@xcelsior/storage-api 1.0.0 → 1.0.1

package/cdk.context.json

@@ -1,6 +1,6 @@
 {
-  "hosted-zone:account=192933325589:domainName=xcelsior.co:region=ap-southeast-2": {
-    "Id": "/hostedzone/Z08595403217R035ZUO3M",
-    "Name": "xcelsior.co."
-  }
+    "hosted-zone:account=192933325589:domainName=xcelsior.co:region=ap-southeast-2": {
+        "Id": "/hostedzone/Z08595403217R035ZUO3M",
+        "Name": "xcelsior.co."
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xcelsior/storage-api",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "files": [
     "packages/**",
@@ -21,8 +21,8 @@
     "@tsconfig/node18": "^18.2.2",
     "@types/node": "^20.11.16",
     "@xcelsior/aws": "1.0.6",
-    "@xcelsior/monitoring": "1.0.4",
-    "@xcelsior/lambda-http": "1.0.5"
+    "@xcelsior/lambda-http": "1.0.5",
+    "@xcelsior/monitoring": "1.0.4"
   },
   "scripts": {
     "dev": "sst dev --stage dev --mode basic",

package/stacks/StorageStack.ts

@@ -42,14 +42,7 @@ function requireEnv(name: string): string {
 function buildSecureAccessFunctionCode(signingSecret: string): string {
     const escaped = signingSecret.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
     return `
-function hexToBytes(hex) {
-    var len = hex.length / 2;
-    var out = new Uint8Array(len);
-    for (var i = 0; i < len; i++) {
-        out[i] = parseInt(hex.substring(i * 2, i * 2 + 2), 16);
-    }
-    return out;
-}
+import crypto from 'crypto';
 
 function deny(msg) {
     return {
@@ -60,7 +53,7 @@ function deny(msg) {
     };
 }
 
-async function handler(event) {
+function handler(event) {
     var request = event.request;
     var tokenP  = request.querystring['token'];
 
@@ -69,20 +62,11 @@ async function handler(event) {
     }
 
     try {
-        var key = await crypto.subtle.importKey(
-            'raw',
-            new TextEncoder().encode('${escaped}'),
-            { name: 'HMAC', hash: 'SHA-256' },
-            false,
-            ['verify']
-        );
-        var ok = await crypto.subtle.verify(
-            'HMAC',
-            key,
-            hexToBytes(tokenP.value),
-            new TextEncoder().encode(request.uri)
-        );
-        if (!ok) return deny('Invalid token.');
+        var expected = crypto.createHmac('sha256', '${escaped}')
+            .update(request.uri)
+            .digest('hex');
+
+        if (expected !== tokenP.value) return deny('Invalid token.');
     } catch (_) {
         return deny('Token validation failed.');
     }
@@ -105,6 +89,37 @@ export function StorageStack({ stack }: StackContext) {
     const maxFileSizeMb = Number(process.env.MAX_FILE_SIZE_MB || '100');
     const presignedUrlExpiry = Number(process.env.PRESIGNED_URL_EXPIRY_SECONDS || '300');
 
+    // ── CORS configuration ──────────────────────────────────────────────────
+    // Comma-separated lists; default to permissive values.
+    const corsAllowedOrigins = (process.env.CORS_ALLOWED_ORIGINS || '*')
+        .split(',')
+        .map((s) => s.trim());
+    const corsAllowedHeaders = (process.env.CORS_ALLOWED_HEADERS || '*')
+        .split(',')
+        .map((s) => s.trim());
+    const corsExposedHeaders = (process.env.CORS_EXPOSED_HEADERS || 'ETag')
+        .split(',')
+        .map((s) => s.trim());
+    const corsMaxAge = Number(process.env.CORS_MAX_AGE || '86400');
+
+    const validMethods: Record<string, s3.HttpMethods> = {
+        GET: s3.HttpMethods.GET,
+        PUT: s3.HttpMethods.PUT,
+        POST: s3.HttpMethods.POST,
+        HEAD: s3.HttpMethods.HEAD,
+        DELETE: s3.HttpMethods.DELETE,
+    };
+    const corsAllowedMethods = (process.env.CORS_ALLOWED_METHODS || 'GET,PUT,POST,HEAD')
+        .split(',')
+        .map((m) => {
+            const method = validMethods[m.trim().toUpperCase()];
+            if (!method)
+                throw new Error(
+                    `Invalid CORS method: "${m.trim()}". Valid values: ${Object.keys(validMethods).join(', ')}`
+                );
+            return method;
+        });
+
     // ── Secure-bucket access secret ─────────────────────────────────────────
     const accessSecret = requireEnv('SECURE_STORAGE_ACCESS_SECRET');
 
@@ -126,16 +141,11 @@ export function StorageStack({ stack }: StackContext) {
 
     const sharedCorsRules: s3.CorsRule[] = [
         {
-            allowedOrigins: ['*'],
-            allowedHeaders: ['*'],
-            allowedMethods: [
-                s3.HttpMethods.GET,
-                s3.HttpMethods.PUT,
-                s3.HttpMethods.POST,
-                s3.HttpMethods.HEAD,
-            ],
-            maxAge: 86400, // 1 day
-            exposedHeaders: ['ETag'],
+            allowedOrigins: corsAllowedOrigins,
+            allowedHeaders: corsAllowedHeaders,
+            allowedMethods: corsAllowedMethods,
+            maxAge: corsMaxAge,
+            exposedHeaders: corsExposedHeaders,
         },
     ];