@open-mercato/storage-s3 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/modules/storage_s3/api/post/storage-providers/s3/upload.ts

@@ -3,18 +3,23 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import {
   detectAttachmentMimeType,
   hasDangerousExecutableExtension,
   isActiveContentAttachment,
 } from '@open-mercato/core/modules/attachments/lib/security'
 import {
+  isMultipartUploadLimitError,
   isMultipartRequestWithinUploadLimit,
+  parseMultipartFormDataWithinUploadLimit,
   resolveAttachmentMaxBytes,
   willExceedAttachmentTenantQuota,
 } from '@open-mercato/core/modules/attachments/lib/upload-limits'
 import { isS3KeyScopedToTenant } from '../../../../lib/key-scope'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
+import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
+import { reconcileTenantS3Objects } from '../../../../lib/quota-accounting'
 import { randomUUID } from 'crypto'
 
 export const metadata = {
@@ -68,66 +73,146 @@ async function readTenantStorageUsageBytes(
 }
 
 export async function POST(req: Request) {
+  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
 
   if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {
-    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })
+    return NextResponse.json({ error: t('storage_s3.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.') }, { status: 413 })
   }
 
   const contentType = req.headers.get('content-type') ?? ''
   if (!contentType.includes('multipart/form-data')) {
-    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.multipartRequired', 'Expected multipart/form-data') }, { status: 400 })
   }
 
-  const form = await req.formData()
+  let form: FormData
+  try {
+    form = await parseMultipartFormDataWithinUploadLimit(req)
+  } catch (error) {
+    if (isMultipartUploadLimitError(error)) {
+      return NextResponse.json({ error: t('storage_s3.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.') }, { status: 413 })
+    }
+    throw error
+  }
   const file = form.get('file') as File | null
   if (!file) {
-    return NextResponse.json({ error: 'file field is required' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.fileRequired', 'file field is required') }, { status: 400 })
   }
 
   const keyOverride = form.get('key') ? String(form.get('key')) : null
 
   if (keyOverride !== null && !isS3KeyScopedToTenant(keyOverride, auth.orgId, auth.tenantId)) {
     return NextResponse.json(
-      { error: 'Access denied: key override is not scoped to this tenant.' },
+      { error: t('storage_s3.errors.keyOverrideAccessDenied', 'Access denied: key override is not scoped to this tenant.') },
       { status: 403 },
     )
   }
 
   if (hasDangerousExecutableExtension(file.name)) {
-    return NextResponse.json({ error: 'Executable file types are not allowed as attachments.' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.') }, { status: 400 })
   }
 
   const effectiveMaxBytes = resolveAttachmentMaxBytes()
   if (file.size > effectiveMaxBytes) {
-    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })
+    return NextResponse.json({ error: t('storage_s3.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.') }, { status: 413 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
   }
 
   const buffer = Buffer.from(await file.arrayBuffer())
   const safeName = sanitizeFileName(file.name)
   const trustedMimeType = detectAttachmentMimeType(buffer, safeName, file.type || null)
   if (isActiveContentAttachment(buffer, safeName, trustedMimeType)) {
-    return NextResponse.json({ error: 'Active content uploads are not allowed.' }, { status: 400 })
-  }
-
-  const tenantUsageBytes = await readTenantStorageUsageBytes(driver, auth.tenantId, auth.orgId)
-  if (willExceedAttachmentTenantQuota(tenantUsageBytes, buffer.length)) {
-    return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })
+    return NextResponse.json({ error: t('storage_s3.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })
   }
 
   const key =
     keyOverride ??
     `uploads/org_${auth.orgId}/tenant_${auth.tenantId}/${Date.now()}_${randomUUID().slice(0, 8)}_${safeName}`
 
-  await driver.putObject(key, buffer, trustedMimeType)
+  const { resolve } = await createRequestContainer()
+  let attachmentQuotaService: AttachmentQuotaService | null = null
+  let recoveryScheduler: ((
+    payload: { reservationId: string; tenantId: string; organizationId: string },
+    delayMs: number,
+  ) => Promise<void>) | null = null
+  try {
+    attachmentQuotaService = resolve('attachmentQuotaService') as AttachmentQuotaService
+    recoveryScheduler = resolve('storageS3QuotaRecoveryScheduler') as (
+      payload: { reservationId: string; tenantId: string; organizationId: string },
+      delayMs: number,
+    ) => Promise<void>
+  } catch {
+    // Backward-compatible fallback below when the attachments quota service is not registered.
+  }
+  let reservation: { id: string; leaseToken: string; expiresAt: Date } | null = null
+  if (attachmentQuotaService) {
+    try {
+      await reconcileTenantS3Objects({
+        driver,
+        quotaService: attachmentQuotaService,
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+      })
+      reservation = await attachmentQuotaService.reserve({
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+        bytes: buffer.length,
+        source: 'storage_s3_upload',
+        storageDriver: 's3',
+        storagePath: key,
+      })
+      if (!recoveryScheduler) throw new Error('Storage quota recovery is unavailable.')
+      await recoveryScheduler({
+        reservationId: reservation.id,
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))
+      await attachmentQuotaService.beginStorage(reservation.id, reservation.leaseToken)
+    } catch (error) {
+      if (reservation) {
+        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+        reservation = null
+      }
+      const code = (error as { code?: unknown })?.code
+      if (code === 'quota_exceeded') {
+        return NextResponse.json({ error: t('storage_s3.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.') }, { status: 413 })
+      }
+      if (code === 'quota_target_exists') {
+        return NextResponse.json({ error: t('storage_s3.errors.quotaTargetExists', 'The target storage key already exists.') }, { status: 409 })
+      }
+      return NextResponse.json({ error: t('storage_s3.errors.quotaUnavailable', 'Storage quota accounting is unavailable.') }, { status: 500 })
+    }
+  } else {
+    const tenantUsageBytes = await readTenantStorageUsageBytes(driver, auth.tenantId, auth.orgId)
+    if (willExceedAttachmentTenantQuota(tenantUsageBytes, buffer.length)) {
+      return NextResponse.json({ error: t('storage_s3.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.') }, { status: 413 })
+    }
+  }
+
+  try {
+    await driver.putObject(key, buffer, trustedMimeType)
+    if (reservation) {
+      await attachmentQuotaService!.markStored(reservation.id, reservation.leaseToken)
+      await attachmentQuotaService!.completeStandalone(reservation.id, reservation.leaseToken, buffer.length)
+    }
+  } catch (error) {
+    if (reservation) {
+      try {
+        await driver.deleteStrict('', key)
+        await attachmentQuotaService!.release(reservation.id, reservation.leaseToken)
+      } catch {
+        // Retain the reservation when object absence cannot be proven.
+      }
+    }
+    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })
+  }
 
   return NextResponse.json({
     key,

package/src/modules/storage_s3/api/put/storage-providers/s3/signed-upload/[token].ts

@@ -0,0 +1,150 @@
+import { createHash } from 'node:crypto'
+import path from 'node:path'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import {
+  detectAttachmentMimeType,
+  hasDangerousExecutableExtension,
+  isActiveContentAttachment,
+} from '@open-mercato/core/modules/attachments/lib/security'
+import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
+import { S3StorageDriver } from '../../../../../lib/s3-driver'
+
+export const metadata = {
+  path: '/storage-providers/s3/signed-upload/:token',
+  PUT: { requireAuth: false },
+}
+
+type RouteContext = { params?: Promise<{ token?: string }> | { token?: string } }
+
+class UploadBodyTooLargeError extends Error {}
+
+async function readBoundedBody(req: Request, maxBytes: number): Promise<Buffer> {
+  if (!req.body) return Buffer.alloc(0)
+  const reader = req.body.getReader()
+  const chunks: Buffer[] = []
+  let totalBytes = 0
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      totalBytes += value.byteLength
+      if (totalBytes > maxBytes) {
+        await reader.cancel()
+        throw new UploadBodyTooLargeError('Attachment exceeds the reserved upload size.')
+      }
+      chunks.push(Buffer.from(value))
+    }
+  } finally {
+    reader.releaseLock()
+  }
+  return Buffer.concat(chunks, totalBytes)
+}
+
+export async function PUT(req: Request, ctx: RouteContext) {
+  const params = ctx.params instanceof Promise ? await ctx.params : ctx.params
+  const token = params?.token?.trim()
+  if (!token) return NextResponse.json({ error: 'Upload token is required.' }, { status: 400 })
+
+  const { resolve } = await createRequestContainer()
+  let quotaService: AttachmentQuotaService | null = null
+  try {
+    quotaService = resolve('attachmentQuotaService') as AttachmentQuotaService
+  } catch {
+    // Fail closed below when the attachments quota service is not registered.
+  }
+  if (!quotaService) return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })
+
+  const tokenHash = createHash('sha256').update(token).digest('hex')
+  const reservation = await quotaService.claimPendingByUploadTokenHash(tokenHash)
+  if (!reservation || reservation.source !== 'storage_s3_signed') {
+    return NextResponse.json({ error: 'Upload token is invalid or expired.' }, { status: 410 })
+  }
+
+  const declaredLengthHeader = req.headers.get('content-length')
+  const declaredLength = declaredLengthHeader == null ? null : Number(declaredLengthHeader)
+  if (declaredLength !== null && Number.isFinite(declaredLength) && declaredLength > reservation.reservedBytes) {
+    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+    return NextResponse.json({ error: 'Attachment exceeds the reserved upload size.' }, { status: 413 })
+  }
+  let buffer: Buffer
+  try {
+    buffer = await readBoundedBody(req, reservation.reservedBytes)
+  } catch (error) {
+    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+    if (error instanceof UploadBodyTooLargeError) {
+      return NextResponse.json({ error: error.message }, { status: 413 })
+    }
+    return NextResponse.json({ error: 'Failed to read attachment.' }, { status: 400 })
+  }
+  if (buffer.length > reservation.reservedBytes) {
+    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+    return NextResponse.json({ error: 'Attachment exceeds the reserved upload size.' }, { status: 413 })
+  }
+  const fileName = path.posix.basename(reservation.storagePath)
+  if (hasDangerousExecutableExtension(fileName)) {
+    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+    return NextResponse.json({ error: 'Executable file types are not allowed as attachments.' }, { status: 400 })
+  }
+  const contentType = detectAttachmentMimeType(buffer, fileName, req.headers.get('content-type'))
+  if (isActiveContentAttachment(buffer, fileName, contentType)) {
+    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+    return NextResponse.json({ error: 'Active content uploads are not allowed.' }, { status: 400 })
+  }
+
+  const credentialsService = resolve('integrationCredentialsService') as {
+    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>
+  }
+  const credentials = await credentialsService.resolve('storage_s3', {
+    tenantId: reservation.tenantId,
+    organizationId: reservation.organizationId,
+  })
+  if (!credentials) {
+    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
+  }
+
+  const driver = new S3StorageDriver({
+    ...credentials,
+    organizationId: reservation.organizationId,
+    tenantId: reservation.tenantId,
+  })
+  let objectStored = false
+  try {
+    await driver.putObject(reservation.storagePath, buffer, contentType)
+    objectStored = true
+    await quotaService.markStored(reservation.id, reservation.leaseToken)
+    await quotaService.completeStandalone(reservation.id, reservation.leaseToken, buffer.length)
+    return new NextResponse(null, { status: 200 })
+  } catch (error) {
+    if (objectStored) {
+      try {
+        await driver.deleteStrict('', reservation.storagePath)
+        await quotaService.release(reservation.id, reservation.leaseToken)
+      } catch {
+        // Retain the reservation when object absence cannot be proven.
+      }
+    }
+    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })
+  }
+}
+
+export default PUT
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Storage',
+  summary: 'Upload through a bounded one-time compatibility URL',
+  methods: {
+    PUT: {
+      summary: 'Upload an object using a bounded one-time token',
+      responses: [{ status: 200, description: 'Upload completed', schema: z.any() }],
+      errors: [
+        { status: 400, description: 'Invalid upload', schema: z.object({ error: z.string() }) },
+        { status: 410, description: 'Token invalid or expired', schema: z.object({ error: z.string() }) },
+        { status: 413, description: 'Upload exceeds reserved size', schema: z.object({ error: z.string() }) },
+      ],
+    },
+  },
+}

package/src/modules/storage_s3/di.ts

@@ -6,8 +6,10 @@ import {
 } from '@open-mercato/core/modules/attachments/lib/drivers'
 import { S3StorageDriver } from './lib/s3-driver'
 import { createStorageService } from './lib/storage-service'
+import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
 import { s3HealthCheck } from './lib/health'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { scheduleStorageS3QuotaRecovery } from './lib/quota-recovery-queue'
 
 const logger = createLogger('storage_s3')
 
@@ -67,14 +69,22 @@ export function register(container: AppContainer) {
 
   container.register({
     s3HealthCheck: asValue(s3HealthCheck),
+    storageS3QuotaRecoveryScheduler: asValue(scheduleStorageS3QuotaRecovery),
     storageService: asFunction(
-      ({ integrationCredentialsService }: { integrationCredentialsService: IntegrationCredentialsService }) => {
+      ({ integrationCredentialsService, attachmentQuotaService, storageS3QuotaRecoveryScheduler }: {
+        integrationCredentialsService: IntegrationCredentialsService
+        attachmentQuotaService: AttachmentQuotaService
+        storageS3QuotaRecoveryScheduler: (
+          payload: { reservationId: string; tenantId: string; organizationId: string },
+          delayMs: number,
+        ) => Promise<void>
+      }) => {
         // StorageService factory — builds the service lazily using credentials
         // resolved from the Integration Marketplace per request.
         return {
           async _resolveService(scope: { tenantId: string; organizationId: string }) {
             const creds = await integrationCredentialsService.resolve('storage_s3', scope)
-            if (!creds) throw new Error('S3 storage integration is not configured for this tenant.')
+            if (!creds) throw new Error('[internal] S3 storage integration is not configured for this tenant.')
             return createStorageService({
               authMode: creds.authMode === 'ambient' || creds.authMode === 'access_keys'
                 ? (creds.authMode as 'ambient' | 'access_keys')
@@ -86,6 +96,8 @@ export function register(container: AppContainer) {
               accessKeyId: creds.accessKeyId ? String(creds.accessKeyId) : undefined,
               secretAccessKey: creds.secretAccessKey ? String(creds.secretAccessKey) : undefined,
               sessionToken: creds.sessionToken ? String(creds.sessionToken) : undefined,
+              quotaService: attachmentQuotaService,
+              quotaRecoveryScheduler: storageS3QuotaRecoveryScheduler,
               organizationId: scope.organizationId,
               tenantId: scope.tenantId,
               // Credentials are resolved from the Integration Marketplace (encrypted at rest)

package/src/modules/storage_s3/i18n/de.json

@@ -0,0 +1,19 @@
+{
+  "storage_s3.errors.activeContentBlocked": "Das Hochladen aktiver Inhalte ist nicht erlaubt.",
+  "storage_s3.errors.dangerousExecutable": "Ausführbare Dateitypen sind als Anhänge nicht erlaubt.",
+  "storage_s3.errors.fileNotFound": "Datei nicht gefunden",
+  "storage_s3.errors.fileRequired": "Das Feld „file“ ist erforderlich",
+  "storage_s3.errors.integrationNotConfigured": "Die S3-Integration ist nicht konfiguriert.",
+  "storage_s3.errors.invalidPayload": "Ungültige Anfragedaten",
+  "storage_s3.errors.invalidQuery": "Ungültige Abfrageparameter",
+  "storage_s3.errors.keyAccessDenied": "Zugriff verweigert: Der Schlüssel ist nicht auf diesen Tenant beschränkt.",
+  "storage_s3.errors.keyOverrideAccessDenied": "Zugriff verweigert: Die Schlüsselüberschreibung ist nicht auf diesen Tenant beschränkt.",
+  "storage_s3.errors.keyRequired": "Der Abfrageparameter „key“ ist erforderlich",
+  "storage_s3.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
+  "storage_s3.errors.multipartRequired": "multipart/form-data wurde erwartet",
+  "storage_s3.errors.prefixAccessDenied": "Zugriff verweigert: Das Präfix ist nicht auf diesen Tenant beschränkt.",
+  "storage_s3.errors.quotaExceeded": "Das Speicherkontingent für Anhänge dieses Mandanten ist erschöpft.",
+  "storage_s3.errors.quotaTargetExists": "Der Ziel-Speicherschlüssel existiert bereits.",
+  "storage_s3.errors.quotaUnavailable": "Die Kontingentabrechnung des Speichers ist nicht verfügbar.",
+  "storage_s3.errors.unauthorized": "Nicht autorisiert"
+}

package/src/modules/storage_s3/i18n/en.json

@@ -0,0 +1,19 @@
+{
+  "storage_s3.errors.activeContentBlocked": "Active content uploads are not allowed.",
+  "storage_s3.errors.dangerousExecutable": "Executable file types are not allowed as attachments.",
+  "storage_s3.errors.fileNotFound": "File not found",
+  "storage_s3.errors.fileRequired": "file field is required",
+  "storage_s3.errors.integrationNotConfigured": "S3 integration is not configured.",
+  "storage_s3.errors.invalidPayload": "Invalid payload",
+  "storage_s3.errors.invalidQuery": "Invalid query parameters",
+  "storage_s3.errors.keyAccessDenied": "Access denied: key is not scoped to this tenant.",
+  "storage_s3.errors.keyOverrideAccessDenied": "Access denied: key override is not scoped to this tenant.",
+  "storage_s3.errors.keyRequired": "key query param is required",
+  "storage_s3.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
+  "storage_s3.errors.multipartRequired": "Expected multipart/form-data",
+  "storage_s3.errors.prefixAccessDenied": "Access denied: prefix is not scoped to this tenant.",
+  "storage_s3.errors.quotaExceeded": "Attachment storage quota exceeded for this tenant.",
+  "storage_s3.errors.quotaTargetExists": "The target storage key already exists.",
+  "storage_s3.errors.quotaUnavailable": "Storage quota accounting is unavailable.",
+  "storage_s3.errors.unauthorized": "Unauthorized"
+}

package/src/modules/storage_s3/i18n/es.json

@@ -0,0 +1,19 @@
+{
+  "storage_s3.errors.activeContentBlocked": "No se permite la carga de contenido activo.",
+  "storage_s3.errors.dangerousExecutable": "No se permiten archivos ejecutables como adjuntos.",
+  "storage_s3.errors.fileNotFound": "Archivo no encontrado",
+  "storage_s3.errors.fileRequired": "El campo file es obligatorio",
+  "storage_s3.errors.integrationNotConfigured": "La integración de S3 no está configurada.",
+  "storage_s3.errors.invalidPayload": "Contenido de solicitud no válido",
+  "storage_s3.errors.invalidQuery": "Parámetros de consulta no válidos",
+  "storage_s3.errors.keyAccessDenied": "Acceso denegado: la clave no está limitada a este tenant.",
+  "storage_s3.errors.keyOverrideAccessDenied": "Acceso denegado: la sobrescritura de la clave no está limitada a este tenant.",
+  "storage_s3.errors.keyRequired": "Se requiere el parámetro de consulta key",
+  "storage_s3.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
+  "storage_s3.errors.multipartRequired": "Se esperaba multipart/form-data",
+  "storage_s3.errors.prefixAccessDenied": "Acceso denegado: el prefijo no está limitado a este tenant.",
+  "storage_s3.errors.quotaExceeded": "Se superó la cuota de almacenamiento de adjuntos para este inquilino.",
+  "storage_s3.errors.quotaTargetExists": "La clave de almacenamiento de destino ya existe.",
+  "storage_s3.errors.quotaUnavailable": "La contabilidad de la cuota de almacenamiento no está disponible.",
+  "storage_s3.errors.unauthorized": "No autorizado"
+}

package/src/modules/storage_s3/i18n/ko.json

@@ -0,0 +1,19 @@
+{
+  "storage_s3.errors.activeContentBlocked": "활성 콘텐츠 업로드는 허용되지 않습니다.",
+  "storage_s3.errors.dangerousExecutable": "실행 파일 형식은 첨부가 허용되지 않습니다.",
+  "storage_s3.errors.fileNotFound": "파일을 찾을 수 없습니다",
+  "storage_s3.errors.fileRequired": "파일 필드는 필수입니다",
+  "storage_s3.errors.integrationNotConfigured": "S3 통합이 구성되지 않았습니다.",
+  "storage_s3.errors.invalidPayload": "잘못된 페이로드",
+  "storage_s3.errors.invalidQuery": "잘못된 쿼리 매개변수",
+  "storage_s3.errors.keyAccessDenied": "액세스 거부됨: 키 범위가 이 테넌트로 지정되지 않았습니다.",
+  "storage_s3.errors.keyOverrideAccessDenied": "액세스 거부됨: 키 재정의 범위가 이 테넌트로 지정되지 않았습니다.",
+  "storage_s3.errors.keyRequired": "주요 쿼리 매개변수가 필요합니다.",
+  "storage_s3.errors.maxUploadSize": "첨부파일이 최대 업로드 크기를 초과합니다.",
+  "storage_s3.errors.multipartRequired": "예상되는 멀티파트/양식 데이터",
+  "storage_s3.errors.prefixAccessDenied": "액세스 거부됨: 접두사의 범위가 이 테넌트로 지정되지 않았습니다.",
+  "storage_s3.errors.quotaExceeded": "이 테넌트의 첨부 파일 저장 용량 한도를 초과했습니다.",
+  "storage_s3.errors.quotaTargetExists": "대상 저장 키가 이미 존재합니다.",
+  "storage_s3.errors.quotaUnavailable": "저장 용량 정산을 사용할 수 없습니다.",
+  "storage_s3.errors.unauthorized": "승인되지 않은"
+}

package/src/modules/storage_s3/i18n/pl.json

@@ -0,0 +1,19 @@
+{
+  "storage_s3.errors.activeContentBlocked": "Przesyłanie treści aktywnych nie jest dozwolone.",
+  "storage_s3.errors.dangerousExecutable": "Pliki wykonywalne nie są dozwolone jako załączniki.",
+  "storage_s3.errors.fileNotFound": "Nie znaleziono pliku",
+  "storage_s3.errors.fileRequired": "Pole file jest wymagane",
+  "storage_s3.errors.integrationNotConfigured": "Integracja S3 nie jest skonfigurowana.",
+  "storage_s3.errors.invalidPayload": "Nieprawidłowe dane żądania",
+  "storage_s3.errors.invalidQuery": "Nieprawidłowe parametry zapytania",
+  "storage_s3.errors.keyAccessDenied": "Odmowa dostępu: klucz nie jest ograniczony do tego tenantu.",
+  "storage_s3.errors.keyOverrideAccessDenied": "Odmowa dostępu: nadpisany klucz nie jest ograniczony do tego tenantu.",
+  "storage_s3.errors.keyRequired": "Wymagany jest parametr zapytania key",
+  "storage_s3.errors.maxUploadSize": "Załącznik przekracza maksymalny dopuszczalny rozmiar przesyłania.",
+  "storage_s3.errors.multipartRequired": "Oczekiwano multipart/form-data",
+  "storage_s3.errors.prefixAccessDenied": "Odmowa dostępu: prefiks nie jest ograniczony do tego tenantu.",
+  "storage_s3.errors.quotaExceeded": "Przekroczono limit przestrzeni na załączniki dla tego najemcy.",
+  "storage_s3.errors.quotaTargetExists": "Docelowy klucz w magazynie już istnieje.",
+  "storage_s3.errors.quotaUnavailable": "Rozliczanie limitu magazynu jest niedostępne.",
+  "storage_s3.errors.unauthorized": "Brak autoryzacji"
+}

package/src/modules/storage_s3/integration.ts

@@ -79,7 +79,7 @@ export const integration: IntegrationDefinition = {
         type: 'url',
         required: false,
         placeholder: 'https://fra1.digitaloceanspaces.com',
-        helpText: 'Custom S3 endpoint URL. Leave empty for AWS S3. Required for MinIO, DigitalOcean Spaces, and other providers.',
+        helpText: 'Custom S3 endpoint URL. Leave empty for AWS S3. Internal/private endpoints require OM_STORAGE_S3_ALLOW_INTERNAL_ENDPOINTS=true.',
       },
       {
         key: 'forcePathStyle',