test: MinIO integration tests for presigned URL s3-signer (Step 2h)

[pyramation]

Summary

Adds integration tests for the s3-signer module in graphile-presigned-url-plugin, exercising presigned URL generation and S3 operations against a real MinIO instance. Also adds the package to the CI test matrix and fixes the CI env var name (MINIO_ENDPOINT → CDN_ENDPOINT) to match the codebase after PR #948 removed all minioEndpoint references.

12 tests covering:

• generatePresignedPutUrl — URL generation + actual PUT upload via presigned URL
• headObject — metadata verification, 404 handling, content-type mismatch detection
• generatePresignedGetUrl — URL generation + actual GET download, Content-Disposition, expiry
• Full round-trip: PUT → HEAD → GET for text payloads, content-addressed (SHA-256) keys, and multiple MIME types

CI changes:

• Renamed MINIO_ENDPOINT → CDN_ENDPOINT in run-tests.yaml global env (the app code no longer reads MINIO_ENDPOINT since PR feat: wire PresignedUrlPreset into ConstructivePreset (Step 2g) #948)
• Added graphile/graphile-presigned-url-plugin to the test matrix

Updates since last revision

• Removed NODE_OPTIONS='--experimental-vm-modules' from the test script. The existing @smithy/node-http-handler pin (<4.5.0) in the root package.json (from PR fix: pin @smithy/node-http-handler <4.5.0 to fix Jest VM dynamic import issue #951) is sufficient to avoid the Jest VM dynamic import issue in CI. No special flags needed.

Review & Testing Checklist for Human

• Verify MINIO_ENDPOINT → CDN_ENDPOINT rename doesn't break other CI test packages — uploads/s3-streamer uses getEnvOptions() which reads CDN_ENDPOINT (or falls back to pgpmDefaults.cdn.endpoint = 'http://localhost:9000'). Grep the repo for any direct process.env.MINIO_ENDPOINT reads that may still exist.
• Verify the new test matrix entry passes in CI — graphile/graphile-presigned-url-plugin needs MinIO available (via the minio_cdn service). Confirm the test job passes on this PR's CI run without --experimental-vm-modules.
• Spot-check that the @smithy/node-http-handler pin from PR fix: pin @smithy/node-http-handler <4.5.0 to fix Jest VM dynamic import issue #951 is still present — these tests depend on the root package.json pnpm override ("@smithy/node-http-handler": "<4.5.0"). If that pin is ever removed, tests will fail with ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING_FLAG.

Notes

• Tests use fixed S3 keys (e.g. test-put-basic.txt). Re-runs against the same MinIO instance are safe since createS3Bucket handles BucketAlreadyOwnedByYou, but stale objects from prior runs could mask upload failures in the beforeAll setup blocks.
• The lockfile diff is large due to pnpm format changes — the only meaningful change is the new @constructive-io/s3-utils workspace devDependency link.
• Only string-body uploads are tested (no binary Buffer uploads) due to TypeScript fetch body type constraints. The underlying S3 operations are identical regardless of body encoding.

Link to Devin session: https://app.devin.ai/sessions/4c882ba2dfbf4045adf85fb83cde6f77
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​pgpm/​metaschema-schema@​0.18.0
	@​pgpm/​metaschema-modules@​0.18.0
	@​pgpm/​database-jobs@​0.18.0
	@​pgpm/​inflection@​0.18.0
	@​pgpm/​types@​0.18.0
	@​pgpm/​verify@​0.18.0
	@​pgpm/​services@​0.18.0
	@​pgsql/​utils@​17.8.15
	@​playwright/​test@​1.58.2

View full report