fix(medusa, medusa-file-*): Protected uploads for file services (#2433)

packages/medusa-file-s3/src/services/s3.js

@@ -19,9 +19,19 @@ class S3Service extends AbstractFileService {
   upload(file) {
     this.updateAwsConfig()
 
+    return this.uploadFile(file)
+  }
+
+  uploadProtected(file) {
+    this.updateAwsConfig()
+
+    return this.uploadFile(file, { acl: "private" })
+  }
+
+  uploadFile(file, options = { isProtected: false, acl: undefined }) {
     const s3 = new aws.S3()
     const params = {
-      ACL: "public-read",
+      ACL: options.acl ?? (options.isProtected ? "private" : "public-read"),
       Bucket: this.bucket_,
       Body: fs.createReadStream(file.path),
       Key: `${file.originalname}`,