Change custom policy documents in getPrivateUrl to be base64-encoded

[bsorbo]

Hi, I noticed that AWS rejects URL's generated by getPrivateUrl when custom policy parameters are used, such as 'IpAddress'.

It looks like the policy document is supposed to be encoded in base64 prior to being added to the URL (which makes sense). The documentation is actually pretty vague on this, but the PHP code example clearly shows this happening:

..
$canned_policy = '{"Statement":[{"Resource":"' . $video_path . '","Condition":{"DateLessThan":{"AWS:EpochTime":'. $expires . '}}}]}';
// the policy contains characters that cannot be part of a URL,
// so we Base64 encode it
$encoded_policy = url_safe_base64_encode($canned_policy);
..

http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/CreateURL_PHP.html

Let me know if there's a better way to implement this (small) change, thanks.

[tellnes]

Looks like I forgot the base64 part. But the rest of the line is correct. If you look at the implementation of url_safe_base64_encode, it does little more than just base64 encode the string. It also replaces the characters +, = and / with -, _ and ~.

When i tests a little, it does not look like it is nessesary to replacing those characters, but the php example code does that, so I think we should do it also.

What I probably intended to write was something like this:

policy = new Buffer(policy).toString('base64');
query["Policy"] = policy.replace(/\+/g, '-').replace(/\=/g, '_').replace(/\//g, '~');

Can you update the code to include the replacing part?

[mr-mig]

Would you be so kind to merge this pull request?

[tellnes]

@mr-mig Sorry for the delay. I've fixed it now and published a new version to npm.