@contember/engine-s3-plugin 2.2.0-alpha.3 → 2.2.0-alpha.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-s3-plugin",
-  "version": "2.2.0-alpha.3",
+  "version": "2.2.0-alpha.6",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -23,9 +23,9 @@
     }
   },
   "dependencies": {
-    "@contember/engine-plugins": "2.2.0-alpha.3",
-    "@contember/graphql-utils": "2.2.0-alpha.3",
-    "@contember/typesafe": "2.2.0-alpha.3",
+    "@contember/engine-plugins": "2.2.0-alpha.6",
+    "@contember/graphql-utils": "2.2.0-alpha.6",
+    "@contember/typesafe": "2.2.0-alpha.6",
     "mime-types": "^3.0.2",
     "picomatch": "^4.0.3",
     "qs": "^6.15.0",

package/src/Config.ts

@@ -2,6 +2,7 @@ import * as Typesafe from '@contember/typesafe'
 
 export enum S3Providers {
 	aws = 'aws',
+	// Path-style addressing with no object ACL — the right value for any MinIO-compatible server, SeaweedFS included.
 	minio = 'minio',
 	ceph = 'ceph',
 	localstack = 'localstack',

package/src/S3ObjectAuthorizator.ts

@@ -13,16 +13,24 @@ export type S3ObjectReadRule = {
 	matcher?: (key: string) => boolean
 }
 
+export type S3ObjectDeleteRule = {
+	pattern: string
+	matcher?: (key: string) => boolean
+}
+
 export class S3ObjectAuthorizator {
 	private readonly uploadRules: S3ObjectUploadRule[]
 	private readonly readRules: S3ObjectReadRule[]
+	private readonly deleteRules: S3ObjectDeleteRule[]
 
 	constructor(
 		uploadRules: Omit<S3ObjectUploadRule, 'matcher'>[],
 		readRules: Omit<S3ObjectReadRule, 'matcher'>[],
+		deleteRules: Omit<S3ObjectDeleteRule, 'matcher'>[] = [],
 	) {
 		this.uploadRules = uploadRules
 		this.readRules = readRules
+		this.deleteRules = deleteRules
 	}
 
 	public verifyReadAccess({ key }: { key: string }): void {
@@ -37,6 +45,18 @@ export class S3ObjectAuthorizator {
 		throw new ForbiddenError(`Read access forbidden for object key ${key}`)
 	}
 
+	public verifyDeleteAccess({ key }: { key: string }): void {
+		for (const rule of this.deleteRules) {
+			rule.matcher ??= pm(rule.pattern)
+
+			if (rule.matcher(key)) {
+				return
+			}
+		}
+
+		throw new ForbiddenError(`Delete access forbidden for object key ${key}`)
+	}
+
 	public verifyUploadAccess({ key, size }: { key: string; size: number | null }): void {
 		const matchedPatterns: S3ObjectUploadRule[] = []
 

package/src/S3SchemaContributor.ts

@@ -12,7 +12,7 @@ import { S3Service, S3ServiceFactory } from './S3Service.js'
 import { Project3Config, resolveS3Config, S3Config } from './Config.js'
 import { GraphQLSchemaContributor, GraphQLSchemaContributorContext, Providers } from '@contember/engine-plugins'
 import * as types from './S3SchemaTypes.js'
-import { S3Acl, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes.js'
+import { S3Acl, S3DeletedObject, S3GenerateSignedUploadInput, S3SignedRead, S3SignedUpload } from './S3SchemaTypes.js'
 import { S3ObjectAuthorizator } from './S3ObjectAuthorizator.js'
 
 interface Identity {
@@ -30,6 +30,7 @@ export type S3SchemaAcl = Record<
 	{
 		read?: boolean
 		upload?: S3SchemaUploadAcl
+		delete?: boolean
 	}
 >
 
@@ -56,17 +57,23 @@ export class S3SchemaContributor implements GraphQLSchemaContributor {
 		const readRules = rules.filter(([, it]) => it.read).map(([it]) => ({
 			pattern: it,
 		}))
+		const deleteRules = rules.filter(([, it]) => it.delete).map(([it]) => ({
+			pattern: it,
+		}))
 
-		if (uploadRules.length === 0 && readRules.length === 0) {
+		if (uploadRules.length === 0 && readRules.length === 0 && deleteRules.length === 0) {
 			return undefined
 		}
 
-		const authorizator = new S3ObjectAuthorizator(uploadRules, readRules)
+		const authorizator = new S3ObjectAuthorizator(uploadRules, readRules, deleteRules)
 		const uploadMutation = this.createUploadMutation(authorizator)
 		const readMutation = this.createReadMutation(authorizator)
+		const deleteMutation = this.createDeleteMutation(authorizator)
 		const mutation = {
 			generateUploadUrl: uploadMutation as GraphQLFieldConfig<any, any, any>,
 			generateReadUrl: readMutation,
+			// not "deleteObject" — a content mutation for an entity named "Object" would shadow it
+			deleteS3Object: deleteMutation,
 		}
 		return {
 			mutation: new GraphQLObjectType({
@@ -106,6 +113,25 @@ export class S3SchemaContributor implements GraphQLSchemaContributor {
 		} as GraphQLFieldConfig<any, any, any>
 	}
 
+	private createDeleteMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {
+		return {
+			type: new GraphQLNonNull(S3DeletedObject),
+			args: {
+				objectKey: {
+					type: new GraphQLNonNull(GraphQLString),
+				},
+			},
+			resolve: async (parent: any, args: { objectKey: string }, ctx: { project: Project3Config }) => {
+				if (!ctx.project.s3) {
+					throw new GraphQLError('S3 is not configured for this project')
+				}
+				const s3Config = resolveS3Config(ctx.project.s3)
+				const s3 = this.s3Factory.create(s3Config, this.providers, authorizator)
+				return await s3.deleteObject({ objectKey: args.objectKey })
+			},
+		}
+	}
+
 	private createUploadMutation(authorizator: S3ObjectAuthorizator): GraphQLFieldConfig<any, any, any> {
 		return {
 			type: new GraphQLNonNull(S3SignedUpload),

package/src/S3SchemaTypes.ts

@@ -44,6 +44,14 @@ export const S3SignedUpload = new GraphQLObjectType({
 	},
 })
 
+export const S3DeletedObject = new GraphQLObjectType({
+	name: 'S3DeletedObject',
+	fields: {
+		objectKey: { type: new GraphQLNonNull(GraphQLString) },
+		bucket: { type: new GraphQLNonNull(GraphQLString) },
+	},
+})
+
 export const S3Acl = new GraphQLEnumType({
 	name: 'S3Acl',
 	values: {

package/src/S3Service.ts

@@ -23,6 +23,22 @@ type SignedUploadUrl = {
 	method: string
 }
 
+type DeletedObject = {
+	bucket: string
+	objectKey: string
+}
+
+export type S3FetchResponse = {
+	readonly ok: boolean
+	readonly status: number
+	text(): Promise<string>
+}
+
+export type S3Fetch = (url: string, init: { method: string; signal: AbortSignal }) => Promise<S3FetchResponse>
+
+const deleteUrlExpiration = 60
+const deleteTimeoutMs = 10_000
+
 export class S3Service {
 	private readonly publicBaseUrl: string
 
@@ -32,6 +48,7 @@ export class S3Service {
 		public readonly config: S3Config,
 		private readonly providers: Pick<Providers, 'uuid' | 'now'>,
 		private readonly authorizator: S3ObjectAuthorizator,
+		private readonly fetch: S3Fetch = (url, init) => globalThis.fetch(url, init),
 	) {
 		this.publicBaseUrl = resolveS3PublicBaseUrl(config)
 		this.signer = new S3Signer(config, providers)
@@ -97,38 +114,71 @@ export class S3Service {
 
 	public getSignedReadUrl({ objectKey, expiration }: { objectKey: string; expiration: number | null }): SignedReadUrl {
 		const bucket = this.config.bucket
-
-		const publicPrefix = this.formatPublicUrl('')
-		if (objectKey.startsWith(publicPrefix)) {
-			objectKey = objectKey.substring(publicPrefix.length)
-		}
-		if (this.config.prefix && !objectKey.startsWith(this.config.prefix)) {
-			throw new ForbiddenError(
-				`Given object key "${objectKey}" does not start with a project prefix "${this.config.prefix}"`,
-			)
-		}
-		const localObjectKey = this.config.prefix ? objectKey.substring(this.config.prefix.length + 1) : objectKey
-		this.authorizator.verifyReadAccess({ key: localObjectKey })
+		const resolved = this.resolveObjectKey(objectKey)
+		this.authorizator.verifyReadAccess({ key: resolved.localObjectKey })
 
 		const url = this.signer.sign({
 			action: 'read',
 			expiration: expiration ?? 3600,
-			key: objectKey,
+			key: resolved.objectKey,
 			headers: {},
 		})
 
 		return {
 			bucket,
-			objectKey,
+			objectKey: resolved.objectKey,
 			url,
 			headers: [],
 			method: 'GET',
 		}
 	}
 
+	/**
+	 * Unlike an upload or a read, a delete carries no payload, so the signed URL never leaves the server.
+	 */
+	public async deleteObject({ objectKey }: { objectKey: string }): Promise<DeletedObject> {
+		const bucket = this.config.bucket
+		const resolved = this.resolveObjectKey(objectKey)
+		this.authorizator.verifyDeleteAccess({ key: resolved.localObjectKey })
+
+		const url = this.signer.sign({
+			action: 'delete',
+			expiration: deleteUrlExpiration,
+			key: resolved.objectKey,
+			headers: {},
+		})
+
+		const response = await this.fetch(url, { method: 'DELETE', signal: AbortSignal.timeout(deleteTimeoutMs) })
+		if (!response.ok) {
+			throw new Error(`Failed to delete an object "${resolved.objectKey}": S3 responded with ${response.status}: ${await response.text()}`)
+		}
+
+		return {
+			bucket,
+			objectKey: resolved.objectKey,
+		}
+	}
+
 	public formatPublicUrl(key: string): string {
 		return `${this.publicBaseUrl}/${key}`
 	}
+
+	private resolveObjectKey(objectKey: string): { objectKey: string; localObjectKey: string } {
+		const publicPrefix = this.formatPublicUrl('')
+		if (objectKey.startsWith(publicPrefix)) {
+			objectKey = objectKey.substring(publicPrefix.length)
+		}
+		// the separator is a part of the prefix: without it, a project prefixed "blog" reaches into "blog-staging" in a shared bucket
+		const prefix = this.config.prefix ? this.config.prefix + '/' : ''
+		if (prefix && !objectKey.startsWith(prefix)) {
+			throw new ForbiddenError(
+				`Given object key "${objectKey}" does not start with a project prefix "${this.config.prefix}"`,
+			)
+		}
+		const localObjectKey = objectKey.substring(prefix.length)
+
+		return { objectKey, localObjectKey }
+	}
 }
 
 export class S3ServiceFactory {

package/src/S3Signer.ts

@@ -4,12 +4,18 @@ import qs from 'qs'
 import { BinaryLike, createHash, createHmac } from 'node:crypto'
 
 interface S3Request {
-	action: 'read' | 'upload'
+	action: 'read' | 'upload' | 'delete'
 	key: string
 	expiration: number
 	headers: Record<string, string>
 }
 
+const methods: Record<S3Request['action'], string> = {
+	read: 'GET',
+	upload: 'PUT',
+	delete: 'DELETE',
+}
+
 const hmac = (secret: BinaryLike, data: BinaryLike) => createHmac('sha256', secret).update(data).digest()
 
 const hash = (data: BinaryLike) => createHash('sha256').update(data).digest('hex')
@@ -36,7 +42,7 @@ export class S3Signer {
 		const queryString = this.getQueryParams(request, nowFormatted)
 		const path = uris.basePath + '/' + request.key
 		const lines = [
-			request.action === 'read' ? 'GET' : 'PUT',
+			methods[request.action],
 			path,
 			queryString,
 			this.getSignedHeaders(request),

package/tests/cases/authorizator.test.ts

@@ -13,6 +13,17 @@ test('required upload pattern', () => {
 	expect(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: null })).toThrow('Upload access forbidden for object key lorem.jpg')
 })
 
+test('required delete pattern', () => {
+	const authorizator = new S3ObjectAuthorizator([], [], [{ pattern: 'foo/**' }])
+	expect(() => authorizator.verifyDeleteAccess({ key: 'foo/lorem.jpg' })).not.toThrow()
+	expect(() => authorizator.verifyDeleteAccess({ key: 'lorem.jpg' })).toThrow('Delete access forbidden for object key lorem.jpg')
+})
+
+test('delete is not implied by upload nor read', () => {
+	const authorizator = new S3ObjectAuthorizator([{ pattern: '**' }], [{ pattern: '**' }])
+	expect(() => authorizator.verifyDeleteAccess({ key: 'foo/lorem.jpg' })).toThrow('Delete access forbidden for object key foo/lorem.jpg')
+})
+
 test('max upload size', () => {
 	const authorizator = new S3ObjectAuthorizator([{ pattern: '**', maxSize: 1024 }], [])
 	expect(() => authorizator.verifyUploadAccess({ key: 'lorem.jpg', size: 1000 })).not.toThrow()

package/tests/cases/signRequest.test.ts

@@ -1,9 +1,9 @@
 import { expect, test } from 'bun:test'
-import { S3ObjectAuthorizator, S3Service } from '../../src/index.js'
+import { S3Fetch, S3ObjectAuthorizator, S3Service } from '../../src/index.js'
 
 const mocked = new Date('2021-07-02T17:22Z')
 const constantUuid = '9fce3907-ff2b-45bb-b4ce-eff5527dd315'
-const createS3Service = (bucket: string, prefix = '') =>
+const createS3Service = (bucket: string, prefix = '', fetch?: S3Fetch) =>
 	new S3Service(
 		{
 			bucket,
@@ -18,9 +18,20 @@ const createS3Service = (bucket: string, prefix = '') =>
 			uuid: () => constantUuid,
 			now: () => mocked,
 		},
-		new S3ObjectAuthorizator([{ pattern: '**' }], [{ pattern: '**' }]),
+		new S3ObjectAuthorizator([{ pattern: '**' }], [{ pattern: '**' }], [{ pattern: '**' }]),
+		fetch,
 	)
 
+const createFetchMock = (response: { ok: boolean; status: number; body?: string } = { ok: true, status: 204 }) => {
+	const calls: { url: string; method: string }[] = []
+	const fetch: S3Fetch = async (url, init) => {
+		calls.push({ url, method: init.method })
+		return { ...response, text: async () => response.body ?? '' }
+	}
+
+	return { calls, fetch }
+}
+
 test('sign s3 request', () => {
 	const service = createS3Service('test')
 	const signed = service.getSignedReadUrl({ objectKey: 'foo.jpg', expiration: null })
@@ -37,6 +48,13 @@ test('sign s3 request - prefix', () => {
 	)
 })
 
+test('sign s3 request - a sibling prefix is not a prefix', () => {
+	const service = createS3Service('test', 'lorem')
+	expect(() => service.getSignedReadUrl({ objectKey: 'loremipsum/foo.jpg', expiration: null })).toThrow(
+		'Given object key "loremipsum/foo.jpg" does not start with a project prefix "lorem"',
+	)
+})
+
 test('sign upload', () => {
 	const service = createS3Service('test')
 	const signed = service.getSignedUploadUrl({
@@ -73,6 +91,66 @@ test('sign upload #2', () => {
 	)
 })
 
+test('delete object', async () => {
+	const { calls, fetch } = createFetchMock()
+	const service = createS3Service('test', '', fetch)
+	const deleted = await service.deleteObject({ objectKey: 'foo.jpg' })
+	expect(deleted).toEqual({ bucket: 'test', objectKey: 'foo.jpg' })
+	expect(calls).toEqual([{
+		method: 'DELETE',
+		url:
+			'https://test.s3.eu-central-1.amazonaws.com/foo.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=test%2F20210702%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20210702T172200Z&X-Amz-Expires=60&X-Amz-Signature=441f2003478d8dc8761b6c4c48c6c0805a36d1f088138a5b89d6bea365922663&X-Amz-SignedHeaders=host',
+	}])
+})
+
+test('delete object - public url is accepted', async () => {
+	const { calls, fetch } = createFetchMock()
+	const service = createS3Service('test', 'lorem', fetch)
+	const deleted = await service.deleteObject({
+		objectKey: 'https://test.s3.eu-central-1.amazonaws.com/lorem/foo.jpg',
+	})
+	expect(deleted.objectKey).toEqual('lorem/foo.jpg')
+	expect(calls.length).toEqual(1)
+})
+
+test('delete object - project prefix is enforced', async () => {
+	const { calls, fetch } = createFetchMock()
+	const service = createS3Service('test', 'lorem', fetch)
+	await expect(service.deleteObject({ objectKey: 'ipsum/foo.jpg' })).rejects.toThrow(
+		'Given object key "ipsum/foo.jpg" does not start with a project prefix "lorem"',
+	)
+	expect(calls.length).toEqual(0)
+})
+
+test('delete object - a sibling prefix is not a prefix', async () => {
+	const { calls, fetch } = createFetchMock()
+	const service = createS3Service('test', 'lorem', fetch)
+	await expect(service.deleteObject({ objectKey: 'loremipsum/foo.jpg' })).rejects.toThrow(
+		'Given object key "loremipsum/foo.jpg" does not start with a project prefix "lorem"',
+	)
+	expect(calls.length).toEqual(0)
+})
+
+test('delete object - acl is verified', async () => {
+	const { calls, fetch } = createFetchMock()
+	const service = new S3Service(
+		{ bucket: 'test', region: 'eu-central-1', credentials: { key: 'test', secret: 'abcd' }, prefix: '' },
+		{ uuid: () => constantUuid, now: () => mocked },
+		new S3ObjectAuthorizator([{ pattern: '**' }], [{ pattern: '**' }], [{ pattern: 'foo/**' }]),
+		fetch,
+	)
+	await expect(service.deleteObject({ objectKey: 'bar/foo.jpg' })).rejects.toThrow('Delete access forbidden for object key bar/foo.jpg')
+	expect(calls.length).toEqual(0)
+})
+
+test('delete object - s3 failure', async () => {
+	const { fetch } = createFetchMock({ ok: false, status: 403, body: '<Error>AccessDenied</Error>' })
+	const service = createS3Service('test', '', fetch)
+	await expect(service.deleteObject({ objectKey: 'foo.jpg' })).rejects.toThrow(
+		'Failed to delete an object "foo.jpg": S3 responded with 403: <Error>AccessDenied</Error>',
+	)
+})
+
 test('bucket with dot', () => {
 	const service = createS3Service('test.foo')
 	const signed = service.getSignedReadUrl({ objectKey: 'foo.jpg', expiration: null })