@aws-amplify/storage 6.6.10 → 6.6.11-storage-browser-integrity.2a9053f.0

package/src/providers/s3/utils/client/{copyObject.ts → s3data/copyObject.ts}

@@ -10,18 +10,21 @@ import {
 import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import type { CopyObjectCommandInput, CopyObjectCommandOutput } from './types';
-import { defaultConfig } from './base';
 import {
 	assignStringVariables,
+	bothNilOrEqual,
 	buildStorageServiceError,
 	parseXmlBody,
-	parseXmlError,
 	s3TransferHandler,
 	serializeObjectConfigsToHeaders,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { IntegrityError } from '../../../../../errors/IntegrityError';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import type { CopyObjectCommandInput, CopyObjectCommandOutput } from './types';
+import { defaultConfig, parseXmlError } from './base';
 
 export type CopyObjectInput = Pick<
 	CopyObjectCommandInput,
@@ -37,6 +40,10 @@ export type CopyObjectInput = Pick<
 	| 'ACL'
 	| 'Tagging'
 	| 'Metadata'
+	| 'CopySourceIfUnmodifiedSince'
+	| 'CopySourceIfMatch'
+	| 'ExpectedSourceBucketOwner'
+	| 'ExpectedBucketOwner'
 >;
 
 export type CopyObjectOutput = CopyObjectCommandOutput;
@@ -50,11 +57,22 @@ const copyObjectSerializer = async (
 		...assignStringVariables({
 			'x-amz-copy-source': input.CopySource,
 			'x-amz-metadata-directive': input.MetadataDirective,
+			'x-amz-copy-source-if-match': input.CopySourceIfMatch,
+			'x-amz-copy-source-if-unmodified-since':
+				input.CopySourceIfUnmodifiedSince?.toISOString(),
+			'x-amz-source-expected-bucket-owner': input.ExpectedSourceBucketOwner,
+			'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
 		}),
 	};
+	validateCopyObjectHeaders(input, headers);
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
 	url.pathname = serializePathnameObjectKey(url, input.Key);
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
 
 	return {
 		method: 'PUT',
@@ -63,6 +81,31 @@ const copyObjectSerializer = async (
 	};
 };
 
+export const validateCopyObjectHeaders = (
+	input: CopyObjectInput,
+	headers: Record<string, string>,
+) => {
+	const validations: boolean[] = [
+		headers['x-amz-copy-source'] === input.CopySource,
+		bothNilOrEqual(
+			input.MetadataDirective,
+			headers['x-amz-metadata-directive'],
+		),
+		bothNilOrEqual(
+			input.CopySourceIfMatch,
+			headers['x-amz-copy-source-if-match'],
+		),
+		bothNilOrEqual(
+			input.CopySourceIfUnmodifiedSince?.toISOString(),
+			headers['x-amz-copy-source-if-unmodified-since'],
+		),
+	];
+
+	if (validations.some(validation => !validation)) {
+		throw new IntegrityError();
+	}
+};
+
 const copyObjectDeserializer = async (
 	response: HttpResponse,
 ): Promise<CopyObjectOutput> => {

package/src/providers/s3/utils/client/{createMultipartUpload.ts → s3data/createMultipartUpload.ts}

@@ -10,22 +10,24 @@ import {
 import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import type {
-	CreateMultipartUploadCommandInput,
-	CreateMultipartUploadCommandOutput,
-} from './types';
-import type { PutObjectInput } from './putObject';
-import { defaultConfig } from './base';
 import {
+	assignStringVariables,
 	buildStorageServiceError,
 	map,
 	parseXmlBody,
-	parseXmlError,
 	s3TransferHandler,
 	serializeObjectConfigsToHeaders,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import type {
+	CreateMultipartUploadCommandInput,
+	CreateMultipartUploadCommandOutput,
+} from './types';
+import type { PutObjectInput } from './putObject';
+import { defaultConfig, parseXmlError } from './base';
 
 export type CreateMultipartUploadInput = Extract<
 	CreateMultipartUploadCommandInput,
@@ -41,11 +43,22 @@ const createMultipartUploadSerializer = async (
 	input: CreateMultipartUploadInput,
 	endpoint: Endpoint,
 ): Promise<HttpRequest> => {
-	const headers = await serializeObjectConfigsToHeaders(input);
+	const headers = {
+		...(await serializeObjectConfigsToHeaders(input)),
+		...assignStringVariables({
+			'x-amz-checksum-algorithm': input.ChecksumAlgorithm,
+			'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+		}),
+	};
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
 	url.pathname = serializePathnameObjectKey(url, input.Key);
 	url.search = 'uploads';
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
 
 	return {
 		method: 'POST',

package/src/providers/s3/utils/client/{deleteObject.ts → s3data/deleteObject.ts}

@@ -10,24 +10,26 @@ import {
 import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import type {
-	DeleteObjectCommandInput,
-	DeleteObjectCommandOutput,
-} from './types';
-import { defaultConfig } from './base';
 import {
+	assignStringVariables,
 	buildStorageServiceError,
 	deserializeBoolean,
 	map,
-	parseXmlError,
 	s3TransferHandler,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import type {
+	DeleteObjectCommandInput,
+	DeleteObjectCommandOutput,
+} from './types';
+import { defaultConfig, parseXmlError } from './base';
 
 export type DeleteObjectInput = Pick<
 	DeleteObjectCommandInput,
-	'Bucket' | 'Key'
+	'Bucket' | 'Key' | 'ExpectedBucketOwner'
 >;
 
 export type DeleteObjectOutput = DeleteObjectCommandOutput;
@@ -39,10 +41,18 @@ const deleteObjectSerializer = (
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
 	url.pathname = serializePathnameObjectKey(url, input.Key);
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
+	const headers = assignStringVariables({
+		'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+	});
 
 	return {
 		method: 'DELETE',
-		headers: {},
+		headers,
 		url,
 	};
 };

package/src/providers/s3/utils/client/{getObject.ts → s3data/getObject.ts}

@@ -11,28 +11,34 @@ import {
 	parseMetadata,
 	presignUrl,
 } from '@aws-amplify/core/internals/aws-client-utils';
-import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
+import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
 
-import { S3EndpointResolverOptions, defaultConfig } from './base';
-import type {
-	CompatibleHttpResponse,
-	GetObjectCommandInput,
-	GetObjectCommandOutput,
-} from './types';
 import {
 	CONTENT_SHA256_HEADER,
+	assignStringVariables,
 	buildStorageServiceError,
 	deserializeBoolean,
 	deserializeMetadata,
 	deserializeNumber,
 	deserializeTimestamp,
 	map,
-	parseXmlError,
 	s3TransferHandler,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import {
+	S3EndpointResolverOptions,
+	defaultConfig,
+	parseXmlError,
+} from './base';
+import type {
+	CompatibleHttpResponse,
+	GetObjectCommandInput,
+	GetObjectCommandOutput,
+} from './types';
 
 const USER_AGENT_HEADER = 'x-amz-user-agent';
 
@@ -43,6 +49,7 @@ export type GetObjectInput = Pick<
 	| 'Range'
 	| 'ResponseContentDisposition'
 	| 'ResponseContentType'
+	| 'ExpectedBucketOwner'
 >;
 
 export type GetObjectOutput = GetObjectCommandOutput;
@@ -54,11 +61,19 @@ const getObjectSerializer = async (
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
 	url.pathname = serializePathnameObjectKey(url, input.Key);
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
 
 	return {
 		method: 'GET',
 		headers: {
 			...(input.Range && { Range: input.Range }),
+			...assignStringVariables({
+				'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+			}),
 		},
 		url,
 	};

package/src/providers/s3/utils/client/{headObject.ts → s3data/headObject.ts}

@@ -10,21 +10,26 @@ import {
 import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import { defaultConfig } from './base';
-import type { HeadObjectCommandInput, HeadObjectCommandOutput } from './types';
 import {
+	assignStringVariables,
 	buildStorageServiceError,
 	deserializeMetadata,
 	deserializeNumber,
 	deserializeTimestamp,
 	map,
-	parseXmlError,
 	s3TransferHandler,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import { defaultConfig, parseXmlError } from './base';
+import type { HeadObjectCommandInput, HeadObjectCommandOutput } from './types';
 
-export type HeadObjectInput = Pick<HeadObjectCommandInput, 'Bucket' | 'Key'>;
+export type HeadObjectInput = Pick<
+	HeadObjectCommandInput,
+	'Bucket' | 'Key' | 'ExpectedBucketOwner'
+>;
 
 export type HeadObjectOutput = Pick<
 	HeadObjectCommandOutput,
@@ -44,10 +49,18 @@ const headObjectSerializer = async (
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
 	url.pathname = serializePathnameObjectKey(url, input.Key);
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
+	const headers = assignStringVariables({
+		'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+	});
 
 	return {
 		method: 'HEAD',
-		headers: {},
+		headers,
 		url,
 	};
 };

package/src/providers/s3/utils/client/{listObjectsV2.ts → s3data/listObjectsV2.ts}

@@ -13,11 +13,6 @@ import {
 } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import type {
-	ListObjectsV2CommandInput,
-	ListObjectsV2CommandOutput,
-} from './types';
-import { defaultConfig } from './base';
 import {
 	assignStringVariables,
 	buildStorageServiceError,
@@ -27,9 +22,15 @@ import {
 	emptyArrayGuard,
 	map,
 	parseXmlBody,
-	parseXmlError,
 	s3TransferHandler,
-} from './utils';
+} from '../utils';
+import { IntegrityError } from '../../../../../errors/IntegrityError';
+
+import type {
+	ListObjectsV2CommandInput,
+	ListObjectsV2CommandOutput,
+} from './types';
+import { defaultConfig, parseXmlError } from './base';
 
 export type ListObjectsV2Input = ListObjectsV2CommandInput;
 
@@ -93,10 +94,13 @@ const listObjectsV2Deserializer = async (
 			StartAfter: 'StartAfter',
 		});
 
-		return {
+		const output = {
 			$metadata: parseMetadata(response),
 			...contents,
 		};
+		validateCorroboratingElements(output);
+
+		return output;
 	}
 };
 
@@ -130,6 +134,27 @@ const deserializeChecksumAlgorithmList = (output: any[]) =>
 const deserializeOwner = (output: any) =>
 	map(output, { DisplayName: 'DisplayName', ID: 'ID' });
 
+const validateCorroboratingElements = (response: ListObjectsV2Output) => {
+	const {
+		IsTruncated,
+		KeyCount,
+		Contents = [],
+		CommonPrefixes = [],
+		NextContinuationToken,
+	} = response;
+
+	const validTruncation =
+		(IsTruncated && !!NextContinuationToken) ||
+		(!IsTruncated && !NextContinuationToken);
+
+	const validNumberOfKeysReturned =
+		KeyCount === Contents.length + CommonPrefixes.length;
+
+	if (!validTruncation || !validNumberOfKeysReturned) {
+		throw new IntegrityError();
+	}
+};
+
 export const listObjectsV2 = composeServiceApi(
 	s3TransferHandler,
 	listObjectsV2Serializer,

package/src/providers/s3/utils/client/{listParts.ts → s3data/listParts.ts}

@@ -13,23 +13,19 @@ import {
 } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import type {
-	CompletedPart,
-	ListPartsCommandInput,
-	ListPartsCommandOutput,
-} from './types';
-import { defaultConfig } from './base';
 import {
 	buildStorageServiceError,
-	deserializeNumber,
+	deserializeCompletedPartList,
 	emptyArrayGuard,
 	map,
 	parseXmlBody,
-	parseXmlError,
 	s3TransferHandler,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+
+import type { ListPartsCommandInput, ListPartsCommandOutput } from './types';
+import { defaultConfig, parseXmlError } from './base';
 
 export type ListPartsInput = Pick<
 	ListPartsCommandInput,
@@ -84,15 +80,6 @@ const listPartsDeserializer = async (
 	}
 };
 
-const deserializeCompletedPartList = (input: any[]): CompletedPart[] =>
-	input.map(item =>
-		map(item, {
-			PartNumber: ['PartNumber', deserializeNumber],
-			ETag: 'ETag',
-			Size: ['Size', deserializeNumber],
-		}),
-	);
-
 export const listParts = composeServiceApi(
 	s3TransferHandler,
 	listPartsSerializer,

package/src/providers/s3/utils/client/{putObject.ts → s3data/putObject.ts}

@@ -10,18 +10,19 @@ import {
 import { AmplifyUrl } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import { defaultConfig } from './base';
-import type { PutObjectCommandInput, PutObjectCommandOutput } from './types';
 import {
 	assignStringVariables,
 	buildStorageServiceError,
 	map,
-	parseXmlError,
 	s3TransferHandler,
 	serializeObjectConfigsToHeaders,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import { defaultConfig, parseXmlError } from './base';
+import type { PutObjectCommandInput, PutObjectCommandOutput } from './types';
 
 export type PutObjectInput = Pick<
 	PutObjectCommandInput,
@@ -37,6 +38,8 @@ export type PutObjectInput = Pick<
 	| 'Expires'
 	| 'Metadata'
 	| 'Tagging'
+	| 'ChecksumCRC32'
+	| 'ExpectedBucketOwner'
 >;
 
 export type PutObjectOutput = Pick<
@@ -55,11 +58,20 @@ const putObjectSerializer = async (
 			...input,
 			ContentType: input.ContentType ?? 'application/octet-stream',
 		})),
-		...assignStringVariables({ 'content-md5': input.ContentMD5 }),
+		...assignStringVariables({
+			'content-md5': input.ContentMD5,
+			'x-amz-checksum-crc32': input.ChecksumCRC32,
+			'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+		}),
 	};
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
 	url.pathname = serializePathnameObjectKey(url, input.Key);
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
 
 	return {
 		method: 'PUT',

package/src/providers/s3/utils/client/{uploadPart.ts → s3data/uploadPart.ts}

@@ -13,23 +13,31 @@ import {
 } from '@aws-amplify/core/internals/utils';
 import { composeServiceApi } from '@aws-amplify/core/internals/aws-client-utils/composers';
 
-import { defaultConfig } from './base';
-import type { UploadPartCommandInput, UploadPartCommandOutput } from './types';
 import {
 	assignStringVariables,
 	buildStorageServiceError,
 	map,
-	parseXmlError,
 	s3TransferHandler,
 	serializePathnameObjectKey,
 	validateS3RequiredParameter,
-} from './utils';
+} from '../utils';
+import { validateObjectUrl } from '../../validateObjectUrl';
+
+import { defaultConfig, parseXmlError } from './base';
+import type { UploadPartCommandInput, UploadPartCommandOutput } from './types';
 
 // Content-length is ignored here because it's forbidden header
 // and will be set by browser or fetch polyfill.
 export type UploadPartInput = Pick<
 	UploadPartCommandInput,
-	'PartNumber' | 'Body' | 'UploadId' | 'Bucket' | 'Key' | 'ContentMD5'
+	| 'PartNumber'
+	| 'Body'
+	| 'UploadId'
+	| 'Bucket'
+	| 'Key'
+	| 'ContentMD5'
+	| 'ChecksumCRC32'
+	| 'ExpectedBucketOwner'
 >;
 
 export type UploadPartOutput = Pick<
@@ -42,9 +50,13 @@ const uploadPartSerializer = async (
 	endpoint: Endpoint,
 ): Promise<HttpRequest> => {
 	const headers = {
-		...assignStringVariables({ 'content-md5': input.ContentMD5 }),
+		...assignStringVariables({
+			'x-amz-checksum-crc32': input.ChecksumCRC32,
+			'content-md5': input.ContentMD5,
+			'x-amz-expected-bucket-owner': input.ExpectedBucketOwner,
+		}),
+		'content-type': 'application/octet-stream',
 	};
-	headers['content-type'] = 'application/octet-stream';
 	const url = new AmplifyUrl(endpoint.url.toString());
 	validateS3RequiredParameter(!!input.Key, 'Key');
 	url.pathname = serializePathnameObjectKey(url, input.Key);
@@ -54,6 +66,11 @@ const uploadPartSerializer = async (
 		partNumber: input.PartNumber + '',
 		uploadId: input.UploadId,
 	}).toString();
+	validateObjectUrl({
+		bucketName: input.Bucket,
+		key: input.Key,
+		objectURL: url,
+	});
 
 	return {
 		method: 'PUT',

package/src/providers/s3/utils/client/utils/createRetryDecider.ts

@@ -0,0 +1,96 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import {
+	ErrorParser,
+	HttpResponse,
+	MiddlewareContext,
+	RetryDeciderOutput,
+	getRetryDecider,
+} from '@aws-amplify/core/internals/aws-client-utils';
+
+import { LocationCredentialsProvider } from '../../../types/options';
+
+/**
+ * Function to decide if the S3 request should be retried. For S3 APIs, we support forceRefresh option
+ * for {@link LocationCredentialsProvider | LocationCredentialsProvider } option. It's set when S3 returns
+ * credentials expired error. In the retry decider, we detect this response and set flag to signify a retry
+ * attempt. The retry attempt would invoke the LocationCredentialsProvider with forceRefresh option set.
+ *
+ * @param response Optional response of the request.
+ * @param error Optional error thrown from previous attempts.
+ * @param middlewareContext Optional context object to store data between retries.
+ * @returns True if the request should be retried.
+ */
+export type RetryDecider = (
+	response?: HttpResponse,
+	error?: unknown,
+	middlewareContext?: MiddlewareContext,
+) => Promise<RetryDeciderOutput>;
+
+/**
+ * Factory of a {@link RetryDecider} function.
+ *
+ * @param errorParser function to parse HTTP response wth XML payload to JS
+ * 	Error instance.
+ * @returns A structure indicating if the response is retryable; And if it is a
+ * 	CredentialsExpiredError
+ */
+export const createRetryDecider =
+	(errorParser: ErrorParser): RetryDecider =>
+	async (
+		response?: HttpResponse,
+		error?: unknown,
+		middlewareContext?: MiddlewareContext,
+	): Promise<RetryDeciderOutput> => {
+		const defaultRetryDecider = getRetryDecider(errorParser);
+		const defaultRetryDecision = await defaultRetryDecider(response, error);
+		if (!response || response.statusCode < 300) {
+			return { retryable: false };
+		}
+		const parsedError = await errorParser(response);
+		const errorCode = parsedError?.name;
+		const errorMessage = parsedError?.message;
+		const isCredentialsExpired = isCredentialsExpiredError(
+			errorCode,
+			errorMessage,
+		);
+
+		return {
+			retryable:
+				defaultRetryDecision.retryable ||
+				// If we know the previous retry attempt sets isCredentialsExpired in the
+				// middleware context, we don't want to retry anymore.
+				!!(isCredentialsExpired && !middlewareContext?.isCredentialsExpired),
+			isCredentialsExpiredError: isCredentialsExpired,
+		};
+	};
+
+// Ref: https://github.com/aws/aws-sdk-js/blob/54829e341181b41573c419bd870dd0e0f8f10632/lib/event_listeners.js#L522-L541
+const INVALID_TOKEN_ERROR_CODES = [
+	'RequestExpired',
+	'ExpiredTokenException',
+	'ExpiredToken',
+];
+
+/**
+ * Given an error code, returns true if it is related to invalid credentials.
+ *
+ * @param errorCode String representation of some error.
+ * @returns True if given error indicates the credentials used to authorize request
+ * are invalid.
+ */
+const isCredentialsExpiredError = (
+	errorCode?: string,
+	errorMessage?: string,
+) => {
+	const isExpiredTokenError =
+		!!errorCode && INVALID_TOKEN_ERROR_CODES.includes(errorCode);
+	// Ref: https://github.com/aws/aws-sdk-js/blob/54829e341181b41573c419bd870dd0e0f8f10632/lib/event_listeners.js#L536-L539
+	const isExpiredSignatureError =
+		!!errorCode &&
+		!!errorMessage &&
+		errorCode.includes('Signature') &&
+		errorMessage.includes('expired');
+
+	return isExpiredTokenError || isExpiredSignatureError;
+};