local-serverless-stack 1.0.0 → 1.1.0

package/dist/server/engine/emulators/s3/index.js

@@ -13,6 +13,83 @@ const OWNER_ID = '75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba0
 const OWNER_DISPLAY_NAME = 'webfile';
 const DEFAULT_CONTENT_TYPE = 'binary/octet-stream';
 const METADATA_HEADER_PREFIX = 'x-amz-meta-';
+const SSE_ALGORITHMS = ['AES256', 'aws:kms', 'aws:kms:dsse'];
+// Since January 2023 AWS applies SSE-S3 (AES256) to every bucket that has no
+// explicit default-encryption rule, and GetBucketEncryption reports that rule
+// instead of the old ServerSideEncryptionConfigurationNotFoundError — so a
+// bucket without a stored configuration (and every bucket persisted before
+// this field existed) answers with this default.
+const DEFAULT_BUCKET_ENCRYPTION = { sseAlgorithm: 'AES256', bucketKeyEnabled: false };
+// Since April 2023 every new AWS bucket is created with all four Block Public
+// Access settings on, and GetPublicAccessBlock reports them. Only an explicit
+// DeletePublicAccessBlock makes the call answer
+// NoSuchPublicAccessBlockConfiguration.
+const DEFAULT_PUBLIC_ACCESS_BLOCK = {
+    blockPublicAcls: true,
+    ignorePublicAcls: true,
+    blockPublicPolicy: true,
+    restrictPublicBuckets: true,
+};
+// Request header (PutObject / CopyObject REPLACE) ↔ record field for the
+// stored system metadata. The same names are accepted as presigned-POST form
+// fields, and objectHeaders() emits them under these canonical spellings.
+const SYSTEM_METADATA_HEADERS = [
+    ['contentDisposition', 'Content-Disposition'],
+    ['cacheControl', 'Cache-Control'],
+    ['contentEncoding', 'Content-Encoding'],
+    ['contentLanguage', 'Content-Language'],
+    ['expires', 'Expires'],
+];
+const SSE_HEADER = 'x-amz-server-side-encryption';
+const SSE_KMS_KEY_HEADER = 'x-amz-server-side-encryption-aws-kms-key-id';
+const SSE_BUCKET_KEY_HEADER = 'x-amz-server-side-encryption-bucket-key-enabled';
+// Query keys that turn a bucket request into a subresource operation, mapped
+// to the stem of the AWS operation name (Put/Get/Delete + stem). A request
+// carrying one of these must NEVER fall through to CreateBucket/DeleteBucket:
+// a PutBucketTagging answered as CreateBucket is a 409, and a
+// DeleteBucketTagging answered as DeleteBucket destroys the (empty) bucket.
+// Keys the engine does not serve answer NotImplemented (501, as AWS does for
+// an operation it does not support) — see handleBucketSubresource().
+const BUCKET_SUBRESOURCES = {
+    accelerate: 'BucketAccelerateConfiguration',
+    acl: 'BucketAcl',
+    analytics: 'BucketAnalyticsConfiguration',
+    cors: 'BucketCors',
+    delete: 'Objects',
+    encryption: 'BucketEncryption',
+    'intelligent-tiering': 'BucketIntelligentTieringConfiguration',
+    inventory: 'BucketInventoryConfiguration',
+    lifecycle: 'BucketLifecycleConfiguration',
+    location: 'BucketLocation',
+    logging: 'BucketLogging',
+    metadataTable: 'BucketMetadataTableConfiguration',
+    metrics: 'BucketMetricsConfiguration',
+    notification: 'BucketNotificationConfiguration',
+    'object-lock': 'ObjectLockConfiguration',
+    ownershipControls: 'BucketOwnershipControls',
+    policy: 'BucketPolicy',
+    policyStatus: 'BucketPolicyStatus',
+    publicAccessBlock: 'PublicAccessBlock',
+    replication: 'BucketReplication',
+    requestPayment: 'BucketRequestPayment',
+    tagging: 'BucketTagging',
+    versioning: 'BucketVersioning',
+    versions: 'ObjectVersions',
+    website: 'BucketWebsite',
+};
+// Same guard for objects: PUT /bucket/key?tagging must not overwrite the
+// object with the tagging XML, DELETE ...?tagging must not delete it, and
+// GET ...?acl must not return the body. None of these is served yet.
+const OBJECT_SUBRESOURCES = {
+    acl: 'ObjectAcl',
+    attributes: 'ObjectAttributes',
+    'legal-hold': 'ObjectLegalHold',
+    restore: 'Object',
+    retention: 'ObjectRetention',
+    select: 'ObjectContent',
+    tagging: 'ObjectTagging',
+    torrent: 'ObjectTorrent',
+};
 export class S3Emulator {
     service = 's3';
     ctx;
@@ -107,24 +184,14 @@ export class S3Emulator {
     // Bucket-level operations
     // -------------------------------------------------------------------------
     async handleBucket(req, bucket) {
-        if (req.method === 'PUT') {
-            if ('versioning' in req.query)
-                return this.putBucketVersioning(bucket, req);
-            if ('notification' in req.query)
-                return this.putBucketNotification(bucket, req);
-            if ('cors' in req.query)
-                return this.putBucketCors(bucket, req);
+        const subresource = findSubresource(req.query, BUCKET_SUBRESOURCES);
+        if (subresource !== undefined)
+            return this.handleBucketSubresource(req, bucket, subresource);
+        // From here on the request carries no subresource: a bare PUT is
+        // CreateBucket and a bare DELETE is DeleteBucket.
+        if (req.method === 'PUT')
             return this.createBucket(bucket, req);
-        }
         if (req.method === 'GET') {
-            if ('location' in req.query)
-                return this.getBucketLocation(bucket);
-            if ('versioning' in req.query)
-                return this.getBucketVersioning(bucket);
-            if ('notification' in req.query)
-                return this.getBucketNotification(bucket);
-            if ('cors' in req.query)
-                return this.getBucketCors(bucket);
             if (req.query['list-type'] === '2')
                 return this.listObjectsV2(bucket, req.query);
             throw notImplementedOperation('s3', 'ListObjects (v1) — request with list-type=2');
@@ -133,19 +200,75 @@ export class S3Emulator {
             this.requireBucket(bucket);
             return { status: 200 };
         }
-        if (req.method === 'DELETE') {
-            if ('cors' in req.query)
-                return this.deleteBucketCors(bucket);
+        if (req.method === 'DELETE')
             return this.deleteBucket(bucket);
-        }
-        if (req.method === 'POST' && 'delete' in req.query)
-            return this.deleteObjects(bucket, req);
         // Browser form upload (presigned POST): multipart/form-data to the bucket.
         if (req.method === 'POST' && multipartBoundary(req.headers['content-type'])) {
             return this.postObject(bucket, req);
         }
         throw notImplementedOperation('s3', `${req.method} /<bucket>`);
     }
+    async handleBucketSubresource(req, bucket, subresource) {
+        switch (`${req.method} ${subresource}`) {
+            case 'GET location':
+                return this.getBucketLocation(bucket);
+            case 'PUT versioning':
+                return this.putBucketVersioning(bucket, req);
+            case 'GET versioning':
+                return this.getBucketVersioning(bucket);
+            case 'PUT notification':
+                return this.putBucketNotification(bucket, req);
+            case 'GET notification':
+                return this.getBucketNotification(bucket);
+            case 'PUT cors':
+                return this.putBucketCors(bucket, req);
+            case 'GET cors':
+                return this.getBucketCors(bucket);
+            case 'DELETE cors':
+                return this.deleteBucketCors(bucket);
+            case 'POST delete':
+                return this.deleteObjects(bucket, req);
+            case 'PUT encryption':
+                return this.putBucketEncryption(bucket, req);
+            case 'GET encryption':
+                return this.getBucketEncryption(bucket);
+            case 'DELETE encryption':
+                return this.updateBucket(bucket, { encryption: undefined });
+            case 'PUT tagging':
+                return this.putBucketTagging(bucket, req);
+            case 'GET tagging':
+                return this.getBucketTagging(bucket);
+            case 'DELETE tagging':
+                return this.updateBucket(bucket, { tags: undefined });
+            case 'PUT publicAccessBlock':
+                return this.putPublicAccessBlock(bucket, req);
+            case 'GET publicAccessBlock':
+                return this.getPublicAccessBlock(bucket);
+            case 'DELETE publicAccessBlock':
+                return this.updateBucket(bucket, { publicAccessBlock: null });
+            case 'PUT policy':
+                return this.putBucketPolicy(bucket, req);
+            case 'GET policy':
+                return this.getBucketPolicy(bucket);
+            case 'DELETE policy':
+                return this.updateBucket(bucket, { policy: undefined });
+            default:
+                throw subresourceNotImplemented(req.method, subresource, BUCKET_SUBRESOURCES);
+        }
+    }
+    // Shared tail of the Delete* configuration calls: AWS answers 204 even when
+    // nothing was configured. Fields set to undefined are dropped from the
+    // persisted record; DeleteBucketEncryption therefore reverts the bucket to
+    // the SSE-S3 default, exactly like AWS.
+    updateBucket(bucket, changes) {
+        const record = { ...this.requireBucket(bucket), ...changes };
+        for (const field of Object.keys(changes)) {
+            if (record[field] === undefined)
+                delete record[field];
+        }
+        this.buckets.set(bucket, record);
+        return { status: 204 };
+    }
     createBucket(bucket, req) {
         if (this.buckets.get(bucket)) {
             throw s3Error('BucketAlreadyOwnedByYou', 'Your previous request to create the named bucket succeeded and you already own it.', 409);
@@ -236,6 +359,85 @@ export class S3Emulator {
         this.buckets.set(bucket, rest);
         return { status: 204 };
     }
+    putBucketEncryption(bucket, req) {
+        const record = this.requireBucket(bucket);
+        this.buckets.set(bucket, { ...record, encryption: parseEncryptionConfiguration(req.body) });
+        return { status: 200 };
+    }
+    getBucketEncryption(bucket) {
+        const { encryption = DEFAULT_BUCKET_ENCRYPTION } = this.requireBucket(bucket);
+        const byDefault = tag('SSEAlgorithm', encryption.sseAlgorithm) +
+            (encryption.kmsKeyId !== undefined ? tag('KMSMasterKeyID', encryption.kmsKeyId) : '');
+        const rule = tag('Rule', tag('ApplyServerSideEncryptionByDefault', byDefault, { escape: false }) +
+            tag('BucketKeyEnabled', encryption.bucketKeyEnabled ? 'true' : 'false'), { escape: false });
+        return xmlResponse(200, tag('ServerSideEncryptionConfiguration', rule, { attrs: { xmlns: S3_XMLNS }, escape: false }));
+    }
+    putBucketTagging(bucket, req) {
+        const record = this.requireBucket(bucket);
+        const tags = parseTagging(req.body);
+        const { tags: previous, ...untagged } = record;
+        void previous;
+        // An empty TagSet leaves the bucket untagged — Get then answers NoSuchTagSet.
+        this.buckets.set(bucket, tags.length > 0 ? { ...untagged, tags } : untagged);
+        return { status: 204 };
+    }
+    getBucketTagging(bucket) {
+        const { tags } = this.requireBucket(bucket);
+        if (!tags)
+            throw s3Error('NoSuchTagSet', 'The TagSet does not exist', 404);
+        const tagXml = tags.map(t => tag('Tag', tag('Key', t.key) + tag('Value', t.value), { escape: false })).join('');
+        return xmlResponse(200, tag('Tagging', tag('TagSet', tagXml, { escape: false }), { attrs: { xmlns: S3_XMLNS }, escape: false }));
+    }
+    putPublicAccessBlock(bucket, req) {
+        const record = this.requireBucket(bucket);
+        const root = parseBodyXml(req.body);
+        // Omitted flags are false, as in AWS (the SDK only serializes set members).
+        const flag = (name) => (childText(root, name) ?? '').toLowerCase() === 'true';
+        this.buckets.set(bucket, {
+            ...record,
+            publicAccessBlock: {
+                blockPublicAcls: flag('BlockPublicAcls'),
+                ignorePublicAcls: flag('IgnorePublicAcls'),
+                blockPublicPolicy: flag('BlockPublicPolicy'),
+                restrictPublicBuckets: flag('RestrictPublicBuckets'),
+            },
+        });
+        return { status: 200 };
+    }
+    getPublicAccessBlock(bucket) {
+        const { publicAccessBlock = DEFAULT_PUBLIC_ACCESS_BLOCK } = this.requireBucket(bucket);
+        if (publicAccessBlock === null) {
+            throw s3Error('NoSuchPublicAccessBlockConfiguration', 'The public access block configuration was not found', 404);
+        }
+        const content = tag('BlockPublicAcls', String(publicAccessBlock.blockPublicAcls)) +
+            tag('IgnorePublicAcls', String(publicAccessBlock.ignorePublicAcls)) +
+            tag('BlockPublicPolicy', String(publicAccessBlock.blockPublicPolicy)) +
+            tag('RestrictPublicBuckets', String(publicAccessBlock.restrictPublicBuckets));
+        return xmlResponse(200, tag('PublicAccessBlockConfiguration', content, { attrs: { xmlns: S3_XMLNS }, escape: false }));
+    }
+    // The policy is stored verbatim (AWS re-serializes it, but SDKs and IaC
+    // compare it as parsed JSON). It is never evaluated: the engine does not
+    // authorize requests.
+    putBucketPolicy(bucket, req) {
+        const record = this.requireBucket(bucket);
+        const policy = req.body.toString('utf8');
+        try {
+            const parsed = JSON.parse(policy);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+                throw new Error('not an object');
+        }
+        catch {
+            throw s3Error('MalformedPolicy', 'Policies must be valid JSON and the first byte must be \'{\'', 400);
+        }
+        this.buckets.set(bucket, { ...record, policy });
+        return { status: 204 };
+    }
+    getBucketPolicy(bucket) {
+        const { policy } = this.requireBucket(bucket);
+        if (policy === undefined)
+            throw s3Error('NoSuchBucketPolicy', 'The bucket policy does not exist', 404);
+        return { status: 200, headers: { 'Content-Type': 'application/json' }, body: policy };
+    }
     async listObjectsV2(bucket, query) {
         this.requireBucket(bucket);
         const index = await this.index(bucket);
@@ -339,6 +541,9 @@ export class S3Emulator {
     // Object-level operations
     // -------------------------------------------------------------------------
     async handleObject(req, bucket, key) {
+        const subresource = findSubresource(req.query, OBJECT_SUBRESOURCES);
+        if (subresource !== undefined)
+            throw subresourceNotImplemented(req.method, subresource, OBJECT_SUBRESOURCES);
         if (req.method === 'PUT') {
             if (req.headers['x-amz-copy-source'])
                 return this.copyObject(bucket, key, req);
@@ -366,14 +571,16 @@ export class S3Emulator {
             blobPath,
             contentType: req.headers['content-type'] ?? DEFAULT_CONTENT_TYPE,
             metadata: metadataFromHeaders(req.headers),
+            ...systemMetadataFromHeaders(req.headers),
             storageClass: 'STANDARD',
+            sse: resolveSse(name => req.headers[name], bucketRecord),
         };
         index.put(key, record);
         if (previous && previous.blobPath !== blobPath) {
             await this.deleteBlobIfUnreferenced(index, previous.blobPath);
         }
         this.queueObjectEvent(bucketRecord.region, bucket, 's3:ObjectCreated:Put', key, record.size, eTag);
-        return { status: 200, headers: { ETag: `"${eTag}"` } };
+        return { status: 200, headers: { ETag: `"${eTag}"`, ...sseHeaders(record) } };
     }
     // Presigned POST (browser form upload): the object key and options travel as
     // form fields, the bytes as a `file` part. The POST policy/signature fields
@@ -397,6 +604,8 @@ export class S3Emulator {
         const key = keyTemplate.replace(/\$\{filename\}/g, () => uploadName);
         if (!key)
             throw s3Error('InvalidArgument', 'The specified key is not valid.', 400);
+        // Validate the SSE fields before any byte is written.
+        const sse = resolveSse(lookup, bucketRecord);
         const index = await this.index(bucket);
         const eTag = md5Hex(file.data);
         const blobPath = await this.ctx.store.writeBlob(`s3/${bucket}/blobs`, file.data);
@@ -408,14 +617,19 @@ export class S3Emulator {
             blobPath,
             contentType: lookup('content-type') ?? file.contentType ?? DEFAULT_CONTENT_TYPE,
             metadata: metadataFromFields(fields),
+            // Same names as the PutObject headers, as form fields (case-insensitive).
+            ...systemMetadataFrom((_field, header) => lookup(header)),
             storageClass: 'STANDARD',
+            sse,
         };
         index.put(key, record);
         if (previous && previous.blobPath !== blobPath) {
             await this.deleteBlobIfUnreferenced(index, previous.blobPath);
         }
         this.queueObjectEvent(bucketRecord.region, bucket, 's3:ObjectCreated:Post', key, record.size, eTag);
-        return this.postResponse(bucket, key, eTag, fields);
+        const response = this.postResponse(bucket, key, eTag, fields);
+        response.headers = { ...response.headers, ...sseHeaders(record) };
+        return response;
     }
     postResponse(bucket, key, eTag, fields) {
         const value = (name) => fields.find(field => field.name.toLowerCase() === name.toLowerCase() && field.filename === undefined)?.data.toString('utf8');
@@ -458,6 +672,10 @@ export class S3Emulator {
         const sourceRecord = sourceIndex.get(sourceKey);
         if (!sourceRecord)
             throw s3Error('NoSuchKey', 'The specified key does not exist.', 404);
+        // Encryption is not metadata: whatever the directive, the copy is
+        // encrypted per the request's SSE headers or, absent those, the
+        // DESTINATION bucket's default — never inherited from the source (AWS).
+        const sse = resolveSse(name => req.headers[name], bucketRecord);
         const data = await this.ctx.store.readBlob(sourceRecord.blobPath);
         const index = await this.index(bucket);
         const blobPath = await this.ctx.store.writeBlob(`s3/${bucket}/blobs`, data);
@@ -471,7 +689,11 @@ export class S3Emulator {
             blobPath,
             contentType: replaceMetadata ? req.headers['content-type'] ?? DEFAULT_CONTENT_TYPE : sourceRecord.contentType,
             metadata: replaceMetadata ? metadataFromHeaders(req.headers) : { ...sourceRecord.metadata },
+            // System metadata follows the directive like user metadata does: COPY
+            // keeps the source's, REPLACE takes only what the request carries.
+            ...(replaceMetadata ? systemMetadataFromHeaders(req.headers) : systemMetadataFrom(field => sourceRecord[field])),
             storageClass: 'STANDARD',
+            sse,
         };
         index.put(key, record);
         if (previous && previous.blobPath !== blobPath) {
@@ -482,7 +704,9 @@ export class S3Emulator {
             attrs: { xmlns: S3_XMLNS },
             escape: false,
         });
-        return xmlResponse(200, result);
+        const response = xmlResponse(200, result);
+        response.headers = { ...response.headers, ...sseHeaders(record) };
+        return response;
     }
     async getObject(bucket, key, req) {
         const record = await this.requireObject(bucket, key);
@@ -634,18 +858,138 @@ function metadataFromFields(fields) {
     }
     return metadata;
 }
+// Collect the stored system metadata (Content-Disposition, Cache-Control, …)
+// through a lookup keyed by record field and canonical header name; empty
+// values are dropped, as S3 does not store an empty header.
+function systemMetadataFrom(lookup) {
+    const metadata = {};
+    for (const [field, header] of SYSTEM_METADATA_HEADERS) {
+        const value = lookup(field, header);
+        if (value)
+            metadata[field] = value;
+    }
+    return metadata;
+}
+function systemMetadataFromHeaders(headers) {
+    return systemMetadataFrom((_field, header) => headers[header.toLowerCase()]);
+}
+// Encryption for a new object (PutObject, presigned POST, CopyObject). The
+// lookup is keyed by the lowercase x-amz-* name (a request header, or a POST
+// form field of the same name). With no SSE header the bucket's default
+// encryption applies — SSE-S3 unless PutBucketEncryption set another rule —
+// which is what AWS reports for every object since 2023.
+function resolveSse(lookup, bucket) {
+    const algorithm = lookup(SSE_HEADER);
+    const kmsKeyId = lookup(SSE_KMS_KEY_HEADER);
+    const bucketKey = lookup(SSE_BUCKET_KEY_HEADER);
+    if (algorithm && !SSE_ALGORITHMS.includes(algorithm)) {
+        throw s3Error('InvalidArgument', 'The encryption method specified is not supported', 400);
+    }
+    if (kmsKeyId && (!algorithm || algorithm === 'AES256')) {
+        throw s3Error('InvalidArgument', `Server Side Encryption with AWS KMS managed key requires HTTP header ${SSE_HEADER} : aws:kms`, 400);
+    }
+    if (!algorithm) {
+        const { sseAlgorithm, kmsKeyId: defaultKey, bucketKeyEnabled } = bucket.encryption ?? DEFAULT_BUCKET_ENCRYPTION;
+        if (sseAlgorithm === 'AES256')
+            return { sseAlgorithm };
+        return { sseAlgorithm, ...(defaultKey !== undefined ? { kmsKeyId: defaultKey } : {}), bucketKeyEnabled: bucketKeyEnabled === true };
+    }
+    const sseAlgorithm = algorithm;
+    if (sseAlgorithm === 'AES256')
+        return { sseAlgorithm };
+    // An explicit aws:kms without a key id means the AWS managed key (aws/s3)
+    // — not the bucket default's key — so no key id is recorded. S3 Bucket
+    // Keys fall back to the bucket-level setting when the header is omitted.
+    return {
+        sseAlgorithm,
+        ...(kmsKeyId ? { kmsKeyId } : {}),
+        bucketKeyEnabled: bucketKey !== undefined ? bucketKey.toLowerCase() === 'true' : bucket.encryption?.bucketKeyEnabled === true,
+    };
+}
+function sseHeaders(record) {
+    const sse = record.sse ?? DEFAULT_BUCKET_ENCRYPTION;
+    const headers = { [SSE_HEADER]: sse.sseAlgorithm };
+    if (sse.kmsKeyId !== undefined)
+        headers[SSE_KMS_KEY_HEADER] = sse.kmsKeyId;
+    if (sse.bucketKeyEnabled)
+        headers[SSE_BUCKET_KEY_HEADER] = 'true';
+    return headers;
+}
 function objectHeaders(record) {
     const headers = {
         'Content-Type': record.contentType,
         ETag: `"${record.eTag}"`,
         'Last-Modified': new Date(record.lastModified).toUTCString(),
         'Accept-Ranges': 'bytes',
+        ...sseHeaders(record),
     };
+    for (const [field, header] of SYSTEM_METADATA_HEADERS) {
+        const value = record[field];
+        if (value !== undefined)
+            headers[header] = value;
+    }
     for (const [name, value] of Object.entries(record.metadata)) {
         headers[`${METADATA_HEADER_PREFIX}${name}`] = value;
     }
     return headers;
 }
+// First query key naming a known subresource (own keys only, so a query
+// param such as `constructor` never matches an Object.prototype member).
+function findSubresource(query, known) {
+    return Object.keys(query).find(key => Object.prototype.hasOwnProperty.call(known, key));
+}
+// Operations whose AWS name is not Verb + stem.
+const IRREGULAR_OPERATION_NAMES = {
+    'GET versions': 'ListObjectVersions',
+    'POST restore': 'RestoreObject',
+    'POST select': 'SelectObjectContent',
+};
+function subresourceNotImplemented(method, subresource, known) {
+    const verb = method.charAt(0) + method.slice(1).toLowerCase();
+    const operation = IRREGULAR_OPERATION_NAMES[`${method} ${subresource}`] ?? `${verb}${known[subresource]}`;
+    return s3Error('NotImplemented', `s3.${operation} (${method} ?${subresource}) is not implemented by the LSS self engine — see docs/SELF_ENGINE.md#coverage`, 501);
+}
+// PutBucketEncryption body. AWS accepts exactly one Rule; the engine keeps
+// the first and rejects a rule without a supported SSEAlgorithm the way AWS
+// does (MalformedXML).
+function parseEncryptionConfiguration(body) {
+    const root = parseBodyXml(body);
+    const rule = childrenNamed(root, 'Rule')[0];
+    const byDefault = rule && childrenNamed(rule, 'ApplyServerSideEncryptionByDefault')[0];
+    const algorithm = byDefault && childText(byDefault, 'SSEAlgorithm');
+    if (!algorithm || !SSE_ALGORITHMS.includes(algorithm)) {
+        throw s3Error('MalformedXML', 'The XML you provided was not well-formed or did not validate against our published schema', 400);
+    }
+    const kmsKeyId = childText(byDefault, 'KMSMasterKeyID');
+    if (kmsKeyId && algorithm === 'AES256') {
+        throw s3Error('InvalidArgument', 'a KMSMasterKeyID is not applicable if the default sse algorithm is not aws:kms or aws:kms:dsse', 400);
+    }
+    return {
+        sseAlgorithm: algorithm,
+        ...(kmsKeyId ? { kmsKeyId } : {}),
+        bucketKeyEnabled: (childText(rule, 'BucketKeyEnabled') ?? '').toLowerCase() === 'true',
+    };
+}
+// PutBucketTagging body: <Tagging><TagSet><Tag><Key/><Value/></Tag>…</TagSet>.
+function parseTagging(body) {
+    const root = parseBodyXml(body);
+    const tagSet = childrenNamed(root, 'TagSet')[0];
+    if (!tagSet) {
+        throw s3Error('MalformedXML', 'The XML you provided was not well-formed or did not validate against our published schema', 400);
+    }
+    const tags = [];
+    const seen = new Set();
+    for (const node of childrenNamed(tagSet, 'Tag')) {
+        const key = childText(node, 'Key');
+        if (!key)
+            throw s3Error('InvalidTag', 'The TagKey you have provided is invalid', 400);
+        if (seen.has(key))
+            throw s3Error('InvalidTag', 'Cannot provide multiple Tags with the same key', 400);
+        seen.add(key);
+        tags.push({ key, value: childText(node, 'Value') ?? '' });
+    }
+    return tags;
+}
 // GET/HEAD response-header overrides carried as `response-*` query params (the
 // presigned-URL mechanism for forcing a download filename / content type). AWS
 // echoes each present param into the matching response header — this is what a