@contember/engine-s3-plugin 2.1.0-alpha.37 → 2.1.0-alpha.39

package/dist/development/src/S3Signer.js

@@ -0,0 +1,84 @@
+import { resolveS3Endpoint } from "./Config.js";
+import qs from "qs";
+import { createHash, createHmac } from "node:crypto";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const hmac = (secret, data) => createHmac("sha256", secret).update(data).digest();
+const hash = (data) => createHash("sha256").update(data).digest("hex");
+const unsignableHeaders = ["authorization", "user-agent", "content-type", "expect", "x-amzn-trace-id"];
+const sortMap = (input) => {
+  return Object.fromEntries(Object.entries(input).sort((a, b) => a[0] < b[0] ? -1 : 1));
+};
+class S3Signer {
+  constructor(config, providers) {
+    this.config = config;
+    this.providers = providers;
+    __publicField(this, "region");
+    this.region = config.region || "eu-west-1";
+  }
+  sign(request) {
+    const uris = resolveS3Endpoint(this.config);
+    request.headers.host = uris.endpoint.substring(uris.endpoint.indexOf("://") + 3);
+    const nowFormatted = this.providers.now().toISOString().replace(/[:-]|\.\d{3}/g, "");
+    const queryString = this.getQueryParams(request, nowFormatted);
+    const path = uris.basePath + "/" + request.key;
+    const lines = [
+      request.action === "read" ? "GET" : "PUT",
+      path,
+      queryString,
+      this.getSignedHeaders(request),
+      this.getSignedHeaderNames(Object.keys(request.headers)),
+      "UNSIGNED-PAYLOAD"
+    ];
+    const canonicalRequest = lines.join("\n");
+    const parts = ["AWS4-HMAC-SHA256", nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)];
+    const signature = [nowFormatted.substring(0, 8), this.region, "s3", "aws4_request", parts.join("\n")].reduce((acc, x) => hmac(acc, x), Buffer.from("AWS4" + this.config.credentials.secret)).toString("hex");
+    return uris.endpoint + path + "?" + (queryString + "&X-Amz-Signature=" + signature).split("&").sort().join("&");
+  }
+  getQueryParams(request, dateFormatted) {
+    const scope = this.getScope(dateFormatted);
+    const queryString = {
+      "X-Amz-Date": dateFormatted,
+      "X-Amz-Algorithm": "AWS4-HMAC-SHA256",
+      "X-Amz-Credential": this.config.credentials.key + "/" + scope,
+      "X-Amz-Expires": String(request.expiration),
+      "X-Amz-SignedHeaders": this.getSignedHeaderNames(Object.keys(request.headers))
+    };
+    const headersToQs = ["content-type", "content-md5", "cache-control"];
+    for (const header in request.headers) {
+      const headerLc = header.toLowerCase();
+      if (headersToQs.includes(headerLc) || headerLc.startsWith("x-amz-")) {
+        queryString[headerLc.startsWith("x-amz-meta-") ? headerLc : header] = request.headers[header];
+      }
+    }
+    const qsSorted = sortMap(queryString);
+    return qs.stringify(qsSorted);
+  }
+  getScope(dateFormatted) {
+    return dateFormatted.substring(0, 8) + "/" + this.region + "/s3/aws4_request";
+  }
+  getSignedHeaders(request) {
+    const lines = [];
+    for (const header in request.headers) {
+      const headerNameLc = header.toLowerCase();
+      if (!this.isHeaderSignable(headerNameLc)) {
+        continue;
+      }
+      const value = request.headers[header].replace(/\s+/g, " ").replace(/^\s+|\s+$/g, "");
+      lines.push(`${headerNameLc}:${value}
+`);
+    }
+    return lines.sort().join("");
+  }
+  isHeaderSignable(headerName) {
+    return headerName.toLowerCase().startsWith("x-amz") || !unsignableHeaders.includes(headerName.toLowerCase());
+  }
+  getSignedHeaderNames(headers) {
+    return headers.map((it) => it.toLowerCase()).filter(this.isHeaderSignable).sort().join(";");
+  }
+}
+export {
+  S3Signer
+};
+//# sourceMappingURL=S3Signer.js.map

package/dist/development/src/S3Signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3Signer.js","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\trequest.action === 'read' ? 'GET' : 'PUT',\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAYA,MAAM,OAAO,CAAC,QAAoB,SAAqB,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqB,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAO,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,WAAW,SAAS,QAAQ;AAAA,MACpC;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;"}

package/dist/production/index.cjs

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
+const S3ConfigProcessor = require("./src/S3ConfigProcessor.cjs");
+const S3SchemaContributor = require("./src/S3SchemaContributor.cjs");
+const S3Service = require("./src/S3Service.cjs");
+const S3ObjectAuthorizator = require("./src/S3ObjectAuthorizator.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class S3 {
+  constructor() {
+    __publicField(this, "name", "contember/s3");
+  }
+  getConfigProcessor() {
+    return new S3ConfigProcessor.S3ConfigProcessor();
+  }
+  getSchemaContributor({ providers }) {
+    const s3ServiceFactory = new S3Service.S3ServiceFactory();
+    return new S3SchemaContributor.S3SchemaContributor(s3ServiceFactory, providers);
+  }
+}
+exports.S3SchemaContributor = S3SchemaContributor.S3SchemaContributor;
+exports.S3Service = S3Service.S3Service;
+exports.S3ServiceFactory = S3Service.S3ServiceFactory;
+exports.S3ObjectAuthorizator = S3ObjectAuthorizator.S3ObjectAuthorizator;
+exports.default = S3;
+//# sourceMappingURL=index.cjs.map

package/dist/production/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../../../packages/engine-s3-plugin/src/index.ts"],"sourcesContent":["import { Plugin, SchemaContributorArgs } from '@contember/engine-plugins'\nimport { S3ConfigProcessor } from './S3ConfigProcessor'\nimport { S3SchemaContributor } from './S3SchemaContributor'\nimport { S3ServiceFactory } from './S3Service'\nimport { Project3Config } from './Config'\n\nexport * from './S3ObjectAuthorizator'\nexport * from './S3SchemaContributor'\nexport * from './S3Service'\n\nexport default class S3 implements Plugin<Project3Config> {\n\tname = 'contember/s3'\n\n\tgetConfigProcessor() {\n\t\treturn new S3ConfigProcessor()\n\t}\n\n\tgetSchemaContributor({ providers }: SchemaContributorArgs) {\n\t\tconst s3ServiceFactory = new S3ServiceFactory()\n\t\treturn new S3SchemaContributor(s3ServiceFactory, providers)\n\t}\n}\n"],"names":["S3ConfigProcessor","S3ServiceFactory","S3SchemaContributor"],"mappings":";;;;;;;;;AAUA,MAAqB,GAAqC;AAAA,EAA1D,cAAA;AACC,kBAAA,MAAA,QAAO,cAAA;AAAA,EAAA;AAAA,EAEP,qBAAqB;AACpB,WAAO,IAAIA,kBAAAA,kBAAA;AAAA,EACZ;AAAA,EAEA,qBAAqB,EAAE,aAAoC;AAC1D,UAAM,mBAAmB,IAAIC,2BAAA;AAC7B,WAAO,IAAIC,oBAAAA,oBAAoB,kBAAkB,SAAS;AAAA,EAC3D;AACD;;;;;;"}

package/dist/production/index.js

@@ -0,0 +1,28 @@
+import { S3ConfigProcessor } from "./src/S3ConfigProcessor.js";
+import { S3SchemaContributor } from "./src/S3SchemaContributor.js";
+import { S3ServiceFactory } from "./src/S3Service.js";
+import { S3Service } from "./src/S3Service.js";
+import { S3ObjectAuthorizator } from "./src/S3ObjectAuthorizator.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class S3 {
+  constructor() {
+    __publicField(this, "name", "contember/s3");
+  }
+  getConfigProcessor() {
+    return new S3ConfigProcessor();
+  }
+  getSchemaContributor({ providers }) {
+    const s3ServiceFactory = new S3ServiceFactory();
+    return new S3SchemaContributor(s3ServiceFactory, providers);
+  }
+}
+export {
+  S3ObjectAuthorizator,
+  S3SchemaContributor,
+  S3Service,
+  S3ServiceFactory,
+  S3 as default
+};
+//# sourceMappingURL=index.js.map

package/dist/production/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../packages/engine-s3-plugin/src/index.ts"],"sourcesContent":["import { Plugin, SchemaContributorArgs } from '@contember/engine-plugins'\nimport { S3ConfigProcessor } from './S3ConfigProcessor'\nimport { S3SchemaContributor } from './S3SchemaContributor'\nimport { S3ServiceFactory } from './S3Service'\nimport { Project3Config } from './Config'\n\nexport * from './S3ObjectAuthorizator'\nexport * from './S3SchemaContributor'\nexport * from './S3Service'\n\nexport default class S3 implements Plugin<Project3Config> {\n\tname = 'contember/s3'\n\n\tgetConfigProcessor() {\n\t\treturn new S3ConfigProcessor()\n\t}\n\n\tgetSchemaContributor({ providers }: SchemaContributorArgs) {\n\t\tconst s3ServiceFactory = new S3ServiceFactory()\n\t\treturn new S3SchemaContributor(s3ServiceFactory, providers)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;AAUA,MAAqB,GAAqC;AAAA,EAA1D,cAAA;AACC,kBAAA,MAAA,QAAO,cAAA;AAAA,EAAA;AAAA,EAEP,qBAAqB;AACpB,WAAO,IAAI,kBAAA;AAAA,EACZ;AAAA,EAEA,qBAAqB,EAAE,aAAoC;AAC1D,UAAM,mBAAmB,IAAI,iBAAA;AAC7B,WAAO,IAAI,oBAAoB,kBAAkB,SAAS;AAAA,EAC3D;AACD;"}

package/dist/production/src/Config.cjs

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+const s3ConfigSchema = Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    bucket: Typesafe__namespace.string,
+    region: Typesafe__namespace.string,
+    prefix: Typesafe__namespace.string,
+    credentials: Typesafe__namespace.object({
+      key: Typesafe__namespace.string,
+      secret: Typesafe__namespace.string
+    })
+  }),
+  Typesafe__namespace.partial({
+    endpoint: Typesafe__namespace.string,
+    cdnEndpoint: Typesafe__namespace.string,
+    provider: Typesafe__namespace.enumeration(
+      "aws",
+      "minio",
+      "ceph",
+      "localstack",
+      "cloudserver"
+      /* cloudserver */
+    ),
+    noAcl: Typesafe__namespace.boolean
+  })
+);
+const serversWithoutAclSupport = [
+  "minio"
+  /* minio */
+];
+const resolveS3Config = (config) => {
+  return {
+    noAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),
+    ...config
+  };
+};
+const defaultRegion = "eu-west-1";
+const resolveS3Endpoint = (config) => {
+  const hasLegacyPath = !!config.endpoint || config.bucket.includes(".");
+  const endpoint = config.endpoint || `https://${hasLegacyPath ? "" : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`;
+  const basePath = hasLegacyPath ? `/${config.bucket}` : "";
+  return { endpoint, basePath };
+};
+const resolveS3PublicBaseUrl = (config) => {
+  if (config.cdnEndpoint) {
+    return config.cdnEndpoint;
+  }
+  const { endpoint, basePath } = resolveS3Endpoint(config);
+  return endpoint + basePath;
+};
+exports.resolveS3Config = resolveS3Config;
+exports.resolveS3Endpoint = resolveS3Endpoint;
+exports.resolveS3PublicBaseUrl = resolveS3PublicBaseUrl;
+exports.s3ConfigSchema = s3ConfigSchema;
+//# sourceMappingURL=Config.cjs.map

package/dist/production/src/Config.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Config.cjs","sources":["../../../../packages/engine-s3-plugin/src/Config.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\nexport enum S3Providers {\n\taws = 'aws',\n\tminio = 'minio',\n\tceph = 'ceph',\n\tlocalstack = 'localstack',\n\tcloudserver = 'cloudserver',\n}\n\nexport const s3ConfigSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tbucket: Typesafe.string,\n\t\tregion: Typesafe.string,\n\t\tprefix: Typesafe.string,\n\t\tcredentials: Typesafe.object({\n\t\t\tkey: Typesafe.string,\n\t\t\tsecret: Typesafe.string,\n\t\t}),\n\t}),\n\tTypesafe.partial({\n\t\tendpoint: Typesafe.string,\n\t\tcdnEndpoint: Typesafe.string,\n\t\tprovider: Typesafe.enumeration(S3Providers.aws, S3Providers.minio, S3Providers.ceph, S3Providers.localstack, S3Providers.cloudserver),\n\t\tnoAcl: Typesafe.boolean,\n\t}),\n)\n\nexport type S3Config = ReturnType<typeof s3ConfigSchema>\n\nexport type Project3Config = { s3?: S3Config }\n\n// todo\nconst serversWithoutAclSupport = [S3Providers.minio]\n\nexport const resolveS3Config = (config: S3Config): S3Config => {\n\treturn {\n\t\tnoAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),\n\t\t...config,\n\t}\n}\n\nconst defaultRegion = 'eu-west-1'\n\nexport const resolveS3Endpoint = (\n\tconfig: S3Config,\n): {\n\tendpoint: string\n\tbasePath: string\n} => {\n\tconst hasLegacyPath = !!config.endpoint || config.bucket.includes('.')\n\tconst endpoint = config.endpoint || `https://${hasLegacyPath ? '' : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`\n\tconst basePath = hasLegacyPath ? `/${config.bucket}` : ''\n\n\treturn { endpoint, basePath }\n}\n\nexport const resolveS3PublicBaseUrl = (config: S3Config): string => {\n\tif (config.cdnEndpoint) {\n\t\treturn config.cdnEndpoint\n\t}\n\tconst { endpoint, basePath } = resolveS3Endpoint(config)\n\treturn endpoint + basePath\n}\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAUO,MAAM,iBAAiBA,oBAAS;AAAA,EACtCA,oBAAS,OAAO;AAAA,IACf,QAAQA,oBAAS;AAAA,IACjB,QAAQA,oBAAS;AAAA,IACjB,QAAQA,oBAAS;AAAA,IACjB,aAAaA,oBAAS,OAAO;AAAA,MAC5B,KAAKA,oBAAS;AAAA,MACd,QAAQA,oBAAS;AAAA,IAAA,CACjB;AAAA,EAAA,CACD;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUA,oBAAS;AAAA,IACnB,aAAaA,oBAAS;AAAA,IACtB,UAAUA,oBAAS;AAAA,MAAY;AAAA,MAAiB;AAAA,MAAmB;AAAA,MAAkB;AAAA,MAAwB;AAAA;AAAA,IAAA;AAAA,IAC7G,OAAOA,oBAAS;AAAA,EAAA,CAChB;AACF;AAOA,MAAM,2BAA2B;AAAA,EAAC;AAAA;AAAA;AAE3B,MAAM,kBAAkB,CAAC,WAA+B;AAC9D,SAAO;AAAA,IACN,OAAO,CAAC,CAAC,OAAO,YAAY,yBAAyB,SAAS,OAAO,QAAQ;AAAA,IAC7E,GAAG;AAAA,EAAA;AAEL;AAEA,MAAM,gBAAgB;AAEf,MAAM,oBAAoB,CAChC,WAII;AACJ,QAAM,gBAAgB,CAAC,CAAC,OAAO,YAAY,OAAO,OAAO,SAAS,GAAG;AACrE,QAAM,WAAW,OAAO,YAAY,WAAW,gBAAgB,KAAK,GAAG,OAAO,MAAM,GAAG,MAAM,OAAO,UAAU,aAAa;AAC3H,QAAM,WAAW,gBAAgB,IAAI,OAAO,MAAM,KAAK;AAEvD,SAAO,EAAE,UAAU,SAAA;AACpB;AAEO,MAAM,yBAAyB,CAAC,WAA6B;AACnE,MAAI,OAAO,aAAa;AACvB,WAAO,OAAO;AAAA,EACf;AACA,QAAM,EAAE,UAAU,aAAa,kBAAkB,MAAM;AACvD,SAAO,WAAW;AACnB;;;;;"}

package/dist/production/src/Config.js

@@ -0,0 +1,56 @@
+import * as Typesafe from "@contember/typesafe";
+const s3ConfigSchema = Typesafe.intersection(
+  Typesafe.object({
+    bucket: Typesafe.string,
+    region: Typesafe.string,
+    prefix: Typesafe.string,
+    credentials: Typesafe.object({
+      key: Typesafe.string,
+      secret: Typesafe.string
+    })
+  }),
+  Typesafe.partial({
+    endpoint: Typesafe.string,
+    cdnEndpoint: Typesafe.string,
+    provider: Typesafe.enumeration(
+      "aws",
+      "minio",
+      "ceph",
+      "localstack",
+      "cloudserver"
+      /* cloudserver */
+    ),
+    noAcl: Typesafe.boolean
+  })
+);
+const serversWithoutAclSupport = [
+  "minio"
+  /* minio */
+];
+const resolveS3Config = (config) => {
+  return {
+    noAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),
+    ...config
+  };
+};
+const defaultRegion = "eu-west-1";
+const resolveS3Endpoint = (config) => {
+  const hasLegacyPath = !!config.endpoint || config.bucket.includes(".");
+  const endpoint = config.endpoint || `https://${hasLegacyPath ? "" : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`;
+  const basePath = hasLegacyPath ? `/${config.bucket}` : "";
+  return { endpoint, basePath };
+};
+const resolveS3PublicBaseUrl = (config) => {
+  if (config.cdnEndpoint) {
+    return config.cdnEndpoint;
+  }
+  const { endpoint, basePath } = resolveS3Endpoint(config);
+  return endpoint + basePath;
+};
+export {
+  resolveS3Config,
+  resolveS3Endpoint,
+  resolveS3PublicBaseUrl,
+  s3ConfigSchema
+};
+//# sourceMappingURL=Config.js.map

package/dist/production/src/Config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Config.js","sources":["../../../../packages/engine-s3-plugin/src/Config.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\nexport enum S3Providers {\n\taws = 'aws',\n\tminio = 'minio',\n\tceph = 'ceph',\n\tlocalstack = 'localstack',\n\tcloudserver = 'cloudserver',\n}\n\nexport const s3ConfigSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tbucket: Typesafe.string,\n\t\tregion: Typesafe.string,\n\t\tprefix: Typesafe.string,\n\t\tcredentials: Typesafe.object({\n\t\t\tkey: Typesafe.string,\n\t\t\tsecret: Typesafe.string,\n\t\t}),\n\t}),\n\tTypesafe.partial({\n\t\tendpoint: Typesafe.string,\n\t\tcdnEndpoint: Typesafe.string,\n\t\tprovider: Typesafe.enumeration(S3Providers.aws, S3Providers.minio, S3Providers.ceph, S3Providers.localstack, S3Providers.cloudserver),\n\t\tnoAcl: Typesafe.boolean,\n\t}),\n)\n\nexport type S3Config = ReturnType<typeof s3ConfigSchema>\n\nexport type Project3Config = { s3?: S3Config }\n\n// todo\nconst serversWithoutAclSupport = [S3Providers.minio]\n\nexport const resolveS3Config = (config: S3Config): S3Config => {\n\treturn {\n\t\tnoAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),\n\t\t...config,\n\t}\n}\n\nconst defaultRegion = 'eu-west-1'\n\nexport const resolveS3Endpoint = (\n\tconfig: S3Config,\n): {\n\tendpoint: string\n\tbasePath: string\n} => {\n\tconst hasLegacyPath = !!config.endpoint || config.bucket.includes('.')\n\tconst endpoint = config.endpoint || `https://${hasLegacyPath ? '' : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`\n\tconst basePath = hasLegacyPath ? `/${config.bucket}` : ''\n\n\treturn { endpoint, basePath }\n}\n\nexport const resolveS3PublicBaseUrl = (config: S3Config): string => {\n\tif (config.cdnEndpoint) {\n\t\treturn config.cdnEndpoint\n\t}\n\tconst { endpoint, basePath } = resolveS3Endpoint(config)\n\treturn endpoint + basePath\n}\n"],"names":[],"mappings":";AAUO,MAAM,iBAAiB,SAAS;AAAA,EACtC,SAAS,OAAO;AAAA,IACf,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,IACjB,aAAa,SAAS,OAAO;AAAA,MAC5B,KAAK,SAAS;AAAA,MACd,QAAQ,SAAS;AAAA,IAAA,CACjB;AAAA,EAAA,CACD;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,SAAS;AAAA,IACnB,aAAa,SAAS;AAAA,IACtB,UAAU,SAAS;AAAA,MAAY;AAAA,MAAiB;AAAA,MAAmB;AAAA,MAAkB;AAAA,MAAwB;AAAA;AAAA,IAAA;AAAA,IAC7G,OAAO,SAAS;AAAA,EAAA,CAChB;AACF;AAOA,MAAM,2BAA2B;AAAA,EAAC;AAAA;AAAA;AAE3B,MAAM,kBAAkB,CAAC,WAA+B;AAC9D,SAAO;AAAA,IACN,OAAO,CAAC,CAAC,OAAO,YAAY,yBAAyB,SAAS,OAAO,QAAQ;AAAA,IAC7E,GAAG;AAAA,EAAA;AAEL;AAEA,MAAM,gBAAgB;AAEf,MAAM,oBAAoB,CAChC,WAII;AACJ,QAAM,gBAAgB,CAAC,CAAC,OAAO,YAAY,OAAO,OAAO,SAAS,GAAG;AACrE,QAAM,WAAW,OAAO,YAAY,WAAW,gBAAgB,KAAK,GAAG,OAAO,MAAM,GAAG,MAAM,OAAO,UAAU,aAAa;AAC3H,QAAM,WAAW,gBAAgB,IAAI,OAAO,MAAM,KAAK;AAEvD,SAAO,EAAE,UAAU,SAAA;AACpB;AAEO,MAAM,yBAAyB,CAAC,WAA6B;AACnE,MAAI,OAAO,aAAa;AACvB,WAAO,OAAO;AAAA,EACf;AACA,QAAM,EAAE,UAAU,aAAa,kBAAkB,MAAM;AACvD,SAAO,WAAW;AACnB;"}

package/dist/production/src/S3ConfigProcessor.cjs

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Config = require("./Config.cjs");
+const Typesafe = require("@contember/typesafe");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+class S3ConfigProcessor {
+  getDefaultEnv() {
+    return {
+      DEFAULT_S3_ENDPOINT: "",
+      DEFAULT_S3_REGION: "us-east-1",
+      DEFAULT_S3_PROVIDER: "aws"
+    };
+  }
+  prepareConfigTemplate(template, { env }) {
+    return {
+      ...template,
+      projectDefaults: {
+        ...template.projectDefaults,
+        s3: {
+          bucket: `%?project.env.S3_BUCKET%`,
+          prefix: `%?project.env.S3_PREFIX||project.slug%`,
+          region: `%project.env.S3_REGION%`,
+          endpoint: `%project.env.S3_ENDPOINT%`,
+          cdnEndpoint: `%?project.env.S3_CDN%`,
+          provider: "%project.env.S3_PROVIDER%",
+          credentials: {
+            key: `%?project.secret.s3.key||project.env.S3_KEY%`,
+            secret: `%?project.secret.s3.secret||project.env.S3_SECRET%`
+          }
+        }
+      }
+    };
+  }
+  getProjectConfigSchema(slug) {
+    return Typesafe__namespace.union(
+      (input, path = []) => Typesafe__namespace.valueAt(input, ["s3", "credentials", "key"]) === void 0 ? {} : Typesafe__namespace.fail(path),
+      Typesafe__namespace.object({
+        s3: Config.s3ConfigSchema
+      })
+    );
+  }
+}
+exports.S3ConfigProcessor = S3ConfigProcessor;
+//# sourceMappingURL=S3ConfigProcessor.cjs.map

package/dist/production/src/S3ConfigProcessor.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3ConfigProcessor.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3ConfigProcessor.ts"],"sourcesContent":["import { ConfigProcessor, ConfigTemplate, ConfigTemplateContext } from '@contember/engine-plugins'\nimport { Project3Config, s3ConfigSchema } from './Config'\nimport * as Typesafe from '@contember/typesafe'\n\nexport class S3ConfigProcessor implements ConfigProcessor<Project3Config> {\n\tgetDefaultEnv(): Record<string, string> {\n\t\treturn {\n\t\t\tDEFAULT_S3_ENDPOINT: '',\n\t\t\tDEFAULT_S3_REGION: 'us-east-1',\n\t\t\tDEFAULT_S3_PROVIDER: 'aws',\n\t\t}\n\t}\n\n\tprepareConfigTemplate(template: ConfigTemplate, { env }: ConfigTemplateContext) {\n\t\treturn {\n\t\t\t...template,\n\t\t\tprojectDefaults: {\n\t\t\t\t...template.projectDefaults,\n\t\t\t\ts3: {\n\t\t\t\t\tbucket: `%?project.env.S3_BUCKET%`,\n\t\t\t\t\tprefix: `%?project.env.S3_PREFIX||project.slug%`,\n\t\t\t\t\tregion: `%project.env.S3_REGION%`,\n\t\t\t\t\tendpoint: `%project.env.S3_ENDPOINT%`,\n\t\t\t\t\tcdnEndpoint: `%?project.env.S3_CDN%`,\n\t\t\t\t\tprovider: '%project.env.S3_PROVIDER%',\n\t\t\t\t\tcredentials: {\n\t\t\t\t\t\tkey: `%?project.secret.s3.key||project.env.S3_KEY%`,\n\t\t\t\t\t\tsecret: `%?project.secret.s3.secret||project.env.S3_SECRET%`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t}\n\n\tgetProjectConfigSchema(slug: string): Typesafe.Type<Record<string, any>> {\n\t\treturn Typesafe.union(\n\t\t\t(input: unknown, path: PropertyKey[] = []) => Typesafe.valueAt(input, ['s3', 'credentials', 'key']) === undefined ? {} : Typesafe.fail(path),\n\t\t\tTypesafe.object({\n\t\t\t\ts3: s3ConfigSchema,\n\t\t\t}),\n\t\t)\n\t}\n}\n"],"names":["Typesafe","s3ConfigSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,kBAA6D;AAAA,EACzE,gBAAwC;AACvC,WAAO;AAAA,MACN,qBAAqB;AAAA,MACrB,mBAAmB;AAAA,MACnB,qBAAqB;AAAA,IAAA;AAAA,EAEvB;AAAA,EAEA,sBAAsB,UAA0B,EAAE,OAA8B;AAC/E,WAAO;AAAA,MACN,GAAG;AAAA,MACH,iBAAiB;AAAA,QAChB,GAAG,SAAS;AAAA,QACZ,IAAI;AAAA,UACH,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,aAAa;AAAA,UACb,UAAU;AAAA,UACV,aAAa;AAAA,YACZ,KAAK;AAAA,YACL,QAAQ;AAAA,UAAA;AAAA,QACT;AAAA,MACD;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,uBAAuB,MAAkD;AACxE,WAAOA,oBAAS;AAAA,MACf,CAAC,OAAgB,OAAsB,CAAA,MAAOA,oBAAS,QAAQ,OAAO,CAAC,MAAM,eAAe,KAAK,CAAC,MAAM,SAAY,CAAA,IAAKA,oBAAS,KAAK,IAAI;AAAA,MAC3IA,oBAAS,OAAO;AAAA,QACf,IAAIC,OAAAA;AAAAA,MAAA,CACJ;AAAA,IAAA;AAAA,EAEH;AACD;;"}

package/dist/production/src/S3ConfigProcessor.js

@@ -0,0 +1,43 @@
+import { s3ConfigSchema } from "./Config.js";
+import * as Typesafe from "@contember/typesafe";
+class S3ConfigProcessor {
+  getDefaultEnv() {
+    return {
+      DEFAULT_S3_ENDPOINT: "",
+      DEFAULT_S3_REGION: "us-east-1",
+      DEFAULT_S3_PROVIDER: "aws"
+    };
+  }
+  prepareConfigTemplate(template, { env }) {
+    return {
+      ...template,
+      projectDefaults: {
+        ...template.projectDefaults,
+        s3: {
+          bucket: `%?project.env.S3_BUCKET%`,
+          prefix: `%?project.env.S3_PREFIX||project.slug%`,
+          region: `%project.env.S3_REGION%`,
+          endpoint: `%project.env.S3_ENDPOINT%`,
+          cdnEndpoint: `%?project.env.S3_CDN%`,
+          provider: "%project.env.S3_PROVIDER%",
+          credentials: {
+            key: `%?project.secret.s3.key||project.env.S3_KEY%`,
+            secret: `%?project.secret.s3.secret||project.env.S3_SECRET%`
+          }
+        }
+      }
+    };
+  }
+  getProjectConfigSchema(slug) {
+    return Typesafe.union(
+      (input, path = []) => Typesafe.valueAt(input, ["s3", "credentials", "key"]) === void 0 ? {} : Typesafe.fail(path),
+      Typesafe.object({
+        s3: s3ConfigSchema
+      })
+    );
+  }
+}
+export {
+  S3ConfigProcessor
+};
+//# sourceMappingURL=S3ConfigProcessor.js.map

package/dist/production/src/S3ConfigProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3ConfigProcessor.js","sources":["../../../../packages/engine-s3-plugin/src/S3ConfigProcessor.ts"],"sourcesContent":["import { ConfigProcessor, ConfigTemplate, ConfigTemplateContext } from '@contember/engine-plugins'\nimport { Project3Config, s3ConfigSchema } from './Config'\nimport * as Typesafe from '@contember/typesafe'\n\nexport class S3ConfigProcessor implements ConfigProcessor<Project3Config> {\n\tgetDefaultEnv(): Record<string, string> {\n\t\treturn {\n\t\t\tDEFAULT_S3_ENDPOINT: '',\n\t\t\tDEFAULT_S3_REGION: 'us-east-1',\n\t\t\tDEFAULT_S3_PROVIDER: 'aws',\n\t\t}\n\t}\n\n\tprepareConfigTemplate(template: ConfigTemplate, { env }: ConfigTemplateContext) {\n\t\treturn {\n\t\t\t...template,\n\t\t\tprojectDefaults: {\n\t\t\t\t...template.projectDefaults,\n\t\t\t\ts3: {\n\t\t\t\t\tbucket: `%?project.env.S3_BUCKET%`,\n\t\t\t\t\tprefix: `%?project.env.S3_PREFIX||project.slug%`,\n\t\t\t\t\tregion: `%project.env.S3_REGION%`,\n\t\t\t\t\tendpoint: `%project.env.S3_ENDPOINT%`,\n\t\t\t\t\tcdnEndpoint: `%?project.env.S3_CDN%`,\n\t\t\t\t\tprovider: '%project.env.S3_PROVIDER%',\n\t\t\t\t\tcredentials: {\n\t\t\t\t\t\tkey: `%?project.secret.s3.key||project.env.S3_KEY%`,\n\t\t\t\t\t\tsecret: `%?project.secret.s3.secret||project.env.S3_SECRET%`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t}\n\n\tgetProjectConfigSchema(slug: string): Typesafe.Type<Record<string, any>> {\n\t\treturn Typesafe.union(\n\t\t\t(input: unknown, path: PropertyKey[] = []) => Typesafe.valueAt(input, ['s3', 'credentials', 'key']) === undefined ? {} : Typesafe.fail(path),\n\t\t\tTypesafe.object({\n\t\t\t\ts3: s3ConfigSchema,\n\t\t\t}),\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,kBAA6D;AAAA,EACzE,gBAAwC;AACvC,WAAO;AAAA,MACN,qBAAqB;AAAA,MACrB,mBAAmB;AAAA,MACnB,qBAAqB;AAAA,IAAA;AAAA,EAEvB;AAAA,EAEA,sBAAsB,UAA0B,EAAE,OAA8B;AAC/E,WAAO;AAAA,MACN,GAAG;AAAA,MACH,iBAAiB;AAAA,QAChB,GAAG,SAAS;AAAA,QACZ,IAAI;AAAA,UACH,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,aAAa;AAAA,UACb,UAAU;AAAA,UACV,aAAa;AAAA,YACZ,KAAK;AAAA,YACL,QAAQ;AAAA,UAAA;AAAA,QACT;AAAA,MACD;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,uBAAuB,MAAkD;AACxE,WAAO,SAAS;AAAA,MACf,CAAC,OAAgB,OAAsB,CAAA,MAAO,SAAS,QAAQ,OAAO,CAAC,MAAM,eAAe,KAAK,CAAC,MAAM,SAAY,CAAA,IAAK,SAAS,KAAK,IAAI;AAAA,MAC3I,SAAS,OAAO;AAAA,QACf,IAAI;AAAA,MAAA,CACJ;AAAA,IAAA;AAAA,EAEH;AACD;"}

package/dist/production/src/S3ObjectAuthorizator.cjs

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const pm = require("picomatch");
+const graphqlUtils = require("@contember/graphql-utils");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class S3ObjectAuthorizator {
+  constructor(uploadRules, readRules) {
+    __publicField(this, "uploadRules");
+    __publicField(this, "readRules");
+    this.uploadRules = uploadRules;
+    this.readRules = readRules;
+  }
+  verifyReadAccess({ key }) {
+    for (const rule of this.readRules) {
+      rule.matcher ?? (rule.matcher = pm(rule.pattern));
+      if (rule.matcher(key)) {
+        return;
+      }
+    }
+    throw new graphqlUtils.ForbiddenError(`Read access forbidden for object key ${key}`);
+  }
+  verifyUploadAccess({ key, size }) {
+    const matchedPatterns = [];
+    for (const rule of this.uploadRules) {
+      rule.matcher ?? (rule.matcher = pm(rule.pattern));
+      if (rule.matcher(key)) {
+        if (!rule.maxSize || size !== null && size <= rule.maxSize) {
+          return;
+        }
+        matchedPatterns.push(rule);
+      }
+    }
+    if (matchedPatterns.length > 0) {
+      if (size === null) {
+        throw new graphqlUtils.ForbiddenError("File size must be provided");
+      } else {
+        throw new graphqlUtils.ForbiddenError("Uploaded file is too large");
+      }
+    }
+    throw new graphqlUtils.ForbiddenError(`Upload access forbidden for object key ${key}`);
+  }
+}
+exports.S3ObjectAuthorizator = S3ObjectAuthorizator;
+//# sourceMappingURL=S3ObjectAuthorizator.cjs.map

package/dist/production/src/S3ObjectAuthorizator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3ObjectAuthorizator.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3ObjectAuthorizator.ts"],"sourcesContent":["/// <reference path=\"../types/picomatch/index.d.ts\" />\nimport pm from 'picomatch'\nimport { ForbiddenError } from '@contember/graphql-utils'\n\nexport type S3ObjectUploadRule = {\n\tpattern: string\n\tmaxSize?: number\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectReadRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport class S3ObjectAuthorizator {\n\tprivate readonly uploadRules: S3ObjectUploadRule[]\n\tprivate readonly readRules: S3ObjectReadRule[]\n\n\tconstructor(\n\t\tuploadRules: Omit<S3ObjectUploadRule, 'matcher'>[],\n\t\treadRules: Omit<S3ObjectReadRule, 'matcher'>[],\n\t) {\n\t\tthis.uploadRules = uploadRules\n\t\tthis.readRules = readRules\n\t}\n\n\tpublic verifyReadAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.readRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Read access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyUploadAccess({ key, size }: { key: string; size: number | null }): void {\n\t\tconst matchedPatterns: S3ObjectUploadRule[] = []\n\n\t\tfor (const rule of this.uploadRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\tif (!rule.maxSize || (size !== null && size <= rule.maxSize)) {\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t\tmatchedPatterns.push(rule)\n\t\t\t}\n\t\t}\n\n\t\tif (matchedPatterns.length > 0) {\n\t\t\tif (size === null) {\n\t\t\t\tthrow new ForbiddenError('File size must be provided')\n\t\t\t} else {\n\t\t\t\tthrow new ForbiddenError('Uploaded file is too large')\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Upload access forbidden for object key ${key}`)\n\t}\n}\n"],"names":["ForbiddenError"],"mappings":";;;;;;;AAeO,MAAM,qBAAqB;AAAA,EAIjC,YACC,aACA,WACC;AANF,kBAAA,MAAiB,aAAA;AACjB,kBAAA,MAAiB,WAAA;AAMhB,SAAK,cAAc;AACnB,SAAK,YAAY;AAAA,EAClB;AAAA,EAEO,iBAAiB,EAAE,OAA8B;AACvD,eAAW,QAAQ,KAAK,WAAW;AAClC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAIA,aAAAA,eAAe,wCAAwC,GAAG,EAAE;AAAA,EACvE;AAAA,EAEO,mBAAmB,EAAE,KAAK,QAAoD;AACpF,UAAM,kBAAwC,CAAA;AAE9C,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB,YAAI,CAAC,KAAK,WAAY,SAAS,QAAQ,QAAQ,KAAK,SAAU;AAC7D;AAAA,QACD;AACA,wBAAgB,KAAK,IAAI;AAAA,MAC1B;AAAA,IACD;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC/B,UAAI,SAAS,MAAM;AAClB,cAAM,IAAIA,aAAAA,eAAe,4BAA4B;AAAA,MACtD,OAAO;AACN,cAAM,IAAIA,aAAAA,eAAe,4BAA4B;AAAA,MACtD;AAAA,IACD;AAEA,UAAM,IAAIA,aAAAA,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AACD;;"}

package/dist/production/src/S3ObjectAuthorizator.js

@@ -0,0 +1,46 @@
+import pm from "picomatch";
+import { ForbiddenError } from "@contember/graphql-utils";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class S3ObjectAuthorizator {
+  constructor(uploadRules, readRules) {
+    __publicField(this, "uploadRules");
+    __publicField(this, "readRules");
+    this.uploadRules = uploadRules;
+    this.readRules = readRules;
+  }
+  verifyReadAccess({ key }) {
+    for (const rule of this.readRules) {
+      rule.matcher ?? (rule.matcher = pm(rule.pattern));
+      if (rule.matcher(key)) {
+        return;
+      }
+    }
+    throw new ForbiddenError(`Read access forbidden for object key ${key}`);
+  }
+  verifyUploadAccess({ key, size }) {
+    const matchedPatterns = [];
+    for (const rule of this.uploadRules) {
+      rule.matcher ?? (rule.matcher = pm(rule.pattern));
+      if (rule.matcher(key)) {
+        if (!rule.maxSize || size !== null && size <= rule.maxSize) {
+          return;
+        }
+        matchedPatterns.push(rule);
+      }
+    }
+    if (matchedPatterns.length > 0) {
+      if (size === null) {
+        throw new ForbiddenError("File size must be provided");
+      } else {
+        throw new ForbiddenError("Uploaded file is too large");
+      }
+    }
+    throw new ForbiddenError(`Upload access forbidden for object key ${key}`);
+  }
+}
+export {
+  S3ObjectAuthorizator
+};
+//# sourceMappingURL=S3ObjectAuthorizator.js.map

package/dist/production/src/S3ObjectAuthorizator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3ObjectAuthorizator.js","sources":["../../../../packages/engine-s3-plugin/src/S3ObjectAuthorizator.ts"],"sourcesContent":["/// <reference path=\"../types/picomatch/index.d.ts\" />\nimport pm from 'picomatch'\nimport { ForbiddenError } from '@contember/graphql-utils'\n\nexport type S3ObjectUploadRule = {\n\tpattern: string\n\tmaxSize?: number\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectReadRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport class S3ObjectAuthorizator {\n\tprivate readonly uploadRules: S3ObjectUploadRule[]\n\tprivate readonly readRules: S3ObjectReadRule[]\n\n\tconstructor(\n\t\tuploadRules: Omit<S3ObjectUploadRule, 'matcher'>[],\n\t\treadRules: Omit<S3ObjectReadRule, 'matcher'>[],\n\t) {\n\t\tthis.uploadRules = uploadRules\n\t\tthis.readRules = readRules\n\t}\n\n\tpublic verifyReadAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.readRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Read access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyUploadAccess({ key, size }: { key: string; size: number | null }): void {\n\t\tconst matchedPatterns: S3ObjectUploadRule[] = []\n\n\t\tfor (const rule of this.uploadRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\tif (!rule.maxSize || (size !== null && size <= rule.maxSize)) {\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t\tmatchedPatterns.push(rule)\n\t\t\t}\n\t\t}\n\n\t\tif (matchedPatterns.length > 0) {\n\t\t\tif (size === null) {\n\t\t\t\tthrow new ForbiddenError('File size must be provided')\n\t\t\t} else {\n\t\t\t\tthrow new ForbiddenError('Uploaded file is too large')\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Upload access forbidden for object key ${key}`)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAeO,MAAM,qBAAqB;AAAA,EAIjC,YACC,aACA,WACC;AANF,kBAAA,MAAiB,aAAA;AACjB,kBAAA,MAAiB,WAAA;AAMhB,SAAK,cAAc;AACnB,SAAK,YAAY;AAAA,EAClB;AAAA,EAEO,iBAAiB,EAAE,OAA8B;AACvD,eAAW,QAAQ,KAAK,WAAW;AAClC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAI,eAAe,wCAAwC,GAAG,EAAE;AAAA,EACvE;AAAA,EAEO,mBAAmB,EAAE,KAAK,QAAoD;AACpF,UAAM,kBAAwC,CAAA;AAE9C,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB,YAAI,CAAC,KAAK,WAAY,SAAS,QAAQ,QAAQ,KAAK,SAAU;AAC7D;AAAA,QACD;AACA,wBAAgB,KAAK,IAAI;AAAA,MAC1B;AAAA,IACD;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC/B,UAAI,SAAS,MAAM;AAClB,cAAM,IAAI,eAAe,4BAA4B;AAAA,MACtD,OAAO;AACN,cAAM,IAAI,eAAe,4BAA4B;AAAA,MACtD;AAAA,IACD;AAEA,UAAM,IAAI,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AACD;"}

package/dist/production/src/S3SchemaContributor.cjs

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const graphql = require("graphql");
+const Config = require("./Config.cjs");
+const S3SchemaTypes = require("./S3SchemaTypes.cjs");
+const S3ObjectAuthorizator = require("./S3ObjectAuthorizator.cjs");
+class S3SchemaContributor {
+  constructor(s3Factory, providers) {
+    this.s3Factory = s3Factory;
+    this.providers = providers;
+  }
+  getCacheKey({ project }) {
+    return project.s3 ? "yes" : "no";
+  }
+  createSchema(context) {
+    if (!context.project.s3) {
+      return void 0;
+    }
+    const rules = context.identity.projectRoles.flatMap((it) => Object.entries(context.schema.acl.roles[it]?.s3 || {}));
+    const uploadRules = rules.filter(([, it]) => it.upload).map(([it, val]) => ({
+      pattern: it,
+      ...typeof val.upload !== "boolean" ? val.upload : {}
+    }));
+    const readRules = rules.filter(([, it]) => it.read).map(([it]) => ({
+      pattern: it
+    }));
+    if (uploadRules.length === 0 && readRules.length === 0) {
+      return void 0;
+    }
+    const authorizator = new S3ObjectAuthorizator.S3ObjectAuthorizator(uploadRules, readRules);
+    const uploadMutation = this.createUploadMutation(authorizator);
+    const readMutation = this.createReadMutation(authorizator);
+    const mutation = {
+      generateUploadUrl: uploadMutation,
+      generateReadUrl: readMutation
+    };
+    return {
+      mutation: new graphql.GraphQLObjectType({
+        name: "Mutation",
+        fields: () => mutation
+      }),
+      query: new graphql.GraphQLObjectType({
+        name: "Query",
+        fields: () => ({
+          s3DummyQuery: {
+            type: graphql.GraphQLString
+          }
+        })
+      })
+    };
+  }
+  createReadMutation(authorizator) {
+    return {
+      type: new graphql.GraphQLNonNull(S3SchemaTypes.S3SignedRead),
+      args: {
+        objectKey: {
+          type: new graphql.GraphQLNonNull(graphql.GraphQLString)
+        },
+        expiration: {
+          type: graphql.GraphQLInt
+        }
+      },
+      resolve: async (parent, args, ctx) => {
+        if (!ctx.project.s3) {
+          throw new graphql.GraphQLError("S3 is not configured for this project");
+        }
+        const s3Config = Config.resolveS3Config(ctx.project.s3);
+        const s3 = this.s3Factory.create(s3Config, this.providers, authorizator);
+        return s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null });
+      }
+    };
+  }
+  createUploadMutation(authorizator) {
+    return {
+      type: new graphql.GraphQLNonNull(S3SchemaTypes.S3SignedUpload),
+      args: {
+        input: { type: S3SchemaTypes.S3GenerateSignedUploadInput },
+        contentType: { type: graphql.GraphQLString, deprecationReason: "Use input.contentType" },
+        expiration: { type: graphql.GraphQLInt, deprecationReason: "Use input.expiration" },
+        prefix: { type: graphql.GraphQLString, deprecationReason: "Use input.prefix" },
+        acl: { type: S3SchemaTypes.S3Acl, deprecationReason: "Use input.acl" }
+      },
+      resolve: async (parent, args, ctx) => {
+        if (!ctx.project.s3) {
+          throw new graphql.GraphQLError("S3 is not configured for this project");
+        }
+        const s3Config = Config.resolveS3Config(ctx.project.s3);
+        const s3 = this.s3Factory.create(s3Config, this.providers, authorizator);
+        return s3.getSignedUploadUrl({
+          acl: args.input?.acl ?? args.acl ?? null,
+          contentDisposition: args.input?.contentDisposition ?? null,
+          contentType: args.input?.contentType ?? args.contentType ?? null,
+          expiration: args.input?.expiration ?? args.expiration ?? null,
+          extension: args.input?.extension ?? null,
+          fileName: args.input?.fileName ?? null,
+          prefix: args.input?.prefix ?? args.prefix ?? null,
+          suffix: args.input?.suffix ?? null,
+          size: args.input?.size ?? null
+        });
+      }
+    };
+  }
+}
+exports.S3SchemaContributor = S3SchemaContributor;
+//# sourceMappingURL=S3SchemaContributor.cjs.map