How to Add File Uploads with S3 to an Echo App

// support/support.go
package support

import (
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"errors"
	"io"
	"net/http"
	"path"
	"regexp"
	"strconv"
	"strings"
	"time"

	"encore.dev/beta/auth"
	"encore.dev/beta/errs"
	"encore.dev/storage/objects"
	"encore.dev/storage/sqldb"
	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

// A private bucket: local files under `encore run`,
// S3 on AWS and Google Cloud Storage on GCP when deployed.
var Attachments = objects.NewBucket("ticket-attachments", objects.BucketConfig{})

var tickets = sqldb.NewDatabase("tickets", sqldb.DatabaseConfig{Migrations: "./migrations"})

var secrets struct {
	// HMAC secret used to verify access tokens.
	AuthTokenHMAC string
}

//encore:authhandler
func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
	uid, err := userIDFromToken(token)
	if err != nil {
		return "", &errs.Error{Code: errs.Unauthenticated, Message: "invalid token"}
	}
	return uid, nil
}

// userIDFromToken verifies a signed access token of the form "<id>.<unix-expiry>.<hex hmac>".
// In production, verify a JWT against your IdP JWKS (signature, issuer, audience,
// expiry) and return the subject. Callers cannot impersonate another user without
// the HMAC secret.
func userIDFromToken(token string) (auth.UID, error) {
	if secrets.AuthTokenHMAC == "" {
		return "", errors.New("auth secret not set")
	}
	parts := strings.Split(token, ".")
	if len(parts) != 3 {
		return "", errors.New("invalid token")
	}
	id, expStr, sig := parts[0], parts[1], parts[2]
	if id == "" || strings.ContainsAny(id, "/ \t\n") {
		return "", errors.New("invalid token")
	}
	exp, err := strconv.ParseInt(expStr, 10, 64)
	if err != nil || exp <= time.Now().Unix() {
		return "", errors.New("invalid token")
	}
	mac := hmac.New(sha256.New, []byte(secrets.AuthTokenHMAC))
	mac.Write([]byte(id + "." + expStr))
	expected := hex.EncodeToString(mac.Sum(nil))
	if subtle.ConstantTimeCompare([]byte(sig), []byte(expected)) != 1 {
		return "", errors.New("invalid token")
	}
	return auth.UID(id), nil
}

const maxUpload = 10 << 20 // 10 MiB

var allowedTypes = map[string]bool{
	"image/png": true, "image/jpeg": true, "application/pdf": true,
}

var safeName = regexp.MustCompile(`[^a-zA-Z0-9._-]`)

//encore:service
type Service struct {
	e *echo.Echo
}

func initService() (*Service, error) {
	e := echo.New()
	e.Use(middleware.Recover())
	e.Use(middleware.BodyLimit("11M"))
	e.POST("/tickets/:id/attachments", upload)
	e.GET("/tickets/:id/attachments/:name", download)
	return &Service{e: e}, nil
}

//encore:api auth raw path=/!fallback
func (s *Service) Fallback(w http.ResponseWriter, req *http.Request) {
	s.e.ServeHTTP(w, req)
}

func authorizeTicket(c echo.Context) (int64, error) {
	uid, ok := auth.UserID()
	if !ok {
		return 0, echo.NewHTTPError(http.StatusUnauthorized)
	}
	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
	if err != nil {
		return 0, echo.NewHTTPError(http.StatusBadRequest, "invalid ticket id")
	}
	var owner string
	err = tickets.QueryRow(c.Request().Context(), `
		SELECT owner_uid FROM tickets WHERE id = $1
	`, id).Scan(&owner)
	if err != nil || owner != string(uid) {
		return 0, echo.NewHTTPError(http.StatusNotFound)
	}
	return id, nil
}

func objectKey(id int64, name string) string {
	return "tickets/" + strconv.FormatInt(id, 10) + "/" + safeName.ReplaceAllString(path.Base(name), "_")
}

func upload(c echo.Context) error {
	id, err := authorizeTicket(c)
	if err != nil {
		return err
	}
	fh, err := c.FormFile("file")
	if err != nil {
		return echo.NewHTTPError(http.StatusBadRequest, "file is required")
	}
	ct := fh.Header.Get("Content-Type")
	if fh.Size > maxUpload || !allowedTypes[ct] {
		return echo.NewHTTPError(http.StatusBadRequest, "PNG, JPEG or PDF up to 10 MiB")
	}
	key := objectKey(id, fh.Filename)
	src, err := fh.Open()
	if err != nil {
		return err
	}
	defer src.Close()

	// Stream to the bucket and refuse to overwrite an existing attachment.
	w := Attachments.Upload(c.Request().Context(), key,
		objects.WithUploadAttrs(objects.UploadAttrs{ContentType: ct}),
		objects.WithPreconditions(objects.Preconditions{NotExists: true}),
	)
	if _, err := io.Copy(w, src); err != nil {
		w.Abort(err)
		return err
	}
	if err := w.Close(); err != nil {
		return echo.NewHTTPError(http.StatusConflict, "an attachment with this name exists")
	}
	return c.JSON(http.StatusCreated, map[string]string{"key": key})
}

func download(c echo.Context) error {
	id, err := authorizeTicket(c)
	if err != nil {
		return err
	}
	key := objectKey(id, c.Param("name"))
	ctx := c.Request().Context()
	if _, err := Attachments.Attrs(ctx, key); errors.Is(err, objects.ErrObjectNotFound) {
		return echo.NewHTTPError(http.StatusNotFound)
	} else if err != nil {
		return err
	}
	u, err := Attachments.SignedDownloadURL(ctx, key, objects.WithTTL(5*time.Minute))
	if err != nil {
		return err
	}
	return c.Redirect(http.StatusFound, u.URL)
}

cfg, err := config.LoadDefaultConfig(ctx)
if err != nil {
	log.Fatal(err)
}
client := s3.NewFromConfig(cfg)
presigner := s3.NewPresignClient(client)
bucket := os.Getenv("ATTACHMENTS_BUCKET")

// In the upload handler (src is the opened multipart file):
_, err = client.PutObject(ctx, &s3.PutObjectInput{
	Bucket:        &bucket,
	Key:           &key,
	Body:          src,
	ContentLength: aws.Int64(fh.Size),
	ContentType:   &ct,
	IfNoneMatch:   aws.String("*"), // fail if the key exists
})

// In the download handler:
req, err := presigner.PresignGetObject(ctx, &s3.GetObjectInput{
	Bucket: &bucket,
	Key:    &key,
}, s3.WithPresignExpires(5*time.Minute))