firebase-tools 10.2.2 → 10.4.0

package/lib/emulator/storage/apis/firebase.js

@@ -5,34 +5,14 @@ const emulatorLogger_1 = require("../../emulatorLogger");
 const types_1 = require("../../types");
 const zlib_1 = require("zlib");
 const metadata_1 = require("../metadata");
-const mime = require("mime");
 const express_1 = require("express");
 const registry_1 = require("../../registry");
-const types_2 = require("../rules/types");
-async function isPermitted(opts) {
-    if (!opts.ruleset) {
-        emulatorLogger_1.EmulatorLogger.forEmulator(types_1.Emulators.STORAGE).log("WARN", `Can not process SDK request with no loaded ruleset`);
-        return false;
-    }
-    if (["Bearer owner", "Firebase owner"].includes(opts.authorization || "")) {
-        return true;
-    }
-    const { permitted, issues } = await opts.ruleset.verify({
-        method: opts.method,
-        path: opts.path,
-        file: opts.file,
-        token: opts.authorization ? opts.authorization.split(" ")[1] : undefined,
-    });
-    if (issues.exist()) {
-        issues.all.forEach((warningOrError) => {
-            emulatorLogger_1.EmulatorLogger.forEmulator(types_1.Emulators.STORAGE).log("WARN", warningOrError);
-        });
-    }
-    return !!permitted;
-}
+const multipart_1 = require("../multipart");
+const errors_1 = require("../errors");
+const upload_1 = require("../upload");
 function createFirebaseEndpoints(emulator) {
     const firebaseStorageAPI = (0, express_1.Router)();
-    const { storageLayer } = emulator;
+    const { storageLayer, uploadService } = emulator;
     if (process.env.STORAGE_EMULATOR_DEBUG) {
         firebaseStorageAPI.use((req, res, next) => {
             console.log("--------------INCOMING REQUEST--------------");
@@ -72,8 +52,10 @@ function createFirebaseEndpoints(emulator) {
             next();
         });
     }
-    firebaseStorageAPI.use((req, res, next) => {
-        if (!emulator.rules) {
+    firebaseStorageAPI.use(/.*\/b\/(.+?)\/.*/, (req, res, next) => {
+        const bucketId = req.params[0];
+        storageLayer.createBucket(bucketId);
+        if (!emulator.rulesManager.getRuleset(bucketId)) {
             emulatorLogger_1.EmulatorLogger.forEmulator(types_1.Emulators.STORAGE).log("WARN", "Permission denied because no Storage ruleset is currently loaded, check your rules for syntax errors.");
             return res.status(403).json({
                 error: {
@@ -84,355 +66,353 @@ function createFirebaseEndpoints(emulator) {
         }
         next();
     });
-    firebaseStorageAPI.use(/.*\/b\/(.+?)\/.*/, (req, res, next) => {
-        storageLayer.createBucket(req.params[0]);
-        next();
-    });
     firebaseStorageAPI.get("/b/:bucketId/o/:objectId", async (req, res) => {
-        const decodedObjectId = decodeURIComponent(req.params.objectId);
-        const operationPath = ["b", req.params.bucketId, "o", decodedObjectId].join("/");
-        const md = storageLayer.getMetadata(req.params.bucketId, decodedObjectId);
-        const rulesFiles = {};
-        if (md) {
-            rulesFiles.before = md.asRulesResource();
-        }
-        const isPermittedViaHeader = await isPermitted({
-            ruleset: emulator.rules,
-            method: types_2.RulesetOperationMethod.GET,
-            path: operationPath,
-            file: rulesFiles,
-            authorization: req.header("authorization"),
-        });
-        const isPermittedViaToken = req.query.token && md && md.downloadTokens.includes(req.query.token.toString());
-        const isRequestPermitted = isPermittedViaHeader || !!isPermittedViaToken;
-        if (!isRequestPermitted) {
-            res.sendStatus(403);
-            return;
+        var _a;
+        let metadata;
+        let data;
+        try {
+            ({ metadata, data } = await storageLayer.handleGetObject({
+                bucketId: req.params.bucketId,
+                decodedObjectId: decodeURIComponent(req.params.objectId),
+                authorization: req.header("authorization"),
+                downloadToken: (_a = req.query.token) === null || _a === void 0 ? void 0 : _a.toString(),
+            }));
         }
-        if (!md) {
-            res.sendStatus(404);
-            return;
+        catch (err) {
+            if (err instanceof errors_1.NotFoundError) {
+                return res.sendStatus(404);
+            }
+            else if (err instanceof errors_1.ForbiddenError) {
+                return res.status(403).json({
+                    error: {
+                        code: 403,
+                        message: `Permission denied. No READ permission.`,
+                    },
+                });
+            }
+            throw err;
         }
-        let isGZipped = false;
-        if (md.contentEncoding === "gzip") {
-            isGZipped = true;
+        if (!metadata.downloadTokens.length) {
+            metadata.addDownloadToken();
         }
         if (req.query.alt === "media") {
-            let data = storageLayer.getBytes(req.params.bucketId, req.params.objectId);
-            if (!data) {
-                res.sendStatus(404);
-                return;
-            }
+            const isGZipped = metadata.contentEncoding === "gzip";
             if (isGZipped) {
                 data = (0, zlib_1.gunzipSync)(data);
             }
             res.setHeader("Accept-Ranges", "bytes");
-            res.setHeader("Content-Type", md.contentType);
-            setObjectHeaders(res, md, { "Content-Encoding": isGZipped ? "identity" : undefined });
-            const byteRange = [...(req.header("range") || "").split("bytes="), "", ""];
-            const [rangeStart, rangeEnd] = byteRange[1].split("-");
-            if (rangeStart) {
-                const range = {
-                    start: parseInt(rangeStart),
-                    end: rangeEnd ? parseInt(rangeEnd) : data.byteLength,
-                };
-                res.setHeader("Content-Range", `bytes ${range.start}-${range.end - 1}/${data.byteLength}`);
-                res.status(206).end(data.slice(range.start, range.end));
+            res.setHeader("Content-Type", metadata.contentType);
+            setObjectHeaders(res, metadata, { "Content-Encoding": isGZipped ? "identity" : undefined });
+            const byteRange = req.range(data.byteLength, { combine: true });
+            if (Array.isArray(byteRange) && byteRange.type === "bytes" && byteRange.length > 0) {
+                const range = byteRange[0];
+                res.setHeader("Content-Range", `${byteRange.type} ${range.start}-${range.end}/${data.byteLength}`);
+                res.status(206).end(data.slice(range.start, range.end + 1));
             }
             else {
                 res.end(data);
             }
             return;
         }
-        if (!md.downloadTokens.length) {
-            md.addDownloadToken();
-        }
-        res.json(new metadata_1.OutgoingFirebaseMetadata(md));
+        return res.json(new metadata_1.OutgoingFirebaseMetadata(metadata));
     });
-    const handleMetadataUpdate = async (req, res) => {
-        const md = storageLayer.getMetadata(req.params.bucketId, req.params.objectId);
-        if (!md) {
-            res.sendStatus(404);
-            return;
-        }
-        const decodedObjectId = decodeURIComponent(req.params.objectId);
-        const operationPath = ["b", req.params.bucketId, "o", decodedObjectId].join("/");
-        if (!(await isPermitted({
-            ruleset: emulator.rules,
-            method: types_2.RulesetOperationMethod.UPDATE,
-            path: operationPath,
-            authorization: req.header("authorization"),
-            file: {
-                before: md.asRulesResource(),
-                after: md.asRulesResource(req.body),
-            },
-        }))) {
-            return res.status(403).json({
-                error: {
-                    code: 403,
-                    message: `Permission denied. No WRITE permission.`,
-                },
-            });
-        }
-        md.update(req.body);
-        setObjectHeaders(res, md);
-        const outgoingMetadata = new metadata_1.OutgoingFirebaseMetadata(md);
-        res.json(outgoingMetadata);
-        return;
-    };
     firebaseStorageAPI.get("/b/:bucketId/o", async (req, res) => {
-        let maxRes = undefined;
-        if (req.query.maxResults) {
-            maxRes = +req.query.maxResults.toString();
-        }
-        const delimiter = req.query.delimiter ? req.query.delimiter.toString() : "/";
-        const pageToken = req.query.pageToken ? req.query.pageToken.toString() : undefined;
-        const prefix = req.query.prefix ? req.query.prefix.toString() : "";
-        const operationPath = ["b", req.params.bucketId, "o", prefix].join("/");
-        if (!(await isPermitted({
-            ruleset: emulator.rules,
-            method: types_2.RulesetOperationMethod.LIST,
-            path: operationPath,
-            file: {},
-            authorization: req.header("authorization"),
-        }))) {
-            return res.status(403).json({
-                error: {
-                    code: 403,
-                    message: `Permission denied. No LIST permission.`,
-                },
+        var _a, _b;
+        const maxResults = (_a = req.query.maxResults) === null || _a === void 0 ? void 0 : _a.toString();
+        let response;
+        try {
+            response = await storageLayer.handleListObjects({
+                bucketId: req.params.bucketId,
+                prefix: req.query.prefix ? req.query.prefix.toString() : "",
+                delimiter: req.query.delimiter ? req.query.delimiter.toString() : "",
+                pageToken: (_b = req.query.pageToken) === null || _b === void 0 ? void 0 : _b.toString(),
+                maxResults: maxResults ? +maxResults : undefined,
+                authorization: req.header("authorization"),
             });
         }
-        res.json(storageLayer.listItemsAndPrefixes(req.params.bucketId, prefix, delimiter, pageToken, maxRes));
-    });
-    const handleUpload = async (req, res) => {
-        if (req.query.create_token || req.query.delete_token) {
-            const decodedObjectId = decodeURIComponent(req.params.objectId);
-            const operationPath = ["b", req.params.bucketId, "o", decodedObjectId].join("/");
-            const mdBefore = storageLayer.getMetadata(req.params.bucketId, req.params.objectId);
-            if (!(await isPermitted({
-                ruleset: emulator.rules,
-                method: types_2.RulesetOperationMethod.UPDATE,
-                path: operationPath,
-                authorization: req.header("authorization"),
-                file: {
-                    before: mdBefore === null || mdBefore === void 0 ? void 0 : mdBefore.asRulesResource(),
-                },
-            }))) {
+        catch (err) {
+            if (err instanceof errors_1.ForbiddenError) {
                 return res.status(403).json({
                     error: {
                         code: 403,
-                        message: `Permission denied. No WRITE permission.`,
+                        message: `Permission denied. No LIST permission.`,
                     },
                 });
             }
-            if (!mdBefore) {
-                return res.status(404).json({
-                    error: {
-                        code: 404,
-                        message: `Request object can not be found`,
-                    },
-                });
+            throw err;
+        }
+        return res.json(response);
+    });
+    const reqBodyToBuffer = async (req) => {
+        if (req.body instanceof Buffer) {
+            return Buffer.from(req.body);
+        }
+        const bufs = [];
+        req.on("data", (data) => {
+            bufs.push(data);
+        });
+        await new Promise((resolve) => {
+            req.on("end", () => {
+                resolve();
+            });
+        });
+        return Buffer.concat(bufs);
+    };
+    const handleUpload = async (req, res) => {
+        if (!req.query.name) {
+            res.sendStatus(400);
+            return;
+        }
+        const bucketId = req.params.bucketId;
+        const objectId = req.query.name.toString();
+        const uploadType = req.header("x-goog-upload-protocol");
+        if (uploadType === "multipart") {
+            const contentTypeHeader = req.header("content-type");
+            if (!contentTypeHeader) {
+                return res.sendStatus(400);
             }
-            const createTokenParam = req.query["create_token"];
-            const deleteTokenParam = req.query["delete_token"];
-            let md;
-            if (createTokenParam) {
-                if (createTokenParam !== "true") {
-                    res.sendStatus(400);
-                    return;
+            let metadataRaw;
+            let dataRaw;
+            try {
+                ({ metadataRaw, dataRaw } = (0, multipart_1.parseObjectUploadMultipartRequest)(contentTypeHeader, await reqBodyToBuffer(req)));
+            }
+            catch (err) {
+                if (err instanceof Error) {
+                    return res.status(400).json({
+                        error: {
+                            code: 400,
+                            message: err.toString(),
+                        },
+                    });
                 }
-                md = storageLayer.addDownloadToken(req.params.bucketId, req.params.objectId);
+                throw err;
             }
-            else if (deleteTokenParam) {
-                md = storageLayer.deleteDownloadToken(req.params.bucketId, req.params.objectId, deleteTokenParam.toString());
+            const upload = uploadService.multipartUpload({
+                bucketId,
+                objectId,
+                metadataRaw,
+                dataRaw: dataRaw,
+                authorization: req.header("authorization"),
+            });
+            let metadata;
+            try {
+                metadata = await storageLayer.handleUploadObject(upload);
             }
-            if (!md) {
-                res.sendStatus(404);
-                return;
+            catch (err) {
+                if (err instanceof errors_1.ForbiddenError) {
+                    return res.status(403).json({
+                        error: {
+                            code: 403,
+                            message: "Permission denied. No WRITE permission.",
+                        },
+                    });
+                }
+                throw err;
             }
-            setObjectHeaders(res, md);
-            return res.json(new metadata_1.OutgoingFirebaseMetadata(md));
+            metadata.addDownloadToken();
+            return res.status(200).json(new metadata_1.OutgoingFirebaseMetadata(metadata));
         }
-        if (!req.query.name) {
+        const uploadCommand = req.header("x-goog-upload-command");
+        if (!uploadCommand) {
             res.sendStatus(400);
             return;
         }
-        const name = req.query.name.toString();
-        const uploadType = req.header("x-goog-upload-protocol");
-        if (uploadType === "multipart") {
-            const contentType = req.header("content-type");
-            if (!contentType || !contentType.startsWith("multipart/related")) {
-                res.sendStatus(400);
-                return;
-            }
-            const boundary = `--${contentType.split("boundary=")[1]}`;
-            const bodyString = req.body.toString();
-            const bodyStringParts = bodyString.split(boundary).filter((v) => v);
-            const metadataString = bodyStringParts[0].split("\r\n")[3];
-            const blobParts = bodyStringParts[1].split("\r\n");
-            const blobContentTypeString = blobParts[1];
-            if (!blobContentTypeString || !blobContentTypeString.startsWith("Content-Type: ")) {
-                res.sendStatus(400);
-                return;
-            }
-            const blobContentType = blobContentTypeString.slice("Content-Type: ".length);
-            const bodyBuffer = req.body;
-            const metadataSegment = `${boundary}${bodyString.split(boundary)[1]}`;
-            const dataSegment = `${boundary}${bodyString.split(boundary).slice(2)[0]}`;
-            const dataSegmentHeader = (dataSegment.match(/.+Content-Type:.+?\r\n\r\n/s) || [])[0];
-            if (!dataSegmentHeader) {
-                res.sendStatus(400);
-                return;
-            }
-            const bufferOffset = metadataSegment.length + dataSegmentHeader.length;
-            const blobBytes = Buffer.from(bodyBuffer.slice(bufferOffset, -`\r\n${boundary}--`.length));
-            const md = storageLayer.oneShotUpload(req.params.bucketId, name, blobContentType, JSON.parse(metadataString), Buffer.from(blobBytes));
-            if (!md) {
-                res.sendStatus(400);
-                return;
-            }
-            const operationPath = ["b", req.params.bucketId, "o", name].join("/");
-            if (!(await isPermitted({
-                ruleset: emulator.rules,
-                method: types_2.RulesetOperationMethod.CREATE,
-                path: operationPath,
+        if (uploadCommand === "start") {
+            const upload = uploadService.startResumableUpload({
+                bucketId,
+                objectId,
+                metadataRaw: JSON.stringify(req.body),
                 authorization: req.header("authorization"),
-                file: {
-                    after: md === null || md === void 0 ? void 0 : md.asRulesResource(),
-                },
-            }))) {
-                storageLayer.deleteFile(md === null || md === void 0 ? void 0 : md.bucket, md === null || md === void 0 ? void 0 : md.name);
-                return res.status(403).json({
-                    error: {
-                        code: 403,
-                        message: `Permission denied. No WRITE permission.`,
-                    },
-                });
+            });
+            res.header("x-goog-upload-chunk-granularity", "10000");
+            res.header("x-goog-upload-control-url", "");
+            res.header("x-goog-upload-status", "active");
+            const emulatorInfo = registry_1.EmulatorRegistry.getInfo(types_1.Emulators.STORAGE);
+            res.header("x-goog-upload-url", `http://${req.hostname}:${emulatorInfo === null || emulatorInfo === void 0 ? void 0 : emulatorInfo.port}/v0/b/${bucketId}/o?name=${objectId}&upload_id=${upload.id}&upload_protocol=resumable`);
+            res.header("x-gupload-uploadid", upload.id);
+            return res.sendStatus(200);
+        }
+        if (!req.query.upload_id) {
+            return res.sendStatus(400);
+        }
+        const uploadId = req.query.upload_id.toString();
+        if (uploadCommand === "query") {
+            let upload;
+            try {
+                upload = uploadService.getResumableUpload(uploadId);
             }
-            if (md.downloadTokens.length === 0) {
-                md.addDownloadToken();
+            catch (err) {
+                if (err instanceof errors_1.NotFoundError) {
+                    return res.sendStatus(404);
+                }
+                throw err;
             }
-            res.json(new metadata_1.OutgoingFirebaseMetadata(md));
-            return;
+            res.header("X-Goog-Upload-Size-Received", upload.size.toString());
+            return res.sendStatus(200);
         }
-        else {
-            const operationPath = ["b", req.params.bucketId, "o", name].join("/");
-            const uploadCommand = req.header("x-goog-upload-command");
-            if (!uploadCommand) {
-                res.sendStatus(400);
-                return;
-            }
-            if (uploadCommand === "start") {
-                let objectContentType = req.header("x-goog-upload-header-content-type") ||
-                    req.header("x-goog-upload-content-type");
-                if (!objectContentType) {
-                    const mimeTypeFromName = mime.getType(name);
-                    if (!mimeTypeFromName) {
-                        objectContentType = "application/octet-stream";
-                    }
-                    else {
-                        objectContentType = mimeTypeFromName;
-                    }
+        if (uploadCommand === "cancel") {
+            try {
+                uploadService.cancelResumableUpload(uploadId);
+            }
+            catch (err) {
+                if (err instanceof errors_1.NotFoundError) {
+                    return res.sendStatus(404);
                 }
-                const upload = storageLayer.startUpload(req.params.bucketId, name, objectContentType, req.body, req.header("authorization"));
-                storageLayer.uploadBytes(upload.uploadId, Buffer.alloc(0));
-                const emulatorInfo = registry_1.EmulatorRegistry.getInfo(types_1.Emulators.STORAGE);
-                res.header("x-goog-upload-chunk-granularity", "10000");
-                res.header("x-goog-upload-control-url", "");
-                res.header("x-goog-upload-status", "active");
-                res.header("x-goog-upload-url", `http://${req.hostname}:${emulatorInfo === null || emulatorInfo === void 0 ? void 0 : emulatorInfo.port}/v0/b/${req.params.bucketId}/o?name=${req.query.name}&upload_id=${upload.uploadId}&upload_protocol=resumable`);
-                res.header("x-gupload-uploadid", upload.uploadId);
-                res.status(200).send();
-                return;
-            }
-            if (!req.query.upload_id) {
-                res.sendStatus(400);
-                return;
-            }
-            const uploadId = req.query.upload_id.toString();
-            if (uploadCommand === "query") {
-                const upload = storageLayer.queryUpload(uploadId);
-                if (!upload) {
-                    res.sendStatus(400);
-                    return;
+                else if (err instanceof upload_1.NotCancellableError) {
+                    return res.sendStatus(400);
                 }
-                res.header("X-Goog-Upload-Size-Received", upload.currentBytesUploaded.toString());
-                res.sendStatus(200);
-                return;
-            }
-            if (uploadCommand === "cancel") {
-                const upload = storageLayer.queryUpload(uploadId);
-                if (upload) {
-                    const cancelled = storageLayer.cancelUpload(upload);
-                    res.sendStatus(cancelled ? 200 : 400);
+                throw err;
+            }
+            return res.sendStatus(200);
+        }
+        if (uploadCommand.includes("upload")) {
+            let upload;
+            try {
+                upload = uploadService.continueResumableUpload(uploadId, await reqBodyToBuffer(req));
+            }
+            catch (err) {
+                if (err instanceof errors_1.NotFoundError) {
+                    return res.sendStatus(404);
                 }
-                else {
-                    res.sendStatus(404);
+                else if (err instanceof upload_1.UploadNotActiveError) {
+                    return res.sendStatus(400);
                 }
-                return;
+                throw err;
+            }
+            if (!uploadCommand.includes("finalize")) {
+                res.header("x-goog-upload-status", "active");
+                res.header("x-gupload-uploadid", upload.id);
+                return res.sendStatus(200);
             }
+        }
+        if (uploadCommand.includes("finalize")) {
             let upload;
-            if (uploadCommand.includes("upload")) {
-                if (!(req.body instanceof Buffer)) {
-                    const bufs = [];
-                    req.on("data", (data) => {
-                        bufs.push(data);
+            try {
+                upload = uploadService.finalizeResumableUpload(uploadId);
+            }
+            catch (err) {
+                if (err instanceof errors_1.NotFoundError) {
+                    return res.sendStatus(404);
+                }
+                else if (err instanceof upload_1.UploadNotActiveError) {
+                    return res.sendStatus(400);
+                }
+                throw err;
+            }
+            let metadata;
+            try {
+                metadata = await storageLayer.handleUploadObject(upload);
+            }
+            catch (err) {
+                if (err instanceof errors_1.ForbiddenError) {
+                    return res.status(403).json({
+                        error: {
+                            code: 403,
+                            message: `Permission denied. No WRITE permission.`,
+                        },
                     });
-                    await new Promise((resolve) => {
-                        req.on("end", () => {
-                            req.body = Buffer.concat(bufs);
-                            resolve();
-                        });
+                }
+                throw err;
+            }
+            metadata.addDownloadToken();
+            return res.status(200).json(new metadata_1.OutgoingFirebaseMetadata(metadata));
+        }
+        return res.sendStatus(400);
+    };
+    const handleTokenRequest = (req, res) => {
+        var _a, _b;
+        if (!req.query.create_token && !req.query.delete_token) {
+            return res.sendStatus(400);
+        }
+        const bucketId = req.params.bucketId;
+        const decodedObjectId = decodeURIComponent(req.params.objectId);
+        const authorization = req.header("authorization");
+        let metadata;
+        if (req.query.create_token) {
+            if (req.query.create_token !== "true") {
+                return res.sendStatus(400);
+            }
+            try {
+                metadata = storageLayer.handleCreateDownloadToken({
+                    bucketId,
+                    decodedObjectId,
+                    authorization,
+                });
+            }
+            catch (err) {
+                if (err instanceof errors_1.ForbiddenError) {
+                    return res.status(403).json({
+                        error: {
+                            code: 403,
+                            message: `Missing admin credentials.`,
+                        },
                     });
                 }
-                upload = storageLayer.uploadBytes(uploadId, req.body);
-                if (!upload) {
-                    res.sendStatus(400);
-                    return;
+                if (err instanceof errors_1.NotFoundError) {
+                    return res.sendStatus(404);
                 }
-                res.header("x-goog-upload-status", "active");
-                res.header("x-gupload-uploadid", upload.uploadId);
+                throw err;
             }
-            if (uploadCommand.includes("finalize")) {
-                upload = storageLayer.queryUpload(uploadId);
-                if (!upload) {
-                    res.sendStatus(400);
-                    return;
-                }
-                if (!(await isPermitted({
-                    ruleset: emulator.rules,
-                    method: types_2.RulesetOperationMethod.CREATE,
-                    path: operationPath,
-                    authorization: upload.authorization,
-                    file: {
-                        after: storageLayer.createMetadata(upload).asRulesResource(),
-                    },
-                }))) {
-                    storageLayer.deleteFile(upload.bucketId, name);
+        }
+        else {
+            try {
+                metadata = storageLayer.handleDeleteDownloadToken({
+                    bucketId,
+                    decodedObjectId,
+                    token: (_b = (_a = req.query["delete_token"]) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : "",
+                    authorization,
+                });
+            }
+            catch (err) {
+                if (err instanceof errors_1.ForbiddenError) {
                     return res.status(403).json({
                         error: {
                             code: 403,
-                            message: `Permission denied. No WRITE permission.`,
+                            message: `Missing admin credentials.`,
                         },
                     });
                 }
-                res.header("x-goog-upload-status", "final");
-                const uploadedFile = storageLayer.finalizeUpload(upload);
-                const md = uploadedFile.metadata;
-                if (md.downloadTokens.length === 0) {
-                    md.addDownloadToken();
+                if (err instanceof errors_1.NotFoundError) {
+                    return res.sendStatus(404);
                 }
-                res.json(new metadata_1.OutgoingFirebaseMetadata(uploadedFile.metadata));
+                throw err;
             }
-            else if (!upload) {
-                res.sendStatus(400);
-                return;
+        }
+        setObjectHeaders(res, metadata);
+        return res.json(new metadata_1.OutgoingFirebaseMetadata(metadata));
+    };
+    const handleObjectPostRequest = async (req, res) => {
+        if (req.query.create_token || req.query.delete_token) {
+            return handleTokenRequest(req, res);
+        }
+        return handleUpload(req, res);
+    };
+    const handleMetadataUpdate = async (req, res) => {
+        let metadata;
+        try {
+            metadata = await storageLayer.handleUpdateObjectMetadata({
+                bucketId: req.params.bucketId,
+                decodedObjectId: decodeURIComponent(req.params.objectId),
+                metadata: req.body,
+                authorization: req.header("authorization"),
+            });
+        }
+        catch (err) {
+            if (err instanceof errors_1.ForbiddenError) {
+                return res.status(403).json({
+                    error: {
+                        code: 403,
+                        message: `Permission denied. No WRITE permission.`,
+                    },
+                });
             }
-            else {
-                res.sendStatus(200);
+            if (err instanceof errors_1.NotFoundError) {
+                return res.sendStatus(404);
             }
+            throw err;
         }
+        setObjectHeaders(res, metadata);
+        return res.json(new metadata_1.OutgoingFirebaseMetadata(metadata));
     };
     firebaseStorageAPI.patch("/b/:bucketId/o/:objectId", handleMetadataUpdate);
     firebaseStorageAPI.put("/b/:bucketId/o/:objectId?", async (req, res) => {
@@ -441,38 +421,33 @@ function createFirebaseEndpoints(emulator) {
             case "patch":
                 return handleMetadataUpdate(req, res);
             default:
-                return handleUpload(req, res);
+                return handleObjectPostRequest(req, res);
         }
     });
-    firebaseStorageAPI.post("/b/:bucketId/o/:objectId?", handleUpload);
+    firebaseStorageAPI.post("/b/:bucketId/o/:objectId?", handleObjectPostRequest);
     firebaseStorageAPI.delete("/b/:bucketId/o/:objectId", async (req, res) => {
-        const decodedObjectId = decodeURIComponent(req.params.objectId);
-        const operationPath = ["b", req.params.bucketId, "o", decodedObjectId].join("/");
-        const md = storageLayer.getMetadata(req.params.bucketId, decodedObjectId);
-        const rulesFiles = {};
-        if (md) {
-            rulesFiles.before = md.asRulesResource();
-        }
-        if (!(await isPermitted({
-            ruleset: emulator.rules,
-            method: types_2.RulesetOperationMethod.DELETE,
-            path: operationPath,
-            authorization: req.header("authorization"),
-            file: rulesFiles,
-        }))) {
-            return res.status(403).json({
-                error: {
-                    code: 403,
-                    message: `Permission denied. No WRITE permission.`,
-                },
+        try {
+            await storageLayer.handleDeleteObject({
+                bucketId: req.params.bucketId,
+                decodedObjectId: decodeURIComponent(req.params.objectId),
+                authorization: req.header("authorization"),
             });
         }
-        if (!md) {
-            res.sendStatus(404);
-            return;
+        catch (err) {
+            if (err instanceof errors_1.ForbiddenError) {
+                return res.status(403).json({
+                    error: {
+                        code: 403,
+                        message: `Permission denied. No WRITE permission.`,
+                    },
+                });
+            }
+            if (err instanceof errors_1.NotFoundError) {
+                return res.sendStatus(404);
+            }
+            throw err;
         }
-        storageLayer.deleteFile(req.params.bucketId, req.params.objectId);
-        res.sendStatus(200);
+        res.sendStatus(204);
     });
     firebaseStorageAPI.get("/", (req, res) => {
         res.json({ emulator: "storage" });