@cytario/web 2.2.2 → 2.2.3

package/app/.server/auth/getSessionCredentials.ts

@@ -52,7 +52,9 @@ const fetchTemporaryCredentials = async (
     // Non-AWS providers (e.g. MinIO) may ignore or reject the `Policy` field,
     // so we omit it there — the role's intrinsic scope is the only bound.
     const sessionPolicy =
-      provider === "aws" ? buildSessionPolicy({ bucketName, prefix }) : undefined;
+      provider === "aws"
+        ? buildSessionPolicy({ bucketName, prefix, region: actualRegion })
+        : undefined;
 
     const command = new AssumeRoleWithWebIdentityCommand({
       RoleArn: roleArn ?? undefined,

package/app/.server/auth/sessionPolicy.ts

@@ -12,12 +12,13 @@
 export interface SessionPolicyArgs {
   bucketName: string;
   prefix: string | null | undefined;
+  region: string;
 }
 
 const stripSlashes = (prefix: string): string => prefix.replace(/^\/+|\/+$/g, "");
 
 /** Build an inline IAM session policy for `AssumeRoleWithWebIdentityCommand`. */
-export const buildSessionPolicy = ({ bucketName, prefix }: SessionPolicyArgs): string => {
+export const buildSessionPolicy = ({ bucketName, prefix, region }: SessionPolicyArgs): string => {
   const normalised = typeof prefix === "string" ? stripSlashes(prefix) : "";
   // Defense-in-depth: refuse wildcards here so the schema is not the only gate
   // protecting cross-tenant `StringLike` conditions.
@@ -52,6 +53,23 @@ export const buildSessionPolicy = ({ bucketName, prefix }: SessionPolicyArgs): s
         Resource: bucketArn,
       };
 
+  // STS intersects this policy with the role's attached policy. Without an
+  // explicit `kms:Decrypt` here, the role's KMS grant is stripped and
+  // `GetObject` against SSE-KMS-encrypted buckets fails. `kms:ViaService`
+  // restricts use of the minted credential to the S3 data path; the role's
+  // attached policy remains the authoritative key allowlist.
+  const decryptStatement = {
+    Sid: "DecryptViaS3",
+    Effect: "Allow",
+    Action: "kms:Decrypt",
+    Resource: "*",
+    Condition: {
+      StringEquals: {
+        "kms:ViaService": `s3.${region}.amazonaws.com`,
+      },
+    },
+  };
+
   const policy = {
     Version: "2012-10-17",
     Statement: [
@@ -62,6 +80,7 @@ export const buildSessionPolicy = ({ bucketName, prefix }: SessionPolicyArgs): s
         Action: "s3:GetObject",
         Resource: objectArn,
       },
+      decryptStatement,
     ],
   };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cytario/web",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Cytario Web — scientific imaging data browser and viewer for OME-TIFF, OME-Zarr, Parquet and GeoTIFF on S3-compatible storage.",
   "license": "AGPL-3.0",
   "sideEffects": false,