fix(medusa, medusa-file-*): Protected uploads for file services

[pKorsholm]

What

• protect imports
• make minio work with imports

Why

• imports were previously using public files which might pose a problem depending on the subject of the import
• using the public bucket for imports breaks imports in minio since it's a multi-bucket setup due to ACL's

How

• add an additional endpoint for uploading protected files

Testing

• validating that product import and export work with minio and DO file services.

[changeset-bot]

🦋 Changeset detected

Latest commit: ba88998

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
medusa-file-minio	Patch
medusa-file-s3	Patch
medusa-file-spaces	Patch
@medusajs/medusa-js	Patch
medusa-react	Patch
@medusajs/medusa	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[olivermrbl]

This is very nice - great work @pKorsholm! I have a single thought, that I'd like your feedback on.

[olivermrbl]

thought: It seems the interface is used slighly differently from plugin to plugin. Here we use it to directly pass the access level while in Minio it's a flag. Would it make sense to consistently use uploadFile with a flag to indicate the privacy level?

This would mean, that we'd have to have the following in S3:

uploadFile(file, makePrivate) {
    const s3 = new aws.S3()
    const params = {
      ACL: makePrivate ? "private" : "public-read",
      ...

And the following in Minio:

uploadFile(file, makePrivate) {
    const parsedFilename = parse(file.originalname)
    const fileKey = `${parsedFilename.name}-${Date.now()}${parsedFilename.ext}`

    const s3 = new aws.S3()
    const params = {
      ACL: makePrivate ? "private" : "public-read",
      Bucket: makePrivate ? this.private_bucket_ : this.bucket_,
      ....

And so forth for all plugins.

Let me know what you think.

[adrien2p]

pretty agree on that in order to make the api consistent and easier to use. Would just say that the second argument could be like:

uploadFile(file, options: { isProtected?: boolean } = { isProtected: false })

[olivermrbl]

I like that. This would also allow us to add an ACL-specific prop in case users need more granular access control:

uploadFile(file, options: { isProtected?: boolean, acl?: string } = { isProtected: false })

[olivermrbl]

LGTM - great work!