@ -5,11 +5,23 @@ const AWS = require("aws-sdk")
const APP_BUCKET = "app-assets"
// this doesn't matter in self host
const REGION = "eu-west-1"
const PUBLIC_READ_POLICY = {
Version : "2012-10-17" ,
Statement : [
{
Effect : "Allow" ,
Principal : "*" ,
Action : "s3:GetObject" ,
Resource : ` arn:aws:s3::: ${ APP_BUCKET } /* ` ,
}
]
}
async function getCouchSession ( ) {
// fetch session token for the api user
const session = await got . post ( ` ${ env . RAW_COUCH_DB_URL } /_session ` , {
responseType : "json" ,
credentials : "include" ,
json : {
username : env . COUCH_DB_USERNAME ,
password : env . COUCH_DB_PASSWORD ,
@ -38,37 +50,25 @@ async function getMinioSession() {
} )
// make sure the bucket exists
try {
await objClient . headBucket ( { Bucket : APP_BUCKET } ) . promise ( )
await objClient . headBucket ( {
Bucket : APP_BUCKET
} ) . promise ( )
await objClient . putBucketPolicy ( {
Bucket : APP_BUCKET ,
Policy : JSON . stringify ( PUBLIC_READ_POLICY ) ,
} ) . promise ( )
} catch ( err ) {
// bucket doesn't exist create it
if ( err . statusCode === 404 ) {
await objClient . createBucket ( { Bucket : APP_BUCKET } ) . promise ( )
await objClient . createBucket ( {
Bucket : APP_BUCKET ,
} ) . promise ( )
} else {
throw err
}
}
// TODO: this doesn't seem to work get an error
// TODO: Generating temporary credentials not allowed for this request.
// TODO: this should work based on minio documentation
// const sts = new AWS.STS({
// endpoint: env.RAW_MINIO_URL,
// region: REGION,
// s3ForcePathStyle: true,
// })
// // NOTE: In the following commands RoleArn and RoleSessionName are not meaningful for MinIO
// const params = {
// DurationSeconds: 3600,
// ExternalId: "123ABC",
// Policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::*"}]}',
// RoleArn: 'arn:xxx:xxx:xxx:xxxx',
// RoleSessionName: 'anything',
// };
// const assumedRole = await sts.assumeRole(params).promise();
// if (!assumedRole) {
// throw "Unable to get access to object store."
// }
// return assumedRole.Credentials
// TODO: need to do something better than this
// Ideally want to send back some pre-signed URLs for files that are to be uploaded
return {
accessKeyId : env . MINIO_ACCESS_KEY ,
secretAccessKey : env . MINIO_SECRET_KEY ,
@ -80,7 +80,5 @@ exports.deploy = async ctx => {
couchDbSession : await getCouchSession ( ) ,
bucket : APP_BUCKET ,
objectStoreSession : await getMinioSession ( ) ,
couchDbUrl : env . RAW_COUCH_DB_URL ,
objectStoreUrl : env . RAW_MINIO_URL ,
}
}
mike12345567
6 years ago