@contember/engine-s3-plugin 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/S3Service.js.map

@@ -1 +1 @@
-{"version":3,"file":"S3Service.js","sources":["../../../../packages/engine-s3-plugin/src/S3Service.ts"],"sourcesContent":["import { extension as resolveExtension } from 'mime-types'\nimport { resolveS3PublicBaseUrl, S3Config } from './Config'\nimport { ForbiddenError, UserInputError } from '@contember/graphql-utils'\nimport { Providers } from '@contember/engine-plugins'\nimport { S3Signer } from './S3Signer'\nimport { S3GenerateSignedUploadInput } from './S3SchemaTypes'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator'\n\ntype SignedReadUrl = {\n\turl: string\n\tbucket: string\n\tobjectKey: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype SignedUploadUrl = {\n\tobjectKey: string\n\turl: string\n\tbucket: string\n\tpublicUrl: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\nexport class S3Service {\n\tprivate readonly publicBaseUrl: string\n\n\tprivate readonly signer: S3Signer\n\n\tconstructor(\n\t\tpublic readonly config: S3Config,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now'>,\n\t\tprivate readonly authorizator: S3ObjectAuthorizator,\n\t) {\n\t\tthis.publicBaseUrl = resolveS3PublicBaseUrl(config)\n\t\tthis.signer = new S3Signer(config, providers)\n\t}\n\n\tpublic getSignedUploadUrl(\n\t\t{ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension, size }: S3GenerateSignedUploadInput,\n\t): SignedUploadUrl {\n\t\tconst ext = extension ?? ((contentType ? resolveExtension(contentType) : null) || 'bin')\n\t\tconst id = this.providers.uuid()\n\t\tconst localObjectKey = (prefix ? prefix + '/' : '') + `${id}${suffix ?? ''}.${ext}`\n\t\tthis.authorizator.verifyUploadAccess({ key: localObjectKey, size })\n\n\t\tconst objectKey = (this.config.prefix ? this.config.prefix + '/' : '') + localObjectKey\n\n\t\tconst bucket = this.config.bucket\n\t\tif (acl && this.config.noAcl) {\n\t\t\tthrow new UserInputError('ACL is not supported')\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t'Cache-Control': 'immutable',\n\t\t}\n\t\tif (contentType) {\n\t\t\theaders['Content-Type'] = contentType\n\t\t}\n\n\t\tif (!this.config.noAcl && acl !== 'NONE') {\n\t\t\tconst mapping = { PUBLIC_READ: 'public-read', PRIVATE: 'private' }\n\t\t\theaders['x-amz-acl'] = mapping[acl ?? 'PUBLIC_READ']\n\t\t}\n\t\tif (fileName || contentDisposition) {\n\t\t\tlet contentDispositionHeader = contentDisposition?.toLowerCase() ?? 'inline'\n\t\t\tif (fileName) {\n\t\t\t\tcontentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`\n\t\t\t}\n\t\t\theaders['Content-Disposition'] = contentDispositionHeader\n\t\t}\n\t\tconst headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }))\n\n\t\t// intentionally not sending following headers\n\t\tif (size) {\n\t\t\theaders['Content-Length'] = String(size)\n\t\t}\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'upload',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: { ...headers },\n\t\t})\n\n\t\tconst publicUrl = this.formatPublicUrl(objectKey)\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\tpublicUrl,\n\t\t\theaders: headersToSend,\n\t\t\tmethod: 'PUT',\n\t\t}\n\t}\n\n\tpublic getSignedReadUrl({ objectKey, expiration }: { objectKey: string; expiration: number | null }): SignedReadUrl {\n\t\tconst bucket = this.config.bucket\n\n\t\tconst publicPrefix = this.formatPublicUrl('')\n\t\tif (objectKey.startsWith(publicPrefix)) {\n\t\t\tobjectKey = objectKey.substring(publicPrefix.length)\n\t\t}\n\t\t// the separator is a part of the prefix: without it, a project prefixed \"blog\" reaches into \"blog-staging\" in a shared bucket\n\t\tconst prefix = this.config.prefix ? this.config.prefix + '/' : ''\n\t\tif (prefix && !objectKey.startsWith(prefix)) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t`Given object key \"${objectKey}\" does not start with a project prefix \"${this.config.prefix}\"`,\n\t\t\t)\n\t\t}\n\t\tconst localObjectKey = objectKey.substring(prefix.length)\n\t\tthis.authorizator.verifyReadAccess({ key: localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'read',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\theaders: [],\n\t\t\tmethod: 'GET',\n\t\t}\n\t}\n\n\tpublic formatPublicUrl(key: string): string {\n\t\treturn `${this.publicBaseUrl}/${key}`\n\t}\n}\n\nexport class S3ServiceFactory {\n\tpublic create(config: S3Config, providers: Providers, authorizator: S3ObjectAuthorizator) {\n\t\treturn new S3Service(config, providers, authorizator)\n\t}\n}\n"],"names":["extension","resolveExtension"],"mappings":";;;;;;;AAyBO,MAAM,UAAU;AAAA,EAKtB,YACiB,QACC,WACA,cAChB;AAHe,SAAA,SAAA;AACC,SAAA,YAAA;AACA,SAAA,eAAA;AAPlB,kBAAA,MAAiB,eAAA;AAEjB,kBAAA,MAAiB,QAAA;AAOhB,SAAK,gBAAgB,uBAAuB,MAAM;AAClD,SAAK,SAAS,IAAI,SAAS,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEO,mBACN,EAAE,KAAK,oBAAoB,aAAa,YAAY,QAAQ,QAAQ,qBAAUA,aAAW,KAAA,GACvE;AAClB,UAAM,MAAMA,iBAAe,cAAcC,UAAiB,WAAW,IAAI,SAAS;AAClF,UAAM,KAAK,KAAK,UAAU,KAAA;AAC1B,UAAM,kBAAkB,SAAS,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,GAAG;AACjF,SAAK,aAAa,mBAAmB,EAAE,KAAK,gBAAgB,MAAM;AAElE,UAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM,MAAM;AAEzE,UAAM,SAAS,KAAK,OAAO;AAC3B,QAAI,OAAO,KAAK,OAAO,OAAO;AAC7B,YAAM,IAAI,eAAe,sBAAsB;AAAA,IAChD;AAEA,UAAM,UAAkC;AAAA,MACvC,iBAAiB;AAAA,IAAA;AAElB,QAAI,aAAa;AAChB,cAAQ,cAAc,IAAI;AAAA,IAC3B;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS,QAAQ,QAAQ;AACzC,YAAM,UAAU,EAAE,aAAa,eAAe,SAAS,UAAA;AACvD,cAAQ,WAAW,IAAI,QAAQ,OAAO,aAAa;AAAA,IACpD;AACA,QAAI,YAAY,oBAAoB;AACnC,UAAI,2BAA2B,oBAAoB,YAAA,KAAiB;AACpE,UAAI,UAAU;AACb,oCAA4B,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,MAC/E;AACA,cAAQ,qBAAqB,IAAI;AAAA,IAClC;AACA,UAAM,gBAAgB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,QAAQ;AAGpF,QAAI,MAAM;AACT,cAAQ,gBAAgB,IAAI,OAAO,IAAI;AAAA,IACxC;AAEA,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,EAAE,GAAG,QAAA;AAAA,IAAQ,CACtB;AAED,UAAM,YAAY,KAAK,gBAAgB,SAAS;AAChD,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,iBAAiB,EAAE,WAAW,cAA+E;AACnH,UAAM,SAAS,KAAK,OAAO;AAE3B,UAAM,eAAe,KAAK,gBAAgB,EAAE;AAC5C,QAAI,UAAU,WAAW,YAAY,GAAG;AACvC,kBAAY,UAAU,UAAU,aAAa,MAAM;AAAA,IACpD;AAEA,UAAM,SAAS,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM;AAC/D,QAAI,UAAU,CAAC,UAAU,WAAW,MAAM,GAAG;AAC5C,YAAM,IAAI;AAAA,QACT,qBAAqB,SAAS,2CAA2C,KAAK,OAAO,MAAM;AAAA,MAAA;AAAA,IAE7F;AACA,UAAM,iBAAiB,UAAU,UAAU,OAAO,MAAM;AACxD,SAAK,aAAa,iBAAiB,EAAE,KAAK,gBAAgB;AAE1D,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,CAAA;AAAA,IAAC,CACV;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,CAAA;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,gBAAgB,KAAqB;AAC3C,WAAO,GAAG,KAAK,aAAa,IAAI,GAAG;AAAA,EACpC;AACD;AAEO,MAAM,iBAAiB;AAAA,EACtB,OAAO,QAAkB,WAAsB,cAAoC;AACzF,WAAO,IAAI,UAAU,QAAQ,WAAW,YAAY;AAAA,EACrD;AACD;"}
+{"version":3,"file":"S3Service.js","sources":["../../../../packages/engine-s3-plugin/src/S3Service.ts"],"sourcesContent":["import { extension as resolveExtension } from 'mime-types'\nimport { resolveS3PublicBaseUrl, S3Config } from './Config.js'\nimport { ForbiddenError, UserInputError } from '@contember/graphql-utils'\nimport { Providers } from '@contember/engine-plugins'\nimport { S3Signer } from './S3Signer.js'\nimport { S3GenerateSignedUploadInput } from './S3SchemaTypes.js'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'\n\ntype SignedReadUrl = {\n\turl: string\n\tbucket: string\n\tobjectKey: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype SignedUploadUrl = {\n\tobjectKey: string\n\turl: string\n\tbucket: string\n\tpublicUrl: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype DeletedObject = {\n\tbucket: string\n\tobjectKey: string\n}\n\nexport type S3FetchResponse = {\n\treadonly ok: boolean\n\treadonly status: number\n\ttext(): Promise<string>\n}\n\nexport type S3Fetch = (url: string, init: { method: string; signal: AbortSignal }) => Promise<S3FetchResponse>\n\nconst deleteUrlExpiration = 60\nconst deleteTimeoutMs = 10_000\n\nexport class S3Service {\n\tprivate readonly publicBaseUrl: string\n\n\tprivate readonly signer: S3Signer\n\n\tconstructor(\n\t\tpublic readonly config: S3Config,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now'>,\n\t\tprivate readonly authorizator: S3ObjectAuthorizator,\n\t\tprivate readonly fetch: S3Fetch = (url, init) => globalThis.fetch(url, init),\n\t) {\n\t\tthis.publicBaseUrl = resolveS3PublicBaseUrl(config)\n\t\tthis.signer = new S3Signer(config, providers)\n\t}\n\n\tpublic getSignedUploadUrl(\n\t\t{ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension, size }: S3GenerateSignedUploadInput,\n\t): SignedUploadUrl {\n\t\tconst ext = extension ?? ((contentType ? resolveExtension(contentType) : null) || 'bin')\n\t\tconst id = this.providers.uuid()\n\t\tconst localObjectKey = (prefix ? prefix + '/' : '') + `${id}${suffix ?? ''}.${ext}`\n\t\tthis.authorizator.verifyUploadAccess({ key: localObjectKey, size })\n\n\t\tconst objectKey = (this.config.prefix ? this.config.prefix + '/' : '') + localObjectKey\n\n\t\tconst bucket = this.config.bucket\n\t\tif (acl && this.config.noAcl) {\n\t\t\tthrow new UserInputError('ACL is not supported')\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t'Cache-Control': 'immutable',\n\t\t}\n\t\tif (contentType) {\n\t\t\theaders['Content-Type'] = contentType\n\t\t}\n\n\t\tif (!this.config.noAcl && acl !== 'NONE') {\n\t\t\tconst mapping = { PUBLIC_READ: 'public-read', PRIVATE: 'private' }\n\t\t\theaders['x-amz-acl'] = mapping[acl ?? 'PUBLIC_READ']\n\t\t}\n\t\tif (fileName || contentDisposition) {\n\t\t\tlet contentDispositionHeader = contentDisposition?.toLowerCase() ?? 'inline'\n\t\t\tif (fileName) {\n\t\t\t\tcontentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`\n\t\t\t}\n\t\t\theaders['Content-Disposition'] = contentDispositionHeader\n\t\t}\n\t\tconst headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }))\n\n\t\t// intentionally not sending following headers\n\t\tif (size) {\n\t\t\theaders['Content-Length'] = String(size)\n\t\t}\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'upload',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: { ...headers },\n\t\t})\n\n\t\tconst publicUrl = this.formatPublicUrl(objectKey)\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\tpublicUrl,\n\t\t\theaders: headersToSend,\n\t\t\tmethod: 'PUT',\n\t\t}\n\t}\n\n\tpublic getSignedReadUrl({ objectKey, expiration }: { objectKey: string; expiration: number | null }): SignedReadUrl {\n\t\tconst bucket = this.config.bucket\n\t\tconst resolved = this.resolveObjectKey(objectKey)\n\t\tthis.authorizator.verifyReadAccess({ key: resolved.localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'read',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: resolved.objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey: resolved.objectKey,\n\t\t\turl,\n\t\t\theaders: [],\n\t\t\tmethod: 'GET',\n\t\t}\n\t}\n\n\t/**\n\t * Unlike an upload or a read, a delete carries no payload, so the signed URL never leaves the server.\n\t */\n\tpublic async deleteObject({ objectKey }: { objectKey: string }): Promise<DeletedObject> {\n\t\tconst bucket = this.config.bucket\n\t\tconst resolved = this.resolveObjectKey(objectKey)\n\t\tthis.authorizator.verifyDeleteAccess({ key: resolved.localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'delete',\n\t\t\texpiration: deleteUrlExpiration,\n\t\t\tkey: resolved.objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\tconst response = await this.fetch(url, { method: 'DELETE', signal: AbortSignal.timeout(deleteTimeoutMs) })\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to delete an object \"${resolved.objectKey}\": S3 responded with ${response.status}: ${await response.text()}`)\n\t\t}\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey: resolved.objectKey,\n\t\t}\n\t}\n\n\tpublic formatPublicUrl(key: string): string {\n\t\treturn `${this.publicBaseUrl}/${key}`\n\t}\n\n\tprivate resolveObjectKey(objectKey: string): { objectKey: string; localObjectKey: string } {\n\t\tconst publicPrefix = this.formatPublicUrl('')\n\t\tif (objectKey.startsWith(publicPrefix)) {\n\t\t\tobjectKey = objectKey.substring(publicPrefix.length)\n\t\t}\n\t\t// the separator is a part of the prefix: without it, a project prefixed \"blog\" reaches into \"blog-staging\" in a shared bucket\n\t\tconst prefix = this.config.prefix ? this.config.prefix + '/' : ''\n\t\tif (prefix && !objectKey.startsWith(prefix)) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t`Given object key \"${objectKey}\" does not start with a project prefix \"${this.config.prefix}\"`,\n\t\t\t)\n\t\t}\n\t\tconst localObjectKey = objectKey.substring(prefix.length)\n\n\t\treturn { objectKey, localObjectKey }\n\t}\n}\n\nexport class S3ServiceFactory {\n\tpublic create(config: S3Config, providers: Providers, authorizator: S3ObjectAuthorizator) {\n\t\treturn new S3Service(config, providers, authorizator)\n\t}\n}\n"],"names":["extension","resolveExtension"],"mappings":";;;;;;;AAsCA,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;AAEjB,MAAM,UAAU;AAAA,EAKtB,YACiB,QACC,WACA,cACA,QAAiB,CAAC,KAAK,SAAS,WAAW,MAAM,KAAK,IAAI,GAC1E;AAJe,SAAA,SAAA;AACC,SAAA,YAAA;AACA,SAAA,eAAA;AACA,SAAA,QAAA;AARlB,kBAAA,MAAiB,eAAA;AAEjB,kBAAA,MAAiB,QAAA;AAQhB,SAAK,gBAAgB,uBAAuB,MAAM;AAClD,SAAK,SAAS,IAAI,SAAS,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEO,mBACN,EAAE,KAAK,oBAAoB,aAAa,YAAY,QAAQ,QAAQ,qBAAUA,aAAW,KAAA,GACvE;AAClB,UAAM,MAAMA,iBAAe,cAAcC,UAAiB,WAAW,IAAI,SAAS;AAClF,UAAM,KAAK,KAAK,UAAU,KAAA;AAC1B,UAAM,kBAAkB,SAAS,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,GAAG;AACjF,SAAK,aAAa,mBAAmB,EAAE,KAAK,gBAAgB,MAAM;AAElE,UAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM,MAAM;AAEzE,UAAM,SAAS,KAAK,OAAO;AAC3B,QAAI,OAAO,KAAK,OAAO,OAAO;AAC7B,YAAM,IAAI,eAAe,sBAAsB;AAAA,IAChD;AAEA,UAAM,UAAkC;AAAA,MACvC,iBAAiB;AAAA,IAAA;AAElB,QAAI,aAAa;AAChB,cAAQ,cAAc,IAAI;AAAA,IAC3B;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS,QAAQ,QAAQ;AACzC,YAAM,UAAU,EAAE,aAAa,eAAe,SAAS,UAAA;AACvD,cAAQ,WAAW,IAAI,QAAQ,OAAO,aAAa;AAAA,IACpD;AACA,QAAI,YAAY,oBAAoB;AACnC,UAAI,2BAA2B,oBAAoB,YAAA,KAAiB;AACpE,UAAI,UAAU;AACb,oCAA4B,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,MAC/E;AACA,cAAQ,qBAAqB,IAAI;AAAA,IAClC;AACA,UAAM,gBAAgB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,QAAQ;AAGpF,QAAI,MAAM;AACT,cAAQ,gBAAgB,IAAI,OAAO,IAAI;AAAA,IACxC;AAEA,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,EAAE,GAAG,QAAA;AAAA,IAAQ,CACtB;AAED,UAAM,YAAY,KAAK,gBAAgB,SAAS;AAChD,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,iBAAiB,EAAE,WAAW,cAA+E;AACnH,UAAM,SAAS,KAAK,OAAO;AAC3B,UAAM,WAAW,KAAK,iBAAiB,SAAS;AAChD,SAAK,aAAa,iBAAiB,EAAE,KAAK,SAAS,gBAAgB;AAEnE,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK,SAAS;AAAA,MACd,SAAS,CAAA;AAAA,IAAC,CACV;AAED,WAAO;AAAA,MACN;AAAA,MACA,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,SAAS,CAAA;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,aAAa,EAAE,aAA4D;AACvF,UAAM,SAAS,KAAK,OAAO;AAC3B,UAAM,WAAW,KAAK,iBAAiB,SAAS;AAChD,SAAK,aAAa,mBAAmB,EAAE,KAAK,SAAS,gBAAgB;AAErE,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,KAAK,SAAS;AAAA,MACd,SAAS,CAAA;AAAA,IAAC,CACV;AAED,UAAM,WAAW,MAAM,KAAK,MAAM,KAAK,EAAE,QAAQ,UAAU,QAAQ,YAAY,QAAQ,eAAe,GAAG;AACzG,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,IAAI,MAAM,+BAA+B,SAAS,SAAS,wBAAwB,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,IACrI;AAEA,WAAO;AAAA,MACN;AAAA,MACA,WAAW,SAAS;AAAA,IAAA;AAAA,EAEtB;AAAA,EAEO,gBAAgB,KAAqB;AAC3C,WAAO,GAAG,KAAK,aAAa,IAAI,GAAG;AAAA,EACpC;AAAA,EAEQ,iBAAiB,WAAkE;AAC1F,UAAM,eAAe,KAAK,gBAAgB,EAAE;AAC5C,QAAI,UAAU,WAAW,YAAY,GAAG;AACvC,kBAAY,UAAU,UAAU,aAAa,MAAM;AAAA,IACpD;AAEA,UAAM,SAAS,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM;AAC/D,QAAI,UAAU,CAAC,UAAU,WAAW,MAAM,GAAG;AAC5C,YAAM,IAAI;AAAA,QACT,qBAAqB,SAAS,2CAA2C,KAAK,OAAO,MAAM;AAAA,MAAA;AAAA,IAE7F;AACA,UAAM,iBAAiB,UAAU,UAAU,OAAO,MAAM;AAExD,WAAO,EAAE,WAAW,eAAA;AAAA,EACrB;AACD;AAEO,MAAM,iBAAiB;AAAA,EACtB,OAAO,QAAkB,WAAsB,cAAoC;AACzF,WAAO,IAAI,UAAU,QAAQ,WAAW,YAAY;AAAA,EACrD;AACD;"}

package/dist/production/src/S3Signer.cjs

@@ -6,6 +6,11 @@ const crypto = require("node:crypto");
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const methods = {
+  read: "GET",
+  upload: "PUT",
+  delete: "DELETE"
+};
 const hmac = (secret, data) => crypto.createHmac("sha256", secret).update(data).digest();
 const hash = (data) => crypto.createHash("sha256").update(data).digest("hex");
 const unsignableHeaders = ["authorization", "user-agent", "content-type", "expect", "x-amzn-trace-id"];
@@ -26,7 +31,7 @@ class S3Signer {
     const queryString = this.getQueryParams(request, nowFormatted);
     const path = uris.basePath + "/" + request.key;
     const lines = [
-      request.action === "read" ? "GET" : "PUT",
+      methods[request.action],
       path,
       queryString,
       this.getSignedHeaders(request),

package/dist/production/src/S3Signer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"S3Signer.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\trequest.action === 'read' ? 'GET' : 'PUT',\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":["createHmac","createHash","resolveS3Endpoint"],"mappings":";;;;;;;;AAYA,MAAM,OAAO,CAAC,QAAoB,SAAqBA,kBAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqBC,OAAAA,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAOC,OAAAA,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,WAAW,SAAS,QAAQ;AAAA,MACpC;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;;"}
+{"version":3,"file":"S3Signer.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config.js'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload' | 'delete'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst methods: Record<S3Request['action'], string> = {\n\tread: 'GET',\n\tupload: 'PUT',\n\tdelete: 'DELETE',\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\tmethods[request.action],\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":["createHmac","createHash","resolveS3Endpoint"],"mappings":";;;;;;;;AAYA,MAAM,UAA+C;AAAA,EACpD,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACT;AAEA,MAAM,OAAO,CAAC,QAAoB,SAAqBA,kBAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqBC,OAAAA,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAOC,OAAAA,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,QAAQ,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;;"}

package/dist/production/src/S3Signer.js

@@ -4,6 +4,11 @@ import { createHash, createHmac } from "node:crypto";
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const methods = {
+  read: "GET",
+  upload: "PUT",
+  delete: "DELETE"
+};
 const hmac = (secret, data) => createHmac("sha256", secret).update(data).digest();
 const hash = (data) => createHash("sha256").update(data).digest("hex");
 const unsignableHeaders = ["authorization", "user-agent", "content-type", "expect", "x-amzn-trace-id"];
@@ -24,7 +29,7 @@ class S3Signer {
     const queryString = this.getQueryParams(request, nowFormatted);
     const path = uris.basePath + "/" + request.key;
     const lines = [
-      request.action === "read" ? "GET" : "PUT",
+      methods[request.action],
       path,
       queryString,
       this.getSignedHeaders(request),

package/dist/production/src/S3Signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"S3Signer.js","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\trequest.action === 'read' ? 'GET' : 'PUT',\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAYA,MAAM,OAAO,CAAC,QAAoB,SAAqB,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqB,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAO,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,WAAW,SAAS,QAAQ;AAAA,MACpC;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;"}
+{"version":3,"file":"S3Signer.js","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config.js'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload' | 'delete'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst methods: Record<S3Request['action'], string> = {\n\tread: 'GET',\n\tupload: 'PUT',\n\tdelete: 'DELETE',\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\tmethods[request.action],\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAYA,MAAM,UAA+C;AAAA,EACpD,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACT;AAEA,MAAM,OAAO,CAAC,QAAoB,SAAqB,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqB,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAO,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,QAAQ,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;"}