How to Generate S3 Presigned Upload URLs in Go

// media/media.go
package media

import (
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"errors"
	"fmt"
	"path"
	"strconv"
	"strings"
	"time"

	"encore.dev/beta/auth"
	"encore.dev/beta/errs"
	"encore.dev/storage/objects"
	"github.com/google/uuid"
)

// An S3 bucket on AWS, a GCS bucket on GCP, the local filesystem in development.
var Uploads = objects.NewBucket("user-uploads", objects.BucketConfig{})

const maxUploadBytes = 100 << 20 // 100 MiB

var secrets struct {
	// HMAC secret used to verify access tokens.
	AuthTokenHMAC string
}

//encore:authhandler
func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
	uid, err := userIDFromToken(token)
	if err != nil {
		return "", &errs.Error{Code: errs.Unauthenticated, Message: "invalid token"}
	}
	return uid, nil
}

// userIDFromToken verifies a signed access token of the form "<id>.<unix-expiry>.<hex hmac>".
// In production, verify a JWT against your IdP JWKS (signature, issuer, audience,
// expiry) and return the subject. Callers cannot impersonate another user without
// the HMAC secret.
func userIDFromToken(token string) (auth.UID, error) {
	if secrets.AuthTokenHMAC == "" {
		return "", errors.New("auth secret not set")
	}
	parts := strings.Split(token, ".")
	if len(parts) != 3 {
		return "", errors.New("invalid token")
	}
	id, expStr, sig := parts[0], parts[1], parts[2]
	if id == "" || strings.ContainsAny(id, "/ \t\n") {
		return "", errors.New("invalid token")
	}
	exp, err := strconv.ParseInt(expStr, 10, 64)
	if err != nil || exp <= time.Now().Unix() {
		return "", errors.New("invalid token")
	}
	mac := hmac.New(sha256.New, []byte(secrets.AuthTokenHMAC))
	mac.Write([]byte(id + "." + expStr))
	expected := hex.EncodeToString(mac.Sum(nil))
	if subtle.ConstantTimeCompare([]byte(sig), []byte(expected)) != 1 {
		return "", errors.New("invalid token")
	}
	return auth.UID(id), nil
}


type UploadURLParams struct {
	FileName string `json:"file_name"`
}

type UploadURLResponse struct {
	Key string `json:"key"`
	URL string `json:"url"`
}

//encore:api auth method=POST path=/uploads
func CreateUploadURL(ctx context.Context, p *UploadURLParams) (*UploadURLResponse, error) {
	uid, ok := auth.UserID()
	if !ok {
		return nil, &errs.Error{Code: errs.Unauthenticated, Message: "unauthenticated"}
	}
	name := path.Base(p.FileName)
	if name == "" || name == "." || name == "/" {
		return nil, &errs.Error{Code: errs.InvalidArgument, Message: "file_name is required"}
	}
	key := fmt.Sprintf("incoming/%s/%s/%s", uid, uuid.NewString(), name)
	u, err := Uploads.SignedUploadURL(ctx, key, objects.WithTTL(15*time.Minute))
	if err != nil {
		return nil, err
	}
	return &UploadURLResponse{Key: key, URL: u.URL}, nil
}

type ObjectInfo struct {
	Key  string `json:"key"`
	Size int64  `json:"size"`
}

// Confirm checks that the client finished the upload, that the object belongs
// to the caller, and that it is within the size limit, before the app uses it.
//
//encore:api auth method=GET path=/uploads/*key
func Confirm(ctx context.Context, key string) (*ObjectInfo, error) {
	uid, ok := auth.UserID()
	if !ok {
		return nil, &errs.Error{Code: errs.Unauthenticated, Message: "unauthenticated"}
	}
	prefix := "incoming/" + string(uid) + "/"
	if !strings.HasPrefix(key, prefix) || strings.Contains(key, "..") {
		return nil, &errs.Error{Code: errs.NotFound, Message: "upload not found"}
	}
	attrs, err := Uploads.Attrs(ctx, key)
	if err != nil {
		return nil, &errs.Error{Code: errs.NotFound, Message: "upload not found"}
	}
	if attrs.Size > maxUploadBytes {
		_ = Uploads.Remove(ctx, key)
		return nil, &errs.Error{Code: errs.InvalidArgument, Message: "file exceeds 100 MiB"}
	}
	return &ObjectInfo{Key: key, Size: attrs.Size}, nil
}

package uploads

import (
	"context"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/s3"
)

type Signer struct {
	presign *s3.PresignClient
	bucket  string
}

func NewSigner(ctx context.Context, bucket string) (*Signer, error) {
	cfg, err := config.LoadDefaultConfig(ctx)
	if err != nil {
		return nil, err
	}
	return &Signer{presign: s3.NewPresignClient(s3.NewFromConfig(cfg)), bucket: bucket}, nil
}

func (s *Signer) UploadURL(ctx context.Context, key, contentType string) (string, error) {
	req, err := s.presign.PresignPutObject(ctx, &s3.PutObjectInput{
		Bucket:      aws.String(s.bucket),
		Key:         aws.String(key),
		ContentType: aws.String(contentType),
	}, s3.WithPresignExpires(15*time.Minute))
	if err != nil {
		return "", err
	}
	return req.URL, nil
}