mirror of
https://github.com/hanzo-apps/dataroom.git
synced 2026-10-30 14:47:36 +00:00
zeekayandHanzo Dev
23a1657d2e
features/storage/ was Papermark's ee/features/storage — commercial-licensed
code that commit 98f0da7fa renamed out of ee/ byte-identical rather than
deleting, leaving it under our AGPL root licence. Deleted and rewritten.
lib/storage/config.ts resolves one bucket from the environment. The upstream
version carried a hardcoded EU/US region matrix selected by the `usStorage`
feature flag; that flag is served by @vercel/edge-config, is false whenever
EDGE_CONFIG is unset, and no per-document region is persisted anywhere in the
schema — so the second region was unreachable on our deployments. Required
vars now throw at the boundary instead of resolving a partial config.
lib/storage/tus-store.ts builds a plain S3Store. MultiRegionS3Store subclassed
it and reassigned this.client/this.bucket per request on a shared instance, so
two concurrent uploads from different teams could observe each other's bucket.
Construction-time config removes the race. It also now forwards the endpoint,
so resumable uploads reach S3-compatible backends.
lib/files/aws-client.ts collapses to two functions: with one config the
team/non-team split was duplication, and getS3Client, getS3ClientForTeam and
getLambdaClient had no callers outside the module.
LICENSE: drop the carve-out clause pointing at ee/LICENSE and app/(ee) —
both directories are gone, so the pointer dangled. Papermark's copyright
line and the AGPL-3.0 text are untouched.
Co-authored-by: Hanzo Dev <[email protected]>
84 lines
2.7 KiB
TypeScript
84 lines
2.7 KiB
TypeScript
import { GetObjectCommand, S3Client } from "@aws-sdk/client-s3";
|
|
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
|
|
|
|
import { getStorageConfig } from "@/lib/storage/config";
|
|
|
|
export interface S3KeyInfo {
|
|
bucket: string;
|
|
key: string;
|
|
region: string;
|
|
}
|
|
|
|
const THREE_DAYS_IN_SECONDS = 3 * 24 * 60 * 60;
|
|
|
|
/**
|
|
* Parse an S3 presigned URL to extract bucket, key, and region.
|
|
* Supports both path-style and virtual-hosted-style URLs.
|
|
*
|
|
* Path-style: https://s3.{region}.amazonaws.com/{bucket}/{key}
|
|
* Virtual-hosted: https://{bucket}.s3.{region}.amazonaws.com/{key}
|
|
*/
|
|
export function parseS3PresignedUrl(presignedUrl: string): S3KeyInfo {
|
|
const url = new URL(presignedUrl);
|
|
const hostname = url.hostname;
|
|
|
|
// Path-style: s3.{region}.amazonaws.com
|
|
const pathStyleMatch = hostname.match(/^s3\.([^.]+)\.amazonaws\.com$/);
|
|
if (pathStyleMatch) {
|
|
const region = pathStyleMatch[1];
|
|
// Path is /{bucket}/{key...}
|
|
const pathParts = url.pathname.slice(1).split("/");
|
|
const bucket = decodeURIComponent(pathParts[0]);
|
|
const key = pathParts.slice(1).map(decodeURIComponent).join("/");
|
|
return { bucket, key, region };
|
|
}
|
|
|
|
// Virtual-hosted-style: {bucket}.s3.{region}.amazonaws.com
|
|
const virtualMatch = hostname.match(/^(.+)\.s3\.([^.]+)\.amazonaws\.com$/);
|
|
if (virtualMatch) {
|
|
const bucket = virtualMatch[1];
|
|
const region = virtualMatch[2];
|
|
const key = decodeURIComponent(url.pathname.slice(1));
|
|
return { bucket, key, region };
|
|
}
|
|
|
|
// Virtual-hosted without region: {bucket}.s3.amazonaws.com (us-east-1)
|
|
const virtualNoRegionMatch = hostname.match(/^(.+)\.s3\.amazonaws\.com$/);
|
|
if (virtualNoRegionMatch) {
|
|
const bucket = virtualNoRegionMatch[1];
|
|
const key = decodeURIComponent(url.pathname.slice(1));
|
|
return { bucket: bucket, key, region: "us-east-1" };
|
|
}
|
|
|
|
throw new Error(`Unable to parse S3 URL: ${presignedUrl}`);
|
|
}
|
|
|
|
/**
|
|
* Generate a fresh presigned URL for an S3 object using team credentials.
|
|
* Uses long-term IAM credentials which allow presigned URLs up to 7 days.
|
|
*/
|
|
export async function generateFreshPresignedUrl(
|
|
teamId: string,
|
|
s3Key: S3KeyInfo,
|
|
expiresInSeconds: number = THREE_DAYS_IN_SECONDS,
|
|
): Promise<string> {
|
|
const config = getStorageConfig();
|
|
|
|
const client = new S3Client({
|
|
region: s3Key.region,
|
|
credentials: {
|
|
accessKeyId: config.accessKeyId,
|
|
secretAccessKey: config.secretAccessKey,
|
|
},
|
|
});
|
|
|
|
const command = new GetObjectCommand({
|
|
Bucket: s3Key.bucket,
|
|
Key: s3Key.key,
|
|
ResponseContentDisposition: `attachment; filename="${encodeURIComponent(s3Key.key.split("/").pop() || "download.zip")}"`,
|
|
ResponseCacheControl: "no-cache, no-store, must-revalidate",
|
|
});
|
|
|
|
return getSignedUrl(client, command, { expiresIn: expiresInSeconds });
|
|
}
|