@open-mercato/storage-s3 0.6.7-develop.6630.1.c8a615e536 → 0.6.7-develop.6645.1.52f0b37813

package/dist/modules/storage_s3/api/get/storage-providers/s3/list.js

@@ -22,6 +22,7 @@ const responseSchema = z.object({
   truncated: z.boolean(),
   nextContinuationToken: z.string().optional()
 });
+const DEFAULT_LIST_NAMESPACE = "uploads";
 async function resolveDriver(tenantId, orgId) {
   const { resolve } = await createRequestContainer();
   const credentialsService = resolve("integrationCredentialsService");
@@ -29,6 +30,26 @@ async function resolveDriver(tenantId, orgId) {
   if (!creds) return null;
   return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId });
 }
+function buildTenantPrefix(namespace, tenantId, orgId) {
+  return `${namespace}/org_${orgId}/tenant_${tenantId}/`;
+}
+function resolveTenantScopedPrefix(prefix, tenantId, orgId) {
+  const normalized = prefix.replace(/^\/+/, "");
+  const parts = normalized.split("/");
+  const namespace = parts[0] || DEFAULT_LIST_NAMESPACE;
+  const tenantPrefix = buildTenantPrefix(namespace, tenantId, orgId);
+  if (!normalized || normalized === tenantPrefix.slice(0, -1)) {
+    return tenantPrefix;
+  }
+  if (normalized.startsWith(tenantPrefix)) {
+    return normalized;
+  }
+  if (parts[1]?.startsWith("org_") || parts[2]?.startsWith("tenant_") || normalized.includes(`org_${orgId}/tenant_${tenantId}`)) {
+    return null;
+  }
+  const namespaceRelativePrefix = normalized.slice(namespace.length).replace(/^\/+/, "");
+  return tenantPrefix + namespaceRelativePrefix;
+}
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth?.tenantId || !auth.orgId) {
@@ -39,9 +60,13 @@ async function GET(req) {
   if (!parsed.success) {
     return NextResponse.json({ error: "Invalid query parameters" }, { status: 400 });
   }
-  const tenantPrefix = `org_${auth.orgId}/tenant_${auth.tenantId}/`;
-  const userPrefix = parsed.data.prefix;
-  const effectivePrefix = userPrefix.includes(`org_${auth.orgId}/tenant_${auth.tenantId}`) ? userPrefix : tenantPrefix + userPrefix.replace(/^\//, "");
+  const effectivePrefix = resolveTenantScopedPrefix(parsed.data.prefix, auth.tenantId, auth.orgId);
+  if (effectivePrefix === null) {
+    return NextResponse.json(
+      { error: "Access denied: prefix is not scoped to this tenant." },
+      { status: 403 }
+    );
+  }
   const driver = await resolveDriver(auth.tenantId, auth.orgId);
   if (!driver) {
     return NextResponse.json({ error: "S3 integration is not configured." }, { status: 400 });
@@ -73,7 +98,8 @@ const openApi = {
       responses: [{ status: 200, description: "File listing", schema: responseSchema }],
       errors: [
         { status: 400, description: "Invalid params or S3 not configured", schema: z.object({ error: z.string() }) },
-        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) }
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "Prefix not scoped to this tenant", schema: z.object({ error: z.string() }) }
       ]
     }
   }

package/dist/modules/storage_s3/api/get/storage-providers/s3/list.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/storage_s3/api/get/storage-providers/s3/list.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/list',\n  GET: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst querySchema = z.object({\n  prefix: z.string().optional().default(''),\n  maxKeys: z.coerce.number().int().min(1).max(1000).optional().default(100),\n  continuationToken: z.string().optional(),\n})\n\nconst fileSchema = z.object({\n  key: z.string(),\n  size: z.number().int(),\n  lastModified: z.string(),\n})\n\nconst responseSchema = z.object({\n  files: z.array(fileSchema),\n  truncated: z.boolean(),\n  nextContinuationToken: z.string().optional(),\n})\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const params = Object.fromEntries(new URL(req.url).searchParams.entries())\n  const parsed = querySchema.safeParse(params)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n\n  // Always scope list operations to the tenant namespace to prevent cross-tenant enumeration.\n  const tenantPrefix = `org_${auth.orgId}/tenant_${auth.tenantId}/`\n  const userPrefix = parsed.data.prefix\n  const effectivePrefix = userPrefix.includes(`org_${auth.orgId}/tenant_${auth.tenantId}`)\n    ? userPrefix\n    : tenantPrefix + userPrefix.replace(/^\\//, '')\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const result = await driver.listObjects(\n    effectivePrefix,\n    parsed.data.maxKeys,\n    parsed.data.continuationToken,\n  )\n\n  return NextResponse.json({\n    files: result.files.map((f) => ({\n      key: f.key,\n      size: f.size,\n      lastModified: f.lastModified.toISOString(),\n    })),\n    truncated: result.truncated,\n    nextContinuationToken: result.nextContinuationToken,\n  })\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'List S3 objects',\n  methods: {\n    GET: {\n      summary: 'List files in S3 by prefix',\n      description: 'Returns a paginated list of S3 objects scoped to the authenticated tenant namespace.',\n      query: querySchema,\n      responses: [{ status: 200, description: 'File listing', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid params or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACxC,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACxE,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,cAAc,EAAE,OAAO;AACzB,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,UAAU;AAAA,EACzB,WAAW,EAAE,QAAQ;AAAA,EACrB,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAC7C,CAAC;AAED,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,EAAE,GAAG,OAAO,gBAAgB,OAAO,SAAS,CAAC;AAC1E;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,SAAS,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AACzE,QAAM,SAAS,YAAY,UAAU,MAAM;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAGA,QAAM,eAAe,OAAO,KAAK,KAAK,WAAW,KAAK,QAAQ;AAC9D,QAAM,aAAa,OAAO,KAAK;AAC/B,QAAM,kBAAkB,WAAW,SAAS,OAAO,KAAK,KAAK,WAAW,KAAK,QAAQ,EAAE,IACnF,aACA,eAAe,WAAW,QAAQ,OAAO,EAAE;AAE/C,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,MAAM,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,EACd;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,MAC9B,KAAK,EAAE;AAAA,MACP,MAAM,EAAE;AAAA,MACR,cAAc,EAAE,aAAa,YAAY;AAAA,IAC3C,EAAE;AAAA,IACF,WAAW,OAAO;AAAA,IAClB,uBAAuB,OAAO;AAAA,EAChC,CAAC;AACH;AAEA,IAAO,eAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,eAAe,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC3G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { S3StorageDriver } from '../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/list',\n  GET: { requireAuth: true, requireFeatures: ['storage_providers.manage'] },\n}\n\nconst querySchema = z.object({\n  prefix: z.string().optional().default(''),\n  maxKeys: z.coerce.number().int().min(1).max(1000).optional().default(100),\n  continuationToken: z.string().optional(),\n})\n\nconst fileSchema = z.object({\n  key: z.string(),\n  size: z.number().int(),\n  lastModified: z.string(),\n})\n\nconst responseSchema = z.object({\n  files: z.array(fileSchema),\n  truncated: z.boolean(),\n  nextContinuationToken: z.string().optional(),\n})\n\nconst DEFAULT_LIST_NAMESPACE = 'uploads'\n\nasync function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {\n  const { resolve } = await createRequestContainer()\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const creds = await credentialsService.resolve('storage_s3', { tenantId, organizationId: orgId })\n  if (!creds) return null\n  return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })\n}\n\nfunction buildTenantPrefix(namespace: string, tenantId: string, orgId: string): string {\n  return `${namespace}/org_${orgId}/tenant_${tenantId}/`\n}\n\nfunction resolveTenantScopedPrefix(prefix: string, tenantId: string, orgId: string): string | null {\n  const normalized = prefix.replace(/^\\/+/, '')\n  const parts = normalized.split('/')\n  const namespace = parts[0] || DEFAULT_LIST_NAMESPACE\n  const tenantPrefix = buildTenantPrefix(namespace, tenantId, orgId)\n\n  if (!normalized || normalized === tenantPrefix.slice(0, -1)) {\n    return tenantPrefix\n  }\n\n  if (normalized.startsWith(tenantPrefix)) {\n    return normalized\n  }\n\n  if (\n    parts[1]?.startsWith('org_') ||\n    parts[2]?.startsWith('tenant_') ||\n    normalized.includes(`org_${orgId}/tenant_${tenantId}`)\n  ) {\n    return null\n  }\n\n  const namespaceRelativePrefix = normalized.slice(namespace.length).replace(/^\\/+/, '')\n  return tenantPrefix + namespaceRelativePrefix\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const params = Object.fromEntries(new URL(req.url).searchParams.entries())\n  const parsed = querySchema.safeParse(params)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n\n  // Always scope list operations to the tenant namespace to prevent cross-tenant enumeration.\n  const effectivePrefix = resolveTenantScopedPrefix(parsed.data.prefix, auth.tenantId, auth.orgId)\n  if (effectivePrefix === null) {\n    return NextResponse.json(\n      { error: 'Access denied: prefix is not scoped to this tenant.' },\n      { status: 403 },\n    )\n  }\n\n  const driver = await resolveDriver(auth.tenantId, auth.orgId)\n  if (!driver) {\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const result = await driver.listObjects(\n    effectivePrefix,\n    parsed.data.maxKeys,\n    parsed.data.continuationToken,\n  )\n\n  return NextResponse.json({\n    files: result.files.map((f) => ({\n      key: f.key,\n      size: f.size,\n      lastModified: f.lastModified.toISOString(),\n    })),\n    truncated: result.truncated,\n    nextContinuationToken: result.nextContinuationToken,\n  })\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'List S3 objects',\n  methods: {\n    GET: {\n      summary: 'List files in S3 by prefix',\n      description: 'Returns a paginated list of S3 objects scoped to the authenticated tenant namespace.',\n      query: querySchema,\n      responses: [{ status: 200, description: 'File listing', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid params or S3 not configured', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Prefix not scoped to this tenant', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACxC,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACxE,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,cAAc,EAAE,OAAO;AACzB,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,UAAU;AAAA,EACzB,WAAW,EAAE,QAAQ;AAAA,EACrB,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAC7C,CAAC;AAED,MAAM,yBAAyB;AAE/B,eAAe,cAAc,UAAkB,OAAgD;AAC7F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,QAAQ,MAAM,mBAAmB,QAAQ,cAAc,EAAE,UAAU,gBAAgB,MAAM,CAAC;AAChG,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,IAAI,gBAAgB,EAAE,GAAG,OAAO,gBAAgB,OAAO,SAAS,CAAC;AAC1E;AAEA,SAAS,kBAAkB,WAAmB,UAAkB,OAAuB;AACrF,SAAO,GAAG,SAAS,QAAQ,KAAK,WAAW,QAAQ;AACrD;AAEA,SAAS,0BAA0B,QAAgB,UAAkB,OAA8B;AACjG,QAAM,aAAa,OAAO,QAAQ,QAAQ,EAAE;AAC5C,QAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,QAAM,YAAY,MAAM,CAAC,KAAK;AAC9B,QAAM,eAAe,kBAAkB,WAAW,UAAU,KAAK;AAEjE,MAAI,CAAC,cAAc,eAAe,aAAa,MAAM,GAAG,EAAE,GAAG;AAC3D,WAAO;AAAA,EACT;AAEA,MAAI,WAAW,WAAW,YAAY,GAAG;AACvC,WAAO;AAAA,EACT;AAEA,MACE,MAAM,CAAC,GAAG,WAAW,MAAM,KAC3B,MAAM,CAAC,GAAG,WAAW,SAAS,KAC9B,WAAW,SAAS,OAAO,KAAK,WAAW,QAAQ,EAAE,GACrD;AACA,WAAO;AAAA,EACT;AAEA,QAAM,0BAA0B,WAAW,MAAM,UAAU,MAAM,EAAE,QAAQ,QAAQ,EAAE;AACrF,SAAO,eAAe;AACxB;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,SAAS,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AACzE,QAAM,SAAS,YAAY,UAAU,MAAM;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAGA,QAAM,kBAAkB,0BAA0B,OAAO,KAAK,QAAQ,KAAK,UAAU,KAAK,KAAK;AAC/F,MAAI,oBAAoB,MAAM;AAC5B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,sDAAsD;AAAA,MAC/D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,KAAK;AAC5D,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,MAAM,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,EACd;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,MAC9B,KAAK,EAAE;AAAA,MACP,MAAM,EAAE;AAAA,MACR,cAAc,EAAE,aAAa,YAAY;AAAA,IAC3C,EAAE;AAAA,IACF,WAAW,OAAO;AAAA,IAClB,uBAAuB,OAAO;AAAA,EAChC,CAAC;AACH;AAEA,IAAO,eAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,eAAe,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC3G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/storage-s3",
-  "version": "0.6.7-develop.6630.1.c8a615e536",
+  "version": "0.6.7-develop.6645.1.52f0b37813",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -69,14 +69,14 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1085.0",
     "@aws-sdk/s3-request-presigner": "^3.1085.0",
-    "@open-mercato/core": "0.6.7-develop.6630.1.c8a615e536"
+    "@open-mercato/core": "0.6.7-develop.6645.1.52f0b37813"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^6.6.10",
-    "@open-mercato/shared": "0.6.7-develop.6630.1.c8a615e536"
+    "@open-mercato/shared": "0.6.7-develop.6645.1.52f0b37813"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6630.1.c8a615e536",
+    "@open-mercato/shared": "0.6.7-develop.6645.1.52f0b37813",
     "@types/jest": "^30.0.0",
     "esbuild": "^0.28.1",
     "glob": "^13.0.6",

package/src/modules/storage_s3/__tests__/s3ListRoute.test.ts

@@ -0,0 +1,85 @@
+/** @jest-environment node */
+
+const tenantId = 'tenant-1'
+const orgId = 'org-1'
+const listObjectsMock = jest.fn()
+const credentialsResolveMock = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/auth/server', () => ({
+  getAuthFromRequest: async () => ({ tenantId, orgId, sub: null }),
+}))
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: async () => ({
+    resolve: (token: string) => {
+      if (token === 'integrationCredentialsService') {
+        return { resolve: credentialsResolveMock }
+      }
+      throw new Error(`Unexpected container token: ${token}`)
+    },
+  }),
+}))
+
+jest.mock('../lib/s3-driver', () => ({
+  S3StorageDriver: jest.fn().mockImplementation(() => ({
+    listObjects: listObjectsMock,
+  })),
+}))
+
+import { GET } from '../api/get/storage-providers/s3/list'
+
+beforeEach(() => {
+  jest.clearAllMocks()
+  credentialsResolveMock.mockResolvedValue({ bucket: 'bucket', region: 'eu-central-1' })
+  listObjectsMock.mockResolvedValue({
+    files: [],
+    truncated: false,
+    nextContinuationToken: undefined,
+  })
+})
+
+describe('storage_s3 list route tenant scoping', () => {
+  it('scopes an unqualified namespace prefix to the authenticated tenant', async () => {
+    const response = await GET(
+      new Request('http://localhost/api/storage-providers/s3/list?prefix=exports/&maxKeys=25&continuationToken=next'),
+    )
+
+    expect(response.status).toBe(200)
+    expect(listObjectsMock).toHaveBeenCalledWith(
+      'exports/org_org-1/tenant_tenant-1/',
+      25,
+      'next',
+    )
+  })
+
+  it('passes an already scoped tenant prefix through when it is structurally left anchored', async () => {
+    const scopedPrefix = 'exports/org_org-1/tenant_tenant-1/reports/'
+    const response = await GET(
+      new Request(`http://localhost/api/storage-providers/s3/list?prefix=${encodeURIComponent(scopedPrefix)}`),
+    )
+
+    expect(response.status).toBe(200)
+    expect(listObjectsMock).toHaveBeenCalledWith(scopedPrefix, 100, undefined)
+  })
+
+  it('rejects a prefix scoped to a different tenant before listing S3 objects', async () => {
+    const response = await GET(
+      new Request('http://localhost/api/storage-providers/s3/list?prefix=exports/org_other/tenant_tenant-1/'),
+    )
+
+    expect(response.status).toBe(403)
+    await expect(response.json()).resolves.toEqual({
+      error: 'Access denied: prefix is not scoped to this tenant.',
+    })
+    expect(listObjectsMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects a prefix that only contains the tenant scope later in the path', async () => {
+    const response = await GET(
+      new Request('http://localhost/api/storage-providers/s3/list?prefix=exports/archive/org_org-1/tenant_tenant-1/'),
+    )
+
+    expect(response.status).toBe(403)
+    expect(listObjectsMock).not.toHaveBeenCalled()
+  })
+})

package/src/modules/storage_s3/api/get/storage-providers/s3/list.ts

@@ -28,6 +28,8 @@ const responseSchema = z.object({
   nextContinuationToken: z.string().optional(),
 })
 
+const DEFAULT_LIST_NAMESPACE = 'uploads'
+
 async function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {
   const { resolve } = await createRequestContainer()
   const credentialsService = resolve('integrationCredentialsService') as {
@@ -38,6 +40,36 @@ async function resolveDriver(tenantId: string, orgId: string): Promise<S3Storage
   return new S3StorageDriver({ ...creds, organizationId: orgId, tenantId })
 }
 
+function buildTenantPrefix(namespace: string, tenantId: string, orgId: string): string {
+  return `${namespace}/org_${orgId}/tenant_${tenantId}/`
+}
+
+function resolveTenantScopedPrefix(prefix: string, tenantId: string, orgId: string): string | null {
+  const normalized = prefix.replace(/^\/+/, '')
+  const parts = normalized.split('/')
+  const namespace = parts[0] || DEFAULT_LIST_NAMESPACE
+  const tenantPrefix = buildTenantPrefix(namespace, tenantId, orgId)
+
+  if (!normalized || normalized === tenantPrefix.slice(0, -1)) {
+    return tenantPrefix
+  }
+
+  if (normalized.startsWith(tenantPrefix)) {
+    return normalized
+  }
+
+  if (
+    parts[1]?.startsWith('org_') ||
+    parts[2]?.startsWith('tenant_') ||
+    normalized.includes(`org_${orgId}/tenant_${tenantId}`)
+  ) {
+    return null
+  }
+
+  const namespaceRelativePrefix = normalized.slice(namespace.length).replace(/^\/+/, '')
+  return tenantPrefix + namespaceRelativePrefix
+}
+
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
@@ -51,11 +83,13 @@ export async function GET(req: Request) {
   }
 
   // Always scope list operations to the tenant namespace to prevent cross-tenant enumeration.
-  const tenantPrefix = `org_${auth.orgId}/tenant_${auth.tenantId}/`
-  const userPrefix = parsed.data.prefix
-  const effectivePrefix = userPrefix.includes(`org_${auth.orgId}/tenant_${auth.tenantId}`)
-    ? userPrefix
-    : tenantPrefix + userPrefix.replace(/^\//, '')
+  const effectivePrefix = resolveTenantScopedPrefix(parsed.data.prefix, auth.tenantId, auth.orgId)
+  if (effectivePrefix === null) {
+    return NextResponse.json(
+      { error: 'Access denied: prefix is not scoped to this tenant.' },
+      { status: 403 },
+    )
+  }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
@@ -93,6 +127,7 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid params or S3 not configured', schema: z.object({ error: z.string() }) },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'Prefix not scoped to this tenant', schema: z.object({ error: z.string() }) },
       ],
     },
   },