@aws-amplify/storage 6.6.10 → 6.6.11-storage-browser-integrity.2a9053f.0

package/src/providers/s3/utils/client/s3control/getDataAccess.ts

@@ -0,0 +1,96 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	Endpoint,
+	HttpRequest,
+	HttpResponse,
+	parseMetadata,
+} from '@aws-amplify/core/internals/aws-client-utils';
+import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+import {
+	AmplifyUrl,
+	AmplifyUrlSearchParams,
+} from '@aws-amplify/core/internals/utils';
+
+import {
+	assignStringVariables,
+	buildStorageServiceError,
+	deserializeTimestamp,
+	map,
+	parseXmlBody,
+	s3TransferHandler,
+} from '../utils';
+
+import type {
+	GetDataAccessCommandInput,
+	GetDataAccessCommandOutput,
+} from './types';
+import { defaultConfig, parseXmlError } from './base';
+
+export type GetDataAccessInput = GetDataAccessCommandInput;
+
+export type GetDataAccessOutput = GetDataAccessCommandOutput;
+
+const getDataAccessSerializer = (
+	input: GetDataAccessInput,
+	endpoint: Endpoint,
+): HttpRequest => {
+	const headers = assignStringVariables({
+		'x-amz-account-id': input.AccountId,
+	});
+	const query = assignStringVariables({
+		durationSeconds: input.DurationSeconds,
+		permission: input.Permission,
+		privilege: input.Privilege,
+		target: input.Target,
+		targetType: input.TargetType,
+	});
+	const url = new AmplifyUrl(endpoint.url.toString());
+	url.search = new AmplifyUrlSearchParams(query).toString();
+
+	// Ref: https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetDataAccess.html
+	url.pathname = '/v20180820/accessgrantsinstance/dataaccess';
+
+	return {
+		method: 'GET',
+		headers,
+		url,
+	};
+};
+
+const getDataAccessDeserializer = async (
+	response: HttpResponse,
+): Promise<GetDataAccessCommandOutput> => {
+	if (response.statusCode >= 300) {
+		// error is always set when statusCode >= 300
+		const error = (await parseXmlError(response)) as Error;
+		throw buildStorageServiceError(error, response.statusCode);
+	} else {
+		const parsed = await parseXmlBody(response);
+		const contents = map(parsed, {
+			Credentials: ['Credentials', deserializeCredentials],
+			MatchedGrantTarget: 'MatchedGrantTarget',
+		});
+
+		return {
+			$metadata: parseMetadata(response),
+			...contents,
+		};
+	}
+};
+
+const deserializeCredentials = (output: any) =>
+	map(output, {
+		AccessKeyId: 'AccessKeyId',
+		Expiration: ['Expiration', deserializeTimestamp],
+		SecretAccessKey: 'SecretAccessKey',
+		SessionToken: 'SessionToken',
+	});
+
+export const getDataAccess = composeServiceApi(
+	s3TransferHandler,
+	getDataAccessSerializer,
+	getDataAccessDeserializer,
+	{ ...defaultConfig, responseType: 'text' },
+);

package/src/providers/s3/utils/client/s3control/index.ts

@@ -0,0 +1,13 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export {
+	getDataAccess,
+	GetDataAccessInput,
+	GetDataAccessOutput,
+} from '../s3control/getDataAccess';
+export {
+	listCallerAccessGrants,
+	ListCallerAccessGrantsInput,
+	ListCallerAccessGrantsOutput,
+} from '../s3control/listCallerAccessGrants';

package/src/providers/s3/utils/client/s3control/listCallerAccessGrants.ts

@@ -0,0 +1,107 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	Endpoint,
+	HttpRequest,
+	HttpResponse,
+	parseMetadata,
+} from '@aws-amplify/core/internals/aws-client-utils';
+import {
+	AmplifyUrl,
+	AmplifyUrlSearchParams,
+} from '@aws-amplify/core/internals/utils';
+import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+
+import {
+	assignStringVariables,
+	buildStorageServiceError,
+	emptyArrayGuard,
+	map,
+	parseXmlBody,
+	s3TransferHandler,
+} from '../utils';
+import { createStringEnumDeserializer } from '../utils/deserializeHelpers';
+
+import type {
+	ListCallerAccessGrantsCommandInput,
+	ListCallerAccessGrantsCommandOutput,
+} from './types';
+import { defaultConfig, parseXmlError } from './base';
+
+export type ListCallerAccessGrantsInput = ListCallerAccessGrantsCommandInput;
+
+export type ListCallerAccessGrantsOutput = ListCallerAccessGrantsCommandOutput;
+
+const listCallerAccessGrantsSerializer = (
+	input: ListCallerAccessGrantsInput,
+	endpoint: Endpoint,
+): HttpRequest => {
+	const headers = assignStringVariables({
+		'x-amz-account-id': input.AccountId,
+	});
+	const query = assignStringVariables({
+		grantscope: input.GrantScope,
+		maxResults: input.MaxResults,
+		nextToken: input.NextToken,
+	});
+	const url = new AmplifyUrl(endpoint.url.toString());
+	url.search = new AmplifyUrlSearchParams(query).toString();
+
+	// Ref: NA
+	url.pathname = '/v20180820/accessgrantsinstance/caller/grants';
+
+	return {
+		method: 'GET',
+		headers,
+		url,
+	};
+};
+
+const listCallerAccessGrantsDeserializer = async (
+	response: HttpResponse,
+): Promise<ListCallerAccessGrantsOutput> => {
+	if (response.statusCode >= 300) {
+		// error is always set when statusCode >= 300
+		const error = (await parseXmlError(response)) as Error;
+		throw buildStorageServiceError(error, response.statusCode);
+	} else {
+		const parsed = await parseXmlBody(response);
+		const contents = map(parsed, {
+			CallerAccessGrantsList: [
+				'CallerAccessGrantsList',
+				value =>
+					emptyArrayGuard(value.AccessGrant, deserializeAccessGrantsList),
+			],
+			NextToken: 'NextToken',
+		});
+
+		return {
+			$metadata: parseMetadata(response),
+			...contents,
+		};
+	}
+};
+
+const deserializeAccessGrantsList = (output: any[]) =>
+	output.map(deserializeCallerAccessGrant);
+
+const deserializeCallerAccessGrant = (output: any) =>
+	map(output, {
+		ApplicationArn: 'ApplicationArn',
+		GrantScope: 'GrantScope',
+		Permission: [
+			'Permission',
+			createStringEnumDeserializer(
+				['READ', 'READWRITE', 'WRITE'] as const,
+				'Permission',
+			),
+		],
+	});
+
+export const listCallerAccessGrants = composeServiceApi(
+	s3TransferHandler,
+	listCallerAccessGrantsSerializer,
+	listCallerAccessGrantsDeserializer,
+	{ ...defaultConfig, responseType: 'text' },
+);

package/src/providers/s3/utils/client/s3control/types.ts

@@ -0,0 +1,216 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/*
+This file contains manually curated AWS service types that are not yet available via the AWS SDK and the `dts-bundler`
+script. Once these APIs have been released to the AWS SDK, this file can be removed in favor of the `dts-bundler`
+types.
+
+These types were harvested from Trebuchet.
+
+@TODO(jimblanc) Unify types & integrate with `dts-bundler`
+*/
+
+import { MetadataBearer as __MetadataBearer } from '@aws-sdk/types';
+
+declare const Permission: {
+	readonly READ: 'READ';
+	readonly READWRITE: 'READWRITE';
+	readonly WRITE: 'WRITE';
+};
+declare const Privilege: {
+	readonly Default: 'Default';
+	readonly Minimal: 'Minimal';
+};
+declare const S3PrefixType: {
+	readonly Object: 'Object';
+};
+
+/**
+ * <p>The Amazon Web Services Security Token Service temporary credential that S3 Access Grants vends to grantees and client applications. </p>
+ * @public
+ */
+export interface Credentials {
+	/**
+	 * <p>The unique access key ID of the Amazon Web Services STS temporary credential that S3 Access Grants vends to grantees and client applications. </p>
+	 * @public
+	 */
+	AccessKeyId?: string;
+	/**
+	 * <p>The secret access key of the Amazon Web Services STS temporary credential that S3 Access Grants vends to grantees and client applications. </p>
+	 * @public
+	 */
+	SecretAccessKey?: string;
+	/**
+	 * <p>The Amazon Web Services STS temporary credential that S3 Access Grants vends to grantees and client applications. </p>
+	 * @public
+	 * @public
+	 *
+	 * The input for {@link ListCallerAccessGrantsCommand}.
+	 * @public
+	 *
+	 * The input for {@link ListCallerAccessGrantsCommand}.
+	 */
+	SessionToken?: string;
+	/**
+	 * <p>The expiration date and time of the temporary credential that S3 Access Grants vends to grantees and client applications. </p>
+	 * @public
+	 * @public
+	 *
+	 * The output of {@link ListCallerAccessGrantsCommand}.
+	 * @public
+	 *
+	 * The output of {@link ListCallerAccessGrantsCommand}.
+	 */
+	Expiration?: Date;
+}
+
+/**
+ * @public
+ *
+ * The input for {@link GetDataAccessCommand}.
+ */
+export type GetDataAccessCommandInput = GetDataAccessRequest;
+/**
+ * @public
+ *
+ * The output of {@link GetDataAccessCommand}.
+ */
+export interface GetDataAccessCommandOutput
+	extends GetDataAccessResult,
+		__MetadataBearer {}
+
+/**
+ * @public
+ */
+export interface GetDataAccessRequest {
+	/**
+	 * <p>The ID of the Amazon Web Services account that is making this request.</p>
+	 * @public
+	 */
+	AccountId?: string;
+
+	/**
+	 * <p>The S3 URI path of the data to which you are requesting temporary access credentials. If the requesting account has an access grant for this data, S3 Access Grants vends temporary access credentials in the response.</p>
+	 * @public
+	 */
+	Target: string | undefined;
+
+	/**
+	 * <p>The type of permission granted to your S3 data, which can be set to one of the following values:</p>
+	 *          <ul>
+	 *             <li>
+	 *                <p>
+	 *                   <code>READ</code> – Grant read-only access to the S3 data.</p>
+	 *             </li>
+	 *             <li>
+	 *                <p>
+	 *                   <code>WRITE</code> – Grant write-only access to the S3 data.</p>
+	 *             </li>
+	 *             <li>
+	 *                <p>
+	 *                   <code>READWRITE</code> – Grant both read and write access to the S3 data.</p>
+	 *             </li>
+	 *          </ul>
+	 * @public
+	 */
+	Permission: Permission | undefined;
+
+	/**
+	 * <p>The session duration, in seconds, of the temporary access credential that S3 Access Grants vends to the grantee or client application. The default value is 1 hour, but the grantee can specify a range from 900 seconds (15 minutes) up to 43200 seconds (12 hours). If the grantee requests a value higher than this maximum, the operation fails. </p>
+	 * @public
+	 */
+	DurationSeconds?: number;
+
+	/**
+	 * <p>The scope of the temporary access credential that S3 Access Grants vends to the grantee or client application. </p>
+	 *          <ul>
+	 *             <li>
+	 *                <p>
+	 *                   <code>Default</code> – The scope of the returned temporary access token is the scope of the grant that is closest to the target scope.</p>
+	 *             </li>
+	 *             <li>
+	 *                <p>
+	 *                   <code>Minimal</code> – The scope of the returned temporary access token is the same as the requested target scope as long as the requested scope is the same as or a subset of the grant scope. </p>
+	 *             </li>
+	 *          </ul>
+	 * @public
+	 */
+	Privilege?: Privilege;
+
+	/**
+	 * <p>The type of <code>Target</code>. The only possible value is <code>Object</code>. Pass this value if the target data that you would like to access is a path to an object. Do not pass this value if the target data is a bucket or a bucket and a prefix. </p>
+	 * @public
+	 */
+	TargetType?: S3PrefixType;
+}
+
+/**
+ * @public
+ */
+export interface GetDataAccessResult {
+	/**
+	 * <p>The temporary credential token that S3 Access Grants vends.</p>
+	 * @public
+	 */
+	Credentials?: Credentials;
+
+	/**
+	 * <p>The S3 URI path of the data to which you are being granted temporary access credentials. </p>
+	 * @public
+	 */
+	MatchedGrantTarget?: string;
+}
+
+/**
+ * @public
+ *
+ * The input for {@link ListCallerAccessGrantsCommand}.
+ */
+export type ListCallerAccessGrantsCommandInput = ListCallerAccessGrantsRequest;
+/**
+ * @public
+ *
+ * The output of {@link ListCallerAccessGrantsCommand}.
+ */
+export interface ListCallerAccessGrantsCommandOutput
+	extends ListCallerAccessGrantsResult,
+		__MetadataBearer {}
+/**
+ * @public
+ */
+export interface ListCallerAccessGrantsEntry {
+	Permission?: Permission;
+	GrantScope?: string;
+	ApplicationArn?: string;
+}
+/**
+ * @public
+ */
+export interface ListCallerAccessGrantsRequest {
+	AccountId?: string;
+	GrantScope?: string;
+	NextToken?: string;
+	MaxResults?: number;
+}
+/**
+ * @public
+ */
+export interface ListCallerAccessGrantsResult {
+	NextToken?: string;
+	CallerAccessGrantsList?: ListCallerAccessGrantsEntry[];
+}
+/**
+ * @public
+ */
+export type Permission = (typeof Permission)[keyof typeof Permission];
+/**
+ * @public
+ */
+export type Privilege = (typeof Privilege)[keyof typeof Privilege];
+/**
+ * @public
+ */
+export type S3PrefixType = (typeof S3PrefixType)[keyof typeof S3PrefixType];
+
+export {};

package/src/providers/s3/utils/client/{abortMultipartUpload.ts → s3data/abortMultipartUpload.ts}

@@ -14,19 +14,21 @@ import {
 } from '@aws-amplify/core/internals/utils';
 import { MetadataBearer } from '@aws-sdk/types';
 
-import type { AbortMultipartUploadCommandInput } from './types';
-import { defaultConfig } from './base';
 import {
+	assignStringVariables,
 	buildStorageServiceError,
-	parseXmlError,
 	s3TransferHandler,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import type { AbortMultipartUploadCommandInput } from './types';
+import { defaultConfig, parseXmlError } from './base';
 
 export type AbortMultipartUploadInput = Pick<
 	AbortMultipartUploadCommandInput,
-	'Bucket' | 'Key' | 'UploadId'
+	'Bucket' | 'Key' | 'UploadId' | 'ExpectedBucketOwner'
 >;
 
 export type AbortMultipartUploadOutput = MetadataBearer;
@@ -42,10 +44,20 @@ const abortMultipartUploadSerializer = (
 	url.search = new AmplifyUrlSearchParams({
 		uploadId: input.UploadId,
 	}).toString();
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
+	const headers = {
+		...assignStringVariables({
+			'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+		}),
+	};
 
 	return {
 		method: 'DELETE',
-		headers: {},
+		headers,
 		url,
 	};
 };

package/src/providers/s3/utils/client/{base.ts → s3data/base.ts}

@@ -8,11 +8,10 @@ import {
 import {
 	EndpointResolverOptions,
 	getDnsSuffix,
-	getRetryDecider,
 	jitteredBackoff,
 } from '@aws-amplify/core/internals/aws-client-utils';
 
-import { parseXmlError } from './utils';
+import { createRetryDecider, createXmlErrorParser } from '../utils';
 
 const DOMAIN_PATTERN = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
 const IP_ADDRESS_PATTERN = /(\d+\.){3}\d+/;
@@ -100,13 +99,37 @@ export const isDnsCompatibleBucketName = (bucketName: string): boolean =>
 	!IP_ADDRESS_PATTERN.test(bucketName) &&
 	!DOTS_PATTERN.test(bucketName);
 
+/**
+ * Error parser for the XML payload of S3 data plane error response. The error's
+ * `Code` and `Message` locates directly at the XML root element.
+ *
+ * @example
+ * ```
+ * <?xml version="1.0" encoding="UTF-8"?>
+ * 	<Error>
+ * 		<Code>NoSuchKey</Code>
+ * 		<Message>The resource you requested does not exist</Message>
+ * 		<Resource>/mybucket/myfoto.jpg</Resource>
+ * 		<RequestId>4442587FB7D0A2F9</RequestId>
+ * 	</Error>
+ * 	```
+ *
+ * @internal
+ */
+export const parseXmlError = createXmlErrorParser({ noErrorWrapping: true });
+
+/**
+ * @internal
+ */
+export const retryDecider = createRetryDecider(parseXmlError);
+
 /**
  * @internal
  */
 export const defaultConfig = {
 	service: SERVICE_NAME,
 	endpointResolver,
-	retryDecider: getRetryDecider(parseXmlError),
+	retryDecider,
 	computeDelay: jitteredBackoff,
 	userAgentValue: getAmplifyUserAgent(),
 	useAccelerateEndpoint: false,

package/src/providers/s3/utils/client/{completeMultipartUpload.ts → s3data/completeMultipartUpload.ts}

@@ -5,6 +5,8 @@ import {
 	Endpoint,
 	HttpRequest,
 	HttpResponse,
+	MiddlewareContext,
+	RetryDeciderOutput,
 	parseMetadata,
 } from '@aws-amplify/core/internals/aws-client-utils';
 import {
@@ -13,29 +15,37 @@ import {
 } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import type {
-	CompleteMultipartUploadCommandInput,
-	CompleteMultipartUploadCommandOutput,
-	CompletedMultipartUpload,
-	CompletedPart,
-} from './types';
-import { defaultConfig } from './base';
 import {
+	assignStringVariables,
 	buildStorageServiceError,
 	map,
 	parseXmlBody,
-	parseXmlError,
 	s3TransferHandler,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+import { validateMultipartUploadXML } from '../../validateMultipartUploadXML';
+
+import { defaultConfig, parseXmlError, retryDecider } from './base';
+import type {
+	CompleteMultipartUploadCommandInput,
+	CompleteMultipartUploadCommandOutput,
+	CompletedMultipartUpload,
+	CompletedPart,
+} from './types';
 
 const INVALID_PARAMETER_ERROR_MSG =
 	'Invalid parameter for ComplteMultipartUpload API';
 
 export type CompleteMultipartUploadInput = Pick<
 	CompleteMultipartUploadCommandInput,
-	'Bucket' | 'Key' | 'UploadId' | 'MultipartUpload'
+	| 'Bucket'
+	| 'Key'
+	| 'UploadId'
+	| 'MultipartUpload'
+	| 'ChecksumCRC32'
+	| 'ExpectedBucketOwner'
 >;
 
 export type CompleteMultipartUploadOutput = Pick<
@@ -49,6 +59,10 @@ const completeMultipartUploadSerializer = async (
 ): Promise<HttpRequest> => {
 	const headers = {
 		'content-type': 'application/xml',
+		...assignStringVariables({
+			'x-amz-checksum-crc32': input.ChecksumCRC32,
+			'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+		}),
 	};
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
@@ -58,14 +72,20 @@ const completeMultipartUploadSerializer = async (
 		uploadId: input.UploadId,
 	}).toString();
 	validateS3RequiredParameter(!!input.MultipartUpload, 'MultipartUpload');
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
+
+	const xml = serializeCompletedMultipartUpload(input.MultipartUpload);
+	validateMultipartUploadXML(input.MultipartUpload, xml);
 
 	return {
 		method: 'POST',
 		headers,
 		url,
-		body:
-			'<?xml version="1.0" encoding="UTF-8"?>' +
-			serializeCompletedMultipartUpload(input.MultipartUpload),
+		body: '<?xml version="1.0" encoding="UTF-8"?>' + xml,
 	};
 };
 
@@ -86,7 +106,13 @@ const serializeCompletedPartList = (input: CompletedPart): string => {
 		throw new Error(`${INVALID_PARAMETER_ERROR_MSG}: ${input}`);
 	}
 
-	return `<Part><ETag>${input.ETag}</ETag><PartNumber>${input.PartNumber}</PartNumber></Part>`;
+	const eTag = `<ETag>${input.ETag}</ETag>`;
+	const partNumber = `<PartNumber>${input.PartNumber}</PartNumber>`;
+	const checksumCRC32 = input.ChecksumCRC32
+		? `<ChecksumCRC32>${input.ChecksumCRC32}</ChecksumCRC32>`
+		: '';
+
+	return `<Part>${eTag}${partNumber}${checksumCRC32}</Part>`;
 };
 
 /**
@@ -135,25 +161,24 @@ const completeMultipartUploadDeserializer = async (
 const retryWhenErrorWith200StatusCode = async (
 	response?: HttpResponse,
 	error?: unknown,
-): Promise<boolean> => {
+	middlewareContext?: MiddlewareContext,
+): Promise<RetryDeciderOutput> => {
 	if (!response) {
-		return false;
+		return { retryable: false };
 	}
 	if (response.statusCode === 200) {
 		if (!response.body) {
-			return true;
+			return { retryable: true };
 		}
 		const parsed = await parseXmlBody(response);
 		if (parsed.Code !== undefined && parsed.Message !== undefined) {
-			return true;
+			return { retryable: true };
 		}
 
-		return false;
+		return { retryable: false };
 	}
 
-	const defaultRetryDecider = defaultConfig.retryDecider;
-
-	return defaultRetryDecider(response, error);
+	return retryDecider(response, error, middlewareContext);
 };
 
 export const completeMultipartUpload = composeServiceApi(