@contember/engine-s3-plugin 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/S3Service.js

@@ -5,11 +5,14 @@ import { S3Signer } from "./S3Signer.js";
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const deleteUrlExpiration = 60;
+const deleteTimeoutMs = 1e4;
 class S3Service {
-  constructor(config, providers, authorizator) {
+  constructor(config, providers, authorizator, fetch = (url, init) => globalThis.fetch(url, init)) {
     this.config = config;
     this.providers = providers;
     this.authorizator = authorizator;
+    this.fetch = fetch;
     __publicField(this, "publicBaseUrl");
     __publicField(this, "signer");
     this.publicBaseUrl = resolveS3PublicBaseUrl(config);
@@ -64,34 +67,61 @@ class S3Service {
   }
   getSignedReadUrl({ objectKey, expiration }) {
     const bucket = this.config.bucket;
-    const publicPrefix = this.formatPublicUrl("");
-    if (objectKey.startsWith(publicPrefix)) {
-      objectKey = objectKey.substring(publicPrefix.length);
-    }
-    if (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {
-      throw new ForbiddenError(
-        `Given object key "${objectKey}" does not start with a project prefix "${this.config.prefix}"`
-      );
-    }
-    const localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey;
-    this.authorizator.verifyReadAccess({ key: localObjectKey });
+    const resolved = this.resolveObjectKey(objectKey);
+    this.authorizator.verifyReadAccess({ key: resolved.localObjectKey });
     const url = this.signer.sign({
       action: "read",
       expiration: expiration ?? 3600,
-      key: objectKey,
+      key: resolved.objectKey,
       headers: {}
     });
     return {
       bucket,
-      objectKey,
+      objectKey: resolved.objectKey,
       url,
       headers: [],
       method: "GET"
     };
   }
+  /**
+   * Unlike an upload or a read, a delete carries no payload, so the signed URL never leaves the server.
+   */
+  async deleteObject({ objectKey }) {
+    const bucket = this.config.bucket;
+    const resolved = this.resolveObjectKey(objectKey);
+    this.authorizator.verifyDeleteAccess({ key: resolved.localObjectKey });
+    const url = this.signer.sign({
+      action: "delete",
+      expiration: deleteUrlExpiration,
+      key: resolved.objectKey,
+      headers: {}
+    });
+    const response = await this.fetch(url, { method: "DELETE", signal: AbortSignal.timeout(deleteTimeoutMs) });
+    if (!response.ok) {
+      throw new Error(`Failed to delete an object "${resolved.objectKey}": S3 responded with ${response.status}: ${await response.text()}`);
+    }
+    return {
+      bucket,
+      objectKey: resolved.objectKey
+    };
+  }
   formatPublicUrl(key) {
     return `${this.publicBaseUrl}/${key}`;
   }
+  resolveObjectKey(objectKey) {
+    const publicPrefix = this.formatPublicUrl("");
+    if (objectKey.startsWith(publicPrefix)) {
+      objectKey = objectKey.substring(publicPrefix.length);
+    }
+    const prefix = this.config.prefix ? this.config.prefix + "/" : "";
+    if (prefix && !objectKey.startsWith(prefix)) {
+      throw new ForbiddenError(
+        `Given object key "${objectKey}" does not start with a project prefix "${this.config.prefix}"`
+      );
+    }
+    const localObjectKey = objectKey.substring(prefix.length);
+    return { objectKey, localObjectKey };
+  }
 }
 class S3ServiceFactory {
   create(config, providers, authorizator) {

package/dist/development/src/S3Service.js.map

@@ -1 +1 @@
-{"version":3,"file":"S3Service.js","sources":["../../../../packages/engine-s3-plugin/src/S3Service.ts"],"sourcesContent":["import { extension as resolveExtension } from 'mime-types'\nimport { resolveS3PublicBaseUrl, S3Config } from './Config.js'\nimport { ForbiddenError, UserInputError } from '@contember/graphql-utils'\nimport { Providers } from '@contember/engine-plugins'\nimport { S3Signer } from './S3Signer.js'\nimport { S3GenerateSignedUploadInput } from './S3SchemaTypes.js'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'\n\ntype SignedReadUrl = {\n\turl: string\n\tbucket: string\n\tobjectKey: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype SignedUploadUrl = {\n\tobjectKey: string\n\turl: string\n\tbucket: string\n\tpublicUrl: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\nexport class S3Service {\n\tprivate readonly publicBaseUrl: string\n\n\tprivate readonly signer: S3Signer\n\n\tconstructor(\n\t\tpublic readonly config: S3Config,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now'>,\n\t\tprivate readonly authorizator: S3ObjectAuthorizator,\n\t) {\n\t\tthis.publicBaseUrl = resolveS3PublicBaseUrl(config)\n\t\tthis.signer = new S3Signer(config, providers)\n\t}\n\n\tpublic getSignedUploadUrl(\n\t\t{ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension, size }: S3GenerateSignedUploadInput,\n\t): SignedUploadUrl {\n\t\tconst ext = extension ?? ((contentType ? resolveExtension(contentType) : null) || 'bin')\n\t\tconst id = this.providers.uuid()\n\t\tconst localObjectKey = (prefix ? prefix + '/' : '') + `${id}${suffix ?? ''}.${ext}`\n\t\tthis.authorizator.verifyUploadAccess({ key: localObjectKey, size })\n\n\t\tconst objectKey = (this.config.prefix ? this.config.prefix + '/' : '') + localObjectKey\n\n\t\tconst bucket = this.config.bucket\n\t\tif (acl && this.config.noAcl) {\n\t\t\tthrow new UserInputError('ACL is not supported')\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t'Cache-Control': 'immutable',\n\t\t}\n\t\tif (contentType) {\n\t\t\theaders['Content-Type'] = contentType\n\t\t}\n\n\t\tif (!this.config.noAcl && acl !== 'NONE') {\n\t\t\tconst mapping = { PUBLIC_READ: 'public-read', PRIVATE: 'private' }\n\t\t\theaders['x-amz-acl'] = mapping[acl ?? 'PUBLIC_READ']\n\t\t}\n\t\tif (fileName || contentDisposition) {\n\t\t\tlet contentDispositionHeader = contentDisposition?.toLowerCase() ?? 'inline'\n\t\t\tif (fileName) {\n\t\t\t\tcontentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`\n\t\t\t}\n\t\t\theaders['Content-Disposition'] = contentDispositionHeader\n\t\t}\n\t\tconst headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }))\n\n\t\t// intentionally not sending following headers\n\t\tif (size) {\n\t\t\theaders['Content-Length'] = String(size)\n\t\t}\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'upload',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: { ...headers },\n\t\t})\n\n\t\tconst publicUrl = this.formatPublicUrl(objectKey)\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\tpublicUrl,\n\t\t\theaders: headersToSend,\n\t\t\tmethod: 'PUT',\n\t\t}\n\t}\n\n\tpublic getSignedReadUrl({ objectKey, expiration }: { objectKey: string; expiration: number | null }): SignedReadUrl {\n\t\tconst bucket = this.config.bucket\n\n\t\tconst publicPrefix = this.formatPublicUrl('')\n\t\tif (objectKey.startsWith(publicPrefix)) {\n\t\t\tobjectKey = objectKey.substring(publicPrefix.length)\n\t\t}\n\t\tif (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t`Given object key \"${objectKey}\" does not start with a project prefix \"${this.config.prefix}\"`,\n\t\t\t)\n\t\t}\n\t\tconst localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey\n\t\tthis.authorizator.verifyReadAccess({ key: localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'read',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\theaders: [],\n\t\t\tmethod: 'GET',\n\t\t}\n\t}\n\n\tpublic formatPublicUrl(key: string): string {\n\t\treturn `${this.publicBaseUrl}/${key}`\n\t}\n}\n\nexport class S3ServiceFactory {\n\tpublic create(config: S3Config, providers: Providers, authorizator: S3ObjectAuthorizator) {\n\t\treturn new S3Service(config, providers, authorizator)\n\t}\n}\n"],"names":["extension","resolveExtension"],"mappings":";;;;;;;AAyBO,MAAM,UAAU;AAAA,EAKtB,YACiB,QACC,WACA,cAChB;AAHe,SAAA,SAAA;AACC,SAAA,YAAA;AACA,SAAA,eAAA;AAPlB,kBAAA,MAAiB,eAAA;AAEjB,kBAAA,MAAiB,QAAA;AAOhB,SAAK,gBAAgB,uBAAuB,MAAM;AAClD,SAAK,SAAS,IAAI,SAAS,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEO,mBACN,EAAE,KAAK,oBAAoB,aAAa,YAAY,QAAQ,QAAQ,qBAAUA,aAAW,KAAA,GACvE;AAClB,UAAM,MAAMA,iBAAe,cAAcC,UAAiB,WAAW,IAAI,SAAS;AAClF,UAAM,KAAK,KAAK,UAAU,KAAA;AAC1B,UAAM,kBAAkB,SAAS,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,GAAG;AACjF,SAAK,aAAa,mBAAmB,EAAE,KAAK,gBAAgB,MAAM;AAElE,UAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM,MAAM;AAEzE,UAAM,SAAS,KAAK,OAAO;AAC3B,QAAI,OAAO,KAAK,OAAO,OAAO;AAC7B,YAAM,IAAI,eAAe,sBAAsB;AAAA,IAChD;AAEA,UAAM,UAAkC;AAAA,MACvC,iBAAiB;AAAA,IAAA;AAElB,QAAI,aAAa;AAChB,cAAQ,cAAc,IAAI;AAAA,IAC3B;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS,QAAQ,QAAQ;AACzC,YAAM,UAAU,EAAE,aAAa,eAAe,SAAS,UAAA;AACvD,cAAQ,WAAW,IAAI,QAAQ,OAAO,aAAa;AAAA,IACpD;AACA,QAAI,YAAY,oBAAoB;AACnC,UAAI,2BAA2B,oBAAoB,YAAA,KAAiB;AACpE,UAAI,UAAU;AACb,oCAA4B,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,MAC/E;AACA,cAAQ,qBAAqB,IAAI;AAAA,IAClC;AACA,UAAM,gBAAgB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,QAAQ;AAGpF,QAAI,MAAM;AACT,cAAQ,gBAAgB,IAAI,OAAO,IAAI;AAAA,IACxC;AAEA,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,EAAE,GAAG,QAAA;AAAA,IAAQ,CACtB;AAED,UAAM,YAAY,KAAK,gBAAgB,SAAS;AAChD,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,iBAAiB,EAAE,WAAW,cAA+E;AACnH,UAAM,SAAS,KAAK,OAAO;AAE3B,UAAM,eAAe,KAAK,gBAAgB,EAAE;AAC5C,QAAI,UAAU,WAAW,YAAY,GAAG;AACvC,kBAAY,UAAU,UAAU,aAAa,MAAM;AAAA,IACpD;AACA,QAAI,KAAK,OAAO,UAAU,CAAC,UAAU,WAAW,KAAK,OAAO,MAAM,GAAG;AACpE,YAAM,IAAI;AAAA,QACT,qBAAqB,SAAS,2CAA2C,KAAK,OAAO,MAAM;AAAA,MAAA;AAAA,IAE7F;AACA,UAAM,iBAAiB,KAAK,OAAO,SAAS,UAAU,UAAU,KAAK,OAAO,OAAO,SAAS,CAAC,IAAI;AACjG,SAAK,aAAa,iBAAiB,EAAE,KAAK,gBAAgB;AAE1D,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,CAAA;AAAA,IAAC,CACV;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,CAAA;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,gBAAgB,KAAqB;AAC3C,WAAO,GAAG,KAAK,aAAa,IAAI,GAAG;AAAA,EACpC;AACD;AAEO,MAAM,iBAAiB;AAAA,EACtB,OAAO,QAAkB,WAAsB,cAAoC;AACzF,WAAO,IAAI,UAAU,QAAQ,WAAW,YAAY;AAAA,EACrD;AACD;"}
+{"version":3,"file":"S3Service.js","sources":["../../../../packages/engine-s3-plugin/src/S3Service.ts"],"sourcesContent":["import { extension as resolveExtension } from 'mime-types'\nimport { resolveS3PublicBaseUrl, S3Config } from './Config.js'\nimport { ForbiddenError, UserInputError } from '@contember/graphql-utils'\nimport { Providers } from '@contember/engine-plugins'\nimport { S3Signer } from './S3Signer.js'\nimport { S3GenerateSignedUploadInput } from './S3SchemaTypes.js'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'\n\ntype SignedReadUrl = {\n\turl: string\n\tbucket: string\n\tobjectKey: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype SignedUploadUrl = {\n\tobjectKey: string\n\turl: string\n\tbucket: string\n\tpublicUrl: string\n\theaders: { key: string; value: string }[]\n\tmethod: string\n}\n\ntype DeletedObject = {\n\tbucket: string\n\tobjectKey: string\n}\n\nexport type S3FetchResponse = {\n\treadonly ok: boolean\n\treadonly status: number\n\ttext(): Promise<string>\n}\n\nexport type S3Fetch = (url: string, init: { method: string; signal: AbortSignal }) => Promise<S3FetchResponse>\n\nconst deleteUrlExpiration = 60\nconst deleteTimeoutMs = 10_000\n\nexport class S3Service {\n\tprivate readonly publicBaseUrl: string\n\n\tprivate readonly signer: S3Signer\n\n\tconstructor(\n\t\tpublic readonly config: S3Config,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now'>,\n\t\tprivate readonly authorizator: S3ObjectAuthorizator,\n\t\tprivate readonly fetch: S3Fetch = (url, init) => globalThis.fetch(url, init),\n\t) {\n\t\tthis.publicBaseUrl = resolveS3PublicBaseUrl(config)\n\t\tthis.signer = new S3Signer(config, providers)\n\t}\n\n\tpublic getSignedUploadUrl(\n\t\t{ acl, contentDisposition, contentType, expiration, prefix, suffix, fileName, extension, size }: S3GenerateSignedUploadInput,\n\t): SignedUploadUrl {\n\t\tconst ext = extension ?? ((contentType ? resolveExtension(contentType) : null) || 'bin')\n\t\tconst id = this.providers.uuid()\n\t\tconst localObjectKey = (prefix ? prefix + '/' : '') + `${id}${suffix ?? ''}.${ext}`\n\t\tthis.authorizator.verifyUploadAccess({ key: localObjectKey, size })\n\n\t\tconst objectKey = (this.config.prefix ? this.config.prefix + '/' : '') + localObjectKey\n\n\t\tconst bucket = this.config.bucket\n\t\tif (acl && this.config.noAcl) {\n\t\t\tthrow new UserInputError('ACL is not supported')\n\t\t}\n\n\t\tconst headers: Record<string, string> = {\n\t\t\t'Cache-Control': 'immutable',\n\t\t}\n\t\tif (contentType) {\n\t\t\theaders['Content-Type'] = contentType\n\t\t}\n\n\t\tif (!this.config.noAcl && acl !== 'NONE') {\n\t\t\tconst mapping = { PUBLIC_READ: 'public-read', PRIVATE: 'private' }\n\t\t\theaders['x-amz-acl'] = mapping[acl ?? 'PUBLIC_READ']\n\t\t}\n\t\tif (fileName || contentDisposition) {\n\t\t\tlet contentDispositionHeader = contentDisposition?.toLowerCase() ?? 'inline'\n\t\t\tif (fileName) {\n\t\t\t\tcontentDispositionHeader += `; filename*=UTF-8''${encodeURIComponent(fileName)}`\n\t\t\t}\n\t\t\theaders['Content-Disposition'] = contentDispositionHeader\n\t\t}\n\t\tconst headersToSend = Object.entries(headers).map(([key, value]) => ({ key, value }))\n\n\t\t// intentionally not sending following headers\n\t\tif (size) {\n\t\t\theaders['Content-Length'] = String(size)\n\t\t}\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'upload',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: objectKey,\n\t\t\theaders: { ...headers },\n\t\t})\n\n\t\tconst publicUrl = this.formatPublicUrl(objectKey)\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey,\n\t\t\turl,\n\t\t\tpublicUrl,\n\t\t\theaders: headersToSend,\n\t\t\tmethod: 'PUT',\n\t\t}\n\t}\n\n\tpublic getSignedReadUrl({ objectKey, expiration }: { objectKey: string; expiration: number | null }): SignedReadUrl {\n\t\tconst bucket = this.config.bucket\n\t\tconst resolved = this.resolveObjectKey(objectKey)\n\t\tthis.authorizator.verifyReadAccess({ key: resolved.localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'read',\n\t\t\texpiration: expiration ?? 3600,\n\t\t\tkey: resolved.objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey: resolved.objectKey,\n\t\t\turl,\n\t\t\theaders: [],\n\t\t\tmethod: 'GET',\n\t\t}\n\t}\n\n\t/**\n\t * Unlike an upload or a read, a delete carries no payload, so the signed URL never leaves the server.\n\t */\n\tpublic async deleteObject({ objectKey }: { objectKey: string }): Promise<DeletedObject> {\n\t\tconst bucket = this.config.bucket\n\t\tconst resolved = this.resolveObjectKey(objectKey)\n\t\tthis.authorizator.verifyDeleteAccess({ key: resolved.localObjectKey })\n\n\t\tconst url = this.signer.sign({\n\t\t\taction: 'delete',\n\t\t\texpiration: deleteUrlExpiration,\n\t\t\tkey: resolved.objectKey,\n\t\t\theaders: {},\n\t\t})\n\n\t\tconst response = await this.fetch(url, { method: 'DELETE', signal: AbortSignal.timeout(deleteTimeoutMs) })\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to delete an object \"${resolved.objectKey}\": S3 responded with ${response.status}: ${await response.text()}`)\n\t\t}\n\n\t\treturn {\n\t\t\tbucket,\n\t\t\tobjectKey: resolved.objectKey,\n\t\t}\n\t}\n\n\tpublic formatPublicUrl(key: string): string {\n\t\treturn `${this.publicBaseUrl}/${key}`\n\t}\n\n\tprivate resolveObjectKey(objectKey: string): { objectKey: string; localObjectKey: string } {\n\t\tconst publicPrefix = this.formatPublicUrl('')\n\t\tif (objectKey.startsWith(publicPrefix)) {\n\t\t\tobjectKey = objectKey.substring(publicPrefix.length)\n\t\t}\n\t\t// the separator is a part of the prefix: without it, a project prefixed \"blog\" reaches into \"blog-staging\" in a shared bucket\n\t\tconst prefix = this.config.prefix ? this.config.prefix + '/' : ''\n\t\tif (prefix && !objectKey.startsWith(prefix)) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t`Given object key \"${objectKey}\" does not start with a project prefix \"${this.config.prefix}\"`,\n\t\t\t)\n\t\t}\n\t\tconst localObjectKey = objectKey.substring(prefix.length)\n\n\t\treturn { objectKey, localObjectKey }\n\t}\n}\n\nexport class S3ServiceFactory {\n\tpublic create(config: S3Config, providers: Providers, authorizator: S3ObjectAuthorizator) {\n\t\treturn new S3Service(config, providers, authorizator)\n\t}\n}\n"],"names":["extension","resolveExtension"],"mappings":";;;;;;;AAsCA,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;AAEjB,MAAM,UAAU;AAAA,EAKtB,YACiB,QACC,WACA,cACA,QAAiB,CAAC,KAAK,SAAS,WAAW,MAAM,KAAK,IAAI,GAC1E;AAJe,SAAA,SAAA;AACC,SAAA,YAAA;AACA,SAAA,eAAA;AACA,SAAA,QAAA;AARlB,kBAAA,MAAiB,eAAA;AAEjB,kBAAA,MAAiB,QAAA;AAQhB,SAAK,gBAAgB,uBAAuB,MAAM;AAClD,SAAK,SAAS,IAAI,SAAS,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEO,mBACN,EAAE,KAAK,oBAAoB,aAAa,YAAY,QAAQ,QAAQ,qBAAUA,aAAW,KAAA,GACvE;AAClB,UAAM,MAAMA,iBAAe,cAAcC,UAAiB,WAAW,IAAI,SAAS;AAClF,UAAM,KAAK,KAAK,UAAU,KAAA;AAC1B,UAAM,kBAAkB,SAAS,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,GAAG;AACjF,SAAK,aAAa,mBAAmB,EAAE,KAAK,gBAAgB,MAAM;AAElE,UAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM,MAAM;AAEzE,UAAM,SAAS,KAAK,OAAO;AAC3B,QAAI,OAAO,KAAK,OAAO,OAAO;AAC7B,YAAM,IAAI,eAAe,sBAAsB;AAAA,IAChD;AAEA,UAAM,UAAkC;AAAA,MACvC,iBAAiB;AAAA,IAAA;AAElB,QAAI,aAAa;AAChB,cAAQ,cAAc,IAAI;AAAA,IAC3B;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS,QAAQ,QAAQ;AACzC,YAAM,UAAU,EAAE,aAAa,eAAe,SAAS,UAAA;AACvD,cAAQ,WAAW,IAAI,QAAQ,OAAO,aAAa;AAAA,IACpD;AACA,QAAI,YAAY,oBAAoB;AACnC,UAAI,2BAA2B,oBAAoB,YAAA,KAAiB;AACpE,UAAI,UAAU;AACb,oCAA4B,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,MAC/E;AACA,cAAQ,qBAAqB,IAAI;AAAA,IAClC;AACA,UAAM,gBAAgB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,QAAQ;AAGpF,QAAI,MAAM;AACT,cAAQ,gBAAgB,IAAI,OAAO,IAAI;AAAA,IACxC;AAEA,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK;AAAA,MACL,SAAS,EAAE,GAAG,QAAA;AAAA,IAAQ,CACtB;AAED,UAAM,YAAY,KAAK,gBAAgB,SAAS;AAChD,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA,EAEO,iBAAiB,EAAE,WAAW,cAA+E;AACnH,UAAM,SAAS,KAAK,OAAO;AAC3B,UAAM,WAAW,KAAK,iBAAiB,SAAS;AAChD,SAAK,aAAa,iBAAiB,EAAE,KAAK,SAAS,gBAAgB;AAEnE,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY,cAAc;AAAA,MAC1B,KAAK,SAAS;AAAA,MACd,SAAS,CAAA;AAAA,IAAC,CACV;AAED,WAAO;AAAA,MACN;AAAA,MACA,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,SAAS,CAAA;AAAA,MACT,QAAQ;AAAA,IAAA;AAAA,EAEV;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,aAAa,EAAE,aAA4D;AACvF,UAAM,SAAS,KAAK,OAAO;AAC3B,UAAM,WAAW,KAAK,iBAAiB,SAAS;AAChD,SAAK,aAAa,mBAAmB,EAAE,KAAK,SAAS,gBAAgB;AAErE,UAAM,MAAM,KAAK,OAAO,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,KAAK,SAAS;AAAA,MACd,SAAS,CAAA;AAAA,IAAC,CACV;AAED,UAAM,WAAW,MAAM,KAAK,MAAM,KAAK,EAAE,QAAQ,UAAU,QAAQ,YAAY,QAAQ,eAAe,GAAG;AACzG,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,IAAI,MAAM,+BAA+B,SAAS,SAAS,wBAAwB,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,IACrI;AAEA,WAAO;AAAA,MACN;AAAA,MACA,WAAW,SAAS;AAAA,IAAA;AAAA,EAEtB;AAAA,EAEO,gBAAgB,KAAqB;AAC3C,WAAO,GAAG,KAAK,aAAa,IAAI,GAAG;AAAA,EACpC;AAAA,EAEQ,iBAAiB,WAAkE;AAC1F,UAAM,eAAe,KAAK,gBAAgB,EAAE;AAC5C,QAAI,UAAU,WAAW,YAAY,GAAG;AACvC,kBAAY,UAAU,UAAU,aAAa,MAAM;AAAA,IACpD;AAEA,UAAM,SAAS,KAAK,OAAO,SAAS,KAAK,OAAO,SAAS,MAAM;AAC/D,QAAI,UAAU,CAAC,UAAU,WAAW,MAAM,GAAG;AAC5C,YAAM,IAAI;AAAA,QACT,qBAAqB,SAAS,2CAA2C,KAAK,OAAO,MAAM;AAAA,MAAA;AAAA,IAE7F;AACA,UAAM,iBAAiB,UAAU,UAAU,OAAO,MAAM;AAExD,WAAO,EAAE,WAAW,eAAA;AAAA,EACrB;AACD;AAEO,MAAM,iBAAiB;AAAA,EACtB,OAAO,QAAkB,WAAsB,cAAoC;AACzF,WAAO,IAAI,UAAU,QAAQ,WAAW,YAAY;AAAA,EACrD;AACD;"}

package/dist/development/src/S3Signer.cjs

@@ -6,6 +6,11 @@ const crypto = require("node:crypto");
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const methods = {
+  read: "GET",
+  upload: "PUT",
+  delete: "DELETE"
+};
 const hmac = (secret, data) => crypto.createHmac("sha256", secret).update(data).digest();
 const hash = (data) => crypto.createHash("sha256").update(data).digest("hex");
 const unsignableHeaders = ["authorization", "user-agent", "content-type", "expect", "x-amzn-trace-id"];
@@ -26,7 +31,7 @@ class S3Signer {
     const queryString = this.getQueryParams(request, nowFormatted);
     const path = uris.basePath + "/" + request.key;
     const lines = [
-      request.action === "read" ? "GET" : "PUT",
+      methods[request.action],
       path,
       queryString,
       this.getSignedHeaders(request),

package/dist/development/src/S3Signer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"S3Signer.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config.js'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\trequest.action === 'read' ? 'GET' : 'PUT',\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":["createHmac","createHash","resolveS3Endpoint"],"mappings":";;;;;;;;AAYA,MAAM,OAAO,CAAC,QAAoB,SAAqBA,kBAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqBC,OAAAA,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAOC,OAAAA,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,WAAW,SAAS,QAAQ;AAAA,MACpC;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;;"}
+{"version":3,"file":"S3Signer.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config.js'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload' | 'delete'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst methods: Record<S3Request['action'], string> = {\n\tread: 'GET',\n\tupload: 'PUT',\n\tdelete: 'DELETE',\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\tmethods[request.action],\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":["createHmac","createHash","resolveS3Endpoint"],"mappings":";;;;;;;;AAYA,MAAM,UAA+C;AAAA,EACpD,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACT;AAEA,MAAM,OAAO,CAAC,QAAoB,SAAqBA,kBAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqBC,OAAAA,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAOC,OAAAA,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,QAAQ,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;;"}

package/dist/development/src/S3Signer.js

@@ -4,6 +4,11 @@ import { createHash, createHmac } from "node:crypto";
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const methods = {
+  read: "GET",
+  upload: "PUT",
+  delete: "DELETE"
+};
 const hmac = (secret, data) => createHmac("sha256", secret).update(data).digest();
 const hash = (data) => createHash("sha256").update(data).digest("hex");
 const unsignableHeaders = ["authorization", "user-agent", "content-type", "expect", "x-amzn-trace-id"];
@@ -24,7 +29,7 @@ class S3Signer {
     const queryString = this.getQueryParams(request, nowFormatted);
     const path = uris.basePath + "/" + request.key;
     const lines = [
-      request.action === "read" ? "GET" : "PUT",
+      methods[request.action],
       path,
       queryString,
       this.getSignedHeaders(request),

package/dist/development/src/S3Signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"S3Signer.js","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config.js'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\trequest.action === 'read' ? 'GET' : 'PUT',\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAYA,MAAM,OAAO,CAAC,QAAoB,SAAqB,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqB,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAO,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,WAAW,SAAS,QAAQ;AAAA,MACpC;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;"}
+{"version":3,"file":"S3Signer.js","sources":["../../../../packages/engine-s3-plugin/src/S3Signer.ts"],"sourcesContent":["import { resolveS3Endpoint, S3Config } from './Config.js'\nimport { Providers } from '@contember/engine-plugins'\nimport qs from 'qs'\nimport { BinaryLike, createHash, createHmac } from 'node:crypto'\n\ninterface S3Request {\n\taction: 'read' | 'upload' | 'delete'\n\tkey: string\n\texpiration: number\n\theaders: Record<string, string>\n}\n\nconst methods: Record<S3Request['action'], string> = {\n\tread: 'GET',\n\tupload: 'PUT',\n\tdelete: 'DELETE',\n}\n\nconst hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()\n\nconst hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')\n\nconst unsignableHeaders = ['authorization', 'user-agent', 'content-type', 'expect', 'x-amzn-trace-id']\n\nconst sortMap = <T extends Record<string, any>>(input: T): T => {\n\treturn Object.fromEntries(Object.entries(input).sort((a, b) => (a[0] < b[0] ? -1 : 1))) as T\n}\nexport class S3Signer {\n\tprivate region: string\n\n\tconstructor(private readonly config: S3Config, private readonly providers: Pick<Providers, 'now'>) {\n\t\tthis.region = config.region || 'eu-west-1'\n\t}\n\n\tpublic sign(request: S3Request) {\n\t\tconst uris = resolveS3Endpoint(this.config)\n\t\trequest.headers.host = uris.endpoint.substring(uris.endpoint.indexOf('://') + 3)\n\t\tconst nowFormatted = this.providers\n\t\t\t.now()\n\t\t\t.toISOString()\n\t\t\t.replace(/[:-]|\\.\\d{3}/g, '')\n\t\tconst queryString = this.getQueryParams(request, nowFormatted)\n\t\tconst path = uris.basePath + '/' + request.key\n\t\tconst lines = [\n\t\t\tmethods[request.action],\n\t\t\tpath,\n\t\t\tqueryString,\n\t\t\tthis.getSignedHeaders(request),\n\t\t\tthis.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t\t'UNSIGNED-PAYLOAD',\n\t\t]\n\t\tconst canonicalRequest = lines.join('\\n')\n\n\t\tconst parts = ['AWS4-HMAC-SHA256', nowFormatted, this.getScope(nowFormatted), hash(canonicalRequest)]\n\n\t\tconst signature = [nowFormatted.substring(0, 8), this.region, 's3', 'aws4_request', parts.join('\\n')]\n\t\t\t.reduce<Buffer>((acc, x) => hmac(acc, x), Buffer.from('AWS4' + this.config.credentials.secret))\n\t\t\t.toString('hex')\n\t\treturn uris.endpoint + path + '?' + (queryString + '&X-Amz-Signature=' + signature).split('&').sort().join('&')\n\t}\n\n\tprivate getQueryParams(request: S3Request, dateFormatted: string) {\n\t\tconst scope = this.getScope(dateFormatted)\n\t\tconst queryString: Record<string, string> = {\n\t\t\t'X-Amz-Date': dateFormatted,\n\t\t\t'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',\n\t\t\t'X-Amz-Credential': this.config.credentials.key + '/' + scope,\n\t\t\t'X-Amz-Expires': String(request.expiration),\n\t\t\t'X-Amz-SignedHeaders': this.getSignedHeaderNames(Object.keys(request.headers)),\n\t\t}\n\n\t\tconst headersToQs = ['content-type', 'content-md5', 'cache-control']\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerLc = header.toLowerCase()\n\t\t\tif (headersToQs.includes(headerLc) || headerLc.startsWith('x-amz-')) {\n\t\t\t\tqueryString[headerLc.startsWith('x-amz-meta-') ? headerLc : header] = request.headers[header]\n\t\t\t}\n\t\t}\n\t\tconst qsSorted = sortMap(queryString)\n\t\treturn qs.stringify(qsSorted)\n\t}\n\n\tprivate getScope(dateFormatted: string) {\n\t\treturn dateFormatted.substring(0, 8) + '/' + this.region + '/s3/aws4_request'\n\t}\n\n\tprivate getSignedHeaders(request: S3Request): string {\n\t\tconst lines = []\n\t\tfor (const header in request.headers) {\n\t\t\tconst headerNameLc = header.toLowerCase()\n\t\t\tif (!this.isHeaderSignable(headerNameLc)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst value = request.headers[header].replace(/\\s+/g, ' ').replace(/^\\s+|\\s+$/g, '')\n\t\t\tlines.push(`${headerNameLc}:${value}\\n`)\n\t\t}\n\t\treturn lines.sort().join('')\n\t}\n\n\tprivate isHeaderSignable(headerName: string) {\n\t\treturn headerName.toLowerCase().startsWith('x-amz') || !unsignableHeaders.includes(headerName.toLowerCase())\n\t}\n\n\tprivate getSignedHeaderNames(headers: string[]) {\n\t\treturn headers\n\t\t\t.map(it => it.toLowerCase())\n\t\t\t.filter(this.isHeaderSignable)\n\t\t\t.sort()\n\t\t\t.join(';')\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAYA,MAAM,UAA+C;AAAA,EACpD,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACT;AAEA,MAAM,OAAO,CAAC,QAAoB,SAAqB,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAA;AAEjG,MAAM,OAAO,CAAC,SAAqB,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAEjF,MAAM,oBAAoB,CAAC,iBAAiB,cAAc,gBAAgB,UAAU,iBAAiB;AAErG,MAAM,UAAU,CAAgC,UAAgB;AAC/D,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAE,CAAC;AACvF;AACO,MAAM,SAAS;AAAA,EAGrB,YAA6B,QAAmC,WAAmC;AAAtE,SAAA,SAAA;AAAmC,SAAA,YAAA;AAFhE,kBAAA,MAAQ,QAAA;AAGP,SAAK,SAAS,OAAO,UAAU;AAAA,EAChC;AAAA,EAEO,KAAK,SAAoB;AAC/B,UAAM,OAAO,kBAAkB,KAAK,MAAM;AAC1C,YAAQ,QAAQ,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ,KAAK,IAAI,CAAC;AAC/E,UAAM,eAAe,KAAK,UACxB,IAAA,EACA,cACA,QAAQ,iBAAiB,EAAE;AAC7B,UAAM,cAAc,KAAK,eAAe,SAAS,YAAY;AAC7D,UAAM,OAAO,KAAK,WAAW,MAAM,QAAQ;AAC3C,UAAM,QAAQ;AAAA,MACb,QAAQ,QAAQ,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,KAAK,iBAAiB,OAAO;AAAA,MAC7B,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,MACtD;AAAA,IAAA;AAED,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAExC,UAAM,QAAQ,CAAC,oBAAoB,cAAc,KAAK,SAAS,YAAY,GAAG,KAAK,gBAAgB,CAAC;AAEpG,UAAM,YAAY,CAAC,aAAa,UAAU,GAAG,CAAC,GAAG,KAAK,QAAQ,MAAM,gBAAgB,MAAM,KAAK,IAAI,CAAC,EAClG,OAAe,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,SAAS,KAAK,OAAO,YAAY,MAAM,CAAC,EAC7F,SAAS,KAAK;AAChB,WAAO,KAAK,WAAW,OAAO,OAAO,cAAc,sBAAsB,WAAW,MAAM,GAAG,EAAE,KAAA,EAAO,KAAK,GAAG;AAAA,EAC/G;AAAA,EAEQ,eAAe,SAAoB,eAAuB;AACjE,UAAM,QAAQ,KAAK,SAAS,aAAa;AACzC,UAAM,cAAsC;AAAA,MAC3C,cAAc;AAAA,MACd,mBAAmB;AAAA,MACnB,oBAAoB,KAAK,OAAO,YAAY,MAAM,MAAM;AAAA,MACxD,iBAAiB,OAAO,QAAQ,UAAU;AAAA,MAC1C,uBAAuB,KAAK,qBAAqB,OAAO,KAAK,QAAQ,OAAO,CAAC;AAAA,IAAA;AAG9E,UAAM,cAAc,CAAC,gBAAgB,eAAe,eAAe;AACnE,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,WAAW,OAAO,YAAA;AACxB,UAAI,YAAY,SAAS,QAAQ,KAAK,SAAS,WAAW,QAAQ,GAAG;AACpE,oBAAY,SAAS,WAAW,aAAa,IAAI,WAAW,MAAM,IAAI,QAAQ,QAAQ,MAAM;AAAA,MAC7F;AAAA,IACD;AACA,UAAM,WAAW,QAAQ,WAAW;AACpC,WAAO,GAAG,UAAU,QAAQ;AAAA,EAC7B;AAAA,EAEQ,SAAS,eAAuB;AACvC,WAAO,cAAc,UAAU,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS;AAAA,EAC5D;AAAA,EAEQ,iBAAiB,SAA4B;AACpD,UAAM,QAAQ,CAAA;AACd,eAAW,UAAU,QAAQ,SAAS;AACrC,YAAM,eAAe,OAAO,YAAA;AAC5B,UAAI,CAAC,KAAK,iBAAiB,YAAY,GAAG;AACzC;AAAA,MACD;AACA,YAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE;AACnF,YAAM,KAAK,GAAG,YAAY,IAAI,KAAK;AAAA,CAAI;AAAA,IACxC;AACA,WAAO,MAAM,OAAO,KAAK,EAAE;AAAA,EAC5B;AAAA,EAEQ,iBAAiB,YAAoB;AAC5C,WAAO,WAAW,cAAc,WAAW,OAAO,KAAK,CAAC,kBAAkB,SAAS,WAAW,aAAa;AAAA,EAC5G;AAAA,EAEQ,qBAAqB,SAAmB;AAC/C,WAAO,QACL,IAAI,CAAA,OAAM,GAAG,aAAa,EAC1B,OAAO,KAAK,gBAAgB,EAC5B,KAAA,EACA,KAAK,GAAG;AAAA,EACX;AACD;"}

package/dist/production/src/Config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"Config.cjs","sources":["../../../../packages/engine-s3-plugin/src/Config.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\nexport enum S3Providers {\n\taws = 'aws',\n\tminio = 'minio',\n\tceph = 'ceph',\n\tlocalstack = 'localstack',\n\tcloudserver = 'cloudserver',\n}\n\nexport const s3ConfigSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tbucket: Typesafe.string,\n\t\tregion: Typesafe.string,\n\t\tprefix: Typesafe.string,\n\t\tcredentials: Typesafe.object({\n\t\t\tkey: Typesafe.string,\n\t\t\tsecret: Typesafe.string,\n\t\t}),\n\t}),\n\tTypesafe.partial({\n\t\tendpoint: Typesafe.string,\n\t\tcdnEndpoint: Typesafe.string,\n\t\tprovider: Typesafe.enumeration(S3Providers.aws, S3Providers.minio, S3Providers.ceph, S3Providers.localstack, S3Providers.cloudserver),\n\t\tnoAcl: Typesafe.boolean,\n\t}),\n)\n\nexport type S3Config = ReturnType<typeof s3ConfigSchema>\n\nexport type Project3Config = { s3?: S3Config }\n\n// todo\nconst serversWithoutAclSupport = [S3Providers.minio]\n\nexport const resolveS3Config = (config: S3Config): S3Config => {\n\treturn {\n\t\tnoAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),\n\t\t...config,\n\t}\n}\n\nconst defaultRegion = 'eu-west-1'\n\nexport const resolveS3Endpoint = (\n\tconfig: S3Config,\n): {\n\tendpoint: string\n\tbasePath: string\n} => {\n\tconst hasLegacyPath = !!config.endpoint || config.bucket.includes('.')\n\tconst endpoint = config.endpoint || `https://${hasLegacyPath ? '' : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`\n\tconst basePath = hasLegacyPath ? `/${config.bucket}` : ''\n\n\treturn { endpoint, basePath }\n}\n\nexport const resolveS3PublicBaseUrl = (config: S3Config): string => {\n\tif (config.cdnEndpoint) {\n\t\treturn config.cdnEndpoint\n\t}\n\tconst { endpoint, basePath } = resolveS3Endpoint(config)\n\treturn endpoint + basePath\n}\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAUO,MAAM,iBAAiBA,oBAAS;AAAA,EACtCA,oBAAS,OAAO;AAAA,IACf,QAAQA,oBAAS;AAAA,IACjB,QAAQA,oBAAS;AAAA,IACjB,QAAQA,oBAAS;AAAA,IACjB,aAAaA,oBAAS,OAAO;AAAA,MAC5B,KAAKA,oBAAS;AAAA,MACd,QAAQA,oBAAS;AAAA,IAAA,CACjB;AAAA,EAAA,CACD;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUA,oBAAS;AAAA,IACnB,aAAaA,oBAAS;AAAA,IACtB,UAAUA,oBAAS;AAAA,MAAY;AAAA,MAAiB;AAAA,MAAmB;AAAA,MAAkB;AAAA,MAAwB;AAAA;AAAA,IAAA;AAAA,IAC7G,OAAOA,oBAAS;AAAA,EAAA,CAChB;AACF;AAOA,MAAM,2BAA2B;AAAA,EAAC;AAAA;AAAA;AAE3B,MAAM,kBAAkB,CAAC,WAA+B;AAC9D,SAAO;AAAA,IACN,OAAO,CAAC,CAAC,OAAO,YAAY,yBAAyB,SAAS,OAAO,QAAQ;AAAA,IAC7E,GAAG;AAAA,EAAA;AAEL;AAEA,MAAM,gBAAgB;AAEf,MAAM,oBAAoB,CAChC,WAII;AACJ,QAAM,gBAAgB,CAAC,CAAC,OAAO,YAAY,OAAO,OAAO,SAAS,GAAG;AACrE,QAAM,WAAW,OAAO,YAAY,WAAW,gBAAgB,KAAK,GAAG,OAAO,MAAM,GAAG,MAAM,OAAO,UAAU,aAAa;AAC3H,QAAM,WAAW,gBAAgB,IAAI,OAAO,MAAM,KAAK;AAEvD,SAAO,EAAE,UAAU,SAAA;AACpB;AAEO,MAAM,yBAAyB,CAAC,WAA6B;AACnE,MAAI,OAAO,aAAa;AACvB,WAAO,OAAO;AAAA,EACf;AACA,QAAM,EAAE,UAAU,aAAa,kBAAkB,MAAM;AACvD,SAAO,WAAW;AACnB;;;;;"}
+{"version":3,"file":"Config.cjs","sources":["../../../../packages/engine-s3-plugin/src/Config.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\nexport enum S3Providers {\n\taws = 'aws',\n\t// Path-style addressing with no object ACL — the right value for any MinIO-compatible server, SeaweedFS included.\n\tminio = 'minio',\n\tceph = 'ceph',\n\tlocalstack = 'localstack',\n\tcloudserver = 'cloudserver',\n}\n\nexport const s3ConfigSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tbucket: Typesafe.string,\n\t\tregion: Typesafe.string,\n\t\tprefix: Typesafe.string,\n\t\tcredentials: Typesafe.object({\n\t\t\tkey: Typesafe.string,\n\t\t\tsecret: Typesafe.string,\n\t\t}),\n\t}),\n\tTypesafe.partial({\n\t\tendpoint: Typesafe.string,\n\t\tcdnEndpoint: Typesafe.string,\n\t\tprovider: Typesafe.enumeration(S3Providers.aws, S3Providers.minio, S3Providers.ceph, S3Providers.localstack, S3Providers.cloudserver),\n\t\tnoAcl: Typesafe.boolean,\n\t}),\n)\n\nexport type S3Config = ReturnType<typeof s3ConfigSchema>\n\nexport type Project3Config = { s3?: S3Config }\n\n// todo\nconst serversWithoutAclSupport = [S3Providers.minio]\n\nexport const resolveS3Config = (config: S3Config): S3Config => {\n\treturn {\n\t\tnoAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),\n\t\t...config,\n\t}\n}\n\nconst defaultRegion = 'eu-west-1'\n\nexport const resolveS3Endpoint = (\n\tconfig: S3Config,\n): {\n\tendpoint: string\n\tbasePath: string\n} => {\n\tconst hasLegacyPath = !!config.endpoint || config.bucket.includes('.')\n\tconst endpoint = config.endpoint || `https://${hasLegacyPath ? '' : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`\n\tconst basePath = hasLegacyPath ? `/${config.bucket}` : ''\n\n\treturn { endpoint, basePath }\n}\n\nexport const resolveS3PublicBaseUrl = (config: S3Config): string => {\n\tif (config.cdnEndpoint) {\n\t\treturn config.cdnEndpoint\n\t}\n\tconst { endpoint, basePath } = resolveS3Endpoint(config)\n\treturn endpoint + basePath\n}\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAWO,MAAM,iBAAiBA,oBAAS;AAAA,EACtCA,oBAAS,OAAO;AAAA,IACf,QAAQA,oBAAS;AAAA,IACjB,QAAQA,oBAAS;AAAA,IACjB,QAAQA,oBAAS;AAAA,IACjB,aAAaA,oBAAS,OAAO;AAAA,MAC5B,KAAKA,oBAAS;AAAA,MACd,QAAQA,oBAAS;AAAA,IAAA,CACjB;AAAA,EAAA,CACD;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUA,oBAAS;AAAA,IACnB,aAAaA,oBAAS;AAAA,IACtB,UAAUA,oBAAS;AAAA,MAAY;AAAA,MAAiB;AAAA,MAAmB;AAAA,MAAkB;AAAA,MAAwB;AAAA;AAAA,IAAA;AAAA,IAC7G,OAAOA,oBAAS;AAAA,EAAA,CAChB;AACF;AAOA,MAAM,2BAA2B;AAAA,EAAC;AAAA;AAAA;AAE3B,MAAM,kBAAkB,CAAC,WAA+B;AAC9D,SAAO;AAAA,IACN,OAAO,CAAC,CAAC,OAAO,YAAY,yBAAyB,SAAS,OAAO,QAAQ;AAAA,IAC7E,GAAG;AAAA,EAAA;AAEL;AAEA,MAAM,gBAAgB;AAEf,MAAM,oBAAoB,CAChC,WAII;AACJ,QAAM,gBAAgB,CAAC,CAAC,OAAO,YAAY,OAAO,OAAO,SAAS,GAAG;AACrE,QAAM,WAAW,OAAO,YAAY,WAAW,gBAAgB,KAAK,GAAG,OAAO,MAAM,GAAG,MAAM,OAAO,UAAU,aAAa;AAC3H,QAAM,WAAW,gBAAgB,IAAI,OAAO,MAAM,KAAK;AAEvD,SAAO,EAAE,UAAU,SAAA;AACpB;AAEO,MAAM,yBAAyB,CAAC,WAA6B;AACnE,MAAI,OAAO,aAAa;AACvB,WAAO,OAAO;AAAA,EACf;AACA,QAAM,EAAE,UAAU,aAAa,kBAAkB,MAAM;AACvD,SAAO,WAAW;AACnB;;;;;"}

package/dist/production/src/Config.js.map

@@ -1 +1 @@
-{"version":3,"file":"Config.js","sources":["../../../../packages/engine-s3-plugin/src/Config.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\nexport enum S3Providers {\n\taws = 'aws',\n\tminio = 'minio',\n\tceph = 'ceph',\n\tlocalstack = 'localstack',\n\tcloudserver = 'cloudserver',\n}\n\nexport const s3ConfigSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tbucket: Typesafe.string,\n\t\tregion: Typesafe.string,\n\t\tprefix: Typesafe.string,\n\t\tcredentials: Typesafe.object({\n\t\t\tkey: Typesafe.string,\n\t\t\tsecret: Typesafe.string,\n\t\t}),\n\t}),\n\tTypesafe.partial({\n\t\tendpoint: Typesafe.string,\n\t\tcdnEndpoint: Typesafe.string,\n\t\tprovider: Typesafe.enumeration(S3Providers.aws, S3Providers.minio, S3Providers.ceph, S3Providers.localstack, S3Providers.cloudserver),\n\t\tnoAcl: Typesafe.boolean,\n\t}),\n)\n\nexport type S3Config = ReturnType<typeof s3ConfigSchema>\n\nexport type Project3Config = { s3?: S3Config }\n\n// todo\nconst serversWithoutAclSupport = [S3Providers.minio]\n\nexport const resolveS3Config = (config: S3Config): S3Config => {\n\treturn {\n\t\tnoAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),\n\t\t...config,\n\t}\n}\n\nconst defaultRegion = 'eu-west-1'\n\nexport const resolveS3Endpoint = (\n\tconfig: S3Config,\n): {\n\tendpoint: string\n\tbasePath: string\n} => {\n\tconst hasLegacyPath = !!config.endpoint || config.bucket.includes('.')\n\tconst endpoint = config.endpoint || `https://${hasLegacyPath ? '' : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`\n\tconst basePath = hasLegacyPath ? `/${config.bucket}` : ''\n\n\treturn { endpoint, basePath }\n}\n\nexport const resolveS3PublicBaseUrl = (config: S3Config): string => {\n\tif (config.cdnEndpoint) {\n\t\treturn config.cdnEndpoint\n\t}\n\tconst { endpoint, basePath } = resolveS3Endpoint(config)\n\treturn endpoint + basePath\n}\n"],"names":[],"mappings":";AAUO,MAAM,iBAAiB,SAAS;AAAA,EACtC,SAAS,OAAO;AAAA,IACf,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,IACjB,aAAa,SAAS,OAAO;AAAA,MAC5B,KAAK,SAAS;AAAA,MACd,QAAQ,SAAS;AAAA,IAAA,CACjB;AAAA,EAAA,CACD;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,SAAS;AAAA,IACnB,aAAa,SAAS;AAAA,IACtB,UAAU,SAAS;AAAA,MAAY;AAAA,MAAiB;AAAA,MAAmB;AAAA,MAAkB;AAAA,MAAwB;AAAA;AAAA,IAAA;AAAA,IAC7G,OAAO,SAAS;AAAA,EAAA,CAChB;AACF;AAOA,MAAM,2BAA2B;AAAA,EAAC;AAAA;AAAA;AAE3B,MAAM,kBAAkB,CAAC,WAA+B;AAC9D,SAAO;AAAA,IACN,OAAO,CAAC,CAAC,OAAO,YAAY,yBAAyB,SAAS,OAAO,QAAQ;AAAA,IAC7E,GAAG;AAAA,EAAA;AAEL;AAEA,MAAM,gBAAgB;AAEf,MAAM,oBAAoB,CAChC,WAII;AACJ,QAAM,gBAAgB,CAAC,CAAC,OAAO,YAAY,OAAO,OAAO,SAAS,GAAG;AACrE,QAAM,WAAW,OAAO,YAAY,WAAW,gBAAgB,KAAK,GAAG,OAAO,MAAM,GAAG,MAAM,OAAO,UAAU,aAAa;AAC3H,QAAM,WAAW,gBAAgB,IAAI,OAAO,MAAM,KAAK;AAEvD,SAAO,EAAE,UAAU,SAAA;AACpB;AAEO,MAAM,yBAAyB,CAAC,WAA6B;AACnE,MAAI,OAAO,aAAa;AACvB,WAAO,OAAO;AAAA,EACf;AACA,QAAM,EAAE,UAAU,aAAa,kBAAkB,MAAM;AACvD,SAAO,WAAW;AACnB;"}
+{"version":3,"file":"Config.js","sources":["../../../../packages/engine-s3-plugin/src/Config.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\nexport enum S3Providers {\n\taws = 'aws',\n\t// Path-style addressing with no object ACL — the right value for any MinIO-compatible server, SeaweedFS included.\n\tminio = 'minio',\n\tceph = 'ceph',\n\tlocalstack = 'localstack',\n\tcloudserver = 'cloudserver',\n}\n\nexport const s3ConfigSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tbucket: Typesafe.string,\n\t\tregion: Typesafe.string,\n\t\tprefix: Typesafe.string,\n\t\tcredentials: Typesafe.object({\n\t\t\tkey: Typesafe.string,\n\t\t\tsecret: Typesafe.string,\n\t\t}),\n\t}),\n\tTypesafe.partial({\n\t\tendpoint: Typesafe.string,\n\t\tcdnEndpoint: Typesafe.string,\n\t\tprovider: Typesafe.enumeration(S3Providers.aws, S3Providers.minio, S3Providers.ceph, S3Providers.localstack, S3Providers.cloudserver),\n\t\tnoAcl: Typesafe.boolean,\n\t}),\n)\n\nexport type S3Config = ReturnType<typeof s3ConfigSchema>\n\nexport type Project3Config = { s3?: S3Config }\n\n// todo\nconst serversWithoutAclSupport = [S3Providers.minio]\n\nexport const resolveS3Config = (config: S3Config): S3Config => {\n\treturn {\n\t\tnoAcl: !!config.provider && serversWithoutAclSupport.includes(config.provider),\n\t\t...config,\n\t}\n}\n\nconst defaultRegion = 'eu-west-1'\n\nexport const resolveS3Endpoint = (\n\tconfig: S3Config,\n): {\n\tendpoint: string\n\tbasePath: string\n} => {\n\tconst hasLegacyPath = !!config.endpoint || config.bucket.includes('.')\n\tconst endpoint = config.endpoint || `https://${hasLegacyPath ? '' : `${config.bucket}.`}s3.${config.region || defaultRegion}.amazonaws.com`\n\tconst basePath = hasLegacyPath ? `/${config.bucket}` : ''\n\n\treturn { endpoint, basePath }\n}\n\nexport const resolveS3PublicBaseUrl = (config: S3Config): string => {\n\tif (config.cdnEndpoint) {\n\t\treturn config.cdnEndpoint\n\t}\n\tconst { endpoint, basePath } = resolveS3Endpoint(config)\n\treturn endpoint + basePath\n}\n"],"names":[],"mappings":";AAWO,MAAM,iBAAiB,SAAS;AAAA,EACtC,SAAS,OAAO;AAAA,IACf,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,IACjB,aAAa,SAAS,OAAO;AAAA,MAC5B,KAAK,SAAS;AAAA,MACd,QAAQ,SAAS;AAAA,IAAA,CACjB;AAAA,EAAA,CACD;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,SAAS;AAAA,IACnB,aAAa,SAAS;AAAA,IACtB,UAAU,SAAS;AAAA,MAAY;AAAA,MAAiB;AAAA,MAAmB;AAAA,MAAkB;AAAA,MAAwB;AAAA;AAAA,IAAA;AAAA,IAC7G,OAAO,SAAS;AAAA,EAAA,CAChB;AACF;AAOA,MAAM,2BAA2B;AAAA,EAAC;AAAA;AAAA;AAE3B,MAAM,kBAAkB,CAAC,WAA+B;AAC9D,SAAO;AAAA,IACN,OAAO,CAAC,CAAC,OAAO,YAAY,yBAAyB,SAAS,OAAO,QAAQ;AAAA,IAC7E,GAAG;AAAA,EAAA;AAEL;AAEA,MAAM,gBAAgB;AAEf,MAAM,oBAAoB,CAChC,WAII;AACJ,QAAM,gBAAgB,CAAC,CAAC,OAAO,YAAY,OAAO,OAAO,SAAS,GAAG;AACrE,QAAM,WAAW,OAAO,YAAY,WAAW,gBAAgB,KAAK,GAAG,OAAO,MAAM,GAAG,MAAM,OAAO,UAAU,aAAa;AAC3H,QAAM,WAAW,gBAAgB,IAAI,OAAO,MAAM,KAAK;AAEvD,SAAO,EAAE,UAAU,SAAA;AACpB;AAEO,MAAM,yBAAyB,CAAC,WAA6B;AACnE,MAAI,OAAO,aAAa;AACvB,WAAO,OAAO;AAAA,EACf;AACA,QAAM,EAAE,UAAU,aAAa,kBAAkB,MAAM;AACvD,SAAO,WAAW;AACnB;"}

package/dist/production/src/S3ObjectAuthorizator.cjs

@@ -6,11 +6,13 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 class S3ObjectAuthorizator {
-  constructor(uploadRules, readRules) {
+  constructor(uploadRules, readRules, deleteRules = []) {
     __publicField(this, "uploadRules");
     __publicField(this, "readRules");
+    __publicField(this, "deleteRules");
     this.uploadRules = uploadRules;
     this.readRules = readRules;
+    this.deleteRules = deleteRules;
   }
   verifyReadAccess({ key }) {
     for (const rule of this.readRules) {
@@ -21,6 +23,15 @@ class S3ObjectAuthorizator {
     }
     throw new graphqlUtils.ForbiddenError(`Read access forbidden for object key ${key}`);
   }
+  verifyDeleteAccess({ key }) {
+    for (const rule of this.deleteRules) {
+      rule.matcher ?? (rule.matcher = pm(rule.pattern));
+      if (rule.matcher(key)) {
+        return;
+      }
+    }
+    throw new graphqlUtils.ForbiddenError(`Delete access forbidden for object key ${key}`);
+  }
   verifyUploadAccess({ key, size }) {
     const matchedPatterns = [];
     for (const rule of this.uploadRules) {

package/dist/production/src/S3ObjectAuthorizator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"S3ObjectAuthorizator.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3ObjectAuthorizator.ts"],"sourcesContent":["/// <reference path=\"../types/picomatch/index.d.ts\" />\nimport pm from 'picomatch'\nimport { ForbiddenError } from '@contember/graphql-utils'\n\nexport type S3ObjectUploadRule = {\n\tpattern: string\n\tmaxSize?: number\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectReadRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport class S3ObjectAuthorizator {\n\tprivate readonly uploadRules: S3ObjectUploadRule[]\n\tprivate readonly readRules: S3ObjectReadRule[]\n\n\tconstructor(\n\t\tuploadRules: Omit<S3ObjectUploadRule, 'matcher'>[],\n\t\treadRules: Omit<S3ObjectReadRule, 'matcher'>[],\n\t) {\n\t\tthis.uploadRules = uploadRules\n\t\tthis.readRules = readRules\n\t}\n\n\tpublic verifyReadAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.readRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Read access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyUploadAccess({ key, size }: { key: string; size: number | null }): void {\n\t\tconst matchedPatterns: S3ObjectUploadRule[] = []\n\n\t\tfor (const rule of this.uploadRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\tif (!rule.maxSize || (size !== null && size <= rule.maxSize)) {\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t\tmatchedPatterns.push(rule)\n\t\t\t}\n\t\t}\n\n\t\tif (matchedPatterns.length > 0) {\n\t\t\tif (size === null) {\n\t\t\t\tthrow new ForbiddenError('File size must be provided')\n\t\t\t} else {\n\t\t\t\tthrow new ForbiddenError('Uploaded file is too large')\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Upload access forbidden for object key ${key}`)\n\t}\n}\n"],"names":["ForbiddenError"],"mappings":";;;;;;;AAeO,MAAM,qBAAqB;AAAA,EAIjC,YACC,aACA,WACC;AANF,kBAAA,MAAiB,aAAA;AACjB,kBAAA,MAAiB,WAAA;AAMhB,SAAK,cAAc;AACnB,SAAK,YAAY;AAAA,EAClB;AAAA,EAEO,iBAAiB,EAAE,OAA8B;AACvD,eAAW,QAAQ,KAAK,WAAW;AAClC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAIA,aAAAA,eAAe,wCAAwC,GAAG,EAAE;AAAA,EACvE;AAAA,EAEO,mBAAmB,EAAE,KAAK,QAAoD;AACpF,UAAM,kBAAwC,CAAA;AAE9C,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB,YAAI,CAAC,KAAK,WAAY,SAAS,QAAQ,QAAQ,KAAK,SAAU;AAC7D;AAAA,QACD;AACA,wBAAgB,KAAK,IAAI;AAAA,MAC1B;AAAA,IACD;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC/B,UAAI,SAAS,MAAM;AAClB,cAAM,IAAIA,aAAAA,eAAe,4BAA4B;AAAA,MACtD,OAAO;AACN,cAAM,IAAIA,aAAAA,eAAe,4BAA4B;AAAA,MACtD;AAAA,IACD;AAEA,UAAM,IAAIA,aAAAA,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AACD;;"}
+{"version":3,"file":"S3ObjectAuthorizator.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3ObjectAuthorizator.ts"],"sourcesContent":["/// <reference path=\"../types/picomatch/index.d.ts\" />\nimport pm from 'picomatch'\nimport { ForbiddenError } from '@contember/graphql-utils'\n\nexport type S3ObjectUploadRule = {\n\tpattern: string\n\tmaxSize?: number\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectReadRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectDeleteRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport class S3ObjectAuthorizator {\n\tprivate readonly uploadRules: S3ObjectUploadRule[]\n\tprivate readonly readRules: S3ObjectReadRule[]\n\tprivate readonly deleteRules: S3ObjectDeleteRule[]\n\n\tconstructor(\n\t\tuploadRules: Omit<S3ObjectUploadRule, 'matcher'>[],\n\t\treadRules: Omit<S3ObjectReadRule, 'matcher'>[],\n\t\tdeleteRules: Omit<S3ObjectDeleteRule, 'matcher'>[] = [],\n\t) {\n\t\tthis.uploadRules = uploadRules\n\t\tthis.readRules = readRules\n\t\tthis.deleteRules = deleteRules\n\t}\n\n\tpublic verifyReadAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.readRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Read access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyDeleteAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.deleteRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Delete access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyUploadAccess({ key, size }: { key: string; size: number | null }): void {\n\t\tconst matchedPatterns: S3ObjectUploadRule[] = []\n\n\t\tfor (const rule of this.uploadRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\tif (!rule.maxSize || (size !== null && size <= rule.maxSize)) {\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t\tmatchedPatterns.push(rule)\n\t\t\t}\n\t\t}\n\n\t\tif (matchedPatterns.length > 0) {\n\t\t\tif (size === null) {\n\t\t\t\tthrow new ForbiddenError('File size must be provided')\n\t\t\t} else {\n\t\t\t\tthrow new ForbiddenError('Uploaded file is too large')\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Upload access forbidden for object key ${key}`)\n\t}\n}\n"],"names":["ForbiddenError"],"mappings":";;;;;;;AAoBO,MAAM,qBAAqB;AAAA,EAKjC,YACC,aACA,WACA,cAAqD,CAAA,GACpD;AARF,kBAAA,MAAiB,aAAA;AACjB,kBAAA,MAAiB,WAAA;AACjB,kBAAA,MAAiB,aAAA;AAOhB,SAAK,cAAc;AACnB,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACpB;AAAA,EAEO,iBAAiB,EAAE,OAA8B;AACvD,eAAW,QAAQ,KAAK,WAAW;AAClC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAIA,aAAAA,eAAe,wCAAwC,GAAG,EAAE;AAAA,EACvE;AAAA,EAEO,mBAAmB,EAAE,OAA8B;AACzD,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAIA,aAAAA,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AAAA,EAEO,mBAAmB,EAAE,KAAK,QAAoD;AACpF,UAAM,kBAAwC,CAAA;AAE9C,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB,YAAI,CAAC,KAAK,WAAY,SAAS,QAAQ,QAAQ,KAAK,SAAU;AAC7D;AAAA,QACD;AACA,wBAAgB,KAAK,IAAI;AAAA,MAC1B;AAAA,IACD;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC/B,UAAI,SAAS,MAAM;AAClB,cAAM,IAAIA,aAAAA,eAAe,4BAA4B;AAAA,MACtD,OAAO;AACN,cAAM,IAAIA,aAAAA,eAAe,4BAA4B;AAAA,MACtD;AAAA,IACD;AAEA,UAAM,IAAIA,aAAAA,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AACD;;"}

package/dist/production/src/S3ObjectAuthorizator.js

@@ -4,11 +4,13 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 class S3ObjectAuthorizator {
-  constructor(uploadRules, readRules) {
+  constructor(uploadRules, readRules, deleteRules = []) {
     __publicField(this, "uploadRules");
     __publicField(this, "readRules");
+    __publicField(this, "deleteRules");
     this.uploadRules = uploadRules;
     this.readRules = readRules;
+    this.deleteRules = deleteRules;
   }
   verifyReadAccess({ key }) {
     for (const rule of this.readRules) {
@@ -19,6 +21,15 @@ class S3ObjectAuthorizator {
     }
     throw new ForbiddenError(`Read access forbidden for object key ${key}`);
   }
+  verifyDeleteAccess({ key }) {
+    for (const rule of this.deleteRules) {
+      rule.matcher ?? (rule.matcher = pm(rule.pattern));
+      if (rule.matcher(key)) {
+        return;
+      }
+    }
+    throw new ForbiddenError(`Delete access forbidden for object key ${key}`);
+  }
   verifyUploadAccess({ key, size }) {
     const matchedPatterns = [];
     for (const rule of this.uploadRules) {

package/dist/production/src/S3ObjectAuthorizator.js.map

@@ -1 +1 @@
-{"version":3,"file":"S3ObjectAuthorizator.js","sources":["../../../../packages/engine-s3-plugin/src/S3ObjectAuthorizator.ts"],"sourcesContent":["/// <reference path=\"../types/picomatch/index.d.ts\" />\nimport pm from 'picomatch'\nimport { ForbiddenError } from '@contember/graphql-utils'\n\nexport type S3ObjectUploadRule = {\n\tpattern: string\n\tmaxSize?: number\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectReadRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport class S3ObjectAuthorizator {\n\tprivate readonly uploadRules: S3ObjectUploadRule[]\n\tprivate readonly readRules: S3ObjectReadRule[]\n\n\tconstructor(\n\t\tuploadRules: Omit<S3ObjectUploadRule, 'matcher'>[],\n\t\treadRules: Omit<S3ObjectReadRule, 'matcher'>[],\n\t) {\n\t\tthis.uploadRules = uploadRules\n\t\tthis.readRules = readRules\n\t}\n\n\tpublic verifyReadAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.readRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Read access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyUploadAccess({ key, size }: { key: string; size: number | null }): void {\n\t\tconst matchedPatterns: S3ObjectUploadRule[] = []\n\n\t\tfor (const rule of this.uploadRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\tif (!rule.maxSize || (size !== null && size <= rule.maxSize)) {\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t\tmatchedPatterns.push(rule)\n\t\t\t}\n\t\t}\n\n\t\tif (matchedPatterns.length > 0) {\n\t\t\tif (size === null) {\n\t\t\t\tthrow new ForbiddenError('File size must be provided')\n\t\t\t} else {\n\t\t\t\tthrow new ForbiddenError('Uploaded file is too large')\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Upload access forbidden for object key ${key}`)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAeO,MAAM,qBAAqB;AAAA,EAIjC,YACC,aACA,WACC;AANF,kBAAA,MAAiB,aAAA;AACjB,kBAAA,MAAiB,WAAA;AAMhB,SAAK,cAAc;AACnB,SAAK,YAAY;AAAA,EAClB;AAAA,EAEO,iBAAiB,EAAE,OAA8B;AACvD,eAAW,QAAQ,KAAK,WAAW;AAClC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAI,eAAe,wCAAwC,GAAG,EAAE;AAAA,EACvE;AAAA,EAEO,mBAAmB,EAAE,KAAK,QAAoD;AACpF,UAAM,kBAAwC,CAAA;AAE9C,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB,YAAI,CAAC,KAAK,WAAY,SAAS,QAAQ,QAAQ,KAAK,SAAU;AAC7D;AAAA,QACD;AACA,wBAAgB,KAAK,IAAI;AAAA,MAC1B;AAAA,IACD;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC/B,UAAI,SAAS,MAAM;AAClB,cAAM,IAAI,eAAe,4BAA4B;AAAA,MACtD,OAAO;AACN,cAAM,IAAI,eAAe,4BAA4B;AAAA,MACtD;AAAA,IACD;AAEA,UAAM,IAAI,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AACD;"}
+{"version":3,"file":"S3ObjectAuthorizator.js","sources":["../../../../packages/engine-s3-plugin/src/S3ObjectAuthorizator.ts"],"sourcesContent":["/// <reference path=\"../types/picomatch/index.d.ts\" />\nimport pm from 'picomatch'\nimport { ForbiddenError } from '@contember/graphql-utils'\n\nexport type S3ObjectUploadRule = {\n\tpattern: string\n\tmaxSize?: number\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectReadRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport type S3ObjectDeleteRule = {\n\tpattern: string\n\tmatcher?: (key: string) => boolean\n}\n\nexport class S3ObjectAuthorizator {\n\tprivate readonly uploadRules: S3ObjectUploadRule[]\n\tprivate readonly readRules: S3ObjectReadRule[]\n\tprivate readonly deleteRules: S3ObjectDeleteRule[]\n\n\tconstructor(\n\t\tuploadRules: Omit<S3ObjectUploadRule, 'matcher'>[],\n\t\treadRules: Omit<S3ObjectReadRule, 'matcher'>[],\n\t\tdeleteRules: Omit<S3ObjectDeleteRule, 'matcher'>[] = [],\n\t) {\n\t\tthis.uploadRules = uploadRules\n\t\tthis.readRules = readRules\n\t\tthis.deleteRules = deleteRules\n\t}\n\n\tpublic verifyReadAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.readRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Read access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyDeleteAccess({ key }: { key: string }): void {\n\t\tfor (const rule of this.deleteRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Delete access forbidden for object key ${key}`)\n\t}\n\n\tpublic verifyUploadAccess({ key, size }: { key: string; size: number | null }): void {\n\t\tconst matchedPatterns: S3ObjectUploadRule[] = []\n\n\t\tfor (const rule of this.uploadRules) {\n\t\t\trule.matcher ??= pm(rule.pattern)\n\n\t\t\tif (rule.matcher(key)) {\n\t\t\t\tif (!rule.maxSize || (size !== null && size <= rule.maxSize)) {\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t\tmatchedPatterns.push(rule)\n\t\t\t}\n\t\t}\n\n\t\tif (matchedPatterns.length > 0) {\n\t\t\tif (size === null) {\n\t\t\t\tthrow new ForbiddenError('File size must be provided')\n\t\t\t} else {\n\t\t\t\tthrow new ForbiddenError('Uploaded file is too large')\n\t\t\t}\n\t\t}\n\n\t\tthrow new ForbiddenError(`Upload access forbidden for object key ${key}`)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAoBO,MAAM,qBAAqB;AAAA,EAKjC,YACC,aACA,WACA,cAAqD,CAAA,GACpD;AARF,kBAAA,MAAiB,aAAA;AACjB,kBAAA,MAAiB,WAAA;AACjB,kBAAA,MAAiB,aAAA;AAOhB,SAAK,cAAc;AACnB,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACpB;AAAA,EAEO,iBAAiB,EAAE,OAA8B;AACvD,eAAW,QAAQ,KAAK,WAAW;AAClC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAI,eAAe,wCAAwC,GAAG,EAAE;AAAA,EACvE;AAAA,EAEO,mBAAmB,EAAE,OAA8B;AACzD,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,IAAI,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AAAA,EAEO,mBAAmB,EAAE,KAAK,QAAoD;AACpF,UAAM,kBAAwC,CAAA;AAE9C,eAAW,QAAQ,KAAK,aAAa;AACpC,WAAK,YAAL,KAAK,UAAY,GAAG,KAAK,OAAO;AAEhC,UAAI,KAAK,QAAQ,GAAG,GAAG;AACtB,YAAI,CAAC,KAAK,WAAY,SAAS,QAAQ,QAAQ,KAAK,SAAU;AAC7D;AAAA,QACD;AACA,wBAAgB,KAAK,IAAI;AAAA,MAC1B;AAAA,IACD;AAEA,QAAI,gBAAgB,SAAS,GAAG;AAC/B,UAAI,SAAS,MAAM;AAClB,cAAM,IAAI,eAAe,4BAA4B;AAAA,MACtD,OAAO;AACN,cAAM,IAAI,eAAe,4BAA4B;AAAA,MACtD;AAAA,IACD;AAEA,UAAM,IAAI,eAAe,0CAA0C,GAAG,EAAE;AAAA,EACzE;AACD;"}

package/dist/production/src/S3SchemaContributor.cjs

@@ -24,15 +24,21 @@ class S3SchemaContributor {
     const readRules = rules.filter(([, it]) => it.read).map(([it]) => ({
       pattern: it
     }));
-    if (uploadRules.length === 0 && readRules.length === 0) {
+    const deleteRules = rules.filter(([, it]) => it.delete).map(([it]) => ({
+      pattern: it
+    }));
+    if (uploadRules.length === 0 && readRules.length === 0 && deleteRules.length === 0) {
       return void 0;
     }
-    const authorizator = new S3ObjectAuthorizator.S3ObjectAuthorizator(uploadRules, readRules);
+    const authorizator = new S3ObjectAuthorizator.S3ObjectAuthorizator(uploadRules, readRules, deleteRules);
     const uploadMutation = this.createUploadMutation(authorizator);
     const readMutation = this.createReadMutation(authorizator);
+    const deleteMutation = this.createDeleteMutation(authorizator);
     const mutation = {
       generateUploadUrl: uploadMutation,
-      generateReadUrl: readMutation
+      generateReadUrl: readMutation,
+      // not "deleteObject" — a content mutation for an entity named "Object" would shadow it
+      deleteS3Object: deleteMutation
     };
     return {
       mutation: new graphql.GraphQLObjectType({
@@ -70,6 +76,24 @@ class S3SchemaContributor {
       }
     };
   }
+  createDeleteMutation(authorizator) {
+    return {
+      type: new graphql.GraphQLNonNull(S3SchemaTypes.S3DeletedObject),
+      args: {
+        objectKey: {
+          type: new graphql.GraphQLNonNull(graphql.GraphQLString)
+        }
+      },
+      resolve: async (parent, args, ctx) => {
+        if (!ctx.project.s3) {
+          throw new graphql.GraphQLError("S3 is not configured for this project");
+        }
+        const s3Config = Config.resolveS3Config(ctx.project.s3);
+        const s3 = this.s3Factory.create(s3Config, this.providers, authorizator);
+        return await s3.deleteObject({ objectKey: args.objectKey });
+      }
+    };
+  }
   createUploadMutation(authorizator) {
     return {
       type: new graphql.GraphQLNonNull(S3SchemaTypes.S3SignedUpload),

package/dist/production/src/S3SchemaContributor.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"S3SchemaContributor.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3SchemaContributor.ts"],"sourcesContent":["import {\n\tGraphQLError,\n\tGraphQLFieldConfig,\n\tGraphQLInt,\n\tGraphQLNonNull,\n\tGraphQLObjectType,\n\tGraphQLSchema,\n\tGraphQLSchemaConfig,\n\tGraphQLString,\n} from 'graphql'\nimport { S3Service, S3ServiceFactory } from './S3Service.js'\nimport { Project3Config, resolveS3Config, S3Config } from './Config.js'\nimport { GraphQLSchemaContributor, GraphQLSchemaContributorContext, Providers } from '@contember/engine-plugins'\nimport * as types from './S3SchemaTypes.js'\nimport { S3Acl, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes.js'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'\n\ninterface Identity {\n\tprojectRoles: string[]\n}\n\nexport type S3SchemaUploadAcl =\n\t| boolean\n\t| {\n\t\tmaxSize?: number\n\t}\n\nexport type S3SchemaAcl = Record<\n\tstring, // public/*.jpg\n\t{\n\t\tread?: boolean\n\t\tupload?: S3SchemaUploadAcl\n\t}\n>\n\nexport class S3SchemaContributor implements GraphQLSchemaContributor {\n\tconstructor(\n\t\tprivate readonly s3Factory: S3ServiceFactory,\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tgetCacheKey?({ project }: GraphQLSchemaContributorContext): string {\n\t\treturn project.s3 ? 'yes' : 'no'\n\t}\n\n\tcreateSchema(context: GraphQLSchemaContributorContext): GraphQLSchemaConfig | undefined {\n\t\tif (!context.project.s3) {\n\t\t\treturn undefined\n\t\t}\n\t\tconst rules = context.identity.projectRoles.flatMap(it => Object.entries((context.schema.acl.roles[it]?.s3 as S3SchemaAcl) || {}))\n\n\t\tconst uploadRules = rules.filter(([, it]) => it.upload).map(([it, val]) => ({\n\t\t\tpattern: it,\n\t\t\t...(typeof val.upload !== 'boolean' ? val.upload : {}),\n\t\t}))\n\t\tconst readRules = rules.filter(([, it]) => it.read).map(([it]) => ({\n\t\t\tpattern: it,\n\t\t}))\n\n\t\tif (uploadRules.length === 0 && readRules.length === 0) {\n\t\t\treturn undefined\n\t\t}\n\n\t\tconst authorizator = new S3ObjectAuthorizator(uploadRules, readRules)\n\t\tconst uploadMutation = this.createUploadMutation(authorizator)\n\t\tconst readMutation = this.createReadMutation(authorizator)\n\t\tconst mutation = {\n\t\t\tgenerateUploadUrl: uploadMutation as GraphQLFieldConfig<any, any, any>,\n\t\t\tgenerateReadUrl: readMutation,\n\t\t}\n\t\treturn {\n\t\t\tmutation: new GraphQLObjectType({\n\t\t\t\tname: 'Mutation',\n\t\t\t\tfields: () => mutation,\n\t\t\t}),\n\t\t\tquery: new GraphQLObjectType({\n\t\t\t\tname: 'Query',\n\t\t\t\tfields: () => ({\n\t\t\t\t\ts3DummyQuery: {\n\t\t\t\t\t\ttype: GraphQLString,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t}),\n\t\t}\n\t}\n\n\tprivate createReadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, { project: Project3Config }, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedRead),\n\t\t\targs: {\n\t\t\t\tobjectKey: {\n\t\t\t\t\ttype: new GraphQLNonNull(GraphQLString),\n\t\t\t\t},\n\t\t\t\texpiration: {\n\t\t\t\t\ttype: GraphQLInt,\n\t\t\t\t},\n\t\t\t},\n\t\t\tresolve: async (parent: any, args: { objectKey: string; expiration?: number }, ctx: { project: Project3Config }) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null })\n\t\t\t},\n\t\t} as GraphQLFieldConfig<any, any, any>\n\t}\n\n\tprivate createUploadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedUpload),\n\t\t\targs: {\n\t\t\t\tinput: { type: types.S3GenerateSignedUploadInput },\n\t\t\t\tcontentType: { type: GraphQLString, deprecationReason: 'Use input.contentType' },\n\t\t\t\texpiration: { type: GraphQLInt, deprecationReason: 'Use input.expiration' },\n\t\t\t\tprefix: { type: GraphQLString, deprecationReason: 'Use input.prefix' },\n\t\t\t\tacl: { type: types.S3Acl, deprecationReason: 'Use input.acl' },\n\t\t\t},\n\t\t\tresolve: async (\n\t\t\t\tparent: any,\n\t\t\t\targs: { input?: Partial<S3GenerateSignedUploadInput>; contentType?: string; acl?: S3Acl; expiration?: number; prefix?: string },\n\t\t\t\tctx: { project: Project3Config },\n\t\t\t) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedUploadUrl({\n\t\t\t\t\tacl: args.input?.acl ?? args.acl ?? null,\n\t\t\t\t\tcontentDisposition: args.input?.contentDisposition ?? null,\n\t\t\t\t\tcontentType: args.input?.contentType ?? args.contentType ?? null,\n\t\t\t\t\texpiration: args.input?.expiration ?? args.expiration ?? null,\n\t\t\t\t\textension: args.input?.extension ?? null,\n\t\t\t\t\tfileName: args.input?.fileName ?? null,\n\t\t\t\t\tprefix: args.input?.prefix ?? args.prefix ?? null,\n\t\t\t\t\tsuffix: args.input?.suffix ?? null,\n\t\t\t\t\tsize: args.input?.size ?? null,\n\t\t\t\t})\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["S3ObjectAuthorizator","GraphQLObjectType","GraphQLString","GraphQLNonNull","S3SignedRead","GraphQLInt","GraphQLError","resolveS3Config","S3SignedUpload","types.S3GenerateSignedUploadInput","types.S3Acl"],"mappings":";;;;;;AAmCO,MAAM,oBAAwD;AAAA,EACpE,YACkB,WACA,WAChB;AAFgB,SAAA,YAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,YAAa,EAAE,WAAoD;AAClE,WAAO,QAAQ,KAAK,QAAQ;AAAA,EAC7B;AAAA,EAEA,aAAa,SAA2E;AACvF,QAAI,CAAC,QAAQ,QAAQ,IAAI;AACxB,aAAO;AAAA,IACR;AACA,UAAM,QAAQ,QAAQ,SAAS,aAAa,QAAQ,QAAM,OAAO,QAAS,QAAQ,OAAO,IAAI,MAAM,EAAE,GAAG,MAAsB,CAAA,CAAE,CAAC;AAEjI,UAAM,cAAc,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;AAAA,MAC3E,SAAS;AAAA,MACT,GAAI,OAAO,IAAI,WAAW,YAAY,IAAI,SAAS,CAAA;AAAA,IAAC,EACnD;AACF,UAAM,YAAY,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;AAAA,MAClE,SAAS;AAAA,IAAA,EACR;AAEF,QAAI,YAAY,WAAW,KAAK,UAAU,WAAW,GAAG;AACvD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,IAAIA,0CAAqB,aAAa,SAAS;AACpE,UAAM,iBAAiB,KAAK,qBAAqB,YAAY;AAC7D,UAAM,eAAe,KAAK,mBAAmB,YAAY;AACzD,UAAM,WAAW;AAAA,MAChB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,IAAA;AAElB,WAAO;AAAA,MACN,UAAU,IAAIC,QAAAA,kBAAkB;AAAA,QAC/B,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAAA,CACd;AAAA,MACD,OAAO,IAAIA,QAAAA,kBAAkB;AAAA,QAC5B,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,UACd,cAAc;AAAA,YACb,MAAMC,QAAAA;AAAAA,UAAA;AAAA,QACP;AAAA,MACD,CACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,mBAAmB,cAA+F;AACzH,WAAO;AAAA,MACN,MAAM,IAAIC,QAAAA,eAAeC,0BAAY;AAAA,MACrC,MAAM;AAAA,QACL,WAAW;AAAA,UACV,MAAM,IAAID,QAAAA,eAAeD,QAAAA,aAAa;AAAA,QAAA;AAAA,QAEvC,YAAY;AAAA,UACX,MAAMG,QAAAA;AAAAA,QAAA;AAAA,MACP;AAAA,MAED,SAAS,OAAO,QAAa,MAAkD,QAAqC;AACnH,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAIC,QAAAA,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAWC,OAAAA,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,iBAAiB,EAAE,WAAW,KAAK,WAAW,YAAY,KAAK,cAAc,MAAM;AAAA,MAC9F;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,qBAAqB,cAAuE;AACnG,WAAO;AAAA,MACN,MAAM,IAAIJ,QAAAA,eAAeK,4BAAc;AAAA,MACvC,MAAM;AAAA,QACL,OAAO,EAAE,MAAMC,0CAAM;AAAA,QACrB,aAAa,EAAE,MAAMP,uBAAe,mBAAmB,wBAAA;AAAA,QACvD,YAAY,EAAE,MAAMG,oBAAY,mBAAmB,uBAAA;AAAA,QACnD,QAAQ,EAAE,MAAMH,uBAAe,mBAAmB,mBAAA;AAAA,QAClD,KAAK,EAAE,MAAMQ,cAAAA,OAAa,mBAAmB,gBAAA;AAAA,MAAgB;AAAA,MAE9D,SAAS,OACR,QACA,MACA,QACI;AACJ,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAIJ,QAAAA,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAWC,OAAAA,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,mBAAmB;AAAA,UAC5B,KAAK,KAAK,OAAO,OAAO,KAAK,OAAO;AAAA,UACpC,oBAAoB,KAAK,OAAO,sBAAsB;AAAA,UACtD,aAAa,KAAK,OAAO,eAAe,KAAK,eAAe;AAAA,UAC5D,YAAY,KAAK,OAAO,cAAc,KAAK,cAAc;AAAA,UACzD,WAAW,KAAK,OAAO,aAAa;AAAA,UACpC,UAAU,KAAK,OAAO,YAAY;AAAA,UAClC,QAAQ,KAAK,OAAO,UAAU,KAAK,UAAU;AAAA,UAC7C,QAAQ,KAAK,OAAO,UAAU;AAAA,UAC9B,MAAM,KAAK,OAAO,QAAQ;AAAA,QAAA,CAC1B;AAAA,MACF;AAAA,IAAA;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"S3SchemaContributor.cjs","sources":["../../../../packages/engine-s3-plugin/src/S3SchemaContributor.ts"],"sourcesContent":["import {\n\tGraphQLError,\n\tGraphQLFieldConfig,\n\tGraphQLInt,\n\tGraphQLNonNull,\n\tGraphQLObjectType,\n\tGraphQLSchema,\n\tGraphQLSchemaConfig,\n\tGraphQLString,\n} from 'graphql'\nimport { S3Service, S3ServiceFactory } from './S3Service.js'\nimport { Project3Config, resolveS3Config, S3Config } from './Config.js'\nimport { GraphQLSchemaContributor, GraphQLSchemaContributorContext, Providers } from '@contember/engine-plugins'\nimport * as types from './S3SchemaTypes.js'\nimport { S3Acl, S3DeletedObject, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes.js'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'\n\ninterface Identity {\n\tprojectRoles: string[]\n}\n\nexport type S3SchemaUploadAcl =\n\t| boolean\n\t| {\n\t\tmaxSize?: number\n\t}\n\nexport type S3SchemaAcl = Record<\n\tstring, // public/*.jpg\n\t{\n\t\tread?: boolean\n\t\tupload?: S3SchemaUploadAcl\n\t\tdelete?: boolean\n\t}\n>\n\nexport class S3SchemaContributor implements GraphQLSchemaContributor {\n\tconstructor(\n\t\tprivate readonly s3Factory: S3ServiceFactory,\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tgetCacheKey?({ project }: GraphQLSchemaContributorContext): string {\n\t\treturn project.s3 ? 'yes' : 'no'\n\t}\n\n\tcreateSchema(context: GraphQLSchemaContributorContext): GraphQLSchemaConfig | undefined {\n\t\tif (!context.project.s3) {\n\t\t\treturn undefined\n\t\t}\n\t\tconst rules = context.identity.projectRoles.flatMap(it => Object.entries((context.schema.acl.roles[it]?.s3 as S3SchemaAcl) || {}))\n\n\t\tconst uploadRules = rules.filter(([, it]) => it.upload).map(([it, val]) => ({\n\t\t\tpattern: it,\n\t\t\t...(typeof val.upload !== 'boolean' ? val.upload : {}),\n\t\t}))\n\t\tconst readRules = rules.filter(([, it]) => it.read).map(([it]) => ({\n\t\t\tpattern: it,\n\t\t}))\n\t\tconst deleteRules = rules.filter(([, it]) => it.delete).map(([it]) => ({\n\t\t\tpattern: it,\n\t\t}))\n\n\t\tif (uploadRules.length === 0 && readRules.length === 0 && deleteRules.length === 0) {\n\t\t\treturn undefined\n\t\t}\n\n\t\tconst authorizator = new S3ObjectAuthorizator(uploadRules, readRules, deleteRules)\n\t\tconst uploadMutation = this.createUploadMutation(authorizator)\n\t\tconst readMutation = this.createReadMutation(authorizator)\n\t\tconst deleteMutation = this.createDeleteMutation(authorizator)\n\t\tconst mutation = {\n\t\t\tgenerateUploadUrl: uploadMutation as GraphQLFieldConfig<any, any, any>,\n\t\t\tgenerateReadUrl: readMutation,\n\t\t\t// not \"deleteObject\" — a content mutation for an entity named \"Object\" would shadow it\n\t\t\tdeleteS3Object: deleteMutation,\n\t\t}\n\t\treturn {\n\t\t\tmutation: new GraphQLObjectType({\n\t\t\t\tname: 'Mutation',\n\t\t\t\tfields: () => mutation,\n\t\t\t}),\n\t\t\tquery: new GraphQLObjectType({\n\t\t\t\tname: 'Query',\n\t\t\t\tfields: () => ({\n\t\t\t\t\ts3DummyQuery: {\n\t\t\t\t\t\ttype: GraphQLString,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t}),\n\t\t}\n\t}\n\n\tprivate createReadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, { project: Project3Config }, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedRead),\n\t\t\targs: {\n\t\t\t\tobjectKey: {\n\t\t\t\t\ttype: new GraphQLNonNull(GraphQLString),\n\t\t\t\t},\n\t\t\t\texpiration: {\n\t\t\t\t\ttype: GraphQLInt,\n\t\t\t\t},\n\t\t\t},\n\t\t\tresolve: async (parent: any, args: { objectKey: string; expiration?: number }, ctx: { project: Project3Config }) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null })\n\t\t\t},\n\t\t} as GraphQLFieldConfig<any, any, any>\n\t}\n\n\tprivate createDeleteMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3DeletedObject),\n\t\t\targs: {\n\t\t\t\tobjectKey: {\n\t\t\t\t\ttype: new GraphQLNonNull(GraphQLString),\n\t\t\t\t},\n\t\t\t},\n\t\t\tresolve: async (parent: any, args: { objectKey: string }, ctx: { project: Project3Config }) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn await s3.deleteObject({ objectKey: args.objectKey })\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate createUploadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedUpload),\n\t\t\targs: {\n\t\t\t\tinput: { type: types.S3GenerateSignedUploadInput },\n\t\t\t\tcontentType: { type: GraphQLString, deprecationReason: 'Use input.contentType' },\n\t\t\t\texpiration: { type: GraphQLInt, deprecationReason: 'Use input.expiration' },\n\t\t\t\tprefix: { type: GraphQLString, deprecationReason: 'Use input.prefix' },\n\t\t\t\tacl: { type: types.S3Acl, deprecationReason: 'Use input.acl' },\n\t\t\t},\n\t\t\tresolve: async (\n\t\t\t\tparent: any,\n\t\t\t\targs: { input?: Partial<S3GenerateSignedUploadInput>; contentType?: string; acl?: S3Acl; expiration?: number; prefix?: string },\n\t\t\t\tctx: { project: Project3Config },\n\t\t\t) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedUploadUrl({\n\t\t\t\t\tacl: args.input?.acl ?? args.acl ?? null,\n\t\t\t\t\tcontentDisposition: args.input?.contentDisposition ?? null,\n\t\t\t\t\tcontentType: args.input?.contentType ?? args.contentType ?? null,\n\t\t\t\t\texpiration: args.input?.expiration ?? args.expiration ?? null,\n\t\t\t\t\textension: args.input?.extension ?? null,\n\t\t\t\t\tfileName: args.input?.fileName ?? null,\n\t\t\t\t\tprefix: args.input?.prefix ?? args.prefix ?? null,\n\t\t\t\t\tsuffix: args.input?.suffix ?? null,\n\t\t\t\t\tsize: args.input?.size ?? null,\n\t\t\t\t})\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["S3ObjectAuthorizator","GraphQLObjectType","GraphQLString","GraphQLNonNull","S3SignedRead","GraphQLInt","GraphQLError","resolveS3Config","S3DeletedObject","S3SignedUpload","types.S3GenerateSignedUploadInput","types.S3Acl"],"mappings":";;;;;;AAoCO,MAAM,oBAAwD;AAAA,EACpE,YACkB,WACA,WAChB;AAFgB,SAAA,YAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,YAAa,EAAE,WAAoD;AAClE,WAAO,QAAQ,KAAK,QAAQ;AAAA,EAC7B;AAAA,EAEA,aAAa,SAA2E;AACvF,QAAI,CAAC,QAAQ,QAAQ,IAAI;AACxB,aAAO;AAAA,IACR;AACA,UAAM,QAAQ,QAAQ,SAAS,aAAa,QAAQ,QAAM,OAAO,QAAS,QAAQ,OAAO,IAAI,MAAM,EAAE,GAAG,MAAsB,CAAA,CAAE,CAAC;AAEjI,UAAM,cAAc,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;AAAA,MAC3E,SAAS;AAAA,MACT,GAAI,OAAO,IAAI,WAAW,YAAY,IAAI,SAAS,CAAA;AAAA,IAAC,EACnD;AACF,UAAM,YAAY,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;AAAA,MAClE,SAAS;AAAA,IAAA,EACR;AACF,UAAM,cAAc,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;AAAA,MACtE,SAAS;AAAA,IAAA,EACR;AAEF,QAAI,YAAY,WAAW,KAAK,UAAU,WAAW,KAAK,YAAY,WAAW,GAAG;AACnF,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,IAAIA,qBAAAA,qBAAqB,aAAa,WAAW,WAAW;AACjF,UAAM,iBAAiB,KAAK,qBAAqB,YAAY;AAC7D,UAAM,eAAe,KAAK,mBAAmB,YAAY;AACzD,UAAM,iBAAiB,KAAK,qBAAqB,YAAY;AAC7D,UAAM,WAAW;AAAA,MAChB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA;AAAA,MAEjB,gBAAgB;AAAA,IAAA;AAEjB,WAAO;AAAA,MACN,UAAU,IAAIC,QAAAA,kBAAkB;AAAA,QAC/B,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAAA,CACd;AAAA,MACD,OAAO,IAAIA,QAAAA,kBAAkB;AAAA,QAC5B,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,UACd,cAAc;AAAA,YACb,MAAMC,QAAAA;AAAAA,UAAA;AAAA,QACP;AAAA,MACD,CACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,mBAAmB,cAA+F;AACzH,WAAO;AAAA,MACN,MAAM,IAAIC,QAAAA,eAAeC,0BAAY;AAAA,MACrC,MAAM;AAAA,QACL,WAAW;AAAA,UACV,MAAM,IAAID,QAAAA,eAAeD,QAAAA,aAAa;AAAA,QAAA;AAAA,QAEvC,YAAY;AAAA,UACX,MAAMG,QAAAA;AAAAA,QAAA;AAAA,MACP;AAAA,MAED,SAAS,OAAO,QAAa,MAAkD,QAAqC;AACnH,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAIC,QAAAA,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAWC,OAAAA,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,iBAAiB,EAAE,WAAW,KAAK,WAAW,YAAY,KAAK,cAAc,MAAM;AAAA,MAC9F;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,qBAAqB,cAAuE;AACnG,WAAO;AAAA,MACN,MAAM,IAAIJ,QAAAA,eAAeK,6BAAe;AAAA,MACxC,MAAM;AAAA,QACL,WAAW;AAAA,UACV,MAAM,IAAIL,QAAAA,eAAeD,QAAAA,aAAa;AAAA,QAAA;AAAA,MACvC;AAAA,MAED,SAAS,OAAO,QAAa,MAA6B,QAAqC;AAC9F,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAII,QAAAA,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAWC,OAAAA,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,MAAM,GAAG,aAAa,EAAE,WAAW,KAAK,WAAW;AAAA,MAC3D;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,qBAAqB,cAAuE;AACnG,WAAO;AAAA,MACN,MAAM,IAAIJ,QAAAA,eAAeM,4BAAc;AAAA,MACvC,MAAM;AAAA,QACL,OAAO,EAAE,MAAMC,0CAAM;AAAA,QACrB,aAAa,EAAE,MAAMR,uBAAe,mBAAmB,wBAAA;AAAA,QACvD,YAAY,EAAE,MAAMG,oBAAY,mBAAmB,uBAAA;AAAA,QACnD,QAAQ,EAAE,MAAMH,uBAAe,mBAAmB,mBAAA;AAAA,QAClD,KAAK,EAAE,MAAMS,cAAAA,OAAa,mBAAmB,gBAAA;AAAA,MAAgB;AAAA,MAE9D,SAAS,OACR,QACA,MACA,QACI;AACJ,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAIL,QAAAA,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAWC,OAAAA,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,mBAAmB;AAAA,UAC5B,KAAK,KAAK,OAAO,OAAO,KAAK,OAAO;AAAA,UACpC,oBAAoB,KAAK,OAAO,sBAAsB;AAAA,UACtD,aAAa,KAAK,OAAO,eAAe,KAAK,eAAe;AAAA,UAC5D,YAAY,KAAK,OAAO,cAAc,KAAK,cAAc;AAAA,UACzD,WAAW,KAAK,OAAO,aAAa;AAAA,UACpC,UAAU,KAAK,OAAO,YAAY;AAAA,UAClC,QAAQ,KAAK,OAAO,UAAU,KAAK,UAAU;AAAA,UAC7C,QAAQ,KAAK,OAAO,UAAU;AAAA,UAC9B,MAAM,KAAK,OAAO,QAAQ;AAAA,QAAA,CAC1B;AAAA,MACF;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/production/src/S3SchemaContributor.js

@@ -1,6 +1,6 @@
 import { GraphQLObjectType, GraphQLString, GraphQLInt, GraphQLNonNull, GraphQLError } from "graphql";
 import { resolveS3Config } from "./Config.js";
-import { S3SignedRead, S3Acl, S3GenerateSignedUploadInput, S3SignedUpload } from "./S3SchemaTypes.js";
+import { S3SignedRead, S3DeletedObject, S3Acl, S3GenerateSignedUploadInput, S3SignedUpload } from "./S3SchemaTypes.js";
 import { S3ObjectAuthorizator } from "./S3ObjectAuthorizator.js";
 class S3SchemaContributor {
   constructor(s3Factory, providers) {
@@ -22,15 +22,21 @@ class S3SchemaContributor {
     const readRules = rules.filter(([, it]) => it.read).map(([it]) => ({
       pattern: it
     }));
-    if (uploadRules.length === 0 && readRules.length === 0) {
+    const deleteRules = rules.filter(([, it]) => it.delete).map(([it]) => ({
+      pattern: it
+    }));
+    if (uploadRules.length === 0 && readRules.length === 0 && deleteRules.length === 0) {
       return void 0;
     }
-    const authorizator = new S3ObjectAuthorizator(uploadRules, readRules);
+    const authorizator = new S3ObjectAuthorizator(uploadRules, readRules, deleteRules);
     const uploadMutation = this.createUploadMutation(authorizator);
     const readMutation = this.createReadMutation(authorizator);
+    const deleteMutation = this.createDeleteMutation(authorizator);
     const mutation = {
       generateUploadUrl: uploadMutation,
-      generateReadUrl: readMutation
+      generateReadUrl: readMutation,
+      // not "deleteObject" — a content mutation for an entity named "Object" would shadow it
+      deleteS3Object: deleteMutation
     };
     return {
       mutation: new GraphQLObjectType({
@@ -68,6 +74,24 @@ class S3SchemaContributor {
       }
     };
   }
+  createDeleteMutation(authorizator) {
+    return {
+      type: new GraphQLNonNull(S3DeletedObject),
+      args: {
+        objectKey: {
+          type: new GraphQLNonNull(GraphQLString)
+        }
+      },
+      resolve: async (parent, args, ctx) => {
+        if (!ctx.project.s3) {
+          throw new GraphQLError("S3 is not configured for this project");
+        }
+        const s3Config = resolveS3Config(ctx.project.s3);
+        const s3 = this.s3Factory.create(s3Config, this.providers, authorizator);
+        return await s3.deleteObject({ objectKey: args.objectKey });
+      }
+    };
+  }
   createUploadMutation(authorizator) {
     return {
       type: new GraphQLNonNull(S3SignedUpload),

package/dist/production/src/S3SchemaContributor.js.map

@@ -1 +1 @@
-{"version":3,"file":"S3SchemaContributor.js","sources":["../../../../packages/engine-s3-plugin/src/S3SchemaContributor.ts"],"sourcesContent":["import {\n\tGraphQLError,\n\tGraphQLFieldConfig,\n\tGraphQLInt,\n\tGraphQLNonNull,\n\tGraphQLObjectType,\n\tGraphQLSchema,\n\tGraphQLSchemaConfig,\n\tGraphQLString,\n} from 'graphql'\nimport { S3Service, S3ServiceFactory } from './S3Service.js'\nimport { Project3Config, resolveS3Config, S3Config } from './Config.js'\nimport { GraphQLSchemaContributor, GraphQLSchemaContributorContext, Providers } from '@contember/engine-plugins'\nimport * as types from './S3SchemaTypes.js'\nimport { S3Acl, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes.js'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'\n\ninterface Identity {\n\tprojectRoles: string[]\n}\n\nexport type S3SchemaUploadAcl =\n\t| boolean\n\t| {\n\t\tmaxSize?: number\n\t}\n\nexport type S3SchemaAcl = Record<\n\tstring, // public/*.jpg\n\t{\n\t\tread?: boolean\n\t\tupload?: S3SchemaUploadAcl\n\t}\n>\n\nexport class S3SchemaContributor implements GraphQLSchemaContributor {\n\tconstructor(\n\t\tprivate readonly s3Factory: S3ServiceFactory,\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tgetCacheKey?({ project }: GraphQLSchemaContributorContext): string {\n\t\treturn project.s3 ? 'yes' : 'no'\n\t}\n\n\tcreateSchema(context: GraphQLSchemaContributorContext): GraphQLSchemaConfig | undefined {\n\t\tif (!context.project.s3) {\n\t\t\treturn undefined\n\t\t}\n\t\tconst rules = context.identity.projectRoles.flatMap(it => Object.entries((context.schema.acl.roles[it]?.s3 as S3SchemaAcl) || {}))\n\n\t\tconst uploadRules = rules.filter(([, it]) => it.upload).map(([it, val]) => ({\n\t\t\tpattern: it,\n\t\t\t...(typeof val.upload !== 'boolean' ? val.upload : {}),\n\t\t}))\n\t\tconst readRules = rules.filter(([, it]) => it.read).map(([it]) => ({\n\t\t\tpattern: it,\n\t\t}))\n\n\t\tif (uploadRules.length === 0 && readRules.length === 0) {\n\t\t\treturn undefined\n\t\t}\n\n\t\tconst authorizator = new S3ObjectAuthorizator(uploadRules, readRules)\n\t\tconst uploadMutation = this.createUploadMutation(authorizator)\n\t\tconst readMutation = this.createReadMutation(authorizator)\n\t\tconst mutation = {\n\t\t\tgenerateUploadUrl: uploadMutation as GraphQLFieldConfig<any, any, any>,\n\t\t\tgenerateReadUrl: readMutation,\n\t\t}\n\t\treturn {\n\t\t\tmutation: new GraphQLObjectType({\n\t\t\t\tname: 'Mutation',\n\t\t\t\tfields: () => mutation,\n\t\t\t}),\n\t\t\tquery: new GraphQLObjectType({\n\t\t\t\tname: 'Query',\n\t\t\t\tfields: () => ({\n\t\t\t\t\ts3DummyQuery: {\n\t\t\t\t\t\ttype: GraphQLString,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t}),\n\t\t}\n\t}\n\n\tprivate createReadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, { project: Project3Config }, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedRead),\n\t\t\targs: {\n\t\t\t\tobjectKey: {\n\t\t\t\t\ttype: new GraphQLNonNull(GraphQLString),\n\t\t\t\t},\n\t\t\t\texpiration: {\n\t\t\t\t\ttype: GraphQLInt,\n\t\t\t\t},\n\t\t\t},\n\t\t\tresolve: async (parent: any, args: { objectKey: string; expiration?: number }, ctx: { project: Project3Config }) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null })\n\t\t\t},\n\t\t} as GraphQLFieldConfig<any, any, any>\n\t}\n\n\tprivate createUploadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedUpload),\n\t\t\targs: {\n\t\t\t\tinput: { type: types.S3GenerateSignedUploadInput },\n\t\t\t\tcontentType: { type: GraphQLString, deprecationReason: 'Use input.contentType' },\n\t\t\t\texpiration: { type: GraphQLInt, deprecationReason: 'Use input.expiration' },\n\t\t\t\tprefix: { type: GraphQLString, deprecationReason: 'Use input.prefix' },\n\t\t\t\tacl: { type: types.S3Acl, deprecationReason: 'Use input.acl' },\n\t\t\t},\n\t\t\tresolve: async (\n\t\t\t\tparent: any,\n\t\t\t\targs: { input?: Partial<S3GenerateSignedUploadInput>; contentType?: string; acl?: S3Acl; expiration?: number; prefix?: string },\n\t\t\t\tctx: { project: Project3Config },\n\t\t\t) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedUploadUrl({\n\t\t\t\t\tacl: args.input?.acl ?? args.acl ?? null,\n\t\t\t\t\tcontentDisposition: args.input?.contentDisposition ?? null,\n\t\t\t\t\tcontentType: args.input?.contentType ?? args.contentType ?? null,\n\t\t\t\t\texpiration: args.input?.expiration ?? args.expiration ?? null,\n\t\t\t\t\textension: args.input?.extension ?? null,\n\t\t\t\t\tfileName: args.input?.fileName ?? null,\n\t\t\t\t\tprefix: args.input?.prefix ?? args.prefix ?? null,\n\t\t\t\t\tsuffix: args.input?.suffix ?? null,\n\t\t\t\t\tsize: args.input?.size ?? null,\n\t\t\t\t})\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["types.S3GenerateSignedUploadInput","types.S3Acl"],"mappings":";;;;AAmCO,MAAM,oBAAwD;AAAA,EACpE,YACkB,WACA,WAChB;AAFgB,SAAA,YAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,YAAa,EAAE,WAAoD;AAClE,WAAO,QAAQ,KAAK,QAAQ;AAAA,EAC7B;AAAA,EAEA,aAAa,SAA2E;AACvF,QAAI,CAAC,QAAQ,QAAQ,IAAI;AACxB,aAAO;AAAA,IACR;AACA,UAAM,QAAQ,QAAQ,SAAS,aAAa,QAAQ,QAAM,OAAO,QAAS,QAAQ,OAAO,IAAI,MAAM,EAAE,GAAG,MAAsB,CAAA,CAAE,CAAC;AAEjI,UAAM,cAAc,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;AAAA,MAC3E,SAAS;AAAA,MACT,GAAI,OAAO,IAAI,WAAW,YAAY,IAAI,SAAS,CAAA;AAAA,IAAC,EACnD;AACF,UAAM,YAAY,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;AAAA,MAClE,SAAS;AAAA,IAAA,EACR;AAEF,QAAI,YAAY,WAAW,KAAK,UAAU,WAAW,GAAG;AACvD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,IAAI,qBAAqB,aAAa,SAAS;AACpE,UAAM,iBAAiB,KAAK,qBAAqB,YAAY;AAC7D,UAAM,eAAe,KAAK,mBAAmB,YAAY;AACzD,UAAM,WAAW;AAAA,MAChB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,IAAA;AAElB,WAAO;AAAA,MACN,UAAU,IAAI,kBAAkB;AAAA,QAC/B,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAAA,CACd;AAAA,MACD,OAAO,IAAI,kBAAkB;AAAA,QAC5B,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,UACd,cAAc;AAAA,YACb,MAAM;AAAA,UAAA;AAAA,QACP;AAAA,MACD,CACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,mBAAmB,cAA+F;AACzH,WAAO;AAAA,MACN,MAAM,IAAI,eAAe,YAAY;AAAA,MACrC,MAAM;AAAA,QACL,WAAW;AAAA,UACV,MAAM,IAAI,eAAe,aAAa;AAAA,QAAA;AAAA,QAEvC,YAAY;AAAA,UACX,MAAM;AAAA,QAAA;AAAA,MACP;AAAA,MAED,SAAS,OAAO,QAAa,MAAkD,QAAqC;AACnH,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAI,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAW,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,iBAAiB,EAAE,WAAW,KAAK,WAAW,YAAY,KAAK,cAAc,MAAM;AAAA,MAC9F;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,qBAAqB,cAAuE;AACnG,WAAO;AAAA,MACN,MAAM,IAAI,eAAe,cAAc;AAAA,MACvC,MAAM;AAAA,QACL,OAAO,EAAE,MAAMA,4BAAM;AAAA,QACrB,aAAa,EAAE,MAAM,eAAe,mBAAmB,wBAAA;AAAA,QACvD,YAAY,EAAE,MAAM,YAAY,mBAAmB,uBAAA;AAAA,QACnD,QAAQ,EAAE,MAAM,eAAe,mBAAmB,mBAAA;AAAA,QAClD,KAAK,EAAE,MAAMC,OAAa,mBAAmB,gBAAA;AAAA,MAAgB;AAAA,MAE9D,SAAS,OACR,QACA,MACA,QACI;AACJ,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAI,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAW,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,mBAAmB;AAAA,UAC5B,KAAK,KAAK,OAAO,OAAO,KAAK,OAAO;AAAA,UACpC,oBAAoB,KAAK,OAAO,sBAAsB;AAAA,UACtD,aAAa,KAAK,OAAO,eAAe,KAAK,eAAe;AAAA,UAC5D,YAAY,KAAK,OAAO,cAAc,KAAK,cAAc;AAAA,UACzD,WAAW,KAAK,OAAO,aAAa;AAAA,UACpC,UAAU,KAAK,OAAO,YAAY;AAAA,UAClC,QAAQ,KAAK,OAAO,UAAU,KAAK,UAAU;AAAA,UAC7C,QAAQ,KAAK,OAAO,UAAU;AAAA,UAC9B,MAAM,KAAK,OAAO,QAAQ;AAAA,QAAA,CAC1B;AAAA,MACF;AAAA,IAAA;AAAA,EAEF;AACD;"}
+{"version":3,"file":"S3SchemaContributor.js","sources":["../../../../packages/engine-s3-plugin/src/S3SchemaContributor.ts"],"sourcesContent":["import {\n\tGraphQLError,\n\tGraphQLFieldConfig,\n\tGraphQLInt,\n\tGraphQLNonNull,\n\tGraphQLObjectType,\n\tGraphQLSchema,\n\tGraphQLSchemaConfig,\n\tGraphQLString,\n} from 'graphql'\nimport { S3Service, S3ServiceFactory } from './S3Service.js'\nimport { Project3Config, resolveS3Config, S3Config } from './Config.js'\nimport { GraphQLSchemaContributor, GraphQLSchemaContributorContext, Providers } from '@contember/engine-plugins'\nimport * as types from './S3SchemaTypes.js'\nimport { S3Acl, S3DeletedObject, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes.js'\nimport { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'\n\ninterface Identity {\n\tprojectRoles: string[]\n}\n\nexport type S3SchemaUploadAcl =\n\t| boolean\n\t| {\n\t\tmaxSize?: number\n\t}\n\nexport type S3SchemaAcl = Record<\n\tstring, // public/*.jpg\n\t{\n\t\tread?: boolean\n\t\tupload?: S3SchemaUploadAcl\n\t\tdelete?: boolean\n\t}\n>\n\nexport class S3SchemaContributor implements GraphQLSchemaContributor {\n\tconstructor(\n\t\tprivate readonly s3Factory: S3ServiceFactory,\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tgetCacheKey?({ project }: GraphQLSchemaContributorContext): string {\n\t\treturn project.s3 ? 'yes' : 'no'\n\t}\n\n\tcreateSchema(context: GraphQLSchemaContributorContext): GraphQLSchemaConfig | undefined {\n\t\tif (!context.project.s3) {\n\t\t\treturn undefined\n\t\t}\n\t\tconst rules = context.identity.projectRoles.flatMap(it => Object.entries((context.schema.acl.roles[it]?.s3 as S3SchemaAcl) || {}))\n\n\t\tconst uploadRules = rules.filter(([, it]) => it.upload).map(([it, val]) => ({\n\t\t\tpattern: it,\n\t\t\t...(typeof val.upload !== 'boolean' ? val.upload : {}),\n\t\t}))\n\t\tconst readRules = rules.filter(([, it]) => it.read).map(([it]) => ({\n\t\t\tpattern: it,\n\t\t}))\n\t\tconst deleteRules = rules.filter(([, it]) => it.delete).map(([it]) => ({\n\t\t\tpattern: it,\n\t\t}))\n\n\t\tif (uploadRules.length === 0 && readRules.length === 0 && deleteRules.length === 0) {\n\t\t\treturn undefined\n\t\t}\n\n\t\tconst authorizator = new S3ObjectAuthorizator(uploadRules, readRules, deleteRules)\n\t\tconst uploadMutation = this.createUploadMutation(authorizator)\n\t\tconst readMutation = this.createReadMutation(authorizator)\n\t\tconst deleteMutation = this.createDeleteMutation(authorizator)\n\t\tconst mutation = {\n\t\t\tgenerateUploadUrl: uploadMutation as GraphQLFieldConfig<any, any, any>,\n\t\t\tgenerateReadUrl: readMutation,\n\t\t\t// not \"deleteObject\" — a content mutation for an entity named \"Object\" would shadow it\n\t\t\tdeleteS3Object: deleteMutation,\n\t\t}\n\t\treturn {\n\t\t\tmutation: new GraphQLObjectType({\n\t\t\t\tname: 'Mutation',\n\t\t\t\tfields: () => mutation,\n\t\t\t}),\n\t\t\tquery: new GraphQLObjectType({\n\t\t\t\tname: 'Query',\n\t\t\t\tfields: () => ({\n\t\t\t\t\ts3DummyQuery: {\n\t\t\t\t\t\ttype: GraphQLString,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t}),\n\t\t}\n\t}\n\n\tprivate createReadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, { project: Project3Config }, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedRead),\n\t\t\targs: {\n\t\t\t\tobjectKey: {\n\t\t\t\t\ttype: new GraphQLNonNull(GraphQLString),\n\t\t\t\t},\n\t\t\t\texpiration: {\n\t\t\t\t\ttype: GraphQLInt,\n\t\t\t\t},\n\t\t\t},\n\t\t\tresolve: async (parent: any, args: { objectKey: string; expiration?: number }, ctx: { project: Project3Config }) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedReadUrl({ objectKey: args.objectKey, expiration: args.expiration ?? null })\n\t\t\t},\n\t\t} as GraphQLFieldConfig<any, any, any>\n\t}\n\n\tprivate createDeleteMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3DeletedObject),\n\t\t\targs: {\n\t\t\t\tobjectKey: {\n\t\t\t\t\ttype: new GraphQLNonNull(GraphQLString),\n\t\t\t\t},\n\t\t\t},\n\t\t\tresolve: async (parent: any, args: { objectKey: string }, ctx: { project: Project3Config }) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn await s3.deleteObject({ objectKey: args.objectKey })\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate createUploadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {\n\t\treturn {\n\t\t\ttype: new GraphQLNonNull(S3SignedUpload),\n\t\t\targs: {\n\t\t\t\tinput: { type: types.S3GenerateSignedUploadInput },\n\t\t\t\tcontentType: { type: GraphQLString, deprecationReason: 'Use input.contentType' },\n\t\t\t\texpiration: { type: GraphQLInt, deprecationReason: 'Use input.expiration' },\n\t\t\t\tprefix: { type: GraphQLString, deprecationReason: 'Use input.prefix' },\n\t\t\t\tacl: { type: types.S3Acl, deprecationReason: 'Use input.acl' },\n\t\t\t},\n\t\t\tresolve: async (\n\t\t\t\tparent: any,\n\t\t\t\targs: { input?: Partial<S3GenerateSignedUploadInput>; contentType?: string; acl?: S3Acl; expiration?: number; prefix?: string },\n\t\t\t\tctx: { project: Project3Config },\n\t\t\t) => {\n\t\t\t\tif (!ctx.project.s3) {\n\t\t\t\t\tthrow new GraphQLError('S3 is not configured for this project')\n\t\t\t\t}\n\t\t\t\tconst s3Config = resolveS3Config(ctx.project.s3)\n\t\t\t\tconst s3 = this.s3Factory.create(s3Config, this.providers, authorizator)\n\t\t\t\treturn s3.getSignedUploadUrl({\n\t\t\t\t\tacl: args.input?.acl ?? args.acl ?? null,\n\t\t\t\t\tcontentDisposition: args.input?.contentDisposition ?? null,\n\t\t\t\t\tcontentType: args.input?.contentType ?? args.contentType ?? null,\n\t\t\t\t\texpiration: args.input?.expiration ?? args.expiration ?? null,\n\t\t\t\t\textension: args.input?.extension ?? null,\n\t\t\t\t\tfileName: args.input?.fileName ?? null,\n\t\t\t\t\tprefix: args.input?.prefix ?? args.prefix ?? null,\n\t\t\t\t\tsuffix: args.input?.suffix ?? null,\n\t\t\t\t\tsize: args.input?.size ?? null,\n\t\t\t\t})\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["types.S3GenerateSignedUploadInput","types.S3Acl"],"mappings":";;;;AAoCO,MAAM,oBAAwD;AAAA,EACpE,YACkB,WACA,WAChB;AAFgB,SAAA,YAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,YAAa,EAAE,WAAoD;AAClE,WAAO,QAAQ,KAAK,QAAQ;AAAA,EAC7B;AAAA,EAEA,aAAa,SAA2E;AACvF,QAAI,CAAC,QAAQ,QAAQ,IAAI;AACxB,aAAO;AAAA,IACR;AACA,UAAM,QAAQ,QAAQ,SAAS,aAAa,QAAQ,QAAM,OAAO,QAAS,QAAQ,OAAO,IAAI,MAAM,EAAE,GAAG,MAAsB,CAAA,CAAE,CAAC;AAEjI,UAAM,cAAc,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;AAAA,MAC3E,SAAS;AAAA,MACT,GAAI,OAAO,IAAI,WAAW,YAAY,IAAI,SAAS,CAAA;AAAA,IAAC,EACnD;AACF,UAAM,YAAY,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;AAAA,MAClE,SAAS;AAAA,IAAA,EACR;AACF,UAAM,cAAc,MAAM,OAAO,CAAC,CAAA,EAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;AAAA,MACtE,SAAS;AAAA,IAAA,EACR;AAEF,QAAI,YAAY,WAAW,KAAK,UAAU,WAAW,KAAK,YAAY,WAAW,GAAG;AACnF,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,IAAI,qBAAqB,aAAa,WAAW,WAAW;AACjF,UAAM,iBAAiB,KAAK,qBAAqB,YAAY;AAC7D,UAAM,eAAe,KAAK,mBAAmB,YAAY;AACzD,UAAM,iBAAiB,KAAK,qBAAqB,YAAY;AAC7D,UAAM,WAAW;AAAA,MAChB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA;AAAA,MAEjB,gBAAgB;AAAA,IAAA;AAEjB,WAAO;AAAA,MACN,UAAU,IAAI,kBAAkB;AAAA,QAC/B,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAAA,CACd;AAAA,MACD,OAAO,IAAI,kBAAkB;AAAA,QAC5B,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,UACd,cAAc;AAAA,YACb,MAAM;AAAA,UAAA;AAAA,QACP;AAAA,MACD,CACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,mBAAmB,cAA+F;AACzH,WAAO;AAAA,MACN,MAAM,IAAI,eAAe,YAAY;AAAA,MACrC,MAAM;AAAA,QACL,WAAW;AAAA,UACV,MAAM,IAAI,eAAe,aAAa;AAAA,QAAA;AAAA,QAEvC,YAAY;AAAA,UACX,MAAM;AAAA,QAAA;AAAA,MACP;AAAA,MAED,SAAS,OAAO,QAAa,MAAkD,QAAqC;AACnH,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAI,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAW,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,iBAAiB,EAAE,WAAW,KAAK,WAAW,YAAY,KAAK,cAAc,MAAM;AAAA,MAC9F;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,qBAAqB,cAAuE;AACnG,WAAO;AAAA,MACN,MAAM,IAAI,eAAe,eAAe;AAAA,MACxC,MAAM;AAAA,QACL,WAAW;AAAA,UACV,MAAM,IAAI,eAAe,aAAa;AAAA,QAAA;AAAA,MACvC;AAAA,MAED,SAAS,OAAO,QAAa,MAA6B,QAAqC;AAC9F,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAI,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAW,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,MAAM,GAAG,aAAa,EAAE,WAAW,KAAK,WAAW;AAAA,MAC3D;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,qBAAqB,cAAuE;AACnG,WAAO;AAAA,MACN,MAAM,IAAI,eAAe,cAAc;AAAA,MACvC,MAAM;AAAA,QACL,OAAO,EAAE,MAAMA,4BAAM;AAAA,QACrB,aAAa,EAAE,MAAM,eAAe,mBAAmB,wBAAA;AAAA,QACvD,YAAY,EAAE,MAAM,YAAY,mBAAmB,uBAAA;AAAA,QACnD,QAAQ,EAAE,MAAM,eAAe,mBAAmB,mBAAA;AAAA,QAClD,KAAK,EAAE,MAAMC,OAAa,mBAAmB,gBAAA;AAAA,MAAgB;AAAA,MAE9D,SAAS,OACR,QACA,MACA,QACI;AACJ,YAAI,CAAC,IAAI,QAAQ,IAAI;AACpB,gBAAM,IAAI,aAAa,uCAAuC;AAAA,QAC/D;AACA,cAAM,WAAW,gBAAgB,IAAI,QAAQ,EAAE;AAC/C,cAAM,KAAK,KAAK,UAAU,OAAO,UAAU,KAAK,WAAW,YAAY;AACvE,eAAO,GAAG,mBAAmB;AAAA,UAC5B,KAAK,KAAK,OAAO,OAAO,KAAK,OAAO;AAAA,UACpC,oBAAoB,KAAK,OAAO,sBAAsB;AAAA,UACtD,aAAa,KAAK,OAAO,eAAe,KAAK,eAAe;AAAA,UAC5D,YAAY,KAAK,OAAO,cAAc,KAAK,cAAc;AAAA,UACzD,WAAW,KAAK,OAAO,aAAa;AAAA,UACpC,UAAU,KAAK,OAAO,YAAY;AAAA,UAClC,QAAQ,KAAK,OAAO,UAAU,KAAK,UAAU;AAAA,UAC7C,QAAQ,KAAK,OAAO,UAAU;AAAA,UAC9B,MAAM,KAAK,OAAO,QAAQ;AAAA,QAAA,CAC1B;AAAA,MACF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/S3SchemaTypes.cjs

@@ -40,6 +40,13 @@ const S3SignedUpload = new graphql.GraphQLObjectType({
     publicUrl: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) }
   }
 });
+const S3DeletedObject = new graphql.GraphQLObjectType({
+  name: "S3DeletedObject",
+  fields: {
+    objectKey: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) },
+    bucket: { type: new graphql.GraphQLNonNull(graphql.GraphQLString) }
+  }
+});
 const S3Acl = new graphql.GraphQLEnumType({
   name: "S3Acl",
   values: {
@@ -64,6 +71,7 @@ const S3GenerateSignedUploadInput = new graphql.GraphQLInputObjectType({
 });
 exports.S3Acl = S3Acl;
 exports.S3ContentDisposition = S3ContentDisposition;
+exports.S3DeletedObject = S3DeletedObject;
 exports.S3GenerateSignedUploadInput = S3GenerateSignedUploadInput;
 exports.S3Header = S3Header;
 exports.S3SignedRead = S3SignedRead;