ok
Direktori : /home2/selectio/www/innerstore/vendor/aws/aws-sdk-php/src/S3Control/ |
Current File : /home2/selectio/www/innerstore/vendor/aws/aws-sdk-php/src/S3Control/EndpointArnMiddleware.php |
<?php namespace Aws\S3Control; use Aws\Api\Service; use Aws\Arn\AccessPointArnInterface; use Aws\Arn\ArnInterface; use Aws\Arn\ArnParser; use Aws\Arn\Exception\InvalidArnException; use Aws\Arn\S3\BucketArnInterface; use Aws\Arn\S3\OutpostsArnInterface; use Aws\CommandInterface; use Aws\Endpoint\PartitionEndpointProvider; use Aws\Exception\InvalidRegionException; use Aws\Exception\UnresolvedEndpointException; use Aws\S3\EndpointRegionHelperTrait; use GuzzleHttp\Psr7; use Psr\Http\Message\RequestInterface; /** * Checks for access point ARN in members targeting BucketName, modifying * endpoint as appropriate * * @internal */ class EndpointArnMiddleware { use EndpointRegionHelperTrait; /** * Commands which do not do ARN expansion for a specific given shape name * @var array */ private static $selectiveNonArnableCmds = [ 'AccessPointName' => [ 'CreateAccessPoint', ], 'BucketName' => [], ]; /** * Commands which do not do ARN expansion at all for relevant members * @var array */ private static $nonArnableCmds = [ 'CreateBucket', 'ListRegionalBuckets', ]; /** * Commands which trigger endpoint and signer redirection based on presence * of OutpostId * @var array */ private static $outpostIdRedirectCmds = [ 'CreateBucket', 'ListRegionalBuckets', ]; /** @var callable */ private $nextHandler; /** @var boolean */ private $isUseEndpointV2; /** * Create a middleware wrapper function. * * @param Service $service * @param $region * @param array $config * @return callable */ public static function wrap( Service $service, $region, array $config, $isUseEndpointV2 ) { return function (callable $handler) use ($service, $region, $config, $isUseEndpointV2) { return new self($handler, $service, $region, $config, $isUseEndpointV2); }; } public function __construct( callable $nextHandler, Service $service, $region, array $config = [], $isUseEndpointV2 = false ) { $this->partitionProvider = PartitionEndpointProvider::defaultProvider(); $this->region = $region; $this->service = $service; $this->config = $config; $this->nextHandler = $nextHandler; $this->isUseEndpointV2 = $isUseEndpointV2; } public function __invoke(CommandInterface $cmd, RequestInterface $req) { $nextHandler = $this->nextHandler; $op = $this->service->getOperation($cmd->getName())->toArray(); if (!empty($op['input']['shape']) && !in_array($cmd->getName(), self::$nonArnableCmds) ) { $service = $this->service->toArray(); if (!empty($input = $service['shapes'][$op['input']['shape']])) { // Stores member name that targets 'BucketName' shape $bucketNameMember = null; // Stores member name that targets 'AccessPointName' shape $accesspointNameMember = null; foreach ($input['members'] as $key => $member) { if ($member['shape'] === 'BucketName') { $bucketNameMember = $key; } if ($member['shape'] === 'AccessPointName') { $accesspointNameMember = $key; } } // Determine if appropriate member contains ARN value and is // eligible for ARN expansion if (!is_null($bucketNameMember) && !empty($cmd[$bucketNameMember]) && !in_array($cmd->getName(), self::$selectiveNonArnableCmds['BucketName']) && ArnParser::isArn($cmd[$bucketNameMember]) ) { $arn = ArnParser::parse($cmd[$bucketNameMember]); !$this->isUseEndpointV2 && $partition = $this->validateBucketArn($arn); } elseif (!is_null($accesspointNameMember) && !empty($cmd[$accesspointNameMember]) && !in_array($cmd->getName(), self::$selectiveNonArnableCmds['AccessPointName']) && ArnParser::isArn($cmd[$accesspointNameMember]) ) { $arn = ArnParser::parse($cmd[$accesspointNameMember]); !$this->isUseEndpointV2 && $partition = $this->validateAccessPointArn($arn); } // Process only if an appropriate member contains an ARN value // and is an Outposts ARN if (!empty($arn) && $arn instanceof OutpostsArnInterface) { if (!$this->isUseEndpointV2) { // Generate host based on ARN $host = $this->generateOutpostsArnHost($arn, $req); $req = $req->withHeader('x-amz-outpost-id', $arn->getOutpostId()); } // ARN replacement $path = $req->getUri()->getPath(); if ($arn instanceof AccessPointArnInterface) { // Replace ARN with access point name $path = str_replace( urlencode($cmd[$accesspointNameMember]), $arn->getAccesspointName(), $path ); // Replace ARN in the payload $req->getBody()->seek(0); $body = Psr7\Utils::streamFor(str_replace( $cmd[$accesspointNameMember], $arn->getAccesspointName(), $req->getBody()->getContents() )); // Replace ARN in the command $cmd[$accesspointNameMember] = $arn->getAccesspointName(); } elseif ($arn instanceof BucketArnInterface) { // Replace ARN in the path $path = str_replace( urlencode($cmd[$bucketNameMember]), $arn->getBucketName(), $path ); // Replace ARN in the payload $req->getBody()->seek(0); $newBody = str_replace( $cmd[$bucketNameMember], $arn->getBucketName(), $req->getBody()->getContents() ); $body = Psr7\Utils::streamFor($newBody); // Replace ARN in the command $cmd[$bucketNameMember] = $arn->getBucketName(); } // Validate or set account ID in command if (isset($cmd['AccountId'])) { if ($cmd['AccountId'] !== $arn->getAccountId()) { throw new \InvalidArgumentException("The account ID" . " supplied in the command ({$cmd['AccountId']})" . " does not match the account ID supplied in the" . " ARN (" . $arn->getAccountId() . ")."); } } else { $cmd['AccountId'] = $arn->getAccountId(); } // Set modified request if (isset($body)) { $req = $req->withBody($body); } if ($this->isUseEndpointV2) { $req = $req->withUri($req->getUri()->withPath($path)); goto next; } $req = $req ->withUri($req->getUri()->withHost($host)->withPath($path)) ->withHeader('x-amz-account-id', $arn->getAccountId()); // Update signing region based on ARN data if configured to do so if ($this->config['use_arn_region']->isUseArnRegion()) { $region = $arn->getRegion(); } else { $region = $this->region; } $endpointData = $partition([ 'region' => $region, 'service' => $arn->getService() ]); $cmd['@context']['signing_region'] = $endpointData['signingRegion']; // Update signing service for Outposts ARNs if ($arn instanceof OutpostsArnInterface) { $cmd['@context']['signing_service'] = $arn->getService(); } } } } if ($this->isUseEndpointV2) { goto next; } // For operations that redirect endpoint & signing service based on // presence of OutpostId member. These operations will likely not // overlap with operations that perform ARN expansion. if (in_array($cmd->getName(), self::$outpostIdRedirectCmds) && !empty($cmd['OutpostId']) ) { $req = $req->withUri( $req->getUri()->withHost($this->generateOutpostIdHost()) ); $cmd['@context']['signing_service'] = 's3-outposts'; } next: return $nextHandler($cmd, $req); } private function generateOutpostsArnHost( OutpostsArnInterface $arn, RequestInterface $req ) { if (!empty($this->config['use_arn_region']->isUseArnRegion())) { $region = $arn->getRegion(); } else { $region = $this->region; } $fipsString = $this->config['use_fips_endpoint']->isUseFipsEndpoint() ? "-fips" : ""; $suffix = $this->getPartitionSuffix($arn, $this->partitionProvider); return "s3-outposts{$fipsString}.{$region}.{$suffix}"; } private function generateOutpostIdHost() { $partition = $this->partitionProvider->getPartition( $this->region, $this->service->getEndpointPrefix() ); $suffix = $partition->getDnsSuffix(); return "s3-outposts.{$this->region}.{$suffix}"; } private function validateBucketArn(ArnInterface $arn) { if ($arn instanceof BucketArnInterface) { return $this->validateArn($arn); } throw new InvalidArnException('Provided ARN was not a valid S3 bucket' . ' ARN.'); } private function validateAccessPointArn(ArnInterface $arn) { if ($arn instanceof AccessPointArnInterface) { return $this->validateArn($arn); } throw new InvalidArnException('Provided ARN was not a valid S3 access' . ' point ARN.'); } /** * Validates an ARN, returning a partition object corresponding to the ARN * if successful * * @param $arn * @return \Aws\Endpoint\Partition */ private function validateArn(ArnInterface $arn) { // Dualstack is not supported with Outposts ARNs if ($arn instanceof OutpostsArnInterface && !empty($this->config['dual_stack']) ) { throw new UnresolvedEndpointException( 'Dualstack is currently not supported with S3 Outposts ARNs.' . ' Please disable dualstack or do not supply an Outposts ARN.'); } // Get partitions for ARN and client region $arnPart = $this->partitionProvider->getPartitionByName( $arn->getPartition() ); $clientPart = $this->partitionProvider->getPartition( $this->region, 's3' ); // If client partition not found, try removing pseudo-region qualifiers if (!($clientPart->isRegionMatch($this->region, 's3'))) { $clientPart = $this->partitionProvider->getPartition( \Aws\strip_fips_pseudo_regions($this->region), 's3' ); } // Verify that the partition matches for supplied partition and region if ($arn->getPartition() !== $clientPart->getName()) { throw new InvalidRegionException('The supplied ARN partition' . " does not match the client's partition."); } if ($clientPart->getName() !== $arnPart->getName()) { throw new InvalidRegionException('The corresponding partition' . ' for the supplied ARN region does not match the' . " client's partition."); } // Ensure ARN region matches client region unless // configured for using ARN region over client region $this->validateMatchingRegion($arn); // Ensure it is not resolved to fips pseudo-region for S3 Outposts $this->validateFipsConfigurations($arn); return $arnPart; } }