@poe-platform/safe-fs 0.1.0

package/dist/safe-fs/fs/s3/http/index.d.ts

@@ -0,0 +1,2 @@
+export { createS3HttpTransport } from "./transport.js";
+export type { S3HttpCredentials, S3HttpCredentialProvider, S3HttpRequestFactory, S3HttpTransportOptions } from "./types.js";

package/dist/safe-fs/fs/s3/http/index.js

@@ -0,0 +1 @@
+export { createS3HttpTransport } from "./transport.js";

package/dist/safe-fs/fs/s3/http/request.d.ts

@@ -0,0 +1,16 @@
+import type { IncomingMessage, RequestOptions } from "node:http";
+import type { S3HttpRequestFactory } from "./types.js";
+export interface RequestScope {
+    readonly signal: AbortSignal;
+    readonly finish: () => void;
+}
+export declare function scopeFor(signal: AbortSignal | undefined, timeout: number): RequestScope;
+export declare function abortable<Value>(pending: Promise<Value>, signal: AbortSignal): Promise<Value>;
+export interface WireResponse {
+    readonly message: IncomingMessage;
+    readonly body: AsyncIterable<Uint8Array>;
+    readonly close: () => void;
+}
+export declare function sendRequest(options: RequestOptions, body: Uint8Array, scope: RequestScope, factory?: S3HttpRequestFactory): Promise<WireResponse>;
+export declare function limitedBody(response: WireResponse, maximum: number, expected?: number): AsyncIterable<Uint8Array>;
+export declare function collect(response: WireResponse, maximum: number, expected?: number): Promise<Uint8Array>;

package/dist/safe-fs/fs/s3/http/request.js

@@ -0,0 +1,196 @@
+import { once } from "node:events";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { S3ServiceError } from "../transport.js";
+export function scopeFor(signal, timeout) {
+    const controller = new AbortController();
+    const abort = () => controller.abort(signal?.reason);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    const timer = setTimeout(() => controller.abort(new S3ServiceError("RequestTimeout", 408)), timeout);
+    return {
+        signal: controller.signal,
+        finish: () => { clearTimeout(timer); signal?.removeEventListener("abort", abort); },
+    };
+}
+export async function abortable(pending, signal) {
+    let abort;
+    try {
+        return await new Promise((resolve, reject) => {
+            abort = () => reject(signal.reason);
+            signal.addEventListener("abort", abort, { once: true });
+            pending.then(resolve, reject);
+            if (signal.aborted)
+                abort();
+        });
+    }
+    finally {
+        if (abort)
+            signal.removeEventListener("abort", abort);
+    }
+}
+export async function sendRequest(options, body, scope, factory) {
+    const signal = scope.signal;
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        let request;
+        let response;
+        let headersReceived = false;
+        let finished = false;
+        const cleanup = () => {
+            signal.removeEventListener("abort", abort);
+            scope.finish();
+        };
+        const close = () => {
+            if (finished)
+                return;
+            finished = true;
+            cleanup();
+            response?.destroy();
+            request?.destroy();
+        };
+        const fail = (error) => {
+            reject(signal.aborted ? signal.reason : error);
+            close();
+        };
+        const abort = () => fail(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        try {
+            const create = factory ?? (options.protocol === "https:" ? httpsRequest : httpRequest);
+            request = create(options, message => {
+                response = message;
+                message.on("error", () => { });
+                if (finished || signal.aborted) {
+                    close();
+                    message.destroy();
+                    return;
+                }
+                headersReceived = true;
+                message.once("close", cleanup);
+                let claimed = false;
+                const source = {
+                    [Symbol.asyncIterator]() {
+                        if (claimed)
+                            throw new S3ServiceError("InvalidResponse", 502, "response body is single-use");
+                        claimed = true;
+                        const iterator = message[Symbol.asyncIterator]();
+                        let ended = false;
+                        return {
+                            async next() {
+                                try {
+                                    signal.throwIfAborted();
+                                    if (ended)
+                                        return { done: true, value: undefined };
+                                    const result = await abortable(iterator.next(), signal);
+                                    signal.throwIfAborted();
+                                    if (result.done) {
+                                        ended = true;
+                                        if (!message.complete)
+                                            throw new S3ServiceError("InvalidResponse", 502, "incomplete HTTP response");
+                                        close();
+                                        return { done: true, value: undefined };
+                                    }
+                                    if (!(result.value instanceof Uint8Array))
+                                        throw new S3ServiceError("InvalidResponse", 502, "nonbinary HTTP body");
+                                    return { done: false, value: new Uint8Array(result.value) };
+                                }
+                                catch (error) {
+                                    ended = true;
+                                    close();
+                                    throw signal.aborted ? signal.reason : error;
+                                }
+                            },
+                            async return() {
+                                ended = true;
+                                close();
+                                return { done: true, value: undefined };
+                            },
+                        };
+                    },
+                };
+                resolve({ message, body: source, close });
+            });
+            request.on("error", fail);
+            request.once("close", () => {
+                if (!headersReceived)
+                    fail(new S3ServiceError("InvalidResponse", 502, "connection closed before response headers"));
+            });
+            if (signal.aborted || finished) {
+                abort();
+                request.destroy();
+                return;
+            }
+            void (async () => {
+                for (let offset = 0; offset < body.length; offset += 64 * 1024) {
+                    signal.throwIfAborted();
+                    if (!request.write(body.subarray(offset, offset + 64 * 1024)))
+                        await once(request, "drain", { signal });
+                }
+                signal.throwIfAborted();
+                request.end();
+            })().catch(fail);
+        }
+        catch (error) {
+            fail(error);
+        }
+    });
+}
+export function limitedBody(response, maximum, expected) {
+    if (expected !== undefined && expected > maximum) {
+        response.close();
+        throw new S3ServiceError("EntityTooLarge", 413, "response exceeds byte limit");
+    }
+    let claimed = false;
+    return {
+        [Symbol.asyncIterator]() {
+            if (claimed)
+                throw new S3ServiceError("InvalidResponse", 502, "response body is single-use");
+            claimed = true;
+            const iterator = response.body[Symbol.asyncIterator]();
+            let count = 0;
+            return {
+                async next() {
+                    try {
+                        const result = await iterator.next();
+                        if (result.done) {
+                            if (expected !== undefined && count !== expected)
+                                throw new S3ServiceError("InvalidResponse", 502, "response content length mismatch");
+                        }
+                        else {
+                            count += result.value.length;
+                            if (count > maximum)
+                                throw new S3ServiceError("EntityTooLarge", 413, "response exceeds byte limit");
+                            if (expected !== undefined && count > expected)
+                                throw new S3ServiceError("InvalidResponse", 502, "response content length mismatch");
+                        }
+                        return result;
+                    }
+                    catch (error) {
+                        response.close();
+                        throw error;
+                    }
+                },
+                async return() {
+                    response.close();
+                    await iterator.return?.();
+                    return { done: true, value: undefined };
+                },
+            };
+        },
+    };
+}
+export async function collect(response, maximum, expected) {
+    const chunks = [];
+    let count = 0;
+    try {
+        for await (const chunk of limitedBody(response, maximum, expected)) {
+            chunks.push(chunk);
+            count += chunk.length;
+        }
+        return Buffer.concat(chunks, count);
+    }
+    finally {
+        response.close();
+    }
+}

package/dist/safe-fs/fs/s3/http/signature.d.ts

@@ -0,0 +1,20 @@
+import type { S3HttpCredentials } from "./types.js";
+export declare function invalid(message: string): never;
+export declare function uriEncode(value: string, preserveSlash?: boolean): string;
+export declare function canonicalQuery(entries: readonly (readonly [string, string])[]): string;
+export declare function sha256(bytes: Uint8Array | string): string;
+export declare function headerValue(value: string): string;
+export declare function signRequest(input: {
+    readonly method: string;
+    readonly path: string;
+    readonly query: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: Uint8Array;
+    readonly region: string;
+    readonly credentials: S3HttpCredentials;
+    readonly date: Date;
+}): {
+    readonly headers: Record<string, string>;
+    readonly canonicalRequest: string;
+    readonly signature: string;
+};

package/dist/safe-fs/fs/s3/http/signature.js

@@ -0,0 +1,74 @@
+import { createHash, createHmac } from "node:crypto";
+import { S3ServiceError } from "../transport.js";
+export function invalid(message) {
+    throw new S3ServiceError("InvalidArgument", 400, message);
+}
+export function uriEncode(value, preserveSlash = false) {
+    if (typeof value !== "string")
+        invalid("expected a UTF-8 string");
+    try {
+        const encoded = encodeURIComponent(value).replace(/[!'()*]/g, character => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+        return preserveSlash ? encoded.replace(/%2F/g, "/") : encoded;
+    }
+    catch {
+        return invalid("invalid Unicode string");
+    }
+}
+export function canonicalQuery(entries) {
+    return entries.map(([name, value]) => [uriEncode(name), uriEncode(value)])
+        .sort(([leftName, leftValue], [rightName, rightValue]) => leftName < rightName ? -1 : leftName > rightName ? 1 : leftValue < rightValue ? -1 : leftValue > rightValue ? 1 : 0)
+        .map(([name, value]) => `${name}=${value}`).join("&");
+}
+export function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+export function headerValue(value) {
+    if (typeof value !== "string" || /[^\x20-\x7e\t]/.test(value))
+        invalid("header values must be printable ASCII without line breaks");
+    return value.trim().replace(/[ \t]+/g, " ");
+}
+export function signRequest(input) {
+    const credentials = input.credentials;
+    if (!credentials || typeof credentials.accessKeyId !== "string" || !/^[A-Za-z0-9_-]+$/.test(credentials.accessKeyId)
+        || typeof credentials.secretAccessKey !== "string" || credentials.secretAccessKey.length === 0
+        || credentials.secretAccessKey.length > 4096)
+        invalid("explicit signing credentials are required");
+    if (!/^[a-z0-9-]{1,64}$/.test(input.region))
+        invalid("invalid signing region");
+    if (!(input.date instanceof Date) || !Number.isFinite(input.date.getTime())
+        || input.date.getUTCFullYear() < 1970 || input.date.getUTCFullYear() > 9999)
+        invalid("invalid signing clock");
+    const timestamp = input.date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+    const date = timestamp.slice(0, 8);
+    const headers = Object.create(null);
+    for (const [name, value] of Object.entries(input.headers)) {
+        const lower = name.toLowerCase();
+        if (!/^[a-z0-9-]+$/.test(lower) || lower in headers)
+            invalid("invalid or duplicate signing header");
+        headers[lower] = headerValue(value);
+    }
+    if (!headers.host)
+        invalid("host is required for signing");
+    const payloadHash = sha256(input.body);
+    headers["x-amz-date"] = timestamp;
+    headers["x-amz-content-sha256"] = payloadHash;
+    if (credentials.sessionToken !== undefined) {
+        headers["x-amz-security-token"] = headerValue(credentials.sessionToken);
+        if (!headers["x-amz-security-token"])
+            invalid("session token must not be empty");
+    }
+    const names = Object.keys(headers).sort();
+    const signedHeaders = names.join(";");
+    const canonicalRequest = [input.method, input.path, input.query,
+        names.map(name => `${name}:${headers[name]}\n`).join(""), signedHeaders, payloadHash].join("\n");
+    const scope = `${date}/${input.region}/s3/aws4_request`;
+    const stringToSign = ["AWS4-HMAC-SHA256", timestamp, scope, sha256(canonicalRequest)].join("\n");
+    let key = createHmac("sha256", `AWS4${credentials.secretAccessKey}`).update(date).digest();
+    for (const part of [input.region, "s3", "aws4_request"])
+        key = createHmac("sha256", key).update(part).digest();
+    const signature = createHmac("sha256", key).update(stringToSign).digest("hex");
+    headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    if (Object.entries(headers).reduce((size, [name, value]) => size + name.length + value.length + 4, 0) > 16 * 1024)
+        invalid("request headers exceed 16 KiB");
+    return { headers, canonicalRequest, signature };
+}

package/dist/safe-fs/fs/s3/http/transport.d.ts

@@ -0,0 +1,3 @@
+import type { S3Transport } from "../transport.js";
+import type { S3HttpTransportOptions } from "./types.js";
+export declare function createS3HttpTransport(options: S3HttpTransportOptions): S3Transport;