@ya-accelerators/web-backend-framework 0.0.61 → 0.0.62

package/dist/s3/index.d.ts

@@ -1,4 +1,34 @@
 import { S3Client } from '@aws-sdk/client-s3';
+export type ObjectLockMode = 'COMPLIANCE' | 'GOVERNANCE';
+export type ObjectVersion = {
+    versionId: string;
+    isLatest: boolean;
+    lastModified?: Date;
+    size?: number;
+};
 export declare const s3: {
     client: () => S3Client;
+    putObjectWorm: (params: {
+        bucket: string;
+        key: string;
+        body: Buffer | Uint8Array | string;
+        mode: ObjectLockMode;
+        retainUntil: Date;
+        contentType?: string;
+    }) => Promise<{
+        versionId: string;
+    }>;
+    listObjectVersions: (params: {
+        bucket: string;
+        key: string;
+    }) => Promise<ObjectVersion[]>;
+    deleteOrphanVersions: (params: {
+        bucket: string;
+        key: string;
+        keepVersionIds: string[];
+        governanceBypass?: boolean;
+    }) => Promise<{
+        deletedVersionIds: string[];
+        skippedVersionIds: string[];
+    }>;
 };

package/dist/s3/index.js

@@ -1,20 +1,95 @@
-import { S3Client } from '@aws-sdk/client-s3';
+import { DeleteObjectCommand, ListObjectVersionsCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import { defaultEnv } from "../env.js";
 let _client;
-export const s3 = {
-    client: () => {
-        if (!_client) {
-            const endpoint = defaultEnv.LOCAL_S3_ENDPOINT;
-            _client = endpoint
-                ? new S3Client({
-                    region: defaultEnv.AWS_REGION,
-                    endpoint,
-                    credentials: { accessKeyId: 'minioadmin', secretAccessKey: 'minioadmin123' },
-                    forcePathStyle: true,
-                })
-                : new S3Client();
+const client = () => {
+    if (!_client) {
+        const endpoint = defaultEnv.LOCAL_S3_ENDPOINT;
+        _client = endpoint
+            ? new S3Client({
+                region: defaultEnv.AWS_REGION,
+                endpoint,
+                credentials: { accessKeyId: 'minioadmin', secretAccessKey: 'minioadmin123' },
+                forcePathStyle: true,
+            })
+            : new S3Client();
+    }
+    return _client;
+};
+// Seal an object under Object Lock retention. Returns the S3 version-id the caller records in its
+// own index. Throws when the bucket returns no VersionId (versioning / Object Lock not enabled).
+const putObjectWorm = async (params) => {
+    const result = await client().send(new PutObjectCommand({
+        Bucket: params.bucket,
+        Key: params.key,
+        Body: params.body,
+        ContentType: params.contentType,
+        ObjectLockMode: params.mode,
+        ObjectLockRetainUntilDate: params.retainUntil,
+    }));
+    if (!result.VersionId) {
+        throw new Error(`putObjectWorm: no VersionId for ${params.bucket}/${params.key} (bucket needs versioning + Object Lock)`);
+    }
+    return { versionId: result.VersionId };
+};
+// Enumerate every version of a single key (evidence audit + orphan detection). Paginates fully.
+const listObjectVersions = async (params) => {
+    const versions = [];
+    let keyMarker;
+    let versionIdMarker;
+    do {
+        const result = await client().send(new ListObjectVersionsCommand({
+            Bucket: params.bucket,
+            Prefix: params.key,
+            KeyMarker: keyMarker,
+            VersionIdMarker: versionIdMarker,
+        }));
+        for (const version of result.Versions ?? []) {
+            if (version.Key === params.key && version.VersionId) {
+                versions.push({
+                    versionId: version.VersionId,
+                    isLatest: version.IsLatest ?? false,
+                    lastModified: version.LastModified,
+                    size: version.Size,
+                });
+            }
+        }
+        keyMarker = result.IsTruncated ? result.NextKeyMarker : undefined;
+        versionIdMarker = result.IsTruncated ? result.NextVersionIdMarker : undefined;
+    } while (keyMarker || versionIdMarker);
+    return versions;
+};
+// Delete versions of a key no longer referenced (`keepVersionIds` = the version-ids still indexed).
+// A version still under retention cannot be deleted: S3 rejects it with `AccessDenied`, and it is
+// returned in `skippedVersionIds` rather than failing the whole sweep. GOVERNANCE-mode versions
+// under retention are deletable only with `governanceBypass` (requires `s3:BypassGovernanceRetention`).
+// Any other error propagates — only the retention denial is caught.
+const deleteOrphanVersions = async (params) => {
+    const keep = new Set(params.keepVersionIds);
+    const deletedVersionIds = [];
+    const skippedVersionIds = [];
+    for (const version of await listObjectVersions({ bucket: params.bucket, key: params.key })) {
+        if (keep.has(version.versionId)) {
+            continue;
+        }
+        try {
+            await client().send(new DeleteObjectCommand({
+                Bucket: params.bucket,
+                Key: params.key,
+                VersionId: version.versionId,
+                BypassGovernanceRetention: params.governanceBypass,
+            }));
+            deletedVersionIds.push(version.versionId);
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === 'AccessDenied') {
+                skippedVersionIds.push(version.versionId);
+            }
+            else {
+                throw error;
+            }
         }
-        return _client;
-    },
+    }
+    return { deletedVersionIds, skippedVersionIds };
 };
+export const s3 = { client, putObjectWorm, listObjectVersions, deleteOrphanVersions };
 //# sourceMappingURL=index.js.map

package/dist/s3/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/s3/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtC,IAAI,OAA6B,CAAA;AAEjC,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,MAAM,EAAE,GAAG,EAAE;QACX,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAA;YAC7C,OAAO,GAAG,QAAQ;gBAChB,CAAC,CAAC,IAAI,QAAQ,CAAC;oBACX,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ;oBACR,WAAW,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE;oBAC5E,cAAc,EAAE,IAAI;iBACrB,CAAC;gBACJ,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAA;QACpB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/s3/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE/G,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtC,IAAI,OAA6B,CAAA;AAEjC,MAAM,MAAM,GAAG,GAAa,EAAE;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAA;QAC7C,OAAO,GAAG,QAAQ;YAChB,CAAC,CAAC,IAAI,QAAQ,CAAC;gBACX,MAAM,EAAE,UAAU,CAAC,UAAU;gBAC7B,QAAQ;gBACR,WAAW,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE;gBAC5E,cAAc,EAAE,IAAI;aACrB,CAAC;YACJ,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAA;IACpB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAUD,kGAAkG;AAClG,iGAAiG;AACjG,MAAM,aAAa,GAAG,KAAK,EAAE,MAO5B,EAAkC,EAAE;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAChC,IAAI,gBAAgB,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,IAAI;QAC3B,yBAAyB,EAAE,MAAM,CAAC,WAAW;KAC9C,CAAC,CACH,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,0CAA0C,CACzG,CAAA;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;AACxC,CAAC,CAAA;AAED,gGAAgG;AAChG,MAAM,kBAAkB,GAAG,KAAK,EAAE,MAAuC,EAA4B,EAAE;IACrG,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,IAAI,SAA6B,CAAA;IACjC,IAAI,eAAmC,CAAA;IACvC,GAAG,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAChC,IAAI,yBAAyB,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,eAAe;SACjC,CAAC,CACH,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;oBACnC,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,CAAC,QAAQ,SAAS,IAAI,eAAe,EAAC;IACtC,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,oGAAoG;AACpG,kGAAkG;AAClG,gGAAgG;AAChG,wGAAwG;AACxG,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,KAAK,EAAE,MAKnC,EAAyE,EAAE;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAC3C,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3F,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,CAAC,IAAI,CACjB,IAAI,mBAAmB,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,yBAAyB,EAAE,MAAM,CAAC,gBAAgB;aACnD,CAAC,CACH,CAAA;YACD,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5D,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC3C,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAA;AACjD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ya-accelerators/web-backend-framework",
-  "version": "0.0.61",
+  "version": "0.0.62",
   "type": "module",
   "description": "",
   "author": "YA Technologies OÜ",