@specific.dev/spectest 0.131.7 → 0.131.8

package/dist/components/s3-runtime/README.md

@@ -22,7 +22,10 @@ each part and its ordering, and the composite checksum survives HEAD/GET for
 reconciliation. Completion conditions use the backend's atomic conditional write.
 Overwriting an object does not inherit the previous object's checksum metadata.
 This patch supports SHA256/COMPOSITE; it does not implement every S3 checksum
-algorithm or streaming checksum trailers.
+algorithm or streaming checksum trailers. It also supports UploadPartCopy from
+one backend snapshot, including closed byte ranges, exact ETag conditions,
+version selection and SHA256 part receipts. Date-based copy conditions are
+explicitly unsupported (501), rather than silently ignored.
 
 Run `./test.sh` from this directory to exercise real HTTP requests against the
 same patched sources used in the image, including corrupt retries, conditional

package/dist/components/s3-runtime/main_test.go

@@ -197,3 +197,86 @@ func TestMultipartAbortAndLegacyUpload(t *testing.T) {
 		t.Fatal("legacy multipart changed")
 	}
 }
+
+func TestUploadPartCopyRetainsExactSourceAndRejectsStaleRetry(t *testing.T) {
+	p := newProbe(t)
+	source := bytes.Repeat([]byte("0123456789"), 600000)
+	put := p.request("PUT", "/uploads/staging%20%2B%25.csv", source, nil, 200)
+	path := p.start("copied", false)
+	headers := map[string]string{"x-amz-copy-source": "/uploads/staging%20%2B%25.csv", "x-amz-copy-source-if-match": put.header.Get("ETag"), "x-amz-copy-source-range": "bytes=3-5242882"}
+	res := p.request("PUT", path+"&partNumber=1", nil, headers, 200)
+	var part struct {
+		XMLName      xml.Name
+		ETag         string
+		LastModified string
+	}
+	if err := xml.Unmarshal(res.body, &part); err != nil || part.XMLName.Local != "CopyPartResult" || part.ETag == "" || part.LastModified == "" {
+		t.Fatalf("copy part receipt: %s: %v", res.body, err)
+	}
+	first := fmt.Sprintf("<Part><PartNumber>1</PartNumber><ETag>%s</ETag></Part>", part.ETag)
+	headers["x-amz-copy-source-if-match"] = `"stale"`
+	p.request("PUT", path+"&partNumber=1", nil, headers, 412)
+	headers["x-amz-copy-source-if-match"] = put.header.Get("ETag")
+	for _, invalid := range []string{"bytes=6000000-6000001", "bytes=3-6000000", "bytes=5-3", "bytes=-3", "bytes=3-", "bytes=0-1,3-4"} {
+		headers["x-amz-copy-source-range"] = invalid
+		p.request("PUT", path+"&partNumber=1", nil, headers, 416)
+	}
+	headers["x-amz-copy-source-range"] = "bytes=5242883-5999999"
+	res = p.request("PUT", path+"&partNumber=2", nil, headers, 200)
+	if err := xml.Unmarshal(res.body, &part); err != nil {
+		t.Fatal(err)
+	}
+	second := fmt.Sprintf("<Part><PartNumber>2</PartNumber><ETag>%s</ETag></Part>", part.ETag)
+	p.request("POST", path, completion(first, second), nil, 200)
+	got := p.request("GET", "/uploads/copied", nil, nil, 200)
+	if !bytes.Equal(got.body, source[3:]) {
+		t.Fatal("copy changed the retained byte range")
+	}
+	p.request("PUT", path+"&partNumber=2", nil, headers, 404)
+}
+
+func TestUploadPartCopyVersionChecksumAndAbort(t *testing.T) {
+	p := newProbe(t)
+	p.request("PUT", "/uploads?versioning", []byte(`<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>`), nil, 200)
+	original := []byte("retained original version")
+	source := p.request("PUT", "/uploads/versioned", original, nil, 200)
+	version := source.header.Get("x-amz-version-id")
+	if version == "" {
+		t.Fatal("source has no version")
+	}
+	p.request("PUT", "/uploads/versioned", []byte("replacement"), nil, 200)
+	path := p.start("version-copy", true)
+	headers := map[string]string{"x-amz-copy-source": "/uploads/versioned?versionId=" + version, "x-amz-copy-source-if-match": source.header.Get("ETag")}
+	res := p.request("PUT", path+"&partNumber=1", nil, headers, 200)
+	var part struct {
+		ETag           string
+		ChecksumSHA256 string
+	}
+	if err := xml.Unmarshal(res.body, &part); err != nil {
+		t.Fatal(err)
+	}
+	if part.ChecksumSHA256 != sum(original) {
+		t.Fatal("copied version checksum differs")
+	}
+	headers["x-amz-copy-source-if-none-match"] = source.header.Get("ETag")
+	p.request("PUT", path+"&partNumber=1", nil, headers, 412)
+	delete(headers, "x-amz-copy-source-if-none-match")
+	headers["x-amz-copy-source-if-modified-since"] = "Sat, 31 Oct 2026 00:00:00 GMT"
+	p.request("PUT", path+"&partNumber=1", nil, headers, 501)
+	delete(headers, "x-amz-copy-source-if-modified-since")
+	descriptor := fmt.Sprintf("<Part><PartNumber>1</PartNumber><ETag>%s</ETag><ChecksumSHA256>%s</ChecksumSHA256></Part>", part.ETag, part.ChecksumSHA256)
+	digest := sha256.Sum256(original)
+	composite := sum(digest[:]) + "-1"
+	p.request("POST", path, completion(descriptor), map[string]string{"x-amz-checksum-type": "COMPOSITE", "x-amz-checksum-sha256": composite}, 200)
+	got := p.request("GET", "/uploads/version-copy", nil, nil, 200)
+	if !bytes.Equal(got.body, original) || got.header.Get("x-amz-checksum-sha256") != composite {
+		t.Fatal("versioned copy bytes or composite receipt changed")
+	}
+	path = p.start("aborted-copy", false)
+	p.request("DELETE", path, nil, nil, 204)
+	p.request("PUT", path+"&partNumber=1", nil, headers, 404)
+	headers["x-amz-copy-source"] = "/uploads/missing"
+	path = p.start("missing-copy", false)
+	p.request("PUT", path+"&partNumber=1", nil, headers, 404)
+	p.request("DELETE", path, nil, nil, 204)
+}

package/dist/components/s3-runtime/multipart.patch

@@ -239,3 +239,114 @@
  			// new metadata overwrites old but keep the rest
  			// TODO: check how metadata can be deleted?!
  			if _, ok := meta[k]; !ok {
+--- a/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
++++ b/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
+@@ -960,6 +960,10 @@
+ 		return ErrInvalidPart
+ 	}
+ 
++	if r.Header.Get("x-amz-copy-source") != "" {
++		return g.copyMultipartUploadPart(bucket, object, uploadID, int(partNumber), w, r)
++	}
++
+ 	size, err := strconv.ParseInt(r.Header.Get("Content-Length"), 10, 64)
+ 	if err != nil || size <= 0 {
+ 		return ErrMissingContentLength
+--- /dev/null
++++ b/vendor/github.com/johannesboyne/gofakes3/upload_part_copy.go
+@@ -0,0 +1,95 @@
++package gofakes3
++
++import (
++	"crypto/sha256"
++	"encoding/base64"
++	"encoding/xml"
++	"io"
++	"net/http"
++	"net/url"
++	"strings"
++)
++
++// Copy from one backend snapshot: a separate HEAD followed by GET could race
++// an overwrite and copy bytes that no longer match the caller's condition.
++func (g *GoFakeS3) copyMultipartUploadPart(bucket, object string, uploadID UploadID, number int, w http.ResponseWriter, r *http.Request) error {
++	source, query, _ := strings.Cut(r.Header.Get("x-amz-copy-source"), "?")
++	source, err := url.PathUnescape(source)
++	if err != nil {
++		return ErrInvalidArgument
++	}
++	parts := strings.SplitN(strings.TrimPrefix(source, "/"), "/", 2)
++	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
++		return ErrInvalidArgument
++	}
++	params, err := url.ParseQuery(query)
++	if err != nil {
++		return ErrInvalidArgument
++	}
++	for key := range params {
++		if key != "versionId" {
++			return ErrInvalidArgument
++		}
++	}
++	// Do not silently ignore conditions this compatibility subset cannot apply.
++	for _, key := range []string{"x-amz-copy-source-if-modified-since", "x-amz-copy-source-if-unmodified-since"} {
++		if r.Header.Get(key) != "" {
++			return ErrNotImplemented
++		}
++	}
++	var src *Object
++	if version := params.Get("versionId"); version != "" {
++		if g.versioned == nil {
++			return ErrNotImplemented
++		}
++		src, err = g.versioned.GetObjectVersion(parts[0], parts[1], VersionID(version), nil)
++	} else {
++		src, err = g.storage.GetObject(parts[0], parts[1], nil)
++	}
++	if err != nil {
++		return err
++	}
++	if src == nil || src.Contents == nil {
++		return ErrInternal
++	}
++	defer src.Contents.Close()
++	if src.IsDeleteMarker {
++		return ErrInvalidArgument
++	}
++	tag := FormatETag(src.Hash)
++	if expected := r.Header.Get("x-amz-copy-source-if-match"); expected != "" && expected != tag {
++		return ErrPreconditionFailed
++	}
++	if expected := r.Header.Get("x-amz-copy-source-if-none-match"); expected != "" && expected == tag {
++		return ErrPreconditionFailed
++	}
++	start, size := int64(0), src.Size
++	if value := r.Header.Get("x-amz-copy-source-range"); value != "" {
++		span, err := parseRangeHeader(value)
++		if err != nil || span == nil || span.FromEnd || span.End == RangeNoEnd || span.End >= src.Size {
++			return ErrInvalidRange
++		}
++		start, size = span.Start, span.End-span.Start+1
++	}
++	if size <= 0 {
++		return ErrInvalidRange
++	}
++	if _, err := io.CopyN(io.Discard, src.Contents, start); err != nil {
++		return err
++	}
++	digest := sha256.New()
++	body := io.TeeReader(io.LimitReader(src.Contents, size), digest)
++	etag, err := g.uploader.UploadPart(bucket, object, uploadID, number, size, body)
++	if err != nil {
++		return err
++	}
++	if src.VersionID != "" {
++		w.Header().Set("x-amz-copy-source-version-id", string(src.VersionID))
++	}
++	return g.xmlEncoder(w).Encode(struct {
++		XMLName        xml.Name    `xml:"CopyPartResult"`
++		ETag           string      `xml:"ETag"`
++		LastModified   ContentTime `xml:"LastModified"`
++		ChecksumSHA256 string      `xml:"ChecksumSHA256"`
++	}{ETag: etag, LastModified: NewContentTime(g.timeSource.Now()), ChecksumSHA256: base64.StdEncoding.EncodeToString(digest.Sum(nil))})
++}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.131.7",
+  "version": "0.131.8",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/s3-runtime/README.md

@@ -22,7 +22,10 @@ each part and its ordering, and the composite checksum survives HEAD/GET for
 reconciliation. Completion conditions use the backend's atomic conditional write.
 Overwriting an object does not inherit the previous object's checksum metadata.
 This patch supports SHA256/COMPOSITE; it does not implement every S3 checksum
-algorithm or streaming checksum trailers.
+algorithm or streaming checksum trailers. It also supports UploadPartCopy from
+one backend snapshot, including closed byte ranges, exact ETag conditions,
+version selection and SHA256 part receipts. Date-based copy conditions are
+explicitly unsupported (501), rather than silently ignored.
 
 Run `./test.sh` from this directory to exercise real HTTP requests against the
 same patched sources used in the image, including corrupt retries, conditional

package/src/components/s3-runtime/main_test.go

@@ -197,3 +197,86 @@ func TestMultipartAbortAndLegacyUpload(t *testing.T) {
 		t.Fatal("legacy multipart changed")
 	}
 }
+
+func TestUploadPartCopyRetainsExactSourceAndRejectsStaleRetry(t *testing.T) {
+	p := newProbe(t)
+	source := bytes.Repeat([]byte("0123456789"), 600000)
+	put := p.request("PUT", "/uploads/staging%20%2B%25.csv", source, nil, 200)
+	path := p.start("copied", false)
+	headers := map[string]string{"x-amz-copy-source": "/uploads/staging%20%2B%25.csv", "x-amz-copy-source-if-match": put.header.Get("ETag"), "x-amz-copy-source-range": "bytes=3-5242882"}
+	res := p.request("PUT", path+"&partNumber=1", nil, headers, 200)
+	var part struct {
+		XMLName      xml.Name
+		ETag         string
+		LastModified string
+	}
+	if err := xml.Unmarshal(res.body, &part); err != nil || part.XMLName.Local != "CopyPartResult" || part.ETag == "" || part.LastModified == "" {
+		t.Fatalf("copy part receipt: %s: %v", res.body, err)
+	}
+	first := fmt.Sprintf("<Part><PartNumber>1</PartNumber><ETag>%s</ETag></Part>", part.ETag)
+	headers["x-amz-copy-source-if-match"] = `"stale"`
+	p.request("PUT", path+"&partNumber=1", nil, headers, 412)
+	headers["x-amz-copy-source-if-match"] = put.header.Get("ETag")
+	for _, invalid := range []string{"bytes=6000000-6000001", "bytes=3-6000000", "bytes=5-3", "bytes=-3", "bytes=3-", "bytes=0-1,3-4"} {
+		headers["x-amz-copy-source-range"] = invalid
+		p.request("PUT", path+"&partNumber=1", nil, headers, 416)
+	}
+	headers["x-amz-copy-source-range"] = "bytes=5242883-5999999"
+	res = p.request("PUT", path+"&partNumber=2", nil, headers, 200)
+	if err := xml.Unmarshal(res.body, &part); err != nil {
+		t.Fatal(err)
+	}
+	second := fmt.Sprintf("<Part><PartNumber>2</PartNumber><ETag>%s</ETag></Part>", part.ETag)
+	p.request("POST", path, completion(first, second), nil, 200)
+	got := p.request("GET", "/uploads/copied", nil, nil, 200)
+	if !bytes.Equal(got.body, source[3:]) {
+		t.Fatal("copy changed the retained byte range")
+	}
+	p.request("PUT", path+"&partNumber=2", nil, headers, 404)
+}
+
+func TestUploadPartCopyVersionChecksumAndAbort(t *testing.T) {
+	p := newProbe(t)
+	p.request("PUT", "/uploads?versioning", []byte(`<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>`), nil, 200)
+	original := []byte("retained original version")
+	source := p.request("PUT", "/uploads/versioned", original, nil, 200)
+	version := source.header.Get("x-amz-version-id")
+	if version == "" {
+		t.Fatal("source has no version")
+	}
+	p.request("PUT", "/uploads/versioned", []byte("replacement"), nil, 200)
+	path := p.start("version-copy", true)
+	headers := map[string]string{"x-amz-copy-source": "/uploads/versioned?versionId=" + version, "x-amz-copy-source-if-match": source.header.Get("ETag")}
+	res := p.request("PUT", path+"&partNumber=1", nil, headers, 200)
+	var part struct {
+		ETag           string
+		ChecksumSHA256 string
+	}
+	if err := xml.Unmarshal(res.body, &part); err != nil {
+		t.Fatal(err)
+	}
+	if part.ChecksumSHA256 != sum(original) {
+		t.Fatal("copied version checksum differs")
+	}
+	headers["x-amz-copy-source-if-none-match"] = source.header.Get("ETag")
+	p.request("PUT", path+"&partNumber=1", nil, headers, 412)
+	delete(headers, "x-amz-copy-source-if-none-match")
+	headers["x-amz-copy-source-if-modified-since"] = "Sat, 31 Oct 2026 00:00:00 GMT"
+	p.request("PUT", path+"&partNumber=1", nil, headers, 501)
+	delete(headers, "x-amz-copy-source-if-modified-since")
+	descriptor := fmt.Sprintf("<Part><PartNumber>1</PartNumber><ETag>%s</ETag><ChecksumSHA256>%s</ChecksumSHA256></Part>", part.ETag, part.ChecksumSHA256)
+	digest := sha256.Sum256(original)
+	composite := sum(digest[:]) + "-1"
+	p.request("POST", path, completion(descriptor), map[string]string{"x-amz-checksum-type": "COMPOSITE", "x-amz-checksum-sha256": composite}, 200)
+	got := p.request("GET", "/uploads/version-copy", nil, nil, 200)
+	if !bytes.Equal(got.body, original) || got.header.Get("x-amz-checksum-sha256") != composite {
+		t.Fatal("versioned copy bytes or composite receipt changed")
+	}
+	path = p.start("aborted-copy", false)
+	p.request("DELETE", path, nil, nil, 204)
+	p.request("PUT", path+"&partNumber=1", nil, headers, 404)
+	headers["x-amz-copy-source"] = "/uploads/missing"
+	path = p.start("missing-copy", false)
+	p.request("PUT", path+"&partNumber=1", nil, headers, 404)
+	p.request("DELETE", path, nil, nil, 204)
+}

package/src/components/s3-runtime/multipart.patch

@@ -239,3 +239,114 @@
  			// new metadata overwrites old but keep the rest
  			// TODO: check how metadata can be deleted?!
  			if _, ok := meta[k]; !ok {
+--- a/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
++++ b/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
+@@ -960,6 +960,10 @@
+ 		return ErrInvalidPart
+ 	}
+ 
++	if r.Header.Get("x-amz-copy-source") != "" {
++		return g.copyMultipartUploadPart(bucket, object, uploadID, int(partNumber), w, r)
++	}
++
+ 	size, err := strconv.ParseInt(r.Header.Get("Content-Length"), 10, 64)
+ 	if err != nil || size <= 0 {
+ 		return ErrMissingContentLength
+--- /dev/null
++++ b/vendor/github.com/johannesboyne/gofakes3/upload_part_copy.go
+@@ -0,0 +1,95 @@
++package gofakes3
++
++import (
++	"crypto/sha256"
++	"encoding/base64"
++	"encoding/xml"
++	"io"
++	"net/http"
++	"net/url"
++	"strings"
++)
++
++// Copy from one backend snapshot: a separate HEAD followed by GET could race
++// an overwrite and copy bytes that no longer match the caller's condition.
++func (g *GoFakeS3) copyMultipartUploadPart(bucket, object string, uploadID UploadID, number int, w http.ResponseWriter, r *http.Request) error {
++	source, query, _ := strings.Cut(r.Header.Get("x-amz-copy-source"), "?")
++	source, err := url.PathUnescape(source)
++	if err != nil {
++		return ErrInvalidArgument
++	}
++	parts := strings.SplitN(strings.TrimPrefix(source, "/"), "/", 2)
++	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
++		return ErrInvalidArgument
++	}
++	params, err := url.ParseQuery(query)
++	if err != nil {
++		return ErrInvalidArgument
++	}
++	for key := range params {
++		if key != "versionId" {
++			return ErrInvalidArgument
++		}
++	}
++	// Do not silently ignore conditions this compatibility subset cannot apply.
++	for _, key := range []string{"x-amz-copy-source-if-modified-since", "x-amz-copy-source-if-unmodified-since"} {
++		if r.Header.Get(key) != "" {
++			return ErrNotImplemented
++		}
++	}
++	var src *Object
++	if version := params.Get("versionId"); version != "" {
++		if g.versioned == nil {
++			return ErrNotImplemented
++		}
++		src, err = g.versioned.GetObjectVersion(parts[0], parts[1], VersionID(version), nil)
++	} else {
++		src, err = g.storage.GetObject(parts[0], parts[1], nil)
++	}
++	if err != nil {
++		return err
++	}
++	if src == nil || src.Contents == nil {
++		return ErrInternal
++	}
++	defer src.Contents.Close()
++	if src.IsDeleteMarker {
++		return ErrInvalidArgument
++	}
++	tag := FormatETag(src.Hash)
++	if expected := r.Header.Get("x-amz-copy-source-if-match"); expected != "" && expected != tag {
++		return ErrPreconditionFailed
++	}
++	if expected := r.Header.Get("x-amz-copy-source-if-none-match"); expected != "" && expected == tag {
++		return ErrPreconditionFailed
++	}
++	start, size := int64(0), src.Size
++	if value := r.Header.Get("x-amz-copy-source-range"); value != "" {
++		span, err := parseRangeHeader(value)
++		if err != nil || span == nil || span.FromEnd || span.End == RangeNoEnd || span.End >= src.Size {
++			return ErrInvalidRange
++		}
++		start, size = span.Start, span.End-span.Start+1
++	}
++	if size <= 0 {
++		return ErrInvalidRange
++	}
++	if _, err := io.CopyN(io.Discard, src.Contents, start); err != nil {
++		return err
++	}
++	digest := sha256.New()
++	body := io.TeeReader(io.LimitReader(src.Contents, size), digest)
++	etag, err := g.uploader.UploadPart(bucket, object, uploadID, number, size, body)
++	if err != nil {
++		return err
++	}
++	if src.VersionID != "" {
++		w.Header().Set("x-amz-copy-source-version-id", string(src.VersionID))
++	}
++	return g.xmlEncoder(w).Encode(struct {
++		XMLName        xml.Name    `xml:"CopyPartResult"`
++		ETag           string      `xml:"ETag"`
++		LastModified   ContentTime `xml:"LastModified"`
++		ChecksumSHA256 string      `xml:"ChecksumSHA256"`
++	}{ETag: etag, LastModified: NewContentTime(g.timeSource.Now()), ChecksumSHA256: base64.StdEncoding.EncodeToString(digest.Sum(nil))})
++}