Epicure/apps/web/lib/storage.ts

import { S3Client, DeleteObjectCommand } from "@aws-sdk/client-s3";
import { createPresignedPost } from "@aws-sdk/s3-presigned-post";

const bucket = process.env["STORAGE_BUCKET"] || "epicure-uploads";
const endpoint = process.env["STORAGE_ENDPOINT"] || "http://localhost:9000";
const publicUrl = process.env["STORAGE_PUBLIC_URL"] || "http://localhost:9000";
// getPublicUrl() below runs in the browser too — non-NEXT_PUBLIC_ vars are never
// inlined into the client bundle, so it needs its own NEXT_PUBLIC_ copy of the value.
const clientPublicUrl = process.env.NEXT_PUBLIC_STORAGE_PUBLIC_URL || "http://localhost:9000";

const credentials = {
  accessKeyId: process.env["STORAGE_ACCESS_KEY"] ?? "minioadmin",
  secretAccessKey: process.env["STORAGE_SECRET_KEY"] ?? "minioadmin",
};

const s3 = new S3Client({
  region: process.env["STORAGE_REGION"] ?? "us-east-1",
  endpoint,
  forcePathStyle: true,
  credentials,
});

// Presigned URLs are PUT/GET directly by the browser, so they must be signed
// against an endpoint the browser can actually resolve — not the internal
// docker hostname `s3` (and `endpoint`) use for server-to-server calls. Signing
// is pure crypto (no network call), so a second client pointed at the public
// URL is safe even though it's never used to make a real request itself.
const presignS3 = new S3Client({
  region: process.env["STORAGE_REGION"] ?? "us-east-1",
  endpoint: publicUrl,
  forcePathStyle: true,
  credentials,
});

/**
 * A presigned PUT URL only signs Bucket/Key/ContentType — nothing binds the
 * actual request body size to what the caller declared when it asked for the
 * URL (and was charged storage-tier quota for), so a client could declare
 * 1 byte and then PUT an arbitrarily large object. S3/MinIO's POST-policy
 * upload flow is the fix: `content-length-range` is a *signed* condition,
 * enforced by the storage server itself when it receives the upload — a
 * mismatched Content-Length is rejected before the bytes are ever accepted,
 * not just checked against something the client also controls.
 */
export async function createPresignedUploadPost(
  key: string,
  contentType: string,
  maxBytes: number
): Promise<{ url: string; fields: Record<string, string> }> {
  return createPresignedPost(presignS3, {
    Bucket: bucket,
    Key: key,
    Conditions: [
      ["content-length-range", 0, maxBytes],
      { "Content-Type": contentType },
    ],
    Fields: { "Content-Type": contentType },
    Expires: 300,
  });
}

export async function deleteObject(key: string): Promise<void> {
  await s3.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
}

export function getPublicUrl(key: string): string {
  return `${clientPublicUrl}/${bucket}/${key}`;
}

/**
 * A recipe/review photo's storage key is only trustworthy if it matches the
 * exact prefix issued by /api/v1/upload/presign for this recipe + user +
 * purpose — otherwise a client could submit another user's key (discoverable
 * from a public recipe's rendered <Image> src, or a review's photoKey in API
 * responses) and have it adopted, then later evicted, triggering
 * deleteObject() against an object it never owned.
 */
export function isOwnedRecipePhotoKey(key: string, recipeId: string, userId: string): boolean {
  return key.startsWith(`recipes/${recipeId}/photos/${userId}-`);
}

export function isOwnedReviewPhotoKey(key: string, recipeId: string, userId: string): boolean {
  return key.startsWith(`recipes/${recipeId}/reviews/${userId}-`);
}

/** Same rationale as isOwnedRecipePhotoKey, for the avatar-presign key prefix. */
export function isOwnedAvatarKey(key: string, userId: string): boolean {
  return key.startsWith(`user-avatars/${userId}/`);
}