@cytario/web 2.1.8 → 2.2.0

package/app/utils/signedFetch.ts

@@ -3,38 +3,116 @@ import type { Credentials } from "@aws-sdk/client-sts";
 import { SignatureV4 } from "@smithy/signature-v4";
 
 import type { ConnectionConfig } from "~/.generated/client";
+import { ExpiredCredentialsError, requestCredentialsRefresh } from "~/utils/credentialsRefresh";
 import { sanitizeHeaders } from "~/utils/sanitizeHeaders";
 
 export type SignedFetch = (url: string, init?: RequestInit) => Promise<Response>;
 
-// Image tile/chunk bytes are immutable per object version → 7-day cache.
+/**
+ * Lowercase header names the SigV4 signer emits. The CORS probe lists these
+ * in `Access-Control-Request-Headers` so the OPTIONS preflight carries the
+ * same set as the eventual GET. Keep in sync with `signer.sign` below.
+ */
+export const SIGNED_REQUEST_HEADERS = [
+  "authorization",
+  "x-amz-content-sha256",
+  "x-amz-date",
+  "x-amz-security-token",
+] as const;
+
+/**
+ * Thrown when a browser fetch fails before a Response — almost always a
+ * CORS misconfiguration on the bucket. Caller error paths instanceof-check
+ * this to surface a dedicated toast.
+ */
+export class CorsLikelyError extends Error {
+  public readonly host: string;
+  public readonly origin: string;
+
+  constructor(host: string, origin: string, cause?: unknown) {
+    super(
+      `Browser was blocked from reading "${host}" — likely a CORS misconfiguration on the bucket.`,
+    );
+    this.name = "CorsLikelyError";
+    this.host = host;
+    this.origin = origin;
+    if (cause !== undefined) {
+      (this as { cause?: unknown }).cause = cause;
+    }
+  }
+}
+
+function isLikelyCorsFailure(error: unknown): boolean {
+  if (!(error instanceof TypeError)) return false;
+  const message = error.message ?? "";
+  return (
+    message.includes("Failed to fetch") ||
+    message.includes("Load failed") ||
+    message.includes("NetworkError when attempting to fetch resource") ||
+    message.includes("NetworkError")
+  );
+}
+
+async function fetchWithCorsDetection(
+  url: string,
+  init: RequestInit,
+  host: string,
+  origin: string,
+): Promise<Response> {
+  try {
+    return await fetch(url, init);
+  } catch (error) {
+    if (isLikelyCorsFailure(error)) {
+      throw new CorsLikelyError(host, origin, error);
+    }
+    throw error;
+  }
+}
+
+/**
+ * Detect expired-token bodies on a cloned response (the caller still owns the
+ * unread body). AWS: 400 + `ExpiredToken`; MinIO: 403 + `ExpiredTokenException`.
+ */
+async function isExpiredTokenResponse(response: Response): Promise<boolean> {
+  if (response.status !== 400 && response.status !== 403) return false;
+  try {
+    const body = await response.clone().text();
+    return (
+      body.includes("<Code>ExpiredToken</Code>") ||
+      body.includes("<Code>ExpiredTokenException</Code>")
+    );
+  } catch {
+    return false;
+  }
+}
+
+// Tile/chunk bytes are immutable per object version → 7-day cache.
 const IMAGE_DATA_CACHE_CONTROL = "private, max-age=604800";
 
-// Sidecars, overlays, JSON companions → 1-hour ceiling so analyst
+// Sidecars / overlays / JSON companions → 1-hour ceiling so analyst
 // regenerations surface without an explicit purge.
 const OTHER_DATA_CACHE_CONTROL = "private, max-age=3600";
 
-// TIFF/OME-TIFF reads, or OME-Zarr chunks whose last path segment is digits
-// only (`image.zarr/0/0/0` or `image.zarr/0.0.0`).
+// Matches TIFF/OME-TIFF reads and OME-Zarr chunk filenames (digits-only).
 function isImageDataPath(pathname: string): boolean {
   return /\.tiff?$/i.test(pathname) || /\/\d+(?:\.\d+)*$/.test(pathname);
 }
 
 /**
- * SigV4-signing fetch. Credentials are resolved lazily per call so the signer
- * is recreated when AccessKeyId rotates. Every GET injects a
- * `response-cache-control` query override so the storage backend echoes a
- * Cache-Control directive — the browser HTTP cache then serves repeat reads
- * without a network round-trip.
+ * SigV4-signing fetch. Credentials resolve lazily so the signer is rebuilt
+ * when `AccessKeyId` rotates. Every GET injects `response-cache-control` so
+ * the browser HTTP cache can serve repeat reads without a network round-trip.
  */
 export function createSignedFetch(
   getCredentials: () => Credentials,
   connectionConfig: Pick<ConnectionConfig, "region">,
+  connectionName?: string,
 ): SignedFetch {
   let cachedKeyId: string | undefined;
   let signer: SignatureV4;
 
-  return async (url: string, init?: RequestInit): Promise<Response> => {
+  // Closured so the ExpiredToken retry path can rebuild with refreshed creds.
+  const buildSignedRequest = async (url: string, init?: RequestInit) => {
     const credentials = getCredentials();
 
     if (!credentials.AccessKeyId || !credentials.SecretAccessKey) {
@@ -51,33 +129,34 @@ export function createSignedFetch(
         region: connectionConfig.region || "eu-central-1",
         service: "s3",
         sha256: Sha256,
+        // S3 paths are pre-encoded; the signer must not double-encode.
+        uriEscapePath: false,
       });
       cachedKeyId = credentials.AccessKeyId;
     }
 
     const parsed = new URL(url);
 
-    // Decode so the signer can re-encode canonically — without this,
-    // percent-encoded chars get double-encoded and the signature breaks.
-    const decodedPath = decodeURIComponent(parsed.pathname);
-
     const cacheControl = isImageDataPath(parsed.pathname)
       ? IMAGE_DATA_CACHE_CONTROL
       : OTHER_DATA_CACHE_CONTROL;
 
-    // Only the host header is signed — Range etc. pass through unsigned to
-    // avoid CORS/signature mismatches. Caller-supplied headers run through
-    // sanitizeHeaders, and the merge order below puts signed headers LAST
-    // so a bypass of sanitizeHeaders still cannot override the signature.
+    // Signed headers merge LAST so a bypass of `sanitizeHeaders` cannot
+    // override the signature.
     const callerHeaders = sanitizeHeaders(init?.headers as Record<string, string> | undefined);
 
+    // Pre-populate the signer's query map so caller-supplied params
+    // (e.g. `?versionId=...`) survive — otherwise the wire URL drops them.
+    const query: Record<string, string> = Object.fromEntries(parsed.searchParams);
+    query["response-cache-control"] = cacheControl;
+
     const request = {
       method: (init?.method as string) ?? "GET",
       protocol: parsed.protocol,
       hostname: parsed.hostname,
       port: parsed.port ? parseInt(parsed.port) : undefined,
-      path: decodedPath,
-      query: { "response-cache-control": cacheControl },
+      path: parsed.pathname,
+      query,
       headers: {
         host: parsed.host,
       },
@@ -85,9 +164,24 @@ export function createSignedFetch(
 
     const signed = await signer.sign(request);
 
-    const wireUrl = `${parsed.origin}${parsed.pathname}?response-cache-control=${encodeURIComponent(cacheControl)}`;
-
-    return fetch(wireUrl, {
+    // RFC-3986 strict encoding — `URLSearchParams.toString()` form-encodes
+    // and would break the signature on reserved characters.
+    const wireQuery = Object.entries(query)
+      .map(
+        ([key, value]) =>
+          `${encodeURIComponent(key).replace(/[!*'()]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)}=${encodeURIComponent(
+            value,
+          ).replace(/[!*'()]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)}`,
+      )
+      .join("&");
+    const wireUrl = `${parsed.origin}${parsed.pathname}?${wireQuery}`;
+
+    const browserOrigin =
+      typeof window !== "undefined" && typeof window.location?.origin === "string"
+        ? window.location.origin
+        : "";
+
+    const fetchInit: RequestInit = {
       ...init,
       method: request.method,
       headers: {
@@ -95,6 +189,47 @@ export function createSignedFetch(
         ...(signed.headers as Record<string, string>),
       },
       signal: init?.signal,
-    });
+      // Block redirect-following — `fetch` would otherwise re-send the
+      // Authorization header (and the STS token) to whatever host the 30x
+      // points at.
+      redirect: "error",
+    };
+
+    return { wireUrl, fetchInit, host: parsed.host, browserOrigin };
+  };
+
+  return async (url: string, init?: RequestInit): Promise<Response> => {
+    const first = await buildSignedRequest(url, init);
+    const response = await fetchWithCorsDetection(
+      first.wireUrl,
+      first.fetchInit,
+      first.host,
+      first.browserOrigin,
+    );
+
+    if (await isExpiredTokenResponse(response)) {
+      if (!connectionName) {
+        throw new ExpiredCredentialsError(
+          "STS credentials expired and no connection name was provided to signedFetch.",
+        );
+      }
+      await requestCredentialsRefresh(connectionName);
+      const retried = await buildSignedRequest(url, init);
+      const retryResponse = await fetchWithCorsDetection(
+        retried.wireUrl,
+        retried.fetchInit,
+        retried.host,
+        retried.browserOrigin,
+      );
+      if (await isExpiredTokenResponse(retryResponse)) {
+        throw new ExpiredCredentialsError(
+          "STS credentials expired and refresh did not yield a working session.",
+          connectionName,
+        );
+      }
+      return retryResponse;
+    }
+
+    return response;
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cytario/web",
-  "version": "2.1.8",
+  "version": "2.2.0",
   "description": "Cytario Web — scientific imaging data browser and viewer for OME-TIFF, OME-Zarr, Parquet and GeoTIFF on S3-compatible storage.",
   "license": "AGPL-3.0",
   "sideEffects": false,
@@ -54,7 +54,7 @@
     "build:server": "tsup --config tsup.server.config.ts",
     "codegen:check": "tsx scripts/codegen-check.ts",
     "dev": "node bin/cytario-web.mjs dev",
-    "predev": "if [ -L node_modules/@cytario/design ]; then npm unlink @cytario/design --no-save 2>/dev/null && npm install @cytario/design --quiet; fi",
+    "predev": "node scripts/prebuild.mjs && if [ -L node_modules/@cytario/design ]; then npm unlink @cytario/design --no-save 2>/dev/null && npm install @cytario/design --quiet; fi",
     "predev:design": "cd ../cytario-design && npm link --quiet && cd - > /dev/null && npm link @cytario/design --quiet && for p in react react-dom react-aria-components; do rm -rf ../cytario-design/node_modules/$p && ln -s \"$(pwd)/node_modules/$p\" ../cytario-design/node_modules/$p; done",
     "dev:design": "concurrently -n tsup,storybook,web -c blue,magenta,green \"cd ../cytario-design && npx tsup --watch\" \"cd ../cytario-design && npm run dev\" \"node bin/cytario-web.mjs dev\"",
     "lint": "eslint --cache --cache-location ./node_modules/.cache/eslint .",

package/prisma/seed.ts

@@ -4,7 +4,7 @@
  * Creates test fixtures in a fresh database. Runs automatically after
  * `prisma db push` or explicitly via `npx prisma db seed`.
  *
- * Both connections point to the same bucket (slashm-ultivue-exchange).
+ * Both connections point to the same bucket (shared-bucket-example).
  * The prefixed connection tests prefix-based directory listing without
  * requiring a separate bucket or cross-bucket auth setup.
  */
@@ -22,7 +22,7 @@ const TEST_PREFIX_CONNECTION_NAME = process.env.E2E_PREFIX_CONNECTION_NAME || "E
 const SHARED_BUCKET = {
   ownerScope: "cytario",
   createdBy: "e2e-seed",
-  bucketName: "slashm-ultivue-exchange",
+  bucketName: "shared-bucket-example",
   provider: "aws" as const,
   endpoint: "https://s3.eu-central-1.amazonaws.com",
   roleArn: "arn:aws:iam::727043715722:role/keycloack-aws-test-iam-role",
@@ -46,7 +46,7 @@ async function seed() {
     create: {
       ...SHARED_BUCKET,
       name: TEST_PREFIX_CONNECTION_NAME,
-      prefix: "Ascent Pharma Group",
+      prefix: "Alpha Lab",
     },
   });
 

package/public/duckdb-extensions/checksums.json

@@ -0,0 +1,12 @@
+{
+  "$comment": "SHA-256 checksums for DuckDB-WASM extensions mirrored locally. Pinned by scripts/download-duckdb-extensions.mjs — every entry must be reviewed and re-populated by hand at each DuckDB core version bump. Keys are `v<version>/<platform>/<ext>`.",
+  "v1.4.3/wasm_eh/httpfs": "5e76d1fb0779c4803ebfd6fb49b80ff833c11b9a6f55208a701e63a491df1d5c",
+  "v1.4.3/wasm_eh/parquet": "22765c8f7dc741cda2b571a66ac7bb355295d7d69a6c37e5315b265672984f55",
+  "v1.4.3/wasm_eh/spatial": "04b776946da64a15a7b14501790c75093e38f876acc46b2922f0daeb6aaa1d60",
+  "v1.4.3/wasm_mvp/httpfs": "88e7d15f1c6ac066cca28b4ee1046486a5110783dea82c28fc4f973924f12498",
+  "v1.4.3/wasm_mvp/parquet": "0785c6c95d003eff4faa7b3b4b660f02c9c92f6d68d135ddf330d42e3a650600",
+  "v1.4.3/wasm_mvp/spatial": "7a745cfc5259f69b46f077bc6afeb7a6aefb8ef8d8b336bb0b770e5449708bb4",
+  "v1.4.3/wasm_threads/httpfs": "20b0a02de0b0a7de2a846bc40d5b504f031580949c7e5828c9da672a8961d241",
+  "v1.4.3/wasm_threads/parquet": "4bae942b3a6d2b68f92203408c2b45b66cb107ec3fa119e0f000f368810ca98b",
+  "v1.4.3/wasm_threads/spatial": "83ad79d02f1dc5d72a0d5d63fa4a49e9f2a9413e947e889956f3ffabaee095c6"
+}

package/scripts/download-duckdb-extensions.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+/* global console, process, fetch, Buffer */
+/**
+ * Download the DuckDB-WASM extensions cytario relies on (httpfs, spatial)
+ * for every WASM build variant the runtime might pick, and write them
+ * under `public/duckdb-extensions/v<duckdb-version>/<platform>/...`.
+ *
+ * Why bundle:
+ *   - Privacy: `INSTALL httpfs;` at session start otherwise leaks every
+ *     user's IP + Referer to `extensions.duckdb.org` (Cloudflare). Same
+ *     reason we removed the runtime `jsdelivr` fetch for the core WASM
+ *     module (see `app/utils/db/duckdbBundles.ts`).
+ *   - CSP: our `connect-src` allowlist intentionally excludes third-party
+ *     CDNs; without local mirrors the page-load `INSTALL` blocks.
+ *
+ * Vite serves anything in `public/` from the document origin verbatim.
+ * `createDatabase.ts` points DuckDB at this local mirror via
+ *   `SET custom_extension_repository='<origin>/duckdb-extensions/';`
+ * before issuing `INSTALL <ext>; LOAD <ext>;`. DuckDB then fetches
+ *   `<repo>/v<version>/<platform>/<ext>.duckdb_extension.wasm`
+ * which matches the upstream `extensions.duckdb.org` layout.
+ *
+ * Supply-chain trust:
+ *   `allowUnsignedExtensions: true` in `createDatabase.ts` disables
+ *   DuckDB's own signature check, so this script is the ONLY integrity
+ *   gate on the wasm payload. `public/duckdb-extensions/checksums.json`
+ *   pins a SHA-256 per `{version, platform, ext}`. Behaviour:
+ *     - Missing checksum entry → fail. Operator must add the entry by
+ *       hand at every DuckDB core version bump (reviewed in a diff).
+ *     - Existing local file with matching hash → skip.
+ *     - Existing local file with mismatched hash → refuse to overwrite
+ *       and abort, so a poisoned mirror is loud, not silent.
+ *     - Fresh download with mismatched hash → refuse to write to disk.
+ *
+ * The DuckDB CORE version bundled inside `@duckdb/duckdb-wasm` is pinned
+ * here. The script aborts loudly when the duckdb-wasm major / minor
+ * changes — a manual review (and probably a version bump here) is the
+ * right response, not a silent re-download against an unverified URL.
+ */
+
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(HERE, "..");
+
+const DUCKDB_WASM_PACKAGE = resolve(
+  REPO_ROOT,
+  "node_modules",
+  "@duckdb",
+  "duckdb-wasm",
+  "package.json",
+);
+
+// duckdb-wasm v1.32.x embeds DuckDB v1.4.3 (verified by `strings ./*.wasm`).
+// Bump this constant when bumping duckdb-wasm to a release that targets a
+// different DuckDB core.
+const SUPPORTED_DUCKDB_WASM = "1.32.";
+const DUCKDB_CORE_VERSION = "1.4.3";
+
+const PLATFORMS = ["wasm_mvp", "wasm_eh", "wasm_threads"];
+// `parquet` is autoloaded by DuckDB on the first `parquet_scan(...)` —
+// must be mirrored alongside the explicitly INSTALLed extensions.
+const EXTENSIONS = ["httpfs", "spatial", "parquet"];
+
+const UPSTREAM_REPO = "https://extensions.duckdb.org";
+const OUTPUT_ROOT = resolve(REPO_ROOT, "public", "duckdb-extensions");
+const CHECKSUMS_FILE = resolve(OUTPUT_ROOT, "checksums.json");
+
+function checkVersion() {
+  const pkg = JSON.parse(readFileSync(DUCKDB_WASM_PACKAGE, "utf8"));
+  const v = pkg.version ?? "";
+  if (!v.startsWith(SUPPORTED_DUCKDB_WASM)) {
+    console.error(
+      `[duckdb-extensions] @duckdb/duckdb-wasm@${v} is not in the supported range (${SUPPORTED_DUCKDB_WASM}*).`,
+    );
+    console.error(
+      "[duckdb-extensions] Update DUCKDB_CORE_VERSION in scripts/download-duckdb-extensions.mjs after verifying the new mapping with `strings node_modules/@duckdb/duckdb-wasm/dist/duckdb-eh.wasm | grep '^v1\\.'`.",
+    );
+    process.exit(1);
+  }
+}
+
+function loadChecksums() {
+  if (!existsSync(CHECKSUMS_FILE)) {
+    throw new Error(
+      `Missing ${CHECKSUMS_FILE}. The integrity manifest must exist before any download — populate it manually at every DuckDB core version bump.`,
+    );
+  }
+  const raw = JSON.parse(readFileSync(CHECKSUMS_FILE, "utf8"));
+  // Strip JSON-comment-style keys so callers can iterate values safely.
+  const entries = Object.fromEntries(Object.entries(raw).filter(([k]) => !k.startsWith("$")));
+  return entries;
+}
+
+function sha256(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
+}
+
+async function downloadOne({ url, destination, key, expectedHash }) {
+  if (existsSync(destination)) {
+    const localHash = sha256(readFileSync(destination));
+    if (localHash === expectedHash) {
+      return { destination, key, skipped: true };
+    }
+    throw new Error(
+      `[duckdb-extensions] integrity mismatch for ${key}: on-disk SHA-256 ${localHash} does not match checksums.json ${expectedHash}. Refusing to overwrite — delete the file manually after investigating.`,
+    );
+  }
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(`Failed to download ${url} — ${res.status} ${res.statusText}`);
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  const downloadedHash = sha256(buf);
+  if (downloadedHash !== expectedHash) {
+    throw new Error(
+      `[duckdb-extensions] integrity mismatch for ${key}: downloaded SHA-256 ${downloadedHash} does not match checksums.json ${expectedHash}. Refusing to write to disk.`,
+    );
+  }
+  mkdirSync(dirname(destination), { recursive: true });
+  writeFileSync(destination, buf);
+  return { destination, key, skipped: false, bytes: buf.byteLength };
+}
+
+async function main() {
+  checkVersion();
+  const checksums = loadChecksums();
+
+  const tasks = [];
+  for (const platform of PLATFORMS) {
+    for (const ext of EXTENSIONS) {
+      const key = `v${DUCKDB_CORE_VERSION}/${platform}/${ext}`;
+      const expectedHash = checksums[key];
+      if (!expectedHash) {
+        // Fail loudly: an operator bumping the DuckDB version must
+        // populate checksums.json by hand so the diff documents the
+        // new trust anchor. Silent allow would defeat the integrity gate.
+        throw new Error(
+          `[duckdb-extensions] no checksum entry for ${key} in public/duckdb-extensions/checksums.json. Populate it manually after verifying the upstream binary, then re-run.`,
+        );
+      }
+      const path = `/v${DUCKDB_CORE_VERSION}/${platform}/${ext}.duckdb_extension.wasm`;
+      tasks.push({
+        url: `${UPSTREAM_REPO}${path}`,
+        destination: resolve(
+          OUTPUT_ROOT,
+          `v${DUCKDB_CORE_VERSION}`,
+          platform,
+          `${ext}.duckdb_extension.wasm`,
+        ),
+        key,
+        expectedHash,
+      });
+    }
+  }
+
+  // L-C: parallelize. `Promise.all` does not preserve console-log order,
+  // but each line is self-describing (it carries the destination path),
+  // so an operator reading the output can still tell which file did what.
+  const results = await Promise.all(tasks.map(downloadOne));
+
+  let downloaded = 0;
+  let skipped = 0;
+  for (const result of results) {
+    if (result.skipped) {
+      skipped++;
+    } else {
+      downloaded++;
+      console.log(
+        `[duckdb-extensions] ${result.bytes} bytes → ${result.destination.replace(REPO_ROOT + "/", "")}`,
+      );
+    }
+  }
+
+  if (downloaded > 0) {
+    console.log(
+      `[duckdb-extensions] downloaded ${downloaded} extension(s), skipped ${skipped} (already present, integrity verified)`,
+    );
+  }
+}
+
+main().catch((err) => {
+  console.error(`[duckdb-extensions] ${err.message}`);
+  process.exit(1);
+});

package/scripts/prebuild.mjs

@@ -1,9 +1,13 @@
 #!/usr/bin/env node
 /* global process */
-// Regenerate `@cytario/plugin-api`'s `src/version.ts` from the latest
-// `plugin-api-v*` git tag — but only when the workspace source is
-// present. Becomes a no-op inside a published `@cytario/web` install
-// where the workspace source is not shipped.
+// Workspace-only build prep:
+//   1. Regenerate `@cytario/plugin-api`'s `src/version.ts` from the latest
+//      `plugin-api-v*` git tag.
+//   2. Download the DuckDB-WASM extensions (httpfs, spatial) into
+//      `public/duckdb-extensions/` so the runtime can `INSTALL` them from
+//      the cytario origin instead of `extensions.duckdb.org`.
+// Both steps become no-ops inside a published `@cytario/web` install where
+// the workspace source is not shipped.
 
 import { existsSync } from "node:fs";
 import { spawnSync } from "node:child_process";
@@ -11,12 +15,16 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const TARGET = resolve(HERE, "..", "packages", "plugin-api", "scripts", "write-version.mjs");
 
-if (!existsSync(TARGET)) {
-  // Published @cytario/web tarball — plugin-api source is not shipped.
-  process.exit(0);
+function run(targetRelative) {
+  const target = resolve(HERE, "..", targetRelative);
+  if (!existsSync(target)) return 0;
+  const result = spawnSync(process.execPath, [target], { stdio: "inherit" });
+  return result.status ?? 0;
 }
 
-const result = spawnSync(process.execPath, [TARGET], { stdio: "inherit" });
-process.exit(result.status ?? 0);
+const versionStatus = run("packages/plugin-api/scripts/write-version.mjs");
+if (versionStatus !== 0) process.exit(versionStatus);
+
+const extensionsStatus = run("scripts/download-duckdb-extensions.mjs");
+process.exit(extensionsStatus);

package/app/.server/auth/getPresignedUrl.ts

@@ -1,21 +0,0 @@
-import { GetObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-
-import { ConnectionConfig } from "~/.generated/client";
-
-/**
- * Generate a presigned URL for an object in S3.
- */
-export const getPresignedUrl = async (
-  connectionConfig: ConnectionConfig,
-  s3Client: S3Client,
-  key: string,
-) => {
-  const command = new GetObjectCommand({ Bucket: connectionConfig.bucketName, Key: key });
-
-  const url = await getSignedUrl(s3Client, command, {
-    expiresIn: 60 * 60 * 1, // 1 hour
-  });
-
-  return url;
-};

package/app/.server/auth/getS3Client.ts

@@ -1,93 +0,0 @@
-import { S3Client } from "@aws-sdk/client-s3";
-import { Credentials } from "@aws-sdk/client-sts";
-import crypto from "crypto";
-import { LRUCache } from "lru-cache";
-
-import { ConnectionConfig } from "~/.generated/client";
-import { isAwsS3Endpoint } from "~/utils/s3Provider";
-
-interface CacheEntry {
-  client: S3Client;
-  userId: string;
-  bucketName: string;
-}
-
-/**
- * User-scoped S3Client cache with TTL and LRU eviction.
- * Prevents cross-user data leakage and handles credential expiration.
- */
-const s3ClientCache = new LRUCache<string, CacheEntry>({
-  max: 10000,
-  ttl: 3600000, // 1 hour in milliseconds (matches typical STS credential TTL)
-});
-
-/**
- * Creates a unique cache key scoped to user, bucket, and credential identity.
- */
-const createCacheKey = (userId: string, bucketName: string, credentials: Credentials): string => {
-  // Hash credentials to detect when they change (e.g., after refresh)
-  const credHash = crypto
-    .createHash("sha256")
-    .update(`${credentials.AccessKeyId}:${credentials.SecretAccessKey}:${credentials.SessionToken}`)
-    .digest("hex")
-    .substring(0, 16);
-
-  return `${userId}:${bucketName}:${credHash}`;
-};
-
-export const getS3Client = async (
-  connectionConfig: ConnectionConfig,
-  credentials: Credentials,
-  userId: string,
-): Promise<S3Client> => {
-  const { bucketName, region, endpoint } = connectionConfig;
-  const { AccessKeyId, SecretAccessKey, SessionToken } = credentials;
-
-  if (!AccessKeyId || !SecretAccessKey) throw Error("No Credentials");
-  if (!userId) throw Error("User ID is required for S3Client cache");
-
-  // Check cache first
-  const key = createCacheKey(userId, bucketName, credentials);
-  const cachedEntry = s3ClientCache.get(key);
-  if (cachedEntry) {
-    return cachedEntry.client;
-  }
-
-  // Use default region if null
-  const actualRegion = region ?? "eu-central-1";
-
-  // Detect if this is AWS S3 or a compatible service (MinIO, etc.)
-  const isAwsS3 = isAwsS3Endpoint(endpoint);
-
-  const s3Client = new S3Client({
-    region: actualRegion,
-    // Only set endpoint for non-AWS S3 services
-    ...(endpoint && !isAwsS3 ? { endpoint } : {}),
-    credentials: {
-      accessKeyId: AccessKeyId,
-      secretAccessKey: SecretAccessKey,
-      sessionToken: SessionToken,
-    },
-    // Only use path style for non-AWS S3 services (MinIO, etc.)
-    forcePathStyle: !isAwsS3,
-  });
-
-  // Cache the client
-  s3ClientCache.set(key, {
-    client: s3Client,
-    userId,
-    bucketName,
-  });
-
-  return s3Client;
-};
-
-/** Remove all cached S3 clients for a given user + bucket (e.g. after config change). */
-export const invalidateS3ClientsForBucket = (userId: string, bucketName: string): void => {
-  for (const key of s3ClientCache.keys()) {
-    const entry = s3ClientCache.peek(key);
-    if (entry && entry.userId === userId && entry.bucketName === bucketName) {
-      s3ClientCache.delete(key);
-    }
-  }
-};