¶ AwsS3Form

  
  _ = require('lodash')
  uuid = require('node-uuid')
  mime = require('mime-nofs')
  
  
  

  
  utils = require( "./utils" )
  
  

  
  cryptoAdapter = require( "./cryptoAdapter" )
  
  class AwsS3Form extends require( "mpbasic" )()
  
    validation:
      cryptoModules: [ "crypto", "crypto-js" ]
      acl: [ "private", "public-read", "public-read-write", "authenticated-read", "bucket-owner-read", "bucket-owner-full-control" ]
      successActionStatus: [200, 201, 204]
  
  
  

  
    defaults: =>
      @extend super,
  
  

  
        accessKeyId: "set-in-config-json"
  
  

  
        secretAccessKey: "set-in-config-json"
  
  

  
        region: "eu-central-1"
  
  

  
        bucket: null
  
  

  
        secure: true
  
  

  
        redirectUrlTemplate: null
  
  

  
        successActionStatus: 204
  
  

  
        policyExpiration: 60*60*12 # Default 12 hrs
  
  

  
        keyPrefix: ""
  
  

  
        acl: "public-read"
  
  

  
        useUuid: true
  
  

  
        cryptoModule: "crypto"
      
  
  

  
    initialize: ->
      @_setCryptoModule( @config.cryptoModule )
      return
  
      
  
  

  
    create: ( filename, options = {} )=>
  
  

  
  
      options.now = new Date()
      if @config.useUuid
        options.uuid = uuid.v4()
      
      if  options.contentType? and _.isString( options.contentType )
        _cType = options.contentType
      else if options.contentType
        _cType = mime.lookup( filename )
      
      _data =
        acl: @_acl( options.acl )
        credential: @_createCredential( options.now )
        amzdate: @_shortDate( options.now )
        contentType: _cType
  
      if options.redirectUrlTemplate?
        _data.success_action_redirect = @_redirectUrl( options.redirectUrlTemplate, filename: filename )
      else
        if _.isString( options.successActionStatus )
          options.successActionStatus = parseInt( options.successActionStatus, 10 )
        _data.success_action_status = @_successActionStatus( options.successActionStatus )
  
      _policyB64 = @_obj2b64( @policy( filename, options, _data ) )
  
      _signature = @sign( _policyB64, options )
  
      if options.secure?
        _secure = options.secure
      else
        _secure = @config.secure
  
      data =
        action: "#{ if _secure then "https" else "http" }://s3-#{@config.region}.amazonaws.com/#{ @config.bucket }"
        filefield: "file"
        fields:
          key: "#{( options.keyPrefix or @config.keyPrefix )}#{filename}"
          acl: _data.acl
          "X-Amz-Credential": _data.credential
          "X-Amz-Algorithm": "AWS4-HMAC-SHA256"
          "X-Amz-Date": _data.amzdate
          "Policy": _policyB64
          "X-Amz-Signature": _signature.toString()
  
      if options.redirectUrlTemplate?
        data.fields.success_action_redirect = @_redirectUrl( options.redirectUrlTemplate, filename: filename )
      else
        data.fields.success_action_status = @_successActionStatus( options.successActionStatus )
  
      if options.uuid?
        data.fields[ "x-amz-meta-uuid" ] = options.uuid
      
      if _cType?
        data.fields[ "Content-Type" ] = _cType
  
      return data
  
  
  

  
    policy: ( filename, options = {}, _predef = {} )=>
      _date = options.now or new Date()
  
      policy =
        expiration: @_calcDate( options.policyExpiration or @config.policyExpiration, _date )
        conditions: [
          { "bucket": @config.bucket }
          [ "starts-with", "$key", ( options.keyPrefix or @config.keyPrefix ) ]
          { "acl": _predef.acl or @_acl( options.acl ) }
          { "x-amz-credential": _predef.credential or @_createCredential( _date ) }
          { "x-amz-algorithm": "AWS4-HMAC-SHA256" }
          { "x-amz-date": _predef.amzdate or @_shortDate( _date ) }
  
  

  
        ]
  
      if _predef.success_action_status?
        policy.conditions.push { "success_action_status": _predef.success_action_status.toString()}
      else
        policy.conditions.push { "success_action_redirect": _predef.success_action_redirect or @_redirectUrl( options.redirectUrlTemplate, filename: filename ) }
      
      _ctypeCondition = false
      if options.customConditions?
        for ccond in options.customConditions
          policy.conditions.push ccond
          if ( _.isArray( ccond ) and _.isString( ccond[ 1 ] ) and ccond[ 1 ].toLowerCase() is "$content-type" ) or ( _.isObject( ccond ) and ccond["content-type"]? )
            _ctypeCondition = true
      
      if not _ctypeCondition and _predef?.contentType?
        policy.conditions.push { "content-type": _predef.contentType }
        
      @debug "generated policy", policy
      if options.uuid?
        policy.conditions.push { "x-amz-meta-uuid": options.uuid }
  
      return policy
  
  
  

  
    sign: ( policyB64, options )=>
      _date = options.now or new Date()
      _signdate = options.signdate or @_shortDate( _date, true )
  
      _h1 = cryptoAdapter.hmacSha256( "AWS4" + ( options.secretAccessKey or @config.secretAccessKey ), _signdate, "utf8" )
      _h2 = cryptoAdapter.hmacSha256( _h1, ( options.region or @config.region ) )
      _h3 = cryptoAdapter.hmacSha256( _h2, "s3" )
      _key = cryptoAdapter.hmacSha256( _h3, "aws4_request" )
  
      return cryptoAdapter.hmacSha256( _key, policyB64 )
  
  
  

  
    _acl: ( acl = @config.acl )=>
      if acl not in @validation.acl
        return @_handleError( null, "EINVALIDACL", val: acl )
      return acl
    
  
  

  
    _redirectUrl: ( tmpl = @config.redirectUrlTemplate, data = {} )=>
      if not tmpl?
        return @_handleError( null, "ENOREDIR" )
      
      if _.isString( tmpl )
        return _.template( tmpl )( data )
      else if _.isFunction( tmpl )
        return tmpl( data )
      else
        return @_handleError( null, "EINVALIDREDIR" )
  
  
  

  
    _successActionStatus: ( status = @config.successActionStatus )=>
      if status not in @validation.successActionStatus
        return @_handleError( null, "EINVALIDSTATUS", val: status )
      return status.toString()
  
  
  

  
    _calcDate: ( addSec, date = new Date() )=>
      _msAdd = 0
      _now = Date.now()
      
      if _.isNumber( addSec )
        _msAdd = addSec * 1000
        if _.isDate( date )
          _ts = date.valueOf()
        else if _.isNumber( date )
          _ts = date
        else
          return @_handleError( null, "ENOTDATE", val: date )
      else if _.isDate( addSec )
        _ts = addSec.valueOf()
      else
        return @_handleError( null, "ENOTDATE", val: addSec )
  
  
  

  
      if ( _now - 10000 ) > _ts
        return @_handleError( null, "EOLDDATE", val: _now )
      
      return ( new Date( _ts + _msAdd ) ).toISOString()
  
  
  

  
    _createCredential: ( date )=>
      shortDate = @_shortDate( date, true )
      return "#{@config.accessKeyId}/#{shortDate}/#{@config.region}/s3/aws4_request"
  
  
  

  
    _shortDate: ( date = new Date(), onlyDate = false )->
      _sfull = date.toISOString().replace( /\.[0-9]{1,3}Z/g, "Z" ).replace( /[\.:-]/g, "" )
      if onlyDate
        return _sfull.substr( 0, 8 )
      return _sfull
  
  
  

  
    _setCryptoModule: ( cryptoModule = @config.cryptoModule )=>
      if cryptoModule not in @validation.cryptoModules
        @_handleError( null, "EINVALIDCRYPTOMODULE", val: cryptoModule )
        return
              
      cryptoAdapter.setModule( cryptoModule )
      return
  
  
  

  
    _obj2b64: ( obj )->
      return new Buffer( JSON.stringify( obj ) ).toString('base64')
  
    ERRORS: =>
      "EINVALIDCRYPTOMODULE": [ 500, "The given cryptoModule `<%= val %>` is not valid. Only `#{@validation.cryptoModules.join('`, `')}` is allowed." ]
      "ENOTDATE": [ 500, "Invalid date `<%= val %>`. Please use a valid date object or number as timestamp" ]
      "EOLDDATE": [ 500, "Date `<%= val %>` to old. Only dates in the future are allowed" ]
      "EINVALIDACL": [ 500, "The given acl `<%= val %>` is not valid. Only `#{@validation.acl.join('`, `')}` is allowed." ]
      "EINVALIDSTATUS": [ 500, "The given successActionStatus `<%= val %>` is not valid. Only `#{@validation.successActionStatus.join('`, `')}` is allowed." ]
      "ENOREDIR": [ 500, "You have to define a `redirectUrlTemplate` as config or `.create()` option." ]
      "EINVALIDREDIR": [ 500, "Only a string or function is valid as redirect url." ]
  
  
  
  

  
  module.exports = AwsS3Form