@contember/engine-s3-plugin 2.1.0-alpha.37 → 2.1.0-alpha.39

package/dist/development/src/S3SchemaContributor.js

@@ -0,0 +1,105 @@
+import { GraphQLObjectType, GraphQLString, GraphQLInt, GraphQLNonNull, GraphQLError } from "graphql";
+import { resolveS3Config } from "./Config.js";
+import { S3SignedRead, S3Acl, S3GenerateSignedUploadInput, S3SignedUpload } from "./S3SchemaTypes.js";
+import { S3ObjectAuthorizator } from "./S3ObjectAuthorizator.js";
+class S3SchemaContributor {
+  constructor(s3Factory, providers) {
+    this.s3Factory = s3Factory;
+    this.providers = providers;
+  }
+  getCacheKey({ project }) {
+    return project.s3 ? "yes" : "no";
+  }
+  createSchema(context) {
+    if (!context.project.s3) {
+      return void 0;
+    }
+    const rules = context.identity.projectRoles.flatMap((it) => Object.entries(context.schema.acl.roles[it]?.s3 || {}));
+    const uploadRules = rules.filter(([, it]) => it.upload).map(([it, val]) => ({
+      pattern: it,
+      ...typeof val.upload !== "boolean" ? val.upload : {}
+    }));
+    const readRules = rules.filter(([, it]) => it.read).map(([it]) => ({
+      pattern: it
+    }));
+    if (uploadRules.length === 0 && readRules.length === 0) {
+      return void 0;
+    }
+    const authorizator = new S3ObjectAuthorizator(uploadRules, readRules);
+    const uploadMutation = this.createUploadMutation(authorizator);
+    const readMutation = this.createReadMutation(authorizator);
+    const mutation = {
+      generateUploadUrl: uploadMutation,
+      generateReadUrl: readMutation
+    };
+    return {
+      mutation: new GraphQLObjectType({
+        name: "Mutation",
+        fields: () => mutation
+      }),
+      query: new GraphQLObjectType({
+        name: "Query",
+        fields: () => ({
+          s3DummyQuery: {
+            type: GraphQLString
+          }
+        })
+      })
+    };
+  }
+  createReadMutation(authorizator) {
+    return {
+      type: new GraphQLNonNull(S3SignedRead),
+      args: {
+        objectKey: {
+          type: new GraphQLNonNull(GraphQLString)
+        },
+        expiration: {
+          type: GraphQLInt
+        }
+      },
+      resolve: async (parent, args, ctx) => {
+        if (!ctx.project.s3) {
+          throw new GraphQLError("S3 is not configured for this project");
+        }
+        const s3Config = resolveS3Config(ctx.project.s3);
+        const s3 = this.s3Factory.create(s3Config, this.providers, authorizator);
+        return s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null });
+      }
+    };
+  }
+  createUploadMutation(authorizator) {
+    return {
+      type: new GraphQLNonNull(S3SignedUpload),
+      args: {
+        input: { type: S3GenerateSignedUploadInput },
+        contentType: { type: GraphQLString, deprecationReason: "Use input.contentType" },
+        expiration: { type: GraphQLInt, deprecationReason: "Use input.expiration" },
+        prefix: { type: GraphQLString, deprecationReason: "Use input.prefix" },
+        acl: { type: S3Acl, deprecationReason: "Use input.acl" }
+      },
+      resolve: async (parent, args, ctx) => {
+        if (!ctx.project.s3) {
+          throw new GraphQLError("S3 is not configured for this project");
+        }
+        const s3Config = resolveS3Config(ctx.project.s3);
+        const s3 = this.s3Factory.create(s3Config, this.providers, authorizator);
+        return s3.getSignedUploadUrl({
+          acl: args.input?.acl ?? args.acl ?? null,
+          contentDisposition: args.input?.contentDisposition ?? null,
+          contentType: args.input?.contentType ?? args.contentType ?? null,
+          expiration: args.input?.expiration ?? args.expiration ?? null,
+          extension: args.input?.extension ?? null,
+          fileName: args.input?.fileName ?? null,
+          prefix: args.input?.prefix ?? args.prefix ?? null,
+          suffix: args.input?.suffix ?? null,
+          size: args.input?.size ?? null
+        });
+      }
+    };
+  }
+}
+export {
+  S3SchemaContributor
+};
+//# sourceMappingURL=S3SchemaContributor.js.map

package/dist/development/src/S3SchemaContributor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3SchemaContributor.js","sources":["../../../../packages/engine-s3-plugin/src/S3SchemaContributor.ts"],"sourcesContent":["import {\n\tGraphQLError,\n\tGraphQLFieldConfig,\n\tGraphQLInt,\n\tGraphQLNonNull,\n\tGraphQLObjectType,\n\tGraphQLSchema,\n\tGraphQLSchemaConfig,\n\tGraphQLString,\n} from 'graphql'\nimport { S3Service, S3ServiceFactory } from './S3Service'\nimport { Project3Config, resolveS3Config, S3Config } from './Config'\nimport { GraphQLSchemaContributor, GraphQLSchemaContributorContext, Providers } from '@contember/engine-plugins'\nimport * as types from './S3SchemaTypes'\nimport { S3Acl, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator'\n\ninterface Identity {\n\tprojectRoles: string[]\n}\n\nexport type S3SchemaUploadAcl =\n\t| boolean\n\t| {\n\t\tmaxSize?: number\n\t}\n\nexport type S3SchemaAcl = Record<\n\tstring, // public/*.jpg\n\t{\n\t\tread?: boolean\n\t\tupload?: S3SchemaUploadAcl\n\t}\n>\n\nexport class S3SchemaContributor implements GraphQLSchemaContributor {\n\tconstructor(\n\t\tprivate readonly s3Factory: S3ServiceFactory,\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tgetCacheKey?({ project }: GraphQLSchemaContributorContext): string {\n\t\treturn project.s3 ? 'yes' : 'no'\n\t}\n\n\tcreateSchema(context: GraphQLSchemaContributorContext): GraphQLSchemaConfig | undefined {\n\t\tif (!context.project.s3) {\n\t\t\treturn undefined\n\t\t}\n\t\tconst rules = context.identity.projectRoles.flatMap(it => Object.entries((context.schema.acl.roles[it]?.s3 as S3SchemaAcl) || {}))\n\n\t\tconst uploadRules = rules.filter(([, it]) => it.upload).map(([it, val]) => ({\n\t\t\tpattern: it,\n\t\t\t...(typeof val.upload !== 'boolean' ? val.upload : {}),\n\t\t}))\n\t\tconst readRules = rules.filter(([, it]) => it.read).map(([it]) => ({\n\t\t\tpattern: it,\n\t\t}))\n\n\t\tif (uploadRules.length === 0 && readRules.length === 0) {\n\t\t\treturn undefined\n\t\t}\n\n\t\tconst authorizator = new S3ObjectAuthorizator(uploadRules, readRules)\n\t\tconst uploadMutation = this.createUploadMutation(authorizator)\n\t\tconst readMutation = this.createReadMutation(authorizator)\n\t\tconst mutation = {\n\t\t\tgenerateUploadUrl: uploadMutation as GraphQLFieldConfig<any, any, any>,\n\t\t\tgenerateReadUrl: readMutation,\n\t\t}\n\t\treturn {\n\t\t\tmutation: new GraphQLObjectType({\n\t\t\t\tname: 'Mutation',\n\t\t\t\tfields: () => mutation,\n\t\t\t}),\n\t\t\tquery: new GraphQLObjectType({\n\t\t\t\tname: 'Query',\n\t\t\t\tfields: () => ({\n\t\t\t\t\ts3DummyQuery: {\n\t\t\t\t\t\ttype: GraphQLString,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t}),\n\t\t}\n\t}\n\n\tprivate createReadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, { project: Project3Config }, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedRead),\n\t\t\targs: {\n\t\t\t\tobjectKey: {\n\t\t\t\t\ttype: new GraphQLNonNull(GraphQLString),\n\t\t\t\t},\n\t\t\t\texpiration: {\n\t\t\t\t\ttype: GraphQLInt,\n\t\t\t\t},\n\t\t\t},\n\t\t\tresolve: async (parent: any, args: { objectKey: string; expiration?: number }, ctx: { project: Project3Config }) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null })\n\t\t\t},\n\t\t} as GraphQLFieldConfig<any, any, any>\n\t}\n\n\tprivate createUploadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedUpload),\n\t\t\targs: {\n\t\t\t\tinput: { type: types.S3GenerateSignedUploadInput },\n\t\t\t\tcontentType: { type: GraphQLString, deprecationReason: 'Use input.contentType' },\n\t\t\t\texpiration: { type: GraphQLInt, deprecationReason: 'Use input.expiration' },\n\t\t\t\tprefix: { type: GraphQLString, deprecationReason: 'Use input.prefix' },\n\t\t\t\tacl: { type: types.S3Acl, deprecationReason: 'Use input.acl' },\n\t\t\t},\n\t\t\tresolve: async (\n\t\t\t\tparent: any,\n\t\t\t\targs: { input?: Partial<S3GenerateSignedUploadInput>; contentType?: string; acl?: S3Acl; expiration?: number; prefix?: string },\n\t\t\t\tctx: { project: Project3Config },\n\t\t\t) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedUploadUrl({\n\t\t\t\t\tacl: args.input?.acl ?? args.acl ?? null,\n\t\t\t\t\tcontentDisposition: args.input?.contentDisposition ?? null,\n\t\t\t\t\tcontentType: args.input?.contentType ?? args.contentType ?? null,\n\t\t\t\t\texpiration: args.input?.expiration ?? args.expiration ?? null,\n\t\t\t\t\textension: args.input?.extension ?? null,\n\t\t\t\t\tfileName: args.input?.fileName ?? null,\n\t\t\t\t\tprefix: args.input?.prefix ?? args.prefix ?? null,\n\t\t\t\t\tsuffix: args.input?.suffix ?? null,\n\t\t\t\t\tsize: args.input?.size ?? null,\n\t\t\t\t})\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["types.S3GenerateSignedUploadInput","types.S3Acl"],"mappings":";;;;AAmCO,MAAM,oBAAwD;AAAA,EACpE,YACkB,WACA,WAChB;AAFgB,SAAA,YAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,YAAa,EAAE,WAAoD;AAClE,WAAO,QAAQ,KAAK,QAAQ;AAAA,EAC7B;AAAA,EAEA,aAAa,SAA2E;AACvF,QAAI,CAAC,QAAQ,QAAQ,IAAI;AACxB,aAAO;AAAA,IACR;AACA,UAAM,QAAQ,QAAQ,SAAS,aAAa,QAAQ,QAAM,OAAO,QAAS,QAAQ,OAAO,IAAI,MAAM,EAAE,GAAG,MAAsB,CAAA,CAAE,CAAC;AAEjI,UAAM,cAAc,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;AAAA,MAC3E,SAAS;AAAA,MACT,GAAI,OAAO,IAAI,WAAW,YAAY,IAAI,SAAS,CAAA;AAAA,IAAC,EACnD;AACF,UAAM,YAAY,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;AAAA,MAClE,SAAS;AAAA,IAAA,EACR;AAEF,QAAI,YAAY,WAAW,KAAK,UAAU,WAAW,GAAG;AACvD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,IAAI,qBAAqB,aAAa,SAAS;AACpE,UAAM,iBAAiB,KAAK,qBAAqB,YAAY;AAC7D,UAAM,eAAe,KAAK,mBAAmB,YAAY;AACzD,UAAM,WAAW;AAAA,MAChB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,IAAA;AAElB,WAAO;AAAA,MACN,UAAU,IAAI,kBAAkB;AAAA,QAC/B,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAAA,CACd;AAAA,MACD,OAAO,IAAI,kBAAkB;AAAA,QAC5B,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,UACd,cAAc;AAAA,YACb,MAAM;AAAA,UAAA;AAAA,QACP;AAAA,MACD,CACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,mBAAmB,cAA+F;AACzH,WAAO;AAAA,MACN,MAAM,IAAI,eAAe,YAAY;AAAA,MACrC,MAAM;AAAA,QACL,WAAW;AAAA,UACV,MAAM,IAAI,eAAe,aAAa;AAAA,QAAA;AAAA,QAEvC,YAAY;AAAA,UACX,MAAM;AAAA,QAAA;AAAA,MACP;AAAA,MAED,SAAS,OAAO,QAAa,MAAkD,QAAqC;AACnH,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAI,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAW,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,iBAAiB,EAAE,WAAW,KAAK,WAAW,YAAY,KAAK,cAAc,MAAM;AAAA,MAC9F;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,qBAAqB,cAAuE;AACnG,WAAO;AAAA,MACN,MAAM,IAAI,eAAe,cAAc;AAAA,MACvC,MAAM;AAAA,QACL,OAAO,EAAE,MAAMA,4BAAM;AAAA,QACrB,aAAa,EAAE,MAAM,eAAe,mBAAmB,wBAAA;AAAA,QACvD,YAAY,EAAE,MAAM,YAAY,mBAAmB,uBAAA;AAAA,QACnD,QAAQ,EAAE,MAAM,eAAe,mBAAmB,mBAAA;AAAA,QAClD,KAAK,EAAE,MAAMC,OAAa,mBAAmB,gBAAA;AAAA,MAAgB;AAAA,MAE9D,SAAS,OACR,QACA,MACA,QACI;AACJ,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAI,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAW,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,mBAAmB;AAAA,UAC5B,KAAK,KAAK,OAAO,OAAO,KAAK,OAAO;AAAA,UACpC,oBAAoB,KAAK,OAAO,sBAAsB;AAAA,UACtD,aAAa,KAAK,OAAO,eAAe,KAAK,eAAe;AAAA,UAC5D,YAAY,KAAK,OAAO,cAAc,KAAK,cAAc;AAAA,UACzD,WAAW,KAAK,OAAO,aAAa;AAAA,UACpC,UAAU,KAAK,OAAO,YAAY;AAAA,UAClC,QAAQ,KAAK,OAAO,UAAU,KAAK,UAAU;AAAA,UAC7C,QAAQ,KAAK,OAAO,UAAU;AAAA,UAC9B,MAAM,KAAK,OAAO,QAAQ;AAAA,QAAA,CAC1B;AAAA,MACF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/development/src/S3SchemaTypes.cjs

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const graphql = require("graphql");
+const S3Header = new graphql.GraphQLObjectType({
+  name: "S3Header",
+  fields: {
+    key: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    value: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) }
+  }
+});
+const S3ContentDisposition = new graphql.GraphQLEnumType({
+  name: "S33ContentDisposition",
+  values: {
+    ATTACHMENT: {},
+    INLINE: {}
+  }
+});
+const S3SignedRead = new graphql.GraphQLObjectType({
+  name: "S3SignedRead",
+  fields: {
+    url: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    headers: {
+      type: new graphql.GraphQLNonNull(new graphql.GraphQLList(new graphql.GraphQLNonNull(S3Header)))
+    },
+    method: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    objectKey: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    bucket: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) }
+  }
+});
+const S3SignedUpload = new graphql.GraphQLObjectType({
+  name: "S3SignedUpload",
+  fields: {
+    url: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    headers: {
+      type: new graphql.GraphQLNonNull(new graphql.GraphQLList(new graphql.GraphQLNonNull(S3Header)))
+    },
+    method: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    objectKey: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    bucket: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    publicUrl: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) }
+  }
+});
+const S3Acl = new graphql.GraphQLEnumType({
+  name: "S3Acl",
+  values: {
+    PUBLIC_READ: {},
+    PRIVATE: {},
+    NONE: {}
+  }
+});
+const S3GenerateSignedUploadInput = new graphql.GraphQLInputObjectType({
+  name: "S3GenerateSignedUploadInput",
+  fields: {
+    contentType: { type: graphql.GraphQLString },
+    extension: { type: graphql.GraphQLString, description: "If not provided, extension is detected from a content-type." },
+    expiration: { type: graphql.GraphQLInt, description: "Signed URL expiration." },
+    size: { type: graphql.GraphQLInt, description: "Uploaded file size. Required when you enable ACL size limits." },
+    prefix: { type: graphql.GraphQLString, description: 'Can be used as a "directory".' },
+    suffix: { type: graphql.GraphQLString, description: "Suffix after generated id and before the extension." },
+    fileName: { type: graphql.GraphQLString, description: "This only affects Content-disposition header. Does not affect actual object key." },
+    contentDisposition: { type: S3ContentDisposition },
+    acl: { type: S3Acl, description: "If not supported by S3 provider, an error is thrown." }
+  }
+});
+exports.S3Acl = S3Acl;
+exports.S3ContentDisposition = S3ContentDisposition;
+exports.S3GenerateSignedUploadInput = S3GenerateSignedUploadInput;
+exports.S3Header = S3Header;
+exports.S3SignedRead = S3SignedRead;
+exports.S3SignedUpload = S3SignedUpload;
+//# sourceMappingURL=S3SchemaTypes.cjs.map

package/dist/development/src/S3SchemaTypes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3SchemaTypes.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3SchemaTypes.ts"],"sourcesContent":["import { GraphQLEnumType, GraphQLInputObjectType, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLString } from 'graphql'\n\nexport const S3Header = new GraphQLObjectType({\n\tname: 'S3Header',\n\tfields: {\n\t\tkey: { type: new GraphQLNonNull(GraphQLString) },\n\t\tvalue: { type: new GraphQLNonNull(GraphQLString) },\n\t},\n})\n\nexport const S3ContentDisposition = new GraphQLEnumType({\n\tname: 'S33ContentDisposition',\n\tvalues: {\n\t\tATTACHMENT: {},\n\t\tINLINE: {},\n\t},\n})\nexport type S3ContentDisposition = 'ATTACHMENT' | 'INLINE'\n\nexport const S3SignedRead = new GraphQLObjectType({\n\tname: 'S3SignedRead',\n\tfields: {\n\t\turl: { type: new GraphQLNonNull(GraphQLString) },\n\t\theaders: {\n\t\t\ttype: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(S3Header))),\n\t\t},\n\t\tmethod: { type: new GraphQLNonNull(GraphQLString) },\n\t\tobjectKey: { type: new GraphQLNonNull(GraphQLString) },\n\t\tbucket: { type: new GraphQLNonNull(GraphQLString) },\n\t},\n})\n\nexport const S3SignedUpload = new GraphQLObjectType({\n\tname: 'S3SignedUpload',\n\tfields: {\n\t\turl: { type: new GraphQLNonNull(GraphQLString) },\n\t\theaders: {\n\t\t\ttype: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(S3Header))),\n\t\t},\n\t\tmethod: { type: new GraphQLNonNull(GraphQLString) },\n\t\tobjectKey: { type: new GraphQLNonNull(GraphQLString) },\n\t\tbucket: { type: new GraphQLNonNull(GraphQLString) },\n\t\tpublicUrl: { type: new GraphQLNonNull(GraphQLString) },\n\t},\n})\n\nexport const S3Acl = new GraphQLEnumType({\n\tname: 'S3Acl',\n\tvalues: {\n\t\tPUBLIC_READ: {},\n\t\tPRIVATE: {},\n\t\tNONE: {},\n\t},\n})\n\nexport type S3Acl = 'PUBLIC_READ' | 'PRIVATE' | 'NONE'\n\nexport const S3GenerateSignedUploadInput = new GraphQLInputObjectType({\n\tname: 'S3GenerateSignedUploadInput',\n\tfields: {\n\t\tcontentType: { type: GraphQLString },\n\t\textension: { type: GraphQLString, description: 'If not provided, extension is detected from a content-type.' },\n\t\texpiration: { type: GraphQLInt, description: 'Signed URL expiration.' },\n\t\tsize: { type: GraphQLInt, description: 'Uploaded file size. Required when you enable ACL size limits.' },\n\t\tprefix: { type: GraphQLString, description: 'Can be used as a \"directory\".' },\n\t\tsuffix: { type: GraphQLString, description: 'Suffix after generated id and before the extension.' },\n\t\tfileName: { type: GraphQLString, description: 'This only affects Content-disposition header. Does not affect actual object key.' },\n\t\tcontentDisposition: { type: S3ContentDisposition },\n\t\tacl: { type: S3Acl, description: 'If not supported by S3 provider, an error is thrown.' },\n\t},\n})\nexport interface S3GenerateSignedUploadInput {\n\tcontentType: null | string\n\textension: null | string\n\texpiration: null | number\n\tsize: null | number\n\tprefix: null | string\n\tsuffix: null | string\n\tfileName: null | string\n\tcontentDisposition: null | S3ContentDisposition\n\tacl: null | S3Acl\n}\n"],"names":["GraphQLObjectType","GraphQLNonNull","GraphQLString","GraphQLEnumType","GraphQLList","GraphQLInputObjectType","GraphQLInt"],"mappings":";;;AAEO,MAAM,WAAW,IAAIA,QAAAA,kBAAkB;AAAA,EAC7C,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,KAAK,EAAE,MAAM,IAAIC,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IAC7C,OAAO,EAAE,MAAM,IAAID,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,EAAE;AAEnD,CAAC;AAEM,MAAM,uBAAuB,IAAIC,QAAAA,gBAAgB;AAAA,EACvD,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,YAAY,CAAA;AAAA,IACZ,QAAQ,CAAA;AAAA,EAAC;AAEX,CAAC;AAGM,MAAM,eAAe,IAAIH,QAAAA,kBAAkB;AAAA,EACjD,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,KAAK,EAAE,MAAM,IAAIC,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IAC7C,SAAS;AAAA,MACR,MAAM,IAAID,QAAAA,eAAe,IAAIG,QAAAA,YAAY,IAAIH,QAAAA,eAAe,QAAQ,CAAC,CAAC;AAAA,IAAA;AAAA,IAEvE,QAAQ,EAAE,MAAM,IAAIA,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IAChD,WAAW,EAAE,MAAM,IAAID,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IACnD,QAAQ,EAAE,MAAM,IAAID,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,EAAE;AAEpD,CAAC;AAEM,MAAM,iBAAiB,IAAIF,QAAAA,kBAAkB;AAAA,EACnD,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,KAAK,EAAE,MAAM,IAAIC,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IAC7C,SAAS;AAAA,MACR,MAAM,IAAID,QAAAA,eAAe,IAAIG,QAAAA,YAAY,IAAIH,QAAAA,eAAe,QAAQ,CAAC,CAAC;AAAA,IAAA;AAAA,IAEvE,QAAQ,EAAE,MAAM,IAAIA,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IAChD,WAAW,EAAE,MAAM,IAAID,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IACnD,QAAQ,EAAE,MAAM,IAAID,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,IAChD,WAAW,EAAE,MAAM,IAAID,QAAAA,eAAeC,QAAAA,aAAa,EAAA;AAAA,EAAE;AAEvD,CAAC;AAEM,MAAM,QAAQ,IAAIC,QAAAA,gBAAgB;AAAA,EACxC,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,aAAa,CAAA;AAAA,IACb,SAAS,CAAA;AAAA,IACT,MAAM,CAAA;AAAA,EAAC;AAET,CAAC;AAIM,MAAM,8BAA8B,IAAIE,QAAAA,uBAAuB;AAAA,EACrE,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,aAAa,EAAE,MAAMH,sBAAA;AAAA,IACrB,WAAW,EAAE,MAAMA,uBAAe,aAAa,8DAAA;AAAA,IAC/C,YAAY,EAAE,MAAMI,oBAAY,aAAa,yBAAA;AAAA,IAC7C,MAAM,EAAE,MAAMA,oBAAY,aAAa,gEAAA;AAAA,IACvC,QAAQ,EAAE,MAAMJ,uBAAe,aAAa,gCAAA;AAAA,IAC5C,QAAQ,EAAE,MAAMA,uBAAe,aAAa,sDAAA;AAAA,IAC5C,UAAU,EAAE,MAAMA,uBAAe,aAAa,mFAAA;AAAA,IAC9C,oBAAoB,EAAE,MAAM,qBAAA;AAAA,IAC5B,KAAK,EAAE,MAAM,OAAO,aAAa,uDAAA;AAAA,EAAuD;AAE1F,CAAC;;;;;;;"}

package/dist/development/src/S3SchemaTypes.js

@@ -0,0 +1,71 @@
+import { GraphQLObjectType, GraphQLNonNull, GraphQLString, GraphQLEnumType, GraphQLList, GraphQLInputObjectType, GraphQLInt } from "graphql";
+const S3Header = new GraphQLObjectType({
+  name: "S3Header",
+  fields: {
+    key: { type: new GraphQLNonNull(GraphQLString) },
+    value: { type: new GraphQLNonNull(GraphQLString) }
+  }
+});
+const S3ContentDisposition = new GraphQLEnumType({
+  name: "S33ContentDisposition",
+  values: {
+    ATTACHMENT: {},
+    INLINE: {}
+  }
+});
+const S3SignedRead = new GraphQLObjectType({
+  name: "S3SignedRead",
+  fields: {
+    url: { type: new GraphQLNonNull(GraphQLString) },
+    headers: {
+      type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(S3Header)))
+    },
+    method: { type: new GraphQLNonNull(GraphQLString) },
+    objectKey: { type: new GraphQLNonNull(GraphQLString) },
+    bucket: { type: new GraphQLNonNull(GraphQLString) }
+  }
+});
+const S3SignedUpload = new GraphQLObjectType({
+  name: "S3SignedUpload",
+  fields: {
+    url: { type: new GraphQLNonNull(GraphQLString) },
+    headers: {
+      type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(S3Header)))
+    },
+    method: { type: new GraphQLNonNull(GraphQLString) },
+    objectKey: { type: new GraphQLNonNull(GraphQLString) },
+    bucket: { type: new GraphQLNonNull(GraphQLString) },
+    publicUrl: { type: new GraphQLNonNull(GraphQLString) }
+  }
+});
+const S3Acl = new GraphQLEnumType({
+  name: "S3Acl",
+  values: {
+    PUBLIC_READ: {},
+    PRIVATE: {},
+    NONE: {}
+  }
+});
+const S3GenerateSignedUploadInput = new GraphQLInputObjectType({
+  name: "S3GenerateSignedUploadInput",
+  fields: {
+    contentType: { type: GraphQLString },
+    extension: { type: GraphQLString, description: "If not provided, extension is detected from a content-type." },
+    expiration: { type: GraphQLInt, description: "Signed URL expiration." },
+    size: { type: GraphQLInt, description: "Uploaded file size. Required when you enable ACL size limits." },
+    prefix: { type: GraphQLString, description: 'Can be used as a "directory".' },
+    suffix: { type: GraphQLString, description: "Suffix after generated id and before the extension." },
+    fileName: { type: GraphQLString, description: "This only affects Content-disposition header. Does not affect actual object key." },
+    contentDisposition: { type: S3ContentDisposition },
+    acl: { type: S3Acl, description: "If not supported by S3 provider, an error is thrown." }
+  }
+});
+export {
+  S3Acl,
+  S3ContentDisposition,
+  S3GenerateSignedUploadInput,
+  S3Header,
+  S3SignedRead,
+  S3SignedUpload
+};
+//# sourceMappingURL=S3SchemaTypes.js.map

package/dist/development/src/S3SchemaTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3SchemaTypes.js","sources":["../../../../packages/engine-s3-plugin/src/S3SchemaTypes.ts"],"sourcesContent":["import { GraphQLEnumType, GraphQLInputObjectType, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLString } from 'graphql'\n\nexport const S3Header = new GraphQLObjectType({\n\tname: 'S3Header',\n\tfields: {\n\t\tkey: { type: new GraphQLNonNull(GraphQLString) },\n\t\tvalue: { type: new GraphQLNonNull(GraphQLString) },\n\t},\n})\n\nexport const S3ContentDisposition = new GraphQLEnumType({\n\tname: 'S33ContentDisposition',\n\tvalues: {\n\t\tATTACHMENT: {},\n\t\tINLINE: {},\n\t},\n})\nexport type S3ContentDisposition = 'ATTACHMENT' | 'INLINE'\n\nexport const S3SignedRead = new GraphQLObjectType({\n\tname: 'S3SignedRead',\n\tfields: {\n\t\turl: { type: new GraphQLNonNull(GraphQLString) },\n\t\theaders: {\n\t\t\ttype: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(S3Header))),\n\t\t},\n\t\tmethod: { type: new GraphQLNonNull(GraphQLString) },\n\t\tobjectKey: { type: new GraphQLNonNull(GraphQLString) },\n\t\tbucket: { type: new GraphQLNonNull(GraphQLString) },\n\t},\n})\n\nexport const S3SignedUpload = new GraphQLObjectType({\n\tname: 'S3SignedUpload',\n\tfields: {\n\t\turl: { type: new GraphQLNonNull(GraphQLString) },\n\t\theaders: {\n\t\t\ttype: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(S3Header))),\n\t\t},\n\t\tmethod: { type: new GraphQLNonNull(GraphQLString) },\n\t\tobjectKey: { type: new GraphQLNonNull(GraphQLString) },\n\t\tbucket: { type: new GraphQLNonNull(GraphQLString) },\n\t\tpublicUrl: { type: new GraphQLNonNull(GraphQLString) },\n\t},\n})\n\nexport const S3Acl = new GraphQLEnumType({\n\tname: 'S3Acl',\n\tvalues: {\n\t\tPUBLIC_READ: {},\n\t\tPRIVATE: {},\n\t\tNONE: {},\n\t},\n})\n\nexport type S3Acl = 'PUBLIC_READ' | 'PRIVATE' | 'NONE'\n\nexport const S3GenerateSignedUploadInput = new GraphQLInputObjectType({\n\tname: 'S3GenerateSignedUploadInput',\n\tfields: {\n\t\tcontentType: { type: GraphQLString },\n\t\textension: { type: GraphQLString, description: 'If not provided, extension is detected from a content-type.' },\n\t\texpiration: { type: GraphQLInt, description: 'Signed URL expiration.' },\n\t\tsize: { type: GraphQLInt, description: 'Uploaded file size. Required when you enable ACL size limits.' },\n\t\tprefix: { type: GraphQLString, description: 'Can be used as a \"directory\".' },\n\t\tsuffix: { type: GraphQLString, description: 'Suffix after generated id and before the extension.' },\n\t\tfileName: { type: GraphQLString, description: 'This only affects Content-disposition header. Does not affect actual object key.' },\n\t\tcontentDisposition: { type: S3ContentDisposition },\n\t\tacl: { type: S3Acl, description: 'If not supported by S3 provider, an error is thrown.' },\n\t},\n})\nexport interface S3GenerateSignedUploadInput {\n\tcontentType: null | string\n\textension: null | string\n\texpiration: null | number\n\tsize: null | number\n\tprefix: null | string\n\tsuffix: null | string\n\tfileName: null | string\n\tcontentDisposition: null | S3ContentDisposition\n\tacl: null | S3Acl\n}\n"],"names":[],"mappings":";AAEO,MAAM,WAAW,IAAI,kBAAkB;AAAA,EAC7C,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,KAAK,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IAC7C,OAAO,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,EAAE;AAEnD,CAAC;AAEM,MAAM,uBAAuB,IAAI,gBAAgB;AAAA,EACvD,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,YAAY,CAAA;AAAA,IACZ,QAAQ,CAAA;AAAA,EAAC;AAEX,CAAC;AAGM,MAAM,eAAe,IAAI,kBAAkB;AAAA,EACjD,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,KAAK,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IAC7C,SAAS;AAAA,MACR,MAAM,IAAI,eAAe,IAAI,YAAY,IAAI,eAAe,QAAQ,CAAC,CAAC;AAAA,IAAA;AAAA,IAEvE,QAAQ,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IAChD,WAAW,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IACnD,QAAQ,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,EAAE;AAEpD,CAAC;AAEM,MAAM,iBAAiB,IAAI,kBAAkB;AAAA,EACnD,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,KAAK,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IAC7C,SAAS;AAAA,MACR,MAAM,IAAI,eAAe,IAAI,YAAY,IAAI,eAAe,QAAQ,CAAC,CAAC;AAAA,IAAA;AAAA,IAEvE,QAAQ,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IAChD,WAAW,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IACnD,QAAQ,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,IAChD,WAAW,EAAE,MAAM,IAAI,eAAe,aAAa,EAAA;AAAA,EAAE;AAEvD,CAAC;AAEM,MAAM,QAAQ,IAAI,gBAAgB;AAAA,EACxC,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,aAAa,CAAA;AAAA,IACb,SAAS,CAAA;AAAA,IACT,MAAM,CAAA;AAAA,EAAC;AAET,CAAC;AAIM,MAAM,8BAA8B,IAAI,uBAAuB;AAAA,EACrE,MAAM;AAAA,EACN,QAAQ;AAAA,IACP,aAAa,EAAE,MAAM,cAAA;AAAA,IACrB,WAAW,EAAE,MAAM,eAAe,aAAa,8DAAA;AAAA,IAC/C,YAAY,EAAE,MAAM,YAAY,aAAa,yBAAA;AAAA,IAC7C,MAAM,EAAE,MAAM,YAAY,aAAa,gEAAA;AAAA,IACvC,QAAQ,EAAE,MAAM,eAAe,aAAa,gCAAA;AAAA,IAC5C,QAAQ,EAAE,MAAM,eAAe,aAAa,sDAAA;AAAA,IAC5C,UAAU,EAAE,MAAM,eAAe,aAAa,mFAAA;AAAA,IAC9C,oBAAoB,EAAE,MAAM,qBAAA;AAAA,IAC5B,KAAK,EAAE,MAAM,OAAO,aAAa,uDAAA;AAAA,EAAuD;AAE1F,CAAC;"}

package/dist/development/src/S3Service.cjs

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const mimeTypes = require("mime-types");
+const Config = require("./Config.cjs");
+const graphqlUtils = require("@contember/graphql-utils");
+const S3Signer = require("./S3Signer.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class S3Service {
+  constructor(config, providers, authorizator) {
+    this.config = config;
+    this.providers = providers;
+    this.authorizator = authorizator;
+    __publicField(this, "publicBaseUrl");
+    __publicField(this, "signer");
+    this.publicBaseUrl = Config.resolveS3PublicBaseUrl(config);
+    this.signer = new S3Signer.S3Signer(config, providers);
+  }
+  getSignedUploadUrl({ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension, size }) {
+    const ext = extension ?? ((contentType ? mimeTypes.extension(contentType) : null) || "bin");
+    const id = this.providers.uuid();
+    const localObjectKey = (prefix ? prefix + "/" : "") + `${id}${suffix ?? ""}.${ext}`;
+    this.authorizator.verifyUploadAccess({ key: localObjectKey, size });
+    const objectKey = (this.config.prefix ? this.config.prefix + "/" : "") + localObjectKey;
+    const bucket = this.config.bucket;
+    if (acl && this.config.noAcl) {
+      throw new graphqlUtils.UserInputError("ACL is not supported");
+    }
+    const headers = {
+      "Cache-Control": "immutable"
+    };
+    if (contentType) {
+      headers["Content-Type"] = contentType;
+    }
+    if (!this.config.noAcl && acl !== "NONE") {
+      const mapping = { PUBLIC_READ: "public-read", PRIVATE: "private" };
+      headers["x-amz-acl"] = mapping[acl ?? "PUBLIC_READ"];
+    }
+    if (fileName || contentDisposition) {
+      let contentDispositionHeader = contentDisposition?.toLowerCase() ?? "inline";
+      if (fileName) {
+        contentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`;
+      }
+      headers["Content-Disposition"] = contentDispositionHeader;
+    }
+    const headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }));
+    if (size) {
+      headers["Content-Length"] = String(size);
+    }
+    const url = this.signer.sign({
+      action: "upload",
+      expiration: expiration ?? 3600,
+      key: objectKey,
+      headers: { ...headers }
+    });
+    const publicUrl = this.formatPublicUrl(objectKey);
+    return {
+      bucket,
+      objectKey,
+      url,
+      publicUrl,
+      headers: headersToSend,
+      method: "PUT"
+    };
+  }
+  getSignedReadUrl({ objectKey, expiration }) {
+    const bucket = this.config.bucket;
+    const publicPrefix = this.formatPublicUrl("");
+    if (objectKey.startsWith(publicPrefix)) {
+      objectKey = objectKey.substring(publicPrefix.length);
+    }
+    if (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {
+      throw new graphqlUtils.ForbiddenError(
+        `Given object key "${objectKey}" does not start with a project prefix "${this.config.prefix}"`
+      );
+    }
+    const localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey;
+    this.authorizator.verifyReadAccess({ key: localObjectKey });
+    const url = this.signer.sign({
+      action: "read",
+      expiration: expiration ?? 3600,
+      key: objectKey,
+      headers: {}
+    });
+    return {
+      bucket,
+      objectKey,
+      url,
+      headers: [],
+      method: "GET"
+    };
+  }
+  formatPublicUrl(key) {
+    return `${this.publicBaseUrl}/${key}`;
+  }
+}
+class S3ServiceFactory {
+  create(config, providers, authorizator) {
+    return new S3Service(config, providers, authorizator);
+  }
+}
+exports.S3Service = S3Service;
+exports.S3ServiceFactory = S3ServiceFactory;
+//# sourceMappingURL=S3Service.cjs.map

package/dist/development/src/S3Service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3Service.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3Service.ts"],"sourcesContent":["import { extension as resolveExtension } from 'mime-types'\nimport { resolveS3PublicBaseUrl, S3Config } from './Config'\nimport { ForbiddenError, UserInputError } from '@contember/graphql-utils'\nimport { Providers } from '@contember/engine-plugins'\nimport { S3Signer } from './S3Signer'\nimport { S3GenerateSignedUploadInput } from './S3SchemaTypes'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator'\n\ntype SignedReadUrl = {\n\turl: string\n\tbucket: string\n\tobjectKey: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype SignedUploadUrl = {\n\tobjectKey: string\n\turl: string\n\tbucket: string\n\tpublicUrl: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\nexport class S3Service {\n\tprivate readonly publicBaseUrl: string\n\n\tprivate readonly signer: S3Signer\n\n\tconstructor(\n\t\tpublic readonly config: S3Config,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now'>,\n\t\tprivate readonly authorizator: S3ObjectAuthorizator,\n\t) {\n\t\tthis.publicBaseUrl = resolveS3PublicBaseUrl(config)\n\t\tthis.signer = new S3Signer(config, providers)\n\t}\n\n\tpublic getSignedUploadUrl(\n\t\t{ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension, size }: S3GenerateSignedUploadInput,\n\t): SignedUploadUrl {\n\t\tconst ext = extension ?? ((contentType ? resolveExtension(contentType) : null) || 'bin')\n\t\tconst id = this.providers.uuid()\n\t\tconst localObjectKey = (prefix ? prefix + '/' : '') + `${id}${suffix ?? ''}.${ext}`\n\t\tthis.authorizator.verifyUploadAccess({ key: localObjectKey, size })\n\n\t\tconst objectKey = (this.config.prefix ? this.config.prefix + '/' : '') + localObjectKey\n\n\t\tconst bucket = this.config.bucket\n\t\tif (acl && this.config.noAcl) {\n\t\t\tthrow new UserInputError('ACL is not supported')\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t'Cache-Control': 'immutable',\n\t\t}\n\t\tif (contentType) {\n\t\t\theaders['Content-Type'] = contentType\n\t\t}\n\n\t\tif (!this.config.noAcl && acl !== 'NONE') {\n\t\t\tconst mapping = { PUBLIC_READ: 'public-read', PRIVATE: 'private' }\n\t\t\theaders['x-amz-acl'] = mapping[acl ?? 'PUBLIC_READ']\n\t\t}\n\t\tif (fileName || contentDisposition) {\n\t\t\tlet contentDispositionHeader = contentDisposition?.toLowerCase() ?? 'inline'\n\t\t\tif (fileName) {\n\t\t\t\tcontentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`\n\t\t\t}\n\t\t\theaders['Content-Disposition'] = contentDispositionHeader\n\t\t}\n\t\tconst headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }))\n\n\t\t// intentionally not sending following headers\n\t\tif (size) {\n\t\t\theaders['Content-Length'] = String(size)\n\t\t}\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'upload',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: { ...headers },\n\t\t})\n\n\t\tconst publicUrl = this.formatPublicUrl(objectKey)\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\tpublicUrl,\n\t\t\theaders: headersToSend,\n\t\t\tmethod: 'PUT',\n\t\t}\n\t}\n\n\tpublic getSignedReadUrl({ objectKey, expiration }: { objectKey: string; expiration: number | null }): SignedReadUrl {\n\t\tconst bucket = this.config.bucket\n\n\t\tconst publicPrefix = this.formatPublicUrl('')\n\t\tif (objectKey.startsWith(publicPrefix)) {\n\t\t\tobjectKey = objectKey.substring(publicPrefix.length)\n\t\t}\n\t\tif (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t`Given object key \"${objectKey}\" does not start with a project prefix \"${this.config.prefix}\"`,\n\t\t\t)\n\t\t}\n\t\tconst localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey\n\t\tthis.authorizator.verifyReadAccess({ key: localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'read',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\theaders: [],\n\t\t\tmethod: 'GET',\n\t\t}\n\t}\n\n\tpublic formatPublicUrl(key: string): string {\n\t\treturn `${this.publicBaseUrl}/${key}`\n\t}\n}\n\nexport class S3ServiceFactory {\n\tpublic create(config: S3Config, providers: Providers, authorizator: S3ObjectAuthorizator) {\n\t\treturn new S3Service(config, providers, authorizator)\n\t}\n}\n"],"names":["resolveS3PublicBaseUrl","S3Signer","resolveExtension","UserInputError","ForbiddenError"],"mappings":";;;;;;;;;AAyBO,MAAM,UAAU;AAAA,EAKtB,YACiB,QACC,WACA,cAChB;AAHe,SAAA,SAAA;AACC,SAAA,YAAA;AACA,SAAA,eAAA;AAPlB,kBAAA,MAAiB,eAAA;AAEjB,kBAAA,MAAiB,QAAA;AAOhB,SAAK,gBAAgBA,OAAAA,uBAAuB,MAAM;AAClD,SAAK,SAAS,IAAIC,kBAAS,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEO,mBACN,EAAE,KAAK,oBAAoB,aAAa,YAAY,QAAQ,QAAQ,UAAU,WAAW,KAAA,GACvE;AAClB,UAAM,MAAM,eAAe,cAAcC,UAAAA,UAAiB,WAAW,IAAI,SAAS;AAClF,UAAM,KAAK,KAAK,UAAU,KAAA;AAC1B,UAAM,kBAAkB,SAAS,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,GAAG;AACjF,SAAK,aAAa,mBAAmB,EAAE,KAAK,gBAAgB,MAAM;AAElE,UAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM,MAAM;AAEzE,UAAM,SAAS,KAAK,OAAO;AAC3B,QAAI,OAAO,KAAK,OAAO,OAAO;AAC7B,YAAM,IAAIC,aAAAA,eAAe,sBAAsB;AAAA,IAChD;AAEA,UAAM,UAAkC;AAAA,MACvC,iBAAiB;AAAA,IAAA;AAElB,QAAI,aAAa;AAChB,cAAQ,cAAc,IAAI;AAAA,IAC3B;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS,QAAQ,QAAQ;AACzC,YAAM,UAAU,EAAE,aAAa,eAAe,SAAS,UAAA;AACvD,cAAQ,WAAW,IAAI,QAAQ,OAAO,aAAa;AAAA,IACpD;AACA,QAAI,YAAY,oBAAoB;AACnC,UAAI,2BAA2B,oBAAoB,YAAA,KAAiB;AACpE,UAAI,UAAU;AACb,oCAA4B,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,MAC/E;AACA,cAAQ,qBAAqB,IAAI;AAAA,IAClC;AACA,UAAM,gBAAgB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,QAAQ;AAGpF,QAAI,MAAM;AACT,cAAQ,gBAAgB,IAAI,OAAO,IAAI;AAAA,IACxC;AAEA,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,EAAE,GAAG,QAAA;AAAA,IAAQ,CACtB;AAED,UAAM,YAAY,KAAK,gBAAgB,SAAS;AAChD,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,iBAAiB,EAAE,WAAW,cAA+E;AACnH,UAAM,SAAS,KAAK,OAAO;AAE3B,UAAM,eAAe,KAAK,gBAAgB,EAAE;AAC5C,QAAI,UAAU,WAAW,YAAY,GAAG;AACvC,kBAAY,UAAU,UAAU,aAAa,MAAM;AAAA,IACpD;AACA,QAAI,KAAK,OAAO,UAAU,CAAC,UAAU,WAAW,KAAK,OAAO,MAAM,GAAG;AACpE,YAAM,IAAIC,aAAAA;AAAAA,QACT,qBAAqB,SAAS,2CAA2C,KAAK,OAAO,MAAM;AAAA,MAAA;AAAA,IAE7F;AACA,UAAM,iBAAiB,KAAK,OAAO,SAAS,UAAU,UAAU,KAAK,OAAO,OAAO,SAAS,CAAC,IAAI;AACjG,SAAK,aAAa,iBAAiB,EAAE,KAAK,gBAAgB;AAE1D,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,CAAA;AAAA,IAAC,CACV;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,CAAA;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,gBAAgB,KAAqB;AAC3C,WAAO,GAAG,KAAK,aAAa,IAAI,GAAG;AAAA,EACpC;AACD;AAEO,MAAM,iBAAiB;AAAA,EACtB,OAAO,QAAkB,WAAsB,cAAoC;AACzF,WAAO,IAAI,UAAU,QAAQ,WAAW,YAAY;AAAA,EACrD;AACD;;;"}

package/dist/development/src/S3Service.js

@@ -0,0 +1,105 @@
+import { extension } from "mime-types";
+import { resolveS3PublicBaseUrl } from "./Config.js";
+import { UserInputError, ForbiddenError } from "@contember/graphql-utils";
+import { S3Signer } from "./S3Signer.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class S3Service {
+  constructor(config, providers, authorizator) {
+    this.config = config;
+    this.providers = providers;
+    this.authorizator = authorizator;
+    __publicField(this, "publicBaseUrl");
+    __publicField(this, "signer");
+    this.publicBaseUrl = resolveS3PublicBaseUrl(config);
+    this.signer = new S3Signer(config, providers);
+  }
+  getSignedUploadUrl({ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension: extension$1, size }) {
+    const ext = extension$1 ?? ((contentType ? extension(contentType) : null) || "bin");
+    const id = this.providers.uuid();
+    const localObjectKey = (prefix ? prefix + "/" : "") + `${id}${suffix ?? ""}.${ext}`;
+    this.authorizator.verifyUploadAccess({ key: localObjectKey, size });
+    const objectKey = (this.config.prefix ? this.config.prefix + "/" : "") + localObjectKey;
+    const bucket = this.config.bucket;
+    if (acl && this.config.noAcl) {
+      throw new UserInputError("ACL is not supported");
+    }
+    const headers = {
+      "Cache-Control": "immutable"
+    };
+    if (contentType) {
+      headers["Content-Type"] = contentType;
+    }
+    if (!this.config.noAcl && acl !== "NONE") {
+      const mapping = { PUBLIC_READ: "public-read", PRIVATE: "private" };
+      headers["x-amz-acl"] = mapping[acl ?? "PUBLIC_READ"];
+    }
+    if (fileName || contentDisposition) {
+      let contentDispositionHeader = contentDisposition?.toLowerCase() ?? "inline";
+      if (fileName) {
+        contentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`;
+      }
+      headers["Content-Disposition"] = contentDispositionHeader;
+    }
+    const headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }));
+    if (size) {
+      headers["Content-Length"] = String(size);
+    }
+    const url = this.signer.sign({
+      action: "upload",
+      expiration: expiration ?? 3600,
+      key: objectKey,
+      headers: { ...headers }
+    });
+    const publicUrl = this.formatPublicUrl(objectKey);
+    return {
+      bucket,
+      objectKey,
+      url,
+      publicUrl,
+      headers: headersToSend,
+      method: "PUT"
+    };
+  }
+  getSignedReadUrl({ objectKey, expiration }) {
+    const bucket = this.config.bucket;
+    const publicPrefix = this.formatPublicUrl("");
+    if (objectKey.startsWith(publicPrefix)) {
+      objectKey = objectKey.substring(publicPrefix.length);
+    }
+    if (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {
+      throw new ForbiddenError(
+        `Given object key "${objectKey}" does not start with a project prefix "${this.config.prefix}"`
+      );
+    }
+    const localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey;
+    this.authorizator.verifyReadAccess({ key: localObjectKey });
+    const url = this.signer.sign({
+      action: "read",
+      expiration: expiration ?? 3600,
+      key: objectKey,
+      headers: {}
+    });
+    return {
+      bucket,
+      objectKey,
+      url,
+      headers: [],
+      method: "GET"
+    };
+  }
+  formatPublicUrl(key) {
+    return `${this.publicBaseUrl}/${key}`;
+  }
+}
+class S3ServiceFactory {
+  create(config, providers, authorizator) {
+    return new S3Service(config, providers, authorizator);
+  }
+}
+export {
+  S3Service,
+  S3ServiceFactory
+};
+//# sourceMappingURL=S3Service.js.map

package/dist/development/src/S3Service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3Service.js","sources":["../../../../packages/engine-s3-plugin/src/S3Service.ts"],"sourcesContent":["import { extension as resolveExtension } from 'mime-types'\nimport { resolveS3PublicBaseUrl, S3Config } from './Config'\nimport { ForbiddenError, UserInputError } from '@contember/graphql-utils'\nimport { Providers } from '@contember/engine-plugins'\nimport { S3Signer } from './S3Signer'\nimport { S3GenerateSignedUploadInput } from './S3SchemaTypes'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator'\n\ntype SignedReadUrl = {\n\turl: string\n\tbucket: string\n\tobjectKey: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype SignedUploadUrl = {\n\tobjectKey: string\n\turl: string\n\tbucket: string\n\tpublicUrl: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\nexport class S3Service {\n\tprivate readonly publicBaseUrl: string\n\n\tprivate readonly signer: S3Signer\n\n\tconstructor(\n\t\tpublic readonly config: S3Config,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now'>,\n\t\tprivate readonly authorizator: S3ObjectAuthorizator,\n\t) {\n\t\tthis.publicBaseUrl = resolveS3PublicBaseUrl(config)\n\t\tthis.signer = new S3Signer(config, providers)\n\t}\n\n\tpublic getSignedUploadUrl(\n\t\t{ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension, size }: S3GenerateSignedUploadInput,\n\t): SignedUploadUrl {\n\t\tconst ext = extension ?? ((contentType ? resolveExtension(contentType) : null) || 'bin')\n\t\tconst id = this.providers.uuid()\n\t\tconst localObjectKey = (prefix ? prefix + '/' : '') + `${id}${suffix ?? ''}.${ext}`\n\t\tthis.authorizator.verifyUploadAccess({ key: localObjectKey, size })\n\n\t\tconst objectKey = (this.config.prefix ? this.config.prefix + '/' : '') + localObjectKey\n\n\t\tconst bucket = this.config.bucket\n\t\tif (acl && this.config.noAcl) {\n\t\t\tthrow new UserInputError('ACL is not supported')\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t'Cache-Control': 'immutable',\n\t\t}\n\t\tif (contentType) {\n\t\t\theaders['Content-Type'] = contentType\n\t\t}\n\n\t\tif (!this.config.noAcl && acl !== 'NONE') {\n\t\t\tconst mapping = { PUBLIC_READ: 'public-read', PRIVATE: 'private' }\n\t\t\theaders['x-amz-acl'] = mapping[acl ?? 'PUBLIC_READ']\n\t\t}\n\t\tif (fileName || contentDisposition) {\n\t\t\tlet contentDispositionHeader = contentDisposition?.toLowerCase() ?? 'inline'\n\t\t\tif (fileName) {\n\t\t\t\tcontentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`\n\t\t\t}\n\t\t\theaders['Content-Disposition'] = contentDispositionHeader\n\t\t}\n\t\tconst headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }))\n\n\t\t// intentionally not sending following headers\n\t\tif (size) {\n\t\t\theaders['Content-Length'] = String(size)\n\t\t}\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'upload',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: { ...headers },\n\t\t})\n\n\t\tconst publicUrl = this.formatPublicUrl(objectKey)\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\tpublicUrl,\n\t\t\theaders: headersToSend,\n\t\t\tmethod: 'PUT',\n\t\t}\n\t}\n\n\tpublic getSignedReadUrl({ objectKey, expiration }: { objectKey: string; expiration: number | null }): SignedReadUrl {\n\t\tconst bucket = this.config.bucket\n\n\t\tconst publicPrefix = this.formatPublicUrl('')\n\t\tif (objectKey.startsWith(publicPrefix)) {\n\t\t\tobjectKey = objectKey.substring(publicPrefix.length)\n\t\t}\n\t\tif (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t`Given object key \"${objectKey}\" does not start with a project prefix \"${this.config.prefix}\"`,\n\t\t\t)\n\t\t}\n\t\tconst localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey\n\t\tthis.authorizator.verifyReadAccess({ key: localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'read',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\theaders: [],\n\t\t\tmethod: 'GET',\n\t\t}\n\t}\n\n\tpublic formatPublicUrl(key: string): string {\n\t\treturn `${this.publicBaseUrl}/${key}`\n\t}\n}\n\nexport class S3ServiceFactory {\n\tpublic create(config: S3Config, providers: Providers, authorizator: S3ObjectAuthorizator) {\n\t\treturn new S3Service(config, providers, authorizator)\n\t}\n}\n"],"names":["extension","resolveExtension"],"mappings":";;;;;;;AAyBO,MAAM,UAAU;AAAA,EAKtB,YACiB,QACC,WACA,cAChB;AAHe,SAAA,SAAA;AACC,SAAA,YAAA;AACA,SAAA,eAAA;AAPlB,kBAAA,MAAiB,eAAA;AAEjB,kBAAA,MAAiB,QAAA;AAOhB,SAAK,gBAAgB,uBAAuB,MAAM;AAClD,SAAK,SAAS,IAAI,SAAS,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEO,mBACN,EAAE,KAAK,oBAAoB,aAAa,YAAY,QAAQ,QAAQ,qBAAUA,aAAW,KAAA,GACvE;AAClB,UAAM,MAAMA,iBAAe,cAAcC,UAAiB,WAAW,IAAI,SAAS;AAClF,UAAM,KAAK,KAAK,UAAU,KAAA;AAC1B,UAAM,kBAAkB,SAAS,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,GAAG;AACjF,SAAK,aAAa,mBAAmB,EAAE,KAAK,gBAAgB,MAAM;AAElE,UAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM,MAAM;AAEzE,UAAM,SAAS,KAAK,OAAO;AAC3B,QAAI,OAAO,KAAK,OAAO,OAAO;AAC7B,YAAM,IAAI,eAAe,sBAAsB;AAAA,IAChD;AAEA,UAAM,UAAkC;AAAA,MACvC,iBAAiB;AAAA,IAAA;AAElB,QAAI,aAAa;AAChB,cAAQ,cAAc,IAAI;AAAA,IAC3B;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS,QAAQ,QAAQ;AACzC,YAAM,UAAU,EAAE,aAAa,eAAe,SAAS,UAAA;AACvD,cAAQ,WAAW,IAAI,QAAQ,OAAO,aAAa;AAAA,IACpD;AACA,QAAI,YAAY,oBAAoB;AACnC,UAAI,2BAA2B,oBAAoB,YAAA,KAAiB;AACpE,UAAI,UAAU;AACb,oCAA4B,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,MAC/E;AACA,cAAQ,qBAAqB,IAAI;AAAA,IAClC;AACA,UAAM,gBAAgB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,QAAQ;AAGpF,QAAI,MAAM;AACT,cAAQ,gBAAgB,IAAI,OAAO,IAAI;AAAA,IACxC;AAEA,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,EAAE,GAAG,QAAA;AAAA,IAAQ,CACtB;AAED,UAAM,YAAY,KAAK,gBAAgB,SAAS;AAChD,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,iBAAiB,EAAE,WAAW,cAA+E;AACnH,UAAM,SAAS,KAAK,OAAO;AAE3B,UAAM,eAAe,KAAK,gBAAgB,EAAE;AAC5C,QAAI,UAAU,WAAW,YAAY,GAAG;AACvC,kBAAY,UAAU,UAAU,aAAa,MAAM;AAAA,IACpD;AACA,QAAI,KAAK,OAAO,UAAU,CAAC,UAAU,WAAW,KAAK,OAAO,MAAM,GAAG;AACpE,YAAM,IAAI;AAAA,QACT,qBAAqB,SAAS,2CAA2C,KAAK,OAAO,MAAM;AAAA,MAAA;AAAA,IAE7F;AACA,UAAM,iBAAiB,KAAK,OAAO,SAAS,UAAU,UAAU,KAAK,OAAO,OAAO,SAAS,CAAC,IAAI;AACjG,SAAK,aAAa,iBAAiB,EAAE,KAAK,gBAAgB;AAE1D,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,CAAA;AAAA,IAAC,CACV;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,CAAA;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,gBAAgB,KAAqB;AAC3C,WAAO,GAAG,KAAK,aAAa,IAAI,GAAG;AAAA,EACpC;AACD;AAEO,MAAM,iBAAiB;AAAA,EACtB,OAAO,QAAkB,WAAsB,cAAoC;AACzF,WAAO,IAAI,UAAU,QAAQ,WAAW,YAAY;AAAA,EACrD;AACD;"}

package/dist/development/src/S3Signer.cjs

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Config = require("./Config.cjs");
+const qs = require("qs");
+const crypto = require("node:crypto");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const hmac = (secret, data) => crypto.createHmac("sha256", secret).update(data).digest();
+const hash = (data) => crypto.createHash("sha256").update(data).digest("hex");
+const unsignableHeaders = ["authorization", "user-agent", "content-type", "expect", "x-amzn-trace-id"];
+const sortMap = (input) => {
+  return Object.fromEntries(Object.entries(input).sort((a, b) => a[0] < b[0] ? -1 : 1));
+};
+class S3Signer {
+  constructor(config, providers) {
+    this.config = config;
+    this.providers = providers;
+    __publicField(this, "region");
+    this.region = config.region || "eu-west-1";
+  }
+  sign(request) {
+    const uris = Config.resolveS3Endpoint(this.config);
+    request.headers.host = uris.endpoint.substring(uris.endpoint.indexOf("://") + 3);
+    const nowFormatted = this.providers.now().toISOString().replace(/[:-]|\.\d{3}/g, "");
+    const queryString = this.getQueryParams(request, nowFormatted);
+    const path = uris.basePath + "/" + request.key;
+    const lines = [
+      request.action === "read" ? "GET" : "PUT",
+      path,
+      queryString,
+      this.getSignedHeaders(request),
+      this.getSignedHeaderNames(Object.keys(request.headers)),
+      "UNSIGNED-PAYLOAD"
+    ];
+    const canonicalRequest = lines.join("\n");
+    const parts = ["AWS4-HMAC-SHA256", nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)];
+    const signature = [nowFormatted.substring(0, 8), this.region, "s3", "aws4_request", parts.join("\n")].reduce((acc, x) => hmac(acc, x), Buffer.from("AWS4" + this.config.credentials.secret)).toString("hex");
+    return uris.endpoint + path + "?" + (queryString + "&X-Amz-Signature=" + signature).split("&").sort().join("&");
+  }
+  getQueryParams(request, dateFormatted) {
+    const scope = this.getScope(dateFormatted);
+    const queryString = {
+      "X-Amz-Date": dateFormatted,
+      "X-Amz-Algorithm": "AWS4-HMAC-SHA256",
+      "X-Amz-Credential": this.config.credentials.key + "/" + scope,
+      "X-Amz-Expires": String(request.expiration),
+      "X-Amz-SignedHeaders": this.getSignedHeaderNames(Object.keys(request.headers))
+    };
+    const headersToQs = ["content-type", "content-md5", "cache-control"];
+    for (const header in request.headers) {
+      const headerLc = header.toLowerCase();
+      if (headersToQs.includes(headerLc) || headerLc.startsWith("x-amz-")) {
+        queryString[headerLc.startsWith("x-amz-meta-") ? headerLc : header] = request.headers[header];
+      }
+    }
+    const qsSorted = sortMap(queryString);
+    return qs.stringify(qsSorted);
+  }
+  getScope(dateFormatted) {
+    return dateFormatted.substring(0, 8) + "/" + this.region + "/s3/aws4_request";
+  }
+  getSignedHeaders(request) {
+    const lines = [];
+    for (const header in request.headers) {
+      const headerNameLc = header.toLowerCase();
+      if (!this.isHeaderSignable(headerNameLc)) {
+        continue;
+      }
+      const value = request.headers[header].replace(/\s+/g, " ").replace(/^\s+|\s+$/g, "");
+      lines.push(`${headerNameLc}:${value}
+`);
+    }
+    return lines.sort().join("");
+  }
+  isHeaderSignable(headerName) {
+    return headerName.toLowerCase().startsWith("x-amz") || !unsignableHeaders.includes(headerName.toLowerCase());
+  }
+  getSignedHeaderNames(headers) {
+    return headers.map((it) => it.toLowerCase()).filter(this.isHeaderSignable).sort().join(";");
+  }
+}
+exports.S3Signer = S3Signer;
+//# sourceMappingURL=S3Signer.cjs.map

package/dist/development/src/S3Signer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3Signer.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\trequest.action === 'read' ? 'GET' : 'PUT',\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":["createHmac","createHash","resolveS3Endpoint"],"mappings":";;;;;;;;AAYA,MAAM,OAAO,CAAC,QAAoB,SAAqBA,kBAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqBC,OAAAA,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAOC,OAAAA,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,WAAW,SAAS,QAAQ;AAAA,MACpC;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;;"}