@aws-amplify/storage 6.6.0 → 6.6.1-storage-browser.37d5283.0

package/src/providers/s3/utils/client/utils/retryDecider.ts

@@ -0,0 +1,81 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import {
+	HttpResponse,
+	MiddlewareContext,
+	RetryDeciderOutput,
+	getRetryDecider,
+} from '@aws-amplify/core/internals/aws-client-utils';
+
+import { LocationCredentialsProvider } from '../../../types/options';
+
+import { parseXmlError } from './parsePayload';
+
+/**
+ * Function to decide if the S3 request should be retried. For S3 APIs, we support forceRefresh option
+ * for {@link LocationCredentialsProvider | LocationCredentialsProvider } option. It's set when S3 returns
+ * credentials expired error. In the retry decider, we detect this response and set flag to signify a retry
+ * attempt. The retry attempt would invoke the LocationCredentialsProvider with forceRefresh option set.
+ *
+ * @param response Optional response of the request.
+ * @param error Optional error thrown from previous attempts.
+ * @param middlewareContext Optional context object to store data between retries.
+ * @returns True if the request should be retried.
+ */
+export const retryDecider = async (
+	response?: HttpResponse,
+	error?: unknown,
+	middlewareContext?: MiddlewareContext,
+): Promise<RetryDeciderOutput> => {
+	const defaultRetryDecider = getRetryDecider(parseXmlError);
+	const defaultRetryDecision = await defaultRetryDecider(response, error);
+	if (!response || response.statusCode < 300) {
+		return { retryable: false };
+	}
+	const parsedError = await parseXmlError(response);
+	const errorCode = parsedError?.name;
+	const errorMessage = parsedError?.message;
+	const isCredentialsExpired = isCredentialsExpiredError(
+		errorCode,
+		errorMessage,
+	);
+
+	return {
+		retryable:
+			defaultRetryDecision.retryable ||
+			// If we know the previous retry attempt sets isCredentialsExpired in the
+			// middleware context, we don't want to retry anymore.
+			!!(isCredentialsExpired && !middlewareContext?.isCredentialsExpired),
+		isCredentialsExpiredError: isCredentialsExpired,
+	};
+};
+
+// Ref: https://github.com/aws/aws-sdk-js/blob/54829e341181b41573c419bd870dd0e0f8f10632/lib/event_listeners.js#L522-L541
+const INVALID_TOKEN_ERROR_CODES = [
+	'RequestExpired',
+	'ExpiredTokenException',
+	'ExpiredToken',
+];
+
+/**
+ * Given an error code, returns true if it is related to invalid credentials.
+ *
+ * @param errorCode String representation of some error.
+ * @returns True if given error indicates the credentials used to authorize request
+ * are invalid.
+ */
+const isCredentialsExpiredError = (
+	errorCode?: string,
+	errorMessage?: string,
+) => {
+	const isExpiredTokenError =
+		!!errorCode && INVALID_TOKEN_ERROR_CODES.includes(errorCode);
+	// Ref: https://github.com/aws/aws-sdk-js/blob/54829e341181b41573c419bd870dd0e0f8f10632/lib/event_listeners.js#L536-L539
+	const isExpiredSignatureError =
+		!!errorCode &&
+		!!errorMessage &&
+		errorCode.includes('Signature') &&
+		errorMessage.includes('expired');
+
+	return isExpiredTokenError || isExpiredSignatureError;
+};

package/src/providers/s3/utils/crc32.native.ts

@@ -0,0 +1,11 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { CRC32Checksum } from './crc32';
+
+export const calculateContentCRC32 = async (
+	content: Blob | string | ArrayBuffer | ArrayBufferView,
+	_seed = 0,
+): Promise<CRC32Checksum | undefined> => {
+	return undefined;
+};

package/src/providers/s3/utils/crc32.ts

@@ -0,0 +1,51 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import crc32 from 'crc-32';
+
+export interface CRC32Checksum {
+	checksumArrayBuffer: ArrayBuffer;
+	checksum: string;
+	seed: number;
+}
+
+export const calculateContentCRC32 = async (
+	content: Blob | string | ArrayBuffer | ArrayBufferView,
+	seed = 0,
+): Promise<CRC32Checksum | undefined> => {
+	let internalSeed = seed;
+	let blob: Blob;
+
+	if (content instanceof Blob) {
+		blob = content;
+	} else {
+		blob = new Blob([content]);
+	}
+
+	await blob.stream().pipeTo(
+		new WritableStream<Uint8Array>({
+			write(chunk) {
+				internalSeed = crc32.buf(chunk, internalSeed) >>> 0;
+			},
+		}),
+	);
+	const hex = internalSeed.toString(16).padStart(8, '0');
+
+	return {
+		checksumArrayBuffer: hexToArrayBuffer(hex),
+		checksum: hexToBase64(hex),
+		seed: internalSeed,
+	};
+};
+
+const hexToArrayBuffer = (hexString: string) =>
+	new Uint8Array((hexString.match(/\w{2}/g)! ?? []).map(h => parseInt(h, 16)))
+		.buffer;
+
+const hexToBase64 = (hexString: string) =>
+	btoa(
+		hexString
+			.match(/\w{2}/g)!
+			.map((a: string) => String.fromCharCode(parseInt(a, 16)))
+			.join(''),
+	);

package/src/providers/s3/utils/resolveIdentityId.ts

@@ -0,0 +1,11 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { StorageValidationErrorCode } from '../../../errors/types/validation';
+import { assertValidationError } from '../../../errors/utils/assertValidationError';
+
+export const resolveIdentityId = (identityId?: string): string => {
+	assertValidationError(!!identityId, StorageValidationErrorCode.NoIdentityId);
+
+	return identityId;
+};

package/src/providers/s3/utils/resolveS3ConfigAndInput.ts

@@ -2,11 +2,25 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { AmplifyClassV6, StorageAccessLevel } from '@aws-amplify/core';
+import { CredentialsProviderOptions } from '@aws-amplify/core/internals/aws-client-utils';
 
 import { assertValidationError } from '../../../errors/utils/assertValidationError';
 import { StorageValidationErrorCode } from '../../../errors/types/validation';
 import { resolvePrefix as defaultPrefixResolver } from '../../../utils/resolvePrefix';
-import { ResolvedS3Config } from '../types/options';
+import {
+	StorageOperationInputWithKey,
+	StorageOperationInputWithPath,
+	StorageOperationInputWithPrefix,
+} from '../../../types/inputs';
+import { StorageError } from '../../../errors/StorageError';
+import { CopyInput, CopyWithPathInput } from '../types';
+import { INVALID_STORAGE_INPUT } from '../../../errors/constants';
+import {
+	BucketInfo,
+	LocationCredentialsProvider,
+	ResolvedS3Config,
+	StorageBucket,
+} from '../types/options';
 
 import { DEFAULT_ACCESS_LEVEL, LOCAL_TESTING_S3_ENDPOINT } from './constants';
 
@@ -14,6 +28,8 @@ interface S3ApiOptions {
 	accessLevel?: StorageAccessLevel;
 	targetIdentityId?: string;
 	useAccelerateEndpoint?: boolean;
+	locationCredentialsProvider?: LocationCredentialsProvider;
+	bucket?: StorageBucket;
 }
 
 interface ResolvedS3ConfigAndInput {
@@ -23,6 +39,16 @@ interface ResolvedS3ConfigAndInput {
 	isObjectLockEnabled?: boolean;
 	identityId?: string;
 }
+export type DeprecatedStorageInput =
+	| StorageOperationInputWithKey
+	| StorageOperationInputWithPrefix
+	| CopyInput;
+
+export type CallbackPathStorageInput =
+	| StorageOperationInputWithPath
+	| CopyWithPathInput;
+
+type StorageInput = DeprecatedStorageInput | CallbackPathStorageInput;
 
 /**
  * resolve the common input options for S3 API handlers from Amplify configuration and library options.
@@ -37,23 +63,35 @@ interface ResolvedS3ConfigAndInput {
  */
 export const resolveS3ConfigAndInput = async (
 	amplify: AmplifyClassV6,
-	apiOptions?: S3ApiOptions,
+	apiInput?: StorageInput & { options?: S3ApiOptions },
 ): Promise<ResolvedS3ConfigAndInput> => {
+	const { options: apiOptions } = apiInput ?? {};
 	/**
 	 * IdentityId is always cached in memory so we can safely make calls here. It
 	 * should be stable even for unauthenticated users, regardless of credentials.
 	 */
 	const { identityId } = await amplify.Auth.fetchAuthSession();
-	assertValidationError(!!identityId, StorageValidationErrorCode.NoIdentityId);
 
 	/**
 	 * A credentials provider function instead of a static credentials object is
 	 * used because the long-running tasks like multipart upload may span over the
 	 * credentials expiry. Auth.fetchAuthSession() automatically refreshes the
 	 * credentials if they are expired.
+	 *
+	 * The optional forceRefresh option is set when the S3 service returns expired
+	 * tokens error in the previous API call attempt.
 	 */
-	const credentialsProvider = async () => {
-		const { credentials } = await amplify.Auth.fetchAuthSession();
+	const credentialsProvider = async (options?: CredentialsProviderOptions) => {
+		if (isLocationCredentialsProvider(apiOptions)) {
+			assertStorageInput(apiInput);
+		}
+
+		// TODO: forceRefresh option of fetchAuthSession would refresh both tokens and
+		// AWS credentials. So we do not support forceRefreshing from the Auth until
+		// we support refreshing only the credentials.
+		const { credentials } = isLocationCredentialsProvider(apiOptions)
+			? await apiOptions.locationCredentialsProvider(options)
+			: await amplify.Auth.fetchAuthSession();
 		assertValidationError(
 			!!credentials,
 			StorageValidationErrorCode.NoCredentials,
@@ -62,8 +100,16 @@ export const resolveS3ConfigAndInput = async (
 		return credentials;
 	};
 
-	const { bucket, region, dangerouslyConnectToHttpEndpointForTesting } =
-		amplify.getConfig()?.Storage?.S3 ?? {};
+	const {
+		bucket: defaultBucket,
+		region: defaultRegion,
+		dangerouslyConnectToHttpEndpointForTesting,
+		buckets,
+	} = amplify.getConfig()?.Storage?.S3 ?? {};
+
+	const { bucket = defaultBucket, region = defaultRegion } =
+		(apiOptions?.bucket && resolveBucketConfig(apiOptions, buckets)) || {};
+
 	assertValidationError(!!bucket, StorageValidationErrorCode.NoBucket);
 	assertValidationError(!!region, StorageValidationErrorCode.NoRegion);
 
@@ -73,15 +119,14 @@ export const resolveS3ConfigAndInput = async (
 		isObjectLockEnabled,
 	} = amplify.libraryOptions?.Storage?.S3 ?? {};
 
-	const keyPrefix = await prefixResolver({
-		accessLevel:
-			apiOptions?.accessLevel ?? defaultAccessLevel ?? DEFAULT_ACCESS_LEVEL,
-		// use conditional assign to make tsc happy because StorageOptions is a union type that may not have targetIdentityId
-		targetIdentityId:
-			apiOptions?.accessLevel === 'protected'
-				? (apiOptions?.targetIdentityId ?? identityId)
-				: identityId,
-	});
+	const accessLevel =
+		apiOptions?.accessLevel ?? defaultAccessLevel ?? DEFAULT_ACCESS_LEVEL;
+	const targetIdentityId =
+		accessLevel === 'protected'
+			? (apiOptions?.targetIdentityId ?? identityId)
+			: identityId;
+
+	const keyPrefix = await prefixResolver({ accessLevel, targetIdentityId });
 
 	return {
 		s3Config: {
@@ -101,3 +146,84 @@ export const resolveS3ConfigAndInput = async (
 		isObjectLockEnabled,
 	};
 };
+
+const isLocationCredentialsProvider = (
+	options?: S3ApiOptions,
+): options is S3ApiOptions & {
+	locationCredentialsProvider: LocationCredentialsProvider;
+} => {
+	return !!options?.locationCredentialsProvider;
+};
+
+const isInputWithCallbackPath = (input?: CallbackPathStorageInput) => {
+	return (
+		((input as StorageOperationInputWithPath)?.path &&
+			typeof (input as StorageOperationInputWithPath).path === 'function') ||
+		((input as CopyWithPathInput)?.destination?.path &&
+			typeof (input as CopyWithPathInput).destination?.path === 'function') ||
+		((input as CopyWithPathInput)?.source?.path &&
+			typeof (input as CopyWithPathInput).source?.path === 'function')
+	);
+};
+
+const isDeprecatedInput = (
+	input?: StorageInput,
+): input is DeprecatedStorageInput => {
+	return (
+		isInputWithKey(input) ||
+		isInputWithPrefix(input) ||
+		isInputWithCopySourceOrDestination(input)
+	);
+};
+const assertStorageInput = (input?: StorageInput) => {
+	if (isDeprecatedInput(input) || isInputWithCallbackPath(input)) {
+		throw new StorageError({
+			name: INVALID_STORAGE_INPUT,
+			message: 'The input needs to have a path as a string value.',
+			recoverySuggestion:
+				'Please provide a valid path as a string value for the input.',
+		});
+	}
+};
+
+const isInputWithKey = (
+	input?: StorageInput,
+): input is StorageOperationInputWithKey => {
+	return !!(typeof (input as StorageOperationInputWithKey).key === 'string');
+};
+const isInputWithPrefix = (
+	input?: StorageInput,
+): input is StorageOperationInputWithPrefix => {
+	return !!(
+		typeof (input as StorageOperationInputWithPrefix).prefix === 'string'
+	);
+};
+const isInputWithCopySourceOrDestination = (
+	input?: StorageInput,
+): input is CopyInput => {
+	return !!(
+		typeof (input as CopyInput).source?.key === 'string' ||
+		typeof (input as CopyInput).destination?.key === 'string'
+	);
+};
+const resolveBucketConfig = (
+	apiOptions: S3ApiOptions,
+	buckets: Record<string, BucketInfo> | undefined,
+): { bucket: string; region: string } | undefined => {
+	if (typeof apiOptions.bucket === 'string') {
+		const bucketConfig = buckets?.[apiOptions.bucket];
+		assertValidationError(
+			!!bucketConfig,
+			StorageValidationErrorCode.InvalidStorageBucket,
+		);
+
+		return { bucket: bucketConfig.bucketName, region: bucketConfig.region };
+	}
+
+	if (typeof apiOptions.bucket === 'object') {
+		return {
+			bucket: apiOptions.bucket.bucketName,
+			region: apiOptions.bucket.region,
+		};
+	}
+};

package/src/providers/s3/utils/validateStorageOperationInput.ts

@@ -7,6 +7,7 @@ import { StorageValidationErrorCode } from '../../../errors/types/validation';
 
 import { isInputWithPath } from './isInputWithPath';
 import { STORAGE_INPUT_KEY, STORAGE_INPUT_PATH } from './constants';
+import { resolveIdentityId } from './resolveIdentityId';
 
 export const validateStorageOperationInput = (
 	input: Input,
@@ -22,7 +23,10 @@ export const validateStorageOperationInput = (
 
 	if (isInputWithPath(input)) {
 		const { path } = input;
-		const objectKey = typeof path === 'string' ? path : path({ identityId });
+		const objectKey =
+			typeof path === 'string'
+				? path
+				: path({ identityId: resolveIdentityId(identityId) });
 
 		assertValidationError(
 			!objectKey.startsWith('/'),

package/src/providers/s3/utils/validateStorageOperationInputWithPrefix.ts

@@ -9,6 +9,7 @@ import { assertValidationError } from '../../../errors/utils/assertValidationErr
 import { StorageValidationErrorCode } from '../../../errors/types/validation';
 
 import { STORAGE_INPUT_PATH, STORAGE_INPUT_PREFIX } from './constants';
+import { resolveIdentityId } from './resolveIdentityId';
 
 // Local assertion function with StorageOperationInputWithPrefixPath as Input
 const _isInputWithPath = (
@@ -28,7 +29,10 @@ export const validateStorageOperationInputWithPrefix = (
 	);
 	if (_isInputWithPath(input)) {
 		const { path } = input;
-		const objectKey = typeof path === 'string' ? path : path({ identityId });
+		const objectKey =
+			typeof path === 'string'
+				? path
+				: path({ identityId: resolveIdentityId(identityId) });
 
 		// Assert on no leading slash in the path parameter
 		assertValidationError(

package/src/storageBrowser/apis/constants.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const DEFAULT_CRED_TTL = 15 * 60; // 15 minutes
+export const MAX_PAGE_SIZE = 1000;

package/src/storageBrowser/apis/getDataAccess.ts

@@ -0,0 +1,79 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	AmplifyErrorCode,
+	StorageAction,
+} from '@aws-amplify/core/internals/utils';
+import { CredentialsProviderOptions } from '@aws-amplify/core/internals/aws-client-utils';
+
+import { getStorageUserAgentValue } from '../../providers/s3/utils/userAgent';
+import { getDataAccess as getDataAccessClient } from '../../providers/s3/utils/client/s3control';
+import { StorageError } from '../../errors/StorageError';
+import { logger } from '../../utils';
+
+import { GetDataAccessInput, GetDataAccessOutput } from './types';
+import { DEFAULT_CRED_TTL } from './constants';
+
+export const getDataAccess = async (
+	input: GetDataAccessInput,
+): Promise<GetDataAccessOutput> => {
+	const targetType = input.scope.endsWith('*') ? undefined : 'Object';
+	const clientCredentialsProvider = async (
+		options?: CredentialsProviderOptions,
+	) => {
+		const { credentials } = await input.credentialsProvider(options);
+
+		return credentials;
+	};
+
+	const result = await getDataAccessClient(
+		{
+			credentials: clientCredentialsProvider,
+			region: input.region,
+			userAgentValue: getStorageUserAgentValue(StorageAction.GetDataAccess),
+		},
+		{
+			AccountId: input.accountId,
+			Target: input.scope,
+			Permission: input.permission,
+			TargetType: targetType,
+			DurationSeconds: DEFAULT_CRED_TTL,
+		},
+	);
+
+	const grantCredentials = result.Credentials;
+
+	// Ensure that S3 returned credentials (this shouldn't happen)
+	if (
+		!grantCredentials ||
+		!grantCredentials.AccessKeyId ||
+		!grantCredentials.SecretAccessKey ||
+		!grantCredentials.SessionToken ||
+		!grantCredentials.Expiration
+	) {
+		throw new StorageError({
+			name: AmplifyErrorCode.Unknown,
+			message: 'Service did not return valid temporary credentials.',
+		});
+	} else {
+		logger.debug(`Retrieved credentials for: ${result.MatchedGrantTarget}`);
+	}
+
+	const {
+		AccessKeyId: accessKeyId,
+		SecretAccessKey: secretAccessKey,
+		SessionToken: sessionToken,
+		Expiration: expiration,
+	} = grantCredentials;
+
+	return {
+		credentials: {
+			accessKeyId,
+			secretAccessKey,
+			sessionToken,
+			expiration,
+		},
+		scope: result.MatchedGrantTarget,
+	};
+};

package/src/storageBrowser/apis/listCallerAccessGrants.ts

@@ -0,0 +1,107 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { StorageAction } from '@aws-amplify/core/internals/utils';
+import { CredentialsProviderOptions } from '@aws-amplify/core/internals/aws-client-utils';
+
+import { logger } from '../../utils';
+import { listCallerAccessGrants as listCallerAccessGrantsClient } from '../../providers/s3/utils/client/s3control';
+import { LocationAccess, LocationType, Permission } from '../types';
+import { StorageError } from '../../errors/StorageError';
+import { getStorageUserAgentValue } from '../../providers/s3/utils/userAgent';
+
+import {
+	ListCallerAccessGrantsInput,
+	ListCallerAccessGrantsOutput,
+} from './types';
+import { MAX_PAGE_SIZE } from './constants';
+
+export const listCallerAccessGrants = async (
+	input: ListCallerAccessGrantsInput,
+): Promise<ListCallerAccessGrantsOutput> => {
+	const { credentialsProvider, accountId, region, nextToken, pageSize } = input;
+
+	logger.debug(`listing available locations from account ${input.accountId}`);
+
+	if (!!pageSize && pageSize > MAX_PAGE_SIZE) {
+		logger.debug(`defaulting pageSize to ${MAX_PAGE_SIZE}.`);
+	}
+
+	const clientCredentialsProvider = async (
+		options?: CredentialsProviderOptions,
+	) => {
+		const { credentials } = await credentialsProvider(options);
+
+		return credentials;
+	};
+
+	const { CallerAccessGrantsList, NextToken } =
+		await listCallerAccessGrantsClient(
+			{
+				credentials: clientCredentialsProvider,
+				region,
+				userAgentValue: getStorageUserAgentValue(
+					StorageAction.ListCallerAccessGrants,
+				),
+			},
+			{
+				AccountId: accountId,
+				NextToken: nextToken,
+				MaxResults: pageSize ?? MAX_PAGE_SIZE,
+			},
+		);
+
+	const accessGrants: LocationAccess[] =
+		CallerAccessGrantsList?.map(grant => {
+			// These values are correct from service mostly, but we add assertions to make TSC happy.
+			assertPermission(grant.Permission);
+			assertGrantScope(grant.GrantScope);
+
+			return {
+				scope: grant.GrantScope,
+				permission: grant.Permission,
+				type: parseGrantType(grant.GrantScope!),
+			};
+		}) ?? [];
+
+	return {
+		locations: accessGrants,
+		nextToken: NextToken,
+	};
+};
+
+const parseGrantType = (grantScope: string): LocationType => {
+	const bucketScopeReg = /^s3:\/\/(.*)\/\*$/;
+	const possibleBucketName = grantScope.match(bucketScopeReg)?.[1];
+	if (!grantScope.endsWith('*')) {
+		return 'OBJECT';
+	} else if (
+		grantScope.endsWith('/*') &&
+		possibleBucketName &&
+		possibleBucketName.indexOf('/') === -1
+	) {
+		return 'BUCKET';
+	} else {
+		return 'PREFIX';
+	}
+};
+
+function assertPermission(
+	permissionValue: string | undefined,
+): asserts permissionValue is Permission {
+	if (!['READ', 'READWRITE', 'WRITE'].includes(permissionValue ?? '')) {
+		throw new StorageError({
+			name: 'InvalidPermission',
+			message: `Invalid permission: ${permissionValue}`,
+		});
+	}
+}
+
+function assertGrantScope(value: unknown): asserts value is string {
+	if (typeof value !== 'string' || !value.startsWith('s3://')) {
+		throw new StorageError({
+			name: 'InvalidGrantScope',
+			message: `Expected a valid grant scope, got ${value}`,
+		});
+	}
+}

package/src/storageBrowser/apis/types.ts

@@ -0,0 +1,33 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	CredentialsProvider,
+	ListLocationsInput,
+	ListLocationsOutput,
+	LocationCredentials,
+	Permission,
+	PrefixType,
+	Privilege,
+} from '../types';
+
+export interface ListCallerAccessGrantsInput extends ListLocationsInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	region: string;
+}
+
+export type ListCallerAccessGrantsOutput = ListLocationsOutput;
+
+export interface GetDataAccessInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	durationSeconds?: number;
+	permission: Permission;
+	prefixType?: PrefixType;
+	privilege?: Privilege;
+	region: string;
+	scope: string;
+}
+
+export type GetDataAccessOutput = LocationCredentials;

package/src/storageBrowser/index.ts

@@ -0,0 +1,25 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { LocationCredentialsProvider } from '../providers/s3/types/options';
+export { StorageSubpathStrategy } from '../types/options';
+
+export { createLocationCredentialsStore } from './locationCredentialsStore';
+export {
+	AuthConfigAdapter,
+	createManagedAuthConfigAdapter,
+	CreateManagedAuthConfigAdapterInput,
+} from './managedAuthConfigAdapter';
+export {
+	GetLocationCredentials,
+	ListLocations,
+	LocationCredentialsStore,
+	CreateLocationCredentialsStoreInput,
+	LocationCredentials,
+	ListLocationsInput,
+	ListLocationsOutput,
+	GetLocationCredentialsInput,
+	GetLocationCredentialsOutput,
+	Permission,
+} from './types';
+export { AWSTemporaryCredentials } from '../providers/s3/types/options';

package/src/storageBrowser/locationCredentialsStore/constants.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const CREDENTIALS_STORE_DEFAULT_SIZE = 10;
+export const CREDENTIALS_REFRESH_WINDOW_MS = 30_000;