feat: Add support for uploading a file directly to the file provider from the client (#12224)

* feat: Add support for uploading a file directly to the file provider from the client

* fix: Add missing types and add a couple of module tests

* fix: Allow nested routes, add test for it

packages/modules/providers/file-s3/integration-tests/__tests__/services.spec.ts

@@ -81,4 +81,83 @@ describe.skip("S3 File Plugin", () => {
       expect(response.status).toEqual(404)
     })
   })
+
+  it("gets a presigned upload URL and uploads a file successfully", async () => {
+    const fileContent = await fs.readFile(fixtureImagePath)
+    const fixtureAsBinary = fileContent.toString("binary")
+
+    const resp = await s3Service.getPresignedUploadUrl({
+      filename: "catphoto.jpg",
+      mimeType: "image/jpeg",
+      access: "private",
+    })
+
+    expect(resp).toEqual({
+      key: expect.stringMatching(/tests\/catphoto.*\.jpg/),
+      url: expect.stringMatching(/https:\/\/.*catphoto\.jpg/),
+    })
+
+    const uploadResp = await axios.put(resp.url, fileContent, {
+      headers: {
+        // On Digitalocean, among others, despite the ACL set on the upload URL, the caller can set the acl to anything they want.
+        // On AWS passing the ACL in the upload will fail since it's set on the signed URL.
+        // "x-amz-acl": "private",
+        "Content-Type": "image/jpeg",
+      },
+    })
+
+    expect(uploadResp.status).toEqual(200)
+
+    const signedUrl = await s3Service.getPresignedDownloadUrl({
+      fileKey: resp.key,
+    })
+
+    const signedUrlFile = Buffer.from(
+      await axios
+        .get(signedUrl, { responseType: "arraybuffer" })
+        .then((r) => r.data)
+    )
+
+    expect(signedUrlFile.toString("binary")).toEqual(fixtureAsBinary)
+
+    await s3Service.delete({ fileKey: resp.key })
+  })
+
+  it("gets a presigned upload URL for a nested filename structure and uploads a file successfully", async () => {
+    const fileContent = await fs.readFile(fixtureImagePath)
+    const fixtureAsBinary = fileContent.toString("binary")
+
+    const resp = await s3Service.getPresignedUploadUrl({
+      filename: "testfolder/catphoto.jpg",
+      mimeType: "image/jpeg",
+      access: "private",
+    })
+
+    expect(resp).toEqual({
+      key: expect.stringMatching(/tests\/testfolder\/catphoto.*\.jpg/),
+      url: expect.stringMatching(/https:\/\/.*testfolder\/catphoto\.jpg/),
+    })
+
+    const uploadResp = await axios.put(resp.url, fileContent, {
+      headers: {
+        "Content-Type": "image/jpeg",
+      },
+    })
+
+    expect(uploadResp.status).toEqual(200)
+
+    const signedUrl = await s3Service.getPresignedDownloadUrl({
+      fileKey: resp.key,
+    })
+
+    const signedUrlFile = Buffer.from(
+      await axios
+        .get(signedUrl, { responseType: "arraybuffer" })
+        .then((r) => r.data)
+    )
+
+    expect(signedUrlFile.toString("binary")).toEqual(fixtureAsBinary)
+
+    await s3Service.delete({ fileKey: resp.key })
+  })
 })

packages/modules/providers/file-s3/src/services/s3-file.ts

@@ -1,6 +1,7 @@
 import {
   DeleteObjectCommand,
   GetObjectCommand,
+  ObjectCannedACL,
   PutObjectCommand,
   S3Client,
   S3ClientConfigType,
@@ -36,6 +37,8 @@ interface S3FileServiceConfig {
   additionalClientConfig?: Record<string, any>
 }
 
+const DEFAULT_UPLOAD_EXPIRATION_DURATION_SECONDS = 60 * 60
+
 export class S3FileService extends AbstractFileProviderService {
   static identifier = "s3"
   protected config_: S3FileServiceConfig
@@ -175,4 +178,41 @@ export class S3FileService extends AbstractFileProviderService {
       expiresIn: this.config_.downloadFileDuration,
     })
   }
+
+  // Note: Some providers (eg. AWS S3) allows IAM policies to further restrict what can be uploaded.
+  async getPresignedUploadUrl(
+    fileData: FileTypes.ProviderGetPresignedUploadUrlDTO
+  ): Promise<FileTypes.ProviderFileResultDTO> {
+    if (!fileData?.filename) {
+      throw new MedusaError(
+        MedusaError.Types.INVALID_DATA,
+        `No filename provided`
+      )
+    }
+
+    const fileKey = `${this.config_.prefix}${fileData.filename}`
+
+    let acl: ObjectCannedACL | undefined
+    if (fileData.access) {
+      acl = fileData.access === "public" ? "public-read" : "private"
+    }
+
+    // Using content-type, acl, etc. doesn't work with all providers, and some simply ignore it.
+    const command = new PutObjectCommand({
+      Bucket: this.config_.bucket,
+      ContentType: fileData.mimeType,
+      ACL: acl,
+      Key: fileKey,
+    })
+
+    const signedUrl = await getSignedUrl(this.client_, command, {
+      expiresIn:
+        fileData.expiresIn ?? DEFAULT_UPLOAD_EXPIRATION_DURATION_SECONDS,
+    })
+
+    return {
+      url: signedUrl,
+      key: fileKey,
+    }
+  }
 }