story/internal/objectstore/store.go

package objectstore

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"fmt"
	"io"
	"net/url"
	"time"

	"github.com/minio/minio-go/v7"
	"github.com/minio/minio-go/v7/pkg/credentials"
)

var (
	ErrObjectSizeMismatch   = errors.New("object size mismatch")
	ErrObjectDigestMismatch = errors.New("object digest mismatch")
)

type Store struct {
	internal *minio.Client
	public   *minio.Client
	bucket   string
}

func New(endpoint, publicEndpoint, accessKey, secretKey, bucket, region string, secure, publicSecure bool) (*Store, error) {
	if endpoint == "" || publicEndpoint == "" || accessKey == "" || secretKey == "" || bucket == "" || region == "" {
		return nil, errors.New("object store endpoints, credentials, bucket and region are required")
	}
	internalOptions := &minio.Options{Creds: credentials.NewStaticV4(accessKey, secretKey, ""), Secure: secure, Region: region}
	internalClient, err := minio.New(endpoint, internalOptions)
	if err != nil {
		return nil, fmt.Errorf("create internal object store client: %w", err)
	}
	publicOptions := &minio.Options{Creds: credentials.NewStaticV4(accessKey, secretKey, ""), Secure: publicSecure, Region: region}
	publicClient, err := minio.New(publicEndpoint, publicOptions)
	if err != nil {
		return nil, fmt.Errorf("create public object store signer: %w", err)
	}
	return &Store{internal: internalClient, public: publicClient, bucket: bucket}, nil
}

func (s *Store) EnsureBucket(ctx context.Context) error {
	exists, err := s.internal.BucketExists(ctx, s.bucket)
	if err != nil {
		return fmt.Errorf("check export bucket: %w", err)
	}
	if exists {
		return nil
	}
	if err := s.internal.MakeBucket(ctx, s.bucket, minio.MakeBucketOptions{}); err != nil {
		exists, checkErr := s.internal.BucketExists(ctx, s.bucket)
		if checkErr == nil && exists {
			return nil
		}
		return fmt.Errorf("create export bucket: %w", err)
	}
	return nil
}

func (s *Store) Ready(ctx context.Context) error {
	exists, err := s.internal.BucketExists(ctx, s.bucket)
	if err != nil {
		return err
	}
	if !exists {
		return errors.New("export bucket does not exist")
	}
	return nil
}

func (s *Store) PutJSON(ctx context.Context, objectRef string, content []byte, digest string) (int64, error) {
	result, err := s.internal.PutObject(ctx, s.bucket, objectRef, bytes.NewReader(content), int64(len(content)), minio.PutObjectOptions{
		ContentType:  "application/json; charset=utf-8",
		UserMetadata: map[string]string{"content-sha256": digest, "data-classification": "private"},
	})
	if err != nil {
		return 0, fmt.Errorf("put private export object: %w", err)
	}
	return result.Size, nil
}

func (s *Store) PresignDownload(ctx context.Context, objectRef string, ttl time.Duration, filename string) (string, error) {
	if ttl <= 0 {
		return "", errors.New("download TTL must be positive")
	}
	parameters := make(url.Values)
	parameters.Set("response-content-disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))
	parameters.Set("response-content-type", "application/json; charset=utf-8")
	signed, err := s.public.PresignedGetObject(ctx, s.bucket, objectRef, ttl, parameters)
	if err != nil {
		return "", fmt.Errorf("sign private export download: %w", err)
	}
	return signed.String(), nil
}

func (s *Store) PresignUpload(ctx context.Context, objectRef string, ttl time.Duration) (string, error) {
	if ttl <= 0 {
		return "", errors.New("upload TTL must be positive")
	}
	signed, err := s.public.PresignedPutObject(ctx, s.bucket, objectRef, ttl)
	if err != nil {
		return "", fmt.Errorf("sign private firmware upload: %w", err)
	}
	return signed.String(), nil
}

func (s *Store) OpenDownload(ctx context.Context, objectRef string) (io.ReadSeekCloser, error) {
	object, err := s.internal.GetObject(ctx, s.bucket, objectRef, minio.GetObjectOptions{})
	if err != nil {
		return nil, fmt.Errorf("open private download object: %w", err)
	}
	if _, err := object.Stat(); err != nil {
		object.Close()
		return nil, fmt.Errorf("stat private download object: %w", err)
	}
	return object, nil
}

func (s *Store) VerifyDigest(ctx context.Context, objectRef, expectedDigest string, expectedSize int64) error {
	object, err := s.internal.GetObject(ctx, s.bucket, objectRef, minio.GetObjectOptions{})
	if err != nil {
		return fmt.Errorf("open private firmware object: %w", err)
	}
	defer object.Close()
	hash := sha256.New()
	written, err := io.Copy(hash, object)
	if err != nil {
		return fmt.Errorf("read private firmware object: %w", err)
	}
	if written != expectedSize {
		return fmt.Errorf("%w: got %d expected %d", ErrObjectSizeMismatch, written, expectedSize)
	}
	actual := hex.EncodeToString(hash.Sum(nil))
	if actual != expectedDigest {
		return ErrObjectDigestMismatch
	}
	return nil
}

func (s *Store) ReadPrefix(ctx context.Context, objectRef string, limit int64) ([]byte, error) {
	if limit < 1 || limit > 1024*1024 {
		return nil, errors.New("object prefix limit must be between 1 byte and 1 MiB")
	}
	object, err := s.internal.GetObject(ctx, s.bucket, objectRef, minio.GetObjectOptions{})
	if err != nil {
		return nil, fmt.Errorf("open private media object: %w", err)
	}
	defer object.Close()
	content, err := io.ReadAll(io.LimitReader(object, limit))
	if err != nil {
		return nil, fmt.Errorf("read private media object prefix: %w", err)
	}
	return content, nil
}

func (s *Store) PresignMediaDownload(ctx context.Context, objectRef string, ttl time.Duration, filename, contentType string, inline bool) (string, error) {
	if ttl <= 0 {
		return "", errors.New("download TTL must be positive")
	}
	disposition := "attachment"
	if inline {
		disposition = "inline"
	}
	parameters := make(url.Values)
	parameters.Set("response-content-disposition", fmt.Sprintf(`%s; filename="%s"`, disposition, filename))
	parameters.Set("response-content-type", contentType)
	signed, err := s.public.PresignedGetObject(ctx, s.bucket, objectRef, ttl, parameters)
	if err != nil {
		return "", fmt.Errorf("sign private media download: %w", err)
	}
	return signed.String(), nil
}

// FreezeFirmware separates expiring upload URLs from published firmware objects.
func (s *Store) FreezeFirmware(ctx context.Context, source, target, digest string, size int64) error {
	_, err := s.internal.CopyObject(ctx, minio.CopyDestOptions{Bucket: s.bucket, Object: target}, minio.CopySrcOptions{Bucket: s.bucket, Object: source})
	if err != nil {
		return err
	}
	return s.VerifyDigest(ctx, target, digest, size)
}

func (s *Store) Remove(ctx context.Context, objectRef string) error {
	if objectRef == "" {
		return nil
	}
	if err := s.internal.RemoveObject(ctx, s.bucket, objectRef, minio.RemoveObjectOptions{}); err != nil {
		return fmt.Errorf("remove private export object: %w", err)
	}
	return nil
}

func (s *Store) Stat(ctx context.Context, objectRef string) (minio.ObjectInfo, error) {
	return s.internal.StatObject(ctx, s.bucket, objectRef, minio.StatObjectOptions{})
}