@contember/engine-s3-plugin 2.0.0-alpha.9 → 2.0.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-s3-plugin",
-  "version": "2.0.0-alpha.9",
+  "version": "2.0.0-beta.2",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -23,23 +23,23 @@
     }
   },
   "dependencies": {
-    "@contember/engine-plugins": "2.0.0-alpha.9",
-    "@contember/graphql-utils": "2.0.0-alpha.9",
-    "@contember/typesafe": "2.0.0-alpha.9",
+    "@contember/engine-plugins": "2.0.0-beta.2",
+    "@contember/graphql-utils": "2.0.0-beta.2",
+    "@contember/typesafe": "2.0.0-beta.2",
     "mime-types": "^2.1.35",
-    "picomatch": "^3.0.1",
-    "qs": "^6.11.2",
-    "uuid": "^9.0.1"
+    "picomatch": "^4.0.2",
+    "qs": "^6.13.0",
+    "uuid": "^10.0.0"
   },
   "devDependencies": {
     "@types/mime-types": "^2.1.4",
-    "@types/qs": "^6.9.10",
-    "@types/uuid": "^9.0.7",
-    "graphql": "^16.8.1"
+    "@types/qs": "^6.9.16",
+    "@types/uuid": "^10.0.0",
+    "graphql": "^16.9.0"
   },
   "peerDependencies": {
     "graphql": ">= 14.6.0",
     "pg": "^8.9.0"
   },
   "type": "module"
-}
+}

package/src/S3ObjectAuthorizator.ts

@@ -1,3 +1,5 @@
+// eslint-disable-next-line @typescript-eslint/triple-slash-reference
+/// <reference path="../types/picomatch/index.d.ts" />
 import pm from 'picomatch'
 import { ForbiddenError } from '@contember/graphql-utils'
 

package/src/S3SchemaContributor.ts

@@ -1,4 +1,5 @@
 import {
+	GraphQLError,
 	GraphQLFieldConfig,
 	GraphQLInt,
 	GraphQLNonNull,
@@ -8,7 +9,7 @@ import {
 	GraphQLString,
 } from 'graphql'
 import { S3Service, S3ServiceFactory } from './S3Service'
-import { resolveS3Config, S3Config } from './Config'
+import { Project3Config, resolveS3Config, S3Config } from './Config'
 import { GraphQLSchemaContributor, GraphQLSchemaContributorContext, Providers } from '@contember/engine-plugins'
 import * as types from './S3SchemaTypes'
 import { S3Acl, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes'
@@ -35,13 +36,16 @@ export type S3SchemaAcl = Record<
 
 export class S3SchemaContributor implements GraphQLSchemaContributor {
 	constructor(
-		private readonly s3Config: S3Config | undefined,
 		private readonly s3Factory: S3ServiceFactory,
 		private readonly providers: Providers,
 	) {}
 
+	getCacheKey?({ project }: GraphQLSchemaContributorContext): string {
+		return project.s3 ? 'yes' : 'no'
+	}
+
 	createSchema(context: GraphQLSchemaContributorContext): GraphQLSchemaConfig | undefined {
-		if (!this.s3Config) {
+		if (!context.project.s3) {
 			return undefined
 		}
 		const rules = context.identity.projectRoles.flatMap(it =>
@@ -61,11 +65,9 @@ export class S3SchemaContributor implements GraphQLSchemaContributor {
 			return undefined
 		}
 
-		const s3Config = resolveS3Config(this.s3Config)
 		const authorizator = new S3ObjectAuthorizator(uploadRules, readRules)
-		const s3 = this.s3Factory.create(s3Config, this.providers, authorizator)
-		const uploadMutation = this.createUploadMutation(s3)
-		const readMutation = this.createReadMutation(s3)
+		const uploadMutation = this.createUploadMutation(authorizator)
+		const readMutation = this.createReadMutation(authorizator)
 		const mutation = {
 			generateUploadUrl: uploadMutation as GraphQLFieldConfig<any, any, any>,
 			generateReadUrl: readMutation,
@@ -86,7 +88,8 @@ export class S3SchemaContributor implements GraphQLSchemaContributor {
 		}
 	}
 
-	private createReadMutation(s3: S3Service): GraphQLFieldConfig<any, any, any> {
+	private createReadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, { project: Project3Config }, any> {
+
 		return {
 			type: new GraphQLNonNull(S3SignedRead),
 			args: {
@@ -97,13 +100,18 @@ export class S3SchemaContributor implements GraphQLSchemaContributor {
 					type: GraphQLInt,
 				},
 			},
-			resolve: async (parent: any, args: { objectKey: string; expiration?: number }) => {
+			resolve: async (parent: any, args: { objectKey: string; expiration?: number }, ctx: { project: Project3Config }) => {
+				if (!ctx.project.s3) {
+					throw new GraphQLError('S3 is not configured for this project')
+				}
+				const s3Config = resolveS3Config(ctx.project.s3)
+				const s3 = this.s3Factory.create(s3Config, this.providers, authorizator)
 				return s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null })
 			},
 		} as GraphQLFieldConfig<any, any, any>
 	}
 
-	private createUploadMutation(s3: S3Service): GraphQLFieldConfig<any, any, any> {
+	private createUploadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {
 		return {
 			type: new GraphQLNonNull(S3SignedUpload),
 			args: {
@@ -116,7 +124,13 @@ export class S3SchemaContributor implements GraphQLSchemaContributor {
 			resolve: async (
 				parent: any,
 				args: { input?: Partial<S3GenerateSignedUploadInput>; contentType?: string; acl?: S3Acl; expiration?: number; prefix?: string },
+				ctx: { project: Project3Config },
 			) => {
+				if (!ctx.project.s3) {
+					throw new GraphQLError('S3 is not configured for this project')
+				}
+				const s3Config = resolveS3Config(ctx.project.s3)
+				const s3 = this.s3Factory.create(s3Config, this.providers, authorizator)
 				return s3.getSignedUploadUrl({
 					acl: args.input?.acl ?? args.acl ?? null,
 					contentDisposition: args.input?.contentDisposition ?? null,

package/src/index.ts

@@ -15,11 +15,8 @@ export default class S3 implements Plugin<Project3Config> {
 		return new S3ConfigProcessor()
 	}
 
-	getSchemaContributor({ project, providers }: SchemaContributorArgs<Project3Config>) {
-		if (!project.s3) {
-			return undefined
-		}
+	getSchemaContributor({ providers }: SchemaContributorArgs) {
 		const s3ServiceFactory = new S3ServiceFactory()
-		return new S3SchemaContributor(project.s3, s3ServiceFactory, providers)
+		return new S3SchemaContributor(s3ServiceFactory, providers)
 	}
 }

package/tests/cases/authorizator.test.ts

@@ -1,22 +1,22 @@
-import { test, assert } from 'vitest'
+import { test, expect } from 'bun:test'
 import { S3ObjectAuthorizator } from '../../src'
 
 test('required read pattern', () => {
 	const authorizator = new S3ObjectAuthorizator([], [{ pattern: 'foo/**' }])
-	assert.doesNotThrow(() => authorizator.verifyReadAccess({ key: 'foo/lorem.jpg' }))
-	assert.throw(() => authorizator.verifyReadAccess({ key: 'lorem.jpg' }), 'Read access forbidden for object key lorem.jpg')
+	expect(() => authorizator.verifyReadAccess({ key: 'foo/lorem.jpg' })).not.toThrow()
+	expect(() => authorizator.verifyReadAccess({ key: 'lorem.jpg' })).toThrow('Read access forbidden for object key lorem.jpg')
 })
 
 test('required upload pattern', () => {
 	const authorizator = new S3ObjectAuthorizator([{ pattern: 'foo/**' }], [])
-	assert.doesNotThrow(() => authorizator.verifyUploadAccess({ key: 'foo/lorem.jpg', size: null }))
-	assert.throw(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: null }), 'Upload access forbidden for object key lorem.jpg')
+	expect(() => authorizator.verifyUploadAccess({ key: 'foo/lorem.jpg', size: null })).not.toThrow()
+	expect(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: null })).toThrow('Upload access forbidden for object key lorem.jpg')
 })
 
 
 test('max upload size', () => {
 	const authorizator = new S3ObjectAuthorizator([{ pattern: '**', maxSize: 1024 }], [])
-	assert.doesNotThrow(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: 1000 }))
-	assert.throw(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: null }), 'File size must be provided')
-	assert.throw(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: 2048 }), 'Uploaded file is too large')
+	expect(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: 1000 })).not.toThrow()
+	expect(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: null })).toThrow('File size must be provided')
+	expect(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: 2048 })).toThrow('Uploaded file is too large')
 })

package/tests/cases/signRequest.test.ts

@@ -1,4 +1,4 @@
-import { test, assert, expect } from 'vitest'
+import { test, expect } from 'bun:test'
 import { S3ObjectAuthorizator, S3Service } from '../../src'
 
 const mocked = new Date('2021-07-02T17:22Z')
@@ -24,31 +24,31 @@ const createS3Service = (bucket: string, prefix = '') => new S3Service(
 test('sign s3 request', () => {
 	const service = createS3Service('test')
 	const signed = service.getSignedReadUrl({ objectKey: 'foo.jpg', expiration: null })
-	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=00e912fe0383066802fc6c0f93ffb223320ca143992385fe69070bbb87c758dc&X-Amz-SignedHeaders=host"')
+	expect(signed.url).toEqual('https://test.s3.eu-central-1.amazonaws.com/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=00e912fe0383066802fc6c0f93ffb223320ca143992385fe69070bbb87c758dc&X-Amz-SignedHeaders=host')
 })
 
 test('sign s3 request - prefix', () => {
 	const service = createS3Service('test', 'lorem')
 	const signed = service.getSignedReadUrl({ objectKey: 'lorem/foo.jpg', expiration: null })
-	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/lorem/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=f6c69dc306422c2b3242c9d9d42147336817720ffae249af8bd91cc7062e9f6d&X-Amz-SignedHeaders=host"')
+	expect(signed.url).toEqual('https://test.s3.eu-central-1.amazonaws.com/lorem/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=f6c69dc306422c2b3242c9d9d42147336817720ffae249af8bd91cc7062e9f6d&X-Amz-SignedHeaders=host')
 })
 
 test('sign upload', () => {
 	const service = createS3Service('test')
 	const signed = service.getSignedUploadUrl({ contentType: 'image/jpeg', acl: 'PUBLIC_READ', expiration: 1800, contentDisposition: null, extension: null, fileName: null, prefix: null, suffix: null, size: null })
-	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/9fce3907-ff2b-45bb-b4ce-eff5527dd315.jpeg?Cache-Control=immutable&Content-Type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=1800&X-Amz-Signature=fcd00b967054c19a2ee64b59e31d61e032ea086dcf2f0d8c36a883971c469c99&X-Amz-SignedHeaders=cache-control%3Bhost%3Bx-amz-acl&x-amz-acl=public-read"')
+	expect(signed.url).toEqual('https://test.s3.eu-central-1.amazonaws.com/9fce3907-ff2b-45bb-b4ce-eff5527dd315.jpeg?Cache-Control=immutable&Content-Type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=1800&X-Amz-Signature=fcd00b967054c19a2ee64b59e31d61e032ea086dcf2f0d8c36a883971c469c99&X-Amz-SignedHeaders=cache-control%3Bhost%3Bx-amz-acl&x-amz-acl=public-read')
 })
 
 test('sign upload #2', () => {
 	const service = createS3Service('test')
 	const signed = service.getSignedUploadUrl({ contentType: 'image/jpeg', acl: 'PUBLIC_READ', expiration: 1800, contentDisposition: 'INLINE', extension: 'jpeg', fileName: 'foo-bar.jpeg', prefix: 'foo', suffix: 'bar', size: null })
-	expect(signed.url).toMatchInlineSnapshot('"https://test.s3.eu-central-1.amazonaws.com/foo/9fce3907-ff2b-45bb-b4ce-eff5527dd315bar.jpeg?Cache-Control=immutable&Content-Type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=1800&X-Amz-Signature=979a93bca65a98ce6b2bf97d2bf2afe7d5f2fa805f7d596187675416c86a3bd5&X-Amz-SignedHeaders=cache-control%3Bcontent-disposition%3Bhost%3Bx-amz-acl&x-amz-acl=public-read"')
+	expect(signed.url).toEqual('https://test.s3.eu-central-1.amazonaws.com/foo/9fce3907-ff2b-45bb-b4ce-eff5527dd315bar.jpeg?Cache-Control=immutable&Content-Type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=1800&X-Amz-Signature=979a93bca65a98ce6b2bf97d2bf2afe7d5f2fa805f7d596187675416c86a3bd5&X-Amz-SignedHeaders=cache-control%3Bcontent-disposition%3Bhost%3Bx-amz-acl&x-amz-acl=public-read')
 })
 
 
 test('bucket with dot', () => {
 	const service = createS3Service('test.foo')
 	const signed = service.getSignedReadUrl({ objectKey: 'foo.jpg', expiration: null })
-	expect(signed.url).toMatchInlineSnapshot('"https://s3.eu-central-1.amazonaws.com/test.foo/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=811a809196e60413e0e54e51d3dd91ab73ad1482b61e5371864d25d43ba642ff&X-Amz-SignedHeaders=host"')
+	expect(signed.url).toEqual('https://s3.eu-central-1.amazonaws.com/test.foo/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=3600&X-Amz-Signature=811a809196e60413e0e54e51d3dd91ab73ad1482b61e5371864d25d43ba642ff&X-Amz-SignedHeaders=host')
 })
 

package/tsconfig.settings.json

@@ -1,9 +1,5 @@
 {
 	"compilerOptions": {
-		"typeRoots": [
-			"./types",
-			"../../node_modules/@types"
-		]
 	},
 	"extends": "../../tsconfig.settings.json"
 }