.error.status))) {
+          expect(dlCopied.error).toBeNull()
+          expect(await dlCopied.data!.text()).toBe('contenu-x')
+        }
+        const dlSrc = await retryTransient(() => admin.storage.download(bucketA, keyX))
+        if (!(dlSrc.error && TRANSIENT_STATUS.has(dlSrc.error.status))) {
+          expect(dlSrc.error, 'la source doit rester intacte après copy').toBeNull()
+        }
+
+        // MOVE a→b : objet dans b, absent de a.
+        const moveRes = await retryFetch(() =>
+          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucketA}/move`, {
+            method: 'POST',
+            headers: { ...H_SERVICE, 'content-type': 'application/json' },
+            body: JSON.stringify({ src_key: keyY, dst_key: 'moved.txt', dst_bucket: bucketB }),
+          }),
+        )
+        if (!TRANSIENT_STATUS.has(moveRes.status)) {
+          expect(moveRes.ok, `move a→b devrait réussir, reçu ${moveRes.status}`).toBe(true)
+          const dlMoved = await retryTransient(() => admin.storage.download(bucketB, 'moved.txt'))
+          if (!(dlMoved.error && TRANSIENT_STATUS.has(dlMoved.error.status))) {
+            expect(dlMoved.error).toBeNull()
+            expect(await dlMoved.data!.text()).toBe('contenu-y')
+          }
+        }
+
+        // dst_bucket inexistant → 404.
+        const badRes = await retryFetch(() =>
+          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucketA}/copy`, {
+            method: 'POST',
+            headers: { ...H_SERVICE, 'content-type': 'application/json' },
+            body: JSON.stringify({ src_key: keyX, dst_key: 'z.txt', dst_bucket: `nope-${s}` }),
+          }),
+        )
+        if (!TRANSIENT_STATUS.has(badRes.status)) {
+          expect(badRes.status, 'copy vers un bucket inconnu doit renvoyer 404').toBe(404)
+        }
+      } finally {
+        for (const [b, wasCreated] of [[bucketA, createdA], [bucketB, createdB]] as const) {
+          if (wasCreated) {
+            try {
+              await admin.storage.deleteBucket(b)
+            } catch {
+              /* best-effort */
+            }
+          }
+        }
+      }
+    },
+    120_000,
+  )
+})

package/packages/aurabase/tests/storage-sdk-parity-e2e.test.ts

@@ -0,0 +1,104 @@
+// ---------------------------------------------------------------------------
+// E2E réel (stack live) — Lot sdk-storage-gen / `storage-sdk-parity-quickwins`.
+// Réf. : docs/superpowers/specs/2026-07-13-storage-sdk-parity-quickwins-design.md
+//
+// Vérifie updateBucket (PATCH partiel), option upload `metadata` (relue via
+// getMetadata), createSignedUrls (batch fan-out). Gaté RUN_E2E, skip gracieux.
+//
+// NB clé : `upload_file` assigne une clé UUID et la RENVOIE (il n'utilise le
+// chemin client que pour l'extension). Les lectures (getMetadata/createSignedUrl)
+// DOIVENT donc utiliser `up.data.key`, jamais le chemin logique d'origine.
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect } from 'vitest'
+import { createAdminClient } from '../src/index'
+import type { AuraResponse } from '../src/index'
+
+const URL = process.env.AURA_E2E_URL
+const PROJECT = process.env.AURA_E2E_PROJECT
+const SERVICE = process.env.AURA_E2E_SERVICE_KEY
+const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && SERVICE)
+const TRANSIENT = new Set([408, 429, 502, 503, 504])
+
+async function retry<T>(fn: () => Promise<AuraResponse<T>>): Promise<AuraResponse<T>> {
+  let r = await fn()
+  for (let i = 0; i < 8 && r.error && TRANSIENT.has(r.error.status); i++) {
+    await new Promise((res) => setTimeout(res, 1000))
+    r = await fn()
+  }
+  return r
+}
+
+describe.runIf(RUN)('storage SDK parity E2E réel (updateBucket / metadata / createSignedUrls)', () => {
+  it(
+    'updateBucket rend public ; upload metadata est relu ; createSignedUrls renvoie N URLs',
+    async () => {
+      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
+      const suffix = process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
+      const bucket = `sbp${suffix}`
+      const tag = `v-${suffix}`
+      let created = false
+      const keys: string[] = []
+
+      try {
+        const cb = await retry(() => admin.storage.createBucket(bucket, { public: false }))
+        if (cb.error && TRANSIENT.has(cb.error.status)) {
+          console.warn(`[storage-sdk-parity-e2e] SKIP (createBucket ${cb.error.status}).`)
+          return
+        }
+        expect(cb.error, `createBucket: ${JSON.stringify(cb.error)}`).toBeNull()
+        created = true
+
+        // --- updateBucket (PATCH partiel) : privé → public -------------------
+        const ub = await retry(() =>
+          admin.storage.updateBucket(bucket, { public: true, fileSizeLimit: 5_000_000 }),
+        )
+        expect(ub.error, `updateBucket: ${JSON.stringify(ub.error)}`).toBeNull()
+        const gb = await retry(() => admin.storage.getBucket(bucket))
+        expect(gb.error).toBeNull()
+        expect((gb.data as { public?: boolean } | null)?.public, 'bucket doit être public après updateBucket').toBe(true)
+
+        // --- upload avec metadata → relue via getMetadata (clé RETOURNÉE) ----
+        const up = await retry(() =>
+          admin.storage.upload(bucket, 'f.txt', new Blob(['hello']), {
+            contentType: 'text/plain',
+            metadata: { tag },
+          }),
+        )
+        expect(up.error, `upload metadata: ${JSON.stringify(up.error)}`).toBeNull()
+        const keyF = (up.data as { key?: string } | null)?.key
+        expect(keyF, 'upload doit retourner la clé stockée').toBeTruthy()
+        keys.push(keyF!)
+
+        const gm = await retry(() => admin.storage.getMetadata(bucket, keyF!))
+        expect(gm.error, `getMetadata(${keyF}): ${JSON.stringify(gm.error)}`).toBeNull()
+        expect(JSON.stringify(gm.data ?? {}), 'la metadata custom (tag) doit être relue').toContain(tag)
+
+        // --- createSignedUrls (batch) sur les clés réelles ------------------
+        const up2 = await retry(() =>
+          admin.storage.upload(bucket, 'g.txt', new Blob(['g']), { contentType: 'text/plain' }),
+        )
+        expect(up2.error).toBeNull()
+        const keyG = (up2.data as { key?: string } | null)?.key
+        expect(keyG).toBeTruthy()
+        keys.push(keyG!)
+
+        const su = await retry(() => admin.storage.createSignedUrls(bucket, [keyF!, keyG!], 300))
+        expect(su.error, `createSignedUrls: ${JSON.stringify(su.error)}`).toBeNull()
+        const rows = su.data ?? []
+        expect(rows.length, 'createSignedUrls doit renvoyer 2 entrées').toBe(2)
+        expect(rows.every((r) => 'url' in r && typeof r.url === 'string' && r.url.length > 0), 'chaque entrée doit porter une URL').toBe(true)
+      } finally {
+        if (created) {
+          try {
+            if (keys.length) await admin.storage.remove(bucket, keys)
+            await admin.storage.deleteBucket(bucket)
+          } catch {
+            /* best-effort */
+          }
+        }
+      }
+    },
+    90_000,
+  )
+})