@gugananuvem/aws-local-simulator 1.0.34 → 1.0.39

package/src/services/s3/presigned-url-generator.js

@@ -0,0 +1,337 @@
+/**
+ * S3 Presigned URL Generator
+ * Gera URLs assinadas para upload, download e operações custom
+ * Permite acesso temporário a objetos S3 sem credenciais
+ */
+
+const crypto = require('crypto');
+
+class PresignedUrlGenerator {
+  constructor(config = {}) {
+    this.signatureVersion = 'AWS4-HMAC-SHA256';
+    this.algorithm = 'AWS4-HMAC-SHA256';
+    this.service = 's3';
+    this.region = config.region || 'us-east-1';
+    this.s3Endpoint = config.s3Endpoint || 'http://localhost:4566';
+  }
+
+  /**
+   * Gerar presigned URL para GET (download)
+   * @param {string} bucket - Nome do bucket
+   * @param {string} key - Chave/path do objeto
+   * @param {object} options - Opções
+   * @param {number} [options.expiresIn] - Tempo de expiração em segundos (default: 3600)
+   * @param {object} [options.credentials] - AWS credentials {accessKeyId, secretAccessKey}
+   * @returns {string} Presigned URL
+   */
+  generateGetUrl(bucket, key, options = {}) {
+    const expiresIn = options.expiresIn || 3600;
+    const credentials = options.credentials || this._getDefaultCredentials();
+
+    return this._generatePresignedUrl('GET', bucket, key, expiresIn, credentials, {});
+  }
+
+  /**
+   * Gerar presigned URL para PUT (upload)
+   * @param {string} bucket - Nome do bucket
+   * @param {string} key - Chave/path do objeto
+   * @param {object} options - Opções
+   * @param {number} [options.expiresIn] - Tempo de expiração em segundos (default: 3600)
+   * @param {object} [options.credentials] - AWS credentials
+   * @param {string} [options.contentType] - Content-Type esperado
+   * @param {object} [options.metadata] - Metadados (x-amz-meta-*)
+   * @param {string} [options.serverSideEncryption] - Encryption type (AES256, aws:kms)
+   * @returns {string} Presigned URL
+   */
+  generatePutUrl(bucket, key, options = {}) {
+    const expiresIn = options.expiresIn || 3600;
+    const credentials = options.credentials || this._getDefaultCredentials();
+    const conditions = {};
+
+    // Adicionar condições para validação
+    if (options.contentType) {
+      conditions['content-type'] = options.contentType;
+    }
+
+    if (options.serverSideEncryption) {
+      conditions['x-amz-server-side-encryption'] = options.serverSideEncryption;
+    }
+
+    if (options.metadata) {
+      Object.entries(options.metadata).forEach(([key, value]) => {
+        conditions[`x-amz-meta-${key}`] = value;
+      });
+    }
+
+    return this._generatePresignedUrl('PUT', bucket, key, expiresIn, credentials, conditions);
+  }
+
+  /**
+   * Gerar presigned URL para DELETE
+   * @param {string} bucket - Nome do bucket
+   * @param {string} key - Chave/path do objeto
+   * @param {object} options - Opções
+   * @param {number} [options.expiresIn] - Tempo de expiração em segundos
+   * @param {object} [options.credentials] - AWS credentials
+   * @returns {string} Presigned URL
+   */
+  generateDeleteUrl(bucket, key, options = {}) {
+    const expiresIn = options.expiresIn || 3600;
+    const credentials = options.credentials || this._getDefaultCredentials();
+
+    return this._generatePresignedUrl('DELETE', bucket, key, expiresIn, credentials, {});
+  }
+
+  /**
+   * Gerar presigned URL para HEAD (verificar objeto)
+   * @param {string} bucket - Nome do bucket
+   * @param {string} key - Chave/path do objeto
+   * @param {object} options - Opções
+   * @param {number} [options.expiresIn] - Tempo de expiração em segundos
+   * @param {object} [options.credentials] - AWS credentials
+   * @returns {string} Presigned URL
+   */
+  generateHeadUrl(bucket, key, options = {}) {
+    const expiresIn = options.expiresIn || 3600;
+    const credentials = options.credentials || this._getDefaultCredentials();
+
+    return this._generatePresignedUrl('HEAD', bucket, key, expiresIn, credentials, {});
+  }
+
+  /**
+   * Validar presigned URL
+   * @param {string} url - URL para validar
+   * @param {string} method - HTTP method esperado
+   * @param {object} [credentials] - Credentials para validação
+   * @returns {object} Resultado da validação
+   */
+  validatePresignedUrl(url, method = 'GET', credentials = null) {
+    try {
+      const urlObj = new URL(url);
+      
+      // Extrair parâmetros de query
+      const params = Object.fromEntries(urlObj.searchParams);
+
+      // Verificar assinatura
+      if (!params.X-Amz-Signature) {
+        return {
+          isValid: false,
+          error: 'Signature missing'
+        };
+      }
+
+      // Verificar expiração
+      if (params['X-Amz-Date']) {
+        const requestTime = this._parseAmzDate(params['X-Amz-Date']);
+        const expiresIn = parseInt(params['X-Amz-Expires']) || 3600;
+        const expireTime = new Date(requestTime.getTime() + expiresIn * 1000);
+
+        if (new Date() > expireTime) {
+          return {
+            isValid: false,
+            error: 'URL expired'
+          };
+        }
+      }
+
+      // Verificar método
+      if (method && method !== 'GET') {
+        // A URL assinada funciona para qualquer método que foi assinado
+        // Aqui seria verificado qual método foi assinado
+      }
+
+      return {
+        isValid: true,
+        method: params['X-Amz-Algorithm'] ? 'SIGNATURE_V4' : 'UNKNOWN',
+        expiresAt: this._parseAmzDate(params['X-Amz-Date'])
+      };
+    } catch (error) {
+      return {
+        isValid: false,
+        error: error.message
+      };
+    }
+  }
+
+  /**
+   * Gerar policy para upload direto (POST policy)
+   * Usado por navegadores para upload direto sem backend
+   * @param {string} bucket - Nome do bucket
+   * @param {string} key - Chave/path do objeto
+   * @param {object} options - Opções
+   * @returns {object} {policy, signature, credentials}
+   */
+  generatePostPolicy(bucket, key, options = {}) {
+    const expiresIn = options.expiresIn || 3600;
+    const credentials = options.credentials || this._getDefaultCredentials();
+    const contentLengthRange = options.contentLengthRange || [1, 104857600]; // 100MB default
+
+    // Data no formato ISO8601
+    const amzDate = new Date().toISOString().replace(/[:-]/g, '').split('.')[0] + 'Z';
+
+    // Policy
+    const policy = {
+      expiration: new Date(Date.now() + expiresIn * 1000).toISOString(),
+      conditions: [
+        { bucket: bucket },
+        { key: key },
+        ['content-length-range', contentLengthRange[0], contentLengthRange[1]],
+        { 'x-amz-credential': `${credentials.accessKeyId}/${this._getCredentialScope(amzDate)}` },
+        { 'x-amz-algorithm': 'AWS4-HMAC-SHA256' },
+        { 'x-amz-date': amzDate }
+      ]
+    };
+
+    // Adicionar condições customizadas
+    if (options.contentType) {
+      policy.conditions.push({ 'content-type': options.contentType });
+    }
+
+    if (options.metadata) {
+      Object.entries(options.metadata).forEach(([k, v]) => {
+        policy.conditions.push({ [`x-amz-meta-${k}`]: v });
+      });
+    }
+
+    // Converter policy para base64
+    const policyJson = JSON.stringify(policy);
+    const policyB64 = Buffer.from(policyJson).toString('base64');
+
+    // Gerar assinatura
+    const signature = this._signPolicy(policyB64, credentials, amzDate);
+
+    return {
+      policy: policyB64,
+      signature: signature,
+      credentials: {
+        accessKeyId: credentials.accessKeyId,
+        algorithm: 'AWS4-HMAC-SHA256',
+        date: amzDate,
+        credentialScope: this._getCredentialScope(amzDate)
+      },
+      url: `${this.s3Endpoint}/${bucket}`,
+      policyObject: policy
+    };
+  }
+
+  /**
+   * Private Methods
+   */
+
+  _generatePresignedUrl(method, bucket, key, expiresIn, credentials, conditions = {}) {
+    const now = new Date();
+    const amzDate = now.toISOString().replace(/[:-]/g, '').split('.')[0] + 'Z';
+    const dateStamp = amzDate.substring(0, 8);
+
+    // Construir canonical request
+    const host = `${bucket}.s3.amazonaws.com`;
+    const canonicalUri = `/${key}`;
+    
+    const canonicalQuerystring = [
+      `X-Amz-Algorithm=AWS4-HMAC-SHA256`,
+      `X-Amz-Credential=${encodeURIComponent(credentials.accessKeyId)}/${this._getCredentialScope(amzDate)}`,
+      `X-Amz-Date=${amzDate}`,
+      `X-Amz-Expires=${expiresIn}`,
+      `X-Amz-SignedHeaders=host`
+    ].sort().join('&');
+
+    const canonicalHeaders = `host:${host}\n`;
+    const signedHeaders = 'host';
+
+    const canonicalRequest = [
+      method,
+      canonicalUri,
+      canonicalQuerystring,
+      canonicalHeaders,
+      '',
+      signedHeaders
+    ].join('\n');
+
+    // Criar string para assinar
+    const canonicalRequestHash = crypto
+      .createHash('sha256')
+      .update(canonicalRequest)
+      .digest('hex');
+
+    const stringToSign = [
+      'AWS4-HMAC-SHA256',
+      amzDate,
+      this._getCredentialScope(amzDate),
+      canonicalRequestHash
+    ].join('\n');
+
+    // Gerar assinatura
+    const signature = this._calculateSignature(
+      stringToSign,
+      credentials.secretAccessKey,
+      dateStamp
+    );
+
+    // Construir presigned URL
+    const presignedUrl = `https://${host}${canonicalUri}?${canonicalQuerystring}&X-Amz-Signature=${signature}`;
+
+    return presignedUrl;
+  }
+
+  _getCredentialScope(amzDate) {
+    const dateStamp = amzDate.substring(0, 8);
+    return `${dateStamp}/${this.region}/${this.service}/aws4_request`;
+  }
+
+  _calculateSignature(stringToSign, secretAccessKey, dateStamp) {
+    const kDate = crypto
+      .createHmac('sha256', `AWS4${secretAccessKey}`)
+      .update(dateStamp)
+      .digest();
+
+    const kRegion = crypto
+      .createHmac('sha256', kDate)
+      .update(this.region)
+      .digest();
+
+    const kService = crypto
+      .createHmac('sha256', kRegion)
+      .update(this.service)
+      .digest();
+
+    const kSigning = crypto
+      .createHmac('sha256', kService)
+      .update('aws4_request')
+      .digest();
+
+    const signature = crypto
+      .createHmac('sha256', kSigning)
+      .update(stringToSign)
+      .digest('hex');
+
+    return signature;
+  }
+
+  _signPolicy(policyB64, credentials, amzDate) {
+    const dateStamp = amzDate.substring(0, 8);
+    const signature = this._calculateSignature(policyB64, credentials.secretAccessKey, dateStamp);
+    return signature;
+  }
+
+  _parseAmzDate(amzDate) {
+    // Format: 20240115T103000Z
+    const year = parseInt(amzDate.substring(0, 4));
+    const month = parseInt(amzDate.substring(4, 6)) - 1;
+    const day = parseInt(amzDate.substring(6, 8));
+    const hour = parseInt(amzDate.substring(9, 11));
+    const minute = parseInt(amzDate.substring(11, 13));
+    const second = parseInt(amzDate.substring(13, 15));
+
+    return new Date(Date.UTC(year, month, day, hour, minute, second));
+  }
+
+  _getDefaultCredentials() {
+    // Return default test credentials
+    return {
+      accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+      secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+    };
+  }
+}
+
+module.exports = PresignedUrlGenerator;

package/src/services/s3/server.js

@@ -1,3 +1,4 @@
+const { setupServiceMiddleware } = require('../../middleware');
 /**
  * S3 Server - Servidor HTTP para S3
  */
@@ -9,6 +10,8 @@ const logger = require('../../utils/logger');
 
 class S3Server {
   constructor(port, config) {
+    this.organizationsService = null;
+    this.stsService = null;
     this.port = port;
     this.config = config;
     this.app = express();
@@ -66,6 +69,14 @@ class S3Server {
   }
 
   setupRoutes() {
+    // IAM enforcement (applied conditionally via injectDependencies)
+    this.app.use((req, res, next) => {
+      if (this.iamMiddleware && !req.path.startsWith('/__admin')) {
+        return this.iamMiddleware(req, res, next);
+      }
+      next();
+    });
+
     // Admin endpoints devem vir antes das rotas S3 para evitar conflito com /:bucket
     this.setupAdminRoutes();
 
@@ -91,6 +102,18 @@ class S3Server {
         }
         return res.status(200).send();
       }
+      if (req.query.notification !== undefined) {
+        let config = {};
+        try {
+          const bodyStr = Buffer.isBuffer(req.body) ? req.body.toString('utf8') : req.body || '{}';
+          config = JSON.parse(bodyStr);
+        } catch (_) {}
+        const result = this.simulator.putBucketNotificationConfiguration(req.params.bucket, config);
+        if (result.error) {
+          return res.status(result.status).send(this.simulator.generateErrorResponse(result.error.code, result.error.message));
+        }
+        return res.status(200).send();
+      }
       const result = this.simulator.createBucket(req.params.bucket);
       if (result.error) {
         res.status(result.status).send(this.simulator.generateErrorResponse(result.error.code, result.error.message));
@@ -208,6 +231,13 @@ class S3Server {
         }
         return res.set('Content-Type', 'application/xml').send(this._generateWebsiteConfigXml(result.websiteConfiguration));
       }
+      if (req.query.notification !== undefined) {
+        const result = this.simulator.getBucketNotificationConfiguration(req.params.bucket);
+        if (result.error) {
+          return res.status(result.status).send(this.simulator.generateErrorResponse(result.error.code, result.error.message));
+        }
+        return res.set('Content-Type', 'application/xml').send(this._generateNotificationConfigXml(result.notificationConfiguration));
+      }
       const bucket = req.params.bucket;
       const prefix = req.query.prefix || '';
       const delimiter = req.query.delimiter;
@@ -264,6 +294,179 @@ class S3Server {
     this.app.get('/__admin/stats', (req, res) => {
       res.json(this.simulator.getStats());
     });
+
+    // ─── Presigned URL Endpoints ──────────────────────────────────────────
+
+    /**
+     * POST /__admin/presigned-urls/get
+     * Generate a presigned GET URL for downloading an object
+     * Body: { bucket, key, expiresIn?, credentials? }
+     */
+    this.app.post('/__admin/presigned-urls/get', (req, res) => {
+      try {
+        const { bucket, key, expiresIn, credentials } = req.body || {};
+        
+        if (!bucket || !key) {
+          return res.status(400).json({ error: 'bucket and key are required' });
+        }
+
+        const result = this.simulator.generatePresignedGetUrl(bucket, key, { expiresIn, credentials });
+        
+        if (result.error) {
+          return res.status(result.status || 500).json(result.error);
+        }
+
+        res.json({
+          presignedUrl: result.presignedUrl,
+          expiresIn: expiresIn || 3600,
+          expiresAt: new Date(Date.now() + (expiresIn || 3600) * 1000).toISOString()
+        });
+      } catch (err) {
+        logger.error('Error generating presigned GET URL:', err);
+        res.status(500).json({ error: err.message });
+      }
+    });
+
+    /**
+     * POST /__admin/presigned-urls/put
+     * Generate a presigned PUT URL for uploading an object
+     * Body: { bucket, key, expiresIn?, credentials?, contentType? }
+     */
+    this.app.post('/__admin/presigned-urls/put', (req, res) => {
+      try {
+        const { bucket, key, expiresIn, credentials, contentType } = req.body || {};
+        
+        if (!bucket || !key) {
+          return res.status(400).json({ error: 'bucket and key are required' });
+        }
+
+        const result = this.simulator.generatePresignedPutUrl(bucket, key, { expiresIn, credentials, contentType });
+        
+        if (result.error) {
+          return res.status(result.status || 500).json(result.error);
+        }
+
+        res.json({
+          presignedUrl: result.presignedUrl,
+          expiresIn: expiresIn || 3600,
+          expiresAt: new Date(Date.now() + (expiresIn || 3600) * 1000).toISOString()
+        });
+      } catch (err) {
+        logger.error('Error generating presigned PUT URL:', err);
+        res.status(500).json({ error: err.message });
+      }
+    });
+
+    /**
+     * POST /__admin/presigned-urls/delete
+     * Generate a presigned DELETE URL for deleting an object
+     * Body: { bucket, key, expiresIn?, credentials? }
+     */
+    this.app.post('/__admin/presigned-urls/delete', (req, res) => {
+      try {
+        const { bucket, key, expiresIn, credentials } = req.body || {};
+        
+        if (!bucket || !key) {
+          return res.status(400).json({ error: 'bucket and key are required' });
+        }
+
+        const result = this.simulator.generatePresignedDeleteUrl(bucket, key, { expiresIn, credentials });
+        
+        if (result.error) {
+          return res.status(result.status || 500).json(result.error);
+        }
+
+        res.json({
+          presignedUrl: result.presignedUrl,
+          expiresIn: expiresIn || 3600,
+          expiresAt: new Date(Date.now() + (expiresIn || 3600) * 1000).toISOString()
+        });
+      } catch (err) {
+        logger.error('Error generating presigned DELETE URL:', err);
+        res.status(500).json({ error: err.message });
+      }
+    });
+
+    /**
+     * POST /__admin/presigned-urls/head
+     * Generate a presigned HEAD URL for checking object metadata
+     * Body: { bucket, key, expiresIn?, credentials? }
+     */
+    this.app.post('/__admin/presigned-urls/head', (req, res) => {
+      try {
+        const { bucket, key, expiresIn, credentials } = req.body || {};
+        
+        if (!bucket || !key) {
+          return res.status(400).json({ error: 'bucket and key are required' });
+        }
+
+        const result = this.simulator.generatePresignedHeadUrl(bucket, key, { expiresIn, credentials });
+        
+        if (result.error) {
+          return res.status(result.status || 500).json(result.error);
+        }
+
+        res.json({
+          presignedUrl: result.presignedUrl,
+          expiresIn: expiresIn || 3600,
+          expiresAt: new Date(Date.now() + (expiresIn || 3600) * 1000).toISOString()
+        });
+      } catch (err) {
+        logger.error('Error generating presigned HEAD URL:', err);
+        res.status(500).json({ error: err.message });
+      }
+    });
+
+    /**
+     * POST /__admin/presigned-urls/post-policy
+     * Generate a presigned POST policy for form uploads
+     * Body: { bucket, key, expiresIn?, credentials?, contentType?, conditions? }
+     */
+    this.app.post('/__admin/presigned-urls/post-policy', (req, res) => {
+      try {
+        const { bucket, key, expiresIn, credentials, contentType, conditions } = req.body || {};
+        
+        if (!bucket || !key) {
+          return res.status(400).json({ error: 'bucket and key are required' });
+        }
+
+        const result = this.simulator.generatePresignedPostPolicy(bucket, key, { expiresIn, credentials, contentType, conditions });
+        
+        if (result.error) {
+          return res.status(result.status || 500).json(result.error);
+        }
+
+        res.json({
+          ...result,
+          expiresIn: expiresIn || 3600,
+          expiresAt: new Date(Date.now() + (expiresIn || 3600) * 1000).toISOString()
+        });
+      } catch (err) {
+        logger.error('Error generating presigned POST policy:', err);
+        res.status(500).json({ error: err.message });
+      }
+    });
+
+    /**
+     * POST /__admin/presigned-urls/validate
+     * Validate a presigned URL
+     * Body: { url, method?, credentials? }
+     */
+    this.app.post('/__admin/presigned-urls/validate', (req, res) => {
+      try {
+        const { url, method, credentials } = req.body || {};
+        
+        if (!url) {
+          return res.status(400).json({ error: 'url is required' });
+        }
+
+        const result = this.simulator.validatePresignedUrl(url, method || 'GET', credentials);
+        res.json(result);
+      } catch (err) {
+        logger.error('Error validating presigned URL:', err);
+        res.status(500).json({ error: err.message });
+      }
+    });
   }
 
   _serveWebsite(req, res, keyPath) {
@@ -318,6 +521,34 @@ class S3Server {
 </WebsiteConfiguration>`;
   }
 
+  _generateNotificationConfigXml(config) {
+    const nc = config || { LambdaFunctionConfigurations: [], QueueConfigurations: [], TopicConfigurations: [] };
+    const lambdaXml = (nc.LambdaFunctionConfigurations || []).map(cfg => `
+  <CloudFunctionConfiguration>
+    <Id>${cfg.Id || ''}</Id>
+    ${(cfg.Events || []).map(e => `<Event>${e}</Event>`).join('')}
+    <CloudFunction>${cfg.LambdaFunctionArn}</CloudFunction>
+    ${cfg.Filter && cfg.Filter.Key ? `<Filter><S3Key>${(cfg.Filter.Key.FilterRules || []).map(r => `<FilterRule><Name>${r.Name}</Name><Value>${r.Value}</Value></FilterRule>`).join('')}</S3Key></Filter>` : ''}
+  </CloudFunctionConfiguration>`).join('');
+    const queueXml = (nc.QueueConfigurations || []).map(cfg => `
+  <QueueConfiguration>
+    <Id>${cfg.Id || ''}</Id>
+    ${(cfg.Events || []).map(e => `<Event>${e}</Event>`).join('')}
+    <Queue>${cfg.QueueArn}</Queue>
+    ${cfg.Filter && cfg.Filter.Key ? `<Filter><S3Key>${(cfg.Filter.Key.FilterRules || []).map(r => `<FilterRule><Name>${r.Name}</Name><Value>${r.Value}</Value></FilterRule>`).join('')}</S3Key></Filter>` : ''}
+  </QueueConfiguration>`).join('');
+    const topicXml = (nc.TopicConfigurations || []).map(cfg => `
+  <TopicConfiguration>
+    <Id>${cfg.Id || ''}</Id>
+    ${(cfg.Events || []).map(e => `<Event>${e}</Event>`).join('')}
+    <Topic>${cfg.TopicArn}</Topic>
+    ${cfg.Filter && cfg.Filter.Key ? `<Filter><S3Key>${(cfg.Filter.Key.FilterRules || []).map(r => `<FilterRule><Name>${r.Name}</Name><Value>${r.Value}</Value></FilterRule>`).join('')}</S3Key></Filter>` : ''}
+  </TopicConfiguration>`).join('');
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<NotificationConfiguration>${lambdaXml}${queueXml}${topicXml}
+</NotificationConfiguration>`;
+  }
+
   start() {
     return new Promise((resolve) => {
       this.server = this.app.listen(this.port, () => {