@open-mercato/storage-s3 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/src/modules/storage_s3/__tests__/quota-recovery.test.ts

@@ -1,83 +0,0 @@
-/** @jest-environment node */
-
-const mockListObjects = jest.fn(async () => ({ files: [], truncated: false }))
-const mockScheduleRecovery = jest.fn(async () => {})
-
-jest.mock('../lib/s3-driver', () => ({
-  S3StorageDriver: jest.fn().mockImplementation(() => ({
-    listObjects: mockListObjects,
-    deleteStrict: jest.fn(async () => {}),
-  })),
-}))
-
-jest.mock('../lib/quota-recovery-queue', () => ({
-  scheduleStorageS3QuotaRecovery: mockScheduleRecovery,
-}))
-
-import handle from '../workers/quota-recovery'
-import { S3StorageDriver } from '../lib/s3-driver'
-
-function reservation(status: 'storing' | 'recovering') {
-  return {
-    id: 'reservation-1',
-    tenantId: 'tenant-1',
-    organizationId: 'org-1',
-    reservedBytes: 3,
-    actualBytes: null,
-    status,
-    source: 'storage_s3_signed',
-    storageDriver: 's3',
-    partitionCode: null,
-    storagePath: 'uploads/org_org-1/tenant_tenant-1/safe.pdf',
-    leaseToken: 'lease-1',
-    uploadTokenHash: 'token-hash',
-    expiresAt: new Date(Date.now() - 1_000),
-  }
-}
-
-describe('storage_s3 quota recovery', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-  })
-
-  it('retains capacity and rechecks once when an active proxy upload has no visible object yet', async () => {
-    const current = reservation('storing')
-    const claimed = { ...reservation('recovering'), expiresAt: new Date(Date.now() + 60_000) }
-    const quotaService = {
-      getReservation: jest.fn(async () => current),
-      claimExpired: jest.fn(async () => claimed),
-      release: jest.fn(async () => {}),
-      commitRecoveredStandalone: jest.fn(async () => {}),
-    }
-    const ctx = {
-      resolve: (name: string) => {
-        if (name === 'attachmentQuotaService') return quotaService
-        if (name === 'integrationCredentialsService') {
-          return { resolve: jest.fn(async () => ({ bucket: 'bucket', region: 'us-east-1' })) }
-        }
-        throw new Error(`Unexpected dependency: ${name}`)
-      },
-    }
-
-    const payload = {
-      reservationId: current.id,
-      tenantId: current.tenantId,
-      organizationId: current.organizationId,
-    }
-    await handle({ payload, id: 'job-1' } as never, ctx as never)
-
-    expect(quotaService.getReservation).toHaveBeenCalledWith(current.id, {
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-    })
-    expect(S3StorageDriver).toHaveBeenCalledWith(expect.objectContaining({
-      organizationId: 'org-1',
-      tenantId: 'tenant-1',
-    }))
-    expect(mockScheduleRecovery).toHaveBeenCalledWith(
-      { ...payload, absenceCheck: 1 },
-      expect.any(Number),
-    )
-    expect(quotaService.release).not.toHaveBeenCalled()
-  })
-})

package/src/modules/storage_s3/__tests__/upload.test.ts

@@ -1,93 +0,0 @@
-/** @jest-environment node */
-
-const mockGetAuthFromRequest = jest.fn()
-jest.mock('@open-mercato/shared/lib/auth/server', () => ({
-  getAuthFromRequest: (...args: unknown[]) => mockGetAuthFromRequest(...args),
-}))
-
-jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: async () => ({
-    t: (key: string) => `translated:${key}`,
-  }),
-}))
-
-const mockResolveCredentials = jest.fn()
-const mockCreateRequestContainer = jest.fn(async () => ({
-  resolve: (key: string) => {
-    if (key === 'integrationCredentialsService') return { resolve: mockResolveCredentials }
-    throw new Error(`Unexpected dependency: ${key}`)
-  },
-}))
-jest.mock('@open-mercato/shared/lib/di/container', () => ({
-  createRequestContainer: () => mockCreateRequestContainer(),
-}))
-
-const mockListObjects = jest.fn()
-const mockPutObject = jest.fn()
-jest.mock('../lib/s3-driver', () => ({
-  S3StorageDriver: jest.fn().mockImplementation(() => ({
-    getBucket: () => 'test-bucket',
-    listObjects: (...args: unknown[]) => mockListObjects(...args),
-    putObject: (...args: unknown[]) => mockPutObject(...args),
-  })),
-}))
-
-import { POST } from '../api/post/storage-providers/s3/upload'
-
-describe('storage_s3 direct upload route', () => {
-  const originalMaxUploadMb = process.env.OM_ATTACHMENT_MAX_UPLOAD_MB
-
-  beforeEach(() => {
-    jest.clearAllMocks()
-    mockGetAuthFromRequest.mockResolvedValue({ tenantId: 'tenant-1', orgId: 'org-1' })
-    mockResolveCredentials.mockResolvedValue({ bucket: 'test-bucket', region: 'eu-central-1' })
-    mockListObjects.mockResolvedValue({ files: [], truncated: false })
-    mockPutObject.mockResolvedValue(undefined)
-    delete process.env.OM_ATTACHMENT_MAX_UPLOAD_MB
-  })
-
-  afterAll(() => {
-    if (originalMaxUploadMb === undefined) delete process.env.OM_ATTACHMENT_MAX_UPLOAD_MB
-    else process.env.OM_ATTACHMENT_MAX_UPLOAD_MB = originalMaxUploadMb
-  })
-
-  it('rejects oversized streamed metadata without trusting content length', async () => {
-    process.env.OM_ATTACHMENT_MAX_UPLOAD_MB = '0.000001'
-    const boundary = 'oversized-key'
-    const body = new TextEncoder().encode([
-      `--${boundary}\r\nContent-Disposition: form-data; name="key"\r\n\r\n`,
-      'x'.repeat(1024 * 1024),
-      `\r\n--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="small.txt"\r\n`,
-      'Content-Type: text/plain\r\n\r\ns\r\n',
-      `--${boundary}--\r\n`,
-    ].join(''))
-    const request = new Request('http://example.test/api/storage-providers/s3/upload', {
-      method: 'POST',
-      headers: { 'content-type': `multipart/form-data; boundary=${boundary}` },
-      body,
-    })
-
-    expect(request.headers.get('content-length')).toBeNull()
-    const response = await POST(request)
-
-    expect(response.status).toBe(413)
-    await expect(response.json()).resolves.toEqual({
-      error: 'translated:storage_s3.errors.maxUploadSize',
-    })
-    expect(mockCreateRequestContainer).not.toHaveBeenCalled()
-    expect(mockPutObject).not.toHaveBeenCalled()
-  })
-
-  it('preserves valid multipart parsing for a normal upload', async () => {
-    const form = new FormData()
-    form.set('file', new File([new TextEncoder().encode('safe')], 'safe.txt', { type: 'text/plain' }))
-    const response = await POST(new Request('http://example.test/api/storage-providers/s3/upload', {
-      method: 'POST',
-      body: form,
-    }))
-
-    expect(response.status).toBe(200)
-    await expect(response.json()).resolves.toMatchObject({ bucket: 'test-bucket', size: 4 })
-    expect(mockPutObject).toHaveBeenCalledTimes(1)
-  })
-})

package/src/modules/storage_s3/api/put/storage-providers/s3/signed-upload/[token].ts

@@ -1,150 +0,0 @@
-import { createHash } from 'node:crypto'
-import path from 'node:path'
-import { NextResponse } from 'next/server'
-import { z } from 'zod'
-import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
-import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import {
-  detectAttachmentMimeType,
-  hasDangerousExecutableExtension,
-  isActiveContentAttachment,
-} from '@open-mercato/core/modules/attachments/lib/security'
-import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
-import { S3StorageDriver } from '../../../../../lib/s3-driver'
-
-export const metadata = {
-  path: '/storage-providers/s3/signed-upload/:token',
-  PUT: { requireAuth: false },
-}
-
-type RouteContext = { params?: Promise<{ token?: string }> | { token?: string } }
-
-class UploadBodyTooLargeError extends Error {}
-
-async function readBoundedBody(req: Request, maxBytes: number): Promise<Buffer> {
-  if (!req.body) return Buffer.alloc(0)
-  const reader = req.body.getReader()
-  const chunks: Buffer[] = []
-  let totalBytes = 0
-  try {
-    while (true) {
-      const { done, value } = await reader.read()
-      if (done) break
-      totalBytes += value.byteLength
-      if (totalBytes > maxBytes) {
-        await reader.cancel()
-        throw new UploadBodyTooLargeError('Attachment exceeds the reserved upload size.')
-      }
-      chunks.push(Buffer.from(value))
-    }
-  } finally {
-    reader.releaseLock()
-  }
-  return Buffer.concat(chunks, totalBytes)
-}
-
-export async function PUT(req: Request, ctx: RouteContext) {
-  const params = ctx.params instanceof Promise ? await ctx.params : ctx.params
-  const token = params?.token?.trim()
-  if (!token) return NextResponse.json({ error: 'Upload token is required.' }, { status: 400 })
-
-  const { resolve } = await createRequestContainer()
-  let quotaService: AttachmentQuotaService | null = null
-  try {
-    quotaService = resolve('attachmentQuotaService') as AttachmentQuotaService
-  } catch {
-    // Fail closed below when the attachments quota service is not registered.
-  }
-  if (!quotaService) return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })
-
-  const tokenHash = createHash('sha256').update(token).digest('hex')
-  const reservation = await quotaService.claimPendingByUploadTokenHash(tokenHash)
-  if (!reservation || reservation.source !== 'storage_s3_signed') {
-    return NextResponse.json({ error: 'Upload token is invalid or expired.' }, { status: 410 })
-  }
-
-  const declaredLengthHeader = req.headers.get('content-length')
-  const declaredLength = declaredLengthHeader == null ? null : Number(declaredLengthHeader)
-  if (declaredLength !== null && Number.isFinite(declaredLength) && declaredLength > reservation.reservedBytes) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-    return NextResponse.json({ error: 'Attachment exceeds the reserved upload size.' }, { status: 413 })
-  }
-  let buffer: Buffer
-  try {
-    buffer = await readBoundedBody(req, reservation.reservedBytes)
-  } catch (error) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-    if (error instanceof UploadBodyTooLargeError) {
-      return NextResponse.json({ error: error.message }, { status: 413 })
-    }
-    return NextResponse.json({ error: 'Failed to read attachment.' }, { status: 400 })
-  }
-  if (buffer.length > reservation.reservedBytes) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-    return NextResponse.json({ error: 'Attachment exceeds the reserved upload size.' }, { status: 413 })
-  }
-  const fileName = path.posix.basename(reservation.storagePath)
-  if (hasDangerousExecutableExtension(fileName)) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-    return NextResponse.json({ error: 'Executable file types are not allowed as attachments.' }, { status: 400 })
-  }
-  const contentType = detectAttachmentMimeType(buffer, fileName, req.headers.get('content-type'))
-  if (isActiveContentAttachment(buffer, fileName, contentType)) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-    return NextResponse.json({ error: 'Active content uploads are not allowed.' }, { status: 400 })
-  }
-
-  const credentialsService = resolve('integrationCredentialsService') as {
-    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>
-  }
-  const credentials = await credentialsService.resolve('storage_s3', {
-    tenantId: reservation.tenantId,
-    organizationId: reservation.organizationId,
-  })
-  if (!credentials) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
-  }
-
-  const driver = new S3StorageDriver({
-    ...credentials,
-    organizationId: reservation.organizationId,
-    tenantId: reservation.tenantId,
-  })
-  let objectStored = false
-  try {
-    await driver.putObject(reservation.storagePath, buffer, contentType)
-    objectStored = true
-    await quotaService.markStored(reservation.id, reservation.leaseToken)
-    await quotaService.completeStandalone(reservation.id, reservation.leaseToken, buffer.length)
-    return new NextResponse(null, { status: 200 })
-  } catch (error) {
-    if (objectStored) {
-      try {
-        await driver.deleteStrict('', reservation.storagePath)
-        await quotaService.release(reservation.id, reservation.leaseToken)
-      } catch {
-        // Retain the reservation when object absence cannot be proven.
-      }
-    }
-    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })
-  }
-}
-
-export default PUT
-
-export const openApi: OpenApiRouteDoc = {
-  tag: 'Storage',
-  summary: 'Upload through a bounded one-time compatibility URL',
-  methods: {
-    PUT: {
-      summary: 'Upload an object using a bounded one-time token',
-      responses: [{ status: 200, description: 'Upload completed', schema: z.any() }],
-      errors: [
-        { status: 400, description: 'Invalid upload', schema: z.object({ error: z.string() }) },
-        { status: 410, description: 'Token invalid or expired', schema: z.object({ error: z.string() }) },
-        { status: 413, description: 'Upload exceeds reserved size', schema: z.object({ error: z.string() }) },
-      ],
-    },
-  },
-}

package/src/modules/storage_s3/i18n/de.json

@@ -1,17 +0,0 @@
-{
-  "storage_s3.errors.activeContentBlocked": "Das Hochladen aktiver Inhalte ist nicht erlaubt.",
-  "storage_s3.errors.dangerousExecutable": "Ausführbare Dateitypen sind als Anhänge nicht erlaubt.",
-  "storage_s3.errors.fileNotFound": "Datei nicht gefunden",
-  "storage_s3.errors.fileRequired": "Das Feld „file“ ist erforderlich",
-  "storage_s3.errors.integrationNotConfigured": "Die S3-Integration ist nicht konfiguriert.",
-  "storage_s3.errors.invalidPayload": "Ungültige Anfragedaten",
-  "storage_s3.errors.invalidQuery": "Ungültige Abfrageparameter",
-  "storage_s3.errors.keyAccessDenied": "Zugriff verweigert: Der Schlüssel ist nicht auf diesen Tenant beschränkt.",
-  "storage_s3.errors.keyOverrideAccessDenied": "Zugriff verweigert: Die Schlüsselüberschreibung ist nicht auf diesen Tenant beschränkt.",
-  "storage_s3.errors.keyRequired": "Der Abfrageparameter „key“ ist erforderlich",
-  "storage_s3.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
-  "storage_s3.errors.multipartRequired": "multipart/form-data wurde erwartet",
-  "storage_s3.errors.prefixAccessDenied": "Zugriff verweigert: Das Präfix ist nicht auf diesen Tenant beschränkt.",
-  "storage_s3.errors.quotaExceeded": "Das Speicherlimit für Anhänge dieses Tenants wurde überschritten.",
-  "storage_s3.errors.unauthorized": "Nicht autorisiert"
-}

package/src/modules/storage_s3/i18n/en.json

@@ -1,17 +0,0 @@
-{
-  "storage_s3.errors.activeContentBlocked": "Active content uploads are not allowed.",
-  "storage_s3.errors.dangerousExecutable": "Executable file types are not allowed as attachments.",
-  "storage_s3.errors.fileNotFound": "File not found",
-  "storage_s3.errors.fileRequired": "file field is required",
-  "storage_s3.errors.integrationNotConfigured": "S3 integration is not configured.",
-  "storage_s3.errors.invalidPayload": "Invalid payload",
-  "storage_s3.errors.invalidQuery": "Invalid query parameters",
-  "storage_s3.errors.keyAccessDenied": "Access denied: key is not scoped to this tenant.",
-  "storage_s3.errors.keyOverrideAccessDenied": "Access denied: key override is not scoped to this tenant.",
-  "storage_s3.errors.keyRequired": "key query param is required",
-  "storage_s3.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
-  "storage_s3.errors.multipartRequired": "Expected multipart/form-data",
-  "storage_s3.errors.prefixAccessDenied": "Access denied: prefix is not scoped to this tenant.",
-  "storage_s3.errors.quotaExceeded": "Attachment storage quota exceeded for this tenant.",
-  "storage_s3.errors.unauthorized": "Unauthorized"
-}

package/src/modules/storage_s3/i18n/es.json

@@ -1,17 +0,0 @@
-{
-  "storage_s3.errors.activeContentBlocked": "No se permite la carga de contenido activo.",
-  "storage_s3.errors.dangerousExecutable": "No se permiten archivos ejecutables como adjuntos.",
-  "storage_s3.errors.fileNotFound": "Archivo no encontrado",
-  "storage_s3.errors.fileRequired": "El campo file es obligatorio",
-  "storage_s3.errors.integrationNotConfigured": "La integración de S3 no está configurada.",
-  "storage_s3.errors.invalidPayload": "Contenido de solicitud no válido",
-  "storage_s3.errors.invalidQuery": "Parámetros de consulta no válidos",
-  "storage_s3.errors.keyAccessDenied": "Acceso denegado: la clave no está limitada a este tenant.",
-  "storage_s3.errors.keyOverrideAccessDenied": "Acceso denegado: la sobrescritura de la clave no está limitada a este tenant.",
-  "storage_s3.errors.keyRequired": "Se requiere el parámetro de consulta key",
-  "storage_s3.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
-  "storage_s3.errors.multipartRequired": "Se esperaba multipart/form-data",
-  "storage_s3.errors.prefixAccessDenied": "Acceso denegado: el prefijo no está limitado a este tenant.",
-  "storage_s3.errors.quotaExceeded": "Se superó la cuota de almacenamiento de adjuntos para este tenant.",
-  "storage_s3.errors.unauthorized": "No autorizado"
-}

package/src/modules/storage_s3/i18n/ko.json

@@ -1,17 +0,0 @@
-{
-  "storage_s3.errors.activeContentBlocked": "활성 콘텐츠 업로드는 허용되지 않습니다.",
-  "storage_s3.errors.dangerousExecutable": "실행 파일 형식은 첨부가 허용되지 않습니다.",
-  "storage_s3.errors.fileNotFound": "파일을 찾을 수 없습니다",
-  "storage_s3.errors.fileRequired": "파일 필드는 필수입니다",
-  "storage_s3.errors.integrationNotConfigured": "S3 통합이 구성되지 않았습니다.",
-  "storage_s3.errors.invalidPayload": "잘못된 페이로드",
-  "storage_s3.errors.invalidQuery": "잘못된 쿼리 매개변수",
-  "storage_s3.errors.keyAccessDenied": "액세스 거부됨: 키 범위가 이 테넌트로 지정되지 않았습니다.",
-  "storage_s3.errors.keyOverrideAccessDenied": "액세스 거부됨: 키 재정의 범위가 이 테넌트로 지정되지 않았습니다.",
-  "storage_s3.errors.keyRequired": "주요 쿼리 매개변수가 필요합니다.",
-  "storage_s3.errors.maxUploadSize": "첨부파일이 최대 업로드 크기를 초과합니다.",
-  "storage_s3.errors.multipartRequired": "예상되는 멀티파트/양식 데이터",
-  "storage_s3.errors.prefixAccessDenied": "액세스 거부됨: 접두사의 범위가 이 테넌트로 지정되지 않았습니다.",
-  "storage_s3.errors.quotaExceeded": "이 테넌트에 대한 첨부 파일 저장소 할당량이 초과되었습니다.",
-  "storage_s3.errors.unauthorized": "승인되지 않은"
-}

package/src/modules/storage_s3/i18n/pl.json

@@ -1,17 +0,0 @@
-{
-  "storage_s3.errors.activeContentBlocked": "Przesyłanie treści aktywnych nie jest dozwolone.",
-  "storage_s3.errors.dangerousExecutable": "Pliki wykonywalne nie są dozwolone jako załączniki.",
-  "storage_s3.errors.fileNotFound": "Nie znaleziono pliku",
-  "storage_s3.errors.fileRequired": "Pole file jest wymagane",
-  "storage_s3.errors.integrationNotConfigured": "Integracja S3 nie jest skonfigurowana.",
-  "storage_s3.errors.invalidPayload": "Nieprawidłowe dane żądania",
-  "storage_s3.errors.invalidQuery": "Nieprawidłowe parametry zapytania",
-  "storage_s3.errors.keyAccessDenied": "Odmowa dostępu: klucz nie jest ograniczony do tego tenantu.",
-  "storage_s3.errors.keyOverrideAccessDenied": "Odmowa dostępu: nadpisany klucz nie jest ograniczony do tego tenantu.",
-  "storage_s3.errors.keyRequired": "Wymagany jest parametr zapytania key",
-  "storage_s3.errors.maxUploadSize": "Załącznik przekracza maksymalny dopuszczalny rozmiar przesyłania.",
-  "storage_s3.errors.multipartRequired": "Oczekiwano multipart/form-data",
-  "storage_s3.errors.prefixAccessDenied": "Odmowa dostępu: prefiks nie jest ograniczony do tego tenantu.",
-  "storage_s3.errors.quotaExceeded": "Przekroczono limit miejsca na załączniki dla tego tenantu.",
-  "storage_s3.errors.unauthorized": "Brak autoryzacji"
-}

package/src/modules/storage_s3/lib/endpoint-safety.ts

@@ -1,179 +0,0 @@
-import { lookup as dnsLookup } from 'node:dns/promises'
-import { Agent as HttpAgent } from 'node:http'
-import { Agent as HttpsAgent } from 'node:https'
-import { isIP, type LookupFunction } from 'node:net'
-import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
-import {
-  assertSafeOutboundUrl,
-  assertStaticallySafeOutboundUrl,
-  parseOutboundUrl,
-  resolveSafeOutboundUrl,
-  type HostLookup,
-  type ResolvedHostAddress,
-  type UrlSafetyReason,
-} from '@open-mercato/shared/lib/url-safety'
-
-const SUBJECT = 'S3 endpoint'
-
-export class UnsafeS3EndpointError extends Error {
-  public readonly reason: string
-
-  constructor(reason: string, message?: string) {
-    super(message ?? `S3 endpoint rejected: ${reason}`)
-    this.name = 'UnsafeS3EndpointError'
-    this.reason = reason
-  }
-}
-
-const s3EndpointErrorFactory = (reason: UrlSafetyReason, message: string) =>
-  new UnsafeS3EndpointError(reason, message)
-
-export type AssertStaticS3EndpointDeps = {
-  allowInternal?: boolean
-}
-
-export function assertStaticallySafeS3Endpoint(
-  rawEndpoint: string | null | undefined,
-  deps: AssertStaticS3EndpointDeps = {},
-): void {
-  if (!rawEndpoint) return
-  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled()
-  assertStaticallySafeOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT,
-    allowPrivate,
-  })
-}
-
-export type AssertSafeS3EndpointDeps = {
-  lookupHost?: HostLookup
-  allowInternal?: boolean
-}
-
-export async function assertSafeS3Endpoint(
-  rawEndpoint: string | null | undefined,
-  deps: AssertSafeS3EndpointDeps = {},
-): Promise<void> {
-  if (!rawEndpoint) return
-  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled()
-  await assertSafeOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT,
-    allowPrivate,
-    lookupHost: deps.lookupHost,
-  })
-}
-
-export type SafeS3EndpointLookupDeps = {
-  lookupHost?: HostLookup
-  allowInternal?: boolean
-}
-
-export function createSafeS3EndpointLookup(
-  rawEndpoint: string | null | undefined,
-  deps: SafeS3EndpointLookupDeps = {},
-): LookupFunction | undefined {
-  if (!rawEndpoint) return undefined
-  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled()
-  if (allowPrivate) return undefined
-
-  const { hostname } = parseOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT,
-  })
-  const endpointHostname = normalizeLookupHostname(hostname)
-
-  return (host, options, callback) => {
-    const lookupHostname = normalizeLookupHostname(host)
-    if (!isAllowedS3LookupHost(lookupHostname, endpointHostname)) {
-      callback(new UnsafeS3EndpointError(
-        'blocked_hostname',
-        `S3 endpoint lookup host "${host}" does not match configured host "${endpointHostname}"`,
-      ), '', 0)
-      return
-    }
-
-    resolveSafeOutboundUrl(buildLookupValidationUrl(rawEndpoint, lookupHostname), {
-      errorFactory: s3EndpointErrorFactory,
-      subject: SUBJECT,
-      lookupHost: deps.lookupHost ?? defaultLookupHost,
-    }).then(({ addresses }) => {
-      if (!addresses || addresses.length === 0) {
-        const family = isIP(lookupHostname)
-        if (options.all) callback(null, [{ address: lookupHostname, family }] as ResolvedHostAddress[])
-        else callback(null, lookupHostname, family)
-        return
-      }
-      if (options.all) {
-        callback(null, addresses.map((record) => ({ address: record.address, family: record.family })))
-        return
-      }
-      callback(null, addresses[0].address, addresses[0].family)
-    }).catch((error: unknown) => {
-      callback(error instanceof Error ? error : new UnsafeS3EndpointError('dns_resolution_failed'), '', 0)
-    })
-  }
-}
-
-function normalizeLookupHostname(hostname: string): string {
-  let normalized = hostname.trim().toLowerCase()
-  if (normalized.startsWith('[') && normalized.endsWith(']')) {
-    normalized = normalized.slice(1, -1)
-  }
-  while (normalized.endsWith('.')) {
-    normalized = normalized.slice(0, -1)
-  }
-  return normalized
-}
-
-function isAllowedS3LookupHost(lookupHostname: string, endpointHostname: string): boolean {
-  if (lookupHostname === endpointHostname) return true
-  if (isIP(endpointHostname)) return false
-  return lookupHostname.endsWith(`.${endpointHostname}`)
-}
-
-function buildLookupValidationUrl(rawEndpoint: string, lookupHostname: string): string {
-  const { url } = parseOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT,
-  })
-  const host = isIP(lookupHostname) === 6 ? `[${lookupHostname}]` : lookupHostname
-  const port = url.port ? `:${url.port}` : ''
-  return `${url.protocol}//${host}${port}`
-}
-
-export type SafeS3RequestHandlerOptions = {
-  connectionTimeout: number
-  requestTimeout: number
-  httpAgent?: HttpAgent
-  httpsAgent?: HttpsAgent
-}
-
-const S3_CONNECTION_TIMEOUT_MS = 10_000
-const S3_REQUEST_TIMEOUT_MS = 120_000
-
-export function createSafeS3RequestHandler(
-  rawEndpoint: string | null | undefined,
-  deps: SafeS3EndpointLookupDeps = {},
-): SafeS3RequestHandlerOptions | undefined {
-  const lookup = createSafeS3EndpointLookup(rawEndpoint, deps)
-  const timeouts = {
-    connectionTimeout: S3_CONNECTION_TIMEOUT_MS,
-    requestTimeout: S3_REQUEST_TIMEOUT_MS,
-  }
-  if (!lookup) return timeouts
-  return {
-    ...timeouts,
-    httpAgent: new HttpAgent({ lookup }),
-    httpsAgent: new HttpsAgent({ lookup }),
-  }
-}
-
-export function isAllowInternalS3EndpointsEnabled(): boolean {
-  return parseBooleanWithDefault(process.env.OM_STORAGE_S3_ALLOW_INTERNAL_ENDPOINTS, false)
-}
-
-const defaultLookupHost: HostLookup = async (hostname) => {
-  const records = await dnsLookup(hostname, { all: true, verbatim: true })
-  return records
-}

package/src/modules/storage_s3/lib/quota-accounting.ts

@@ -1,29 +0,0 @@
-import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
-import { isS3KeyScopedToTenant } from './key-scope'
-import type { S3StorageDriver } from './s3-driver'
-
-export async function reconcileTenantS3Objects(input: {
-  driver: S3StorageDriver
-  quotaService: AttachmentQuotaService
-  tenantId: string
-  organizationId: string
-}): Promise<void> {
-  const objects: Array<{ path: string; bytes: number }> = []
-  let continuationToken: string | undefined
-  do {
-    const page = await input.driver.listObjects('', 1000, continuationToken)
-    for (const file of page.files) {
-      if (isS3KeyScopedToTenant(file.key, input.organizationId, input.tenantId)) {
-        objects.push({ path: file.key, bytes: file.size })
-      }
-    }
-    continuationToken = page.truncated ? page.nextContinuationToken : undefined
-  } while (continuationToken)
-
-  await input.quotaService.reconcileStandaloneObjects({
-    tenantId: input.tenantId,
-    organizationId: input.organizationId,
-    storageDriver: 's3',
-    objects,
-  })
-}

package/src/modules/storage_s3/lib/quota-recovery-queue.ts

@@ -1,17 +0,0 @@
-import { createModuleQueue } from '@open-mercato/queue'
-
-export type StorageS3QuotaRecoveryJob = {
-  reservationId: string
-  tenantId: string
-  organizationId: string
-  absenceCheck?: number
-}
-
-const queue = createModuleQueue<StorageS3QuotaRecoveryJob>('storage-s3-quota-recovery', { concurrency: 2 })
-
-export async function scheduleStorageS3QuotaRecovery(
-  payload: StorageS3QuotaRecoveryJob,
-  delayMs: number,
-): Promise<void> {
-  await queue.enqueue(payload, { delayMs: Math.max(1_000, delayMs) })
-}