@felipedsvit/s3node 0.1.2

package/src/features/notifications.js

@@ -0,0 +1,161 @@
+import { S3Error } from '../errors.js'
+import { childNamed, childText, childrenNamed, document, parseXml, text } from '../xml.js'
+
+const DISPATCH_TIMEOUT_MS = 5000
+
+const KNOWN_EVENTS = [
+  's3:ObjectCreated:*',
+  's3:ObjectCreated:Put',
+  's3:ObjectCreated:Post',
+  's3:ObjectCreated:Copy',
+  's3:ObjectCreated:CompleteMultipartUpload',
+  's3:ObjectRemoved:*',
+  's3:ObjectRemoved:Delete',
+  's3:ObjectRemoved:DeleteMarkerCreated',
+]
+
+/**
+ * There is no SQS or SNS behind this server, so destinations are plain
+ * webhooks. The element name is deliberately non-standard rather than
+ * pretending to be `<QueueConfiguration>` and silently doing something else.
+ */
+function parseFilter(node) {
+  const filter = childNamed(node, 'Filter')
+  const s3Key = filter ? childNamed(filter, 'S3Key') : null
+  const rules = {}
+  for (const rule of childrenNamed(s3Key, 'FilterRule')) {
+    const name = childText(rule, 'Name')?.toLowerCase()
+    if (name === 'prefix' || name === 'suffix') rules[name] = childText(rule, 'Value') ?? ''
+  }
+  return rules
+}
+
+export function parseNotificationXml(body) {
+  const root = parseXml(body)
+  if (root.name !== 'NotificationConfiguration') {
+    throw new S3Error('MalformedXML', 'Expected a NotificationConfiguration element')
+  }
+  const targets = childrenNamed(root, 'WebhookConfiguration').map((node, index) => {
+    const endpoint = childText(node, 'Endpoint')
+    if (!endpoint) throw new S3Error('MalformedXML', 'Each WebhookConfiguration requires an Endpoint')
+    let url
+    try {
+      url = new URL(endpoint)
+    } catch {
+      throw new S3Error('MalformedXML', `Invalid webhook endpoint ${endpoint}`)
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      throw new S3Error('MalformedXML', 'Webhook endpoints must be http or https')
+    }
+    const events = childrenNamed(node, 'Event').map((event) => event.text)
+    if (events.length === 0) throw new S3Error('MalformedXML', 'Each WebhookConfiguration requires an Event')
+    for (const event of events) {
+      if (!KNOWN_EVENTS.includes(event)) {
+        throw new S3Error('MalformedXML', `Unsupported event ${event}`)
+      }
+    }
+    return { id: childText(node, 'Id') ?? `webhook-${index}`, endpoint, events, filter: parseFilter(node) }
+  })
+  return { targets }
+}
+
+export function notificationXml(config) {
+  const targets = (config?.targets ?? []).map((target) => {
+    const rules = Object.entries(target.filter ?? {})
+      .map(([name, value]) => `<FilterRule>${text('Name', name)}${text('Value', value)}</FilterRule>`)
+      .join('')
+    return '<WebhookConfiguration>' +
+      text('Id', target.id) +
+      text('Endpoint', target.endpoint) +
+      target.events.map((event) => text('Event', event)).join('') +
+      (rules ? `<Filter><S3Key>${rules}</S3Key></Filter>` : '') +
+      '</WebhookConfiguration>'
+  }).join('')
+  return document('NotificationConfiguration', targets)
+}
+
+function eventMatches(pattern, eventName) {
+  const full = `s3:${eventName}`
+  if (pattern === full) return true
+  if (!pattern.endsWith(':*')) return false
+  return full.startsWith(pattern.slice(0, -1))
+}
+
+function filterMatches(filter, key) {
+  if (filter.prefix !== undefined && !key.startsWith(filter.prefix)) return false
+  if (filter.suffix !== undefined && !key.endsWith(filter.suffix)) return false
+  return true
+}
+
+export function buildEvent({ eventName, region, bucket, key, size, etag, versionId, configurationId }) {
+  return {
+    Records: [{
+      eventVersion: '2.1',
+      eventSource: 'aws:s3',
+      awsRegion: region,
+      eventTime: new Date().toISOString(),
+      eventName,
+      s3: {
+        s3SchemaVersion: '1.0',
+        configurationId,
+        bucket: { name: bucket, arn: `arn:aws:s3:::${bucket}` },
+        object: {
+          key: encodeURIComponent(key).replaceAll('%2F', '/'),
+          size,
+          eTag: etag ? etag.replaceAll('"', '') : undefined,
+          versionId,
+        },
+      },
+    }],
+  }
+}
+
+/**
+ * Best-effort, fire-and-forget delivery. A slow or broken webhook must never
+ * stall or fail the S3 request that triggered it.
+ */
+export class NotificationDispatcher {
+  constructor(store, { region = 'us-east-1', logger = null, fetchImpl = fetch } = {}) {
+    this.store = store
+    this.region = region
+    this.logger = logger
+    this.fetchImpl = fetchImpl
+    this.inFlight = new Set()
+  }
+
+  dispatch({ bucket, eventName, key, size, etag, versionId }) {
+    let config
+    try {
+      config = this.store.metadata.getConfig(bucket, 'notification')
+    } catch {
+      return
+    }
+    if (!config?.targets?.length) return
+
+    for (const target of config.targets) {
+      if (!target.events.some((pattern) => eventMatches(pattern, eventName))) continue
+      if (!filterMatches(target.filter ?? {}, key)) continue
+
+      const payload = buildEvent({
+        eventName, region: this.region, bucket, key, size, etag, versionId,
+        configurationId: target.id,
+      })
+      const promise = this.fetchImpl(target.endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-amz-event-source': 's3node' },
+        body: JSON.stringify(payload),
+        signal: AbortSignal.timeout(DISPATCH_TIMEOUT_MS),
+      }).catch((err) => {
+        this.logger?.error?.({ message: 'notification delivery failed', endpoint: target.endpoint, error: err.message })
+      }).finally(() => this.inFlight.delete(promise))
+      this.inFlight.add(promise)
+    }
+  }
+
+  /** Used by tests and shutdown to wait for outstanding deliveries. */
+  async drain() {
+    while (this.inFlight.size) await Promise.allSettled([...this.inFlight])
+  }
+}
+
+export { KNOWN_EVENTS }

package/src/features/postpolicy.js

@@ -0,0 +1,150 @@
+import { S3Error } from '../errors.js'
+import { ALGORITHM, calculateSignature, deriveSigningKey, signaturesMatch } from '../auth/sigv4.js'
+
+const MAX_POLICY_BYTES = 20 * 1024
+
+/**
+ * Fields the browser always sends that do not themselves need a matching
+ * policy condition.
+ */
+const EXEMPT_FIELDS = new Set([
+  'policy', 'x-amz-signature', 'x-amz-algorithm', 'x-amz-credential', 'x-amz-date',
+  'x-amz-security-token', 'file', 'signature', 'awsaccesskeyid',
+])
+
+function parseCredential(credential) {
+  const parts = String(credential ?? '').split('/')
+  if (parts.length !== 5 || parts[4] !== 'aws4_request') {
+    throw new S3Error('AuthorizationHeaderMalformed', 'Malformed x-amz-credential')
+  }
+  return { accessKeyId: parts[0], date: parts[1], region: parts[2], service: parts[3] }
+}
+
+function conditionValue(fields, name) {
+  return fields.get(String(name).toLowerCase())
+}
+
+/**
+ * Validates the decoded policy against the submitted fields.
+ *
+ * Every condition must hold, and every submitted field must be covered by some
+ * condition. The second half is the important one: without it a form signed for
+ * `uploads/` could carry any other field the server acts on.
+ */
+function validateConditions(policy, fields, { contentLength }) {
+  if (!Array.isArray(policy.conditions)) {
+    throw new S3Error('MalformedPOSTRequest', 'The policy requires a conditions array')
+  }
+  const covered = new Set(EXEMPT_FIELDS)
+  let range = null
+
+  for (const condition of policy.conditions) {
+    if (Array.isArray(condition)) {
+      const [operator, target, ...rest] = condition
+      const op = String(operator).toLowerCase()
+
+      if (op === 'content-length-range') {
+        range = { min: Number(target), max: Number(rest[0]) }
+        continue
+      }
+
+      const name = String(target ?? '').replace(/^\$/, '').toLowerCase()
+      covered.add(name)
+      const actual = conditionValue(fields, name)
+      if (op === 'eq') {
+        if (actual !== String(rest[0])) {
+          throw new S3Error('AccessDenied', `Policy condition failed: ${name} must equal "${rest[0]}"`)
+        }
+      } else if (op === 'starts-with') {
+        const prefix = String(rest[0] ?? '')
+        if (actual === undefined || !actual.startsWith(prefix)) {
+          throw new S3Error('AccessDenied', `Policy condition failed: ${name} must start with "${prefix}"`)
+        }
+      } else {
+        throw new S3Error('MalformedPOSTRequest', `Unsupported policy condition ${operator}`)
+      }
+      continue
+    }
+
+    if (!condition || typeof condition !== 'object') {
+      throw new S3Error('MalformedPOSTRequest', 'Malformed policy condition')
+    }
+    for (const [rawName, expected] of Object.entries(condition)) {
+      const name = rawName.toLowerCase()
+      covered.add(name)
+      if (conditionValue(fields, name) !== String(expected)) {
+        throw new S3Error('AccessDenied', `Policy condition failed: ${name} must equal "${expected}"`)
+      }
+    }
+  }
+
+  for (const name of fields.keys()) {
+    if (!covered.has(name)) {
+      throw new S3Error('AccessDenied', `Field ${name} is not covered by the policy`)
+    }
+  }
+
+  if (range && contentLength !== undefined) {
+    if (contentLength < range.min || contentLength > range.max) {
+      throw new S3Error('EntityTooLarge',
+        `The uploaded body must be between ${range.min} and ${range.max} bytes`)
+    }
+  }
+  return { range }
+}
+
+/**
+ * Verifies a browser POST upload. The signature is taken over the base64 policy
+ * string exactly as submitted, so it must not be re-encoded before signing.
+ */
+export function verifyPostPolicy({ fields, bucket, lookupCredential, now = Date.now(), contentLength }) {
+  const encodedPolicy = fields.get('policy')
+  if (!encodedPolicy) throw new S3Error('AccessDenied', 'The POST request is missing a policy')
+  if (encodedPolicy.length > MAX_POLICY_BYTES) {
+    throw new S3Error('MalformedPOSTRequest', 'The policy exceeds the maximum accepted size')
+  }
+
+  const algorithm = fields.get('x-amz-algorithm')
+  if (algorithm !== ALGORITHM) {
+    throw new S3Error('AccessDenied', 'Unsupported or missing x-amz-algorithm')
+  }
+  const signature = fields.get('x-amz-signature')
+  if (!signature) throw new S3Error('AccessDenied', 'The POST request is missing a signature')
+
+  const { accessKeyId, date, region, service } = parseCredential(fields.get('x-amz-credential'))
+  if (service !== 's3') throw new S3Error('AuthorizationHeaderMalformed', 'Credential must be scoped to s3')
+
+  const credential = lookupCredential(accessKeyId)
+  if (!credential) throw new S3Error('InvalidAccessKeyId')
+
+  let policy
+  try {
+    policy = JSON.parse(Buffer.from(encodedPolicy, 'base64').toString('utf8'))
+  } catch {
+    throw new S3Error('MalformedPOSTRequest', 'The policy is not valid base64-encoded JSON')
+  }
+
+  if (!policy.expiration || Number.isNaN(Date.parse(policy.expiration))) {
+    throw new S3Error('MalformedPOSTRequest', 'The policy requires an expiration')
+  }
+  if (now > Date.parse(policy.expiration)) throw new S3Error('AccessDenied', 'The policy has expired')
+
+  const expected = calculateSignature(
+    deriveSigningKey(credential.secretAccessKey, date, region, service, accessKeyId),
+    encodedPolicy,
+  )
+  if (!signaturesMatch(expected, signature)) throw new S3Error('SignatureDoesNotMatch')
+
+  if (fields.get('bucket') !== undefined && fields.get('bucket') !== bucket) {
+    throw new S3Error('AccessDenied', 'The policy was signed for a different bucket')
+  }
+
+  const { range } = validateConditions(policy, fields, { contentLength })
+  return { accessKeyId, policy, range }
+}
+
+/** S3 substitutes `${filename}` in the key with the uploaded file name. */
+export function resolveKey(rawKey, filename) {
+  if (!rawKey) throw new S3Error('MalformedPOSTRequest', 'The POST request is missing a key')
+  return rawKey.replaceAll('${filename}', filename ?? '')
+}

package/src/features/tagging.js

@@ -0,0 +1,64 @@
+import { S3Error } from '../errors.js'
+import { childNamed, childText, childrenNamed, document, parseXml, text } from '../xml.js'
+
+const MAX_OBJECT_TAGS = 10
+const MAX_BUCKET_TAGS = 50
+const MAX_KEY_LENGTH = 128
+const MAX_VALUE_LENGTH = 256
+
+export function validateTagSet(tags, { max = MAX_OBJECT_TAGS } = {}) {
+  const entries = Object.entries(tags)
+  if (entries.length > max) {
+    throw new S3Error('InvalidTag', `A maximum of ${max} tags is allowed`)
+  }
+  for (const [key, value] of entries) {
+    if (!key || key.length > MAX_KEY_LENGTH) {
+      throw new S3Error('InvalidTag', `Tag key must be between 1 and ${MAX_KEY_LENGTH} characters`)
+    }
+    if (String(value).length > MAX_VALUE_LENGTH) {
+      throw new S3Error('InvalidTag', `Tag value must be at most ${MAX_VALUE_LENGTH} characters`)
+    }
+  }
+  return tags
+}
+
+/** `x-amz-tagging: a=1&b=2` — the header form used on PutObject. */
+export function parseTaggingHeader(header) {
+  if (!header) return {}
+  const tags = {}
+  for (const pair of String(header).split('&')) {
+    if (!pair) continue
+    const eq = pair.indexOf('=')
+    const rawKey = eq === -1 ? pair : pair.slice(0, eq)
+    const rawValue = eq === -1 ? '' : pair.slice(eq + 1)
+    try {
+      tags[decodeURIComponent(rawKey.replaceAll('+', ' '))] =
+        decodeURIComponent(rawValue.replaceAll('+', ' '))
+    } catch {
+      throw new S3Error('InvalidArgument', 'Malformed x-amz-tagging header')
+    }
+  }
+  return validateTagSet(tags)
+}
+
+export function parseTaggingXml(body, options) {
+  const root = parseXml(body)
+  if (root.name !== 'Tagging') throw new S3Error('MalformedXML', 'Expected a Tagging element')
+  const tagSet = childNamed(root, 'TagSet')
+  const tags = {}
+  for (const tag of childrenNamed(tagSet, 'Tag')) {
+    const key = childText(tag, 'Key')
+    if (!key) throw new S3Error('MalformedXML', 'Each Tag requires a Key')
+    tags[key] = childText(tag, 'Value') ?? ''
+  }
+  return validateTagSet(tags, options)
+}
+
+export function taggingXml(tags) {
+  const entries = Object.entries(tags ?? {})
+    .map(([key, value]) => `<Tag>${text('Key', key)}${text('Value', value)}</Tag>`)
+    .join('')
+  return document('Tagging', `<TagSet>${entries}</TagSet>`)
+}
+
+export { MAX_BUCKET_TAGS, MAX_OBJECT_TAGS }

package/src/handlers/bucket.js

@@ -0,0 +1,197 @@
+import { S3Error } from '../errors.js'
+import { collectBody, isoDate, sendEmpty, sendXml } from '../http.js'
+import { childText, childrenNamed, document, escapeXml, parseXml, text } from '../xml.js'
+import { MAX_DELETE_KEYS, integerParam, maybeEncode, ownerXml } from './shared.js'
+import { notify } from './shared.js'
+
+export async function createBucket(ctx, res, { store }) {
+  await collectBody(ctx.bodyStreams).catch(() => Buffer.alloc(0))
+  store.createBucket(ctx.bucket)
+  sendEmpty(ctx, res, 200, { Location: `/${ctx.bucket}` })
+}
+
+export async function deleteBucket(ctx, res, { store }) {
+  await store.deleteBucket(ctx.bucket)
+  sendEmpty(ctx, res, 204)
+}
+
+export function headBucket(ctx, res, { store }) {
+  store.requireBucket(ctx.bucket)
+  sendEmpty(ctx, res, 200, { 'x-amz-bucket-region': store.region })
+}
+
+export function getBucketLocation(ctx, res, { store }) {
+  store.requireBucket(ctx.bucket)
+  const constraint = store.region === 'us-east-1' ? '' : escapeXml(store.region)
+  sendXml(ctx, res, 200, document('LocationConstraint', constraint))
+}
+
+function listCommon(ctx) {
+  return {
+    prefix: ctx.query.get('prefix') ?? '',
+    delimiter: ctx.query.get('delimiter') ?? '',
+    encodingType: ctx.query.get('encoding-type') ?? '',
+    maxKeys: integerParam(ctx.query, 'max-keys', 1000, { min: 0, max: 1000 }),
+  }
+}
+
+function contentsXml(records, encodingType, { withOwner }) {
+  return records.map((record) => (
+    `<Contents>${
+      text('Key', maybeEncode(record.key.toString('utf8'), encodingType))
+    }${text('LastModified', isoDate(record.lastModified))
+    }${text('ETag', record.etag)
+    }${text('Size', record.size)
+    }${text('StorageClass', 'STANDARD')
+    }${withOwner ? ownerXml : ''}</Contents>`
+  )).join('')
+}
+
+function prefixesXml(prefixes, encodingType) {
+  return prefixes
+    .map((value) => `<CommonPrefixes>${text('Prefix', maybeEncode(value, encodingType))}</CommonPrefixes>`)
+    .join('')
+}
+
+export function listObjectsV2(ctx, res, { store }) {
+  const { prefix, delimiter, encodingType, maxKeys } = listCommon(ctx)
+  const continuationToken = ctx.query.get('continuation-token')
+  const startAfter = ctx.query.get('start-after') ?? ''
+  const fetchOwner = ctx.query.get('fetch-owner') === 'true'
+
+  const cursor = continuationToken ? Buffer.from(continuationToken, 'base64') : null
+  const result = store.listObjects(ctx.bucket, { prefix, delimiter, maxKeys, startAfter, cursor })
+
+  const body =
+    text('Name', ctx.bucket) +
+    text('Prefix', maybeEncode(prefix, encodingType)) +
+    (delimiter ? text('Delimiter', maybeEncode(delimiter, encodingType)) : '') +
+    text('MaxKeys', maxKeys) +
+    text('KeyCount', result.contents.length + result.commonPrefixes.length) +
+    text('IsTruncated', String(result.truncated)) +
+    (continuationToken ? text('ContinuationToken', continuationToken) : '') +
+    (result.truncated && result.nextCursor
+      ? text('NextContinuationToken', Buffer.from(result.nextCursor).toString('base64'))
+      : '') +
+    (startAfter ? text('StartAfter', maybeEncode(startAfter, encodingType)) : '') +
+    (encodingType ? text('EncodingType', encodingType) : '') +
+    contentsXml(result.contents, encodingType, { withOwner: fetchOwner }) +
+    prefixesXml(result.commonPrefixes, encodingType)
+
+  sendXml(ctx, res, 200, document('ListBucketResult', body))
+}
+
+export function listObjectsV1(ctx, res, { store }) {
+  const { prefix, delimiter, encodingType, maxKeys } = listCommon(ctx)
+  const marker = ctx.query.get('marker') ?? ''
+  const result = store.listObjects(ctx.bucket, { prefix, delimiter, maxKeys, startAfter: marker })
+
+  // V1 pagination is by last key returned, not by an opaque cursor, so the
+  // marker is whichever of the two result lists ends highest in byte order.
+  const candidates = [
+    result.contents.at(-1)?.key.toString('utf8'),
+    result.commonPrefixes.at(-1),
+  ].filter((value) => value !== undefined)
+  const lastKey = candidates.sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))).at(-1)
+
+  const body =
+    text('Name', ctx.bucket) +
+    text('Prefix', maybeEncode(prefix, encodingType)) +
+    text('Marker', maybeEncode(marker, encodingType)) +
+    (delimiter ? text('Delimiter', maybeEncode(delimiter, encodingType)) : '') +
+    text('MaxKeys', maxKeys) +
+    text('IsTruncated', String(result.truncated)) +
+    (result.truncated && lastKey ? text('NextMarker', maybeEncode(lastKey, encodingType)) : '') +
+    (encodingType ? text('EncodingType', encodingType) : '') +
+    contentsXml(result.contents, encodingType, { withOwner: true }) +
+    prefixesXml(result.commonPrefixes, encodingType)
+
+  sendXml(ctx, res, 200, document('ListBucketResult', body))
+}
+
+export function listObjectVersions(ctx, res, { store }) {
+  const { prefix, delimiter, encodingType, maxKeys } = listCommon(ctx)
+  const keyMarker = ctx.query.get('key-marker') ?? ''
+  const versionIdMarker = ctx.query.get('version-id-marker') ?? ''
+
+  const result = store.listVersions(ctx.bucket, {
+    prefix, delimiter, maxKeys, keyMarker, versionIdMarker,
+  })
+
+  const entries = result.versions.map((record) => {
+    const common =
+      text('Key', maybeEncode(record.key.toString('utf8'), encodingType)) +
+      text('VersionId', record.versionId) +
+      text('IsLatest', String(record.isLatest)) +
+      text('LastModified', isoDate(record.lastModified))
+    return record.isDeleteMarker
+      ? `<DeleteMarker>${common}${ownerXml}</DeleteMarker>`
+      : `<Version>${common}${text('ETag', record.etag)}${text('Size', record.size)}` +
+        `${text('StorageClass', 'STANDARD')}${ownerXml}</Version>`
+  }).join('')
+
+  const body =
+    text('Name', ctx.bucket) +
+    text('Prefix', maybeEncode(prefix, encodingType)) +
+    (delimiter ? text('Delimiter', maybeEncode(delimiter, encodingType)) : '') +
+    text('KeyMarker', maybeEncode(keyMarker, encodingType)) +
+    (versionIdMarker ? text('VersionIdMarker', versionIdMarker) : '') +
+    text('MaxKeys', maxKeys) +
+    text('IsTruncated', String(result.truncated)) +
+    (result.nextKeyMarker ? text('NextKeyMarker', maybeEncode(result.nextKeyMarker, encodingType)) : '') +
+    (result.nextVersionIdMarker ? text('NextVersionIdMarker', result.nextVersionIdMarker) : '') +
+    (encodingType ? text('EncodingType', encodingType) : '') +
+    entries +
+    prefixesXml(result.commonPrefixes, encodingType)
+
+  sendXml(ctx, res, 200, document('ListVersionsResult', body))
+}
+
+export async function deleteObjects(ctx, res, { store, server }) {
+  store.requireBucket(ctx.bucket)
+  const body = await collectBody(ctx.bodyStreams)
+  const root = parseXml(body)
+  if (root.name !== 'Delete') throw new S3Error('MalformedXML', 'Expected a Delete element')
+
+  const quiet = childText(root, 'Quiet') === 'true'
+  const entries = childrenNamed(root, 'Object')
+  if (entries.length === 0) throw new S3Error('MalformedXML', 'No objects specified')
+  if (entries.length > MAX_DELETE_KEYS) {
+    throw new S3Error('MalformedXML', `A maximum of ${MAX_DELETE_KEYS} keys may be deleted in one request`)
+  }
+
+  const deleted = []
+  const errors = []
+  for (const entry of entries) {
+    const key = childText(entry, 'Key')
+    if (!key) {
+      errors.push({ key: '', code: 'MalformedXML', message: 'Missing Key' })
+      continue
+    }
+    const versionId = childText(entry, 'VersionId')
+    try {
+      const result = await store.deleteObject(ctx.bucket, key, versionId ?? null)
+      deleted.push({ key, ...result })
+      notify(server, {
+        bucket: ctx.bucket,
+        eventName: result.deleteMarker ? 'ObjectRemoved:DeleteMarkerCreated' : 'ObjectRemoved:Delete',
+        key, size: 0, versionId: result.versionId,
+      })
+    } catch (err) {
+      const s3 = err instanceof S3Error ? err : new S3Error('InternalError', err.message)
+      errors.push({ key, code: s3.code, message: s3.message })
+    }
+  }
+
+  const payload =
+    (quiet ? '' : deleted.map((entry) =>
+      `<Deleted>${text('Key', entry.key)}${
+        entry.versionId ? text('VersionId', entry.versionId) : ''
+      }${entry.deleteMarker ? text('DeleteMarker', 'true') : ''}</Deleted>`
+    ).join('')) +
+    errors.map((entry) =>
+      `<Error>${text('Key', entry.key)}${text('Code', entry.code)}${text('Message', entry.message)}</Error>`
+    ).join('')
+
+  sendXml(ctx, res, 200, document('DeleteResult', payload))
+}