@contember/engine-s3-plugin 1.2.1 → 1.3.0-alpha.4

package/tests/cases/authorizator.test.ts

@@ -0,0 +1,22 @@
+import { test, assert } from 'vitest'
+import { S3ObjectAuthorizator } from '../../src'
+
+test('required read pattern', () => {
+	const authorizator = new S3ObjectAuthorizator([], [{ pattern: 'foo/**' }])
+	assert.doesNotThrow(() => authorizator.verifyReadAccess({ key: 'foo/lorem.jpg' }))
+	assert.throw(() => authorizator.verifyReadAccess({ key: 'lorem.jpg' }), 'Read access forbidden for object key lorem.jpg')
+})
+
+test('required upload pattern', () => {
+	const authorizator = new S3ObjectAuthorizator([{ pattern: 'foo/**' }], [])
+	assert.doesNotThrow(() => authorizator.verifyUploadAccess({ key: 'foo/lorem.jpg', size: null }))
+	assert.throw(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: null }), 'Upload access forbidden for object key lorem.jpg')
+})
+
+
+test('max upload size', () => {
+	const authorizator = new S3ObjectAuthorizator([{ pattern: '**', maxSize: 1024 }], [])
+	assert.doesNotThrow(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: 1000 }))
+	assert.throw(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: null }), 'File size must be provided')
+	assert.throw(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: 2048 }), 'Uploaded file is too large')
+})

package/tests/cases/signRequest.test.ts

@@ -1,5 +1,5 @@
-import { test, assert } from 'vitest'
-import { S3Acl, S3Service } from '../../src'
+import { test, assert, expect } from 'vitest'
+import { S3ObjectAuthorizator, S3Service } from '../../src'
 
 const mocked = new Date('2021-07-02 17:22')
 const constantUuid = '9fce3907-ff2b-45bb-b4ce-eff5527dd315'
@@ -17,38 +17,38 @@ const createS3Service = (bucket: string, prefix = '') => new S3Service(
 		uuid: () => constantUuid,
 		now: () => mocked,
 	},
+	new S3ObjectAuthorizator([{ pattern: '**' }], [{ pattern: '**' }]),
 )
 
 
 test('sign s3 request', () => {
 	const service = createS3Service('test')
-	assert.equal(
-		service.getSignedReadUrl('foo.jpg', () => {}).url,
-		'https://test.s3.eu-central-1.amazonaws.com/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=00e912fe0383066802fc6c0f93ffb223320ca143992385fe69070bbb87c758dc&X-Amz-SignedHeaders=host',
-	)
+	const signed = service.getSignedReadUrl({ objectKey: 'foo.jpg', expiration: null })
+	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=00e912fe0383066802fc6c0f93ffb223320ca143992385fe69070bbb87c758dc&X-Amz-SignedHeaders=host"')
 })
 
 test('sign s3 request - prefix', () => {
 	const service = createS3Service('test', 'lorem')
-	assert.equal(
-		service.getSignedReadUrl('lorem/foo.jpg', () => {}).url,
-		'https://test.s3.eu-central-1.amazonaws.com/lorem/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=f6c69dc306422c2b3242c9d9d42147336817720ffae249af8bd91cc7062e9f6d&X-Amz-SignedHeaders=host',
-	)
+	const signed = service.getSignedReadUrl({ objectKey: 'lorem/foo.jpg', expiration: null })
+	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/lorem/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=f6c69dc306422c2b3242c9d9d42147336817720ffae249af8bd91cc7062e9f6d&X-Amz-SignedHeaders=host"')
 })
 
 test('sign upload', () => {
 	const service = createS3Service('test')
-	assert.equal(
-		service.getSignedUploadUrl('foo.jpg', () => {}, S3Acl.PublicRead, 1800).url,
-		`https://test.s3.eu-central-1.amazonaws.com/${constantUuid}.bin?Cache-Control=immutable&Content-Type=foo.jpg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=1800&X-Amz-Signature=d33b2d6574fca41d7f707fd3d4695712380f78a0e9e0b0ace3fc12d7a4606bc2&X-Amz-SignedHeaders=cache-control%3Bhost%3Bx-amz-acl&x-amz-acl=public-read`,
-	)
+	const signed = service.getSignedUploadUrl({ contentType: 'image/jpeg', acl: 'PUBLIC_READ', expiration: 1800, contentDisposition: null, extension: null, fileName: null, prefix: null, suffix: null, size: null })
+	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/9fce3907-ff2b-45bb-b4ce-eff5527dd315.jpeg?Cache-Control=immutable&Content-Type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=1800&X-Amz-Signature=fcd00b967054c19a2ee64b59e31d61e032ea086dcf2f0d8c36a883971c469c99&X-Amz-SignedHeaders=cache-control%3Bhost%3Bx-amz-acl&x-amz-acl=public-read"')
 })
 
+test('sign upload #2', () => {
+	const service = createS3Service('test')
+	const signed = service.getSignedUploadUrl({ contentType: 'image/jpeg', acl: 'PUBLIC_READ', expiration: 1800, contentDisposition: 'INLINE', extension: 'jpeg', fileName: 'foo-bar.jpeg', prefix: 'foo', suffix: 'bar', size: null })
+	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/foo/9fce3907-ff2b-45bb-b4ce-eff5527dd315bar.jpeg?Cache-Control=immutable&Content-Type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=1800&X-Amz-Signature=979a93bca65a98ce6b2bf97d2bf2afe7d5f2fa805f7d596187675416c86a3bd5&X-Amz-SignedHeaders=cache-control%3Bcontent-disposition%3Bhost%3Bx-amz-acl&x-amz-acl=public-read"')
+})
+
+
 test('bucket with dot', () => {
 	const service = createS3Service('test.foo')
-	assert.equal(
-		service.getSignedReadUrl('foo.jpg', () => {}).url,
-		'https://s3.eu-central-1.amazonaws.com/test.foo/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=811a809196e60413e0e54e51d3dd91ab73ad1482b61e5371864d25d43ba642ff&X-Amz-SignedHeaders=host',
-	)
+	const signed = service.getSignedReadUrl({ objectKey: 'foo.jpg', expiration: null })
+	expect(signed.url).toMatchInlineSnapshot('"https://s3.eu-central-1.amazonaws.com/test.foo/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=811a809196e60413e0e54e51d3dd91ab73ad1482b61e5371864d25d43ba642ff&X-Amz-SignedHeaders=host"')
 })
 

package/tests/tsconfig.json

@@ -5,8 +5,6 @@
 		"esModuleInterop": true
 	},
 	"references": [
-		{
-			"path": "../src"
-		}
+		{ "path": "../src" }
 	]
 }

package/tsconfig.json

@@ -2,11 +2,7 @@
 	"files": [],
 	"include": [],
 	"references": [
-		{
-			"path": "./src"
-		},
-		{
-			"path": "./tests"
-		}
+		{ "path": "./src" },
+		{ "path": "./tests" }
 	]
 }

package/dist/src/ObjectKeyVerifier.d.ts

@@ -1,3 +0,0 @@
-export declare type ObjectKeyVerifier = (key: string) => void;
-export declare const createObjectKeyVerifier: (patterns: string[]) => ObjectKeyVerifier;
-//# sourceMappingURL=ObjectKeyVerifier.d.ts.map

package/dist/src/ObjectKeyVerifier.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ObjectKeyVerifier.d.ts","sourceRoot":"","sources":["../../src/ObjectKeyVerifier.ts"],"names":[],"mappings":"AAGA,oBAAY,iBAAiB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;AAErD,eAAO,MAAM,uBAAuB,aAAc,MAAM,EAAE,KAAG,iBAQ5D,CAAA"}

package/dist/src/ObjectKeyVerifier.js

@@ -1,18 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createObjectKeyVerifier = void 0;
-const picomatch_1 = __importDefault(require("picomatch"));
-const graphql_utils_1 = require("@contember/graphql-utils");
-const createObjectKeyVerifier = (patterns) => {
-    const matchers = patterns.map(it => (0, picomatch_1.default)(it));
-    return key => {
-        if (!matchers.find(it => it(key))) {
-            throw new graphql_utils_1.ForbiddenError(`You are not allowed to use object key ${key}`);
-        }
-    };
-};
-exports.createObjectKeyVerifier = createObjectKeyVerifier;
-//# sourceMappingURL=ObjectKeyVerifier.js.map

package/dist/src/ObjectKeyVerifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ObjectKeyVerifier.js","sourceRoot":"","sources":["../../src/ObjectKeyVerifier.ts"],"names":[],"mappings":";;;;;;AAAA,0DAAuC;AACvC,4DAAyD;AAIlD,MAAM,uBAAuB,GAAG,CAAC,QAAkB,EAAqB,EAAE;IAChF,MAAM,QAAQ,GAAc,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAA,mBAAE,EAAC,EAAE,CAAC,CAAC,CAAA;IAEtD,OAAO,GAAG,CAAC,EAAE;QACZ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;YAClC,MAAM,IAAI,8BAAc,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;SACxE;IACF,CAAC,CAAA;AACF,CAAC,CAAA;AARY,QAAA,uBAAuB,2BAQnC"}

package/src/ObjectKeyVerifier.ts

@@ -1,14 +0,0 @@
-import pm, { Matcher } from 'picomatch'
-import { ForbiddenError } from '@contember/graphql-utils'
-
-export type ObjectKeyVerifier = (key: string) => void
-
-export const createObjectKeyVerifier = (patterns: string[]): ObjectKeyVerifier => {
-	const matchers: Matcher[] = patterns.map(it => pm(it))
-
-	return key => {
-		if (!matchers.find(it => it(key))) {
-			throw new ForbiddenError(`You are not allowed to use object key ${key}`)
-		}
-	}
-}

package/types/sign3/index.d.ts

@@ -1,8 +0,0 @@
-declare module 'sign3' {
-	type Signer = (bucket: string, key: string, expires: number, headers: Record<string, string>) => string
-	export interface S3Signer {
-		get: Signer
-		put: Signer
-	}
-	export default function (url: string): S3Signer
-}