@carlonicora/nestjs-neo4jsonapi 4.17.3 → 4.18.0

package/dist/foundations/s3/services/s3.service.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.S3Service = void 0;
 const client_s3_1 = require("@aws-sdk/client-s3");
 const lib_storage_1 = require("@aws-sdk/lib-storage");
-const s3_request_presigner_1 = require("@aws-sdk/s3-request-presigner");
+const stream_1 = require("stream");
 const storage_blob_1 = require("@azure/storage-blob");
 const common_1 = require("@nestjs/common");
 const config_1 = require("@nestjs/config");
@@ -21,16 +21,117 @@ const nestjs_cls_1 = require("nestjs-cls");
 const jsonapi_service_1 = require("../../../core/jsonapi/services/jsonapi.service");
 const logging_service_1 = require("../../../core/logging/services/logging.service");
 const s3_model_1 = require("../../s3/entities/s3.model");
+const s3_meta_1 = require("../../s3/entities/s3.meta");
+const s3_cipher_core_1 = require("../cipher/s3-cipher.core");
+const s3_cipher_service_1 = require("./s3-cipher.service");
 let S3Service = class S3Service {
-    constructor(builder, clsService, configService, logger) {
+    constructor(builder, clsService, configService, logger, cipher) {
         this.builder = builder;
         this.clsService = clsService;
         this.configService = configService;
         this.logger = logger;
+        this.cipher = cipher;
     }
     get s3Config() {
         return this.configService.get("s3");
     }
+    /** Token-verified api URL served by S3Controller: `${api.url}s3/objects/<token>`. */
+    _apiObjectUrl(token) {
+        return `${this.configService.get("api").url}${s3_meta_1.s3Meta.endpoint}/${s3_meta_1.S3_OBJECTS_SEGMENT}/${token}`;
+    }
+    /** Object metadata flag for an encrypted write, or undefined when the key is stored as plaintext. */
+    _metadataFor(key) {
+        return this.cipher.shouldEncrypt(key) ? { [s3_cipher_core_1.S3_ENCRYPTION_METADATA_KEY]: s3_cipher_core_1.S3_ENCRYPTION_METADATA_VALUE } : undefined;
+    }
+    /** Body and metadata to write for `key`: ciphertext plus the flag when encrypting, the buffer untouched otherwise. */
+    async _prepareBody(key, buffer) {
+        const metadata = this._metadataFor(key);
+        if (!metadata)
+            return { body: buffer, metadata: undefined };
+        return { body: await this.cipher.encrypt(buffer), metadata };
+    }
+    /** Throws when a flagged object cannot be opened: ciphertext is never returned to a caller. */
+    _assertCanDecrypt(key) {
+        if (!this.cipher.canDecrypt)
+            throw new s3_cipher_core_1.S3CipherKeyMissingError([], key);
+    }
+    /** The cipher does not know the storage key; name it in a missing-key error. */
+    _withObjectKey(error, key) {
+        if (error instanceof s3_cipher_core_1.S3CipherKeyMissingError && !error.objectKey) {
+            return new s3_cipher_core_1.S3CipherKeyMissingError(error.keyIds, key);
+        }
+        return error;
+    }
+    /** Decrypts the stored bytes when the object metadata (S3 `Metadata` / Azure `metadata`) carries the flag. */
+    async _readBody(key, metadata, bytes) {
+        if (!(0, s3_cipher_core_1.isEncryptedObjectMetadata)(metadata))
+            return bytes;
+        this._assertCanDecrypt(key);
+        try {
+            return await this.cipher.decrypt(bytes);
+        }
+        catch (error) {
+            throw this._withObjectKey(error, key);
+        }
+    }
+    /** Streaming counterpart of `_readBody`: a flagged object is piped through the cipher's decrypt stream. */
+    _readStream(key, metadata, stream) {
+        if (!(0, s3_cipher_core_1.isEncryptedObjectMetadata)(metadata))
+            return stream;
+        this._assertCanDecrypt(key);
+        const decrypting = this.cipher.decryptStream();
+        (0, stream_1.pipeline)(stream, decrypting, (error) => {
+            if (error)
+                this.logger.error(`Failed to decrypt object stream ${key}`, this._withObjectKey(error, key));
+        });
+        return decrypting;
+    }
+    /**
+     * `_readStream`, but for a flagged object it waits for the first decrypted chunk (or the end), so a
+     * failure before any byte (a key that is not configured) rejects here, before a response starts,
+     * instead of breaking a response that is already under way.
+     */
+    async _readStreamReady(key, metadata, body) {
+        const stream = this._readStream(key, metadata, body);
+        if (stream === body)
+            return stream;
+        try {
+            return await new Promise((resolve, reject) => {
+                const cleanup = () => {
+                    stream.off("data", onData);
+                    stream.off("end", onEnd);
+                    stream.off("error", onError);
+                };
+                const onData = (chunk) => {
+                    cleanup();
+                    stream.pause();
+                    stream.unshift(chunk);
+                    resolve(stream);
+                };
+                const onEnd = () => {
+                    cleanup();
+                    resolve(stream_1.Readable.from([]));
+                };
+                const onError = (error) => {
+                    cleanup();
+                    reject(error);
+                };
+                stream.on("data", onData);
+                stream.on("end", onEnd);
+                stream.on("error", onError);
+            });
+        }
+        catch (error) {
+            throw this._withObjectKey(error, key);
+        }
+    }
+    async _streamToBuffer(stream) {
+        const chunks = [];
+        for await (const chunk of stream) {
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        }
+        return Buffer.concat(chunks);
+    }
     async _loadConfiguration() {
         const type = this.s3Config.type;
         this._storageType = type;
@@ -102,61 +203,25 @@ let S3Service = class S3Service {
                 break;
         }
     }
-    async _prepareUrl(params) {
-        if (this._storageType === "azure")
-            return await this._prepareAzureUrl(params);
-        const isPublic = params.isPublic ?? false;
-        const command = isPublic
-            ? new client_s3_1.PutObjectCommand({
-                Bucket: this._bucket,
-                Key: params.key,
-                ContentType: params.contentType,
-                ACL: "public-read",
-            })
-            : new client_s3_1.PutObjectCommand({
-                Bucket: this._bucket,
-                ContentType: params.contentType,
-                Key: params.key,
-            });
-        const signedUrl = await (0, s3_request_presigner_1.getSignedUrl)(this.s3Client, command, {
-            expiresIn: 3600,
-        });
-        return signedUrl;
-    }
-    async _prepareAzureUrl(params) {
-        const blobClient = this.containerClient.getBlockBlobClient(params.key);
-        // For Azure, we need to check if we have shared key credentials to generate SAS
-        const credential = this.blobServiceClient.credential;
-        if (credential instanceof storage_blob_1.StorageSharedKeyCredential) {
-            const sasToken = (0, storage_blob_1.generateBlobSASQueryParameters)({
-                containerName: this._bucket,
-                blobName: params.key,
-                permissions: storage_blob_1.BlobSASPermissions.parse("racw"), // Read, Add, Create, Write permissions
-                startsOn: new Date(new Date().valueOf() - 15 * 60 * 1000), // Start 15 minutes ago to account for clock skew
-                expiresOn: new Date(new Date().valueOf() + 3600 * 1000), // 1 hour from now
-                protocol: storage_blob_1.SASProtocol.Https,
-                contentType: params.contentType, // This helps Azure validate the content type
-            }, credential);
-            return `${blobClient.url}?${sasToken}`;
-        }
-        else {
-            // If we don't have shared key credentials, we can't generate SAS tokens
-            // This would happen if using connection string with SAS or other auth methods
-            throw new Error("Cannot generate SAS token: Shared key credentials required for presigned URLs");
-        }
-    }
     async generatePresignedUrl(params) {
         await this._loadConfiguration();
         if (!this._endpoint)
             return null;
-        const signedUrl = await this._prepareUrl(params);
+        // Uploads always go through the api: S3Controller writes the bytes, encrypting them when
+        // `shouldEncrypt`, passing them through otherwise. Put tokens are not windowed.
+        const token = this.cipher.signObjectToken({
+            op: "put",
+            key: params.key,
+            contentType: params.contentType,
+            expiresInSeconds: s3_cipher_core_1.S3_OBJECT_TOKEN_TTL_SECONDS,
+        });
         const data = {
             id: (0, crypto_1.randomUUID)(),
-            url: signedUrl,
-            storageType: this._storageType,
+            url: this._apiObjectUrl(token),
+            storageType: "api",
             contentType: params.contentType,
-            blobType: this._storageType === "azure" ? "BlockBlob" : undefined,
-            acl: this._storageType !== "azure" && params.isPublic ? "public-read" : undefined,
+            blobType: undefined,
+            acl: undefined,
             createdAt: new Date(),
             updatedAt: new Date(),
         };
@@ -241,7 +306,7 @@ let S3Service = class S3Service {
      * characters that would break the header (quotes, path separators, control chars) while
      * `filename*` carries the original UTF-8 name for browsers that support it.
      */
-    _contentDispositionAttachment(filename) {
+    contentDispositionAttachment(filename) {
         const ascii = filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\/\r\n]/g, "_");
         return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
     }
@@ -260,69 +325,25 @@ let S3Service = class S3Service {
         await this._loadConfiguration();
         if (!this._endpoint)
             return null;
-        if (this._storageType === "azure")
-            return await this._generateAzureSignedUrl(params);
-        try {
-            if (params.isPublic) {
-                return `${this._endpoint}${params.key}`;
-            }
-            else {
-                const command = new client_s3_1.GetObjectCommand({
-                    Bucket: this._bucket,
-                    Key: params.key,
-                    // When a filename is supplied the browser must save the file instead of
-                    // rendering it inline (docx/pdf otherwise open in the browser viewer).
-                    ...(params.filename
-                        ? { ResponseContentDisposition: this._contentDispositionAttachment(params.filename) }
-                        : {}),
-                });
-                // Sign against the start of the current window so the same key yields the same URL
-                // for the whole window and browser/image caches can hit. The window is added to the
-                // expiry so the URL stays valid for at least the requested ttl from now.
-                const configuredWindow = this.s3Config.signingWindowSeconds;
-                const windowSeconds = configuredWindow > 0 ? configuredWindow : 3600;
-                const windowMs = windowSeconds * 1000;
-                const signedUrl = await (0, s3_request_presigner_1.getSignedUrl)(this.s3Client, command, {
-                    signingDate: new Date(Math.floor(Date.now() / windowMs) * windowMs),
-                    expiresIn: (params.ttl ?? 3600) + windowSeconds,
-                });
-                return signedUrl;
-            }
-        }
-        catch (error) {
-            throw new Error(`Failed to generate URL: ${error.message}`);
-        }
+        // Downloads always go through the api, for every key; the api decrypts flagged objects and
+        // passes the rest through. The expiry is anchored to the start of the current signing window
+        // so the same key yields the same URL for the whole window and browser/image caches can hit;
+        // the window is added so the URL stays valid for at least the requested ttl from now.
+        // Public assets get no expiry.
+        const token = this.cipher.signObjectToken({
+            op: "get",
+            key: params.key,
+            filename: params.filename,
+            expiresAt: params.isPublic ? undefined : this._windowedExpiry(params.ttl ?? s3_cipher_core_1.S3_OBJECT_TOKEN_TTL_SECONDS),
+        });
+        return this._apiObjectUrl(token);
     }
-    async _generateAzureSignedUrl(params) {
-        try {
-            const blobClient = this.containerClient.getBlobClient(params.key);
-            if (params.isPublic) {
-                return blobClient.url;
-            }
-            else {
-                // Check if we have shared key credentials to generate SAS
-                const credential = this.blobServiceClient.credential;
-                if (credential instanceof storage_blob_1.StorageSharedKeyCredential) {
-                    const sasToken = (0, storage_blob_1.generateBlobSASQueryParameters)({
-                        containerName: this._bucket,
-                        blobName: params.key,
-                        permissions: storage_blob_1.BlobSASPermissions.parse("r"), // Read permission
-                        startsOn: new Date(new Date().valueOf() - 15 * 60 * 1000), // Start 15 minutes ago to account for clock skew
-                        expiresOn: new Date(new Date().valueOf() + (params.ttl ?? 3600) * 1000),
-                        protocol: storage_blob_1.SASProtocol.Https,
-                        ...(params.filename ? { contentDisposition: this._contentDispositionAttachment(params.filename) } : {}),
-                    }, credential);
-                    return `${blobClient.url}?${sasToken}`;
-                }
-                else {
-                    // If no shared key credentials, return the blob URL (works if container is public)
-                    return blobClient.url;
-                }
-            }
-        }
-        catch (error) {
-            throw new Error(`Failed to generate Azure URL: ${error.message}`);
-        }
+    /** Unix seconds: start of the current signing window + ttl + window (`s3.signingWindowSeconds`, default 3600). */
+    _windowedExpiry(ttl) {
+        const configuredWindow = this.s3Config.signingWindowSeconds;
+        const windowSeconds = configuredWindow > 0 ? configuredWindow : 3600;
+        const windowStart = Math.floor(Math.floor(Date.now() / 1000) / windowSeconds) * windowSeconds;
+        return windowStart + ttl + windowSeconds;
     }
     async uploadFile(params) {
         await this._loadConfiguration();
@@ -345,18 +366,15 @@ let S3Service = class S3Service {
         };
         const extension = extensionMapping[baseContentType] || (baseContentType.includes("/") ? baseContentType.split("/")[1] : "bin");
         const finalKey = `${params.key}.${extension}`;
-        const presignedUrl = await this._prepareUrl({
-            key: finalKey,
-            contentType: fileContentType,
-        });
         try {
-            await fetch(presignedUrl, {
-                method: "PUT",
-                body: new Uint8Array(params.buffer),
-                headers: {
-                    "Content-Type": fileContentType,
-                },
-            });
+            const { body, metadata } = await this._prepareBody(finalKey, params.buffer);
+            await this.s3Client.send(new client_s3_1.PutObjectCommand({
+                Bucket: this._bucket,
+                Key: finalKey,
+                Body: body,
+                ContentType: fileContentType,
+                Metadata: metadata,
+            }));
         }
         catch (error) {
             this.logger.error("File upload error", error);
@@ -382,11 +400,13 @@ let S3Service = class S3Service {
         const extension = extensionMapping[baseContentType] || (baseContentType.includes("/") ? baseContentType.split("/")[1] : "bin");
         const finalKey = `${params.key}.${extension}`;
         try {
+            const { body, metadata } = await this._prepareBody(finalKey, params.buffer);
             const blobClient = this.containerClient.getBlockBlobClient(finalKey);
-            await blobClient.upload(params.buffer, params.buffer.length, {
+            await blobClient.upload(body, body.length, {
                 blobHTTPHeaders: {
                     blobContentType: fileContentType,
                 },
+                metadata,
             });
             const fileUrl = await this.generateSignedUrl({ key: finalKey });
             return { filePath: finalKey, fileUrl };
@@ -407,18 +427,15 @@ let S3Service = class S3Service {
             throw new Error("Unsupported image format");
         }
         const finalKey = `${params.key}.${contentType.split("/")[1]}`;
-        const presignedUrl = await this._prepareUrl({
-            key: finalKey,
-            contentType: contentType,
-        });
         try {
-            await fetch(presignedUrl, {
-                method: "PUT",
-                body: new Uint8Array(params.buffer),
-                headers: {
-                    "Content-Type": contentType,
-                },
-            });
+            const { body, metadata } = await this._prepareBody(finalKey, params.buffer);
+            await this.s3Client.send(new client_s3_1.PutObjectCommand({
+                Bucket: this._bucket,
+                Key: finalKey,
+                Body: body,
+                ContentType: contentType,
+                Metadata: metadata,
+            }));
         }
         catch (error) {
             this.logger.error("Image upload error", error);
@@ -433,11 +450,13 @@ let S3Service = class S3Service {
         }
         const finalKey = `${params.key}.${contentType.split("/")[1]}`;
         try {
+            const { body, metadata } = await this._prepareBody(finalKey, params.buffer);
             const blobClient = this.containerClient.getBlockBlobClient(finalKey);
-            await blobClient.upload(params.buffer, params.buffer.length, {
+            await blobClient.upload(body, body.length, {
                 blobHTTPHeaders: {
                     blobContentType: contentType,
                 },
+                metadata,
             });
             const publicUrl = await this.generateSignedUrl({ key: finalKey });
             return { imagePath: finalKey, imageUrl: publicUrl };
@@ -474,11 +493,13 @@ let S3Service = class S3Service {
         }
         const finalKey = params.key;
         try {
+            const { body, metadata } = await this._prepareBody(finalKey, params.buffer);
             const blobClient = this.containerClient.getBlockBlobClient(finalKey);
-            await blobClient.upload(params.buffer, params.buffer.length, {
+            await blobClient.upload(body, body.length, {
                 blobHTTPHeaders: {
                     blobContentType: params.contentType,
                 },
+                metadata,
             });
             const fileUrl = await this.generateSignedUrl({ key: finalKey });
             return { filePath: finalKey, fileUrl };
@@ -492,19 +513,22 @@ let S3Service = class S3Service {
         await this._loadConfiguration();
         if (!this._endpoint)
             return;
+        const { body, metadata } = await this._prepareBody(params.key, params.buffer);
         if (this._storageType === "azure") {
             const blobClient = this.containerClient.getBlockBlobClient(params.key);
-            await blobClient.upload(params.buffer, params.buffer.length, {
+            await blobClient.upload(body, body.length, {
                 blobHTTPHeaders: { blobContentType: params.contentType },
+                metadata,
             });
             return;
         }
         const command = new client_s3_1.PutObjectCommand({
             Bucket: this._bucket,
             Key: params.key,
-            Body: params.buffer,
+            Body: body,
             ContentType: params.contentType,
             ACL: params.isPublic ? "public-read" : undefined,
+            Metadata: metadata,
         });
         await this.s3Client.send(command);
     }
@@ -521,12 +545,8 @@ let S3Service = class S3Service {
         });
         try {
             const response = await this.s3Client.send(command);
-            const stream = response.Body;
-            const chunks = [];
-            for await (const chunk of stream) {
-                chunks.push(Buffer.from(chunk));
-            }
-            return Buffer.concat(chunks).toString("utf-8");
+            const bytes = await this._streamToBuffer(response.Body);
+            return (await this._readBody(params.key, response.Metadata, bytes)).toString("utf-8");
         }
         catch (error) {
             console.error(`Failed to get object content for key ${params.key}:`, error);
@@ -537,12 +557,8 @@ let S3Service = class S3Service {
         try {
             const blobClient = this.containerClient.getBlobClient(params.key);
             const downloadResponse = await blobClient.download();
-            const stream = downloadResponse.readableStreamBody;
-            const chunks = [];
-            for await (const chunk of stream) {
-                chunks.push(Buffer.from(chunk));
-            }
-            return Buffer.concat(chunks).toString("utf-8");
+            const bytes = await this._streamToBuffer(downloadResponse.readableStreamBody);
+            return (await this._readBody(params.key, downloadResponse.metadata, bytes)).toString("utf-8");
         }
         catch (error) {
             console.error(`Failed to get Azure object content for key ${params.key}:`, error);
@@ -591,12 +607,9 @@ let S3Service = class S3Service {
             if (!downloadResponse.readableStreamBody) {
                 throw new Error(`Azure blob not found: ${params.key}`);
             }
-            const chunks = [];
-            for await (const chunk of downloadResponse.readableStreamBody) {
-                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-            }
+            const bytes = await this._streamToBuffer(downloadResponse.readableStreamBody);
             return {
-                buffer: Buffer.concat(chunks),
+                buffer: await this._readBody(params.key, downloadResponse.metadata, bytes),
                 contentType: downloadResponse.contentType ?? undefined,
             };
         }
@@ -608,12 +621,9 @@ let S3Service = class S3Service {
         if (!response.Body) {
             throw new Error(`S3 object not found: ${params.key}`);
         }
-        const chunks = [];
-        for await (const chunk of response.Body) {
-            chunks.push(Buffer.from(chunk));
-        }
+        const bytes = await this._streamToBuffer(response.Body);
         return {
-            buffer: Buffer.concat(chunks),
+            buffer: await this._readBody(params.key, response.Metadata, bytes),
             contentType: response.ContentType,
         };
     }
@@ -625,10 +635,21 @@ let S3Service = class S3Service {
         await this._loadConfiguration();
         if (!this._endpoint)
             return;
+        const metadata = this._metadataFor(params.key);
+        let body = params.stream;
+        if (metadata) {
+            const encrypting = this.cipher.encryptStream();
+            (0, stream_1.pipeline)(params.stream, encrypting, (error) => {
+                if (error)
+                    this.logger.error(`Failed to encrypt object stream ${params.key}`, error);
+            });
+            body = encrypting;
+        }
         if (this._storageType === "azure") {
             const blobClient = this.containerClient.getBlockBlobClient(params.key);
-            await blobClient.uploadStream(params.stream, 8 * 1024 * 1024, 4, {
+            await blobClient.uploadStream(body, 8 * 1024 * 1024, 4, {
                 blobHTTPHeaders: { blobContentType: params.contentType },
+                metadata,
             });
             return;
         }
@@ -638,8 +659,9 @@ let S3Service = class S3Service {
             params: {
                 Bucket: this._bucket,
                 Key: params.key,
-                Body: params.stream,
+                Body: body,
                 ContentType: params.contentType,
+                Metadata: metadata,
             },
             partSize: 10 * 1024 * 1024,
             queueSize: 4,
@@ -720,35 +742,36 @@ let S3Service = class S3Service {
         if (this._storageType === "azure") {
             return await this._downloadAzureFileAsString(params);
         }
+        let response;
         try {
-            const response = await this.s3Client.send(new client_s3_1.GetObjectCommand({ Bucket: this._bucket, Key: params.key }));
-            if (response.Body) {
-                return await response.Body.transformToString();
-            }
-            return null;
+            response = await this.s3Client.send(new client_s3_1.GetObjectCommand({ Bucket: this._bucket, Key: params.key }));
         }
         catch (error) {
             this.logger.error(`Failed to download file ${params.key}`, error);
             return null;
         }
+        if (!response.Body)
+            return null;
+        if (!(0, s3_cipher_core_1.isEncryptedObjectMetadata)(response.Metadata))
+            return await response.Body.transformToString();
+        const bytes = Buffer.from(await response.Body.transformToByteArray());
+        return (await this._readBody(params.key, response.Metadata, bytes)).toString("utf-8");
     }
     async _downloadAzureFileAsString(params) {
+        let downloadResponse;
+        let bytes;
         try {
             const blobClient = this.containerClient.getBlobClient(params.key);
-            const downloadResponse = await blobClient.download();
-            if (downloadResponse.readableStreamBody) {
-                const chunks = [];
-                for await (const chunk of downloadResponse.readableStreamBody) {
-                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-                }
-                return Buffer.concat(chunks).toString("utf-8");
-            }
-            return null;
+            downloadResponse = await blobClient.download();
+            if (!downloadResponse.readableStreamBody)
+                return null;
+            bytes = await this._streamToBuffer(downloadResponse.readableStreamBody);
         }
         catch (error) {
             this.logger.error(`Failed to download Azure file ${params.key}`, error);
             return null;
         }
+        return (await this._readBody(params.key, downloadResponse.metadata, bytes)).toString("utf-8");
     }
     /**
      * Download a file from S3/Azure and return its content as a Buffer.
@@ -761,36 +784,35 @@ let S3Service = class S3Service {
         if (this._storageType === "azure") {
             return await this._downloadAzureFileAsBuffer(params);
         }
+        let response;
+        let bytes;
         try {
-            const response = await this.s3Client.send(new client_s3_1.GetObjectCommand({ Bucket: this._bucket, Key: params.key }));
-            if (response.Body) {
-                const byteArray = await response.Body.transformToByteArray();
-                return Buffer.from(byteArray);
-            }
-            return null;
+            response = await this.s3Client.send(new client_s3_1.GetObjectCommand({ Bucket: this._bucket, Key: params.key }));
+            if (!response.Body)
+                return null;
+            bytes = Buffer.from(await response.Body.transformToByteArray());
         }
         catch (error) {
             this.logger.error(`Failed to download file as buffer ${params.key}`, error);
             return null;
         }
+        return await this._readBody(params.key, response.Metadata, bytes);
     }
     async _downloadAzureFileAsBuffer(params) {
+        let downloadResponse;
+        let bytes;
         try {
             const blobClient = this.containerClient.getBlobClient(params.key);
-            const downloadResponse = await blobClient.download();
-            if (downloadResponse.readableStreamBody) {
-                const chunks = [];
-                for await (const chunk of downloadResponse.readableStreamBody) {
-                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-                }
-                return Buffer.concat(chunks);
-            }
-            return null;
+            downloadResponse = await blobClient.download();
+            if (!downloadResponse.readableStreamBody)
+                return null;
+            bytes = await this._streamToBuffer(downloadResponse.readableStreamBody);
         }
         catch (error) {
             this.logger.error(`Failed to download Azure file as buffer ${params.key}`, error);
             return null;
         }
+        return await this._readBody(params.key, downloadResponse.metadata, bytes);
     }
     /**
      * Download a file from S3/Azure and return a readable stream.
@@ -803,36 +825,77 @@ let S3Service = class S3Service {
         if (this._storageType === "azure") {
             return await this._downloadAzureFileAsStream(params);
         }
+        let response;
         try {
             const command = new client_s3_1.GetObjectCommand({
                 Bucket: this._bucket,
                 Key: params.key,
             });
-            const response = await this.s3Client.send(command);
-            if (response.Body) {
-                // AWS SDK v3 Body is SdkStream which extends Readable
-                return response.Body;
-            }
-            return null;
+            response = await this.s3Client.send(command);
         }
         catch (error) {
             this.logger.error(`Failed to download file as stream ${params.key}`, error);
             return null;
         }
+        if (!response.Body)
+            return null;
+        // AWS SDK v3 Body is SdkStream which extends Readable
+        return this._readStream(params.key, response.Metadata, response.Body);
+    }
+    /**
+     * Stream an object for the token-verified api route. Returns null when the object does not exist;
+     * a flagged object comes back decrypted, and throws when no configured key can open it.
+     */
+    async downloadObject(params) {
+        await this._loadConfiguration();
+        if (!this._endpoint)
+            return null;
+        if (this._storageType === "azure") {
+            let downloadResponse;
+            try {
+                downloadResponse = await this.containerClient.getBlobClient(params.key).download();
+            }
+            catch (error) {
+                if (error?.statusCode === 404)
+                    return null;
+                throw error;
+            }
+            if (!downloadResponse.readableStreamBody)
+                return null;
+            return {
+                stream: await this._readStreamReady(params.key, downloadResponse.metadata, downloadResponse.readableStreamBody),
+                contentType: downloadResponse.contentType ?? undefined,
+            };
+        }
+        let response;
+        try {
+            response = await this.s3Client.send(new client_s3_1.GetObjectCommand({ Bucket: this._bucket, Key: params.key }));
+        }
+        catch (error) {
+            if (error?.name === "NoSuchKey" || error?.name === "NotFound" || error?.$metadata?.httpStatusCode === 404)
+                return null;
+            throw error;
+        }
+        if (!response.Body)
+            return null;
+        return {
+            stream: await this._readStreamReady(params.key, response.Metadata, response.Body),
+            contentType: response.ContentType,
+        };
     }
     async _downloadAzureFileAsStream(params) {
+        let downloadResponse;
         try {
             const blobClient = this.containerClient.getBlobClient(params.key);
-            const downloadResponse = await blobClient.download();
-            if (downloadResponse.readableStreamBody) {
-                return downloadResponse.readableStreamBody;
-            }
-            return null;
+            downloadResponse = await blobClient.download();
         }
         catch (error) {
             this.logger.error(`Failed to download Azure file as stream ${params.key}`, error);
             return null;
         }
+        if (!downloadResponse.readableStreamBody)
+            return null;
+        return this._readStream(params.key, downloadResponse.metadata, downloadResponse.readableStreamBody);
     }
     /**
      * Upload a buffer with an exact key — NO extension appending.
@@ -843,18 +906,21 @@ let S3Service = class S3Service {
         await this._loadConfiguration();
         if (!this._endpoint)
             return;
+        const { body, metadata } = await this._prepareBody(params.key, params.buffer);
         if (this._storageType === "azure") {
             const blobClient = this.containerClient.getBlockBlobClient(params.key);
-            await blobClient.upload(params.buffer, params.buffer.length, {
+            await blobClient.upload(body, body.length, {
                 blobHTTPHeaders: { blobContentType: params.contentType },
+                metadata,
             });
             return;
         }
         await this.s3Client.send(new client_s3_1.PutObjectCommand({
             Bucket: this._bucket,
             Key: params.key,
-            Body: params.buffer,
+            Body: body,
             ContentType: params.contentType,
+            Metadata: metadata,
         }));
     }
 };
@@ -864,6 +930,7 @@ exports.S3Service = S3Service = __decorate([
     __metadata("design:paramtypes", [jsonapi_service_1.JsonApiService,
         nestjs_cls_1.ClsService,
         config_1.ConfigService,
-        logging_service_1.AppLoggingService])
+        logging_service_1.AppLoggingService,
+        s3_cipher_service_1.S3CipherService])
 ], S3Service);
 //# sourceMappingURL=s3.service.js.map