@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.4

package/dist/storage/config/storage-config.controller.js

@@ -0,0 +1,275 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageConfigController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const index_1 = require("../../identity/index");
+const storage_constants_1 = require("../storage.constants");
+const storage_bucket_provision_service_1 = require("./storage-bucket-provision.service");
+const storage_config_admin_service_1 = require("./storage-config-admin.service");
+const storage_connection_test_service_1 = require("./storage-connection-test.service");
+const storage_bucket_provision_dto_1 = require("./dto/storage-bucket-provision.dto");
+const storage_config_response_dto_1 = require("./dto/storage-config-response.dto");
+const storage_connection_test_dto_1 = require("./dto/storage-connection-test.dto");
+const update_storage_config_dto_1 = require("./dto/update-storage-config.dto");
+// =============================================================================
+// StorageConfigController (issue #375, epic #372)
+// =============================================================================
+//
+// The HTTP surface behind `/admin/settings/storage` (#376). Four operations:
+//
+//   GET  /api/admin/storage-config          storage_config:read
+//   PUT  /api/admin/storage-config          storage_config:write
+//   POST /api/admin/storage-config/test     storage_config:write
+//   POST /api/admin/storage-config/bucket   storage_config:write
+//
+// -----------------------------------------------------------------------------
+// `storage_config:*`, AND WHY IT IS NEITHER OF THE TWO PAIRS THAT ALREADY EXIST
+// -----------------------------------------------------------------------------
+//
+// NOT `system_settings:*`: a wrong bucket, a wrong endpoint or a rotated-out
+// secret does not degrade one feature, it breaks every upload, avatar, job
+// artifact and database backup in the deployment at once — and immediately,
+// because the configuration is resolved per call with no restart in between.
+// That is the same "distinct blast radius" argument `nodes:*`, `db_backup:*`,
+// `broadcasts:*` and `push:*` each made before it.
+//
+// NOT `storage:*`, which is the closer-looking mistake: that pair gates OBJECT
+// ACCESS and is seeded to Viewer and Contributor, so every ordinary user of this
+// application holds `storage:read`. Reusing it here would put the deployment's
+// credential-bearing configuration screen in front of the entire user base.
+//
+// The Settings UI Pattern (CLAUDE.md rule 3) requires a hub card's `permission`
+// to be the exact string its controller enforces, so #376's Storage card mirrors
+// these two strings and nothing else. See `common/constants/roles.constants.ts`.
+//
+// -----------------------------------------------------------------------------
+// THE TWO PROBES ARE GATED ON `:write`, NOT `:read`
+// -----------------------------------------------------------------------------
+//
+// Both are side-effecting. `POST /test` writes a throwaway object into somebody
+// else's bucket and asks a third-party endpoint to do work; `POST /bucket`
+// creates infrastructure. `:read` is held by anyone who may LOOK at the
+// configuration, and looking is not writing — the identical argument
+// `EmailSettingsController` makes for its test send.
+//
+// -----------------------------------------------------------------------------
+// ⚠ BOTH PROBES ANSWER 200 EVEN WHEN THE ANSWER IS BAD
+// -----------------------------------------------------------------------------
+//
+// A refused `HeadBucket` and a credential without `s3:CreateBucket` are
+// DIAGNOSES, not transport failures, and this app's error envelope would discard
+// exactly the detail they exist to deliver (`HttpExceptionFilter` suppresses
+// detail in production, and the web client funnels 4xx/5xx into generic failure
+// handling). The outcome therefore travels in the body — `success` for the test,
+// `outcome` for the bucket action — and a client that reads the status code
+// instead reports success for every misconfiguration there is. See each DTO's
+// header, and `email/dto/test-email-result.dto.ts`, which makes the argument
+// first.
+//
+// -----------------------------------------------------------------------------
+// A SEPARATE CONTROLLER, NOT ROUTES ON `SystemSettingsController`
+// -----------------------------------------------------------------------------
+//
+// Same reasoning as `EmailSettingsController` and `PushConfigController`: this
+// surface writes a credential and drives an object store, which the generic
+// settings routes have no business doing, it enforces a different permission
+// pair, and keeping it separate keeps the OpenAPI tag — and therefore the API
+// reference — aligned with the settings page it backs.
+// =============================================================================
+/**
+ * The `/api/admin/storage-config` routes (`storage_config:read|write`): read, save, connection test, bucket provisioning.
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+let StorageConfigController = class StorageConfigController {
+    storageConfig;
+    connectionTest;
+    bucketProvision;
+    constructor(storageConfig, connectionTest, bucketProvision) {
+        this.storageConfig = storageConfig;
+        this.connectionTest = connectionTest;
+        this.bucketProvision = bucketProvision;
+    }
+    async getConfig() {
+        return this.storageConfig.describeForAdmin();
+    }
+    async replaceConfig(dto, userId, ifMatch) {
+        // `Number.isInteger` rather than a bare `parseInt`, matching
+        // `EmailSettingsController` and `PushConfigController`: `parseInt('abc')` is
+        // `NaN`, and `NaN !== currentVersion` is always true, so a malformed header
+        // would turn every save into a 409 that no amount of reloading fixes. An
+        // unparseable `If-Match` is treated as absent instead, which is exactly what
+        // the header's own "omit to overwrite unconditionally" semantics say.
+        const parsed = ifMatch !== undefined ? Number.parseInt(ifMatch, 10) : NaN;
+        const expectedVersion = Number.isInteger(parsed) ? parsed : undefined;
+        return this.storageConfig.replace(dto, userId, expectedVersion);
+    }
+    async testConfig(dto, userId) {
+        return this.connectionTest.test(dto, userId);
+    }
+    async provisionBucket(dto, userId) {
+        return this.bucketProvision.provision(dto, userId);
+    }
+};
+exports.StorageConfigController = StorageConfigController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, index_1.Auth)({ permissions: [storage_constants_1.PERMISSIONS.STORAGE_CONFIG_READ] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get the object-storage configuration (Admin only)',
+        description: 'Returns the `storage` settings namespace together with `secretStatus`, a masked, ' +
+            'non-secret description of the stored secret access key. **The secret access key ' +
+            'itself is never returned by this or any other endpoint** — it is held in the ' +
+            'encrypted credential store and is unreadable through the API by design. ' +
+            '`accessKeyId` IS returned: it is an identifier that travels in the clear in every ' +
+            'signed request, and an administrator who cannot see it cannot tell a rotated key ' +
+            'from a mistyped one.\n\n' +
+            '`configured` is the single definition of "this deployment can store a file", ' +
+            'answered by the same function the upload path asks; `missing` names every field ' +
+            'standing in the way. `effectiveEndpoint` is read-only and is what an S3 client ' +
+            "would actually be pointed at — for R2 that is derived from the account id, so a " +
+            'settings page never has to build that host itself.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'The storage configuration and the masked status of its stored secret',
+        type: storage_config_response_dto_1.StorageConfigResponseDto,
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], StorageConfigController.prototype, "getConfig", null);
+__decorate([
+    (0, common_1.Put)(),
+    (0, index_1.Auth)({ permissions: [storage_constants_1.PERMISSIONS.STORAGE_CONFIG_WRITE] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Replace the object-storage configuration (Admin only)',
+        description: 'Full replace of the seven settings fields. `secretAccessKey` is **write-only**: ' +
+            'send it to set or rotate the secret, and **omit it or send it empty to keep the ' +
+            'stored one**. There is no way to erase a stored secret through this endpoint.\n\n' +
+            'Sending an empty string for a text field CLEARS it — that is how an operator drops ' +
+            'an endpoint override, or un-configures storage entirely by clearing `bucket`.\n\n' +
+            '**`409` when the save would repoint a deployment that still holds objects.** ' +
+            'Changing `provider`, `bucket` or the effective endpoint does NOT copy anything: ' +
+            'existing objects and database-backup archives stay where they are and become ' +
+            'unreachable. The 409 body names how many rows are affected; re-send with ' +
+            '`{"confirmation":"SWITCH"}` to proceed. A first configuration, or one with nothing ' +
+            'stored at the old location, needs no confirmation.',
+    }),
+    (0, swagger_1.ApiHeader)({
+        name: 'If-Match',
+        description: 'Expected `version` for optimistic concurrency. Use `0` to assert that nothing is ' +
+            'stored yet. Omit to overwrite unconditionally. Note this is the version of the ' +
+            'whole system-settings row, so a concurrent save of an unrelated setting can cause ' +
+            'a conflict — reload and re-apply.',
+        required: false,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'The updated storage configuration',
+        type: storage_config_response_dto_1.StorageConfigResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Validation error' }),
+    (0, swagger_1.ApiResponse)({
+        status: 409,
+        description: 'Version conflict, or the save relocates storage and the `SWITCH` confirmation was ' +
+            'missing',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __param(2, (0, common_1.Headers)('if-match')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [update_storage_config_dto_1.UpdateStorageConfigDto, String, String]),
+    __metadata("design:returntype", Promise)
+], StorageConfigController.prototype, "replaceConfig", null);
+__decorate([
+    (0, common_1.Post)('test'),
+    (0, index_1.Auth)({ permissions: [storage_constants_1.PERMISSIONS.STORAGE_CONFIG_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Test an object-storage configuration (Admin only)',
+        description: 'Runs four checks against the configuration **in the request body**, which does not ' +
+            'have to have been saved — so a new bucket can be proved before the deployment is ' +
+            'committed to it. A blank `secretAccessKey` means "use the stored one".\n\n' +
+            '**This returns HTTP 200 even when the configuration is broken.** A refused request ' +
+            'is a successful diagnosis, and it is the reason this endpoint exists — read the ' +
+            '`success` field. Treating 200 as "storage works" reports success for every ' +
+            'misconfiguration there is.\n\n' +
+            'Each check is reported separately, with a machine-readable `code`, because the ' +
+            'ways this can fail need different fixes. In particular `bucket_missing` (404 — no ' +
+            'such bucket, create it) and `bucket_forbidden` (403 — it exists and this key may ' +
+            'not see it, so widen the policy or fix a typo that landed on somebody else’s ' +
+            'bucket) are deliberately NOT collapsed together.\n\n' +
+            'The round-trip check writes one small object under `storage-config-test/` and ' +
+            'deletes it again.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'The outcome of the four checks. Check `success`; each entry in `checks` carries a ' +
+            "`code`, an actionable `detail` and the provider's verbatim `error`.",
+        type: storage_connection_test_dto_1.StorageConnectionTestResultDto,
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [storage_connection_test_dto_1.TestStorageConfigDto, String]),
+    __metadata("design:returntype", Promise)
+], StorageConfigController.prototype, "testConfig", null);
+__decorate([
+    (0, common_1.Post)('bucket'),
+    (0, index_1.Auth)({ permissions: [storage_constants_1.PERMISSIONS.STORAGE_CONFIG_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Create and harden the configured bucket (Admin only)',
+        description: 'Creates the bucket named by the configuration **in the request body**, then applies ' +
+            'the settings this application needs: all public access blocked and default ' +
+            'encryption on (AWS S3 only — R2 buckets are private and encrypted by default), and ' +
+            'a CORS rule allowing `PUT`/`GET`/`HEAD` from this deployment’s own origin **with ' +
+            '`ExposeHeaders: ["ETag"]`**, which browser multipart uploads cannot complete ' +
+            'without.\n\n' +
+            'Every step reports its own outcome: a bucket that was created but could not be ' +
+            'hardened answers `outcome: "partial"` and says which step failed, rather than ' +
+            'reporting a success that hides it.\n\n' +
+            '**A credential without `s3:CreateBucket` answers `200` with `outcome: "guided"`** ' +
+            'and a ready-to-paste command block with this deployment’s real values in it — ' +
+            'never a 4xx. A least-privilege credential that cannot create buckets is the ' +
+            'ordinary configuration, not a fault.\n\n' +
+            'Safe to repeat: a bucket that already exists and belongs to this account is left ' +
+            'alone and the hardening steps still run, which is also the repair path for a bucket ' +
+            'created by hand without a CORS rule.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'The per-step outcome. Read `outcome`; `guided` carries `guidance.commands` and is ' +
+            'not an error.',
+        type: storage_bucket_provision_dto_1.StorageBucketProvisionResultDto,
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [storage_bucket_provision_dto_1.ProvisionStorageBucketDto, String]),
+    __metadata("design:returntype", Promise)
+], StorageConfigController.prototype, "provisionBucket", null);
+exports.StorageConfigController = StorageConfigController = __decorate([
+    (0, swagger_1.ApiTags)('Storage Configuration'),
+    (0, common_1.Controller)('admin/storage-config'),
+    __metadata("design:paramtypes", [storage_config_admin_service_1.StorageConfigAdminService,
+        storage_connection_test_service_1.StorageConnectionTestService,
+        storage_bucket_provision_service_1.StorageBucketProvisionService])
+], StorageConfigController);
+//# sourceMappingURL=storage-config.controller.js.map

package/dist/storage/config/storage-config.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.controller.js","sourceRoot":"","sources":["../../../src/storage/config/storage-config.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAgF;AAEhF,gDAAyD;AACzD,4DAAmD;AACnD,yFAAmF;AACnF,iFAA2E;AAC3E,uFAAiF;AACjF,qFAAgH;AAChH,mFAA6E;AAC7E,mFAG2C;AAC3C,+EAAyE;AAEzE,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,gEAAgE;AAChE,iEAAiE;AACjE,iEAAiE;AACjE,iEAAiE;AACjE,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,mDAAmD;AACnD,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,EAAE;AACF,gFAAgF;AAChF,oDAAoD;AACpD,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,wEAAwE;AACxE,qEAAqE;AACrE,qDAAqD;AACrD,EAAE;AACF,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;AAChF,EAAE;AACF,wEAAwE;AACxE,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,SAAS;AACT,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,uDAAuD;AACvD,gFAAgF;AAEhF;;;;;;GAMG;AAGI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAEf;IACA;IACA;IAHnB,YACmB,aAAwC,EACxC,cAA4C,EAC5C,eAA8C;QAF9C,kBAAa,GAAb,aAAa,CAA2B;QACxC,mBAAc,GAAd,cAAc,CAA8B;QAC5C,oBAAe,GAAf,eAAe,CAA+B;IAC9D,CAAC;IAyBE,AAAN,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC;IAwCK,AAAN,KAAK,CAAC,aAAa,CACT,GAA2B,EAChB,MAAc,EACZ,OAAgB;QAErC,6DAA6D;QAC7D,6EAA6E;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,sEAAsE;QACtE,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAClE,CAAC;IA8BK,AAAN,KAAK,CAAC,UAAU,CACN,GAAyB,EACd,MAAc;QAEjC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAgCK,AAAN,KAAK,CAAC,eAAe,CACX,GAA8B,EACnB,MAAc;QAEjC,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AAhKY,0DAAuB;AA8B5B;IAvBL,IAAA,YAAG,GAAE;IACL,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,+BAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACxD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,mFAAmF;YACnF,kFAAkF;YAClF,+EAA+E;YAC/E,0EAA0E;YAC1E,oFAAoF;YACpF,mFAAmF;YACnF,0BAA0B;YAC1B,+EAA+E;YAC/E,kFAAkF;YAClF,iFAAiF;YACjF,kFAAkF;YAClF,oDAAoD;KACvD,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,sDAAwB;KAC/B,CAAC;;;;wDAGD;AAwCK;IAtCL,IAAA,YAAG,GAAE;IACL,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,+BAAW,CAAC,oBAAoB,CAAC,EAAE,CAAC;IACzD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,kFAAkF;YAClF,kFAAkF;YAClF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,+EAA+E;YAC/E,kFAAkF;YAClF,+EAA+E;YAC/E,2EAA2E;YAC3E,qFAAqF;YACrF,oDAAoD;KACvD,CAAC;IACD,IAAA,mBAAS,EAAC;QACT,IAAI,EAAE,UAAU;QAChB,WAAW,EACT,mFAAmF;YACnF,iFAAiF;YACjF,oFAAoF;YACpF,mCAAmC;QACrC,QAAQ,EAAE,KAAK;KAChB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,mCAAmC;QAChD,IAAI,EAAE,sDAAwB;KAC/B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC7D,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EACT,oFAAoF;YACpF,SAAS;KACZ,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;IACjB,WAAA,IAAA,gBAAO,EAAC,UAAU,CAAC,CAAA;;qCAFP,kDAAsB;;4DAcpC;AA8BK;IA5BL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,+BAAW,CAAC,oBAAoB,CAAC,EAAE,CAAC;IACzD,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,qFAAqF;YACrF,mFAAmF;YACnF,4EAA4E;YAC5E,qFAAqF;YACrF,kFAAkF;YAClF,6EAA6E;YAC7E,gCAAgC;YAChC,iFAAiF;YACjF,oFAAoF;YACpF,mFAAmF;YACnF,+EAA+E;YAC/E,sDAAsD;YACtD,gFAAgF;YAChF,mBAAmB;KACtB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EACT,oFAAoF;YACpF,qEAAqE;QACvE,IAAI,EAAE,4DAA8B;KACrC,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;;qCADL,kDAAoB;;yDAIlC;AAgCK;IA9BL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,+BAAW,CAAC,oBAAoB,CAAC,EAAE,CAAC;IACzD,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EACT,sFAAsF;YACtF,6EAA6E;YAC7E,qFAAqF;YACrF,mFAAmF;YACnF,+EAA+E;YAC/E,cAAc;YACd,iFAAiF;YACjF,gFAAgF;YAChF,wCAAwC;YACxC,oFAAoF;YACpF,gFAAgF;YAChF,8EAA8E;YAC9E,0CAA0C;YAC1C,mFAAmF;YACnF,sFAAsF;YACtF,sCAAsC;KACzC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EACT,oFAAoF;YACpF,eAAe;QACjB,IAAI,EAAE,8DAA+B;KACtC,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;;qCADL,wDAAyB;;8DAIvC;kCA/JU,uBAAuB;IAFnC,IAAA,iBAAO,EAAC,uBAAuB,CAAC;IAChC,IAAA,mBAAU,EAAC,sBAAsB,CAAC;qCAGC,wDAAyB;QACxB,8DAA4B;QAC3B,gEAA6B;GAJtD,uBAAuB,CAgKnC"}

package/dist/storage/config/storage-config.d.ts

@@ -0,0 +1,104 @@
+/**
+ * A configuration that is complete enough to build a provider from.
+ *
+ * `bucket`, `region` and `endpoint` are the driver's `location()`, already
+ * resolved (R2's endpoint is derived, a missing region carries the driver's
+ * default): a caller holding one has nothing left to decide. `settings` is the
+ * driver's parsed settings; `secrets` its stored secrets by name.
+ *
+ * ⚠ `secrets` IS PLAINTEXT. It is here because a provider cannot be built
+ * without it. Treat a value of this type the way
+ * `CredentialsService.getSecret` tells you to treat its return: use it, then
+ * let it go out of scope. Do not store one on an instance field, do not put one
+ * in a DTO, do not log one, and do not hand one to an error constructor.
+ * `StorageConfigService` holds to that rule itself: it caches the settings half
+ * and re-reads the secrets every time.
+ *
+ * @stability experimental
+ */
+export interface ResolvedStorageConfig {
+    /** The id of the active driver. */
+    provider: string;
+    /** The bucket, container or directory name. Never empty. */
+    bucket: string;
+    /** The region; empty when the backend has none. */
+    region: string;
+    /**
+     * The origin the driver talks to, or absent for "the SDK's own default host".
+     * Absent is meaningful and is NOT the same as empty.
+     */
+    endpoint?: string;
+    /** The driver's parsed, non-secret settings. */
+    settings: Readonly<Record<string, unknown>>;
+    /** ⚠ Plaintext. The driver's stored secrets by declared name. See the type's own warning. */
+    secrets: Readonly<Record<string, string>>;
+}
+/**
+ * The result of asking whether storage is usable: yes with a config, or no with
+ * the list of reasons.
+ *
+ * A DISCRIMINATED UNION RATHER THAN `ResolvedStorageConfig | null`, because the
+ * `null` branch is the one that has to be explained to a person. An operator
+ * whose uploads have started returning 503 needs "bucket, secretAccessKey",
+ * and a bare `null` forces whoever writes the error to re-derive that list.
+ *
+ * @stability experimental
+ */
+export type StorageConfigResolution = {
+    /** Usable. */
+    configured: true;
+    /** The resolved configuration a provider is built from. */
+    config: ResolvedStorageConfig;
+} | {
+    /** Not usable. */
+    configured: false;
+    /** Which driver's requirements were checked. */
+    provider: string;
+    /** Every missing field the driver named, not just the first. */
+    missing: string[];
+};
+/**
+ * A stable, non-reversible identity for a resolved configuration.
+ *
+ * WHAT IT IS FOR: `ResolvingStorageProvider` keeps a built provider and needs
+ * to know, per call, whether the configuration that produced it is still the
+ * configuration in force. Comparing fingerprints answers that in constant time
+ * and, crucially, ACROSS A SECRET ROTATION: the secrets are an input, so a key
+ * rotated in the credential store yields a different fingerprint, the old
+ * provider is discarded, and the new key is in use on the very next call rather
+ * than at the next restart.
+ *
+ * WHY A HASH RATHER THAN THE VALUES JOINED. Keying on the raw tuple would park
+ * a plaintext copy of the secrets on a long-lived instance field for the life
+ * of the process, where a heap dump or a careless `JSON.stringify(this)` in a
+ * debug log would find it. SHA-256 detects change exactly as well and carries
+ * nothing back out.
+ *
+ * ⚠ NEVER LOG THE RETURN VALUE. It is a hash of a secret; publishing it invites
+ * exactly the offline guessing attack the hash is otherwise immune to. Use
+ * {@link describeStorageConfig} for anything a human will read.
+ *
+ * Every field that changes the bytes on the wire is an input, and nothing else
+ * is: two configurations with the same fingerprint are two configurations the
+ * same provider can serve.
+ *
+ * @stability experimental
+ */
+export declare function fingerprintStorageConfig(config: ResolvedStorageConfig): string;
+/**
+ * A one-line, SECRET-FREE description of a configuration, for log lines.
+ *
+ * Exists so that "which storage is this process using?" is answerable from the
+ * logs without anybody being tempted to interpolate the config object itself,
+ * which would put the secrets in the log pipeline, in whatever aggregator ships
+ * it, and in every retention window downstream.
+ *
+ * An `accessKeyId` setting is included when the driver has one: it is an
+ * identifier that travels in the clear in every SigV4 `Authorization` header,
+ * and the one field that distinguishes "the key was rotated" from "the key was
+ * mistyped" when both look the same from the outside.
+ *
+ * @stability experimental
+ */
+export declare function describeStorageConfig(config: ResolvedStorageConfig): string;
+//# sourceMappingURL=storage-config.d.ts.map

package/dist/storage/config/storage-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.d.ts","sourceRoot":"","sources":["../../../src/storage/config/storage-config.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,6FAA6F;IAC7F,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IACE,cAAc;IACd,UAAU,EAAE,IAAI,CAAC;IACjB,2DAA2D;IAC3D,MAAM,EAAE,qBAAqB,CAAC;CAC/B,GACD;IACE,kBAAkB;IAClB,UAAU,EAAE,KAAK,CAAC;IAClB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAW9E;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAK3E"}

package/dist/storage/config/storage-config.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fingerprintStorageConfig = fingerprintStorageConfig;
+exports.describeStorageConfig = describeStorageConfig;
+const node_crypto_1 = require("node:crypto");
+/**
+ * A stable, non-reversible identity for a resolved configuration.
+ *
+ * WHAT IT IS FOR: `ResolvingStorageProvider` keeps a built provider and needs
+ * to know, per call, whether the configuration that produced it is still the
+ * configuration in force. Comparing fingerprints answers that in constant time
+ * and, crucially, ACROSS A SECRET ROTATION: the secrets are an input, so a key
+ * rotated in the credential store yields a different fingerprint, the old
+ * provider is discarded, and the new key is in use on the very next call rather
+ * than at the next restart.
+ *
+ * WHY A HASH RATHER THAN THE VALUES JOINED. Keying on the raw tuple would park
+ * a plaintext copy of the secrets on a long-lived instance field for the life
+ * of the process, where a heap dump or a careless `JSON.stringify(this)` in a
+ * debug log would find it. SHA-256 detects change exactly as well and carries
+ * nothing back out.
+ *
+ * ⚠ NEVER LOG THE RETURN VALUE. It is a hash of a secret; publishing it invites
+ * exactly the offline guessing attack the hash is otherwise immune to. Use
+ * {@link describeStorageConfig} for anything a human will read.
+ *
+ * Every field that changes the bytes on the wire is an input, and nothing else
+ * is: two configurations with the same fingerprint are two configurations the
+ * same provider can serve.
+ *
+ * @stability experimental
+ */
+function fingerprintStorageConfig(config) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify([
+        config.provider,
+        // Sorted, so two spellings of one configuration agree.
+        sortedEntries(config.settings),
+        sortedEntries(config.secrets),
+    ]))
+        .digest('hex');
+}
+function sortedEntries(record) {
+    return Object.entries(record).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+}
+/**
+ * A one-line, SECRET-FREE description of a configuration, for log lines.
+ *
+ * Exists so that "which storage is this process using?" is answerable from the
+ * logs without anybody being tempted to interpolate the config object itself,
+ * which would put the secrets in the log pipeline, in whatever aggregator ships
+ * it, and in every retention window downstream.
+ *
+ * An `accessKeyId` setting is included when the driver has one: it is an
+ * identifier that travels in the clear in every SigV4 `Authorization` header,
+ * and the one field that distinguishes "the key was rotated" from "the key was
+ * mistyped" when both look the same from the outside.
+ *
+ * @stability experimental
+ */
+function describeStorageConfig(config) {
+    const where = config.endpoint ?? (config.region ? `${config.region} (default host)` : 'the default host');
+    const keyId = typeof config.settings.accessKeyId === 'string' && config.settings.accessKeyId ? ` keyId=${config.settings.accessKeyId}` : '';
+    return `${config.provider} bucket=${config.bucket} at=${where}${keyId}`;
+}
+//# sourceMappingURL=storage-config.js.map

package/dist/storage/config/storage-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.js","sourceRoot":"","sources":["../../../src/storage/config/storage-config.ts"],"names":[],"mappings":";;AA4GA,4DAWC;AAqBD,sDAKC;AAjJD,6CAAyC;AAiFzC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,wBAAwB,CAAC,MAA6B;IACpE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,MAAM,CAAC,QAAQ;QACf,uDAAuD;QACvD,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9B,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;KAC9B,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAAyC;IAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,qBAAqB,CAAC,MAA6B;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5I,OAAO,GAAG,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,CAAC;AAC1E,CAAC"}

package/dist/storage/config/storage-config.module.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The storage configuration admin surface: `/api/admin/storage-config` (read,
+ * save, connection test, bucket provisioning; `storage_config:read|write`),
+ * the `storage.config` and `storage.bucket` Doctor checks and the egress
+ * contributor. Exports nothing.
+ *
+ * @stability experimental
+ */
+export declare class StorageConfigModule {
+}
+//# sourceMappingURL=storage-config.module.d.ts.map

package/dist/storage/config/storage-config.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.module.d.ts","sourceRoot":"","sources":["../../../src/storage/config/storage-config.module.ts"],"names":[],"mappings":"AAyEA;;;;;;;GAOG;AACH,qBAea,mBAAmB;CAAG"}

package/dist/storage/config/storage-config.module.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageConfigModule = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../credentials/index");
+const storage_providers_module_1 = require("../providers/storage-providers.module");
+const storage_bucket_provision_service_1 = require("./storage-bucket-provision.service");
+const storage_config_admin_service_1 = require("./storage-config-admin.service");
+const storage_config_controller_1 = require("./storage-config.controller");
+const storage_connection_test_service_1 = require("./storage-connection-test.service");
+const storage_submission_service_1 = require("./storage-submission.service");
+const storage_bucket_doctor_check_1 = require("./doctor/storage-bucket.doctor-check");
+const storage_config_doctor_check_1 = require("./doctor/storage-config.doctor-check");
+const storage_egress_contributor_1 = require("./doctor/egress/storage.egress.contributor");
+// =============================================================================
+// StorageConfigModule (issue #375, epic #372)
+// =============================================================================
+//
+// The admin surface for object-storage CONFIGURATION: one controller and the
+// three services behind it.
+//
+// -----------------------------------------------------------------------------
+// WHY A NEW MODULE, AND NOT `StorageModule` OR `StorageProvidersModule`
+// -----------------------------------------------------------------------------
+//
+// ⚠ NOT `StorageProvidersModule`, although that is where `StorageConfigService`
+// lives and so looks like the natural home. That module is dependency-injection
+// infrastructure — it has no controller and its own header says it exists to
+// "provide dependency injection for storage provider implementations". Giving it
+// an HTTP surface is precisely what `CredentialsModule`'s header argues against
+// for the identical case: "the admin UI that eventually needs one adds it in its
+// own module, where reviewing it is the point of the diff rather than a detail
+// buried in shared infrastructure." A route that hands out object-store
+// credentials' masked state and drives `CreateBucket` is exactly the kind of
+// route that should be a visible module in `AppModule`'s list.
+//
+// ⚠ NOT `StorageModule` either, which is the other obvious candidate. That
+// module is the OBJECT surface: `ObjectsController`, each route gated on
+// `storage:read` (list, get, download) or `storage:write` (upload, metadata,
+// delete; `storage:delete_any` widens delete to other users' objects, #516),
+// plus the upload pipeline, the cleanup job and the processing chain. It imports `JobsModule` and `ObjectProcessingModule` for that work, and
+// a settings page has no use for either. The two surfaces also differ on the one
+// axis that matters most here: `StorageModule`'s routes are for EVERY user of
+// the application (Viewer holds `storage:read`), and these routes are for the
+// one or two people who decide which object store the deployment uses. Folding
+// an Admin-only configuration surface into the module every user's uploads go
+// through makes the permission boundary a detail of a decorator rather than a
+// module you can point at.
+//
+// -----------------------------------------------------------------------------
+// THE THREE IMPORTS, AND WHY NONE OF THEM IS A CYCLE
+// -----------------------------------------------------------------------------
+//
+//   * `StorageProvidersModule` exports `StorageConfigService`, whose
+//     `invalidateCache()` the write path must call the instant a save commits.
+//     It is a one-way edge: nothing in that module knows this one exists.
+//   * `SettingsModule` for `SystemSettingsService` — the `storage` namespace is
+//     part of the single `global` settings row, so the write goes through
+//     `patchSettings` rather than a hand-rolled upsert (see
+//     `storage-config-admin.service.ts` for why that matters). `SettingsModule`
+//     is a LEAF: it imports nothing, which is the property
+//     `storage-providers.module.ts` already documents and relies on.
+//   * `CredentialsModule` for the secret access key. It is deliberately not
+//     `@Global()` — "requiring `imports: [CredentialsModule]` makes every new
+//     consumer a visible line in a diff" — and this line is that diff.
+//
+// `PrismaModule` is `@Global()`, so `PrismaService` needs no import; it is used
+// for the audit rows and for the switch gate's two `count` queries.
+//
+// NOTHING IS EXPORTED. These services back one settings page and have no second
+// consumer; the moment one appears, adding an `exports` line is the diff that
+// should be reviewed.
+// =============================================================================
+/**
+ * The storage configuration admin surface: `/api/admin/storage-config` (read,
+ * save, connection test, bucket provisioning; `storage_config:read|write`),
+ * the `storage.config` and `storage.bucket` Doctor checks and the egress
+ * contributor. Exports nothing.
+ *
+ * @stability experimental
+ */
+let StorageConfigModule = class StorageConfigModule {
+};
+exports.StorageConfigModule = StorageConfigModule;
+exports.StorageConfigModule = StorageConfigModule = __decorate([
+    (0, common_1.Module)({
+        imports: [storage_providers_module_1.StorageProvidersModule, index_1.CredentialsModule],
+        controllers: [storage_config_controller_1.StorageConfigController],
+        providers: [
+            storage_config_admin_service_1.StorageConfigAdminService,
+            storage_submission_service_1.StorageSubmissionService,
+            storage_connection_test_service_1.StorageConnectionTestService,
+            storage_bucket_provision_service_1.StorageBucketProvisionService,
+            // Doctor checks (#634): read-only, never the connection test above.
+            storage_config_doctor_check_1.StorageConfigDoctorCheck,
+            storage_bucket_doctor_check_1.StorageBucketDoctorCheck,
+            // Egress inventory (#773): the object store's host (server and browser).
+            storage_egress_contributor_1.StorageEgressContributor,
+        ],
+    })
+], StorageConfigModule);
+//# sourceMappingURL=storage-config.module.js.map

package/dist/storage/config/storage-config.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.module.js","sourceRoot":"","sources":["../../../src/storage/config/storage-config.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AAExC,mDAA4D;AAC5D,oFAA+E;AAC/E,yFAAmF;AACnF,iFAA2E;AAC3E,2EAAsE;AACtE,uFAAiF;AACjF,6EAAwE;AACxE,sFAAgF;AAChF,sFAAgF;AAChF,2FAAsF;AAEtF,gFAAgF;AAChF,8CAA8C;AAC9C,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,4BAA4B;AAC5B,EAAE;AACF,gFAAgF;AAChF,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,8IAA8I;AAC9I,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAChF,EAAE;AACF,qEAAqE;AACrE,+EAA+E;AAC/E,0EAA0E;AAC1E,gFAAgF;AAChF,0EAA0E;AAC1E,4DAA4D;AAC5D,gFAAgF;AAChF,2DAA2D;AAC3D,qEAAqE;AACrE,4EAA4E;AAC5E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,oEAAoE;AACpE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;;GAOG;AAgBI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAAG,CAAA;AAAtB,kDAAmB;8BAAnB,mBAAmB;IAf/B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,iDAAsB,EAAE,yBAAiB,CAAC;QACpD,WAAW,EAAE,CAAC,mDAAuB,CAAC;QACtC,SAAS,EAAE;YACT,wDAAyB;YACzB,qDAAwB;YACxB,8DAA4B;YAC5B,gEAA6B;YAC7B,oEAAoE;YACpE,sDAAwB;YACxB,sDAAwB;YACxB,yEAAyE;YACzE,qDAAwB;SACzB;KACF,CAAC;GACW,mBAAmB,CAAG"}

package/dist/storage/config/storage-config.permissions.d.ts

@@ -0,0 +1,17 @@
+import type { StoragePermissionDeclaration } from '../storage.permissions';
+/**
+ * The storage CONFIGURATION permissions (`storage_config:read`,
+ * `storage_config:write`): system scope, `admin` only, deliberately distinct
+ * from both `system_settings:*` and `storage:*`. The admin `Storage` card
+ * declares `storage_config:read`, the exact string
+ * `StorageConfigController` enforces.
+ *
+ * @stability stable
+ */
+export declare const STORAGE_CONFIG_PERMISSIONS: {
+    /** `storage_config:read`: view the configuration and the secret's masked status. */
+    readonly STORAGE_CONFIG_READ: StoragePermissionDeclaration<'storage_config:read'>;
+    /** `storage_config:write`: change it, test it and provision a bucket. */
+    readonly STORAGE_CONFIG_WRITE: StoragePermissionDeclaration<'storage_config:write'>;
+};
+//# sourceMappingURL=storage-config.permissions.d.ts.map

package/dist/storage/config/storage-config.permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-config.permissions.d.ts","sourceRoot":"","sources":["../../../src/storage/config/storage-config.permissions.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAQ3E;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE;IACvC,oFAAoF;IACpF,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;IAClF,yEAAyE;IACzE,QAAQ,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;CAyCrF,CAAC"}