@podosoft/podokit 1.3.0 → 1.4.1

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/s3-object.store.spec.ts

@@ -1,8 +1,51 @@
-import { afterAll, describe, expect, it } from "bun:test";
-import { randomBytes, randomUUID } from "node:crypto";
+import { afterAll, describe, expect, it, spyOn } from "bun:test";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import {
+  IN_MEMORY_READ_BYTES,
+  MIN_MULTIPART_PART_BYTES,
+  MultipartUploadError,
+  objectResponse,
+} from "@podosoft/podokit-runtime";
 import { ReadinessService } from "../health/readiness.service";
 import { S3ObjectStore } from "./s3-object.store";
-import { StorageService } from "./storage.service";
+import { EMPTY_PAYLOAD_HASH, signS3Request } from "./s3-signer";
+import { storageSettings } from "./storage.config";
+import { STREAM_PART_BYTES, StorageService } from "./storage.service";
+
+async function* chunks(content: Uint8Array, size = 256 * 1024): AsyncGenerator<Uint8Array> {
+  for (let offset = 0; offset < content.byteLength; offset += size) yield content.subarray(offset, offset + size);
+}
+
+function digest(content: Uint8Array): string {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+async function readAll(store: S3ObjectStore, key: string): Promise<Uint8Array> {
+  const object = await store.get(key);
+  if (!object) throw new Error(`expected ${key}`);
+  return new Uint8Array(await new Response(object.body).arrayBuffer());
+}
+
+/**
+ * Lists unfinished multipart uploads of one key (path-style endpoints only).
+ * MinIO-compatible services match the prefix against the whole key.
+ */
+async function pendingUploads(key: string): Promise<string[]> {
+  const settings = storageSettings();
+  const signed = signS3Request({
+    method: "GET",
+    url: new URL(`${settings.endpoint}/${settings.bucket}/`),
+    query: [["uploads", ""], ["prefix", key]],
+    payloadHash: EMPTY_PAYLOAD_HASH,
+  }, {
+    accessKeyId: settings.accessKeyId ?? "",
+    secretAccessKey: settings.secretAccessKey ?? "",
+  }, settings.region);
+  const response = await fetch(signed.url, { headers: signed.headers });
+  const xml = await response.text();
+  if (!response.ok) throw new Error(`ListMultipartUploads failed: ${xml}`);
+  return [...xml.matchAll(/<UploadId>([^<]+)<\/UploadId>/g)].map((match) => match[1] ?? "");
+}
 
 // Runs against the bucket in the S3_* settings, like the storage API spec.
 const integration = process.env.S3_ENDPOINT ? describe : describe.skip;
@@ -69,12 +112,182 @@ integration("S3ObjectStore against a live bucket", () => {
     expect(object.size).toBe(6);
   });
 
-  it("fails the stream rather than mix in content written after the metadata was read", async () => {
-    const key = await put("replaced.txt", "before", "text/plain");
-    const object = await store.get(key);
-    if (!object) throw new Error("expected the stored object");
-    await store.put(key, "after!", { contentType: "text/plain" });
+  it("streams a body larger than one part and removes nothing on success", async () => {
+    const content = randomBytes(2 * STREAM_PART_BYTES + 12345);
+    const key = `${prefix}streamed.bin`;
+    created.push(key);
+    const stored = await store.put(key, chunks(content), { contentType: "application/octet-stream" });
+    expect(stored).toMatchObject({ key, size: content.byteLength });
+    expect(await store.stat(key)).toMatchObject({ size: content.byteLength, contentType: "application/octet-stream" });
+    expect(digest(await readAll(store, key))).toBe(digest(content));
+
+    const fromStream = `${prefix}from-stream.bin`;
+    created.push(fromStream);
+    await store.put(fromStream, new Response(content).body as ReadableStream<Uint8Array>);
+    expect(digest(await readAll(store, fromStream))).toBe(digest(content));
+
+    const empty = `${prefix}empty.bin`;
+    created.push(empty);
+    expect(await store.put(empty, chunks(new Uint8Array(0)))).toMatchObject({ size: 0 });
+    expect(await store.stat(empty)).toMatchObject({ size: 0 });
+  });
+
+  it("aborts a streamed write whose source fails, leaving no object or upload", async () => {
+    const key = `${prefix}failed/stream.bin`;
+    async function* failing(): AsyncGenerator<Uint8Array> {
+      yield* chunks(randomBytes(STREAM_PART_BYTES + 1024));
+      throw new Error("client went away");
+    }
+    await expect(store.put(key, failing())).rejects.toThrow("client went away");
+    expect(await store.exists(key)).toBe(false);
+    expect(await pendingUploads(key)).toEqual([]);
+  });
+
+  it("assembles parts uploaded out of order under a key with reserved characters", async () => {
+    const key = `${prefix}multipart/a b+c&d=é.bin`;
+    created.push(key);
+    const first = randomBytes(MIN_MULTIPART_PART_BYTES);
+    const second = randomBytes(1000);
+    const { uploadId } = await store.createMultipartUpload(key, { contentType: "video/mp4" });
+    expect(await pendingUploads(key)).toEqual([uploadId]);
 
-    await expect(new Response(object.body).text()).rejects.toThrow("changed while it was being read");
+    const uploadedSecond = await store.uploadPart(key, uploadId, 2, chunks(second, 100));
+    const uploadedFirst = await store.uploadPart(key, uploadId, 1, new Blob([first]));
+    expect(uploadedFirst.size).toBe(first.byteLength);
+    expect(uploadedSecond).toMatchObject({ size: second.byteLength });
+
+    const info = await store.completeMultipartUpload(key, uploadId, [
+      { partNumber: 2, etag: uploadedSecond.etag },
+      { partNumber: 1, etag: uploadedFirst.etag },
+    ]);
+    expect(info).toMatchObject({ key, size: first.byteLength + second.byteLength, contentType: "video/mp4" });
+    expect(info.etag).toMatch(/^"[^"]+-2"$/);
+    expect(digest(await readAll(store, key))).toBe(digest(Buffer.concat([first, second])));
+    expect((await store.list(`${prefix}multipart/`)).keys).toEqual([key]);
+    expect(await pendingUploads(key)).toEqual([]);
+  });
+
+  it("reports multipart failures with provider-neutral codes", async () => {
+    const key = `${prefix}multipart-errors.bin`;
+    const codeOf = async (operation: Promise<unknown>): Promise<string | undefined> => {
+      const error = await operation.then(() => undefined, (failure: unknown) => failure);
+      return error instanceof MultipartUploadError ? error.code : undefined;
+    };
+    const { uploadId } = await store.createMultipartUpload(key);
+    const small = await store.uploadPart(key, uploadId, 1, "small");
+    const last = await store.uploadPart(key, uploadId, 2, "last");
+
+    expect(await codeOf(store.completeMultipartUpload(key, uploadId, [{ partNumber: 1, etag: "\"0\"" }])))
+      .toBe("INVALID_PART");
+    expect(await codeOf(store.completeMultipartUpload(key, uploadId, [
+      { partNumber: 1, etag: small.etag },
+      { partNumber: 2, etag: last.etag },
+    ]))).toBe("PART_TOO_SMALL");
+
+    await store.abortMultipartUpload(key, uploadId);
+    await store.abortMultipartUpload(key, uploadId);
+    expect(await codeOf(store.uploadPart(key, uploadId, 1, "late"))).toBe("UPLOAD_NOT_FOUND");
+    expect(await codeOf(store.completeMultipartUpload(key, uploadId, [{ partNumber: 1, etag: small.etag }])))
+      .toBe("UPLOAD_NOT_FOUND");
+    expect(await store.exists(key)).toBe(false);
+  });
+
+  it("rejects keys that a request URL would rewrite, for put and multipart alike", async () => {
+    for (const key of [`${prefix}a/../b`, `${prefix}./b`, ""]) {
+      await expect(store.put(key, "x")).rejects.toThrow("Object key");
+      await expect(store.createMultipartUpload(key)).rejects.toThrow("Object key");
+    }
+    await expect(store.uploadPart(`${prefix}a`, "id", 0, "x")).rejects.toThrow(RangeError);
   });
+
+  it("serves objects through objectResponse, with the Content-Length of those read into memory", async () => {
+    const server = Bun.serve({
+      port: 0,
+      async fetch(request): Promise<Response> {
+        const object = await store.get(`${prefix}${new URL(request.url).pathname.slice(1)}`);
+        return object ? objectResponse(request, object) : new Response(null, { status: 404 });
+      },
+    });
+    try {
+      for (const size of [68, 100 * 1024, IN_MEMORY_READ_BYTES, IN_MEMORY_READ_BYTES + 1]) {
+        const content = randomBytes(size);
+        const name = `served/${size}.bin`;
+        await put(name, content, "image/png");
+        const response = await fetch(new URL(name, server.url));
+        expect(response.status).toBe(200);
+        expect(response.headers.get("content-type")).toBe("image/png");
+        if (size <= IN_MEMORY_READ_BYTES) {
+          expect(response.headers.get("content-length")).toBe(String(size));
+          expect(response.headers.get("transfer-encoding")).toBeNull();
+        } else {
+          // Streamed from S3, which Bun may send chunked; a length must still be right.
+          expect(response.headers.get("content-length") ?? String(size)).toBe(String(size));
+        }
+        expect(digest(new Uint8Array(await response.arrayBuffer()))).toBe(digest(content));
+      }
+      const missing = await fetch(new URL("served/missing.bin", server.url));
+      expect(missing.status).toBe(404);
+    } finally {
+      server.stop(true);
+    }
+  }, 30_000);
+
+  it("releases a streamed download when objectResponse sends no body", async () => {
+    const key = await put("unsent.bin", randomBytes(16 * 1024 * 1024));
+    const info = await store.stat(key);
+    if (!info) throw new Error("expected the stored object");
+    const downloads = spyOn(globalThis, "fetch");
+    try {
+      const requests: RequestInit[] = [{ headers: { "if-none-match": info.etag } }, { method: "HEAD" }];
+      for (const init of requests) {
+        downloads.mockClear();
+        const object = await store.get(key);
+        if (!object) throw new Error("expected the stored object");
+        const response = objectResponse(new Request("http://localhost/unsent.bin", init), object);
+        expect(response.status).toBe(init.method === "HEAD" ? 200 : 304);
+        expect(downloads).toHaveBeenCalledTimes(1);
+        const download = await downloads.mock.results[0]?.value;
+        if (!(download instanceof Response)) throw new Error("expected the download response");
+        // A cancelled body reads as finished instead of yielding the object.
+        expect(await download.body?.getReader().read()).toEqual({ done: true, value: undefined });
+      }
+    } finally {
+      downloads.mockRestore();
+    }
+  }, 30_000);
+
+  it("reports a missing bucket as an error rather than a missing object", async () => {
+    const bucket = process.env.S3_BUCKET;
+    process.env.S3_BUCKET = `podokit-missing-${randomUUID()}`;
+    const elsewhere = new StorageService(new ReadinessService());
+    if (bucket === undefined) delete process.env.S3_BUCKET;
+    else process.env.S3_BUCKET = bucket;
+    try {
+      await expect(new S3ObjectStore(elsewhere).get("anything")).rejects.toThrow("NoSuchBucket");
+    } finally {
+      elsewhere.close();
+    }
+  });
+
+  it("never sends content written during a read under the metadata of that read", async () => {
+    // One GET describes and streams one version. An overwrite while a large
+    // object streams may end the stream early, as Silo does, but never switches
+    // it to the new content; an object read into memory is already complete.
+    for (const size of [1024 * 1024, 16 * 1024 * 1024]) {
+      const before = randomBytes(size);
+      const key = await put(`overwritten/${size}.bin`, before);
+      const info = await store.stat(key);
+      const object = await store.get(key);
+      if (!object) throw new Error("expected the stored object");
+      expect(object).toMatchObject({ size, etag: info?.etag ?? "" });
+
+      const reading = new Response(object.body).arrayBuffer().then(
+        (bytes) => new Uint8Array(bytes),
+        () => null,
+      );
+      await store.put(key, randomBytes(size + 1000));
+      const read = await reading;
+      if (size <= IN_MEMORY_READ_BYTES || read !== null) expect(read && digest(read)).toBe(digest(before));
+    }
+  }, 60_000);
 });

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/s3-object.store.ts

@@ -1,31 +1,45 @@
-import type {
-  DownloadUrlOptions,
-  ListObjectsOptions,
-  ObjectBody,
-  ObjectData,
-  ObjectInfo,
-  ObjectPage,
-  ObjectStore,
-  PutObjectOptions,
-  StoredObject,
+import {
+  assertPartNumber,
+  normalizeCompletedParts,
+  type CompletedPart,
+  type CreateMultipartUploadOptions,
+  type DownloadUrlOptions,
+  type ListObjectsOptions,
+  type MultipartUpload,
+  type ObjectBody,
+  type ObjectData,
+  type ObjectInfo,
+  type ObjectPage,
+  type ObjectStore,
+  type PutObjectOptions,
+  type StoredObject,
+  type UploadedPart,
 } from "@podosoft/podokit-runtime";
 import type { StorageService } from "./storage.service";
 
-async function bodyBytes(body: ObjectBody): Promise<Uint8Array> {
-  if (typeof body === "string") return Buffer.from(body);
-  if (body instanceof Uint8Array) return body;
-  const chunks: Uint8Array[] = [];
-  for await (const chunk of body) chunks.push(chunk);
-  return Buffer.concat(chunks);
+const MAX_KEY_BYTES = 1024;
+
+/**
+ * Checks a key for writing. S3 limits keys to 1024 bytes, and a "." or ".."
+ * segment would be resolved away in the request URL, writing another key.
+ */
+export function s3ObjectKey(key: string): string {
+  if (key.length === 0 || Buffer.byteLength(key) > MAX_KEY_BYTES) {
+    throw new Error(`Object key must be 1 to ${MAX_KEY_BYTES} bytes`);
+  }
+  if (key.split("/").some((segment) => segment === "." || segment === "..")) {
+    throw new Error("Object key must not contain . or .. segments");
+  }
+  return key;
 }
 
 export class S3ObjectStore implements ObjectStore {
   constructor(private readonly storage: StorageService) {}
 
   async put(key: string, body: ObjectBody, options: PutObjectOptions = {}): Promise<StoredObject> {
-    const bytes = await bodyBytes(body);
-    await this.storage.put(key, bytes, options.contentType);
-    return { key, size: bytes.byteLength, ...options };
+    const objectKey = s3ObjectKey(key);
+    const size = await this.storage.put(objectKey, body, options.contentType);
+    return { key: objectKey, size, ...options };
   }
 
   get(key: string): Promise<ObjectData | null> {
@@ -52,5 +66,27 @@ export class S3ObjectStore implements ObjectStore {
     return this.storage.presignedGetUrl(key, options.expiresInSeconds);
   }
 
+  async createMultipartUpload(key: string, options: CreateMultipartUploadOptions = {}): Promise<MultipartUpload> {
+    return { uploadId: await this.storage.createMultipartUpload(s3ObjectKey(key), options.contentType) };
+  }
+
+  async uploadPart(key: string, uploadId: string, partNumber: number, body: ObjectBody): Promise<UploadedPart> {
+    const objectKey = s3ObjectKey(key);
+    assertPartNumber(partNumber);
+    return this.storage.uploadPart(objectKey, uploadId, partNumber, body);
+  }
+
+  async completeMultipartUpload(key: string, uploadId: string, parts: readonly CompletedPart[]): Promise<ObjectInfo> {
+    const objectKey = s3ObjectKey(key);
+    await this.storage.completeMultipartUpload(objectKey, uploadId, normalizeCompletedParts(parts));
+    const info = await this.storage.stat(objectKey);
+    if (!info) throw new Error(`Object ${objectKey} was removed right after its upload completed`);
+    return info;
+  }
+
+  async abortMultipartUpload(key: string, uploadId: string): Promise<void> {
+    await this.storage.abortMultipartUpload(s3ObjectKey(key), uploadId);
+  }
+
   close(): void {}
 }

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/s3-signer.spec.ts

@@ -0,0 +1,71 @@
+import { describe, expect, it } from "bun:test";
+import { EMPTY_PAYLOAD_HASH, encodeRfc3986, signS3Request } from "./s3-signer";
+
+// The examples in the AWS documentation for Signature Version 4 header signing.
+const credentials = {
+  accessKeyId: "AKIAIOSFODNN7EXAMPLE",
+  secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+};
+const now = new Date("2013-05-24T00:00:00Z");
+
+function signature(authorization: string | undefined): string | undefined {
+  return /Signature=([0-9a-f]{64})$/.exec(authorization ?? "")?.[1];
+}
+
+describe("signS3Request", () => {
+  it("matches the AWS example for a ranged GET", () => {
+    const signed = signS3Request({
+      method: "GET",
+      url: new URL("https://examplebucket.s3.amazonaws.com/test.txt"),
+      headers: { Range: "bytes=0-9" },
+      payloadHash: EMPTY_PAYLOAD_HASH,
+    }, credentials, "us-east-1", now);
+    expect(signed.headers.authorization).toBe(
+      "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request, " +
+        "SignedHeaders=host;range;x-amz-content-sha256;x-amz-date, " +
+        "Signature=f0e8bdb87c964420e857bd35b5d6ed310bd44f0170aba48dd91039c6036bdb41",
+    );
+    expect(signed.headers["x-amz-date"]).toBe("20130524T000000Z");
+    expect(signed.headers.host).toBeUndefined();
+  });
+
+  it("matches the AWS examples for query parameters and an encoded key", () => {
+    const list = signS3Request({
+      method: "GET",
+      url: new URL("https://examplebucket.s3.amazonaws.com/"),
+      query: [["prefix", "J"], ["max-keys", "2"]],
+      payloadHash: EMPTY_PAYLOAD_HASH,
+    }, credentials, "us-east-1", now);
+    expect(signature(list.headers.authorization)).toBe("34b48302e7b5fa45bde8084f4b7868a86f0a534bc59db6670ed5711ef69dc6f7");
+    expect(list.url).toBe("https://examplebucket.s3.amazonaws.com/?max-keys=2&prefix=J");
+
+    const lifecycle = signS3Request({
+      method: "GET",
+      url: new URL("https://examplebucket.s3.amazonaws.com/"),
+      query: [["lifecycle", ""]],
+      payloadHash: EMPTY_PAYLOAD_HASH,
+    }, credentials, "us-east-1", now);
+    expect(signature(lifecycle.headers.authorization)).toBe("fea454ca298b7da1c68078a5d1bdbfbbe0d65c699e0f91ac7a200a0136783543");
+
+    const put = signS3Request({
+      method: "PUT",
+      url: new URL(`https://examplebucket.s3.amazonaws.com/${encodeRfc3986("test$file.text")}`),
+      headers: { date: "Fri, 24 May 2013 00:00:00 GMT", "x-amz-storage-class": "REDUCED_REDUNDANCY" },
+      payloadHash: "44ce7dd67c959e0d3524ffac1771dfbba87d2b6b4b4e99e42034a8b803f8b072",
+    }, credentials, "us-east-1", now);
+    expect(signature(put.headers.authorization)).toBe("98ad721746da40c64f1a55b78f14c238d841ea1380cd77a1b5971af0ece108bd");
+  });
+
+  it("signs a session token and encodes every reserved character", () => {
+    const signed = signS3Request({
+      method: "DELETE",
+      url: new URL("http://localhost:9000/podokit/a"),
+      query: [["uploadId", "a+b/c=d e"]],
+      payloadHash: EMPTY_PAYLOAD_HASH,
+    }, { ...credentials, sessionToken: "token" }, "us-east-1", now);
+    expect(signed.headers["x-amz-security-token"]).toBe("token");
+    expect(signed.headers.authorization).toContain("SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token,");
+    expect(signed.url).toBe("http://localhost:9000/podokit/a?uploadId=a%2Bb%2Fc%3Dd%20e");
+    expect(encodeRfc3986("a b!*'()~._-")).toBe("a%20b%21%2A%27%28%29~._-");
+  });
+});

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/s3-signer.ts

@@ -0,0 +1,98 @@
+import { createHash, createHmac } from "node:crypto";
+
+export interface S3Credentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+}
+
+export interface SignedRequestInput {
+  method: string;
+  /** The request URL without a query string; the path must already be encoded. */
+  url: URL;
+  query?: ReadonlyArray<readonly [string, string]>;
+  headers?: Record<string, string>;
+  /** The hex SHA-256 of the body, or UNSIGNED-PAYLOAD. */
+  payloadHash: string;
+}
+
+export interface SignedRequest {
+  url: string;
+  headers: Record<string, string>;
+}
+
+export const EMPTY_PAYLOAD_HASH = createHash("sha256").update("").digest("hex");
+export const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
+
+/** Percent-encodes everything but RFC 3986 unreserved characters, as SigV4 requires. */
+export function encodeRfc3986(value: string): string {
+  return encodeURIComponent(value).replace(
+    /[!'()*]/g,
+    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+}
+
+function hmac(key: string | Buffer, value: string): Buffer {
+  return createHmac("sha256", key).update(value, "utf8").digest();
+}
+
+function hex(value: string): string {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+
+function amzDate(now: Date): string {
+  return now.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+}
+
+/**
+ * Signs an S3 request with AWS Signature Version 4 in the Authorization header.
+ * Bun's S3Client signs its own requests but exposes no multipart operations,
+ * so the multipart calls are signed here.
+ */
+export function signS3Request(
+  input: SignedRequestInput,
+  credentials: S3Credentials,
+  region: string,
+  now: Date = new Date(),
+): SignedRequest {
+  const timestamp = amzDate(now);
+  const day = timestamp.slice(0, 8);
+  const headers: Record<string, string> = {};
+  for (const [name, value] of Object.entries(input.headers ?? {})) headers[name.toLowerCase()] = value;
+  headers.host = input.url.host;
+  headers["x-amz-date"] = timestamp;
+  headers["x-amz-content-sha256"] = input.payloadHash;
+  if (credentials.sessionToken) headers["x-amz-security-token"] = credentials.sessionToken;
+
+  const names = Object.keys(headers).sort();
+  const canonicalHeaders = names
+    .map((name) => `${name}:${(headers[name] ?? "").trim().replace(/\s+/g, " ")}\n`)
+    .join("");
+  const signedHeaders = names.join(";");
+  const query = (input.query ?? [])
+    .map(([name, value]) => [encodeRfc3986(name), encodeRfc3986(value)] as const)
+    .sort(([leftName, leftValue], [rightName, rightValue]) =>
+      leftName < rightName ? -1 : leftName > rightName ? 1 : leftValue < rightValue ? -1 : leftValue > rightValue ? 1 : 0
+    )
+    .map(([name, value]) => `${name}=${value}`)
+    .join("&");
+  const canonicalRequest = [
+    input.method,
+    input.url.pathname,
+    query,
+    canonicalHeaders,
+    signedHeaders,
+    input.payloadHash,
+  ].join("\n");
+  const scope = `${day}/${region}/s3/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", timestamp, scope, hex(canonicalRequest)].join("\n");
+  const signingKey = hmac(hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, day), region), "s3"), "aws4_request");
+  const signature = createHmac("sha256", signingKey).update(stringToSign, "utf8").digest("hex");
+
+  headers.authorization =
+    `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  // Bun's fetch sets Host from the URL.
+  delete headers.host;
+  return { url: query ? `${input.url.href}?${query}` : input.url.href, headers };
+}

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/storage-demo.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from "bun:test";
 import { AppException } from "@podosoft/podokit-contracts";
+import { objectBodyChunks } from "@podosoft/podokit-runtime";
 import { Elysia } from "elysia";
 import type { RequestIdentity } from "../core/services";
 import { storageDemoRoutes, type DemoStorage } from "./storage.module";
@@ -16,9 +17,11 @@ function memoryStorage(): MemoryStorage {
     objects,
     presigned,
     put: async (key, body) => {
-      if (typeof body === "string") objects.set(key, body);
-      else if (body instanceof Blob) objects.set(key, await body.text());
-      else objects.set(key, Buffer.from(body).toString("utf8"));
+      const chunks: Uint8Array[] = [];
+      for await (const chunk of objectBodyChunks(body)) chunks.push(chunk);
+      const content = Buffer.concat(chunks);
+      objects.set(key, content.toString("utf8"));
+      return content.byteLength;
     },
     open: async (key) => {
       const content = objects.get(key);

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/storage.config.ts

@@ -5,14 +5,18 @@ export interface StorageSettings {
   endpoint?: string;
   accessKeyId?: string;
   secretAccessKey?: string;
+  sessionToken?: string;
   virtualHostedStyle: boolean;
 }
 
+// The same S3_* then AWS_* credential variables Bun.S3Client reads, so the
+// signed multipart requests use the credentials of every other request.
 export function storageSettings(): StorageSettings {
   const provider = process.env.STORAGE_PROVIDER === "aws" ? "aws" : "minio";
   const endpoint = process.env.S3_ENDPOINT;
-  const accessKeyId = process.env.S3_ACCESS_KEY_ID;
-  const secretAccessKey = process.env.S3_SECRET_ACCESS_KEY;
+  const accessKeyId = process.env.S3_ACCESS_KEY_ID || process.env.AWS_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.S3_SECRET_ACCESS_KEY || process.env.AWS_SECRET_ACCESS_KEY;
+  const sessionToken = process.env.S3_SESSION_TOKEN || process.env.AWS_SESSION_TOKEN;
   return {
     provider,
     bucket: process.env.S3_BUCKET ?? "podokit",
@@ -23,5 +27,6 @@ export function storageSettings(): StorageSettings {
     ...(endpoint ? { endpoint } : {}),
     ...(accessKeyId ? { accessKeyId } : {}),
     ...(secretAccessKey ? { secretAccessKey } : {}),
+    ...(sessionToken ? { sessionToken } : {}),
   };
 }