@constructive-io/bucket-provisioner 0.30.1 → 0.31.0

package/README.md

@@ -224,7 +224,8 @@ CORS rules for public/temp buckets (PUT, GET, HEAD).
 
 #### `buildPrivateCorsRules(allowedOrigins, maxAgeSeconds?)`
 
-CORS rules for private buckets (PUT, HEAD only — no GET).
+CORS rules for private buckets (PUT, GET, HEAD for the configured origins).
+Presigned downloads still require browser CORS; allowing GET does not grant unsigned object access.
 
 ### Lifecycle Builders
 
@@ -273,7 +274,7 @@ Error codes:
 
 | Access Type | Block Public Access | Bucket Policy | CORS Methods | Lifecycle |
 |-------------|-------------------|---------------|--------------|-----------|
-| `private` | All blocked | None (deleted) | PUT, HEAD | None |
+| `private` | All blocked | None (deleted) | PUT, GET, HEAD | None |
 | `public` | Partially relaxed | Public-read | PUT, GET, HEAD | None |
 | `temp` | All blocked | None (deleted) | PUT, GET, HEAD | Auto-expire (1 day) |
 

package/cors.d.ts

@@ -23,9 +23,9 @@ export declare function buildUploadCorsRules(allowedOrigins: string[], maxAgeSec
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)

package/cors.js

@@ -53,9 +53,9 @@ function buildUploadCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)
@@ -67,7 +67,7 @@ function buildPrivateCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
     return [
         {
             allowedOrigins,
-            allowedMethods: ['PUT', 'HEAD'],
+            allowedMethods: ['PUT', 'GET', 'HEAD'],
             allowedHeaders: [
                 'Content-Type',
                 'Content-Length',

package/esm/cors.d.ts

@@ -23,9 +23,9 @@ export declare function buildUploadCorsRules(allowedOrigins: string[], maxAgeSec
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)

package/esm/cors.js

@@ -49,9 +49,9 @@ export function buildUploadCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
 /**
  * Build restrictive CORS rules for private-only buckets.
  *
- * Similar to upload CORS but without GET (private files use
- * presigned URLs which include auth in the query string,
- * so CORS is less of a concern for downloads).
+ * Presigned GETs still need CORS for browser fetch/preview. Allow reads from
+ * the configured origins; S3 authorization and public-access blocking still
+ * reject unsigned access to private objects.
  *
  * @param allowedOrigins - Domains allowed to make cross-origin requests.
  * @param maxAgeSeconds - Preflight cache duration (default: 3600 = 1 hour)
@@ -63,7 +63,7 @@ export function buildPrivateCorsRules(allowedOrigins, maxAgeSeconds = 3600) {
     return [
         {
             allowedOrigins,
-            allowedMethods: ['PUT', 'HEAD'],
+            allowedMethods: ['PUT', 'GET', 'HEAD'],
             allowedHeaders: [
                 'Content-Type',
                 'Content-Length',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/bucket-provisioner",
-  "version": "0.30.1",
+  "version": "0.31.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "S3-compatible bucket provisioning library — create buckets, configure privacy policies, CORS, and access controls",
   "main": "index.js",
@@ -30,7 +30,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1052.0",
-    "@constructive-io/s3-utils": "^2.34.0"
+    "@constructive-io/s3-utils": "^2.35.0"
   },
   "devDependencies": {
     "makage": "^0.8.0"
@@ -44,5 +44,5 @@
     "storage",
     "constructive"
   ],
-  "gitHead": "8227c782c98281f7185d257a7f716fbffdcc45c2"
+  "gitHead": "487c4ec9ee997d7da80584a3d41d7120d4354c54"
 }