@open-mercato/storage-s3 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/src/modules/storage_s3/api/get/storage-providers/s3/download.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import {
   buildAttachmentContentDisposition,
   canRenderInlineAttachment,
@@ -28,24 +27,23 @@ async function resolveDriver(tenantId: string, orgId: string): Promise<S3Storage
 }
 
 export async function GET(req: Request) {
-  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
   const key = new URL(req.url).searchParams.get('key')
   if (!key) {
-    return NextResponse.json({ error: t('storage_s3.errors.keyRequired', 'key query param is required') }, { status: 400 })
+    return NextResponse.json({ error: 'key query param is required' }, { status: 400 })
   }
 
   if (!isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)) {
-    return NextResponse.json({ error: t('storage_s3.errors.keyAccessDenied', 'Access denied: key is not scoped to this tenant.') }, { status: 403 })
+    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
+    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
   }
 
   let buffer: Buffer
@@ -55,7 +53,7 @@ export async function GET(req: Request) {
     buffer = result.buffer
     contentType = result.contentType
   } catch {
-    return NextResponse.json({ error: t('storage_s3.errors.fileNotFound', 'File not found') }, { status: 404 })
+    return NextResponse.json({ error: 'File not found' }, { status: 404 })
   }
 
   const fileName = sanitizeUploadedFileName(key.split('/').pop() || 'download')

package/src/modules/storage_s3/api/get/storage-providers/s3/list.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
 
 export const metadata = {
@@ -72,30 +71,29 @@ function resolveTenantScopedPrefix(prefix: string, tenantId: string, orgId: stri
 }
 
 export async function GET(req: Request) {
-  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
   const params = Object.fromEntries(new URL(req.url).searchParams.entries())
   const parsed = querySchema.safeParse(params)
   if (!parsed.success) {
-    return NextResponse.json({ error: t('storage_s3.errors.invalidQuery', 'Invalid query parameters') }, { status: 400 })
+    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })
   }
 
   // Always scope list operations to the tenant namespace to prevent cross-tenant enumeration.
   const effectivePrefix = resolveTenantScopedPrefix(parsed.data.prefix, auth.tenantId, auth.orgId)
   if (effectivePrefix === null) {
     return NextResponse.json(
-      { error: t('storage_s3.errors.prefixAccessDenied', 'Access denied: prefix is not scoped to this tenant.') },
+      { error: 'Access denied: prefix is not scoped to this tenant.' },
       { status: 403 },
     )
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
+    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
   }
 
   const result = await driver.listObjects(

package/src/modules/storage_s3/api/post/storage-providers/s3/signed-url.ts

@@ -3,13 +3,8 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { isS3KeyAddressableByScope, isS3KeyScopedToTenant } from '../../../../lib/key-scope'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
-import { createHash, randomBytes } from 'node:crypto'
-import { resolveAttachmentMaxBytes } from '@open-mercato/core/modules/attachments/lib/upload-limits'
-import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
-import { reconcileTenantS3Objects } from '../../../../lib/quota-accounting'
 
 export const metadata = {
   path: '/storage-providers/s3/signed-url',
@@ -21,13 +16,11 @@ const requestSchema = z.object({
   operation: z.enum(['upload', 'download']),
   expiresIn: z.number().int().min(60).max(604800).optional().default(3600),
   contentType: z.string().optional(),
-  size: z.number().int().nonnegative().optional(),
 })
 
 const responseSchema = z.object({
   url: z.string(),
   expiresAt: z.string(),
-  reservationId: z.string().optional(),
 })
 
 async function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {
@@ -41,96 +34,32 @@ async function resolveDriver(tenantId: string, orgId: string): Promise<S3Storage
 }
 
 export async function POST(req: Request) {
-  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
   const json = await req.json().catch(() => null)
   const parsed = requestSchema.safeParse(json)
   if (!parsed.success) {
-    return NextResponse.json({ error: t('storage_s3.errors.invalidPayload', 'Invalid payload') }, { status: 400 })
+    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
   }
 
-  const { key, operation, expiresIn, contentType, size } = parsed.data
+  const { key, operation, expiresIn, contentType } = parsed.data
   const canAccessKey = operation === 'download'
     ? isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)
     : isS3KeyScopedToTenant(key, auth.orgId, auth.tenantId)
   if (!canAccessKey) {
-    return NextResponse.json({ error: t('storage_s3.errors.keyAccessDenied', 'Access denied: key is not scoped to this tenant.') }, { status: 403 })
+    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
-  }
-
-  const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString()
-
-  if (operation === 'upload') {
-    const { resolve } = await createRequestContainer()
-    let attachmentQuotaService: AttachmentQuotaService | null = null
-    let recoveryScheduler: ((
-      payload: { reservationId: string; tenantId: string; organizationId: string },
-      delayMs: number,
-    ) => Promise<void>) | null = null
-    try {
-      attachmentQuotaService = resolve('attachmentQuotaService') as AttachmentQuotaService
-      recoveryScheduler = resolve('storageS3QuotaRecoveryScheduler') as (
-        payload: { reservationId: string; tenantId: string; organizationId: string },
-        delayMs: number,
-      ) => Promise<void>
-    } catch {
-      // Fail closed below when the attachments quota service is not registered.
-    }
-    if (!attachmentQuotaService) {
-      return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })
-    }
-    const compatibilityToken = randomBytes(32).toString('base64url')
-    const reservedBytes = size ?? resolveAttachmentMaxBytes()
-    let reservation: Awaited<ReturnType<AttachmentQuotaService['reserve']>> | null = null
-    try {
-      await reconcileTenantS3Objects({
-        driver,
-        quotaService: attachmentQuotaService,
-        tenantId: auth.tenantId,
-        organizationId: auth.orgId,
-      })
-      reservation = await attachmentQuotaService.reserve({
-        tenantId: auth.tenantId,
-        organizationId: auth.orgId,
-        bytes: reservedBytes,
-        source: 'storage_s3_signed',
-        storageDriver: 's3',
-        storagePath: key,
-        uploadTokenHash: createHash('sha256').update(compatibilityToken).digest('hex'),
-        ttlMs: expiresIn * 1000,
-      })
-      if (!recoveryScheduler) throw new Error('Storage quota recovery is unavailable.')
-      await recoveryScheduler({
-        reservationId: reservation.id,
-        tenantId: auth.tenantId,
-        organizationId: auth.orgId,
-      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))
-      const url = new URL(`/api/storage-providers/s3/signed-upload/${compatibilityToken}`, req.url).toString()
-      return NextResponse.json({ url, expiresAt, reservationId: reservation.id })
-    } catch (error) {
-      if (reservation) {
-        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-      }
-      const code = (error as { code?: unknown })?.code
-      if (code === 'quota_exceeded') {
-        return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })
-      }
-      if (code === 'quota_target_exists') {
-        return NextResponse.json({ error: 'The target storage key already exists.' }, { status: 409 })
-      }
-      return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })
-    }
+    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
   }
 
   const url = await driver.getSignedUrl(key, operation, expiresIn, contentType)
+  const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString()
 
   return NextResponse.json({ url, expiresAt })
 }

package/src/modules/storage_s3/api/post/storage-providers/s3/upload.ts

@@ -3,23 +3,18 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import {
   detectAttachmentMimeType,
   hasDangerousExecutableExtension,
   isActiveContentAttachment,
 } from '@open-mercato/core/modules/attachments/lib/security'
 import {
-  isMultipartUploadLimitError,
   isMultipartRequestWithinUploadLimit,
-  parseMultipartFormDataWithinUploadLimit,
   resolveAttachmentMaxBytes,
   willExceedAttachmentTenantQuota,
 } from '@open-mercato/core/modules/attachments/lib/upload-limits'
 import { isS3KeyScopedToTenant } from '../../../../lib/key-scope'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
-import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
-import { reconcileTenantS3Objects } from '../../../../lib/quota-accounting'
 import { randomUUID } from 'crypto'
 
 export const metadata = {
@@ -73,146 +68,66 @@ async function readTenantStorageUsageBytes(
 }
 
 export async function POST(req: Request) {
-  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
   if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {
-    return NextResponse.json({ error: t('storage_s3.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.') }, { status: 413 })
+    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })
   }
 
   const contentType = req.headers.get('content-type') ?? ''
   if (!contentType.includes('multipart/form-data')) {
-    return NextResponse.json({ error: t('storage_s3.errors.multipartRequired', 'Expected multipart/form-data') }, { status: 400 })
+    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })
   }
 
-  let form: FormData
-  try {
-    form = await parseMultipartFormDataWithinUploadLimit(req)
-  } catch (error) {
-    if (isMultipartUploadLimitError(error)) {
-      return NextResponse.json({ error: t('storage_s3.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.') }, { status: 413 })
-    }
-    throw error
-  }
+  const form = await req.formData()
   const file = form.get('file') as File | null
   if (!file) {
-    return NextResponse.json({ error: t('storage_s3.errors.fileRequired', 'file field is required') }, { status: 400 })
+    return NextResponse.json({ error: 'file field is required' }, { status: 400 })
   }
 
   const keyOverride = form.get('key') ? String(form.get('key')) : null
 
   if (keyOverride !== null && !isS3KeyScopedToTenant(keyOverride, auth.orgId, auth.tenantId)) {
     return NextResponse.json(
-      { error: t('storage_s3.errors.keyOverrideAccessDenied', 'Access denied: key override is not scoped to this tenant.') },
+      { error: 'Access denied: key override is not scoped to this tenant.' },
       { status: 403 },
     )
   }
 
   if (hasDangerousExecutableExtension(file.name)) {
-    return NextResponse.json({ error: t('storage_s3.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.') }, { status: 400 })
+    return NextResponse.json({ error: 'Executable file types are not allowed as attachments.' }, { status: 400 })
   }
 
   const effectiveMaxBytes = resolveAttachmentMaxBytes()
   if (file.size > effectiveMaxBytes) {
-    return NextResponse.json({ error: t('storage_s3.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.') }, { status: 413 })
+    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
+    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
   }
 
   const buffer = Buffer.from(await file.arrayBuffer())
   const safeName = sanitizeFileName(file.name)
   const trustedMimeType = detectAttachmentMimeType(buffer, safeName, file.type || null)
   if (isActiveContentAttachment(buffer, safeName, trustedMimeType)) {
-    return NextResponse.json({ error: t('storage_s3.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })
+    return NextResponse.json({ error: 'Active content uploads are not allowed.' }, { status: 400 })
+  }
+
+  const tenantUsageBytes = await readTenantStorageUsageBytes(driver, auth.tenantId, auth.orgId)
+  if (willExceedAttachmentTenantQuota(tenantUsageBytes, buffer.length)) {
+    return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })
   }
 
   const key =
     keyOverride ??
     `uploads/org_${auth.orgId}/tenant_${auth.tenantId}/${Date.now()}_${randomUUID().slice(0, 8)}_${safeName}`
 
-  const { resolve } = await createRequestContainer()
-  let attachmentQuotaService: AttachmentQuotaService | null = null
-  let recoveryScheduler: ((
-    payload: { reservationId: string; tenantId: string; organizationId: string },
-    delayMs: number,
-  ) => Promise<void>) | null = null
-  try {
-    attachmentQuotaService = resolve('attachmentQuotaService') as AttachmentQuotaService
-    recoveryScheduler = resolve('storageS3QuotaRecoveryScheduler') as (
-      payload: { reservationId: string; tenantId: string; organizationId: string },
-      delayMs: number,
-    ) => Promise<void>
-  } catch {
-    // Backward-compatible fallback below when the attachments quota service is not registered.
-  }
-  let reservation: { id: string; leaseToken: string; expiresAt: Date } | null = null
-  if (attachmentQuotaService) {
-    try {
-      await reconcileTenantS3Objects({
-        driver,
-        quotaService: attachmentQuotaService,
-        tenantId: auth.tenantId,
-        organizationId: auth.orgId,
-      })
-      reservation = await attachmentQuotaService.reserve({
-        tenantId: auth.tenantId,
-        organizationId: auth.orgId,
-        bytes: buffer.length,
-        source: 'storage_s3_upload',
-        storageDriver: 's3',
-        storagePath: key,
-      })
-      if (!recoveryScheduler) throw new Error('Storage quota recovery is unavailable.')
-      await recoveryScheduler({
-        reservationId: reservation.id,
-        tenantId: auth.tenantId,
-        organizationId: auth.orgId,
-      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))
-      await attachmentQuotaService.beginStorage(reservation.id, reservation.leaseToken)
-    } catch (error) {
-      if (reservation) {
-        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-        reservation = null
-      }
-      const code = (error as { code?: unknown })?.code
-      if (code === 'quota_exceeded') {
-        return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })
-      }
-      if (code === 'quota_target_exists') {
-        return NextResponse.json({ error: 'The target storage key already exists.' }, { status: 409 })
-      }
-      return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })
-    }
-  } else {
-    const tenantUsageBytes = await readTenantStorageUsageBytes(driver, auth.tenantId, auth.orgId)
-    if (willExceedAttachmentTenantQuota(tenantUsageBytes, buffer.length)) {
-      return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })
-    }
-  }
-
-  try {
-    await driver.putObject(key, buffer, trustedMimeType)
-    if (reservation) {
-      await attachmentQuotaService!.markStored(reservation.id, reservation.leaseToken)
-      await attachmentQuotaService!.completeStandalone(reservation.id, reservation.leaseToken, buffer.length)
-    }
-  } catch (error) {
-    if (reservation) {
-      try {
-        await driver.deleteStrict('', key)
-        await attachmentQuotaService!.release(reservation.id, reservation.leaseToken)
-      } catch {
-        // Retain the reservation when object absence cannot be proven.
-      }
-    }
-    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })
-  }
+  await driver.putObject(key, buffer, trustedMimeType)
 
   return NextResponse.json({
     key,

package/src/modules/storage_s3/di.ts

@@ -6,10 +6,8 @@ import {
 } from '@open-mercato/core/modules/attachments/lib/drivers'
 import { S3StorageDriver } from './lib/s3-driver'
 import { createStorageService } from './lib/storage-service'
-import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
 import { s3HealthCheck } from './lib/health'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { scheduleStorageS3QuotaRecovery } from './lib/quota-recovery-queue'
 
 const logger = createLogger('storage_s3')
 
@@ -69,22 +67,14 @@ export function register(container: AppContainer) {
 
   container.register({
     s3HealthCheck: asValue(s3HealthCheck),
-    storageS3QuotaRecoveryScheduler: asValue(scheduleStorageS3QuotaRecovery),
     storageService: asFunction(
-      ({ integrationCredentialsService, attachmentQuotaService, storageS3QuotaRecoveryScheduler }: {
-        integrationCredentialsService: IntegrationCredentialsService
-        attachmentQuotaService: AttachmentQuotaService
-        storageS3QuotaRecoveryScheduler: (
-          payload: { reservationId: string; tenantId: string; organizationId: string },
-          delayMs: number,
-        ) => Promise<void>
-      }) => {
+      ({ integrationCredentialsService }: { integrationCredentialsService: IntegrationCredentialsService }) => {
         // StorageService factory — builds the service lazily using credentials
         // resolved from the Integration Marketplace per request.
         return {
           async _resolveService(scope: { tenantId: string; organizationId: string }) {
             const creds = await integrationCredentialsService.resolve('storage_s3', scope)
-            if (!creds) throw new Error('[internal] S3 storage integration is not configured for this tenant.')
+            if (!creds) throw new Error('S3 storage integration is not configured for this tenant.')
             return createStorageService({
               authMode: creds.authMode === 'ambient' || creds.authMode === 'access_keys'
                 ? (creds.authMode as 'ambient' | 'access_keys')
@@ -96,8 +86,6 @@ export function register(container: AppContainer) {
               accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : undefined,
               secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : undefined,
               sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,
-              quotaService: attachmentQuotaService,
-              quotaRecoveryScheduler: storageS3QuotaRecoveryScheduler,
               organizationId: scope.organizationId,
               tenantId: scope.tenantId,
               // Credentials are resolved from the Integration Marketplace (encrypted at rest)

package/src/modules/storage_s3/integration.ts

@@ -79,7 +79,7 @@ export const integration: IntegrationDefinition = {
         type: 'url',
         required: false,
         placeholder: 'https://fra1.digitaloceanspaces.com',
-        helpText: 'Custom S3 endpoint URL. Leave empty for AWS S3. Internal/private endpoints require OM_STORAGE_S3_ALLOW_INTERNAL_ENDPOINTS=true.',
+        helpText: 'Custom S3 endpoint URL. Leave empty for AWS S3. Required for MinIO, DigitalOcean Spaces, and other providers.',
       },
       {
         key: 'forcePathStyle',

package/src/modules/storage_s3/lib/health.ts

@@ -1,5 +1,4 @@
 import { S3Client, HeadBucketCommand } from '@aws-sdk/client-s3'
-import { assertSafeS3Endpoint, createSafeS3RequestHandler } from './endpoint-safety'
 import type { S3DriverConfig } from './s3-driver'
 
 export const s3HealthCheck = {
@@ -68,28 +67,11 @@ export const s3HealthCheck = {
       }
     }
 
-    try {
-      await assertSafeS3Endpoint(cfg.endpoint)
-    } catch (err: unknown) {
-      const message = err instanceof Error ? err.message : 'Unsafe S3 endpoint'
-      const reason = err && typeof err === 'object' && 'reason' in err ? (err as { reason?: unknown }).reason : undefined
-      return {
-        status: 'unhealthy',
-        message,
-        details: {
-          ...(typeof reason === 'string' ? { reason } : {}),
-        },
-        checkedAt,
-      }
-    }
-
-    const requestHandler = createSafeS3RequestHandler(cfg.endpoint)
     const client = new S3Client({
       region: cfg.region ?? 'us-east-1',
       endpoint: cfg.endpoint,
       forcePathStyle: cfg.forcePathStyle ?? false,
       credentials: credentialConfig,
-      ...(requestHandler ? { requestHandler } : {}),
     })
 
     try {

package/src/modules/storage_s3/lib/key-scope.ts

@@ -113,7 +113,7 @@ export function assertS3KeyScopedToTenant(
   pathPrefix?: string,
 ): void {
   if (!isS3KeyScopedToTenant(storagePath, scope, pathPrefix)) {
-    throw new Error('[internal] S3 key is not scoped to the active tenant')
+    throw new Error('S3 key is not scoped to the active tenant')
   }
 }
 
@@ -123,7 +123,7 @@ export function assertS3KeyAddressableByTenantScope(
   pathPrefix?: string,
 ): void {
   if (!isS3KeyAddressableByTenantScope(storagePath, scope, pathPrefix)) {
-    throw new Error('[internal] S3 key is not scoped to the active tenant')
+    throw new Error('S3 key is not scoped to the active tenant')
   }
 }
 
@@ -140,7 +140,7 @@ export function assertS3ListPrefixScopedToTenant(
 
   if (parts[0]?.startsWith('org_') || parts[1]?.startsWith('tenant_')) {
     if (parts[0] !== segments.orgSegment || parts[1] !== segments.tenantSegment) {
-      throw new Error('[internal] S3 prefix is not scoped to the active tenant')
+      throw new Error('S3 prefix is not scoped to the active tenant')
     }
     return
   }
@@ -149,7 +149,7 @@ export function assertS3ListPrefixScopedToTenant(
     (parts[1]?.startsWith('org_') && parts[1] !== segments.orgSegment)
     || (parts[2]?.startsWith('tenant_') && parts[2] !== segments.tenantSegment)
   ) {
-    throw new Error('[internal] S3 prefix is not scoped to the active tenant')
+    throw new Error('S3 prefix is not scoped to the active tenant')
   }
 }