fix: Secure S3 attachments, bump SDK, refactoring

Closes #673

server/api/hooks/file-manager/LocalFileManager.js

@@ -0,0 +1,51 @@
+const fs = require('fs');
+const fse = require('fs-extra');
+const path = require('path');
+const { rimraf } = require('rimraf');
+
+const PATH_SEGMENT_TO_URL_REPLACE_REGEX = /(public|private)\//;
+
+const buildPath = (pathSegment) => path.join(sails.config.custom.uploadsBasePath, pathSegment);
+
+class LocalFileManager {
+  // eslint-disable-next-line class-methods-use-this
+  async move(sourceFilePath, filePathSegment) {
+    const { dir, base } = path.parse(filePathSegment);
+
+    const folderPath = buildPath(dir);
+    const filePath = path.join(folderPath, base);
+
+    await fs.promises.mkdir(folderPath);
+    await fse.move(sourceFilePath, filePath);
+
+    return filePath;
+  }
+
+  // eslint-disable-next-line class-methods-use-this
+  async save(filePathSegment, buffer) {
+    await fse.outputFile(buildPath(filePathSegment), buffer);
+  }
+
+  // eslint-disable-next-line class-methods-use-this
+  read(filePathSegment) {
+    const filePath = buildPath(filePathSegment);
+
+    if (!fs.existsSync(filePath)) {
+      throw new Error('File does not exist');
+    }
+
+    return fs.createReadStream(filePath);
+  }
+
+  // eslint-disable-next-line class-methods-use-this
+  async deleteFolder(folderPathSegment) {
+    await rimraf(buildPath(folderPathSegment));
+  }
+
+  // eslint-disable-next-line class-methods-use-this
+  buildUrl(filePathSegment) {
+    return `${sails.config.custom.baseUrl}/${filePathSegment.replace(PATH_SEGMENT_TO_URL_REPLACE_REGEX, '')}`;
+  }
+}
+
+module.exports = LocalFileManager;

server/api/hooks/file-manager/S3FileManager.js

@@ -0,0 +1,76 @@
+const fs = require('fs');
+const {
+  DeleteObjectsCommand,
+  GetObjectCommand,
+  ListObjectsV2Command,
+  PutObjectCommand,
+} = require('@aws-sdk/client-s3');
+
+class S3FileManager {
+  constructor(client) {
+    this.client = client;
+  }
+
+  async move(sourceFilePath, filePathSegment, contentType) {
+    const command = new PutObjectCommand({
+      Bucket: sails.config.custom.s3Bucket,
+      Key: filePathSegment,
+      Body: fs.createReadStream(sourceFilePath),
+      ContentType: contentType,
+    });
+
+    await this.client.send(command);
+
+    return null;
+  }
+
+  async save(filePathSegment, buffer, contentType) {
+    const command = new PutObjectCommand({
+      Bucket: sails.config.custom.s3Bucket,
+      Key: filePathSegment,
+      Body: buffer,
+      ContentType: contentType,
+    });
+
+    await this.client.send(command);
+  }
+
+  async read(filePathSegment) {
+    const command = new GetObjectCommand({
+      Bucket: sails.config.custom.s3Bucket,
+      Key: filePathSegment,
+    });
+
+    const result = await this.client.send(command);
+    return result.Body;
+  }
+
+  async deleteFolder(folderPathSegment) {
+    const listObjectsCommand = new ListObjectsV2Command({
+      Bucket: sails.config.custom.s3Bucket,
+      Prefix: folderPathSegment,
+    });
+
+    const result = await this.client.send(listObjectsCommand);
+
+    if (!result.Contents || result.Contents.length === 0) {
+      return;
+    }
+
+    const deleteObjectsCommand = new DeleteObjectsCommand({
+      Bucket: sails.config.custom.s3Bucket,
+      Delete: {
+        Objects: result.Contents.map(({ Key }) => ({ Key })),
+      },
+    });
+
+    await this.client.send(deleteObjectsCommand);
+  }
+
+  // eslint-disable-next-line class-methods-use-this
+  buildUrl(filePathSegment) {
+    return `${sails.hooks.s3.getBaseUrl()}/${filePathSegment}`;
+  }
+}
+
+module.exports = S3FileManager;

server/api/hooks/file-manager/index.js

@@ -0,0 +1,41 @@
+const LocalFileManager = require('./LocalFileManager');
+const S3FileManager = require('./S3FileManager');
+
+/**
+ * file-manager hook
+ *
+ * @description :: A hook definition. Extends Sails by adding shadow routes, implicit actions,
+ *                 and/or initialization logic.
+ * @docs        :: https://sailsjs.com/docs/concepts/extending-sails/hooks
+ */
+
+module.exports = function defineFileManagerHook(sails) {
+  let instance = null;
+
+  const createInstance = () => {
+    instance = sails.hooks.s3.isActive()
+      ? new S3FileManager(sails.hooks.s3.getClient())
+      : new LocalFileManager();
+  };
+
+  return {
+    /**
+     * Runs when this Sails app loads/lifts.
+     */
+
+    async initialize() {
+      sails.log.info('Initializing custom hook (`file-manager`)');
+
+      return new Promise((resolve) => {
+        sails.after('hook:s3:loaded', () => {
+          createInstance();
+          resolve();
+        });
+      });
+    },
+
+    getInstance() {
+      return instance;
+    },
+  };
+};