4 Commits

Include renames

Author	SHA1	Message	Date
Claude	de7d276245	fix: round 2 S3 audit — CRITICAL SigV4 payload hash bug, timeouts, Content-MD5/Length validation ... CRITICAL: - SigV4 canonical request used sha256Hex('') instead of x-amz-content-sha256 header value — every PUT/POST with body would fail 403. Now uses the signed header value for canonical request, verifyBodyHash after streaming for integrity. HIGH: - Add 30s AbortSignal.timeout to all Telegram CDN fetches in object-stream.ts (previously could hang indefinitely, exhausting connection pool) MEDIUM: - Content-MD5 validation: compute and compare when header is present - Content-Length validation: reject if actual body size != header - max-keys=0 clamping: enforce minimum of 1 per S3 spec Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-29 08:22:45 +07:00
asepharyana	144ebe6dd3	feat: implement chunked storage for Telegram file uploads and retrieval	2026-07-07 08:08:22 +07:00
asepharyana	8e6ccf2110	feat: S3 client compatibility — virtual-hosted style, CORS, presigned multi-method, ListMultipartUploads, edge case fixes ... - Virtual-hosted bucket detection from Host header (extractS3BucketFromHost) - S3 CORS headers + OPTIONS preflight + x-amz-id-2/HostId everywhere - Presigned GET/PUT/HEAD/DELETE via centralized auth (no GET-only restriction) - ListMultipartUploads with DB/xml helpers - UploadPart partNumber range validation (1-10000) - CompleteMultipartUpload ETag matching and ascending order validation - DeleteObjects quiet mode support - CopyObject URL-decode and conditional if-match/if-none-match - encoding-type=url support in ListObjects V1/V2 XML - Safe range-based prefix matching (replaces SQL LIKE) - STREAMING-AWS4-HMAC-SHA256-PAYLOAD → 501 NotImplemented - Traefik wildcard HostRegex for virtual-hosted style - S3_VHOST_DOMAINS config env var	2026-07-07 05:39:23 +07:00
asepharyana	378a084fd3	feat: stream S3 object bodies from Telegram parts	2026-07-07 04:25:05 +07:00