@reventlessdev/reventless-aws 3.0.0-alpha.250 → 3.0.0-alpha.252

package/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs

@@ -2,7 +2,11 @@
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Float from "@rescript/runtime/lib/es6/Stdlib_Float.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as ClientS3 from "@aws-sdk/client-s3";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as S3RequestPresigner from "@aws-sdk/s3-request-presigner";
@@ -14,107 +18,223 @@ function getEnv(k) {
   }
 }
 
-function corsHeaders() {
+function decodeStore(json) {
+  if (typeof json !== "object" || json === null || Array.isArray(json)) {
+    return;
+  }
+  let match = Stdlib_Option.flatMap(json["bucket"], Stdlib_JSON.Decode.string);
+  let match$1 = Stdlib_Option.flatMap(json["prefix"], Stdlib_JSON.Decode.string);
+  if (match !== undefined && match$1 !== undefined) {
+    return {
+      bucket: match,
+      prefix: match$1
+    };
+  }
+}
+
+function loadStores() {
+  let match = Stdlib_Option.map(getEnv("UPLOAD_STORES"), s => JSON.parse(s));
+  if (match !== undefined) {
+    if (typeof match === "object" && match !== null && !Array.isArray(match)) {
+      return Object.fromEntries(Stdlib_Array.filterMap(Object.entries(match), param => {
+        let k = param[0];
+        return Stdlib_Option.map(decodeStore(param[1]), c => [
+          k,
+          c
+        ]);
+      }));
+    } else {
+      return {};
+    }
+  } else {
+    return {};
+  }
+}
+
+function windowMs() {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(getEnv("RELEASE_WINDOW_SECONDS"), Stdlib_Float.fromString), 900) * 1000;
+}
+
+function scopeCheck(key, sub, servedPrefix) {
+  if (sub === "") {
+    return {
+      TAG: "Error",
+      _0: "unauthenticated"
+    };
+  } else if (key.startsWith(servedPrefix + `/`)) {
+    if (key.startsWith(servedPrefix + `/` + sub + `/`)) {
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    } else {
+      return {
+        TAG: "Error",
+        _0: "not_yours"
+      };
+    }
+  } else {
+    return {
+      TAG: "Error",
+      _0: "not_in_store"
+    };
+  }
+}
+
+function ageOk(lastModifiedMs, nowMs, windowMs) {
+  if (lastModifiedMs !== undefined) {
+    return nowMs - lastModifiedMs <= windowMs;
+  } else {
+    return true;
+  }
+}
+
+function decideRelease(key, sub, servedPrefix, lastModifiedMs, nowMs, windowMs) {
+  let reason = scopeCheck(key, sub, servedPrefix);
+  if (reason.TAG === "Ok") {
+    if (ageOk(lastModifiedMs, nowMs, windowMs)) {
+      return "Released";
+    } else {
+      return {
+        TAG: "Refused",
+        _0: "too_old"
+      };
+    }
+  } else {
+    return {
+      TAG: "Refused",
+      _0: reason._0
+    };
+  }
+}
+
+function ticket(uploadUrl, storageRef) {
   return Object.fromEntries([
     [
-      "content-type",
-      "application/json"
+      "uploadUrl",
+      uploadUrl
     ],
     [
-      "access-control-allow-origin",
-      "*"
-    ],
+      "storageRef",
+      storageRef
+    ]
+  ]);
+}
+
+function releaseResult(released, reason) {
+  return Object.fromEntries([
     [
-      "access-control-allow-methods",
-      "POST,OPTIONS"
+      "released",
+      released
     ],
     [
-      "access-control-allow-headers",
-      "*"
+      "reason",
+      Stdlib_Option.mapOr(reason, null, prim => prim)
     ]
   ]);
 }
 
-function decodeJwtSub(header) {
+function keyOfRef(storageRef) {
+  if (storageRef.startsWith("/")) {
+    return storageRef.slice(1, storageRef.length);
+  } else {
+    return storageRef;
+  }
+}
+
+async function headLastModifiedMs(client, bucket, key) {
   try {
-    let token = header.startsWith("Bearer ") ? header.slice(7, header.length) : header;
-    let payload = token.split(".")[1];
-    if (payload === undefined) {
-      return;
-    }
-    let base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
-    let obj = JSON.parse(Buffer.from(base64, "base64").toString("utf8"));
-    if (typeof obj === "object" && obj !== null && !Array.isArray(obj)) {
-      return Stdlib_Option.flatMap(obj["sub"], Stdlib_JSON.Decode.string);
+    let out = await client.send(new ClientS3.HeadObjectCommand({
+      Bucket: bucket,
+      Key: key
+    }));
+    return Stdlib_Option.map(out.LastModified, d => d.getTime());
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    let match = Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.name);
+    if (match !== undefined) {
+      switch (match) {
+        case "NoSuchKey" :
+        case "NotFound" :
+          return;
+        default:
+          throw exn;
+      }
     } else {
-      return;
+      throw exn;
     }
-  } catch (exn) {
-    return;
   }
 }
 
-function identityPrefix(event) {
-  let authHeader = Stdlib_Option.flatMap(event.headers, h => Stdlib_Option.orElse(h["authorization"], h["Authorization"]));
-  let sub = Stdlib_Option.flatMap(authHeader, decodeJwtSub);
-  if (sub !== undefined) {
-    return sub + `/`;
-  } else {
-    return "";
+async function handlePresign(client, bucket, servedPrefix, sub, args) {
+  if (sub === "") {
+    Stdlib_JsError.throwWithMessage("unauthenticated");
+  }
+  let fileName = Stdlib_Option.getOr(args.fileName, "upload");
+  let key = servedPrefix + `/` + sub + `/` + Nodecrypto.randomUUID() + `/` + fileName;
+  let command = new ClientS3.PutObjectCommand({
+    Bucket: bucket,
+    Key: key,
+    ContentType: args.contentType
+  });
+  let uploadUrl = await S3RequestPresigner.getSignedUrl(client, command, {
+    expiresIn: 300
+  });
+  return ticket(uploadUrl, `/` + key);
+}
+
+async function handleRelease(client, bucket, servedPrefix, sub, args) {
+  let key = keyOfRef(Stdlib_Option.getOr(args.storageRef, ""));
+  let reason = scopeCheck(key, sub, servedPrefix);
+  if (reason.TAG !== "Ok") {
+    return releaseResult(false, reason._0);
+  }
+  let lastModifiedMs = await headLastModifiedMs(client, bucket, key);
+  let reason$1 = decideRelease(key, sub, servedPrefix, lastModifiedMs, Date.now(), windowMs());
+  if (typeof reason$1 === "object") {
+    return releaseResult(false, reason$1._0);
   }
+  await client.send(new ClientS3.DeleteObjectCommand({
+    Bucket: bucket,
+    Key: key
+  }));
+  return releaseResult(true, undefined);
 }
 
 async function handler(event) {
-  try {
-    let bucket = Stdlib_Option.getOr(getEnv("UPLOAD_BUCKET"), "");
-    let parsed = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(JSON.parse(Stdlib_Option.getOr(event.body, "{}"))), {});
-    let fileName = Stdlib_Option.getOr(Stdlib_Option.flatMap(parsed["fileName"], Stdlib_JSON.Decode.string), "upload");
-    let contentType = Stdlib_Option.flatMap(parsed["contentType"], Stdlib_JSON.Decode.string);
-    let servedPrefix = Stdlib_Option.getOr(getEnv("SERVED_PREFIX"), "uploads");
-    let key = servedPrefix + `/` + identityPrefix(event) + Nodecrypto.randomUUID() + `/` + fileName;
-    let client = new ClientS3.S3Client();
-    let command = new ClientS3.PutObjectCommand({
-      Bucket: bucket,
-      Key: key,
-      ContentType: contentType
-    });
-    let uploadUrl = await S3RequestPresigner.getSignedUrl(client, command, {
-      expiresIn: 300
-    });
-    let storageRef = `/` + key;
-    return {
-      statusCode: 200,
-      headers: corsHeaders(),
-      body: JSON.stringify(Object.fromEntries([
-        [
-          "uploadUrl",
-          uploadUrl
-        ],
-        [
-          "storageRef",
-          storageRef
-        ]
-      ]))
-    };
-  } catch (raw_exn) {
-    let exn = Primitive_exceptions.internalToException(raw_exn);
-    console.error("UploadPresign: presign failed", exn);
-    return {
-      statusCode: 400,
-      headers: corsHeaders(),
-      body: JSON.stringify(Object.fromEntries([[
-          "error",
-          "presign_failed"
-        ]]))
-    };
+  let stores = loadStores();
+  let args = Stdlib_Option.getOr(event.arguments, {});
+  let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(event.identity, i => i.sub), "");
+  let storeKey = Stdlib_Option.getOr(args.store, "");
+  let match = stores[storeKey];
+  if (match === undefined) {
+    return Stdlib_JsError.throwWithMessage("unknown_store");
+  }
+  let prefix = match.prefix;
+  let bucket = match.bucket;
+  let client = new ClientS3.S3Client();
+  let match$1 = Stdlib_Option.getOr(event.operation, "presign");
+  if (match$1 === "release") {
+    return await handleRelease(client, bucket, prefix, sub, args);
+  } else {
+    return await handlePresign(client, bucket, prefix, sub, args);
   }
 }
 
 export {
   getEnv,
-  corsHeaders,
-  decodeJwtSub,
-  identityPrefix,
+  decodeStore,
+  loadStores,
+  windowMs,
+  scopeCheck,
+  ageOk,
+  decideRelease,
+  ticket,
+  releaseResult,
+  keyOfRef,
+  headLastModifiedMs,
+  handlePresign,
+  handleRelease,
   handler,
 }
 /* node:crypto Not a pure module */

package/src/util/Util_DeadLetterQueue.res

@@ -12,10 +12,16 @@ let queueTags = queueName =>
     ~scope=Plugin,
   )
 
+// 14 days, the SQS maximum, stated rather than inherited. A dead letter is the
+// only surviving evidence of a message the system could not process, and the
+// 4-day default can expire it over a long weekend before anyone reads it.
+let retentionSeconds = 14 * 24 * 60 * 60
+
 let queue = SQS.Queue.make(
   ~name,
   ~args={
     SQS.Queue.visibilityTimeoutSeconds: 180->Pulumi.Input.make,
+    messageRetentionSeconds: retentionSeconds->Pulumi.Input.make,
     sqsManagedSseEnabled: false->Pulumi.Input.make,
     tags: queueTags(name),
   },
@@ -27,6 +33,7 @@ let fifoQueue = SQS.Queue.make(
     SQS.Queue.fifoQueue: true->Pulumi.Input.make,
     contentBasedDeduplication: true->Pulumi.Input.make,
     visibilityTimeoutSeconds: 180->Pulumi.Input.make,
+    messageRetentionSeconds: retentionSeconds->Pulumi.Input.make,
     sqsManagedSseEnabled: false->Pulumi.Input.make,
     tags: queueTags(nameFifo),
   },
@@ -45,8 +52,27 @@ let lambdaRole = IAM.Role.makeWithDefaultPolicy(
   ~opts,
 )
 
+// Logs what arrived, then FAILS the invocation on purpose.
+//
+// Returning success here would let SQS delete the message, which is what this
+// handler used to do — and it made a dead letter unobservable twice over: the
+// queue's depth returned to 0, so a depth alarm could never fire, and the
+// function's `Errors` metric stayed at 0, so neither could an error alarm. A
+// plugin whose commands failed every 5 minutes for two days produced 217 dead
+// letters and no signal at all; it was found by a person noticing a stale UI.
+//
+// Failing instead keeps the message on the queue (this queue has no redrive
+// target of its own, so it stays until retention expires) and keeps `Errors`
+// non-zero for as long as the condition lasts. Both are conventional alarm
+// subjects, and a monitoring backend attached through the `DeadLetterSink` seam
+// below now has something to attach to. Re-delivery re-logs the payload; on a
+// queue that is empty in normal operation, that repetition is the alert.
 let entryPointCode = `export const handler = async (event) => {
   console.error("DEAD LETTER ITEM:", JSON.stringify(event));
+  throw new Error(
+    "Dead-lettered " + (event?.Records?.length ?? 0) +
+    " message(s); see DEAD LETTER ITEM above. Failing so the messages are retained and Errors is non-zero."
+  );
 };`
 
 let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -22,6 +22,7 @@ function queueTags(queueName) {
 }
 
 let queue = new (Aws.sqs.Queue)(name, {
+  messageRetentionSeconds: 1209600,
   tags: queueTags(name),
   visibilityTimeoutSeconds: 180,
   sqsManagedSseEnabled: false
@@ -30,6 +31,7 @@ let queue = new (Aws.sqs.Queue)(name, {
 let fifoQueue = new (Aws.sqs.Queue)(nameFifo, {
   contentBasedDeduplication: true,
   fifoQueue: true,
+  messageRetentionSeconds: 1209600,
   tags: queueTags(nameFifo),
   visibilityTimeoutSeconds: 180,
   sqsManagedSseEnabled: false
@@ -45,6 +47,10 @@ let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AW
 
 let entryPointCode = `export const handler = async (event) => {
   console.error("DEAD LETTER ITEM:", JSON.stringify(event));
+  throw new Error(
+    "Dead-lettered " + (event?.Records?.length ?? 0) +
+    " message(s); see DEAD LETTER ITEM above. Failing so the messages are retained and Errors is non-zero."
+  );
 };`;
 
 let archiveContents = {};
@@ -150,10 +156,13 @@ Pulumi.all([
   }, opts);
 });
 
+let retentionSeconds = 1209600;
+
 export {
   name,
   nameFifo,
   queueTags,
+  retentionSeconds,
   queue,
   fifoQueue,
   opts,

package/tests/Upload_ReleaseRuleTest.res

@@ -0,0 +1,90 @@
+// The release rule as a pure decision — no S3, no AppSync (plan Step 4).
+//
+// `Upload_Presign_S3_Ops` splits the rule into `scopeCheck` (the string-checkable
+// half: authenticated, in-store, owned) and `ageOk` (the clock half), composed by
+// `decideRelease`. These tests pin every allow/deny reason so a release that should
+// refuse can never silently succeed — the failure mode the plan exists to remove.
+
+open JestGlobals
+
+module Ops = Upload_Presign_S3_Ops
+
+let prefix = "uploads"
+let sub = "user-1"
+let ownKey = "uploads/user-1/abc/file.png"
+let otherKey = "uploads/user-2/abc/file.png"
+let outsideKey = "other/user-1/abc/file.png"
+
+let nowMs = 1_000_000.0
+let windowMs = 900_000.0 // 15 minutes
+let fresh = Some(nowMs -. 1_000.0) // 1s old
+let stale = Some(nowMs -. 1_000_000.0) // ~16.6min old, beyond the window
+
+describe("Upload_Presign_S3_Ops.scopeCheck", () => {
+  testSync("rejects an empty sub as unauthenticated", () =>
+    expect(Ops.scopeCheck(~key=ownKey, ~sub="", ~servedPrefix=prefix))->toEqual(
+      Error("unauthenticated"),
+    )
+  )
+
+  testSync("rejects a key outside the store prefix as not_in_store", () =>
+    expect(Ops.scopeCheck(~key=outsideKey, ~sub, ~servedPrefix=prefix))->toEqual(
+      Error("not_in_store"),
+    )
+  )
+
+  testSync("rejects another identity's key as not_yours", () =>
+    expect(Ops.scopeCheck(~key=otherKey, ~sub, ~servedPrefix=prefix))->toEqual(Error("not_yours"))
+  )
+
+  testSync("allows the caller's own in-store key", () =>
+    expect(Ops.scopeCheck(~key=ownKey, ~sub, ~servedPrefix=prefix))->toEqual(Ok())
+  )
+})
+
+describe("Upload_Presign_S3_Ops.ageOk", () => {
+  testSync("treats an absent object as releasable (idempotent)", () =>
+    expect(Ops.ageOk(~lastModifiedMs=None, ~nowMs, ~windowMs))->toBe(true)
+  )
+
+  testSync("allows an object younger than the window", () =>
+    expect(Ops.ageOk(~lastModifiedMs=fresh, ~nowMs, ~windowMs))->toBe(true)
+  )
+
+  testSync("refuses an object older than the window", () =>
+    expect(Ops.ageOk(~lastModifiedMs=stale, ~nowMs, ~windowMs))->toBe(false)
+  )
+})
+
+describe("Upload_Presign_S3_Ops.decideRelease", () => {
+  let decide = (~key, ~sub, ~lastModifiedMs) =>
+    Ops.decideRelease(~key, ~sub, ~servedPrefix=prefix, ~lastModifiedMs, ~nowMs, ~windowMs)
+
+  testSync("releases the caller's own fresh object", () =>
+    expect(decide(~key=ownKey, ~sub, ~lastModifiedMs=fresh))->toEqual(Ops.Released)
+  )
+
+  testSync("releases an absent object (idempotent retry)", () =>
+    expect(decide(~key=ownKey, ~sub, ~lastModifiedMs=None))->toEqual(Ops.Released)
+  )
+
+  testSync("refuses another identity's object with not_yours", () =>
+    expect(decide(~key=otherKey, ~sub, ~lastModifiedMs=fresh))->toEqual(Ops.Refused("not_yours"))
+  )
+
+  testSync("refuses an object older than the window with too_old", () =>
+    expect(decide(~key=ownKey, ~sub, ~lastModifiedMs=stale))->toEqual(Ops.Refused("too_old"))
+  )
+
+  testSync("refuses a key outside the store with not_in_store", () =>
+    expect(decide(~key=outsideKey, ~sub, ~lastModifiedMs=fresh))->toEqual(
+      Ops.Refused("not_in_store"),
+    )
+  )
+
+  testSync("refuses an unauthenticated caller before any age check", () =>
+    expect(decide(~key=ownKey, ~sub="", ~lastModifiedMs=stale))->toEqual(
+      Ops.Refused("unauthenticated"),
+    )
+  )
+})

package/tests/Upload_ReleaseRuleTest.res.mjs

@@ -0,0 +1,110 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Upload_Presign_S3_Ops$ReventlessAws from "../src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs";
+
+let prefix = "uploads";
+
+let sub = "user-1";
+
+let ownKey = "uploads/user-1/abc/file.png";
+
+let otherKey = "uploads/user-2/abc/file.png";
+
+let outsideKey = "other/user-1/abc/file.png";
+
+let fresh = 1000000.0 - 1000.0;
+
+let stale = 1000000.0 - 1000000.0;
+
+globalThis.describe("Upload_Presign_S3_Ops.scopeCheck", () => {
+  globalThis.test("rejects an empty sub as unauthenticated", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.scopeCheck(ownKey, "", prefix)).toEqual({
+      TAG: "Error",
+      _0: "unauthenticated"
+    });
+  });
+  globalThis.test("rejects a key outside the store prefix as not_in_store", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.scopeCheck(outsideKey, sub, prefix)).toEqual({
+      TAG: "Error",
+      _0: "not_in_store"
+    });
+  });
+  globalThis.test("rejects another identity's key as not_yours", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.scopeCheck(otherKey, sub, prefix)).toEqual({
+      TAG: "Error",
+      _0: "not_yours"
+    });
+  });
+  globalThis.test("allows the caller's own in-store key", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.scopeCheck(ownKey, sub, prefix)).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+});
+
+globalThis.describe("Upload_Presign_S3_Ops.ageOk", () => {
+  globalThis.test("treats an absent object as releasable (idempotent)", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.ageOk(undefined, 1000000.0, 900000.0)).toBe(true);
+  });
+  globalThis.test("allows an object younger than the window", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.ageOk(fresh, 1000000.0, 900000.0)).toBe(true);
+  });
+  globalThis.test("refuses an object older than the window", () => {
+    globalThis.expect(Upload_Presign_S3_Ops$ReventlessAws.ageOk(stale, 1000000.0, 900000.0)).toBe(false);
+  });
+});
+
+globalThis.describe("Upload_Presign_S3_Ops.decideRelease", () => {
+  let decide = (key, sub, lastModifiedMs) => Upload_Presign_S3_Ops$ReventlessAws.decideRelease(key, sub, prefix, lastModifiedMs, 1000000.0, 900000.0);
+  globalThis.test("releases the caller's own fresh object", () => {
+    globalThis.expect(decide(ownKey, sub, fresh)).toEqual("Released");
+  });
+  globalThis.test("releases an absent object (idempotent retry)", () => {
+    globalThis.expect(decide(ownKey, sub, undefined)).toEqual("Released");
+  });
+  globalThis.test("refuses another identity's object with not_yours", () => {
+    globalThis.expect(decide(otherKey, sub, fresh)).toEqual({
+      TAG: "Refused",
+      _0: "not_yours"
+    });
+  });
+  globalThis.test("refuses an object older than the window with too_old", () => {
+    globalThis.expect(decide(ownKey, sub, stale)).toEqual({
+      TAG: "Refused",
+      _0: "too_old"
+    });
+  });
+  globalThis.test("refuses a key outside the store with not_in_store", () => {
+    globalThis.expect(decide(outsideKey, sub, fresh)).toEqual({
+      TAG: "Refused",
+      _0: "not_in_store"
+    });
+  });
+  globalThis.test("refuses an unauthenticated caller before any age check", () => {
+    globalThis.expect(decide(ownKey, "", stale)).toEqual({
+      TAG: "Refused",
+      _0: "unauthenticated"
+    });
+  });
+});
+
+let Ops;
+
+let nowMs = 1000000.0;
+
+let windowMs = 900000.0;
+
+export {
+  Ops,
+  prefix,
+  sub,
+  ownKey,
+  otherKey,
+  outsideKey,
+  nowMs,
+  windowMs,
+  fresh,
+  stale,
+}
+/*  Not a pure module */