@aws-amplify/storage 6.6.5 → 6.6.6-storage-browser.4949269.0

package/src/providers/s3/utils/resolveS3ConfigAndInput.ts

@@ -2,11 +2,25 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { AmplifyClassV6, StorageAccessLevel } from '@aws-amplify/core';
+import { CredentialsProviderOptions } from '@aws-amplify/core/internals/aws-client-utils';
 
 import { assertValidationError } from '../../../errors/utils/assertValidationError';
 import { StorageValidationErrorCode } from '../../../errors/types/validation';
 import { resolvePrefix as defaultPrefixResolver } from '../../../utils/resolvePrefix';
-import { BucketInfo, ResolvedS3Config, StorageBucket } from '../types/options';
+import {
+	StorageOperationInputWithKey,
+	StorageOperationInputWithPath,
+	StorageOperationInputWithPrefix,
+} from '../../../types/inputs';
+import { StorageError } from '../../../errors/StorageError';
+import { CopyInput, CopyWithPathInput } from '../types';
+import { INVALID_STORAGE_INPUT } from '../../../errors/constants';
+import {
+	BucketInfo,
+	LocationCredentialsProvider,
+	ResolvedS3Config,
+	StorageBucket,
+} from '../types/options';
 
 import { DEFAULT_ACCESS_LEVEL, LOCAL_TESTING_S3_ENDPOINT } from './constants';
 
@@ -14,6 +28,7 @@ interface S3ApiOptions {
 	accessLevel?: StorageAccessLevel;
 	targetIdentityId?: string;
 	useAccelerateEndpoint?: boolean;
+	locationCredentialsProvider?: LocationCredentialsProvider;
 	bucket?: StorageBucket;
 }
 
@@ -24,6 +39,16 @@ interface ResolvedS3ConfigAndInput {
 	isObjectLockEnabled?: boolean;
 	identityId?: string;
 }
+export type DeprecatedStorageInput =
+	| StorageOperationInputWithKey
+	| StorageOperationInputWithPrefix
+	| CopyInput;
+
+export type CallbackPathStorageInput =
+	| StorageOperationInputWithPath
+	| CopyWithPathInput;
+
+type StorageInput = DeprecatedStorageInput | CallbackPathStorageInput;
 
 /**
  * resolve the common input options for S3 API handlers from Amplify configuration and library options.
@@ -38,23 +63,35 @@ interface ResolvedS3ConfigAndInput {
  */
 export const resolveS3ConfigAndInput = async (
 	amplify: AmplifyClassV6,
-	apiOptions?: S3ApiOptions,
+	apiInput?: StorageInput & { options?: S3ApiOptions },
 ): Promise<ResolvedS3ConfigAndInput> => {
+	const { options: apiOptions } = apiInput ?? {};
 	/**
 	 * IdentityId is always cached in memory so we can safely make calls here. It
 	 * should be stable even for unauthenticated users, regardless of credentials.
 	 */
 	const { identityId } = await amplify.Auth.fetchAuthSession();
-	assertValidationError(!!identityId, StorageValidationErrorCode.NoIdentityId);
 
 	/**
 	 * A credentials provider function instead of a static credentials object is
 	 * used because the long-running tasks like multipart upload may span over the
 	 * credentials expiry. Auth.fetchAuthSession() automatically refreshes the
 	 * credentials if they are expired.
+	 *
+	 * The optional forceRefresh option is set when the S3 service returns expired
+	 * tokens error in the previous API call attempt.
 	 */
-	const credentialsProvider = async () => {
-		const { credentials } = await amplify.Auth.fetchAuthSession();
+	const credentialsProvider = async (options?: CredentialsProviderOptions) => {
+		if (isLocationCredentialsProvider(apiOptions)) {
+			assertStorageInput(apiInput);
+		}
+
+		// TODO: forceRefresh option of fetchAuthSession would refresh both tokens and
+		// AWS credentials. So we do not support forceRefreshing from the Auth until
+		// we support refreshing only the credentials.
+		const { credentials } = isLocationCredentialsProvider(apiOptions)
+			? await apiOptions.locationCredentialsProvider(options)
+			: await amplify.Auth.fetchAuthSession();
 		assertValidationError(
 			!!credentials,
 			StorageValidationErrorCode.NoCredentials,
@@ -82,15 +119,14 @@ export const resolveS3ConfigAndInput = async (
 		isObjectLockEnabled,
 	} = amplify.libraryOptions?.Storage?.S3 ?? {};
 
-	const keyPrefix = await prefixResolver({
-		accessLevel:
-			apiOptions?.accessLevel ?? defaultAccessLevel ?? DEFAULT_ACCESS_LEVEL,
-		// use conditional assign to make tsc happy because StorageOptions is a union type that may not have targetIdentityId
-		targetIdentityId:
-			apiOptions?.accessLevel === 'protected'
-				? (apiOptions?.targetIdentityId ?? identityId)
-				: identityId,
-	});
+	const accessLevel =
+		apiOptions?.accessLevel ?? defaultAccessLevel ?? DEFAULT_ACCESS_LEVEL;
+	const targetIdentityId =
+		accessLevel === 'protected'
+			? (apiOptions?.targetIdentityId ?? identityId)
+			: identityId;
+
+	const keyPrefix = await prefixResolver({ accessLevel, targetIdentityId });
 
 	return {
 		s3Config: {
@@ -111,6 +147,65 @@ export const resolveS3ConfigAndInput = async (
 	};
 };
 
+const isLocationCredentialsProvider = (
+	options?: S3ApiOptions,
+): options is S3ApiOptions & {
+	locationCredentialsProvider: LocationCredentialsProvider;
+} => {
+	return !!options?.locationCredentialsProvider;
+};
+
+const isInputWithCallbackPath = (input?: CallbackPathStorageInput) => {
+	return (
+		((input as StorageOperationInputWithPath)?.path &&
+			typeof (input as StorageOperationInputWithPath).path === 'function') ||
+		((input as CopyWithPathInput)?.destination?.path &&
+			typeof (input as CopyWithPathInput).destination?.path === 'function') ||
+		((input as CopyWithPathInput)?.source?.path &&
+			typeof (input as CopyWithPathInput).source?.path === 'function')
+	);
+};
+
+const isDeprecatedInput = (
+	input?: StorageInput,
+): input is DeprecatedStorageInput => {
+	return (
+		isInputWithKey(input) ||
+		isInputWithPrefix(input) ||
+		isInputWithCopySourceOrDestination(input)
+	);
+};
+const assertStorageInput = (input?: StorageInput) => {
+	if (isDeprecatedInput(input) || isInputWithCallbackPath(input)) {
+		throw new StorageError({
+			name: INVALID_STORAGE_INPUT,
+			message: 'The input needs to have a path as a string value.',
+			recoverySuggestion:
+				'Please provide a valid path as a string value for the input.',
+		});
+	}
+};
+
+const isInputWithKey = (
+	input?: StorageInput,
+): input is StorageOperationInputWithKey => {
+	return !!(typeof (input as StorageOperationInputWithKey).key === 'string');
+};
+const isInputWithPrefix = (
+	input?: StorageInput,
+): input is StorageOperationInputWithPrefix => {
+	return !!(
+		typeof (input as StorageOperationInputWithPrefix).prefix === 'string'
+	);
+};
+const isInputWithCopySourceOrDestination = (
+	input?: StorageInput,
+): input is CopyInput => {
+	return !!(
+		typeof (input as CopyInput).source?.key === 'string' ||
+		typeof (input as CopyInput).destination?.key === 'string'
+	);
+};
 const resolveBucketConfig = (
 	apiOptions: S3ApiOptions,
 	buckets: Record<string, BucketInfo> | undefined,

package/src/providers/s3/utils/validateStorageOperationInput.ts

@@ -7,6 +7,7 @@ import { StorageValidationErrorCode } from '../../../errors/types/validation';
 
 import { isInputWithPath } from './isInputWithPath';
 import { STORAGE_INPUT_KEY, STORAGE_INPUT_PATH } from './constants';
+import { resolveIdentityId } from './resolveIdentityId';
 
 export const validateStorageOperationInput = (
 	input: Input,
@@ -22,7 +23,10 @@ export const validateStorageOperationInput = (
 
 	if (isInputWithPath(input)) {
 		const { path } = input;
-		const objectKey = typeof path === 'string' ? path : path({ identityId });
+		const objectKey =
+			typeof path === 'string'
+				? path
+				: path({ identityId: resolveIdentityId(identityId) });
 
 		assertValidationError(
 			!objectKey.startsWith('/'),

package/src/providers/s3/utils/validateStorageOperationInputWithPrefix.ts

@@ -9,6 +9,7 @@ import { assertValidationError } from '../../../errors/utils/assertValidationErr
 import { StorageValidationErrorCode } from '../../../errors/types/validation';
 
 import { STORAGE_INPUT_PATH, STORAGE_INPUT_PREFIX } from './constants';
+import { resolveIdentityId } from './resolveIdentityId';
 
 // Local assertion function with StorageOperationInputWithPrefixPath as Input
 const _isInputWithPath = (
@@ -28,7 +29,10 @@ export const validateStorageOperationInputWithPrefix = (
 	);
 	if (_isInputWithPath(input)) {
 		const { path } = input;
-		const objectKey = typeof path === 'string' ? path : path({ identityId });
+		const objectKey =
+			typeof path === 'string'
+				? path
+				: path({ identityId: resolveIdentityId(identityId) });
 
 		// Assert on no leading slash in the path parameter
 		assertValidationError(

package/src/storageBrowser/apis/constants.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const DEFAULT_CRED_TTL = 15 * 60; // 15 minutes
+export const MAX_PAGE_SIZE = 1000;

package/src/storageBrowser/apis/getDataAccess.ts

@@ -0,0 +1,79 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	AmplifyErrorCode,
+	StorageAction,
+} from '@aws-amplify/core/internals/utils';
+import { CredentialsProviderOptions } from '@aws-amplify/core/internals/aws-client-utils';
+
+import { getStorageUserAgentValue } from '../../providers/s3/utils/userAgent';
+import { getDataAccess as getDataAccessClient } from '../../providers/s3/utils/client/s3control';
+import { StorageError } from '../../errors/StorageError';
+import { logger } from '../../utils';
+
+import { GetDataAccessInput, GetDataAccessOutput } from './types';
+import { DEFAULT_CRED_TTL } from './constants';
+
+export const getDataAccess = async (
+	input: GetDataAccessInput,
+): Promise<GetDataAccessOutput> => {
+	const targetType = input.scope.endsWith('*') ? undefined : 'Object';
+	const clientCredentialsProvider = async (
+		options?: CredentialsProviderOptions,
+	) => {
+		const { credentials } = await input.credentialsProvider(options);
+
+		return credentials;
+	};
+
+	const result = await getDataAccessClient(
+		{
+			credentials: clientCredentialsProvider,
+			region: input.region,
+			userAgentValue: getStorageUserAgentValue(StorageAction.GetDataAccess),
+		},
+		{
+			AccountId: input.accountId,
+			Target: input.scope,
+			Permission: input.permission,
+			TargetType: targetType,
+			DurationSeconds: DEFAULT_CRED_TTL,
+		},
+	);
+
+	const grantCredentials = result.Credentials;
+
+	// Ensure that S3 returned credentials (this shouldn't happen)
+	if (
+		!grantCredentials ||
+		!grantCredentials.AccessKeyId ||
+		!grantCredentials.SecretAccessKey ||
+		!grantCredentials.SessionToken ||
+		!grantCredentials.Expiration
+	) {
+		throw new StorageError({
+			name: AmplifyErrorCode.Unknown,
+			message: 'Service did not return valid temporary credentials.',
+		});
+	} else {
+		logger.debug(`Retrieved credentials for: ${result.MatchedGrantTarget}`);
+	}
+
+	const {
+		AccessKeyId: accessKeyId,
+		SecretAccessKey: secretAccessKey,
+		SessionToken: sessionToken,
+		Expiration: expiration,
+	} = grantCredentials;
+
+	return {
+		credentials: {
+			accessKeyId,
+			secretAccessKey,
+			sessionToken,
+			expiration,
+		},
+		scope: result.MatchedGrantTarget,
+	};
+};

package/src/storageBrowser/apis/listCallerAccessGrants.ts

@@ -0,0 +1,94 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { StorageAction } from '@aws-amplify/core/internals/utils';
+import { CredentialsProviderOptions } from '@aws-amplify/core/internals/aws-client-utils';
+
+import { logger } from '../../utils';
+import { listCallerAccessGrants as listCallerAccessGrantsClient } from '../../providers/s3/utils/client/s3control';
+import { LocationAccess, LocationType } from '../types';
+import { StorageError } from '../../errors/StorageError';
+import { getStorageUserAgentValue } from '../../providers/s3/utils/userAgent';
+
+import {
+	ListCallerAccessGrantsInput,
+	ListCallerAccessGrantsOutput,
+} from './types';
+import { MAX_PAGE_SIZE } from './constants';
+
+export const listCallerAccessGrants = async (
+	input: ListCallerAccessGrantsInput,
+): Promise<ListCallerAccessGrantsOutput> => {
+	const { credentialsProvider, accountId, region, nextToken, pageSize } = input;
+
+	logger.debug(`listing available locations from account ${input.accountId}`);
+
+	if (!!pageSize && pageSize > MAX_PAGE_SIZE) {
+		logger.debug(`defaulting pageSize to ${MAX_PAGE_SIZE}.`);
+	}
+
+	const clientCredentialsProvider = async (
+		options?: CredentialsProviderOptions,
+	) => {
+		const { credentials } = await credentialsProvider(options);
+
+		return credentials;
+	};
+
+	const { CallerAccessGrantsList, NextToken } =
+		await listCallerAccessGrantsClient(
+			{
+				credentials: clientCredentialsProvider,
+				region,
+				userAgentValue: getStorageUserAgentValue(
+					StorageAction.ListCallerAccessGrants,
+				),
+			},
+			{
+				AccountId: accountId,
+				NextToken: nextToken,
+				MaxResults: pageSize ?? MAX_PAGE_SIZE,
+			},
+		);
+
+	const accessGrants: LocationAccess[] =
+		CallerAccessGrantsList?.map(grant => {
+			assertGrantScope(grant.GrantScope);
+
+			return {
+				scope: grant.GrantScope,
+				permission: grant.Permission!,
+				type: parseGrantType(grant.GrantScope!),
+			};
+		}) ?? [];
+
+	return {
+		locations: accessGrants,
+		nextToken: NextToken,
+	};
+};
+
+const parseGrantType = (grantScope: string): LocationType => {
+	const bucketScopeReg = /^s3:\/\/(.*)\/\*$/;
+	const possibleBucketName = grantScope.match(bucketScopeReg)?.[1];
+	if (!grantScope.endsWith('*')) {
+		return 'OBJECT';
+	} else if (
+		grantScope.endsWith('/*') &&
+		possibleBucketName &&
+		possibleBucketName.indexOf('/') === -1
+	) {
+		return 'BUCKET';
+	} else {
+		return 'PREFIX';
+	}
+};
+
+function assertGrantScope(value: unknown): asserts value is string {
+	if (typeof value !== 'string' || !value.startsWith('s3://')) {
+		throw new StorageError({
+			name: 'InvalidGrantScope',
+			message: `Expected a valid grant scope, got ${value}`,
+		});
+	}
+}

package/src/storageBrowser/apis/types.ts

@@ -0,0 +1,33 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	CredentialsProvider,
+	ListLocationsInput,
+	ListLocationsOutput,
+	LocationCredentials,
+	Permission,
+	PrefixType,
+	Privilege,
+} from '../types';
+
+export interface ListCallerAccessGrantsInput extends ListLocationsInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	region: string;
+}
+
+export type ListCallerAccessGrantsOutput = ListLocationsOutput;
+
+export interface GetDataAccessInput {
+	accountId: string;
+	credentialsProvider: CredentialsProvider;
+	durationSeconds?: number;
+	permission: Permission;
+	prefixType?: PrefixType;
+	privilege?: Privilege;
+	region: string;
+	scope: string;
+}
+
+export type GetDataAccessOutput = LocationCredentials;

package/src/storageBrowser/index.ts

@@ -0,0 +1,25 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { LocationCredentialsProvider } from '../providers/s3/types/options';
+export { StorageSubpathStrategy } from '../types/options';
+
+export { createLocationCredentialsStore } from './locationCredentialsStore';
+export {
+	AuthConfigAdapter,
+	createManagedAuthConfigAdapter,
+	CreateManagedAuthConfigAdapterInput,
+} from './managedAuthConfigAdapter';
+export {
+	GetLocationCredentials,
+	ListLocations,
+	LocationCredentialsStore,
+	CreateLocationCredentialsStoreInput,
+	LocationCredentials,
+	ListLocationsInput,
+	ListLocationsOutput,
+	GetLocationCredentialsInput,
+	GetLocationCredentialsOutput,
+	Permission,
+} from './types';
+export { AWSTemporaryCredentials } from '../providers/s3/types/options';

package/src/storageBrowser/locationCredentialsStore/constants.ts

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const CREDENTIALS_STORE_DEFAULT_SIZE = 10;
+export const CREDENTIALS_REFRESH_WINDOW_MS = 30_000;

package/src/storageBrowser/locationCredentialsStore/create.ts

@@ -0,0 +1,54 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+	CreateLocationCredentialsStoreInput,
+	CredentialsLocation,
+	LocationCredentialsStore,
+} from '../types';
+import { StorageValidationErrorCode } from '../../errors/types/validation';
+import { assertValidationError } from '../../errors/utils/assertValidationError';
+import { LocationCredentialsProvider } from '../../providers/s3/types/options';
+
+import { createStore, getValue, removeStore } from './registry';
+
+export const createLocationCredentialsStore = (
+	input: CreateLocationCredentialsStoreInput,
+): LocationCredentialsStore => {
+	const storeSymbol = createStore(input.handler);
+
+	const store = {
+		getProvider(providerLocation: CredentialsLocation) {
+			const locationCredentialsProvider = async ({
+				forceRefresh = false,
+			}: Parameters<LocationCredentialsProvider>[0] = {}) => {
+				validateS3Uri(providerLocation.scope);
+
+				// TODO(@AllanZhengYP): validate the action bucket and paths matches provider scope.
+				return getValue({
+					storeSymbol,
+					location: { ...providerLocation },
+					forceRefresh,
+				});
+			};
+
+			return locationCredentialsProvider;
+		},
+
+		destroy() {
+			removeStore(storeSymbol);
+		},
+	};
+
+	return store;
+};
+
+type S3Uri = string;
+
+const validateS3Uri = (uri: S3Uri): void => {
+	const s3UrlSchemaRegex = /^s3:\/\/[^/]+/;
+	assertValidationError(
+		s3UrlSchemaRegex.test(uri),
+		StorageValidationErrorCode.InvalidS3Uri,
+	);
+};

package/src/storageBrowser/locationCredentialsStore/index.ts

@@ -0,0 +1,4 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export { createLocationCredentialsStore } from './create';

package/src/storageBrowser/locationCredentialsStore/registry.ts

@@ -0,0 +1,88 @@
+/* eslint-disable unused-imports/no-unused-vars */
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { AWSTemporaryCredentials } from '../../providers/s3/types/options';
+import { CredentialsLocation, GetLocationCredentials } from '../types';
+import { assertValidationError } from '../../errors/utils/assertValidationError';
+import { StorageValidationErrorCode } from '../../errors/types/validation';
+
+import {
+	LruLocationCredentialsStore,
+	fetchNewValue,
+	getCacheValue,
+	initStore,
+} from './store';
+
+interface StoreRegistrySymbol {
+	readonly value: symbol;
+}
+
+/**
+ * Keep all cache records for all instances of credentials store in a singleton
+ * so we can reliably de-reference from the memory when we destroy a store
+ * instance.
+ */
+const storeRegistry = new WeakMap<
+	StoreRegistrySymbol,
+	LruLocationCredentialsStore
+>();
+
+/**
+ * @internal
+ */
+export const createStore = (
+	refreshHandler: GetLocationCredentials,
+	size?: number,
+) => {
+	const storeSymbol = { value: Symbol('LocationCredentialsStore') };
+	storeRegistry.set(storeSymbol, initStore(refreshHandler, size));
+
+	return storeSymbol;
+};
+
+const getLookUpLocations = (location: CredentialsLocation) => {
+	const { scope, permission } = location;
+	const locations = [{ scope, permission }];
+	if (permission === 'READ' || permission === 'WRITE') {
+		locations.push({ scope, permission: 'READWRITE' });
+	}
+
+	return locations;
+};
+
+const getCredentialsStore = (storeSymbol: StoreRegistrySymbol) => {
+	assertValidationError(
+		storeRegistry.has(storeSymbol),
+		StorageValidationErrorCode.LocationCredentialsStoreDestroyed,
+	);
+
+	return storeRegistry.get(storeSymbol)!;
+};
+
+/**
+ * @internal
+ */
+export const getValue = async (input: {
+	storeSymbol: StoreRegistrySymbol;
+	location: CredentialsLocation;
+	forceRefresh: boolean;
+}): Promise<{ credentials: AWSTemporaryCredentials }> => {
+	const { storeSymbol: storeReference, location, forceRefresh } = input;
+	const store = getCredentialsStore(storeReference);
+	if (!forceRefresh) {
+		const lookupLocations = getLookUpLocations(location);
+		for (const lookupLocation of lookupLocations) {
+			const credentials = getCacheValue(store, lookupLocation);
+			if (credentials !== null) {
+				return { credentials };
+			}
+		}
+	}
+
+	return fetchNewValue(store, location);
+};
+
+export const removeStore = (storeSymbol: StoreRegistrySymbol) => {
+	storeRegistry.delete(storeSymbol);
+};