@aws-amplify/storage 6.6.10 → 6.6.11-storage-browser-integrity.2a9053f.0

package/src/internals/apis/remove.ts

@@ -0,0 +1,24 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { Amplify } from '@aws-amplify/core';
+
+import { remove as removeInternal } from '../../providers/s3/apis/internal/remove';
+import { RemoveInput } from '../types/inputs';
+import { RemoveOutput } from '../types/outputs';
+
+/**
+ * @internal
+ */
+export const remove = (input: RemoveInput): Promise<RemoveOutput> =>
+	removeInternal(Amplify, {
+		path: input.path,
+		options: {
+			useAccelerateEndpoint: input?.options?.useAccelerateEndpoint,
+			bucket: input?.options?.bucket,
+			expectedBucketOwner: input?.options?.expectedBucketOwner,
+			locationCredentialsProvider: input?.options?.locationCredentialsProvider,
+		},
+		// Type casting is necessary because `removeInternal` supports both Gen1 and Gen2 signatures, but here
+		// given in input can only be Gen2 signature, the return can only ben Gen2 signature.
+	}) as Promise<RemoveOutput>;

package/src/internals/apis/uploadData.ts

@@ -0,0 +1,34 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { UploadDataInput } from '../types/inputs';
+import { UploadDataOutput } from '../types/outputs';
+import { uploadData as uploadDataInternal } from '../../providers/s3/apis/internal/uploadData';
+
+/**
+ * @internal
+ */
+export const uploadData = (input: UploadDataInput) => {
+	const { data, path, options } = input;
+
+	return uploadDataInternal({
+		path,
+		data,
+		options: {
+			useAccelerateEndpoint: options?.useAccelerateEndpoint,
+			bucket: options?.bucket,
+			onProgress: options?.onProgress,
+			contentDisposition: options?.contentDisposition,
+			contentEncoding: options?.contentEncoding,
+			contentType: options?.contentType,
+			metadata: options?.metadata,
+			preventOverwrite: options?.preventOverwrite,
+			expectedBucketOwner: options?.expectedBucketOwner,
+
+			// Advanced options
+			locationCredentialsProvider: options?.locationCredentialsProvider,
+		},
+		// Type casting is necessary because `uploadDataInternal` supports both Gen1 and Gen2 signatures, but here
+		// given in input can only be Gen2 signature, the return can only ben Gen2 signature.
+	}) as UploadDataOutput;
+};

package/src/internals/index.ts

@@ -0,0 +1,67 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { LocationCredentialsProvider } from '../providers/s3/types/options';
+export { StorageSubpathStrategy } from '../types/options';
+
+export { Permission } from './types/common';
+
+/*
+Internal APIs
+*/
+export {
+	GetDataAccessInput,
+	ListCallerAccessGrantsInput,
+	GetPropertiesInput,
+	GetUrlInput,
+	CopyInput,
+	ListInput,
+	ListAllInput,
+	ListPaginateInput,
+	RemoveInput,
+	UploadDataInput,
+	DownloadDataInput,
+} from './types/inputs';
+export {
+	GetDataAccessOutput,
+	ListCallerAccessGrantsOutput,
+	GetPropertiesOutput,
+	GetUrlOutput,
+	RemoveOutput,
+	UploadDataOutput,
+	DownloadDataOutput,
+	ListOutput,
+	CopyOutput,
+} from './types/outputs';
+
+export { getDataAccess } from './apis/getDataAccess';
+export { listCallerAccessGrants } from './apis/listCallerAccessGrants';
+export { list } from './apis/list';
+export { getProperties } from './apis/getProperties';
+export { getUrl } from './apis/getUrl';
+export { remove } from './apis/remove';
+export { uploadData } from './apis/uploadData';
+export { downloadData } from './apis/downloadData';
+export { copy } from './apis/copy';
+
+/*
+CredentialsStore exports
+*/
+export { createLocationCredentialsStore } from './locationCredentialsStore';
+export {
+	AuthConfigAdapter,
+	createManagedAuthConfigAdapter,
+	CreateManagedAuthConfigAdapterInput,
+} from './managedAuthConfigAdapter';
+export {
+	GetLocationCredentials,
+	ListLocations,
+	LocationCredentialsStore,
+	CreateLocationCredentialsStoreInput,
+	LocationCredentials,
+	ListLocationsInput,
+	ListLocationsOutput,
+	GetLocationCredentialsInput,
+	GetLocationCredentialsOutput,
+} from './types/credentials';
+export { AWSTemporaryCredentials } from '../providers/s3/types/options';

package/src/internals/locationCredentialsStore/constants.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const CREDENTIALS_STORE_DEFAULT_SIZE = 10;
+export const CREDENTIALS_REFRESH_WINDOW_MS = 30_000;

package/src/internals/locationCredentialsStore/create.ts

@@ -0,0 +1,54 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	CreateLocationCredentialsStoreInput,
+	CredentialsLocation,
+	LocationCredentialsStore,
+} from '../types/credentials';
+import { StorageValidationErrorCode } from '../../errors/types/validation';
+import { assertValidationError } from '../../errors/utils/assertValidationError';
+import { LocationCredentialsProvider } from '../../providers/s3/types/options';
+
+import { createStore, getValue, removeStore } from './registry';
+
+export const createLocationCredentialsStore = (
+	input: CreateLocationCredentialsStoreInput,
+): LocationCredentialsStore => {
+	const storeSymbol = createStore(input.handler);
+
+	const store = {
+		getProvider(providerLocation: CredentialsLocation) {
+			const locationCredentialsProvider = async ({
+				forceRefresh = false,
+			}: Parameters<LocationCredentialsProvider>[0] = {}) => {
+				validateS3Uri(providerLocation.scope);
+
+				// TODO(@AllanZhengYP): validate the action bucket and paths matches provider scope.
+				return getValue({
+					storeSymbol,
+					location: { ...providerLocation },
+					forceRefresh,
+				});
+			};
+
+			return locationCredentialsProvider;
+		},
+
+		destroy() {
+			removeStore(storeSymbol);
+		},
+	};
+
+	return store;
+};
+
+type S3Uri = string;
+
+const validateS3Uri = (uri: S3Uri): void => {
+	const s3UrlSchemaRegex = /^s3:\/\/[^/]+/;
+	assertValidationError(
+		s3UrlSchemaRegex.test(uri),
+		StorageValidationErrorCode.InvalidS3Uri,
+	);
+};

package/src/internals/locationCredentialsStore/index.ts

@@ -0,0 +1,4 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { createLocationCredentialsStore } from './create';

package/src/internals/locationCredentialsStore/registry.ts

@@ -0,0 +1,89 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { AWSTemporaryCredentials } from '../../providers/s3/types/options';
+import {
+	CredentialsLocation,
+	GetLocationCredentials,
+} from '../types/credentials';
+import { assertValidationError } from '../../errors/utils/assertValidationError';
+import { StorageValidationErrorCode } from '../../errors/types/validation';
+
+import {
+	LruLocationCredentialsStore,
+	fetchNewValue,
+	getCacheValue,
+	initStore,
+} from './store';
+
+interface StoreRegistrySymbol {
+	readonly value: symbol;
+}
+
+/**
+ * Keep all cache records for all instances of credentials store in a singleton
+ * so we can reliably de-reference from the memory when we destroy a store
+ * instance.
+ */
+const storeRegistry = new WeakMap<
+	StoreRegistrySymbol,
+	LruLocationCredentialsStore
+>();
+
+/**
+ * @internal
+ */
+export const createStore = (
+	refreshHandler: GetLocationCredentials,
+	size?: number,
+) => {
+	const storeSymbol = { value: Symbol('LocationCredentialsStore') };
+	storeRegistry.set(storeSymbol, initStore(refreshHandler, size));
+
+	return storeSymbol;
+};
+
+const getLookUpLocations = (location: CredentialsLocation) => {
+	const { scope, permission } = location;
+	const locations = [{ scope, permission }];
+	if (permission === 'READ' || permission === 'WRITE') {
+		locations.push({ scope, permission: 'READWRITE' });
+	}
+
+	return locations;
+};
+
+const getCredentialsStore = (storeSymbol: StoreRegistrySymbol) => {
+	assertValidationError(
+		storeRegistry.has(storeSymbol),
+		StorageValidationErrorCode.LocationCredentialsStoreDestroyed,
+	);
+
+	return storeRegistry.get(storeSymbol)!;
+};
+
+/**
+ * @internal
+ */
+export const getValue = async (input: {
+	storeSymbol: StoreRegistrySymbol;
+	location: CredentialsLocation;
+	forceRefresh: boolean;
+}): Promise<{ credentials: AWSTemporaryCredentials }> => {
+	const { storeSymbol: storeReference, location, forceRefresh } = input;
+	const store = getCredentialsStore(storeReference);
+	if (!forceRefresh) {
+		const lookupLocations = getLookUpLocations(location);
+		for (const lookupLocation of lookupLocations) {
+			const credentials = getCacheValue(store, lookupLocation);
+			if (credentials !== null) {
+				return { credentials };
+			}
+		}
+	}
+
+	return fetchNewValue(store, location);
+};
+
+export const removeStore = (storeSymbol: StoreRegistrySymbol) => {
+	storeRegistry.delete(storeSymbol);
+};

package/src/internals/locationCredentialsStore/store.ts

@@ -0,0 +1,159 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	CredentialsLocation,
+	GetLocationCredentials,
+} from '../types/credentials';
+import { Permission } from '../types/common';
+import { AWSTemporaryCredentials } from '../../providers/s3/types/options';
+import { assertValidationError } from '../../errors/utils/assertValidationError';
+import { StorageValidationErrorCode } from '../../errors/types/validation';
+
+import {
+	CREDENTIALS_REFRESH_WINDOW_MS,
+	CREDENTIALS_STORE_DEFAULT_SIZE,
+} from './constants';
+
+interface StoreValue extends CredentialsLocation {
+	credentials?: AWSTemporaryCredentials;
+	inflightCredentials?: Promise<{ credentials: AWSTemporaryCredentials }>;
+}
+
+type S3Uri = string;
+
+type CacheKey = `${S3Uri}_${Permission}`;
+
+const createCacheKey = (location: CredentialsLocation): CacheKey =>
+	`${location.scope}_${location.permission}`;
+
+/**
+ * LRU implementation for Location Credentials Store
+ * O(n) for get and set for simplicity.
+ *
+ * @internal
+ */
+export interface LruLocationCredentialsStore {
+	capacity: number;
+	refreshHandler: GetLocationCredentials;
+	values: Map<CacheKey, StoreValue>;
+}
+
+/**
+ * @internal
+ */
+export const initStore = (
+	refreshHandler: GetLocationCredentials,
+	size = CREDENTIALS_STORE_DEFAULT_SIZE,
+): LruLocationCredentialsStore => {
+	assertValidationError(
+		size > 0,
+		StorageValidationErrorCode.InvalidLocationCredentialsCacheSize,
+	);
+
+	return {
+		capacity: size,
+		refreshHandler,
+		values: new Map<CacheKey, StoreValue>(),
+	};
+};
+
+export const getCacheValue = (
+	store: LruLocationCredentialsStore,
+	location: CredentialsLocation,
+): AWSTemporaryCredentials | null => {
+	const cacheKey = createCacheKey(location);
+	const cachedValue = store.values.get(cacheKey);
+	const cachedCredentials = cachedValue?.credentials;
+	if (!cachedCredentials) {
+		return null;
+	}
+
+	// Delete and re-insert to key to map to indicate a latest reference in LRU.
+	store.values.delete(cacheKey);
+	if (!pastTTL(cachedCredentials)) {
+		// TODO(@AllanZhengYP): If the credential is still valid but will expire
+		// soon, we should return credentials AND dispatch a refresh.
+		store.values.set(cacheKey, cachedValue);
+
+		return cachedCredentials;
+	}
+
+	return null;
+};
+
+const pastTTL = (credentials: AWSTemporaryCredentials) => {
+	const { expiration } = credentials;
+
+	return expiration.getTime() - CREDENTIALS_REFRESH_WINDOW_MS <= Date.now();
+};
+
+/**
+ * Fetch new credentials value with refresh handler and cache the result in
+ * LRU cache.
+ * @internal
+ */
+export const fetchNewValue = async (
+	store: LruLocationCredentialsStore,
+	location: CredentialsLocation,
+): Promise<{ credentials: AWSTemporaryCredentials }> => {
+	const storeValues = store.values;
+	const key = createCacheKey(location);
+	if (!storeValues.has(key)) {
+		const newStoreValue: StoreValue = {
+			scope: location.scope,
+			permission: location.permission,
+		};
+		setCacheRecord(store, key, newStoreValue);
+	}
+	const storeValue = storeValues.get(key)!;
+
+	return dispatchRefresh(store.refreshHandler, storeValue, () => {
+		store.values.delete(key);
+	});
+};
+
+const dispatchRefresh = (
+	refreshHandler: GetLocationCredentials,
+	value: StoreValue,
+	onRefreshFailure: () => void,
+) => {
+	if (value.inflightCredentials) {
+		return value.inflightCredentials;
+	}
+
+	value.inflightCredentials = (async () => {
+		try {
+			const { credentials } = await refreshHandler({
+				scope: value.scope,
+				permission: value.permission,
+			});
+			value.credentials = credentials;
+
+			return { credentials };
+		} catch (e) {
+			onRefreshFailure();
+			throw e;
+		} finally {
+			value.inflightCredentials = undefined;
+		}
+	})();
+
+	return value.inflightCredentials;
+};
+
+const setCacheRecord = (
+	store: LruLocationCredentialsStore,
+	key: CacheKey,
+	value: StoreValue,
+): void => {
+	if (store.capacity === store.values.size) {
+		// Pop least used entry. The Map's key are in insertion order.
+		// So first key is the last recently inserted.
+		const [oldestKey] = store.values.keys();
+		store.values.delete(oldestKey);
+		// TODO(@AllanZhengYP): Add log info when record is evicted.
+	}
+	// Add latest used value to the cache.
+	store.values.set(key, value);
+};

package/src/internals/managedAuthConfigAdapter/createListLocationsHandler.ts

@@ -0,0 +1,21 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { CredentialsProvider, ListLocations } from '../types/credentials';
+import { listCallerAccessGrants } from '../apis/listCallerAccessGrants';
+
+interface CreateListLocationsHandlerInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	region: string;
+}
+
+export const createListLocationsHandler = (
+	handlerInput: CreateListLocationsHandlerInput,
+): ListLocations => {
+	return async function listLocations(input = {}) {
+		const result = await listCallerAccessGrants({ ...input, ...handlerInput });
+
+		return result;
+	};
+};

package/src/internals/managedAuthConfigAdapter/createLocationCredentialsHandler.ts

@@ -0,0 +1,40 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { getDataAccess } from '../apis/getDataAccess';
+import {
+	CredentialsProvider,
+	GetLocationCredentials,
+	GetLocationCredentialsInput,
+} from '../types/credentials';
+
+interface CreateLocationCredentialsHandlerInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	region: string;
+}
+
+export const createLocationCredentialsHandler = (
+	handlerInput: CreateLocationCredentialsHandlerInput,
+): GetLocationCredentials => {
+	const { accountId, region, credentialsProvider } = handlerInput;
+
+	/**
+	 * Retrieves credentials for the specified scope & permission.
+	 *
+	 * @param input - An object specifying the requested scope & permission.
+	 *
+	 * @returns A promise which will resolve with the requested credentials.
+	 */
+	return (input: GetLocationCredentialsInput) => {
+		const { scope, permission } = input;
+
+		return getDataAccess({
+			accountId,
+			credentialsProvider,
+			permission,
+			region,
+			scope,
+		});
+	};
+};

package/src/internals/managedAuthConfigAdapter/createManagedAuthConfigAdapter.ts

@@ -0,0 +1,53 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import {
+	CredentialsProvider,
+	GetLocationCredentials,
+	ListLocations,
+} from '../types/credentials';
+
+import { createListLocationsHandler } from './createListLocationsHandler';
+import { createLocationCredentialsHandler } from './createLocationCredentialsHandler';
+
+export interface CreateManagedAuthConfigAdapterInput {
+	accountId: string;
+	region: string;
+	credentialsProvider: CredentialsProvider;
+}
+
+export interface AuthConfigAdapter {
+	listLocations: ListLocations;
+	getLocationCredentials: GetLocationCredentials;
+	region: string;
+}
+
+/**
+ * Create configuration including handlers to call S3 Access Grant APIs to list and get
+ * credentials for different locations.
+ *
+ * @param options - Configuration options for the adapter.
+ * @returns - An object containing the handlers to call S3 Access Grant APIs and region
+ */
+export const createManagedAuthConfigAdapter = ({
+	credentialsProvider,
+	region,
+	accountId,
+}: CreateManagedAuthConfigAdapterInput): AuthConfigAdapter => {
+	const listLocations = createListLocationsHandler({
+		credentialsProvider,
+		accountId,
+		region,
+	});
+
+	const getLocationCredentials = createLocationCredentialsHandler({
+		credentialsProvider,
+		accountId,
+		region,
+	});
+
+	return {
+		listLocations,
+		getLocationCredentials,
+		region,
+	};
+};

package/src/internals/managedAuthConfigAdapter/index.ts

@@ -0,0 +1,8 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export {
+	AuthConfigAdapter,
+	createManagedAuthConfigAdapter,
+	CreateManagedAuthConfigAdapterInput,
+} from './createManagedAuthConfigAdapter';

package/src/internals/types/common.ts

@@ -0,0 +1,22 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * @internal
+ */
+export type Permission = 'READ' | 'READWRITE' | 'WRITE';
+
+/**
+ * @internal
+ */
+export type LocationType = 'BUCKET' | 'PREFIX' | 'OBJECT';
+
+/**
+ * @internal
+ */
+export type Privilege = 'Default' | 'Minimal';
+
+/**
+ * @internal
+ */
+export type PrefixType = 'Object';