@dimah-s3/server 0.8.6 → 1.0.0

package/dist/plugins.js

@@ -1,35 +1,10 @@
-import { S3_API_ROUTES, isAPIError, DimahS3Error, S3_ERROR_CODES, confirmBodySchema, deleteQuerySchema, downloadQuerySchema, multipartAbortBodySchema, multipartCompleteBodySchema, multipartInitBodySchema, multipartListPartsQuerySchema, multipartSignPartBodySchema, uploadBodySchema, parseFileName, buildContentDisposition } from '@dimah-s3/core';
-import { HeadObjectCommand, DeleteObjectCommand, GetObjectCommand, AbortMultipartUploadCommand, ListPartsCommand, CompleteMultipartUploadCommand, CreateMultipartUploadCommand, UploadPartCommand, PutObjectCommand, GetObjectAclCommand } from '@aws-sdk/client-s3';
+import { S3_API_ROUTES, isAPIError, DimahS3Error, S3_ERROR_CODES, confirmBodySchema, deleteQuerySchema, downloadQuerySchema, multipartAbortBodySchema, multipartCompleteBodySchema, multipartInitBodySchema, multipartListPartsQuerySchema, multipartSignPartBodySchema, uploadBodySchema, parseFileName, S3_MAX_EXPIRES_IN, buildContentDisposition, S3_MAX_POST_OBJECT_BYTES, S3_DEFAULT_EXPIRES_IN } from '@dimah-s3/core';
+import { DeleteObjectCommand, GetObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, PutObjectCommand, GetObjectAclCommand, ListPartsCommand, CompleteMultipartUploadCommand, HeadObjectCommand, AbortMultipartUploadCommand } from '@aws-sdk/client-s3';
 import { createMiddleware, createEndpoint } from 'better-call';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
 
 // src/plugin/apply-plugins.ts
-
-// src/helpers/is-aws-not-found.ts
-function isAwsNotFound(err) {
-  const e = err;
-  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.$metadata?.httpStatusCode === 404;
-}
-var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
-async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const result = await s3.send(
-      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
-      { abortSignal: controller.signal }
-    );
-    const isPublic = result.Grants?.some(
-      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
-    );
-    return isPublic ? "public-read" : "private";
-  } catch {
-    return void 0;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 var errors = {
   notFound: () => DimahS3Error.from("NOT_FOUND", S3_ERROR_CODES.NOT_FOUND),
   unauthorized: () => DimahS3Error.from("UNAUTHORIZED", S3_ERROR_CODES.UNAUTHORIZED),
@@ -64,13 +39,69 @@ var errors = {
     "BAD_REQUEST",
     S3_ERROR_CODES.FILE_SIZE_REQUIRED_MULTIPART
   ),
+  multipartPartMissing: (partNumber) => DimahS3Error.from("BAD_REQUEST", {
+    code: S3_ERROR_CODES.MULTIPART_PART_MISSING.code,
+    message: S3_ERROR_CODES.MULTIPART_PART_MISSING.message.replaceAll(
+      "{partNumber}",
+      String(partNumber)
+    ),
+    params: { partNumber }
+  }),
+  payloadTooLarge: (message = S3_ERROR_CODES.PAYLOAD_TOO_LARGE.message) => DimahS3Error.from("PAYLOAD_TOO_LARGE", {
+    ...S3_ERROR_CODES.PAYLOAD_TOO_LARGE,
+    message
+  }),
   validationError: (message) => DimahS3Error.from("BAD_REQUEST", {
     code: S3_ERROR_CODES.VALIDATION_ERROR.code,
     message
   })
 };
 
-// src/internal-helpers.ts
+// src/helpers/is-aws-not-found.ts
+function isAwsNotFound(err) {
+  const e = err;
+  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.name === "NoSuchUpload" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.Code === "NoSuchUpload" || e?.$metadata?.httpStatusCode === 404;
+}
+async function sendOrObjectNotFound(send) {
+  try {
+    return await send();
+  } catch (err) {
+    if (isAwsNotFound(err)) throw errors.objectNotFound();
+    throw err;
+  }
+}
+var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
+async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const result = await s3.send(
+      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
+      { abortSignal: controller.signal }
+    );
+    const isPublic = result.Grants?.some(
+      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
+    );
+    return isPublic ? "public-read" : "private";
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// src/helpers/resolve-request-acl.ts
+function resolveRequestAcl(policy, requested) {
+  if (policy?.acl) return policy.acl;
+  if (policy?.allowClientAcl && requested) return requested;
+  return "private";
+}
+function normalizeExpiresIn(value, maxExpiresIn = S3_MAX_EXPIRES_IN) {
+  const n = Number(value);
+  const expires = Number.isFinite(n) && n > 0 ? Math.floor(n) : S3_DEFAULT_EXPIRES_IN;
+  const max = Number.isFinite(maxExpiresIn) && maxExpiresIn > 0 ? Math.floor(maxExpiresIn) : S3_MAX_EXPIRES_IN;
+  return Math.min(expires, max);
+}
 async function runHook(hook, context) {
   if (!hook) return;
   try {
@@ -96,10 +127,8 @@ async function runLifecycleHook(hook, context) {
     throw errors.internalError();
   }
 }
-function normalizeExpiresIn(value) {
-  const n = Number(value);
-  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 600;
-}
+
+// src/helpers/request.ts
 function requestFromHeaders(headers) {
   return new Request("http://dimah-s3.local", { headers });
 }
@@ -155,11 +184,56 @@ async function resolveRequestTarget(config, policy, input) {
   });
   return { key, bucket };
 }
+async function headObjectOrNotFound(client, bucket, key) {
+  return sendOrObjectNotFound(
+    () => client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }))
+  );
+}
+async function headObjectAfterMultipartComplete(client, bucket, key) {
+  const send = () => sendOrObjectNotFound(
+    () => client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }))
+  );
+  let head = await send();
+  for (let attempt = 0; attempt < 4 && !head.ContentLength; attempt++) {
+    await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
+    head = await send();
+  }
+  return head;
+}
+function requireContentLength(head) {
+  if (typeof head.ContentLength !== "number") {
+    throw errors.internalError();
+  }
+  return head.ContentLength;
+}
+async function listAllParts(client, input) {
+  const parts = [];
+  let partNumberMarker;
+  let isTruncated = true;
+  while (isTruncated) {
+    const response = await sendOrObjectNotFound(
+      () => client.send(
+        new ListPartsCommand({
+          Bucket: input.bucket,
+          Key: input.key,
+          UploadId: input.uploadId,
+          ...partNumberMarker ? { PartNumberMarker: partNumberMarker } : {}
+        })
+      )
+    );
+    parts.push(...response.Parts ?? []);
+    isTruncated = response.IsTruncated === true;
+    partNumberMarker = isTruncated ? response.NextPartNumberMarker : void 0;
+  }
+  return parts;
+}
+
+// src/helpers/features.ts
 function normalizeFeature(value) {
   if (value === void 0) return void 0;
   if (value === false) return { enabled: false };
   if (value === true) return { enabled: true };
-  return { ...value, enabled: value.enabled ?? true };
+  return { ...value, enabled: true };
 }
 function isFeatureEnabled(config, feature) {
   return config[feature]?.enabled === true;
@@ -178,7 +252,10 @@ function applyMultipartDefault(config, multipartInput) {
       multipart: {
         ...next.multipart,
         prefix: next.multipart.prefix ?? next.upload.prefix,
-        resolveKey: next.multipart.resolveKey ?? next.upload.resolveKey
+        resolveKey: next.multipart.resolveKey ?? next.upload.resolveKey,
+        acl: next.multipart.acl ?? next.upload.acl,
+        allowClientAcl: next.multipart.allowClientAcl ?? next.upload.allowClientAcl,
+        requireFileSize: next.multipart.requireFileSize ?? next.upload.requireFileSize
       }
     };
   }
@@ -192,6 +269,13 @@ function normalizeFeatures(config) {
     multipart: normalizeFeature(config.multipart)
   };
 }
+function assertExclusiveBucketFlags(config) {
+  if (config.allowClientBucket && config.buckets?.length) {
+    throw new Error(
+      "dimahS3: set either allowClientBucket or buckets, not both. allowClientBucket honors any client-sent bucket; buckets is an allowlist."
+    );
+  }
+}
 
 // src/api/assert-feature-enabled.ts
 function assertFeatureEnabled(config, feature) {
@@ -255,9 +339,7 @@ async function handleConfirm(config, input, request) {
     key,
     bucket
   });
-  const head = await config.client.send(
-    new HeadObjectCommand({ Bucket: bucket, Key: key })
-  );
+  const head = await headObjectOrNotFound(config.client, bucket, key);
   const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.client, bucket, key) : void 0;
   const fileName = parseFileName(head.ContentDisposition);
   const context = {
@@ -265,7 +347,7 @@ async function handleConfirm(config, input, request) {
     key,
     bucket,
     contentType: head.ContentType,
-    contentLength: head.ContentLength ?? 0,
+    contentLength: requireContentLength(head),
     eTag: head.ETag?.replace(/"/g, ""),
     metadata: head.Metadata,
     acl,
@@ -306,16 +388,7 @@ async function handleDelete(config, input, request) {
     key,
     bucket
   });
-  try {
-    await config.client.send(
-      new HeadObjectCommand({ Bucket: bucket, Key: key })
-    );
-  } catch (err) {
-    if (isAwsNotFound(err)) {
-      throw errors.objectNotFound();
-    }
-    throw err;
-  }
+  await headObjectOrNotFound(config.client, bucket, key);
   await config.client.send(
     new DeleteObjectCommand({ Bucket: bucket, Key: key })
   );
@@ -337,7 +410,7 @@ async function handleDownload(config, input, request) {
     bucket: input.bucket,
     fileName: input.fileName
   });
-  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const expiresIn = normalizeExpiresIn(input.expiresIn, config.maxExpiresIn);
   const fileName = input.fileName;
   await runHook(config.download?.guard, {
     request,
@@ -345,16 +418,7 @@ async function handleDownload(config, input, request) {
     bucket,
     fileName
   });
-  try {
-    await config.client.send(
-      new HeadObjectCommand({ Bucket: bucket, Key: key })
-    );
-  } catch (err) {
-    if (isAwsNotFound(err)) {
-      throw errors.objectNotFound();
-    }
-    throw err;
-  }
+  await headObjectOrNotFound(config.client, bucket, key);
   const url = await getSignedUrl(
     config.client,
     new GetObjectCommand({
@@ -395,12 +459,14 @@ async function handleAbort(config, input, request) {
     bucket,
     uploadId
   });
-  await config.client.send(
-    new AbortMultipartUploadCommand({
-      Bucket: bucket,
-      Key: key,
-      UploadId: uploadId
-    })
+  await sendOrObjectNotFound(
+    () => config.client.send(
+      new AbortMultipartUploadCommand({
+        Bucket: bucket,
+        Key: key,
+        UploadId: uploadId
+      })
+    )
   );
   await runLifecycleHook(config.multipart?.onAbort, {
     request,
@@ -434,32 +500,34 @@ async function handleComplete(config, input, request) {
     uploadId,
     parts: partRefs
   });
-  const listed = await config.client.send(
-    new ListPartsCommand({ Bucket: bucket, Key: key, UploadId: uploadId })
-  );
-  const listedParts = listed.Parts ?? [];
+  const listedParts = await listAllParts(config.client, {
+    bucket,
+    key,
+    uploadId
+  });
   const completeParts = parts.map((partNumber) => {
     const found = listedParts.find((p) => p.PartNumber === partNumber);
-    return { PartNumber: partNumber, ETag: found?.ETag ?? "" };
+    if (!found?.ETag) {
+      throw errors.multipartPartMissing(partNumber);
+    }
+    return { PartNumber: partNumber, ETag: found.ETag };
   });
-  const completeResult = await config.client.send(
-    new CompleteMultipartUploadCommand({
-      Bucket: bucket,
-      Key: key,
-      UploadId: uploadId,
-      MultipartUpload: { Parts: completeParts }
-    })
+  const completeResult = await sendOrObjectNotFound(
+    () => config.client.send(
+      new CompleteMultipartUploadCommand({
+        Bucket: bucket,
+        Key: key,
+        UploadId: uploadId,
+        MultipartUpload: { Parts: completeParts }
+      })
+    )
   );
-  let head = await config.client.send(
-    new HeadObjectCommand({ Bucket: bucket, Key: key })
+  const head = await headObjectAfterMultipartComplete(
+    config.client,
+    bucket,
+    key
   );
-  for (let attempt = 0; attempt < 4 && !head.ContentLength; attempt++) {
-    await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
-    head = await config.client.send(
-      new HeadObjectCommand({ Bucket: bucket, Key: key })
-    );
-  }
-  const contentLength = head.ContentLength ?? 0;
+  const contentLength = requireContentLength(head);
   const contentType = head.ContentType;
   const eTag = (head.ETag ?? completeResult.ETag ?? "").replace(/"/g, "");
   const metadata = head.Metadata ?? {};
@@ -511,7 +579,7 @@ async function handleMultipartInit(config, input, request) {
     fileName: input.fileName,
     contentType: input.contentType
   });
-  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const acl = resolveRequestAcl(config.multipart, input.acl);
   const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : void 0;
   if (config.multipart?.requireFileSize && fileSize === void 0) {
     throw errors.fileSizeRequiredMultipart();
@@ -520,7 +588,11 @@ async function handleMultipartInit(config, input, request) {
     request,
     key,
     bucket,
-    fileSize
+    fileSize,
+    contentType: input.contentType,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName
   });
   const { UploadId } = await config.client.send(
     new CreateMultipartUploadCommand({
@@ -532,6 +604,9 @@ async function handleMultipartInit(config, input, request) {
       ACL: acl
     })
   );
+  if (!UploadId) {
+    throw errors.internalError();
+  }
   await runLifecycleHook(config.multipart?.onInit, {
     request,
     key,
@@ -571,14 +646,8 @@ async function handleListParts(config, input, request) {
     bucket,
     uploadId
   });
-  const response = await config.client.send(
-    new ListPartsCommand({
-      Bucket: bucket,
-      Key: key,
-      UploadId: uploadId
-    })
-  );
-  const parts = (response.Parts ?? []).map((p) => ({
+  const listed = await listAllParts(config.client, { bucket, key, uploadId });
+  const parts = listed.map((p) => ({
     partNumber: p.PartNumber ?? 0,
     size: p.Size ?? 0,
     eTag: (p.ETag ?? "").replace(/"/g, "")
@@ -608,7 +677,7 @@ async function handleSignPart(config, input, request) {
   });
   const uploadId = input.uploadId;
   const partNumber = input.partNumber;
-  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const expiresIn = normalizeExpiresIn(input.expiresIn, config.maxExpiresIn);
   const partSize = typeof input.partSize === "number" && input.partSize > 0 ? Math.floor(input.partSize) : null;
   await runHook(config.multipart?.partGuard, {
     request,
@@ -649,6 +718,14 @@ var multipartPart = createS3Endpoint(
     return handleSignPart(ctx.context.config, ctx.body, ctx.context.request);
   }
 );
+function putMetadataHeaders(metadata) {
+  if (!metadata) return {};
+  const headers = {};
+  for (const [k, v] of Object.entries(metadata)) {
+    headers[`x-amz-meta-${k}`] = v;
+  }
+  return headers;
+}
 async function handleUpload(config, input, request) {
   const { key, bucket } = await resolveRequestTarget(config, config.upload, {
     request,
@@ -657,10 +734,13 @@ async function handleUpload(config, input, request) {
     fileName: input.fileName,
     contentType: input.contentType
   });
-  const expiresIn = normalizeExpiresIn(input.expiresIn);
-  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const expiresIn = normalizeExpiresIn(input.expiresIn, config.maxExpiresIn);
+  const acl = resolveRequestAcl(config.upload, input.acl);
   const contentType = input.contentType ?? "application/octet-stream";
   const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : null;
+  if (config.upload?.requireFileSize && fileSize === null) {
+    throw errors.fileSizeRequiredUpload();
+  }
   await runHook(config.upload?.guard, {
     request,
     key,
@@ -672,12 +752,10 @@ async function handleUpload(config, input, request) {
     fileName: input.fileName
   });
   const method = config.upload?.method ?? "POST";
-  if (method === "PUT" && config.upload?.requireFileSize && fileSize === null) {
-    throw errors.fileSizeRequiredUpload();
-  }
   if (method === "PUT") {
     const putHeaders = {
-      "Content-Type": contentType
+      "Content-Type": contentType,
+      ...putMetadataHeaders(input.metadata)
     };
     if (input.fileName) {
       putHeaders["Content-Disposition"] = buildContentDisposition(
@@ -691,6 +769,7 @@ async function handleUpload(config, input, request) {
         Key: key,
         ContentType: contentType,
         ACL: acl,
+        Metadata: input.metadata,
         ...input.fileName ? { ContentDisposition: buildContentDisposition(input.fileName) } : {},
         ...fileSize !== null ? { ContentLength: fileSize } : {}
       }),
@@ -736,7 +815,7 @@ async function handleUpload(config, input, request) {
     {
       Bucket: bucket,
       Key: key,
-      Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, Number.MAX_SAFE_INTEGER]],
+      Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, S3_MAX_POST_OBJECT_BYTES]],
       Fields: fields,
       Expires: expiresIn
     }
@@ -938,6 +1017,7 @@ function applyPlugins(config) {
     }
   }
   const { plugins: _omit, ...rest } = config;
+  assertExclusiveBucketFlags(rest);
   for (const plugin of plugins) {
     plugin.init?.({ config: rest, getPlugin });
   }