@contember/engine-s3-plugin 2.1.0-beta.2 → 2.1.0-rc.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-s3-plugin",
-  "version": "2.1.0-beta.2",
+  "version": "2.1.0-rc.2",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",

package/src/S3Service.ts

@@ -102,12 +102,14 @@ export class S3Service {
 		if (objectKey.startsWith(publicPrefix)) {
 			objectKey = objectKey.substring(publicPrefix.length)
 		}
-		if (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {
+		// the separator is a part of the prefix: without it, a project prefixed "blog" reaches into "blog-staging" in a shared bucket
+		const prefix = this.config.prefix ? this.config.prefix + '/' : ''
+		if (prefix && !objectKey.startsWith(prefix)) {
 			throw new ForbiddenError(
 				`Given object key "${objectKey}" does not start with a project prefix "${this.config.prefix}"`,
 			)
 		}
-		const localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey
+		const localObjectKey = objectKey.substring(prefix.length)
 		this.authorizator.verifyReadAccess({ key: localObjectKey })
 
 		const url = this.signer.sign({

package/tests/cases/signRequest.test.ts

@@ -37,6 +37,13 @@ test('sign s3 request - prefix', () => {
 	)
 })
 
+test('sign s3 request - a sibling prefix is not a prefix', () => {
+	const service = createS3Service('test', 'lorem')
+	expect(() => service.getSignedReadUrl({ objectKey: 'loremipsum/foo.jpg', expiration: null })).toThrow(
+		'Given object key "loremipsum/foo.jpg" does not start with a project prefix "lorem"',
+	)
+})
+
 test('sign upload', () => {
 	const service = createS3Service('test')
 	const signed = service.getSignedUploadUrl({