@open-mercato/storage-s3 0.6.7-develop.6572.1.3d8e83062f → 0.6.7-develop.6574.1.05dcf72ba8

package/dist/modules/storage_s3/api/delete/storage-providers/s3/delete.js

@@ -16,7 +16,7 @@ async function resolveDriver(tenantId, orgId) {
   const credentialsService = resolve("integrationCredentialsService");
   const creds = await credentialsService.resolve("storage_s3", { tenantId, organizationId: orgId });
   if (!creds) return null;
-  return new S3StorageDriver(creds);
+  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId });
 }
 async function DELETE(req) {
   const auth = await getAuthFromRequest(req);

package/dist/modules/storage_s3/api/delete/storage-providers/s3/delete.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/storage_s3/api/delete/storage-providers/s3/delete.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { isS3KeyAddressableByScope } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/delete',\n  DELETE: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst requestSchema = z.object({\n  key: z.string().min(1),\n})\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver(creds)\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const json = await req.json().catch(() => null)\n  const parsed = requestSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  if (!isS3KeyAddressableByScope(parsed.data.key, auth.orgId, auth.tenantId)) {\n    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  await driver.delete('', parsed.data.key)\n  return new NextResponse(null, { status: 204 })\n}\n\nexport default DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Delete file from S3',\n  methods: {\n    DELETE: {\n      summary: 'Delete a file from S3 by key',\n      description: 'Permanently removes the object at the given key from the configured S3 bucket.',\n      requestBody: { contentType: 'application/json', schema: requestSchema },\n      responses: [{ status: 204, description: 'File deleted', schema: z.null() }],\n      errors: [\n        { status: 400, description: 'Invalid payload or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key not scoped to this tenant', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC7E;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC;AAED,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,KAAK;AAClC;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,MAAI,CAAC,0BAA0B,OAAO,KAAK,KAAK,KAAK,OAAO,KAAK,QAAQ,GAAG;AAC1E,WAAO,aAAa,KAAK,EAAE,OAAO,mDAAmD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,OAAO,OAAO,IAAI,OAAO,KAAK,GAAG;AACvC,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEA,IAAO,iBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,cAAc;AAAA,MACtE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,KAAK,EAAE,CAAC;AAAA,MAC1E,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { isS3KeyAddressableByScope } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/delete',\n  DELETE: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst requestSchema = z.object({\n  key: z.string().min(1),\n})\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const json = await req.json().catch(() => null)\n  const parsed = requestSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  if (!isS3KeyAddressableByScope(parsed.data.key, auth.orgId, auth.tenantId)) {\n    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  await driver.delete('', parsed.data.key)\n  return new NextResponse(null, { status: 204 })\n}\n\nexport default DELETE\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Delete file from S3',\n  methods: {\n    DELETE: {\n      summary: 'Delete a file from S3 by key',\n      description: 'Permanently removes the object at the given key from the configured S3 bucket.',\n      requestBody: { contentType: 'application/json', schema: requestSchema },\n      responses: [{ status: 204, description: 'File deleted', schema: z.null() }],\n      errors: [\n        { status: 400, description: 'Invalid payload or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key not scoped to this tenant', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC7E;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC;AAED,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,EAAE,GAAG,OAAO,gBAAgB,OAAO,SAAS,CAAC;AAC1E;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,MAAI,CAAC,0BAA0B,OAAO,KAAK,KAAK,KAAK,OAAO,KAAK,QAAQ,GAAG;AAC1E,WAAO,aAAa,KAAK,EAAE,OAAO,mDAAmD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,OAAO,OAAO,IAAI,OAAO,KAAK,GAAG;AACvC,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEA,IAAO,iBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,cAAc;AAAA,MACtE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,KAAK,EAAE,CAAC;AAAA,MAC1E,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/storage_s3/api/get/storage-providers/s3/download.js

@@ -18,7 +18,7 @@ async function resolveDriver(tenantId, orgId) {
   const credentialsService = resolve("integrationCredentialsService");
   const creds = await credentialsService.resolve("storage_s3", { tenantId, organizationId: orgId });
   if (!creds) return null;
-  return new S3StorageDriver(creds);
+  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId });
 }
 async function GET(req) {
   const auth = await getAuthFromRequest(req);

package/dist/modules/storage_s3/api/get/storage-providers/s3/download.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/storage_s3/api/get/storage-providers/s3/download.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n  sanitizeUploadedFileName,\n} from '@open-mercato/core/modules/attachments/lib/security'\nimport { isS3KeyAddressableByScope } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/download',\n  GET: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver(creds)\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const key = new URL(req.url).searchParams.get('key')\n  if (!key) {\n    return NextResponse.json({ error: 'key query param is required' }, { status: 400 })\n  }\n\n  if (!isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)) {\n    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  let buffer: Buffer\n  let contentType: string | undefined\n  try {\n    const result = await driver.read('', key)\n    buffer = result.buffer\n    contentType = result.contentType\n  } catch {\n    return NextResponse.json({ error: 'File not found' }, { status: 404 })\n  }\n\n  const fileName = sanitizeUploadedFileName(key.split('/').pop() || 'download')\n  const renderInline = canRenderInlineAttachment(contentType)\n  const responseContentType = renderInline ? (contentType ?? 'application/octet-stream') : 'application/octet-stream'\n\n  return new NextResponse(new Uint8Array(buffer), {\n    status: 200,\n    headers: {\n      'Content-Security-Policy': \"default-src 'none'; sandbox\",\n      'Content-Disposition': buildAttachmentContentDisposition(fileName, renderInline ? 'inline' : 'attachment'),\n      'Content-Length': String(buffer.length),\n      'Content-Type': responseContentType,\n      'X-Content-Type-Options': 'nosniff',\n    },\n  })\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Download file from S3',\n  methods: {\n    GET: {\n      summary: 'Download a file from S3 by key',\n      description: 'Streams the file content for the given S3 key. Requires storage_providers.manage feature.',\n      query: z.object({ key: z.string().describe('S3 object key') }),\n      responses: [{ status: 200, description: 'File content stream', schema: z.any() }],\n      errors: [\n        { status: 400, description: 'Missing key or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key not scoped to this tenant', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'File not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,KAAK;AAClC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,KAAK;AACnD,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,MAAI,CAAC,0BAA0B,KAAK,KAAK,OAAO,KAAK,QAAQ,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,mDAAmD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,IAAI,GAAG;AACxC,aAAS,OAAO;AAChB,kBAAc,OAAO;AAAA,EACvB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,WAAW,yBAAyB,IAAI,MAAM,GAAG,EAAE,IAAI,KAAK,UAAU;AAC5E,QAAM,eAAe,0BAA0B,WAAW;AAC1D,QAAM,sBAAsB,eAAgB,eAAe,6BAA8B;AAEzF,SAAO,IAAI,aAAa,IAAI,WAAW,MAAM,GAAG;AAAA,IAC9C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,2BAA2B;AAAA,MAC3B,uBAAuB,kCAAkC,UAAU,eAAe,WAAW,YAAY;AAAA,MACzG,kBAAkB,OAAO,OAAO,MAAM;AAAA,MACtC,gBAAgB;AAAA,MAChB,0BAA0B;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,IAAO,mBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;AAAA,MAC7D,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,IAAI,EAAE,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n  sanitizeUploadedFileName,\n} from '@open-mercato/core/modules/attachments/lib/security'\nimport { isS3KeyAddressableByScope } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/download',\n  GET: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const key = new URL(req.url).searchParams.get('key')\n  if (!key) {\n    return NextResponse.json({ error: 'key query param is required' }, { status: 400 })\n  }\n\n  if (!isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)) {\n    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  let buffer: Buffer\n  let contentType: string | undefined\n  try {\n    const result = await driver.read('', key)\n    buffer = result.buffer\n    contentType = result.contentType\n  } catch {\n    return NextResponse.json({ error: 'File not found' }, { status: 404 })\n  }\n\n  const fileName = sanitizeUploadedFileName(key.split('/').pop() || 'download')\n  const renderInline = canRenderInlineAttachment(contentType)\n  const responseContentType = renderInline ? (contentType ?? 'application/octet-stream') : 'application/octet-stream'\n\n  return new NextResponse(new Uint8Array(buffer), {\n    status: 200,\n    headers: {\n      'Content-Security-Policy': \"default-src 'none'; sandbox\",\n      'Content-Disposition': buildAttachmentContentDisposition(fileName, renderInline ? 'inline' : 'attachment'),\n      'Content-Length': String(buffer.length),\n      'Content-Type': responseContentType,\n      'X-Content-Type-Options': 'nosniff',\n    },\n  })\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Download file from S3',\n  methods: {\n    GET: {\n      summary: 'Download a file from S3 by key',\n      description: 'Streams the file content for the given S3 key. Requires storage_providers.manage feature.',\n      query: z.object({ key: z.string().describe('S3 object key') }),\n      responses: [{ status: 200, description: 'File content stream', schema: z.any() }],\n      errors: [\n        { status: 400, description: 'Missing key or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key not scoped to this tenant', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'File not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,EAAE,GAAG,OAAO,gBAAgB,OAAO,SAAS,CAAC;AAC1E;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,KAAK;AACnD,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,MAAI,CAAC,0BAA0B,KAAK,KAAK,OAAO,KAAK,QAAQ,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,mDAAmD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,IAAI,GAAG;AACxC,aAAS,OAAO;AAChB,kBAAc,OAAO;AAAA,EACvB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,WAAW,yBAAyB,IAAI,MAAM,GAAG,EAAE,IAAI,KAAK,UAAU;AAC5E,QAAM,eAAe,0BAA0B,WAAW;AAC1D,QAAM,sBAAsB,eAAgB,eAAe,6BAA8B;AAEzF,SAAO,IAAI,aAAa,IAAI,WAAW,MAAM,GAAG;AAAA,IAC9C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,2BAA2B;AAAA,MAC3B,uBAAuB,kCAAkC,UAAU,eAAe,WAAW,YAAY;AAAA,MACzG,kBAAkB,OAAO,OAAO,MAAM;AAAA,MACtC,gBAAgB;AAAA,MAChB,0BAA0B;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,IAAO,mBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;AAAA,MAC7D,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,IAAI,EAAE,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACxG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/storage_s3/api/get/storage-providers/s3/list.js

@@ -27,7 +27,7 @@ async function resolveDriver(tenantId, orgId) {
   const credentialsService = resolve("integrationCredentialsService");
   const creds = await credentialsService.resolve("storage_s3", { tenantId, organizationId: orgId });
   if (!creds) return null;
-  return new S3StorageDriver(creds);
+  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId });
 }
 async function GET(req) {
   const auth = await getAuthFromRequest(req);

package/dist/modules/storage_s3/api/get/storage-providers/s3/list.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/storage_s3/api/get/storage-providers/s3/list.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/list',\n  GET: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst querySchema = z.object({\n  prefix: z.string().optional().default(''),\n  maxKeys: z.coerce.number().int().min(1).max(1000).optional().default(100),\n  continuationToken: z.string().optional(),\n})\n\nconst fileSchema = z.object({\n  key: z.string(),\n  size: z.number().int(),\n  lastModified: z.string(),\n})\n\nconst responseSchema = z.object({\n  files: z.array(fileSchema),\n  truncated: z.boolean(),\n  nextContinuationToken: z.string().optional(),\n})\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver(creds)\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const params = Object.fromEntries(new URL(req.url).searchParams.entries())\n  const parsed = querySchema.safeParse(params)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n\n  // Always scope list operations to the tenant namespace to prevent cross-tenant enumeration.\n  const tenantPrefix = `org_${auth.orgId}/tenant_${auth.tenantId}/`\n  const userPrefix = parsed.data.prefix\n  const effectivePrefix = userPrefix.includes(`org_${auth.orgId}/tenant_${auth.tenantId}`)\n    ? userPrefix\n    : tenantPrefix + userPrefix.replace(/^\\//, '')\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const result = await driver.listObjects(\n    effectivePrefix,\n    parsed.data.maxKeys,\n    parsed.data.continuationToken,\n  )\n\n  return NextResponse.json({\n    files: result.files.map((f) => ({\n      key: f.key,\n      size: f.size,\n      lastModified: f.lastModified.toISOString(),\n    })),\n    truncated: result.truncated,\n    nextContinuationToken: result.nextContinuationToken,\n  })\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'List S3 objects',\n  methods: {\n    GET: {\n      summary: 'List files in S3 by prefix',\n      description: 'Returns a paginated list of S3 objects scoped to the authenticated tenant namespace.',\n      query: querySchema,\n      responses: [{ status: 200, description: 'File listing', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid params or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACxC,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACxE,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,cAAc,EAAE,OAAO;AACzB,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,UAAU;AAAA,EACzB,WAAW,EAAE,QAAQ;AAAA,EACrB,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAC7C,CAAC;AAED,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,KAAK;AAClC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,SAAS,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AACzE,QAAM,SAAS,YAAY,UAAU,MAAM;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAGA,QAAM,eAAe,OAAO,KAAK,KAAK,WAAW,KAAK,QAAQ;AAC9D,QAAM,aAAa,OAAO,KAAK;AAC/B,QAAM,kBAAkB,WAAW,SAAS,OAAO,KAAK,KAAK,WAAW,KAAK,QAAQ,EAAE,IACnF,aACA,eAAe,WAAW,QAAQ,OAAO,EAAE;AAE/C,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,MAAM,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,EACd;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,MAC9B,KAAK,EAAE;AAAA,MACP,MAAM,EAAE;AAAA,MACR,cAAc,EAAE,aAAa,YAAY;AAAA,IAC3C,EAAE;AAAA,IACF,WAAW,OAAO;AAAA,IAClB,uBAAuB,OAAO;AAAA,EAChC,CAAC;AACH;AAEA,IAAO,eAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,eAAe,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC3G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/list',\n  GET: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst querySchema = z.object({\n  prefix: z.string().optional().default(''),\n  maxKeys: z.coerce.number().int().min(1).max(1000).optional().default(100),\n  continuationToken: z.string().optional(),\n})\n\nconst fileSchema = z.object({\n  key: z.string(),\n  size: z.number().int(),\n  lastModified: z.string(),\n})\n\nconst responseSchema = z.object({\n  files: z.array(fileSchema),\n  truncated: z.boolean(),\n  nextContinuationToken: z.string().optional(),\n})\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const params = Object.fromEntries(new URL(req.url).searchParams.entries())\n  const parsed = querySchema.safeParse(params)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n\n  // Always scope list operations to the tenant namespace to prevent cross-tenant enumeration.\n  const tenantPrefix = `org_${auth.orgId}/tenant_${auth.tenantId}/`\n  const userPrefix = parsed.data.prefix\n  const effectivePrefix = userPrefix.includes(`org_${auth.orgId}/tenant_${auth.tenantId}`)\n    ? userPrefix\n    : tenantPrefix + userPrefix.replace(/^\\//, '')\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const result = await driver.listObjects(\n    effectivePrefix,\n    parsed.data.maxKeys,\n    parsed.data.continuationToken,\n  )\n\n  return NextResponse.json({\n    files: result.files.map((f) => ({\n      key: f.key,\n      size: f.size,\n      lastModified: f.lastModified.toISOString(),\n    })),\n    truncated: result.truncated,\n    nextContinuationToken: result.nextContinuationToken,\n  })\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'List S3 objects',\n  methods: {\n    GET: {\n      summary: 'List files in S3 by prefix',\n      description: 'Returns a paginated list of S3 objects scoped to the authenticated tenant namespace.',\n      query: querySchema,\n      responses: [{ status: 200, description: 'File listing', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid params or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACxC,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACxE,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,cAAc,EAAE,OAAO;AACzB,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,UAAU;AAAA,EACzB,WAAW,EAAE,QAAQ;AAAA,EACrB,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAC7C,CAAC;AAED,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,EAAE,GAAG,OAAO,gBAAgB,OAAO,SAAS,CAAC;AAC1E;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,SAAS,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AACzE,QAAM,SAAS,YAAY,UAAU,MAAM;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAGA,QAAM,eAAe,OAAO,KAAK,KAAK,WAAW,KAAK,QAAQ;AAC9D,QAAM,aAAa,OAAO,KAAK;AAC/B,QAAM,kBAAkB,WAAW,SAAS,OAAO,KAAK,KAAK,WAAW,KAAK,QAAQ,EAAE,IACnF,aACA,eAAe,WAAW,QAAQ,OAAO,EAAE;AAE/C,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,MAAM,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,EACd;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,MAC9B,KAAK,EAAE;AAAA,MACP,MAAM,EAAE;AAAA,MACR,cAAc,EAAE,aAAa,YAAY;AAAA,IAC3C,EAAE;AAAA,IACF,WAAW,OAAO;AAAA,IAClB,uBAAuB,OAAO;AAAA,EAChC,CAAC;AACH;AAEA,IAAO,eAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,eAAe,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC3G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/storage_s3/api/post/storage-providers/s3/signed-url.js

@@ -23,7 +23,7 @@ async function resolveDriver(tenantId, orgId) {
   const credentialsService = resolve("integrationCredentialsService");
   const creds = await credentialsService.resolve("storage_s3", { tenantId, organizationId: orgId });
   if (!creds) return null;
-  return new S3StorageDriver(creds);
+  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId });
 }
 async function POST(req) {
   const auth = await getAuthFromRequest(req);

package/dist/modules/storage_s3/api/post/storage-providers/s3/signed-url.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/storage_s3/api/post/storage-providers/s3/signed-url.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { isS3KeyAddressableByScope, isS3KeyScopedToTenant } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/signed-url',\n  POST: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst requestSchema = z.object({\n  key: z.string().min(1),\n  operation: z.enum(['upload', 'download']),\n  expiresIn: z.number().int().min(60).max(604800).optional().default(3600),\n  contentType: z.string().optional(),\n})\n\nconst responseSchema = z.object({\n  url: z.string(),\n  expiresAt: z.string(),\n})\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver(creds)\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const json = await req.json().catch(() => null)\n  const parsed = requestSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const { key, operation, expiresIn, contentType } = parsed.data\n  const canAccessKey = operation === 'download'\n    ? isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)\n    : isS3KeyScopedToTenant(key, auth.orgId, auth.tenantId)\n  if (!canAccessKey) {\n    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const url = await driver.getSignedUrl(key, operation, expiresIn, contentType)\n  const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString()\n\n  return NextResponse.json({ url, expiresAt })\n}\n\nexport default POST\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Generate S3 pre-signed URL',\n  methods: {\n    POST: {\n      summary: 'Generate a pre-signed URL for direct browser upload or download',\n      description: 'Returns a time-limited URL that allows a browser to directly upload or download a file from S3.',\n      requestBody: { contentType: 'application/json', schema: requestSchema },\n      responses: [{ status: 200, description: 'Pre-signed URL and expiry', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key not scoped to this tenant', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC3E;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,EAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,MAAM,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACvE,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,KAAK,EAAE,OAAO;AAAA,EACd,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,KAAK;AAClC;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,EAAE,KAAK,WAAW,WAAW,YAAY,IAAI,OAAO;AAC1D,QAAM,eAAe,cAAc,aAC/B,0BAA0B,KAAK,KAAK,OAAO,KAAK,QAAQ,IACxD,sBAAsB,KAAK,KAAK,OAAO,KAAK,QAAQ;AACxD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,mDAAmD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,MAAM,MAAM,OAAO,aAAa,KAAK,WAAW,WAAW,WAAW;AAC5E,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI,EAAE,YAAY;AAEtE,SAAO,aAAa,KAAK,EAAE,KAAK,UAAU,CAAC;AAC7C;AAEA,IAAO,qBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,cAAc;AAAA,MACtE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,eAAe,CAAC;AAAA,MAC7F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { isS3KeyAddressableByScope, isS3KeyScopedToTenant } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/signed-url',\n  POST: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst requestSchema = z.object({\n  key: z.string().min(1),\n  operation: z.enum(['upload', 'download']),\n  expiresIn: z.number().int().min(60).max(604800).optional().default(3600),\n  contentType: z.string().optional(),\n})\n\nconst responseSchema = z.object({\n  url: z.string(),\n  expiresAt: z.string(),\n})\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const json = await req.json().catch(() => null)\n  const parsed = requestSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const { key, operation, expiresIn, contentType } = parsed.data\n  const canAccessKey = operation === 'download'\n    ? isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)\n    : isS3KeyScopedToTenant(key, auth.orgId, auth.tenantId)\n  if (!canAccessKey) {\n    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const url = await driver.getSignedUrl(key, operation, expiresIn, contentType)\n  const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString()\n\n  return NextResponse.json({ url, expiresAt })\n}\n\nexport default POST\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Generate S3 pre-signed URL',\n  methods: {\n    POST: {\n      summary: 'Generate a pre-signed URL for direct browser upload or download',\n      description: 'Returns a time-limited URL that allows a browser to directly upload or download a file from S3.',\n      requestBody: { contentType: 'application/json', schema: requestSchema },\n      responses: [{ status: 200, description: 'Pre-signed URL and expiry', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key not scoped to this tenant', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC3E;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,EAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,MAAM,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACvE,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,KAAK,EAAE,OAAO;AAAA,EACd,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,EAAE,GAAG,OAAO,gBAAgB,OAAO,SAAS,CAAC;AAC1E;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,EAAE,KAAK,WAAW,WAAW,YAAY,IAAI,OAAO;AAC1D,QAAM,eAAe,cAAc,aAC/B,0BAA0B,KAAK,KAAK,OAAO,KAAK,QAAQ,IACxD,sBAAsB,KAAK,KAAK,OAAO,KAAK,QAAQ;AACxD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,mDAAmD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,MAAM,MAAM,OAAO,aAAa,KAAK,WAAW,WAAW,WAAW;AAC5E,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI,EAAE,YAAY;AAEtE,SAAO,aAAa,KAAK,EAAE,KAAK,UAAU,CAAC;AAC7C;AAEA,IAAO,qBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,cAAc;AAAA,MACtE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,eAAe,CAAC;AAAA,MAC7F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/storage_s3/api/post/storage-providers/s3/upload.js

@@ -33,7 +33,7 @@ async function resolveDriver(tenantId, orgId) {
   const credentialsService = resolve("integrationCredentialsService");
   const creds = await credentialsService.resolve("storage_s3", { tenantId, organizationId: orgId });
   if (!creds) return null;
-  return new S3StorageDriver(creds);
+  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId });
 }
 async function readTenantStorageUsageBytes(driver, tenantId, orgId) {
   let totalBytes = 0;

package/dist/modules/storage_s3/api/post/storage-providers/s3/upload.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/storage_s3/api/post/storage-providers/s3/upload.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n} from '@open-mercato/core/modules/attachments/lib/security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '@open-mercato/core/modules/attachments/lib/upload-limits'\nimport { isS3KeyScopedToTenant } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\nimport { randomUUID } from 'crypto'\n\nexport const metadata = {\n  path: '/storage-providers/s3/upload',\n  POST: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst responseSchema = z.object({\n  key: z.string(),\n  bucket: z.string(),\n  size: z.number().int(),\n  contentType: z.string().optional(),\n})\n\nfunction sanitizeFileName(name: string): string {\n  return name.replace(/[^a-zA-Z0-9._-]/g, '_') || 'upload'\n}\n\nasync function resolveDriver(\n  tenantId: string,\n  orgId: string,\n): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver(creds)\n}\n\nasync function readTenantStorageUsageBytes(\n  driver: S3StorageDriver,\n  tenantId: string,\n  orgId: string,\n): Promise<number> {\n  let totalBytes = 0\n  let continuationToken: string | undefined\n\n  do {\n    const page = await driver.listObjects('', 1000, continuationToken)\n    for (const file of page.files) {\n      if (isS3KeyScopedToTenant(file.key, orgId, tenantId)) {\n        totalBytes += file.size\n      }\n    }\n    continuationToken = page.truncated ? page.nextContinuationToken : undefined\n  } while (continuationToken)\n\n  return totalBytes\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const contentType = req.headers.get('content-type') ?? ''\n  if (!contentType.includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n\n  const form = await req.formData()\n  const file = form.get('file') as File | null\n  if (!file) {\n    return NextResponse.json({ error: 'file field is required' }, { status: 400 })\n  }\n\n  const keyOverride = form.get('key') ? String(form.get('key')) : null\n\n  if (keyOverride !== null && !isS3KeyScopedToTenant(keyOverride, auth.orgId, auth.tenantId)) {\n    return NextResponse.json(\n      { error: 'Access denied: key override is not scoped to this tenant.' },\n      { status: 403 },\n    )\n  }\n\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({ error: 'Executable file types are not allowed as attachments.' }, { status: 400 })\n  }\n\n  const effectiveMaxBytes = resolveAttachmentMaxBytes()\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const buffer = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeFileName(file.name)\n  const trustedMimeType = detectAttachmentMimeType(buffer, safeName, file.type || null)\n  if (isActiveContentAttachment(buffer, safeName, trustedMimeType)) {\n    return NextResponse.json({ error: 'Active content uploads are not allowed.' }, { status: 400 })\n  }\n\n  const tenantUsageBytes = await readTenantStorageUsageBytes(driver, auth.tenantId, auth.orgId)\n  if (willExceedAttachmentTenantQuota(tenantUsageBytes, buffer.length)) {\n    return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })\n  }\n\n  const key =\n    keyOverride ??\n    `uploads/org_${auth.orgId}/tenant_${auth.tenantId}/${Date.now()}_${randomUUID().slice(0, 8)}_${safeName}`\n\n  await driver.putObject(key, buffer, trustedMimeType)\n\n  return NextResponse.json({\n    key,\n    bucket: driver.getBucket(),\n    size: buffer.length,\n    contentType: trustedMimeType,\n  })\n}\n\nexport default POST\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Upload file to S3',\n  methods: {\n    POST: {\n      summary: 'Upload a file directly to S3',\n      description: 'Uploads a file to the configured S3 bucket. Requires storage_providers.manage feature.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: z.object({\n          file: z.any().describe('File to upload'),\n          key: z.string().optional().describe('Optional S3 key override (must be scoped to org/tenant)'),\n          contentType: z.string().optional().describe('Optional client-provided content-type hint; the server derives the trusted MIME type.'),\n        }),\n      },\n      responses: [{ status: 200, description: 'Upload result', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Missing file, blocked file type, or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key override not scoped to this tenant', schema: z.object({ error: z.string() }) },\n        { status: 413, description: 'Upload too large or tenant storage quota exceeded', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAEpB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC3E;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,KAAK,EAAE,OAAO;AAAA,EACd,QAAQ,EAAE,OAAO;AAAA,EACjB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAED,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,GAAG,KAAK;AAClD;AAEA,eAAe,cACb,UACA,OACiC;AACjC,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,KAAK;AAClC;AAEA,eAAe,4BACb,QACA,UACA,OACiB;AACjB,MAAI,aAAa;AACjB,MAAI;AAEJ,KAAG;AACD,UAAM,OAAO,MAAM,OAAO,YAAY,IAAI,KAAM,iBAAiB;AACjE,eAAW,QAAQ,KAAK,OAAO;AAC7B,UAAI,sBAAsB,KAAK,KAAK,OAAO,QAAQ,GAAG;AACpD,sBAAc,KAAK;AAAA,MACrB;AAAA,IACF;AACA,wBAAoB,KAAK,YAAY,KAAK,wBAAwB;AAAA,EACpE,SAAS;AAET,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,SAAS,qBAAqB,GAAG;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,KAAK,IAAI,KAAK,IAAI,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI;AAEhE,MAAI,gBAAgB,QAAQ,CAAC,sBAAsB,aAAa,KAAK,OAAO,KAAK,QAAQ,GAAG;AAC1F,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4DAA4D;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK,EAAE,OAAO,wDAAwD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9G;AAEA,QAAM,oBAAoB,0BAA0B;AACpD,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AACnD,QAAM,WAAW,iBAAiB,KAAK,IAAI;AAC3C,QAAM,kBAAkB,yBAAyB,QAAQ,UAAU,KAAK,QAAQ,IAAI;AACpF,MAAI,0BAA0B,QAAQ,UAAU,eAAe,GAAG;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AAEA,QAAM,mBAAmB,MAAM,4BAA4B,QAAQ,KAAK,UAAU,KAAK,KAAK;AAC5F,MAAI,gCAAgC,kBAAkB,OAAO,MAAM,GAAG;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AAEA,QAAM,MACJ,eACA,eAAe,KAAK,KAAK,WAAW,KAAK,QAAQ,IAAI,KAAK,IAAI,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,QAAQ;AAEzG,QAAM,OAAO,UAAU,KAAK,QAAQ,eAAe;AAEnD,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA,QAAQ,OAAO,UAAU;AAAA,IACzB,MAAM,OAAO;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACH;AAEA,IAAO,iBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,EAAE,OAAO;AAAA,UACf,MAAM,EAAE,IAAI,EAAE,SAAS,gBAAgB;AAAA,UACvC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,yDAAyD;AAAA,UAC7F,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uFAAuF;AAAA,QACrI,CAAC;AAAA,MACH;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,eAAe,CAAC;AAAA,MACjF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC7H,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC9G,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC3H;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n} from '@open-mercato/core/modules/attachments/lib/security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '@open-mercato/core/modules/attachments/lib/upload-limits'\nimport { isS3KeyScopedToTenant } from '../../../../lib/key-scope'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\nimport { randomUUID } from 'crypto'\n\nexport const metadata = {\n  path: '/storage-providers/s3/upload',\n  POST: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst responseSchema = z.object({\n  key: z.string(),\n  bucket: z.string(),\n  size: z.number().int(),\n  contentType: z.string().optional(),\n})\n\nfunction sanitizeFileName(name: string): string {\n  return name.replace(/[^a-zA-Z0-9._-]/g, '_') || 'upload'\n}\n\nasync function resolveDriver(\n  tenantId: string,\n  orgId: string,\n): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })\n}\n\nasync function readTenantStorageUsageBytes(\n  driver: S3StorageDriver,\n  tenantId: string,\n  orgId: string,\n): Promise<number> {\n  let totalBytes = 0\n  let continuationToken: string | undefined\n\n  do {\n    const page = await driver.listObjects('', 1000, continuationToken)\n    for (const file of page.files) {\n      if (isS3KeyScopedToTenant(file.key, orgId, tenantId)) {\n        totalBytes += file.size\n      }\n    }\n    continuationToken = page.truncated ? page.nextContinuationToken : undefined\n  } while (continuationToken)\n\n  return totalBytes\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const contentType = req.headers.get('content-type') ?? ''\n  if (!contentType.includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n\n  const form = await req.formData()\n  const file = form.get('file') as File | null\n  if (!file) {\n    return NextResponse.json({ error: 'file field is required' }, { status: 400 })\n  }\n\n  const keyOverride = form.get('key') ? String(form.get('key')) : null\n\n  if (keyOverride !== null && !isS3KeyScopedToTenant(keyOverride, auth.orgId, auth.tenantId)) {\n    return NextResponse.json(\n      { error: 'Access denied: key override is not scoped to this tenant.' },\n      { status: 403 },\n    )\n  }\n\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({ error: 'Executable file types are not allowed as attachments.' }, { status: 400 })\n  }\n\n  const effectiveMaxBytes = resolveAttachmentMaxBytes()\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const buffer = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeFileName(file.name)\n  const trustedMimeType = detectAttachmentMimeType(buffer, safeName, file.type || null)\n  if (isActiveContentAttachment(buffer, safeName, trustedMimeType)) {\n    return NextResponse.json({ error: 'Active content uploads are not allowed.' }, { status: 400 })\n  }\n\n  const tenantUsageBytes = await readTenantStorageUsageBytes(driver, auth.tenantId, auth.orgId)\n  if (willExceedAttachmentTenantQuota(tenantUsageBytes, buffer.length)) {\n    return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })\n  }\n\n  const key =\n    keyOverride ??\n    `uploads/org_${auth.orgId}/tenant_${auth.tenantId}/${Date.now()}_${randomUUID().slice(0, 8)}_${safeName}`\n\n  await driver.putObject(key, buffer, trustedMimeType)\n\n  return NextResponse.json({\n    key,\n    bucket: driver.getBucket(),\n    size: buffer.length,\n    contentType: trustedMimeType,\n  })\n}\n\nexport default POST\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Upload file to S3',\n  methods: {\n    POST: {\n      summary: 'Upload a file directly to S3',\n      description: 'Uploads a file to the configured S3 bucket. Requires storage_providers.manage feature.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: z.object({\n          file: z.any().describe('File to upload'),\n          key: z.string().optional().describe('Optional S3 key override (must be scoped to org/tenant)'),\n          contentType: z.string().optional().describe('Optional client-provided content-type hint; the server derives the trusted MIME type.'),\n        }),\n      },\n      responses: [{ status: 200, description: 'Upload result', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Missing file, blocked file type, or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Key override not scoped to this tenant', schema: z.object({ error: z.string() }) },\n        { status: 413, description: 'Upload too large or tenant storage quota exceeded', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAEpB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC3E;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,KAAK,EAAE,OAAO;AAAA,EACd,QAAQ,EAAE,OAAO;AAAA,EACjB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAED,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KAAK,QAAQ,oBAAoB,GAAG,KAAK;AAClD;AAEA,eAAe,cACb,UACA,OACiC;AACjC,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,EAAE,GAAG,OAAO,gBAAgB,OAAO,SAAS,CAAC;AAC1E;AAEA,eAAe,4BACb,QACA,UACA,OACiB;AACjB,MAAI,aAAa;AACjB,MAAI;AAEJ,KAAG;AACD,UAAM,OAAO,MAAM,OAAO,YAAY,IAAI,KAAM,iBAAiB;AACjE,eAAW,QAAQ,KAAK,OAAO;AAC7B,UAAI,sBAAsB,KAAK,KAAK,OAAO,QAAQ,GAAG;AACpD,sBAAc,KAAK;AAAA,MACrB;AAAA,IACF;AACA,wBAAoB,KAAK,YAAY,KAAK,wBAAwB;AAAA,EACpE,SAAS;AAET,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,SAAS,qBAAqB,GAAG;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,KAAK,IAAI,KAAK,IAAI,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI;AAEhE,MAAI,gBAAgB,QAAQ,CAAC,sBAAsB,aAAa,KAAK,OAAO,KAAK,QAAQ,GAAG;AAC1F,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4DAA4D;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK,EAAE,OAAO,wDAAwD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9G;AAEA,QAAM,oBAAoB,0BAA0B;AACpD,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AACnD,QAAM,WAAW,iBAAiB,KAAK,IAAI;AAC3C,QAAM,kBAAkB,yBAAyB,QAAQ,UAAU,KAAK,QAAQ,IAAI;AACpF,MAAI,0BAA0B,QAAQ,UAAU,eAAe,GAAG;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AAEA,QAAM,mBAAmB,MAAM,4BAA4B,QAAQ,KAAK,UAAU,KAAK,KAAK;AAC5F,MAAI,gCAAgC,kBAAkB,OAAO,MAAM,GAAG;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AAEA,QAAM,MACJ,eACA,eAAe,KAAK,KAAK,WAAW,KAAK,QAAQ,IAAI,KAAK,IAAI,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,QAAQ;AAEzG,QAAM,OAAO,UAAU,KAAK,QAAQ,eAAe;AAEnD,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA,QAAQ,OAAO,UAAU;AAAA,IACzB,MAAM,OAAO;AAAA,IACb,aAAa;AAAA,EACf,CAAC;AACH;AAEA,IAAO,iBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,EAAE,OAAO;AAAA,UACf,MAAM,EAAE,IAAI,EAAE,SAAS,gBAAgB;AAAA,UACvC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,yDAAyD;AAAA,UAC7F,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uFAAuF;AAAA,QACrI,CAAC;AAAA,MACH;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,eAAe,CAAC;AAAA,MACjF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC7H,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC9G,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC3H;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/storage_s3/di.js

@@ -21,16 +21,23 @@ registerExternalStorageDriver("s3", (config) => {
 });
 function register(container) {
   registerExternalCredentialEnhancer("s3", async (config, scope) => {
-    if (config.credentialsEnvPrefix || config.accessKeyId || config.authMode) return config;
+    const scopedConfig = {
+      ...config,
+      organizationId: scope.organizationId,
+      tenantId: scope.tenantId
+    };
+    if (config.credentialsEnvPrefix || config.accessKeyId || config.authMode) return scopedConfig;
     try {
       const credsSvc = container.resolve("integrationCredentialsService");
       const creds = await credsSvc.resolve("storage_s3", scope);
       if (!creds) {
         logger.debug("No marketplace credentials found for scope", { tenantId: scope.tenantId, organizationId: scope.organizationId });
-        return config;
+        return scopedConfig;
       }
       logger.debug("Injecting marketplace credentials into S3 driver config");
       return {
+        organizationId: scope.organizationId,
+        tenantId: scope.tenantId,
         authMode: creds.authMode,
         bucket: config.bucket ?? (creds.bucket ? String(creds.bucket) : void 0),
         region: config.region ?? (creds.region ? String(creds.region) : void 0),
@@ -41,8 +48,8 @@ function register(container) {
         sessionToken: creds.sessionToken ? String(creds.sessionToken) : void 0
       };
     } catch (err) {
-      logger.warn("Credential enhancer failed, using partition config as-is", { err });
-      return config;
+      logger.warn("Credential enhancer failed, using scoped partition config", { err });
+      return scopedConfig;
     }
   });
   container.register({
@@ -61,7 +68,9 @@ function register(container) {
               forcePathStyle: Boolean(creds.forcePathStyle),
               accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : void 0,
               secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : void 0,
-              sessionToken: creds.sessionToken ? String(creds.sessionToken) : void 0
+              sessionToken: creds.sessionToken ? String(creds.sessionToken) : void 0,
+              organizationId: scope.organizationId,
+              tenantId: scope.tenantId
               // Credentials are resolved from the Integration Marketplace (encrypted at rest)
               // and injected directly rather than via env prefix for the standalone service.
             });

package/dist/modules/storage_s3/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/storage_s3/di.ts"],
-  "sourcesContent": ["import { asFunction, asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  registerExternalStorageDriver,\n  registerExternalCredentialEnhancer,\n} from '@open-mercato/core/modules/attachments/lib/drivers'\nimport { S3StorageDriver } from './lib/s3-driver'\nimport { createStorageService } from './lib/storage-service'\nimport { s3HealthCheck } from './lib/health'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('storage_s3')\n\ntype IntegrationCredentialsService = {\n  resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n}\n\n// Module-level registration \u2014 runs at import time, before any DI container is built.\n// This avoids the singleton-proxy resolution issue when registering via DI.\nregisterExternalStorageDriver('s3', (config: Record<string, unknown>) => {\n  logger.debug('Creating S3StorageDriver', {\n    bucket: config.bucket,\n    region: config.region,\n    endpoint: config.endpoint,\n    forcePathStyle: config.forcePathStyle,\n    hasAccessKey: Boolean(config.accessKeyId),\n    hasCredentialsEnvPrefix: Boolean(config.credentialsEnvPrefix),\n  })\n  return new S3StorageDriver(config)\n})\n\nexport function register(container: AppContainer) {\n  // Register the credential enhancer via DI so it can access the request-scoped\n  // integrationCredentialsService to inject marketplace credentials at upload time.\n  registerExternalCredentialEnhancer('s3', async (config, scope) => {\n    if (config.credentialsEnvPrefix || config.accessKeyId || config.authMode) return config\n    try {\n      const credsSvc = container.resolve('integrationCredentialsService') as IntegrationCredentialsService\n      const creds = await credsSvc.resolve('storage_s3', scope)\n      if (!creds) {\n        logger.debug('No marketplace credentials found for scope', { tenantId: scope.tenantId, organizationId: scope.organizationId })\n        return config\n      }\n      logger.debug('Injecting marketplace credentials into S3 driver config')\n      return {\n        authMode: creds.authMode,\n        bucket: config.bucket ?? (creds.bucket ? String(creds.bucket) : undefined),\n        region: config.region ?? (creds.region ? String(creds.region) : undefined),\n        endpoint: config.endpoint ?? (creds.endpoint ? String(creds.endpoint) : undefined),\n        forcePathStyle: config.forcePathStyle ?? Boolean(creds.forcePathStyle),\n        accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : undefined,\n        secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : undefined,\n        sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,\n      }\n    } catch (err) {\n      logger.warn('Credential enhancer failed, using partition config as-is', { err })\n      return config\n    }\n  })\n\n  container.register({\n    s3HealthCheck: asValue(s3HealthCheck),\n    storageService: asFunction(\n      ({ integrationCredentialsService }: { integrationCredentialsService: IntegrationCredentialsService }) => {\n        // StorageService factory \u2014 builds the service lazily using credentials\n        // resolved from the Integration Marketplace per request.\n        return {\n          async _resolveService(scope: { tenantId: string; organizationId: string }) {\n            const creds = await integrationCredentialsService.resolve('storage_s3', scope)\n            if (!creds) throw new Error('S3 storage integration is not configured for this tenant.')\n            return createStorageService({\n              authMode: creds.authMode === 'ambient' || creds.authMode === 'access_keys'\n                ? (creds.authMode as 'ambient' | 'access_keys')\n                : undefined,\n              bucket: String(creds.bucket ?? ''),\n              region: creds.region ? String(creds.region) : undefined,\n              endpoint: creds.endpoint ? String(creds.endpoint) : undefined,\n              forcePathStyle: Boolean(creds.forcePathStyle),\n              accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : undefined,\n              secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : undefined,\n              sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,\n              // Credentials are resolved from the Integration Marketplace (encrypted at rest)\n              // and injected directly rather than via env prefix for the standalone service.\n            } as Parameters<typeof createStorageService>[0])\n          },\n        }\n      },\n    )\n      .scoped()\n      .proxy(),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,eAAe;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY;AAQxC,8BAA8B,MAAM,CAAC,WAAoC;AACvE,SAAO,MAAM,4BAA4B;AAAA,IACvC,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO;AAAA,IACvB,cAAc,QAAQ,OAAO,WAAW;AAAA,IACxC,yBAAyB,QAAQ,OAAO,oBAAoB;AAAA,EAC9D,CAAC;AACD,SAAO,IAAI,gBAAgB,MAAM;AACnC,CAAC;AAEM,SAAS,SAAS,WAAyB;AAGhD,qCAAmC,MAAM,OAAO,QAAQ,UAAU;AAChE,QAAI,OAAO,wBAAwB,OAAO,eAAe,OAAO,SAAU,QAAO;AACjF,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,+BAA+B;AAClE,YAAM,QAAQ,MAAM,SAAS,QAAQ,cAAc,KAAK;AACxD,UAAI,CAAC,OAAO;AACV,eAAO,MAAM,8CAA8C,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe,CAAC;AAC7H,eAAO;AAAA,MACT;AACA,aAAO,MAAM,yDAAyD;AACtE,aAAO;AAAA,QACL,UAAU,MAAM;AAAA,QAChB,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,QAChE,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,QAChE,UAAU,OAAO,aAAa,MAAM,WAAW,OAAO,MAAM,QAAQ,IAAI;AAAA,QACxE,gBAAgB,OAAO,kBAAkB,QAAQ,MAAM,cAAc;AAAA,QACrE,aAAa,MAAM,cAAc,OAAO,MAAM,WAAW,IAAI;AAAA,QAC7D,iBAAiB,MAAM,kBAAkB,OAAO,MAAM,eAAe,IAAI;AAAA,QACzE,cAAc,MAAM,eAAe,OAAO,MAAM,YAAY,IAAI;AAAA,MAClE;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,4DAA4D,EAAE,IAAI,CAAC;AAC/E,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAED,YAAU,SAAS;AAAA,IACjB,eAAe,QAAQ,aAAa;AAAA,IACpC,gBAAgB;AAAA,MACd,CAAC,EAAE,8BAA8B,MAAwE;AAGvG,eAAO;AAAA,UACL,MAAM,gBAAgB,OAAqD;AACzE,kBAAM,QAAQ,MAAM,8BAA8B,QAAQ,cAAc,KAAK;AAC7E,gBAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AACvF,mBAAO,qBAAqB;AAAA,cAC1B,UAAU,MAAM,aAAa,aAAa,MAAM,aAAa,gBACxD,MAAM,WACP;AAAA,cACJ,QAAQ,OAAO,MAAM,UAAU,EAAE;AAAA,cACjC,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,cAC9C,UAAU,MAAM,WAAW,OAAO,MAAM,QAAQ,IAAI;AAAA,cACpD,gBAAgB,QAAQ,MAAM,cAAc;AAAA,cAC5C,aAAa,MAAM,cAAc,OAAO,MAAM,WAAW,IAAI;AAAA,cAC7D,iBAAiB,MAAM,kBAAkB,OAAO,MAAM,eAAe,IAAI;AAAA,cACzE,cAAc,MAAM,eAAe,OAAO,MAAM,YAAY,IAAI;AAAA;AAAA;AAAA,YAGlE,CAA+C;AAAA,UACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF,EACG,OAAO,EACP,MAAM;AAAA,EACX,CAAC;AACH;",
+  "sourcesContent": ["import { asFunction, asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  registerExternalStorageDriver,\n  registerExternalCredentialEnhancer,\n} from '@open-mercato/core/modules/attachments/lib/drivers'\nimport { S3StorageDriver } from './lib/s3-driver'\nimport { createStorageService } from './lib/storage-service'\nimport { s3HealthCheck } from './lib/health'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('storage_s3')\n\ntype IntegrationCredentialsService = {\n  resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n}\n\n// Module-level registration \u2014 runs at import time, before any DI container is built.\n// This avoids the singleton-proxy resolution issue when registering via DI.\nregisterExternalStorageDriver('s3', (config: Record<string, unknown>) => {\n  logger.debug('Creating S3StorageDriver', {\n    bucket: config.bucket,\n    region: config.region,\n    endpoint: config.endpoint,\n    forcePathStyle: config.forcePathStyle,\n    hasAccessKey: Boolean(config.accessKeyId),\n    hasCredentialsEnvPrefix: Boolean(config.credentialsEnvPrefix),\n  })\n  return new S3StorageDriver(config)\n})\n\nexport function register(container: AppContainer) {\n  // Register the credential enhancer via DI so it can access the request-scoped\n  // integrationCredentialsService to inject marketplace credentials at upload time.\n  registerExternalCredentialEnhancer('s3', async (config, scope) => {\n    const scopedConfig = {\n      ...config,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    }\n    if (config.credentialsEnvPrefix || config.accessKeyId || config.authMode) return scopedConfig\n    try {\n      const credsSvc = container.resolve('integrationCredentialsService') as IntegrationCredentialsService\n      const creds = await credsSvc.resolve('storage_s3', scope)\n      if (!creds) {\n        logger.debug('No marketplace credentials found for scope', { tenantId: scope.tenantId, organizationId: scope.organizationId })\n        return scopedConfig\n      }\n      logger.debug('Injecting marketplace credentials into S3 driver config')\n      return {\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        authMode: creds.authMode,\n        bucket: config.bucket ?? (creds.bucket ? String(creds.bucket) : undefined),\n        region: config.region ?? (creds.region ? String(creds.region) : undefined),\n        endpoint: config.endpoint ?? (creds.endpoint ? String(creds.endpoint) : undefined),\n        forcePathStyle: config.forcePathStyle ?? Boolean(creds.forcePathStyle),\n        accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : undefined,\n        secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : undefined,\n        sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,\n      }\n    } catch (err) {\n      logger.warn('Credential enhancer failed, using scoped partition config', { err })\n      return scopedConfig\n    }\n  })\n\n  container.register({\n    s3HealthCheck: asValue(s3HealthCheck),\n    storageService: asFunction(\n      ({ integrationCredentialsService }: { integrationCredentialsService: IntegrationCredentialsService }) => {\n        // StorageService factory \u2014 builds the service lazily using credentials\n        // resolved from the Integration Marketplace per request.\n        return {\n          async _resolveService(scope: { tenantId: string; organizationId: string }) {\n            const creds = await integrationCredentialsService.resolve('storage_s3', scope)\n            if (!creds) throw new Error('S3 storage integration is not configured for this tenant.')\n            return createStorageService({\n              authMode: creds.authMode === 'ambient' || creds.authMode === 'access_keys'\n                ? (creds.authMode as 'ambient' | 'access_keys')\n                : undefined,\n              bucket: String(creds.bucket ?? ''),\n              region: creds.region ? String(creds.region) : undefined,\n              endpoint: creds.endpoint ? String(creds.endpoint) : undefined,\n              forcePathStyle: Boolean(creds.forcePathStyle),\n              accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : undefined,\n              secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : undefined,\n              sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n              // Credentials are resolved from the Integration Marketplace (encrypted at rest)\n              // and injected directly rather than via env prefix for the standalone service.\n            } as Parameters<typeof createStorageService>[0])\n          },\n        }\n      },\n    )\n      .scoped()\n      .proxy(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,eAAe;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY;AAQxC,8BAA8B,MAAM,CAAC,WAAoC;AACvE,SAAO,MAAM,4BAA4B;AAAA,IACvC,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO;AAAA,IACvB,cAAc,QAAQ,OAAO,WAAW;AAAA,IACxC,yBAAyB,QAAQ,OAAO,oBAAoB;AAAA,EAC9D,CAAC;AACD,SAAO,IAAI,gBAAgB,MAAM;AACnC,CAAC;AAEM,SAAS,SAAS,WAAyB;AAGhD,qCAAmC,MAAM,OAAO,QAAQ,UAAU;AAChE,UAAM,eAAe;AAAA,MACnB,GAAG;AAAA,MACH,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AACA,QAAI,OAAO,wBAAwB,OAAO,eAAe,OAAO,SAAU,QAAO;AACjF,QAAI;AACF,YAAM,WAAW,UAAU,QAAQ,+BAA+B;AAClE,YAAM,QAAQ,MAAM,SAAS,QAAQ,cAAc,KAAK;AACxD,UAAI,CAAC,OAAO;AACV,eAAO,MAAM,8CAA8C,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe,CAAC;AAC7H,eAAO;AAAA,MACT;AACA,aAAO,MAAM,yDAAyD;AACtE,aAAO;AAAA,QACL,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,QAChE,QAAQ,OAAO,WAAW,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,QAChE,UAAU,OAAO,aAAa,MAAM,WAAW,OAAO,MAAM,QAAQ,IAAI;AAAA,QACxE,gBAAgB,OAAO,kBAAkB,QAAQ,MAAM,cAAc;AAAA,QACrE,aAAa,MAAM,cAAc,OAAO,MAAM,WAAW,IAAI;AAAA,QAC7D,iBAAiB,MAAM,kBAAkB,OAAO,MAAM,eAAe,IAAI;AAAA,QACzE,cAAc,MAAM,eAAe,OAAO,MAAM,YAAY,IAAI;AAAA,MAClE;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,6DAA6D,EAAE,IAAI,CAAC;AAChF,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAED,YAAU,SAAS;AAAA,IACjB,eAAe,QAAQ,aAAa;AAAA,IACpC,gBAAgB;AAAA,MACd,CAAC,EAAE,8BAA8B,MAAwE;AAGvG,eAAO;AAAA,UACL,MAAM,gBAAgB,OAAqD;AACzE,kBAAM,QAAQ,MAAM,8BAA8B,QAAQ,cAAc,KAAK;AAC7E,gBAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2DAA2D;AACvF,mBAAO,qBAAqB;AAAA,cAC1B,UAAU,MAAM,aAAa,aAAa,MAAM,aAAa,gBACxD,MAAM,WACP;AAAA,cACJ,QAAQ,OAAO,MAAM,UAAU,EAAE;AAAA,cACjC,QAAQ,MAAM,SAAS,OAAO,MAAM,MAAM,IAAI;AAAA,cAC9C,UAAU,MAAM,WAAW,OAAO,MAAM,QAAQ,IAAI;AAAA,cACpD,gBAAgB,QAAQ,MAAM,cAAc;AAAA,cAC5C,aAAa,MAAM,cAAc,OAAO,MAAM,WAAW,IAAI;AAAA,cAC7D,iBAAiB,MAAM,kBAAkB,OAAO,MAAM,eAAe,IAAI;AAAA,cACzE,cAAc,MAAM,eAAe,OAAO,MAAM,YAAY,IAAI;AAAA,cAChE,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA;AAAA;AAAA,YAGlB,CAA+C;AAAA,UACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF,EACG,OAAO,EACP,MAAM;AAAA,EACX,CAAC;AACH;",
   "names": []
 }

package/dist/modules/storage_s3/lib/key-scope.js

@@ -1,25 +1,96 @@
 const SHARED_ORG_SEGMENT = "org_shared";
 const SHARED_TENANT_SEGMENT = "tenant_shared";
+function resolveSegment(value, prefix) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  return `${prefix}_${trimmed}`;
+}
+function resolveScopeSegments(scope) {
+  const orgSegment = resolveSegment(scope?.organizationId, "org");
+  const tenantSegment = resolveSegment(scope?.tenantId, "tenant");
+  if (!orgSegment || !tenantSegment) return null;
+  return { orgSegment, tenantSegment };
+}
+function normalizePath(value) {
+  return value.replace(/^\/+/, "");
+}
+function stripConfiguredPrefix(value, pathPrefix) {
+  const normalized = normalizePath(value);
+  const normalizedPrefix = normalizePath(pathPrefix ?? "");
+  if (!normalizedPrefix) return normalized;
+  return normalized.startsWith(normalizedPrefix) ? normalized.slice(normalizedPrefix.length).replace(/^\/+/, "") : normalized;
+}
+function splitS3Path(value, pathPrefix) {
+  return stripConfiguredPrefix(value, pathPrefix).split("/").filter(Boolean);
+}
 function findScopeSegmentIndex(parts) {
   return parts.findIndex((part, index) => part.startsWith("org_") && parts[index + 1]?.startsWith("tenant_"));
 }
-function hasScopeSegments(key, orgSegment, tenantSegment) {
-  const parts = key.split("/");
+function hasScopeSegments(parts, orgSegment, tenantSegment) {
   const scopeIndex = findScopeSegmentIndex(parts);
   return scopeIndex >= 0 && parts[scopeIndex] === orgSegment && parts[scopeIndex + 1] === tenantSegment;
 }
-function isS3KeyScopedToTenant(key, orgId, tenantId) {
-  if (!orgId || !tenantId) return false;
-  return hasScopeSegments(key, `org_${orgId}`, `tenant_${tenantId}`);
+function resolveScopeSegmentsFromArgs(scopeOrOrgId, tenantId) {
+  if (typeof scopeOrOrgId === "string") {
+    return resolveScopeSegments({ organizationId: scopeOrOrgId, tenantId });
+  }
+  return resolveScopeSegments(scopeOrOrgId);
+}
+function isS3KeyScopedToTenant(storagePath, scopeOrOrgId, pathPrefixOrTenantId) {
+  const segments = resolveScopeSegmentsFromArgs(scopeOrOrgId, pathPrefixOrTenantId);
+  if (!segments) return typeof scopeOrOrgId === "string" ? false : true;
+  const pathPrefix = typeof scopeOrOrgId === "string" ? void 0 : pathPrefixOrTenantId;
+  const parts = splitS3Path(storagePath, pathPrefix);
+  return hasScopeSegments(parts, segments.orgSegment, segments.tenantSegment);
 }
 function isS3KeyShared(key) {
-  return hasScopeSegments(key, SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT);
+  return hasScopeSegments(splitS3Path(key), SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT);
 }
 function isS3KeyAddressableByScope(key, orgId, tenantId) {
   return isS3KeyScopedToTenant(key, orgId, tenantId) || isS3KeyShared(key);
 }
+function isS3KeyAddressableByTenantScope(storagePath, scope, pathPrefix) {
+  if (!resolveScopeSegments(scope)) return true;
+  const parts = splitS3Path(storagePath, pathPrefix);
+  return isS3KeyScopedToTenant(storagePath, scope, pathPrefix) || hasScopeSegments(parts, SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT);
+}
+function assertS3KeyScopedToTenant(storagePath, scope, pathPrefix) {
+  if (!isS3KeyScopedToTenant(storagePath, scope, pathPrefix)) {
+    throw new Error("S3 key is not scoped to the active tenant");
+  }
+}
+function assertS3KeyAddressableByTenantScope(storagePath, scope, pathPrefix) {
+  if (!isS3KeyAddressableByTenantScope(storagePath, scope, pathPrefix)) {
+    throw new Error("S3 key is not scoped to the active tenant");
+  }
+}
+function assertS3ListPrefixScopedToTenant(prefix, scope, pathPrefix) {
+  const segments = resolveScopeSegments(scope);
+  if (!segments) return;
+  const parts = splitS3Path(prefix, pathPrefix);
+  if (parts.length === 0) return;
+  if (parts[0]?.startsWith("org_") || parts[1]?.startsWith("tenant_")) {
+    if (parts[0] !== segments.orgSegment || parts[1] !== segments.tenantSegment) {
+      throw new Error("S3 prefix is not scoped to the active tenant");
+    }
+    return;
+  }
+  if (parts[1]?.startsWith("org_") && parts[1] !== segments.orgSegment || parts[2]?.startsWith("tenant_") && parts[2] !== segments.tenantSegment) {
+    throw new Error("S3 prefix is not scoped to the active tenant");
+  }
+}
+function filterS3ObjectsToTenant(files, scope, pathPrefix) {
+  if (!resolveScopeSegments(scope)) return files;
+  return files.filter((file) => isS3KeyScopedToTenant(file.key, scope, pathPrefix));
+}
 export {
+  assertS3KeyAddressableByTenantScope,
+  assertS3KeyScopedToTenant,
+  assertS3ListPrefixScopedToTenant,
+  filterS3ObjectsToTenant,
   isS3KeyAddressableByScope,
+  isS3KeyAddressableByTenantScope,
   isS3KeyScopedToTenant,
   isS3KeyShared
 };

package/dist/modules/storage_s3/lib/key-scope.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/storage_s3/lib/key-scope.ts"],
-  "sourcesContent": ["const SHARED_ORG_SEGMENT = 'org_shared'\nconst SHARED_TENANT_SEGMENT = 'tenant_shared'\n\nfunction findScopeSegmentIndex(parts: string[]): number {\n  return parts.findIndex((part, index) => (\n    part.startsWith('org_') && parts[index + 1]?.startsWith('tenant_')\n  ))\n}\n\nfunction hasScopeSegments(key: string, orgSegment: string, tenantSegment: string): boolean {\n  const parts = key.split('/')\n  const scopeIndex = findScopeSegmentIndex(parts)\n  return scopeIndex >= 0\n    && parts[scopeIndex] === orgSegment\n    && parts[scopeIndex + 1] === tenantSegment\n}\n\nexport function isS3KeyScopedToTenant(key: string, orgId: string, tenantId: string): boolean {\n  if (!orgId || !tenantId) return false\n  return hasScopeSegments(key, `org_${orgId}`, `tenant_${tenantId}`)\n}\n\nexport function isS3KeyShared(key: string): boolean {\n  return hasScopeSegments(key, SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT)\n}\n\nexport function isS3KeyAddressableByScope(key: string, orgId: string, tenantId: string): boolean {\n  return isS3KeyScopedToTenant(key, orgId, tenantId) || isS3KeyShared(key)\n}\n"],
-  "mappings": "AAAA,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAE9B,SAAS,sBAAsB,OAAyB;AACtD,SAAO,MAAM,UAAU,CAAC,MAAM,UAC5B,KAAK,WAAW,MAAM,KAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,SAAS,CAClE;AACH;AAEA,SAAS,iBAAiB,KAAa,YAAoB,eAAgC;AACzF,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,QAAM,aAAa,sBAAsB,KAAK;AAC9C,SAAO,cAAc,KAChB,MAAM,UAAU,MAAM,cACtB,MAAM,aAAa,CAAC,MAAM;AACjC;AAEO,SAAS,sBAAsB,KAAa,OAAe,UAA2B;AAC3F,MAAI,CAAC,SAAS,CAAC,SAAU,QAAO;AAChC,SAAO,iBAAiB,KAAK,OAAO,KAAK,IAAI,UAAU,QAAQ,EAAE;AACnE;AAEO,SAAS,cAAc,KAAsB;AAClD,SAAO,iBAAiB,KAAK,oBAAoB,qBAAqB;AACxE;AAEO,SAAS,0BAA0B,KAAa,OAAe,UAA2B;AAC/F,SAAO,sBAAsB,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACzE;",
+  "sourcesContent": ["export type S3TenantScope = {\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nexport type S3ScopedObject = {\n  key: string\n}\n\ntype ScopeSegments = {\n  orgSegment: string\n  tenantSegment: string\n}\n\nconst SHARED_ORG_SEGMENT = 'org_shared'\nconst SHARED_TENANT_SEGMENT = 'tenant_shared'\n\nfunction resolveSegment(value: string | null | undefined, prefix: 'org' | 'tenant'): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!trimmed) return null\n  return `${prefix}_${trimmed}`\n}\n\nfunction resolveScopeSegments(scope: S3TenantScope | null | undefined): ScopeSegments | null {\n  const orgSegment = resolveSegment(scope?.organizationId, 'org')\n  const tenantSegment = resolveSegment(scope?.tenantId, 'tenant')\n  if (!orgSegment || !tenantSegment) return null\n  return { orgSegment, tenantSegment }\n}\n\nfunction normalizePath(value: string): string {\n  return value.replace(/^\\/+/, '')\n}\n\nfunction stripConfiguredPrefix(value: string, pathPrefix?: string): string {\n  const normalized = normalizePath(value)\n  const normalizedPrefix = normalizePath(pathPrefix ?? '')\n  if (!normalizedPrefix) return normalized\n  return normalized.startsWith(normalizedPrefix)\n    ? normalized.slice(normalizedPrefix.length).replace(/^\\/+/, '')\n    : normalized\n}\n\nfunction splitS3Path(value: string, pathPrefix?: string): string[] {\n  return stripConfiguredPrefix(value, pathPrefix).split('/').filter(Boolean)\n}\n\nfunction findScopeSegmentIndex(parts: string[]): number {\n  return parts.findIndex((part, index) => (\n    part.startsWith('org_') && parts[index + 1]?.startsWith('tenant_')\n  ))\n}\n\nfunction hasScopeSegments(parts: string[], orgSegment: string, tenantSegment: string): boolean {\n  const scopeIndex = findScopeSegmentIndex(parts)\n  return scopeIndex >= 0\n    && parts[scopeIndex] === orgSegment\n    && parts[scopeIndex + 1] === tenantSegment\n}\n\nfunction resolveScopeSegmentsFromArgs(\n  scopeOrOrgId: S3TenantScope | string | null | undefined,\n  tenantId?: string,\n): ScopeSegments | null {\n  if (typeof scopeOrOrgId === 'string') {\n    return resolveScopeSegments({ organizationId: scopeOrOrgId, tenantId })\n  }\n  return resolveScopeSegments(scopeOrOrgId)\n}\n\nexport function isS3KeyScopedToTenant(key: string, orgId: string, tenantId: string): boolean\nexport function isS3KeyScopedToTenant(\n  storagePath: string,\n  scope: S3TenantScope | null | undefined,\n  pathPrefix?: string,\n): boolean\nexport function isS3KeyScopedToTenant(\n  storagePath: string,\n  scopeOrOrgId: S3TenantScope | string | null | undefined,\n  pathPrefixOrTenantId?: string,\n): boolean {\n  const segments = resolveScopeSegmentsFromArgs(scopeOrOrgId, pathPrefixOrTenantId)\n  if (!segments) return typeof scopeOrOrgId === 'string' ? false : true\n\n  const pathPrefix = typeof scopeOrOrgId === 'string' ? undefined : pathPrefixOrTenantId\n  const parts = splitS3Path(storagePath, pathPrefix)\n  return hasScopeSegments(parts, segments.orgSegment, segments.tenantSegment)\n}\n\nexport function isS3KeyShared(key: string): boolean {\n  return hasScopeSegments(splitS3Path(key), SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT)\n}\n\nexport function isS3KeyAddressableByScope(key: string, orgId: string, tenantId: string): boolean {\n  return isS3KeyScopedToTenant(key, orgId, tenantId) || isS3KeyShared(key)\n}\n\nexport function isS3KeyAddressableByTenantScope(\n  storagePath: string,\n  scope: S3TenantScope | null | undefined,\n  pathPrefix?: string,\n): boolean {\n  if (!resolveScopeSegments(scope)) return true\n  const parts = splitS3Path(storagePath, pathPrefix)\n  return isS3KeyScopedToTenant(storagePath, scope, pathPrefix)\n    || hasScopeSegments(parts, SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT)\n}\n\nexport function assertS3KeyScopedToTenant(\n  storagePath: string,\n  scope: S3TenantScope | null | undefined,\n  pathPrefix?: string,\n): void {\n  if (!isS3KeyScopedToTenant(storagePath, scope, pathPrefix)) {\n    throw new Error('S3 key is not scoped to the active tenant')\n  }\n}\n\nexport function assertS3KeyAddressableByTenantScope(\n  storagePath: string,\n  scope: S3TenantScope | null | undefined,\n  pathPrefix?: string,\n): void {\n  if (!isS3KeyAddressableByTenantScope(storagePath, scope, pathPrefix)) {\n    throw new Error('S3 key is not scoped to the active tenant')\n  }\n}\n\nexport function assertS3ListPrefixScopedToTenant(\n  prefix: string,\n  scope: S3TenantScope | null | undefined,\n  pathPrefix?: string,\n): void {\n  const segments = resolveScopeSegments(scope)\n  if (!segments) return\n\n  const parts = splitS3Path(prefix, pathPrefix)\n  if (parts.length === 0) return\n\n  if (parts[0]?.startsWith('org_') || parts[1]?.startsWith('tenant_')) {\n    if (parts[0] !== segments.orgSegment || parts[1] !== segments.tenantSegment) {\n      throw new Error('S3 prefix is not scoped to the active tenant')\n    }\n    return\n  }\n\n  if (\n    (parts[1]?.startsWith('org_') && parts[1] !== segments.orgSegment)\n    || (parts[2]?.startsWith('tenant_') && parts[2] !== segments.tenantSegment)\n  ) {\n    throw new Error('S3 prefix is not scoped to the active tenant')\n  }\n}\n\nexport function filterS3ObjectsToTenant<T extends S3ScopedObject>(\n  files: T[],\n  scope: S3TenantScope | null | undefined,\n  pathPrefix?: string,\n): T[] {\n  if (!resolveScopeSegments(scope)) return files\n  return files.filter((file) => isS3KeyScopedToTenant(file.key, scope, pathPrefix))\n}\n"],
+  "mappings": "AAcA,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAE9B,SAAS,eAAe,OAAkC,QAAyC;AACjG,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,GAAG,MAAM,IAAI,OAAO;AAC7B;AAEA,SAAS,qBAAqB,OAA+D;AAC3F,QAAM,aAAa,eAAe,OAAO,gBAAgB,KAAK;AAC9D,QAAM,gBAAgB,eAAe,OAAO,UAAU,QAAQ;AAC9D,MAAI,CAAC,cAAc,CAAC,cAAe,QAAO;AAC1C,SAAO,EAAE,YAAY,cAAc;AACrC;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,MAAM,QAAQ,QAAQ,EAAE;AACjC;AAEA,SAAS,sBAAsB,OAAe,YAA6B;AACzE,QAAM,aAAa,cAAc,KAAK;AACtC,QAAM,mBAAmB,cAAc,cAAc,EAAE;AACvD,MAAI,CAAC,iBAAkB,QAAO;AAC9B,SAAO,WAAW,WAAW,gBAAgB,IACzC,WAAW,MAAM,iBAAiB,MAAM,EAAE,QAAQ,QAAQ,EAAE,IAC5D;AACN;AAEA,SAAS,YAAY,OAAe,YAA+B;AACjE,SAAO,sBAAsB,OAAO,UAAU,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAC3E;AAEA,SAAS,sBAAsB,OAAyB;AACtD,SAAO,MAAM,UAAU,CAAC,MAAM,UAC5B,KAAK,WAAW,MAAM,KAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,SAAS,CAClE;AACH;AAEA,SAAS,iBAAiB,OAAiB,YAAoB,eAAgC;AAC7F,QAAM,aAAa,sBAAsB,KAAK;AAC9C,SAAO,cAAc,KAChB,MAAM,UAAU,MAAM,cACtB,MAAM,aAAa,CAAC,MAAM;AACjC;AAEA,SAAS,6BACP,cACA,UACsB;AACtB,MAAI,OAAO,iBAAiB,UAAU;AACpC,WAAO,qBAAqB,EAAE,gBAAgB,cAAc,SAAS,CAAC;AAAA,EACxE;AACA,SAAO,qBAAqB,YAAY;AAC1C;AAQO,SAAS,sBACd,aACA,cACA,sBACS;AACT,QAAM,WAAW,6BAA6B,cAAc,oBAAoB;AAChF,MAAI,CAAC,SAAU,QAAO,OAAO,iBAAiB,WAAW,QAAQ;AAEjE,QAAM,aAAa,OAAO,iBAAiB,WAAW,SAAY;AAClE,QAAM,QAAQ,YAAY,aAAa,UAAU;AACjD,SAAO,iBAAiB,OAAO,SAAS,YAAY,SAAS,aAAa;AAC5E;AAEO,SAAS,cAAc,KAAsB;AAClD,SAAO,iBAAiB,YAAY,GAAG,GAAG,oBAAoB,qBAAqB;AACrF;AAEO,SAAS,0BAA0B,KAAa,OAAe,UAA2B;AAC/F,SAAO,sBAAsB,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACzE;AAEO,SAAS,gCACd,aACA,OACA,YACS;AACT,MAAI,CAAC,qBAAqB,KAAK,EAAG,QAAO;AACzC,QAAM,QAAQ,YAAY,aAAa,UAAU;AACjD,SAAO,sBAAsB,aAAa,OAAO,UAAU,KACtD,iBAAiB,OAAO,oBAAoB,qBAAqB;AACxE;AAEO,SAAS,0BACd,aACA,OACA,YACM;AACN,MAAI,CAAC,sBAAsB,aAAa,OAAO,UAAU,GAAG;AAC1D,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACF;AAEO,SAAS,oCACd,aACA,OACA,YACM;AACN,MAAI,CAAC,gCAAgC,aAAa,OAAO,UAAU,GAAG;AACpE,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACF;AAEO,SAAS,iCACd,QACA,OACA,YACM;AACN,QAAM,WAAW,qBAAqB,KAAK;AAC3C,MAAI,CAAC,SAAU;AAEf,QAAM,QAAQ,YAAY,QAAQ,UAAU;AAC5C,MAAI,MAAM,WAAW,EAAG;AAExB,MAAI,MAAM,CAAC,GAAG,WAAW,MAAM,KAAK,MAAM,CAAC,GAAG,WAAW,SAAS,GAAG;AACnE,QAAI,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,CAAC,MAAM,SAAS,eAAe;AAC3E,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA;AAAA,EACF;AAEA,MACG,MAAM,CAAC,GAAG,WAAW,MAAM,KAAK,MAAM,CAAC,MAAM,SAAS,cACnD,MAAM,CAAC,GAAG,WAAW,SAAS,KAAK,MAAM,CAAC,MAAM,SAAS,eAC7D;AACA,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACF;AAEO,SAAS,wBACd,OACA,OACA,YACK;AACL,MAAI,CAAC,qBAAqB,KAAK,EAAG,QAAO;AACzC,SAAO,MAAM,OAAO,CAAC,SAAS,sBAAsB,KAAK,KAAK,OAAO,UAAU,CAAC;AAClF;",
   "names": []
 }

package/dist/modules/storage_s3/lib/s3-driver.js

@@ -10,6 +10,12 @@ import {
   ListObjectsV2Command
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import {
+  assertS3KeyAddressableByTenantScope,
+  assertS3KeyScopedToTenant,
+  assertS3ListPrefixScopedToTenant,
+  filterS3ObjectsToTenant
+} from "./key-scope.js";
 function sanitizeFileName(fileName) {
   if (!fileName) return "file";
   return fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
@@ -36,6 +42,7 @@ class S3StorageDriver {
     const cfg = config;
     this.bucket = cfg.bucket;
     this.pathPrefix = cfg.pathPrefix ?? "";
+    this.scope = cfg.organizationId && cfg.tenantId ? { organizationId: cfg.organizationId, tenantId: cfg.tenantId } : null;
     const authMode = cfg.authMode;
     const shouldUseAccessKeys = authMode === "access_keys" || authMode !== "ambient" && (cfg.accessKeyId && cfg.secretAccessKey || Boolean(cfg.credentialsEnvPrefix));
     let credentials;
@@ -63,6 +70,20 @@ class S3StorageDriver {
       credentials
     });
   }
+  assertKeyScoped(storagePath, scope) {
+    assertS3KeyScopedToTenant(storagePath, scope ?? this.scope, this.pathPrefix);
+  }
+  assertKeyAddressable(storagePath, scope) {
+    assertS3KeyAddressableByTenantScope(storagePath, scope ?? this.scope, this.pathPrefix);
+  }
+  assertPartitionScoped(partitionCode, storagePath) {
+    if (!partitionCode) return;
+    const prefix = this.pathPrefix && storagePath.startsWith(this.pathPrefix) ? storagePath.slice(this.pathPrefix.length).replace(/^\/+/, "") : storagePath.replace(/^\/+/, "");
+    const firstSegment = prefix.split("/").filter(Boolean)[0];
+    if (firstSegment !== partitionCode) {
+      throw new Error("S3 key is not scoped to the requested partition");
+    }
+  }
   async store(payload) {
     const orgSegment = resolveOrgSegment(payload.orgId ?? null);
     const tenantSegment = resolveTenantSegment(payload.tenantId ?? null);
@@ -80,7 +101,9 @@ class S3StorageDriver {
     );
     return { storagePath: key };
   }
-  async read(_partitionCode, storagePath) {
+  async read(partitionCode, storagePath) {
+    this.assertPartitionScoped(partitionCode, storagePath);
+    this.assertKeyAddressable(storagePath);
     const response = await this.client.send(
       new GetObjectCommand({ Bucket: this.bucket, Key: storagePath })
     );
@@ -90,7 +113,9 @@ class S3StorageDriver {
     const buffer = await streamToBuffer(response.Body);
     return { buffer, contentType: response.ContentType };
   }
-  async delete(_partitionCode, storagePath) {
+  async delete(partitionCode, storagePath) {
+    this.assertPartitionScoped(partitionCode, storagePath);
+    this.assertKeyAddressable(storagePath);
     try {
       await this.client.send(
         new DeleteObjectCommand({ Bucket: this.bucket, Key: storagePath })
@@ -118,6 +143,7 @@ class S3StorageDriver {
    * Put an object directly at a specific S3 key (for standalone usage).
    */
   async putObject(key, buffer, contentType) {
+    this.assertKeyScoped(key);
     await this.client.send(
       new PutObjectCommand({
         Bucket: this.bucket,
@@ -131,7 +157,9 @@ class S3StorageDriver {
   getBucket() {
     return this.bucket;
   }
-  async listObjects(prefix, maxKeys = 100, continuationToken) {
+  async listObjects(prefix, maxKeys = 100, continuationToken, scope) {
+    const activeScope = scope ?? this.scope;
+    assertS3ListPrefixScopedToTenant(prefix, activeScope, this.pathPrefix);
     const response = await this.client.send(
       new ListObjectsV2Command({
         Bucket: this.bucket,
@@ -140,12 +168,13 @@ class S3StorageDriver {
         ContinuationToken: continuationToken
       })
     );
+    const files = (response.Contents ?? []).map((obj) => ({
+      key: obj.Key ?? "",
+      size: obj.Size ?? 0,
+      lastModified: obj.LastModified ?? /* @__PURE__ */ new Date(0)
+    }));
     return {
-      files: (response.Contents ?? []).map((obj) => ({
-        key: obj.Key ?? "",
-        size: obj.Size ?? 0,
-        lastModified: obj.LastModified ?? /* @__PURE__ */ new Date(0)
-      })),
+      files: filterS3ObjectsToTenant(files, activeScope, this.pathPrefix),
       truncated: response.IsTruncated ?? false,
       nextContinuationToken: response.NextContinuationToken
     };
@@ -153,7 +182,12 @@ class S3StorageDriver {
   /**
    * Generate a pre-signed URL for direct browser upload or download.
    */
-  async getSignedUrl(storagePath, operation, expiresIn = 3600, contentType) {
+  async getSignedUrl(storagePath, operation, expiresIn = 3600, contentType, scope) {
+    if (operation === "upload") {
+      this.assertKeyScoped(storagePath, scope);
+    } else {
+      this.assertKeyAddressable(storagePath, scope);
+    }
     if (operation === "upload") {
       const command2 = new PutObjectCommand({
         Bucket: this.bucket,