@usehenri/s3 0.0.0 → 1.2.0

package/CHANGELOG.md

@@ -0,0 +1,61 @@
+# @usehenri/s3
+
+## 1.2.0
+
+### Minor Changes
+
+- [#407](https://github.com/usehenri/henri/pull/407) [`de1c1e0`](https://github.com/usehenri/henri/commit/de1c1e02ed83d13dcfeb8e44012f309eb663f03e) Thanks [@reel](https://github.com/reel)! - Uploads that survive a second machine: an object store, signed urls and variants
+  
+  `@usehenri/uploads` shipped one backend — the local disk — and said `url()`
+  was allowed to answer `null` forever. Two application processes on two
+  machines therefore did not share uploads at all, a link to a stored file
+  meant writing a controller and a route for every one of them, and a
+  thumbnail meant leaving the framework entirely. All three are closed here.
+  
+  **`@usehenri/s3`, a new package.** `config.uploads.storage` takes an object
+  now (`{ "adapter": "s3", "bucket": "…", "region": "…" }`, the shape
+  `config.shared` and a store already have) and `s3` resolves the package from
+  the application. One backend speaks to S3, R2, Spaces, MinIO and GCS's
+  interoperability mode; what tells them apart is an endpoint and a region. It
+  carries no dependency but `debug` — AWS Signature Version 4 is two hundred
+  lines of `node:crypto`, checked against the vectors AWS publishes. Every
+  safety property survives the move: the key is generated and refused if it is
+  not, the type still comes from the bytes and becomes the object's
+  `Content-Type`, the original name is metadata, and a part still lands on a
+  private local file that only `store()` promotes.
+  
+  **Signed urls.** `henri.uploads.url(record, { expiresIn, disposition,
+  filename, type })` is one call whatever the backend: the provider's own
+  signature on an object store, henri's own (an HMAC over the key, the expiry,
+  the disposition, the name and the type, verified by a route it mounts) on
+  the local disk. Neither can be edited to name another object, widened, or
+  replayed past its expiry. Until then a signed url **is** a bearer
+  capability, so `config.uploads.urls` is off by default and `url()` refuses
+  with `HENRI_UPLOAD_URLS_DISABLED` rather than answering `null`.
+  `uploads.urls.cdn` puts a cache in front of henri's own, whose signature
+  deliberately does not cover the host.
+  
+  **Variants.** `config.uploads.variants` declares them by name and
+  `henri.uploads.variant(record, 'thumb')` answers a record like any other.
+  The key is the source's plus a digest of the variant's terms, so the work
+  happens once, on demand, and never in the request that uploaded. `sharp` is
+  an **optional peer dependency** resolved from the application: without it
+  `variant()` refuses with `HENRI_UPLOAD_NO_IMAGE_LIBRARY` and the install
+  line rather than quietly answering the original, and `henri doctor` reports
+  it. A name never comes from a request, an SVG is refused, a source is
+  bounded at fifty megapixels and one frame, no metadata is carried forward,
+  and what the resize produced is sniffed before it is stored.
+  
+  New configuration: `uploads.storage` in its object form, `uploads.urls`
+  (`expiresIn`, `path`, `cdn`) and `uploads.variants`. New codes:
+  `HENRI_UPLOAD_NO_IMAGE_LIBRARY`, `HENRI_UPLOAD_STORAGE_FAILED`,
+  `HENRI_UPLOAD_STORAGE_MISCONFIGURED`, `HENRI_UPLOAD_URLS_DISABLED`,
+  `HENRI_UPLOAD_URL_EXPIRED`, `HENRI_UPLOAD_URL_INVALID`,
+  `HENRI_UPLOAD_VARIANT_FAILED`, `HENRI_UPLOAD_VARIANT_UNKNOWN`,
+  `HENRI_UPLOAD_VARIANT_UNSUPPORTED`. `henri doctor` asks for
+  `@usehenri/s3` and `sharp` when the configuration names them.
+
+### Patch Changes
+
+- Updated dependencies [[`68fe3af`](https://github.com/usehenri/henri/commit/68fe3afa8bdaa6d9a95d0e60858fd4abe28028b2), [`1a86acb`](https://github.com/usehenri/henri/commit/1a86acbf15e4a43e5fb81277bb22e101c06e77a4), [`de1c1e0`](https://github.com/usehenri/henri/commit/de1c1e02ed83d13dcfeb8e44012f309eb663f03e)]:
+  - @usehenri/uploads@1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016-present, Félix-Antoine Paradis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,10 @@
+<!-- generated by scripts/prepublish.js -->
+
 # @usehenri/s3
 
-Placeholder release. Install a real version: see https://usehenri.io.
+Henri uploads on an object store: one S3-compatible backend for S3, R2, Spaces and MinIO, with presigned urls.
+
+Part of [henri](https://usehenri.io), the Rails-like React framework for
+Node.js: [documentation](https://usehenri.io),
+[source and issues](https://github.com/usehenri/henri),
+[changelog](https://github.com/usehenri/henri/blob/master/packages/s3/CHANGELOG.md).

package/index.js

@@ -0,0 +1,36 @@
+/**
+ * `@usehenri/s3`: uploads on an object store.
+ *
+ * ```json
+ * {
+ *   "uploads": {
+ *     "storage": {
+ *       "adapter": "s3",
+ *       "bucket": "henri-uploads",
+ *       "region": "us-east-1"
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * `@usehenri/uploads` resolves this package from the application the way
+ * core resolves `@usehenri/redis` for `config.shared`, and constructs the
+ * default export with the block. One backend speaks to S3, R2, Spaces,
+ * MinIO and GCS's interoperability mode: what tells them apart is the
+ * endpoint and the region.
+ *
+ * See https://usehenri.io/guides/uploads/
+ */
+const S3Storage = require('./src/storage');
+
+const { S3Client } = require('./src/client');
+const { StorageError, coded } = require('./src/errors');
+const { presign, sign } = require('./src/signature');
+
+module.exports = S3Storage;
+module.exports.S3Client = S3Client;
+module.exports.S3Storage = S3Storage;
+module.exports.StorageError = StorageError;
+module.exports.coded = coded;
+module.exports.presign = presign;
+module.exports.sign = sign;

package/package.json

@@ -1,15 +1,47 @@
 {
-  "description": "Placeholder creating @usehenri/s3 on npm; the first real version is published by the henri release workflow",
-  "homepage": "https://usehenri.io",
-  "license": "MIT",
   "name": "@usehenri/s3",
-  "publishConfig": {
-    "access": "public"
-  },
+  "version": "1.2.0",
+  "description": "henri uploads on an object store: one S3-compatible backend for S3, R2, Spaces and MinIO, with presigned urls",
+  "license": "MIT",
+  "author": "Felix-Antoine Paradis",
+  "homepage": "https://usehenri.io",
   "repository": {
-    "directory": "packages/s3",
     "type": "git",
-    "url": "git+https://github.com/usehenri/henri.git"
+    "url": "git+https://github.com/usehenri/henri.git",
+    "directory": "packages/s3"
+  },
+  "bugs": {
+    "url": "https://github.com/usehenri/henri/issues"
+  },
+  "keywords": [
+    "henri",
+    "uploads",
+    "s3",
+    "storage",
+    "r2",
+    "minio",
+    "presigned"
+  ],
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "src",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "debug": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@usehenri/uploads": "^1.2.0"
   },
-  "version": "0.0.0"
-}
+  "devDependencies": {
+    "@usehenri/uploads": "^1.2.0"
+  }
+}