Google Cloud Storage Signed URLs in Go: Upload and Download

// contracts/contracts.go
package contracts

import (
	"context"
	"crypto/hmac"
	"crypto/rand"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"errors"
	"regexp"
	"strconv"
	"strings"
	"time"

	"encore.dev/beta/auth"
	"encore.dev/beta/errs"
	"encore.dev/storage/objects"
)

// A private Cloud Storage bucket on GCP (S3 on AWS), local storage with `encore run`.
var Contracts = objects.NewBucket("signed-contracts", objects.BucketConfig{})

const maxSize = 10 << 20 // 10 MB

var keyPattern = regexp.MustCompile(`^contracts/[a-zA-Z0-9_-]+/[0-9a-f]{32}\.pdf$`)

var secrets struct {
	// HMAC secret used to verify access tokens.
	AuthTokenHMAC string
}

//encore:authhandler
func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
	uid, err := userIDFromToken(token)
	if err != nil {
		return "", &errs.Error{Code: errs.Unauthenticated, Message: "invalid token"}
	}
	return uid, nil
}

// userIDFromToken verifies a signed access token of the form "<id>.<unix-expiry>.<hex hmac>".
// In production, verify a JWT against your IdP JWKS and return the subject.
func userIDFromToken(token string) (auth.UID, error) {
	if secrets.AuthTokenHMAC == "" {
		return "", errors.New("auth secret not set")
	}
	parts := strings.Split(token, ".")
	if len(parts) != 3 {
		return "", errors.New("invalid token")
	}
	id, expStr, sig := parts[0], parts[1], parts[2]
	if id == "" || strings.ContainsAny(id, "/ \t\n") {
		return "", errors.New("invalid token")
	}
	exp, err := strconv.ParseInt(expStr, 10, 64)
	if err != nil || exp <= time.Now().Unix() {
		return "", errors.New("invalid token")
	}
	mac := hmac.New(sha256.New, []byte(secrets.AuthTokenHMAC))
	mac.Write([]byte(id + "." + expStr))
	expected := hex.EncodeToString(mac.Sum(nil))
	if subtle.ConstantTimeCompare([]byte(sig), []byte(expected)) != 1 {
		return "", errors.New("invalid token")
	}
	return auth.UID(id), nil
}

func callerPrefix() (string, error) {
	uid, ok := auth.UserID()
	if !ok {
		return "", &errs.Error{Code: errs.Unauthenticated, Message: "unauthenticated"}
	}
	return "contracts/" + string(uid) + "/", nil
}

func keyBelongsToCaller(key string) bool {
	prefix, err := callerPrefix()
	return err == nil && strings.HasPrefix(key, prefix) && !strings.Contains(key, "..") && keyPattern.MatchString(key)
}

type UploadURLResponse struct {
	Key string `json:"key"`
	URL string `json:"url"` // PUT the PDF here within 10 minutes
}

// UploadURL returns a signed URL for one new contract PDF, under the caller's prefix.
//
//encore:api auth method=POST path=/contracts/upload-url
func UploadURL(ctx context.Context) (*UploadURLResponse, error) {
	prefix, err := callerPrefix()
	if err != nil {
		return nil, err
	}
	id := make([]byte, 16)
	if _, err := rand.Read(id); err != nil {
		return nil, err
	}
	key := prefix + hex.EncodeToString(id) + ".pdf"
	u, err := Contracts.SignedUploadURL(ctx, key, objects.WithTTL(10*time.Minute))
	if err != nil {
		return nil, err
	}
	return &UploadURLResponse{Key: key, URL: u.URL}, nil
}

type ConfirmParams struct {
	Key string `json:"key"`
}

// Confirm checks the uploaded object and deletes it if it breaks the rules,
// since a signed PUT URL does not limit size or content type.
//
//encore:api auth method=POST path=/contracts/confirm
func Confirm(ctx context.Context, p *ConfirmParams) error {
	if !keyBelongsToCaller(p.Key) {
		return &errs.Error{Code: errs.InvalidArgument, Message: "invalid key"}
	}
	attrs, err := Contracts.Attrs(ctx, p.Key)
	if errors.Is(err, objects.ErrObjectNotFound) {
		return &errs.Error{Code: errs.NotFound, Message: "upload not found"}
	} else if err != nil {
		return err
	}
	if attrs.Size > maxSize || attrs.ContentType != "application/pdf" {
		_ = Contracts.Remove(ctx, p.Key)
		return &errs.Error{Code: errs.InvalidArgument, Message: "expected a PDF up to 10 MB"}
	}
	return nil
}

type DownloadURLParams struct {
	Key string `query:"key"`
}

type DownloadURLResponse struct {
	URL string `json:"url"`
}

// DownloadURL returns a link that works for five minutes. Check that the
// caller may read this contract before signing, for example in an auth handler.
//
//encore:api auth method=GET path=/contracts/download-url
func DownloadURL(ctx context.Context, p *DownloadURLParams) (*DownloadURLResponse, error) {
	if !keyBelongsToCaller(p.Key) {
		return nil, &errs.Error{Code: errs.InvalidArgument, Message: "invalid key"}
	}
	if ok, err := Contracts.Exists(ctx, p.Key); err != nil {
		return nil, err
	} else if !ok {
		return nil, &errs.Error{Code: errs.NotFound, Message: "contract not found"}
	}
	u, err := Contracts.SignedDownloadURL(ctx, p.Key, objects.WithTTL(5*time.Minute))
	if err != nil {
		return nil, err
	}
	return &DownloadURLResponse{URL: u.URL}, nil
}

var bucket = os.Getenv("CONTRACTS_BUCKET") // a different bucket per environment

// uploadURL signs a PUT for one object. The client must send exactly
// Content-Type: application/pdf, or GCS rejects the signature.
func uploadURL(client *storage.Client, key string) (string, error) {
	return client.Bucket(bucket).SignedURL(key, &storage.SignedURLOptions{
		Scheme:      storage.SigningSchemeV4,
		Method:      "PUT",
		ContentType: "application/pdf",
		Expires:     time.Now().Add(10 * time.Minute),
	})
}

// downloadURL signs a GET and asks GCS to serve the file as an attachment.
func downloadURL(client *storage.Client, key string) (string, error) {
	return client.Bucket(bucket).SignedURL(key, &storage.SignedURLOptions{
		Scheme:  storage.SigningSchemeV4,
		Method:  "GET",
		Expires: time.Now().Add(5 * time.Minute),
		QueryParameters: url.Values{
			"response-content-disposition": {`attachment; filename="contract.pdf"`},
		},
	})
}

func main() {
	// On Cloud Run the client finds the service account email through the
	// metadata server and signs through the IAM signBlob API.
	client, err := storage.NewClient(context.Background())
	if err != nil {
		log.Fatal(err)
	}
	defer client.Close()
	// ... call uploadURL and downloadURL from your handlers
}