@open-mercato/storage-s3 0.6.7-develop.6573.1.28649ddec6 → 0.6.7-develop.6576.1.c4bc47711b

package/src/modules/storage_s3/di.ts

@@ -33,16 +33,23 @@ export function register(container: AppContainer) {
   // Register the credential enhancer via DI so it can access the request-scoped
   // integrationCredentialsService to inject marketplace credentials at upload time.
   registerExternalCredentialEnhancer('s3', async (config, scope) => {
-    if (config.credentialsEnvPrefix || config.accessKeyId || config.authMode) return config
+    const scopedConfig = {
+      ...config,
+      organizationId: scope.organizationId,
+      tenantId: scope.tenantId,
+    }
+    if (config.credentialsEnvPrefix || config.accessKeyId || config.authMode) return scopedConfig
     try {
       const credsSvc = container.resolve('integrationCredentialsService') as IntegrationCredentialsService
       const creds = await credsSvc.resolve('storage_s3', scope)
       if (!creds) {
         logger.debug('No marketplace credentials found for scope', { tenantId: scope.tenantId, organizationId: scope.organizationId })
-        return config
+        return scopedConfig
       }
       logger.debug('Injecting marketplace credentials into S3 driver config')
       return {
+        organizationId: scope.organizationId,
+        tenantId: scope.tenantId,
         authMode: creds.authMode,
         bucket: config.bucket ?? (creds.bucket ? String(creds.bucket) : undefined),
         region: config.region ?? (creds.region ? String(creds.region) : undefined),
@@ -53,8 +60,8 @@ export function register(container: AppContainer) {
         sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,
       }
     } catch (err) {
-      logger.warn('Credential enhancer failed, using partition config as-is', { err })
-      return config
+      logger.warn('Credential enhancer failed, using scoped partition config', { err })
+      return scopedConfig
     }
   })
 
@@ -79,6 +86,8 @@ export function register(container: AppContainer) {
               accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : undefined,
               secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : undefined,
               sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,
+              organizationId: scope.organizationId,
+              tenantId: scope.tenantId,
               // Credentials are resolved from the Integration Marketplace (encrypted at rest)
               // and injected directly rather than via env prefix for the standalone service.
             } as Parameters<typeof createStorageService>[0])

package/src/modules/storage_s3/lib/key-scope.ts

@@ -1,29 +1,163 @@
+export type S3TenantScope = {
+  organizationId?: string | null
+  tenantId?: string | null
+}
+
+export type S3ScopedObject = {
+  key: string
+}
+
+type ScopeSegments = {
+  orgSegment: string
+  tenantSegment: string
+}
+
 const SHARED_ORG_SEGMENT = 'org_shared'
 const SHARED_TENANT_SEGMENT = 'tenant_shared'
 
+function resolveSegment(value: string | null | undefined, prefix: 'org' | 'tenant'): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  if (!trimmed) return null
+  return `${prefix}_${trimmed}`
+}
+
+function resolveScopeSegments(scope: S3TenantScope | null | undefined): ScopeSegments | null {
+  const orgSegment = resolveSegment(scope?.organizationId, 'org')
+  const tenantSegment = resolveSegment(scope?.tenantId, 'tenant')
+  if (!orgSegment || !tenantSegment) return null
+  return { orgSegment, tenantSegment }
+}
+
+function normalizePath(value: string): string {
+  return value.replace(/^\/+/, '')
+}
+
+function stripConfiguredPrefix(value: string, pathPrefix?: string): string {
+  const normalized = normalizePath(value)
+  const normalizedPrefix = normalizePath(pathPrefix ?? '')
+  if (!normalizedPrefix) return normalized
+  return normalized.startsWith(normalizedPrefix)
+    ? normalized.slice(normalizedPrefix.length).replace(/^\/+/, '')
+    : normalized
+}
+
+function splitS3Path(value: string, pathPrefix?: string): string[] {
+  return stripConfiguredPrefix(value, pathPrefix).split('/').filter(Boolean)
+}
+
 function findScopeSegmentIndex(parts: string[]): number {
   return parts.findIndex((part, index) => (
     part.startsWith('org_') && parts[index + 1]?.startsWith('tenant_')
   ))
 }
 
-function hasScopeSegments(key: string, orgSegment: string, tenantSegment: string): boolean {
-  const parts = key.split('/')
+function hasScopeSegments(parts: string[], orgSegment: string, tenantSegment: string): boolean {
   const scopeIndex = findScopeSegmentIndex(parts)
   return scopeIndex >= 0
     && parts[scopeIndex] === orgSegment
     && parts[scopeIndex + 1] === tenantSegment
 }
 
-export function isS3KeyScopedToTenant(key: string, orgId: string, tenantId: string): boolean {
-  if (!orgId || !tenantId) return false
-  return hasScopeSegments(key, `org_${orgId}`, `tenant_${tenantId}`)
+function resolveScopeSegmentsFromArgs(
+  scopeOrOrgId: S3TenantScope | string | null | undefined,
+  tenantId?: string,
+): ScopeSegments | null {
+  if (typeof scopeOrOrgId === 'string') {
+    return resolveScopeSegments({ organizationId: scopeOrOrgId, tenantId })
+  }
+  return resolveScopeSegments(scopeOrOrgId)
+}
+
+export function isS3KeyScopedToTenant(key: string, orgId: string, tenantId: string): boolean
+export function isS3KeyScopedToTenant(
+  storagePath: string,
+  scope: S3TenantScope | null | undefined,
+  pathPrefix?: string,
+): boolean
+export function isS3KeyScopedToTenant(
+  storagePath: string,
+  scopeOrOrgId: S3TenantScope | string | null | undefined,
+  pathPrefixOrTenantId?: string,
+): boolean {
+  const segments = resolveScopeSegmentsFromArgs(scopeOrOrgId, pathPrefixOrTenantId)
+  if (!segments) return typeof scopeOrOrgId === 'string' ? false : true
+
+  const pathPrefix = typeof scopeOrOrgId === 'string' ? undefined : pathPrefixOrTenantId
+  const parts = splitS3Path(storagePath, pathPrefix)
+  return hasScopeSegments(parts, segments.orgSegment, segments.tenantSegment)
 }
 
 export function isS3KeyShared(key: string): boolean {
-  return hasScopeSegments(key, SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT)
+  return hasScopeSegments(splitS3Path(key), SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT)
 }
 
 export function isS3KeyAddressableByScope(key: string, orgId: string, tenantId: string): boolean {
   return isS3KeyScopedToTenant(key, orgId, tenantId) || isS3KeyShared(key)
 }
+
+export function isS3KeyAddressableByTenantScope(
+  storagePath: string,
+  scope: S3TenantScope | null | undefined,
+  pathPrefix?: string,
+): boolean {
+  if (!resolveScopeSegments(scope)) return true
+  const parts = splitS3Path(storagePath, pathPrefix)
+  return isS3KeyScopedToTenant(storagePath, scope, pathPrefix)
+    || hasScopeSegments(parts, SHARED_ORG_SEGMENT, SHARED_TENANT_SEGMENT)
+}
+
+export function assertS3KeyScopedToTenant(
+  storagePath: string,
+  scope: S3TenantScope | null | undefined,
+  pathPrefix?: string,
+): void {
+  if (!isS3KeyScopedToTenant(storagePath, scope, pathPrefix)) {
+    throw new Error('S3 key is not scoped to the active tenant')
+  }
+}
+
+export function assertS3KeyAddressableByTenantScope(
+  storagePath: string,
+  scope: S3TenantScope | null | undefined,
+  pathPrefix?: string,
+): void {
+  if (!isS3KeyAddressableByTenantScope(storagePath, scope, pathPrefix)) {
+    throw new Error('S3 key is not scoped to the active tenant')
+  }
+}
+
+export function assertS3ListPrefixScopedToTenant(
+  prefix: string,
+  scope: S3TenantScope | null | undefined,
+  pathPrefix?: string,
+): void {
+  const segments = resolveScopeSegments(scope)
+  if (!segments) return
+
+  const parts = splitS3Path(prefix, pathPrefix)
+  if (parts.length === 0) return
+
+  if (parts[0]?.startsWith('org_') || parts[1]?.startsWith('tenant_')) {
+    if (parts[0] !== segments.orgSegment || parts[1] !== segments.tenantSegment) {
+      throw new Error('S3 prefix is not scoped to the active tenant')
+    }
+    return
+  }
+
+  if (
+    (parts[1]?.startsWith('org_') && parts[1] !== segments.orgSegment)
+    || (parts[2]?.startsWith('tenant_') && parts[2] !== segments.tenantSegment)
+  ) {
+    throw new Error('S3 prefix is not scoped to the active tenant')
+  }
+}
+
+export function filterS3ObjectsToTenant<T extends S3ScopedObject>(
+  files: T[],
+  scope: S3TenantScope | null | undefined,
+  pathPrefix?: string,
+): T[] {
+  if (!resolveScopeSegments(scope)) return files
+  return files.filter((file) => isS3KeyScopedToTenant(file.key, scope, pathPrefix))
+}

package/src/modules/storage_s3/lib/s3-driver.ts

@@ -11,6 +11,13 @@ import {
 } from '@aws-sdk/client-s3'
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner'
 import type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from '@open-mercato/core/modules/attachments/lib/drivers'
+import {
+  assertS3KeyAddressableByTenantScope,
+  assertS3KeyScopedToTenant,
+  assertS3ListPrefixScopedToTenant,
+  filterS3ObjectsToTenant,
+  type S3TenantScope,
+} from './key-scope'
 
 export type S3DriverConfig = {
   bucket: string
@@ -32,6 +39,8 @@ export type S3DriverConfig = {
   accessKeyId?: string
   secretAccessKey?: string
   sessionToken?: string
+  organizationId?: string | null
+  tenantId?: string | null
 }
 
 function sanitizeFileName(fileName: string): string {
@@ -63,11 +72,15 @@ export class S3StorageDriver implements StorageDriver {
   private readonly client: S3Client
   private readonly bucket: string
   private readonly pathPrefix: string
+  private readonly scope: S3TenantScope | null
 
   constructor(config: Record<string, unknown>) {
     const cfg = config as S3DriverConfig
     this.bucket = cfg.bucket
     this.pathPrefix = cfg.pathPrefix ?? ''
+    this.scope = cfg.organizationId && cfg.tenantId
+      ? { organizationId: cfg.organizationId, tenantId: cfg.tenantId }
+      : null
 
     const authMode = cfg.authMode
     const shouldUseAccessKeys =
@@ -104,6 +117,25 @@ export class S3StorageDriver implements StorageDriver {
     })
   }
 
+  private assertKeyScoped(storagePath: string, scope?: S3TenantScope | null): void {
+    assertS3KeyScopedToTenant(storagePath, scope ?? this.scope, this.pathPrefix)
+  }
+
+  private assertKeyAddressable(storagePath: string, scope?: S3TenantScope | null): void {
+    assertS3KeyAddressableByTenantScope(storagePath, scope ?? this.scope, this.pathPrefix)
+  }
+
+  private assertPartitionScoped(partitionCode: string, storagePath: string): void {
+    if (!partitionCode) return
+    const prefix = this.pathPrefix && storagePath.startsWith(this.pathPrefix)
+      ? storagePath.slice(this.pathPrefix.length).replace(/^\/+/, '')
+      : storagePath.replace(/^\/+/, '')
+    const firstSegment = prefix.split('/').filter(Boolean)[0]
+    if (firstSegment !== partitionCode) {
+      throw new Error('S3 key is not scoped to the requested partition')
+    }
+  }
+
   async store(payload: StoreFilePayload): Promise<StoredFile> {
     const orgSegment = resolveOrgSegment(payload.orgId ?? null)
     const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)
@@ -124,7 +156,9 @@ export class S3StorageDriver implements StorageDriver {
     return { storagePath: key }
   }
 
-  async read(_partitionCode: string, storagePath: string): Promise<ReadFileResult> {
+  async read(partitionCode: string, storagePath: string): Promise<ReadFileResult> {
+    this.assertPartitionScoped(partitionCode, storagePath)
+    this.assertKeyAddressable(storagePath)
     const response = await this.client.send(
       new GetObjectCommand({ Bucket: this.bucket, Key: storagePath }),
     )
@@ -135,7 +169,9 @@ export class S3StorageDriver implements StorageDriver {
     return { buffer, contentType: response.ContentType }
   }
 
-  async delete(_partitionCode: string, storagePath: string): Promise<void> {
+  async delete(partitionCode: string, storagePath: string): Promise<void> {
+    this.assertPartitionScoped(partitionCode, storagePath)
+    this.assertKeyAddressable(storagePath)
     try {
       await this.client.send(
         new DeleteObjectCommand({ Bucket: this.bucket, Key: storagePath }),
@@ -170,6 +206,7 @@ export class S3StorageDriver implements StorageDriver {
    * Put an object directly at a specific S3 key (for standalone usage).
    */
   async putObject(key: string, buffer: Buffer, contentType?: string): Promise<void> {
+    this.assertKeyScoped(key)
     await this.client.send(
       new PutObjectCommand({
         Bucket: this.bucket,
@@ -189,11 +226,14 @@ export class S3StorageDriver implements StorageDriver {
     prefix: string,
     maxKeys = 100,
     continuationToken?: string,
+    scope?: S3TenantScope | null,
   ): Promise<{
     files: Array<{ key: string; size: number; lastModified: Date }>
     truncated: boolean
     nextContinuationToken?: string
   }> {
+    const activeScope = scope ?? this.scope
+    assertS3ListPrefixScopedToTenant(prefix, activeScope, this.pathPrefix)
     const response = await this.client.send(
       new ListObjectsV2Command({
         Bucket: this.bucket,
@@ -202,12 +242,13 @@ export class S3StorageDriver implements StorageDriver {
         ContinuationToken: continuationToken,
       }),
     )
+    const files = (response.Contents ?? []).map((obj) => ({
+      key: obj.Key ?? '',
+      size: obj.Size ?? 0,
+      lastModified: obj.LastModified ?? new Date(0),
+    }))
     return {
-      files: (response.Contents ?? []).map((obj) => ({
-        key: obj.Key ?? '',
-        size: obj.Size ?? 0,
-        lastModified: obj.LastModified ?? new Date(0),
-      })),
+      files: filterS3ObjectsToTenant(files, activeScope, this.pathPrefix),
       truncated: response.IsTruncated ?? false,
       nextContinuationToken: response.NextContinuationToken,
     }
@@ -221,7 +262,13 @@ export class S3StorageDriver implements StorageDriver {
     operation: 'upload' | 'download',
     expiresIn = 3600,
     contentType?: string,
+    scope?: S3TenantScope | null,
   ): Promise<string> {
+    if (operation === 'upload') {
+      this.assertKeyScoped(storagePath, scope)
+    } else {
+      this.assertKeyAddressable(storagePath, scope)
+    }
     if (operation === 'upload') {
       const command = new PutObjectCommand({
         Bucket: this.bucket,

package/src/modules/storage_s3/lib/storage-service.ts

@@ -1,5 +1,10 @@
 import { randomUUID } from 'crypto'
 import { S3StorageDriver } from './s3-driver'
+import {
+  assertS3KeyAddressableByTenantScope,
+  assertS3KeyScopedToTenant,
+  assertS3ListPrefixScopedToTenant,
+} from './key-scope'
 
 type TenantScope = {
   tenantId: string | null | undefined
@@ -48,6 +53,9 @@ type S3Config = {
   accessKeyId?: string
   secretAccessKey?: string
   sessionToken?: string
+  pathPrefix?: string
+  organizationId?: string | null
+  tenantId?: string | null
 }
 
 function sanitizeSegment(value: string): string {
@@ -77,6 +85,7 @@ export interface StorageService {
 
 export function createStorageService(config: S3Config): StorageService {
   const driver = new S3StorageDriver(config as Record<string, unknown>)
+  const pathPrefix = config.pathPrefix
 
   return {
     async upload({ namespace, fileName, buffer, contentType, scope }): Promise<StorageResult> {
@@ -96,28 +105,37 @@ export function createStorageService(config: S3Config): StorageService {
       }
     },
 
-    async download({ key }): Promise<{ buffer: Buffer; contentType?: string }> {
+    async download({ key, scope }): Promise<{ buffer: Buffer; contentType?: string }> {
+      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)
       return driver.read('', key)
     },
 
-    async delete({ key }): Promise<void> {
+    async delete({ key, scope }): Promise<void> {
+      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)
       return driver.delete('', key)
     },
 
-    async getSignedUrl({ key, operation, expiresIn = 3600, contentType }): Promise<{ url: string; expiresAt: Date }> {
-      const url = await driver.getSignedUrl(key, operation, expiresIn, contentType)
+    async getSignedUrl({ key, operation, expiresIn = 3600, contentType, scope }): Promise<{ url: string; expiresAt: Date }> {
+      if (operation === 'upload') {
+        assertS3KeyScopedToTenant(key, scope, pathPrefix)
+      } else {
+        assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)
+      }
+      const url = await driver.getSignedUrl(key, operation, expiresIn, contentType, scope)
       return { url, expiresAt: new Date(Date.now() + expiresIn * 1000) }
     },
 
-    async list({ prefix, maxKeys = 100, continuationToken }): Promise<{
+    async list({ prefix, maxKeys = 100, continuationToken, scope }): Promise<{
       files: Array<{ key: string; size: number; lastModified: Date }>
       truncated: boolean
       nextContinuationToken?: string
     }> {
-      return driver.listObjects(prefix, maxKeys, continuationToken)
+      assertS3ListPrefixScopedToTenant(prefix, scope, pathPrefix)
+      return driver.listObjects(prefix, maxKeys, continuationToken, scope)
     },
 
-    async toLocalPath({ key }) {
+    async toLocalPath({ key, scope }) {
+      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)
       return driver.toLocalPath('', key)
     },
   }