@aws-amplify/storage 6.6.10 → 6.6.11-storage-browser-integrity.2a9053f.0

package/src/internals/types/credentials.ts

@@ -0,0 +1,109 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	AWSTemporaryCredentials,
+	LocationCredentialsProvider,
+} from '../../providers/s3/types/options';
+
+import { LocationType, Permission } from './common';
+
+/**
+ * @internal
+ */
+export type CredentialsProvider = LocationCredentialsProvider;
+
+export interface CreateLocationCredentialsStoreInput {
+	handler: GetLocationCredentials;
+}
+
+export interface LocationCredentialsStore {
+	/**
+	 * Get location-specific credentials. It uses a cache internally to optimize performance when
+	 * getting credentials for the same location. It will refresh credentials if they expire or
+	 * when forced to.
+	 */
+	getProvider(option: CredentialsLocation): LocationCredentialsProvider;
+	/**
+	 * Invalidate cached credentials and force subsequent calls to get location-specific
+	 * credentials to throw. It also makes subsequent calls to `getCredentialsProviderForLocation`
+	 * to throw.
+	 */
+	destroy(): void;
+}
+
+export interface LocationCredentials extends Partial<LocationScope> {
+	/**
+	 * AWS credentials which can be used to access the specified location.
+	 */
+	readonly credentials: AWSTemporaryCredentials;
+}
+
+export type GetLocationCredentialsInput = CredentialsLocation;
+export type GetLocationCredentialsOutput = LocationCredentials;
+
+export type GetLocationCredentials = (
+	input: GetLocationCredentialsInput,
+) => Promise<GetLocationCredentialsOutput>;
+
+/**
+ * @internal
+ */
+export interface ListLocationsInput {
+	pageSize?: number;
+	nextToken?: string;
+}
+
+/**
+ * @internal
+ */
+export interface ListLocationsOutput {
+	locations: LocationAccess[];
+	nextToken?: string;
+}
+
+/**
+ * @internal
+ */
+export type ListLocations = (
+	input?: ListLocationsInput,
+) => Promise<ListLocationsOutput>;
+
+/**
+ * @internal
+ */
+export interface LocationScope {
+	/**
+	 * Scope of storage location. For S3 service, it's the S3 path of the data to
+	 * which the access is granted. It can be in following formats:
+	 *
+	 * @example Bucket 's3://<bucket>/*'
+	 * @example Prefix 's3://<bucket>/<prefix-with-path>*'
+	 * @example Object 's3://<bucket>/<prefix-with-path>/<object>'
+	 */
+	readonly scope: string;
+}
+
+/**
+ * @internal
+ */
+export interface CredentialsLocation extends LocationScope {
+	/**
+	 * The type of access granted to your Storage data. Can be either of READ,
+	 * WRITE or READWRITE
+	 */
+	readonly permission: Permission;
+}
+
+/**
+ * @internal
+ */
+export interface LocationAccess extends CredentialsLocation {
+	/**
+	 * Parse location type parsed from scope format:
+	 * * BUCKET: `'s3://<bucket>/*'`
+	 * * PREFIX: `'s3://<bucket>/<prefix-with-path>*'`
+	 * * OBJECT: `'s3://<bucket>/<prefix-with-path>/<object>'`
+	 */
+	readonly type: LocationType;
+}

package/src/internals/types/inputs.ts

@@ -0,0 +1,153 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	StorageCopyInputWithPath,
+	StorageOperationInputWithPath,
+	StorageOperationOptionsInput,
+} from '../../types/inputs';
+import {
+	CopyWithPathInput,
+	DownloadDataWithPathInput,
+	GetPropertiesWithPathInput,
+	GetUrlWithPathInput,
+	RemoveWithPathInput,
+	UploadDataWithPathInput,
+} from '../../providers/s3';
+import {
+	ListAllWithPathInput,
+	ListPaginateWithPathInput,
+} from '../../providers/s3/types/inputs';
+
+import { CredentialsProvider, ListLocationsInput } from './credentials';
+import { Permission, PrefixType, Privilege } from './common';
+
+/**
+ * @internal
+ */
+export interface ListCallerAccessGrantsInput extends ListLocationsInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	region: string;
+}
+
+/**
+ * @internal
+ */
+export interface GetDataAccessInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	durationSeconds?: number;
+	permission: Permission;
+	prefixType?: PrefixType;
+	privilege?: Privilege;
+	region: string;
+	scope: string;
+}
+
+/**
+ * @internal
+ */
+export type ListAllInput = ExtendInputWithAdvancedOptions<
+	ListAllWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+/**
+ * @internal
+ */
+export type ListPaginateInput = ExtendInputWithAdvancedOptions<
+	ListPaginateWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+/**
+ * @internal
+ */
+export type ListInput = ListAllInput | ListPaginateInput;
+
+/**
+ * @internal
+ */
+export type RemoveInput = ExtendInputWithAdvancedOptions<
+	RemoveWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+/**
+ * @internal
+ */
+export type GetPropertiesInput = ExtendInputWithAdvancedOptions<
+	GetPropertiesWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+/**
+ * @internal
+ */
+export type GetUrlInput = ExtendInputWithAdvancedOptions<
+	GetUrlWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+/**
+ * @internal
+ */
+export type CopyInput = ExtendCopyInputWithAdvancedOptions<
+	CopyWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+export type UploadDataInput = ExtendInputWithAdvancedOptions<
+	UploadDataWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+/**
+ * @internal
+ */
+export type DownloadDataInput = ExtendInputWithAdvancedOptions<
+	DownloadDataWithPathInput,
+	{
+		locationCredentialsProvider?: CredentialsProvider;
+	}
+>;
+
+/**
+ * Generic types that extend the public non-copy API input types with extended
+ * options. This is a temporary solution to support advanced options from internal APIs.
+ */
+type ExtendInputWithAdvancedOptions<InputType, ExtendedOptionsType> =
+	InputType extends StorageOperationInputWithPath &
+		StorageOperationOptionsInput<infer PublicInputOptionsType>
+		? InputType & {
+				options?: PublicInputOptionsType & ExtendedOptionsType;
+			}
+		: never;
+
+/**
+ * Generic types that extend the public copy API input type with extended options.
+ * This is a temporary solution to support advanced options from internal APIs.
+ */
+type ExtendCopyInputWithAdvancedOptions<InputType, ExtendedOptionsType> =
+	InputType extends StorageCopyInputWithPath
+		? {
+				source: InputType['source'];
+				destination: InputType['destination'];
+				options?: ExtendedOptionsType;
+			}
+		: never;

package/src/internals/types/options.ts

@@ -0,0 +1,2 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0

package/src/internals/types/outputs.ts

@@ -0,0 +1,60 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	CopyWithPathOutput,
+	DownloadDataWithPathOutput,
+	GetPropertiesWithPathOutput,
+	GetUrlWithPathOutput,
+	ListAllWithPathOutput,
+	ListPaginateWithPathOutput,
+	RemoveWithPathOutput,
+	UploadDataWithPathOutput,
+} from '../../providers/s3/types';
+
+import { ListLocationsOutput, LocationCredentials } from './credentials';
+
+/**
+ * @internal
+ */
+export type CopyOutput = CopyWithPathOutput;
+
+/**
+ * @internal
+ */
+export type DownloadDataOutput = DownloadDataWithPathOutput;
+
+/**
+ * @internal
+ */
+export type GetDataAccessOutput = LocationCredentials;
+
+/**
+ * @internal
+ */
+export type GetPropertiesOutput = GetPropertiesWithPathOutput;
+
+/**
+ * @internal
+ */
+export type GetUrlOutput = GetUrlWithPathOutput;
+
+/**
+ * @internal
+ */
+export type RemoveOutput = RemoveWithPathOutput;
+
+/**
+ * @internal
+ */
+export type ListOutput = ListAllWithPathOutput | ListPaginateWithPathOutput;
+
+/**
+ * @internal
+ */
+export type UploadDataOutput = UploadDataWithPathOutput;
+
+/**
+ * @internal
+ */
+export type ListCallerAccessGrantsOutput = ListLocationsOutput;

package/src/internals/utils/constants.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const DEFAULT_CRED_TTL = 15 * 60; // 15 minutes
+export const MAX_PAGE_SIZE = 1000;

package/src/providers/s3/apis/downloadData.ts

@@ -1,26 +1,14 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { Amplify } from '@aws-amplify/core';
-import { StorageAction } from '@aws-amplify/core/internals/utils';
-
 import {
 	DownloadDataInput,
 	DownloadDataOutput,
 	DownloadDataWithPathInput,
 	DownloadDataWithPathOutput,
 } from '../types';
-import { resolveS3ConfigAndInput } from '../utils/resolveS3ConfigAndInput';
-import { createDownloadTask, validateStorageOperationInput } from '../utils';
-import { getObject } from '../utils/client';
-import { getStorageUserAgentValue } from '../utils/userAgent';
-import { logger } from '../../../utils';
-import {
-	StorageDownloadDataOutput,
-	StorageItemWithKey,
-	StorageItemWithPath,
-} from '../../../types';
-import { STORAGE_INPUT_KEY } from '../utils/constants';
+
+import { downloadData as downloadDataInternal } from './internal/downloadData';
 
 /**
  * Download S3 object data to memory
@@ -89,77 +77,8 @@ export function downloadData(
  *```
  */
 export function downloadData(input: DownloadDataInput): DownloadDataOutput;
-
 export function downloadData(
 	input: DownloadDataInput | DownloadDataWithPathInput,
 ) {
-	const abortController = new AbortController();
-
-	const downloadTask = createDownloadTask({
-		job: downloadDataJob(input, abortController.signal),
-		onCancel: (message?: string) => {
-			abortController.abort(message);
-		},
-	});
-
-	return downloadTask;
+	return downloadDataInternal(input);
 }
-
-const downloadDataJob =
-	(
-		downloadDataInput: DownloadDataInput | DownloadDataWithPathInput,
-		abortSignal: AbortSignal,
-	) =>
-	async (): Promise<
-		StorageDownloadDataOutput<StorageItemWithKey | StorageItemWithPath>
-	> => {
-		const { options: downloadDataOptions } = downloadDataInput;
-		const { bucket, keyPrefix, s3Config, identityId } =
-			await resolveS3ConfigAndInput(Amplify, downloadDataOptions);
-		const { inputType, objectKey } = validateStorageOperationInput(
-			downloadDataInput,
-			identityId,
-		);
-		const finalKey =
-			inputType === STORAGE_INPUT_KEY ? keyPrefix + objectKey : objectKey;
-
-		logger.debug(`download ${objectKey} from ${finalKey}.`);
-
-		const {
-			Body: body,
-			LastModified: lastModified,
-			ContentLength: size,
-			ETag: eTag,
-			Metadata: metadata,
-			VersionId: versionId,
-			ContentType: contentType,
-		} = await getObject(
-			{
-				...s3Config,
-				abortSignal,
-				onDownloadProgress: downloadDataOptions?.onProgress,
-				userAgentValue: getStorageUserAgentValue(StorageAction.DownloadData),
-			},
-			{
-				Bucket: bucket,
-				Key: finalKey,
-				...(downloadDataOptions?.bytesRange && {
-					Range: `bytes=${downloadDataOptions.bytesRange.start}-${downloadDataOptions.bytesRange.end}`,
-				}),
-			},
-		);
-
-		const result = {
-			body,
-			lastModified,
-			size,
-			contentType,
-			eTag,
-			metadata,
-			versionId,
-		};
-
-		return inputType === STORAGE_INPUT_KEY
-			? { key: objectKey, ...result }
-			: { path: objectKey, ...result };
-	};

package/src/providers/s3/apis/internal/copy.ts

@@ -14,13 +14,16 @@ import { ResolvedS3Config, StorageBucket } from '../../types/options';
 import {
 	isInputWithPath,
 	resolveS3ConfigAndInput,
+	validateBucketOwnerID,
 	validateStorageOperationInput,
 } from '../../utils';
 import { StorageValidationErrorCode } from '../../../../errors/types/validation';
 import { assertValidationError } from '../../../../errors/utils/assertValidationError';
-import { copyObject } from '../../utils/client';
+import { copyObject } from '../../utils/client/s3data';
 import { getStorageUserAgentValue } from '../../utils/userAgent';
 import { logger } from '../../../../utils';
+// TODO: Remove this interface when we move to public advanced APIs.
+import { CopyInput as CopyWithPathInputWithAdvancedOptions } from '../../../../internals';
 
 const isCopyInputWithPath = (
 	input: CopyInput | CopyWithPathInput,
@@ -44,7 +47,7 @@ const storageBucketAssertion = (
 
 export const copy = async (
 	amplify: AmplifyClassV6,
-	input: CopyInput | CopyWithPathInput,
+	input: CopyInput | CopyWithPathInputWithAdvancedOptions,
 ): Promise<CopyOutput | CopyWithPathOutput> => {
 	return isCopyInputWithPath(input)
 		? copyWithPath(amplify, input)
@@ -53,21 +56,33 @@ export const copy = async (
 
 const copyWithPath = async (
 	amplify: AmplifyClassV6,
-	input: CopyWithPathInput,
+	input: CopyWithPathInputWithAdvancedOptions,
 ): Promise<CopyWithPathOutput> => {
 	const { source, destination } = input;
 
 	storageBucketAssertion(source.bucket, destination.bucket);
 
-	const { bucket: sourceBucket, identityId } = await resolveS3ConfigAndInput(
-		amplify,
-		input.source,
-	);
+	const { bucket: sourceBucket } = await resolveS3ConfigAndInput(amplify, {
+		path: input.source.path,
+		options: {
+			locationCredentialsProvider: input.options?.locationCredentialsProvider,
+			...input.source,
+		},
+	});
 
-	const { s3Config, bucket: destBucket } = await resolveS3ConfigAndInput(
-		amplify,
-		input.destination,
-	); // resolveS3ConfigAndInput does not make extra API calls or storage access if called repeatedly.
+	// The bucket, region, credentials of s3 client are resolved from destination.
+	// Whereas the source bucket and path are a input parameter of S3 copy operation.
+	const {
+		s3Config,
+		bucket: destBucket,
+		identityId,
+	} = await resolveS3ConfigAndInput(amplify, {
+		path: input.destination.path,
+		options: {
+			locationCredentialsProvider: input.options?.locationCredentialsProvider,
+			...input.destination,
+		},
+	}); // resolveS3ConfigAndInput does not make extra API calls or storage access if called repeatedly.
 
 	assertValidationError(!!source.path, StorageValidationErrorCode.NoSourcePath);
 	assertValidationError(
@@ -83,7 +98,8 @@ const copyWithPath = async (
 		destination,
 		identityId,
 	);
-
+	validateBucketOwnerID(source.expectedBucketOwner);
+	validateBucketOwnerID(destination.expectedBucketOwner);
 	const finalCopySource = `${sourceBucket}/${sourcePath}`;
 	const finalCopyDestination = destinationPath;
 	logger.debug(`copying "${finalCopySource}" to "${finalCopyDestination}".`);
@@ -93,6 +109,10 @@ const copyWithPath = async (
 		destination: finalCopyDestination,
 		bucket: destBucket,
 		s3Config,
+		notModifiedSince: input.source.notModifiedSince,
+		eTag: input.source.eTag,
+		expectedSourceBucketOwner: input.source?.expectedBucketOwner,
+		expectedBucketOwner: input.destination?.expectedBucketOwner,
 	});
 
 	return { path: finalCopyDestination };
@@ -112,15 +132,35 @@ export const copyWithKey = async (
 		!!destination.key,
 		StorageValidationErrorCode.NoDestinationKey,
 	);
+	validateBucketOwnerID(source.expectedBucketOwner);
+	validateBucketOwnerID(destination.expectedBucketOwner);
 
 	const { bucket: sourceBucket, keyPrefix: sourceKeyPrefix } =
-		await resolveS3ConfigAndInput(amplify, source);
-
+		await resolveS3ConfigAndInput(amplify, {
+			...input,
+			options: {
+				// @ts-expect-error: 'options' does not exist on type 'CopyInput'. In case of JS users set the location
+				// credentials provider option, resolveS3ConfigAndInput will throw validation error.
+				locationCredentialsProvider: input.options?.locationCredentialsProvider,
+				...input.source,
+			},
+		});
+
+	// The bucket, region, credentials of s3 client are resolved from destination.
+	// Whereas the source bucket and path are a input parameter of S3 copy operation.
 	const {
 		s3Config,
 		bucket: destBucket,
 		keyPrefix: destinationKeyPrefix,
-	} = await resolveS3ConfigAndInput(amplify, destination); // resolveS3ConfigAndInput does not make extra API calls or storage access if called repeatedly.
+	} = await resolveS3ConfigAndInput(amplify, {
+		...input,
+		options: {
+			// @ts-expect-error: 'options' does not exist on type 'CopyInput'. In case of JS users set the location
+			// credentials provider option, resolveS3ConfigAndInput will throw validation error.
+			locationCredentialsProvider: input.options?.locationCredentialsProvider,
+			...input.destination,
+		},
+	}); // resolveS3ConfigAndInput does not make extra API calls or storage access if called repeatedly.
 
 	// TODO(ashwinkumar6) V6-logger: warn `You may copy files from another user if the source level is "protected", currently it's ${srcLevel}`
 	const finalCopySource = `${sourceBucket}/${sourceKeyPrefix}${source.key}`;
@@ -132,6 +172,10 @@ export const copyWithKey = async (
 		destination: finalCopyDestination,
 		bucket: destBucket,
 		s3Config,
+		notModifiedSince: input.source.notModifiedSince,
+		eTag: input.source.eTag,
+		expectedSourceBucketOwner: input.source?.expectedBucketOwner,
+		expectedBucketOwner: input.destination?.expectedBucketOwner,
 	});
 
 	return {
@@ -144,11 +188,19 @@ const serviceCopy = async ({
 	destination,
 	bucket,
 	s3Config,
+	notModifiedSince,
+	eTag,
+	expectedSourceBucketOwner,
+	expectedBucketOwner,
 }: {
 	source: string;
 	destination: string;
 	bucket: string;
 	s3Config: ResolvedS3Config;
+	notModifiedSince?: Date;
+	eTag?: string;
+	expectedSourceBucketOwner?: string;
+	expectedBucketOwner?: string;
 }) => {
 	await copyObject(
 		{
@@ -160,6 +212,10 @@ const serviceCopy = async ({
 			CopySource: source,
 			Key: destination,
 			MetadataDirective: 'COPY', // Copies over metadata like contentType as well
+			CopySourceIfMatch: eTag,
+			CopySourceIfUnmodifiedSince: notModifiedSince,
+			ExpectedSourceBucketOwner: expectedSourceBucketOwner,
+			ExpectedBucketOwner: expectedBucketOwner,
 		},
 	);
 };

package/src/providers/s3/apis/internal/downloadData.ts

@@ -0,0 +1,96 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { Amplify } from '@aws-amplify/core';
+import { StorageAction } from '@aws-amplify/core/internals/utils';
+
+import { resolveS3ConfigAndInput } from '../../utils/resolveS3ConfigAndInput';
+import {
+	createDownloadTask,
+	validateBucketOwnerID,
+	validateStorageOperationInput,
+} from '../../utils';
+import { getObject } from '../../utils/client/s3data';
+import { getStorageUserAgentValue } from '../../utils/userAgent';
+import { logger } from '../../../../utils';
+import { DownloadDataInput, DownloadDataWithPathInput } from '../../types';
+import { STORAGE_INPUT_KEY } from '../../utils/constants';
+import {
+	StorageDownloadDataOutput,
+	StorageItemWithKey,
+	StorageItemWithPath,
+} from '../../../../types';
+// TODO: Remove this interface when we move to public advanced APIs.
+import { DownloadDataInput as DownloadDataWithPathInputWithAdvancedOptions } from '../../../../internals/types/inputs';
+
+export const downloadData = (
+	input: DownloadDataInput | DownloadDataWithPathInputWithAdvancedOptions,
+) => {
+	const abortController = new AbortController();
+	const downloadTask = createDownloadTask({
+		job: downloadDataJob(input, abortController.signal),
+		onCancel: (message?: string) => {
+			abortController.abort(message);
+		},
+	});
+
+	return downloadTask;
+};
+
+const downloadDataJob =
+	(
+		downloadDataInput: DownloadDataInput | DownloadDataWithPathInput,
+		abortSignal: AbortSignal,
+	) =>
+	async (): Promise<
+		StorageDownloadDataOutput<StorageItemWithKey | StorageItemWithPath>
+	> => {
+		const { options: downloadDataOptions } = downloadDataInput;
+		const { bucket, keyPrefix, s3Config, identityId } =
+			await resolveS3ConfigAndInput(Amplify, downloadDataInput);
+		const { inputType, objectKey } = validateStorageOperationInput(
+			downloadDataInput,
+			identityId,
+		);
+		validateBucketOwnerID(downloadDataOptions?.expectedBucketOwner);
+		const finalKey =
+			inputType === STORAGE_INPUT_KEY ? keyPrefix + objectKey : objectKey;
+		logger.debug(`download ${objectKey} from ${finalKey}.`);
+		const {
+			Body: body,
+			LastModified: lastModified,
+			ContentLength: size,
+			ETag: eTag,
+			Metadata: metadata,
+			VersionId: versionId,
+			ContentType: contentType,
+		} = await getObject(
+			{
+				...s3Config,
+				abortSignal,
+				onDownloadProgress: downloadDataOptions?.onProgress,
+				userAgentValue: getStorageUserAgentValue(StorageAction.DownloadData),
+			},
+			{
+				Bucket: bucket,
+				Key: finalKey,
+				...(downloadDataOptions?.bytesRange && {
+					Range: `bytes=${downloadDataOptions.bytesRange.start}-${downloadDataOptions.bytesRange.end}`,
+				}),
+				ExpectedBucketOwner: downloadDataOptions?.expectedBucketOwner,
+			},
+		);
+		const result = {
+			body,
+			lastModified,
+			size,
+			contentType,
+			eTag,
+			metadata,
+			versionId,
+		};
+
+		return inputType === STORAGE_INPUT_KEY
+			? { key: objectKey, ...result }
+			: { path: objectKey, ...result };
+	};