feat: add S3 SigV4 auth verification and XML builders

src/utils/s3/auth.ts

@@ -0,0 +1,274 @@
+export interface SigV4Result {
+  isValid: boolean;
+  credential: {
+    accessKey: string;
+    date: string;
+    region: string;
+    service: string;
+  } | null;
+  errorCode?: string;
+}
+
+const SERVICE = 's3';
+const TERMINATION = 'aws4_request';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const buf = (data: string | ArrayBuffer | Uint8Array): Uint8Array => {
+  if (data instanceof Uint8Array) return data;
+  if (data instanceof ArrayBuffer) return new Uint8Array(data);
+  return new TextEncoder().encode(data);
+};
+
+const sha256Hex = async (data: string | Uint8Array | ArrayBuffer): Promise<string> => {
+  const hashBuffer = await crypto.subtle.digest('SHA-256', buf(data) as never);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+};
+
+const hmacSha256 = async (key: Uint8Array, message: string): Promise<Uint8Array> => {
+  const cryptoKey = await crypto.subtle.importKey(
+    'raw',
+    key as never,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  const result = await crypto.subtle.sign('HMAC', cryptoKey, buf(message) as never);
+  return new Uint8Array(result);
+};
+
+const getSigningKey = async (
+  secretKey: string,
+  dateStamp: string,
+  region: string,
+): Promise<Uint8Array> => {
+  let key = await hmacSha256(buf(`AWS4${secretKey}`), dateStamp);
+  key = await hmacSha256(key, region);
+  key = await hmacSha256(key, SERVICE);
+  return await hmacSha256(key, TERMINATION);
+};
+
+const hmacHex = async (key: Uint8Array, message: string): Promise<string> => {
+  const result = await hmacSha256(key, message);
+  return Array.from(result)
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('');
+};
+
+const parseAuthorizationHeader = (authHeader: string) => {
+  const credentialMatch = authHeader.match(/Credential=([^,]+)/);
+  const signedHeadersMatch = authHeader.match(/SignedHeaders=([^,]+)/);
+  const signatureMatch = authHeader.match(/Signature=([^,]+)/);
+
+  if (!credentialMatch || !signedHeadersMatch || !signatureMatch) return null;
+
+  const credentialParts = credentialMatch[1].split('/');
+  if (credentialParts.length !== 5) return null;
+
+  return {
+    accessKey: credentialParts[0],
+    date: credentialParts[1],
+    region: credentialParts[2],
+    service: credentialParts[3],
+    termination: credentialParts[4],
+    signedHeaders: signedHeadersMatch[1],
+    signature: signatureMatch[1],
+  };
+};
+
+const buildCanonicalRequest = (
+  method: string,
+  canonicalUri: string,
+  canonicalQueryString: string,
+  signedHeaders: string,
+  headers: Record<string, string>,
+  hashedPayload: string,
+): string => {
+  const canonicalHeaders = signedHeaders
+    .split(';')
+    .map((h) => {
+      const value = headers[h.toLowerCase()] || '';
+      return `${h.toLowerCase()}:${value.trim()}\n`;
+    })
+    .join('');
+
+  return `${method}\n${canonicalUri}\n${canonicalQueryString}\n${canonicalHeaders}\n${signedHeaders}\n${hashedPayload}`;
+};
+
+const normalizeUri = (uri: string): string => {
+  if (!uri || uri === '') return '/';
+  return uri;
+};
+
+const buildCanonicalQueryString = (searchParams: URLSearchParams): string => {
+  const params: string[] = [];
+  const keys = Array.from(searchParams.keys()).sort();
+  for (const key of keys) {
+    const values = searchParams.getAll(key).sort();
+    for (const value of values) {
+      params.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+    }
+  }
+  return params.join('&');
+};
+
+const getHashedPayload = async (
+  body: string | null,
+  contentSha256: string | null,
+): Promise<string> => {
+  if (contentSha256) return contentSha256;
+  if (!body || body.length === 0) return await sha256Hex('');
+  return await sha256Hex(body);
+};
+
+export const verifySignature = async (
+  method: string,
+  url: string,
+  headers: Record<string, string>,
+  body: string | null,
+  s3AccessKey: string,
+  s3SecretKey: string,
+  region: string,
+): Promise<SigV4Result> => {
+  const authHeader = headers['authorization'];
+  if (!authHeader || !authHeader.startsWith('AWS4-HMAC-SHA256')) {
+    return { isValid: false, credential: null, errorCode: 'AccessDenied' };
+  }
+
+  const parsed = parseAuthorizationHeader(authHeader);
+  if (!parsed) {
+    return { isValid: false, credential: null, errorCode: 'AccessDenied' };
+  }
+
+  if (parsed.accessKey !== s3AccessKey) {
+    return { isValid: false, credential: null, errorCode: 'SignatureDoesNotMatch' };
+  }
+
+  const parsedUrl = new URL(url, 'http://localhost');
+  const canonicalUri = normalizeUri(parsedUrl.pathname);
+  const canonicalQueryString = buildCanonicalQueryString(parsedUrl.searchParams);
+
+  const contentSha256 = headers['x-amz-content-sha256'] || null;
+  const hashedPayload = await getHashedPayload(body, contentSha256);
+
+  const canonicalRequest = buildCanonicalRequest(
+    method,
+    canonicalUri,
+    canonicalQueryString,
+    parsed.signedHeaders,
+    headers,
+    hashedPayload,
+  );
+
+  const hashedCanonicalRequest = await sha256Hex(canonicalRequest);
+
+  const amzDate = headers['x-amz-date'] || '';
+  const dateStamp = parsed.date;
+  const credentialScope = `${dateStamp}/${parsed.region}/${parsed.service}/${parsed.termination}`;
+
+  const stringToSign = `AWS4-HMAC-SHA256\n${amzDate}\n${credentialScope}\n${hashedCanonicalRequest}`;
+
+  const signingKey = await getSigningKey(s3SecretKey, dateStamp, region);
+  const expectedSignature = await hmacHex(signingKey, stringToSign);
+
+  if (expectedSignature !== parsed.signature) {
+    return { isValid: false, credential: null, errorCode: 'SignatureDoesNotMatch' };
+  }
+
+  return {
+    isValid: true,
+    credential: {
+      accessKey: parsed.accessKey,
+      date: parsed.date,
+      region: parsed.region,
+      service: parsed.service,
+    },
+  };
+};
+
+export const verifyPresignedUrl = async (
+  url: string,
+  s3AccessKey: string,
+  s3SecretKey: string,
+  region: string,
+): Promise<SigV4Result> => {
+  const parsedUrl = new URL(url);
+  const queryParams = Object.fromEntries(parsedUrl.searchParams.entries());
+
+  const algorithm = queryParams['X-Amz-Algorithm'];
+  const credential = queryParams['X-Amz-Credential'];
+  const signedHeaders = queryParams['X-Amz-SignedHeaders'];
+  const signature = queryParams['X-Amz-Signature'];
+  const expires = parseInt(queryParams['X-Amz-Expires'] || '0', 10);
+  const amzDate = queryParams['X-Amz-Date'];
+
+  if (
+    !algorithm ||
+    algorithm !== 'AWS4-HMAC-SHA256' ||
+    !credential ||
+    !signature ||
+    !expires ||
+    !amzDate
+  ) {
+    return { isValid: false, credential: null, errorCode: 'AccessDenied' };
+  }
+
+  // Check expiration
+  const dateObj = new Date(
+    parseInt(amzDate.substring(0, 4), 10),
+    parseInt(amzDate.substring(4, 6), 10) - 1,
+    parseInt(amzDate.substring(6, 8), 10),
+    parseInt(amzDate.substring(9, 11), 10),
+    parseInt(amzDate.substring(11, 13), 10),
+    parseInt(amzDate.substring(13, 15), 10),
+  );
+  const expiresMs = expires * 1000;
+  if (Date.now() > dateObj.getTime() + expiresMs) {
+    return { isValid: false, credential: null, errorCode: 'AccessDenied' };
+  }
+
+  const credParts = credential.split('/');
+  const presignedAccessKey = credParts[0];
+  if (presignedAccessKey !== s3AccessKey) {
+    return { isValid: false, credential: null, errorCode: 'SignatureDoesNotMatch' };
+  }
+  const dateStamp = credParts[1] || amzDate.substring(0, 8);
+
+  const canonicalUri = normalizeUri(parsedUrl.pathname);
+
+  const sortedParams = new URLSearchParams();
+  const paramKeys = Object.keys(queryParams).sort();
+  for (const key of paramKeys) {
+    if (key !== 'X-Amz-Signature') {
+      sortedParams.append(key, queryParams[key]);
+    }
+  }
+  const canonicalQueryString = buildCanonicalQueryString(sortedParams);
+
+  const canonicalHeaders = signedHeaders
+    .split(';')
+    .map((h) => `${h}:host\n`)
+    .join('');
+  const signedHeadersStr = signedHeaders;
+  const hashedPayload = 'UNSIGNED-PAYLOAD';
+
+  const canonicalRequest = `${canonicalUri}\n${canonicalQueryString}\n${canonicalHeaders}\n${signedHeadersStr}\n${hashedPayload}`;
+  const hashedCanonicalRequest = await sha256Hex(canonicalRequest);
+
+  const credentialScope = `${dateStamp}/${region}/s3/aws4_request`;
+  const stringToSign = `AWS4-HMAC-SHA256\n${amzDate}\n${credentialScope}\n${hashedCanonicalRequest}`;
+
+  const signingKey = await getSigningKey(s3SecretKey, dateStamp, region);
+  const expectedSignature = await hmacHex(signingKey, stringToSign);
+
+  if (expectedSignature !== signature) {
+    return { isValid: false, credential: null, errorCode: 'SignatureDoesNotMatch' };
+  }
+
+  return { isValid: true, credential: null };
+};
+
+export const isS3Request = (headers: Record<string, string>): boolean => {
+  const auth = headers['authorization'] || '';
+  return auth.startsWith('AWS4-HMAC-SHA256');
+};

src/utils/s3/xml.ts

@@ -0,0 +1,234 @@
+const escapeXml = (str: string): string =>
+  str
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+
+const isoDate = (d: Date): string => d.toISOString().replace(/\.\d{3}Z$/, 'Z');
+
+// ─────── Bucket operations ───────
+
+export const listBucketsXml = (
+  buckets: { name: string; createdAt: Date }[],
+  requestId: string,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<ListAllMyBucketsResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Buckets>
+    ${buckets.map((b) => `<Bucket>
+      <Name>${escapeXml(b.name)}</Name>
+      <CreationDate>${isoDate(b.createdAt)}</CreationDate>
+    </Bucket>`).join('')}
+  </Buckets>
+</ListAllMyBucketsResult>`;
+
+// ─────── Object listing ───────
+
+export const listBucketResultXml = (
+  bucketName: string,
+  objects: { key: string; sizeBytes: number; etag: string; lastModified: Date; mimeType: string }[],
+  prefixes: string[],
+  isTruncated: boolean,
+  marker: string | null,
+  maxKeys: number,
+  prefix: string,
+  delimiter: string | null,
+  nextMarker: string | null,
+  requestId: string,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Name>${escapeXml(bucketName)}</Name>
+  <Prefix>${escapeXml(prefix)}</Prefix>
+  <Marker>${escapeXml(marker || '')}</Marker>
+  <MaxKeys>${maxKeys}</MaxKeys>
+  <Delimiter>${escapeXml(delimiter || '')}</Delimiter>
+  <IsTruncated>${isTruncated}</IsTruncated>
+  ${objects.map((o) => `<Contents>
+    <Key>${escapeXml(o.key)}</Key>
+    <LastModified>${isoDate(o.lastModified)}</LastModified>
+    <ETag>"${o.etag}"</ETag>
+    <Size>${o.sizeBytes}</Size>
+    <StorageClass>STANDARD</StorageClass>
+  </Contents>`).join('')}
+  ${prefixes.map((p) => `<CommonPrefixes>
+    <Prefix>${escapeXml(p)}</Prefix>
+  </CommonPrefixes>`).join('')}
+  ${nextMarker ? `<NextMarker>${escapeXml(nextMarker)}</NextMarker>` : ''}
+</ListBucketResult>`;
+
+export const listBucketV2ResultXml = (
+  bucketName: string,
+  objects: { key: string; sizeBytes: number; etag: string; lastModified: Date; mimeType: string }[],
+  prefixes: string[],
+  isTruncated: boolean,
+  maxKeys: number,
+  prefix: string,
+  delimiter: string | null,
+  continuationToken: string | null,
+  nextContinuationToken: string | null,
+  keyCount: number,
+  requestId: string,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<ListBucketResultV2 xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Name>${escapeXml(bucketName)}</Name>
+  <Prefix>${escapeXml(prefix)}</Prefix>
+  <MaxKeys>${maxKeys}</MaxKeys>
+  <KeyCount>${keyCount}</KeyCount>
+  ${delimiter ? `<Delimiter>${escapeXml(delimiter)}</Delimiter>` : ''}
+  ${continuationToken ? `<ContinuationToken>${escapeXml(continuationToken)}</ContinuationToken>` : ''}
+  <IsTruncated>${isTruncated}</IsTruncated>
+  ${objects.map((o) => `<Contents>
+    <Key>${escapeXml(o.key)}</Key>
+    <LastModified>${isoDate(o.lastModified)}</LastModified>
+    <ETag>"${o.etag}"</ETag>
+    <Size>${o.sizeBytes}</Size>
+    <StorageClass>STANDARD</StorageClass>
+  </Contents>`).join('')}
+  ${prefixes.map((p) => `<CommonPrefixes>
+    <Prefix>${escapeXml(p)}</Prefix>
+  </CommonPrefixes>`).join('')}
+  ${nextContinuationToken ? `<NextContinuationToken>${escapeXml(nextContinuationToken)}</NextContinuationToken>` : ''}
+</ListBucketResultV2>`;
+
+// ─────── Multipart ───────
+
+export const initiateMultipartUploadXml = (
+  bucketName: string,
+  key: string,
+  uploadId: string,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<InitiateMultipartUploadResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Bucket>${escapeXml(bucketName)}</Bucket>
+  <Key>${escapeXml(key)}</Key>
+  <UploadId>${uploadId}</UploadId>
+</InitiateMultipartUploadResult>`;
+
+export const listPartsXml = (
+  bucketName: string,
+  key: string,
+  uploadId: string,
+  parts: { partNumber: number; etag: string; sizeBytes: number; createdAt: Date }[],
+  maxParts: number,
+  isTruncated: boolean,
+  requestId: string,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<ListPartsResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Bucket>${escapeXml(bucketName)}</Bucket>
+  <Key>${escapeXml(key)}</Key>
+  <UploadId>${uploadId}</UploadId>
+  <MaxParts>${maxParts}</MaxParts>
+  <IsTruncated>${isTruncated}</IsTruncated>
+  ${parts.map((p) => `<Part>
+    <PartNumber>${p.partNumber}</PartNumber>
+    <LastModified>${isoDate(p.createdAt)}</LastModified>
+    <ETag>"${p.etag}"</ETag>
+    <Size>${p.sizeBytes}</Size>
+  </Part>`).join('')}
+</ListPartsResult>`;
+
+export const completeMultipartUploadXml = (
+  bucketName: string,
+  key: string,
+  etag: string,
+  location: string,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<CompleteMultipartUploadResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Location>${escapeXml(location)}</Location>
+  <Bucket>${escapeXml(bucketName)}</Bucket>
+  <Key>${escapeXml(key)}</Key>
+  <ETag>"${etag}"</ETag>
+</CompleteMultipartUploadResult>`;
+
+// ─────── Delete result ───────
+
+export const deleteResultXml = (
+  deleted: string[],
+  errors: { key: string; code: string; message: string }[],
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<DeleteResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  ${deleted.map((key) => `<Deleted>
+    <Key>${escapeXml(key)}</Key>
+  </Deleted>`).join('')}
+  ${errors.map((e) => `<Error>
+    <Key>${escapeXml(e.key)}</Key>
+    <Code>${e.code}</Code>
+    <Message>${escapeXml(e.message)}</Message>
+  </Error>`).join('')}
+</DeleteResult>`;
+
+// ─────── Copy ───────
+
+export const copyObjectResultXml = (
+  etag: string,
+  lastModified: Date,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<CopyObjectResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <ETag>"${etag}"</ETag>
+  <LastModified>${isoDate(lastModified)}</LastModified>
+</CopyObjectResult>`;
+
+// ─────── Error ───────
+
+export const s3ErrorXml = (
+  code: string,
+  message: string,
+  resource: string,
+  requestId: string,
+): string => `<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>${code}</Code>
+  <Message>${escapeXml(message)}</Message>
+  <Resource>${escapeXml(resource)}</Resource>
+  <RequestId>${requestId}</RequestId>
+</Error>`;
+
+export const s3ErrorResponse = (
+  code: string,
+  message: string,
+  resource: string,
+  status: number,
+): Response =>
+  new Response(s3ErrorXml(code, message, resource, ''), {
+    status,
+    headers: { 'content-type': 'application/xml' },
+  });
+
+// ─────── DeleteObjects XML parser ───────
+
+export const parseDeleteObjectsBody = (body: string): { keys: string[]; quiet: boolean } => {
+  const keys: string[] = [];
+  const keyRegex = /<Key>([^<]+)<\/Key>/g;
+  let match;
+  while ((match = keyRegex.exec(body)) !== null) {
+    keys.push(match[1]);
+  }
+  const quiet = body.includes('<Quiet>true</Quiet>') || body.includes('<Quiet>true ');
+  return { keys, quiet };
+};
+
+// ─────── CompleteMultipartUpload XML parser ───────
+
+export interface CompletePart {
+  partNumber: number;
+  etag: string;
+}
+
+export const parseCompleteMultipartBody = (body: string): CompletePart[] => {
+  const parts: CompletePart[] = [];
+  const partRegex = /<Part>[\s\S]*?<\/Part>/g;
+  const partMatch = body.match(partRegex) || [];
+
+  for (const partXml of partMatch) {
+    const numMatch = partXml.match(/<PartNumber>(\d+)<\/PartNumber>/);
+    const etagMatch = partXml.match(/<ETag>"?([^"<\s]+)"?<\/ETag>/);
+    if (numMatch && etagMatch) {
+      parts.push({
+        partNumber: parseInt(numMatch[1], 10),
+        etag: etagMatch[1].replace(/^"/, '').replace(/"$/, ''),
+      });
+    }
+  }
+
+  return parts;
+};