graphile-settings 6.18.0 → 6.18.1

package/esm/presigned-url-resolver.d.ts

@@ -30,7 +30,7 @@ export declare function getPresignedUrlS3Config(): S3Config;
  * URL plugin (argument order: `(databaseId, bucketKey)`).
  *
  * Uses CDN_BUCKET_NAME as a prefix. For each (database, bucketKey) pair, the
- * S3 bucket name becomes `{prefix}-{bucketKey}-{databaseId}`.
+ * S3 bucket name becomes `{prefix}-{bucketKey}-{digest}`.
  *
  * This aligns with the bucket provisioner plugin which creates separate
  * S3 buckets per logical bucket key.
@@ -41,7 +41,7 @@ export declare function createBucketNameResolver(): BucketNameResolver;
  * (argument order: `(bucketKey, databaseId)`).
  *
  * Produces the exact same physical name as createBucketNameResolver()
- * (`{prefix}-{bucketKey}-{databaseId}`) so the eager `provisionBucket`
+ * (`{prefix}-{bucketKey}-{digest}`) so the eager `provisionBucket`
  * mutation mints the identical tenant-aware name that the lazy first-upload
  * path would. Throws on a missing prefix — no default bucket name.
  */

package/esm/presigned-url-resolver.js

@@ -14,6 +14,7 @@ import { BucketProvisioner } from '@constructive-io/bucket-provisioner';
 import { getEnvOptions } from '@constructive-io/graphql-env';
 import { createS3Client } from '@constructive-io/s3-utils';
 import { Logger } from '@pgpmjs/logger';
+import { createHash } from 'crypto';
 import { getBucketProvisionerConnection } from './bucket-provisioner-resolver';
 const log = new Logger('presigned-url-resolver');
 let s3Config = null;
@@ -79,21 +80,65 @@ function getBucketNamePrefix() {
     }
     return prefix;
 }
+/** S3's hard ceiling on a bucket name. */
+const MAX_BUCKET_NAME_LENGTH = 63;
+/** S3's floor, which a degenerate prefix/key could otherwise fall under. */
+const MIN_BUCKET_NAME_LENGTH = 3;
+/** Hex characters of the identity digest kept as the uniqueness tail. */
+const IDENTITY_DIGEST_LENGTH = 12;
+/** Readable budget: how much of the name the prefix and key may each occupy. */
+const PREFIX_BUDGET = 20;
+const BUCKET_KEY_BUDGET = 63 - IDENTITY_DIGEST_LENGTH - PREFIX_BUDGET - 3;
 /**
- * The single physical-bucket naming policy: `{prefix}-{bucketKey}-{databaseId}`
- * (e.g., "myapp-public-abc123def456"). Both the presigned-upload (lazy) path
- * and the bucket-provisioner (eager) path derive names from this one function
- * so a bucket's physical name is identical regardless of which path mints it.
+ * Reduce a component to the S3 bucket-name alphabet: lowercase, `[a-z0-9-]`,
+ * with runs of separators collapsed and no leading or trailing hyphen.
+ *
+ * Dots are legal in a bucket name but deliberately dropped — a dotted name
+ * cannot be used with virtual-hosted-style HTTPS, because the wildcard
+ * certificate does not match a further label.
+ */
+function sanitizeBucketNameComponent(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+/**
+ * The single physical-bucket naming policy:
+ * `{prefix}-{bucketKey}-{digest}` (e.g. `myapp-public-3f9c1a2b7e04`).
+ *
+ * Both the presigned-upload (lazy) path and the bucket-provisioner (eager) path
+ * derive names from this one function, so a bucket's physical name is identical
+ * regardless of which path mints it.
+ *
+ * The name is bounded and S3-legal by construction: the prefix and key are
+ * sanitized to `[a-z0-9-]` and truncated to a readable budget, and the tail is a
+ * digest of the *untruncated* identity — so two buckets whose keys agree only
+ * past the truncation point, or the same key in two databases, still get distinct
+ * names. Names remain stable for a given (prefix, databaseId, bucketKey) because
+ * nothing here reads the clock or a counter; and an already-provisioned bucket
+ * never consults this function at all, since `platform_buckets.physical_name` is
+ * authoritative once recorded.
  */
 function mintPhysicalBucketName(prefix, databaseId, bucketKey) {
-    return `${prefix}-${bucketKey}-${databaseId}`;
+    const identity = `${prefix}/${databaseId}/${bucketKey}`;
+    const digest = createHash('sha256').update(identity).digest('hex').slice(0, IDENTITY_DIGEST_LENGTH);
+    const safePrefix = sanitizeBucketNameComponent(prefix).slice(0, PREFIX_BUDGET).replace(/-+$/, '');
+    const safeKey = sanitizeBucketNameComponent(bucketKey).slice(0, BUCKET_KEY_BUDGET).replace(/-+$/, '');
+    const name = [safePrefix, safeKey, digest].filter((part) => part.length > 0).join('-');
+    // The digest alone already satisfies both bounds, so this is only reachable
+    // when both readable components sanitize away to nothing.
+    if (name.length < MIN_BUCKET_NAME_LENGTH || name.length > MAX_BUCKET_NAME_LENGTH) {
+        throw new Error(`[presigned-url-resolver] Cannot mint a legal S3 bucket name for key "${bucketKey}": got "${name}"`);
+    }
+    return name;
 }
 /**
  * Create a per-(database, bucketKey) bucket name resolver for the presigned
  * URL plugin (argument order: `(databaseId, bucketKey)`).
  *
  * Uses CDN_BUCKET_NAME as a prefix. For each (database, bucketKey) pair, the
- * S3 bucket name becomes `{prefix}-{bucketKey}-{databaseId}`.
+ * S3 bucket name becomes `{prefix}-{bucketKey}-{digest}`.
  *
  * This aligns with the bucket provisioner plugin which creates separate
  * S3 buckets per logical bucket key.
@@ -107,7 +152,7 @@ export function createBucketNameResolver() {
  * (argument order: `(bucketKey, databaseId)`).
  *
  * Produces the exact same physical name as createBucketNameResolver()
- * (`{prefix}-{bucketKey}-{databaseId}`) so the eager `provisionBucket`
+ * (`{prefix}-{bucketKey}-{digest}`) so the eager `provisionBucket`
  * mutation mints the identical tenant-aware name that the lazy first-upload
  * path would. Throws on a missing prefix — no default bucket name.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-settings",
-  "version": "6.18.0",
+  "version": "6.18.1",
   "author": "Constructive <developers@constructive.io>",
   "description": "graphile settings",
   "main": "index.js",
@@ -59,7 +59,7 @@
     "graphile-meta": "^1.8.0",
     "graphile-pg-aggregates": "^2.13.0",
     "graphile-postgis": "^3.14.0",
-    "graphile-presigned-url-plugin": "^1.14.0",
+    "graphile-presigned-url-plugin": "^1.14.1",
     "graphile-realtime-subscriptions": "^1.11.0",
     "graphile-search": "^2.13.0",
     "graphile-upload-plugin": "^2.26.0",
@@ -92,5 +92,5 @@
     "constructive",
     "graphql"
   ],
-  "gitHead": "b5b6b9f05276b7e9cbd3d1f4acd31dd315c353ea"
+  "gitHead": "8d77dfe57bb328cbdfe10732b10ca24865adf9c0"
 }

package/presigned-url-resolver.d.ts

@@ -30,7 +30,7 @@ export declare function getPresignedUrlS3Config(): S3Config;
  * URL plugin (argument order: `(databaseId, bucketKey)`).
  *
  * Uses CDN_BUCKET_NAME as a prefix. For each (database, bucketKey) pair, the
- * S3 bucket name becomes `{prefix}-{bucketKey}-{databaseId}`.
+ * S3 bucket name becomes `{prefix}-{bucketKey}-{digest}`.
  *
  * This aligns with the bucket provisioner plugin which creates separate
  * S3 buckets per logical bucket key.
@@ -41,7 +41,7 @@ export declare function createBucketNameResolver(): BucketNameResolver;
  * (argument order: `(bucketKey, databaseId)`).
  *
  * Produces the exact same physical name as createBucketNameResolver()
- * (`{prefix}-{bucketKey}-{databaseId}`) so the eager `provisionBucket`
+ * (`{prefix}-{bucketKey}-{digest}`) so the eager `provisionBucket`
  * mutation mints the identical tenant-aware name that the lazy first-upload
  * path would. Throws on a missing prefix — no default bucket name.
  */

package/presigned-url-resolver.js

@@ -21,6 +21,7 @@ const bucket_provisioner_1 = require("@constructive-io/bucket-provisioner");
 const graphql_env_1 = require("@constructive-io/graphql-env");
 const s3_utils_1 = require("@constructive-io/s3-utils");
 const logger_1 = require("@pgpmjs/logger");
+const crypto_1 = require("crypto");
 const bucket_provisioner_resolver_1 = require("./bucket-provisioner-resolver");
 const log = new logger_1.Logger('presigned-url-resolver');
 let s3Config = null;
@@ -86,21 +87,65 @@ function getBucketNamePrefix() {
     }
     return prefix;
 }
+/** S3's hard ceiling on a bucket name. */
+const MAX_BUCKET_NAME_LENGTH = 63;
+/** S3's floor, which a degenerate prefix/key could otherwise fall under. */
+const MIN_BUCKET_NAME_LENGTH = 3;
+/** Hex characters of the identity digest kept as the uniqueness tail. */
+const IDENTITY_DIGEST_LENGTH = 12;
+/** Readable budget: how much of the name the prefix and key may each occupy. */
+const PREFIX_BUDGET = 20;
+const BUCKET_KEY_BUDGET = 63 - IDENTITY_DIGEST_LENGTH - PREFIX_BUDGET - 3;
 /**
- * The single physical-bucket naming policy: `{prefix}-{bucketKey}-{databaseId}`
- * (e.g., "myapp-public-abc123def456"). Both the presigned-upload (lazy) path
- * and the bucket-provisioner (eager) path derive names from this one function
- * so a bucket's physical name is identical regardless of which path mints it.
+ * Reduce a component to the S3 bucket-name alphabet: lowercase, `[a-z0-9-]`,
+ * with runs of separators collapsed and no leading or trailing hyphen.
+ *
+ * Dots are legal in a bucket name but deliberately dropped — a dotted name
+ * cannot be used with virtual-hosted-style HTTPS, because the wildcard
+ * certificate does not match a further label.
+ */
+function sanitizeBucketNameComponent(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+/**
+ * The single physical-bucket naming policy:
+ * `{prefix}-{bucketKey}-{digest}` (e.g. `myapp-public-3f9c1a2b7e04`).
+ *
+ * Both the presigned-upload (lazy) path and the bucket-provisioner (eager) path
+ * derive names from this one function, so a bucket's physical name is identical
+ * regardless of which path mints it.
+ *
+ * The name is bounded and S3-legal by construction: the prefix and key are
+ * sanitized to `[a-z0-9-]` and truncated to a readable budget, and the tail is a
+ * digest of the *untruncated* identity — so two buckets whose keys agree only
+ * past the truncation point, or the same key in two databases, still get distinct
+ * names. Names remain stable for a given (prefix, databaseId, bucketKey) because
+ * nothing here reads the clock or a counter; and an already-provisioned bucket
+ * never consults this function at all, since `platform_buckets.physical_name` is
+ * authoritative once recorded.
  */
 function mintPhysicalBucketName(prefix, databaseId, bucketKey) {
-    return `${prefix}-${bucketKey}-${databaseId}`;
+    const identity = `${prefix}/${databaseId}/${bucketKey}`;
+    const digest = (0, crypto_1.createHash)('sha256').update(identity).digest('hex').slice(0, IDENTITY_DIGEST_LENGTH);
+    const safePrefix = sanitizeBucketNameComponent(prefix).slice(0, PREFIX_BUDGET).replace(/-+$/, '');
+    const safeKey = sanitizeBucketNameComponent(bucketKey).slice(0, BUCKET_KEY_BUDGET).replace(/-+$/, '');
+    const name = [safePrefix, safeKey, digest].filter((part) => part.length > 0).join('-');
+    // The digest alone already satisfies both bounds, so this is only reachable
+    // when both readable components sanitize away to nothing.
+    if (name.length < MIN_BUCKET_NAME_LENGTH || name.length > MAX_BUCKET_NAME_LENGTH) {
+        throw new Error(`[presigned-url-resolver] Cannot mint a legal S3 bucket name for key "${bucketKey}": got "${name}"`);
+    }
+    return name;
 }
 /**
  * Create a per-(database, bucketKey) bucket name resolver for the presigned
  * URL plugin (argument order: `(databaseId, bucketKey)`).
  *
  * Uses CDN_BUCKET_NAME as a prefix. For each (database, bucketKey) pair, the
- * S3 bucket name becomes `{prefix}-{bucketKey}-{databaseId}`.
+ * S3 bucket name becomes `{prefix}-{bucketKey}-{digest}`.
  *
  * This aligns with the bucket provisioner plugin which creates separate
  * S3 buckets per logical bucket key.
@@ -114,7 +159,7 @@ function createBucketNameResolver() {
  * (argument order: `(bucketKey, databaseId)`).
  *
  * Produces the exact same physical name as createBucketNameResolver()
- * (`{prefix}-{bucketKey}-{databaseId}`) so the eager `provisionBucket`
+ * (`{prefix}-{bucketKey}-{digest}`) so the eager `provisionBucket`
  * mutation mints the identical tenant-aware name that the lazy first-upload
  * path would. Throws on a missing prefix — no default bucket name.
  */