canopycms 0.0.66-int.85 → 0.0.66-int.86

package/dist/assets/factory.js

@@ -18,10 +18,14 @@ export function createAssetStore(media, opts = {}) {
     }
     switch (media.adapter) {
         case 's3':
+            // Every field here is optional on S3AssetStoreOptions, so dropping one is legal
+            // TypeScript and silently reverts a configured behavior to its default. factory.test.ts
+            // asserts each reaches the store for that reason.
             return new S3AssetStore({
                 bucket: media.bucket,
                 region: media.region,
                 maxUploadBytes: media.maxUploadBytes,
+                uploadUrl: media.uploadUrl,
             });
         case 'local': {
             const root = media.directory ?? opts.devAssetsDir;

package/dist/assets/store-s3.d.ts

@@ -11,6 +11,17 @@ export interface S3AssetStoreOptions {
     region: string;
     /** Defaults to 50 MiB. */
     maxUploadBytes?: number;
+    /**
+     * POST target for presigned direct uploads, replacing the S3 REST endpoint the AWS SDK
+     * returns. Absolute http(s) URL or a site-relative path. See `mediaSchema`'s s3 branch for
+     * what this is for; see `isHttpUrlOrSameOriginPath` for what is accepted.
+     *
+     * This is NOT the `publicBaseUrl` that used to live on this interface and was deleted for
+     * looking like the store emitted prefixed URLs. Nothing is joined onto this value and it is
+     * never rendered or stored — it is the endpoint the browser posts to, and it is returned to
+     * the client inside the presign response rather than in the client config.
+     */
+    uploadUrl?: string;
     /** Override the default bucket-prefix layout (rarely needed). */
     prefixes?: AssetPrefixes;
 }
@@ -21,6 +32,7 @@ export declare class S3AssetStore implements AssetStore {
     private readonly client;
     private readonly bucket;
     private readonly maxUploadBytes;
+    private readonly uploadUrl;
     private readonly keys;
     private readonly stagingPrefix;
     constructor(options: S3AssetStoreOptions);
@@ -31,6 +43,14 @@ export declare class S3AssetStore implements AssetStore {
      * artifacts under builds/. The API layer validates too; defense-in-depth.
      */
     private assertStagingKey;
+    /**
+     * `uploadUrl` replaces only the returned `url`. `createPresignedPost` must still run — we
+     * need its `fields`, which carry the policy and signature — and it must still be called
+     * against the real bucket endpoint: a presigned POST's string-to-sign is the base64 policy
+     * alone, so the host is not signed and does not belong in the presign's input. Routing
+     * `uploadUrl` into the S3 client's `endpoint` instead would also mangle it, prepending the
+     * bucket as a subdomain (or, with forcePathStyle, exposing it in the path).
+     */
     beginUpload(input: BeginUploadInput): Promise<StagedUploadTarget>;
     writeStaging(key: string, data: Uint8Array, contentType?: string): Promise<void>;
     readStaging(key: string): Promise<Uint8Array | null>;

package/dist/assets/store-s3.js

@@ -7,6 +7,7 @@
 import { randomUUID } from 'node:crypto';
 import { DeleteObjectCommand, GetObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
 import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+import { isHttpUrlOrSameOriginPath } from '../utils/sanitize-href.js';
 import { ASSET_PREFIXES, createKeyBuilders } from './keys.js';
 const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 const PRESIGN_EXPIRY_SECONDS = 15 * 60;
@@ -23,6 +24,13 @@ export class S3AssetStore {
         this.capabilities = { directUpload: true };
         this.bucket = options.bucket;
         this.maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+        // Re-validated here even though mediaSchema already checks it: this class is exported and
+        // constructible directly, so config validation is not on every path that reaches it. Same
+        // defense-in-depth reasoning as assertStagingKey below.
+        if (options.uploadUrl !== undefined && !isHttpUrlOrSameOriginPath(options.uploadUrl)) {
+            throw new Error(`Invalid uploadUrl: ${options.uploadUrl}`);
+        }
+        this.uploadUrl = options.uploadUrl;
         this.client = new S3Client({ region: options.region });
         const prefixes = options.prefixes ?? ASSET_PREFIXES;
         this.keys = createKeyBuilders(prefixes);
@@ -39,6 +47,14 @@ export class S3AssetStore {
             throw new Error(`Not a staging key: ${key}`);
         }
     }
+    /**
+     * `uploadUrl` replaces only the returned `url`. `createPresignedPost` must still run — we
+     * need its `fields`, which carry the policy and signature — and it must still be called
+     * against the real bucket endpoint: a presigned POST's string-to-sign is the base64 policy
+     * alone, so the host is not signed and does not belong in the presign's input. Routing
+     * `uploadUrl` into the S3 client's `endpoint` instead would also mangle it, prepending the
+     * bucket as a subdomain (or, with forcePathStyle, exposing it in the path).
+     */
     async beginUpload(input) {
         const key = this.keys.stagingKey(randomUUID());
         const { url, fields } = await createPresignedPost(this.client, {
@@ -53,7 +69,13 @@ export class S3AssetStore {
             },
             Expires: PRESIGN_EXPIRY_SECONDS,
         });
-        return { mode: 'direct', url, fields, stagingKey: key, maxBytes: this.maxUploadBytes };
+        return {
+            mode: 'direct',
+            url: this.uploadUrl ?? url,
+            fields,
+            stagingKey: key,
+            maxBytes: this.maxUploadBytes,
+        };
     }
     async writeStaging(key, data, contentType) {
         this.assertStagingKey(key);