ARSN-108 Fix test suites

Installing from git sources for dependents produced only an index.js
file. It was due to .gitignore ignoring the build folder and npm/yarn
removing the ignored files after install. Adding an empty .npmignore
solves the problem. This can be found here:
https://stackoverflow.com/questions/61754026/installing-npm-package-with-prepare-script-from-yarn-produces-only-index-js

.github/workflows/tests.yaml

@@ -31,7 +31,8 @@ jobs:
         node-version: '16'
         cache: 'yarn'
     - name: install dependencies
-      run: yarn install --frozen-lockfile
+      run: yarn cache clean && yarn install --frozen-lockfile
+      continue-on-error: true # TODO ARSN-97 Remove it when no errors in TS
     - name: lint yaml
       run: yarn --silent lint_yml
     - name: lint javascript
@@ -45,3 +46,31 @@ jobs:
     - name: run executables tests
       run: yarn install && yarn test
       working-directory: 'lib/executables/pensieveCreds/'
+
+  compile:
+    name: Compile and upload build artifacts
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+    - name: Install NodeJS
+      uses: actions/setup-node@v2
+      with:
+        node-version: '16'
+        cache: yarn
+    - name: Install dependencies
+      run: yarn cache clean && yarn install --frozen-lockfile
+      continue-on-error: true # TODO ARSN-97 Remove it when no errors in TS
+    - name: Compile
+      run: yarn build
+      continue-on-error: true # TODO ARSN-97 Remove it when no errors in TS
+    - name: Upload artifacts
+      uses: scality/action-artifacts@v2
+      with:
+        url: https://artifacts.scality.net
+        user: ${{ secrets.ARTIFACTS_USER }}
+        password: ${{ secrets.ARTIFACTS_PASSWORD }}
+        source: ./build
+        method: upload
+      if: success()

.gitignore

@@ -10,3 +10,9 @@ node_modules/
 *-linux
 *-macos
 
+# Coverage
+coverage/
+.nyc_output/
+
+# TypeScript
+build/

babel.config.js

@@ -0,0 +1,6 @@
+module.exports = {
+    presets: [
+        ['@babel/preset-env', { targets: { node: 'current' } }],
+        '@babel/preset-typescript',
+    ],
+};

errors/arsenalErrors.json

@@ -1,760 +0,0 @@
-{
-  "_comment": "------------------- Amazon errors ------------------",
-  "AccessDenied": {
-    "code": 403,
-    "description": "Access Denied"
-  },
-  "AccessForbidden": {
-    "code": 403,
-    "description": "Access Forbidden"
-  },
-  "AccountProblem": {
-    "code": 403,
-    "description": "There is a problem with your AWS account that prevents the operation from completing successfully. Please use Contact Us."
-  },
-  "AmbiguousGrantByEmailAddress": {
-    "code": 400,
-    "description": "The email address you provided is associated with more than one account."
-  },
-  "BadDigest": {
-    "code": 400,
-    "description": "The Content-MD5 you specified did not match what we received."
-  },
-  "BucketAlreadyExists": {
-    "code": 409,
-    "description": "The requested bucket name is not available. The bucket namespace is shared by all users of the system. Please select a different name and try again."
-  },
-  "BucketAlreadyOwnedByYou": {
-    "code": 409,
-    "description": "Your previous request to create the named bucket succeeded and you already own it. You get this error in all AWS regions except US Standard, us-east-1. In us-east-1 region, you will get 200 OK, but it is no-op (if bucket exists S3 will not do anything)."
-  },
-  "BucketNotEmpty": {
-    "code": 409,
-    "description": "The bucket you tried to delete is not empty."
-  },
-  "CredentialsNotSupported": {
-    "code": 400,
-    "description": "This request does not support credentials."
-  },
-  "CrossLocationLoggingProhibited": {
-    "code": 403,
-    "description": "Cross-location logging not allowed. Buckets in one geographic location cannot log information to a bucket in another location."
-  },
-  "DeleteConflict": {
-    "code": 409,
-    "description": "The request was rejected because it attempted to delete a resource that has attached subordinate entities. The error message describes these entities."
-  },
-  "EntityTooSmall": {
-    "code": 400,
-    "description": "Your proposed upload is smaller than the minimum allowed object size."
-  },
-  "EntityTooLarge": {
-    "code": 400,
-    "description": "Your proposed upload exceeds the maximum allowed object size."
-  },
-  "ExpiredToken": {
-    "code": 400,
-    "description": "The provided token has expired."
-  },
-  "HttpHeadersTooLarge": {
-    "code": 400,
-    "description": "Your http headers exceed the maximum allowed http headers size."
-  },
-  "IllegalVersioningConfigurationException": {
-    "code": 400,
-    "description": "Indicates that the versioning configuration specified in the request is invalid."
-  },
-  "IncompleteBody": {
-    "code": 400,
-    "description": "You did not provide the number of bytes specified by the Content-Length HTTP header."
-  },
-  "IncorrectNumberOfFilesInPostRequest": {
-    "code": 400,
-    "description": "POST requires exactly one file upload per request."
-  },
-  "InlineDataTooLarge": {
-    "code": 400,
-    "description": "Inline data exceeds the maximum allowed size."
-  },
-  "InternalError": {
-    "code": 500,
-    "description": "We encountered an internal error. Please try again."
-  },
-  "InvalidAccessKeyId": {
-    "code": 403,
-    "description": "The AWS access key Id you provided does not exist in our records."
-  },
-  "InvalidAddressingHeader": {
-    "code": 400,
-    "description": "You must specify the Anonymous role."
-  },
-  "InvalidArgument": {
-    "code": 400,
-    "description": "Invalid Argument"
-  },
-  "InvalidBucketName": {
-    "code": 400,
-    "description": "The specified bucket is not valid."
-  },
-  "InvalidBucketState": {
-    "code": 409,
-    "description": "The request is not valid with the current state of the bucket."
-  },
-  "InvalidDigest": {
-    "code": 400,
-    "description": "The Content-MD5 you specified is not valid."
-  },
-  "InvalidEncryptionAlgorithmError": {
-    "code": 400,
-    "description": "The encryption request you specified is not valid. The valid value is AES256."
-  },
-  "InvalidLocationConstraint": {
-    "code": 400,
-    "description": "The specified location constraint is not valid."
-  },
-  "InvalidObjectState": {
-    "code": 403,
-    "description": "The operation is not valid for the current state of the object."
-  },
-  "InvalidPart": {
-    "code": 400,
-    "description": "One or more of the specified parts could not be found. The part might not have been uploaded, or the specified entity tag might not have matched the part's entity tag."
-  },
-  "InvalidPartOrder": {
-    "code": 400,
-    "description": "The list of parts was not in ascending order.Parts list must specified in order by part number."
-  },
-  "InvalidPartNumber": {
-    "code": 416,
-    "description": "The requested partnumber is not satisfiable."
-  },
-  "InvalidPayer": {
-    "code": 403,
-    "description": "All access to this object has been disabled."
-  },
-  "InvalidPolicyDocument": {
-    "code": 400,
-    "description": "The content of the form does not meet the conditions specified in the policy document."
-  },
-  "InvalidRange": {
-    "code": 416,
-    "description": "The requested range cannot be satisfied."
-  },
-  "InvalidRedirectLocation": {
-    "code": 400,
-    "description": "The website redirect location must have a prefix of 'http://' or 'https://' or '/'."
-  },
-  "InvalidRequest": {
-    "code": 400,
-    "description": "SOAP requests must be made over an HTTPS connection."
-  },
-  "InvalidSecurity": {
-    "code": 403,
-    "description": "The provided security credentials are not valid."
-  },
-  "InvalidSOAPRequest": {
-    "code": 400,
-    "description": "The SOAP request body is invalid."
-  },
-  "InvalidStorageClass": {
-    "code": 400,
-    "description": "The storage class you specified is not valid."
-  },
-  "InvalidTag": {
-    "code": 400,
-    "description": "The Tag you have provided is invalid"
-  },
-  "InvalidTargetBucketForLogging": {
-    "code": 400,
-    "description": "The target bucket for logging does not exist, is not owned by you, or does not have the appropriate grants for the log-delivery group."
-  },
-  "InvalidToken": {
-    "code": 400,
-    "description": "The provided token is malformed or otherwise invalid."
-  },
-  "InvalidURI": {
-    "code": 400,
-    "description": "Couldn't parse the specified URI."
-  },
-  "KeyTooLong": {
-    "code": 400,
-    "description": "Your key is too long."
-  },
-  "LimitExceeded": {
-    "code": 409,
-    "description": "    The request was rejected because it attempted to create resources beyond the current AWS account limits. The error message describes the limit exceeded."
-  },
-  "MalformedACLError": {
-    "code": 400,
-    "description": "The XML you provided was not well-formed or did not validate against our published schema."
-  },
-  "MalformedPOSTRequest": {
-    "code": 400,
-    "description": "The body of your POST request is not well-formed multipart/form-data."
-  },
-  "MalformedXML": {
-    "code": 400,
-    "description": "The XML you provided was not well-formed or did not validate against our published schema."
-  },
-  "MaxMessageLengthExceeded": {
-    "code": 400,
-    "description": "Your request was too big."
-  },
-  "MaxPostPreDataLengthExceededError": {
-    "code": 400,
-    "description": "Your POST request fields preceding the upload file were too large."
-  },
-  "MetadataTooLarge": {
-    "code": 400,
-    "description": "Your metadata headers exceed the maximum allowed metadata size."
-  },
-  "MethodNotAllowed": {
-    "code": 405,
-    "description": "The specified method is not allowed against this resource."
-  },
-  "MissingAttachment": {
-    "code": 400,
-    "description": "A SOAP attachment was expected, but none were found."
-  },
-  "MissingContentLength": {
-    "code": 411,
-    "description": "You must provide the Content-Length HTTP header."
-  },
-  "MissingRequestBodyError": {
-    "code": 400,
-    "description": "Request body is empty"
-  },
-  "MissingRequiredParameter": {
-    "code": 400,
-    "description": "Your request is missing a required parameter."
-  },
-  "MissingSecurityElement": {
-    "code": 400,
-    "description": "The SOAP 1.1 request is missing a security element."
-  },
-  "MissingSecurityHeader": {
-    "code": 400,
-    "description": "Your request is missing a required header."
-  },
-  "NoLoggingStatusForKey": {
-    "code": 400,
-    "description": "There is no such thing as a logging status subresource for a key."
-  },
-  "NoSuchBucket": {
-    "code": 404,
-    "description": "The specified bucket does not exist."
-  },
-  "NoSuchCORSConfiguration": {
-    "code": 404,
-    "description": "The CORS configuration does not exist"
-  },
-  "NoSuchKey": {
-    "code": 404,
-    "description": "The specified key does not exist."
-  },
-  "NoSuchLifecycleConfiguration": {
-    "code": 404,
-    "description": "The lifecycle configuration does not exist."
-  },
-  "NoSuchObjectLockConfiguration": {
-    "code": 404,
-    "description": "The specified object does not have a ObjectLock configuration."
-  },
-  "NoSuchWebsiteConfiguration": {
-    "code": 404,
-    "description": "The specified bucket does not have a website configuration"
-  },
-  "NoSuchUpload": {
-    "code": 404,
-    "description": "The specified multipart upload does not exist. The upload ID might be invalid, or the multipart upload might have been aborted or completed."
-  },
-  "NoSuchVersion": {
-    "code": 404,
-    "description": "Indicates that the version ID specified in the request does not match an existing version."
-  },
-  "ReplicationConfigurationNotFoundError": {
-    "code": 404,
-    "description": "The replication configuration was not found"
-  },
-  "ObjectLockConfigurationNotFoundError": {
-    "code": 404,
-    "description": "The object lock configuration was not found"
-  },
-  "ServerSideEncryptionConfigurationNotFoundError" : {
-    "code": 404,
-    "description": "The server side encryption configuration was not found"
-  },
-  "NotImplemented": {
-    "code": 501,
-    "description": "A header you provided implies functionality that is not implemented."
-  },
-  "NotModified": {
-    "code": 304,
-    "description": "Not Modified."
-  },
-  "NotSignedUp": {
-    "code": 403,
-    "description": "Your account is not signed up for the S3 service. You must sign up before you can use S3. "
-  },
-  "NoSuchBucketPolicy": {
-    "code": 404,
-    "description": "The specified bucket does not have a bucket policy."
-  },
-  "OperationAborted": {
-    "code": 409,
-    "description": "A conflicting conditional operation is currently in progress against this resource. Try again."
-  },
-  "PermanentRedirect": {
-    "code": 301,
-    "description": "The bucket you are attempting to access must be addressed using the specified endpoint. Send all future requests to this endpoint."
-  },
-  "PreconditionFailed": {
-    "code": 412,
-    "description": "At least one of the preconditions you specified did not hold."
-  },
-  "Redirect": {
-    "code": 307,
-    "description": "Temporary redirect."
-  },
-  "RestoreAlreadyInProgress": {
-    "code": 409,
-    "description": "Object restore is already in progress."
-  },
-  "RequestIsNotMultiPartContent": {
-    "code": 400,
-    "description": "Bucket POST must be of the enclosure-type multipart/form-data."
-  },
-  "RequestTimeout": {
-    "code": 400,
-    "description": "Your socket connection to the server was not read from or written to within the timeout period."
-  },
-  "RequestTimeTooSkewed": {
-    "code": 403,
-    "description": "The difference between the request time and the server's time is too large."
-  },
-  "RequestTorrentOfBucketError": {
-    "code": 400,
-    "description": "Requesting the torrent file of a bucket is not permitted."
-  },
-  "SignatureDoesNotMatch": {
-    "code": 403,
-    "description": "The request signature we calculated does not match the signature you provided."
-  },
-  "_comment" : {
-    "note" : "This is an AWS S3 specific error. We are opting to use the more general 'ServiceUnavailable' error used throughout AWS (IAM/EC2) to have uniformity of error messages even though we are potentially compromising S3 compatibility.",
-    "ServiceUnavailable": {
-      "code": 503,
-      "description": "Reduce your request rate."
-    }
-  },
-  "ServiceUnavailable": {
-    "code": 503,
-    "description": "The request has failed due to a temporary failure of the server."
-  },
-  "SlowDown": {
-    "code": 503,
-    "description": "Reduce your request rate."
-  },
-  "TemporaryRedirect": {
-    "code": 307,
-    "description": "You are being redirected to the bucket while DNS updates."
-  },
-  "TokenRefreshRequired": {
-    "code": 400,
-    "description": "The provided token must be refreshed."
-  },
-  "TooManyBuckets": {
-    "code": 400,
-    "description": "You have attempted to create more buckets than allowed."
-  },
-  "TooManyParts": {
-    "code": 400,
-    "description": "You have attempted to upload more parts than allowed."
-  },
-  "UnexpectedContent": {
-    "code": 400,
-    "description": "This request does not support content."
-  },
-  "UnresolvableGrantByEmailAddress": {
-    "code": 400,
-    "description": "The email address you provided does not match any account on record."
-  },
-  "UserKeyMustBeSpecified": {
-    "code": 400,
-    "description": "The bucket POST must contain the specified field name. If it is specified, check the order of the fields."
-  },
-  "NoSuchEntity": {
-    "code": 404,
-    "description": "The request was rejected because it referenced an entity that does not exist. The error message describes the entity."
-  },
-  "WrongFormat": {
-    "code": 400,
-    "description": "Data entered by the user has a wrong format."
-  },
-  "Forbidden": {
-    "code": 403,
-    "description": "Authentication failed."
-  },
-  "EntityDoesNotExist": {
-    "code": 404,
-    "description": "Not found."
-  },
-  "EntityAlreadyExists": {
-    "code": 409,
-    "description": "The request was rejected because it attempted to create a resource that already exists."
-  },
-  "ServiceFailure": {
-    "code": 500,
-    "description": "Server error: the request processing has failed because of an unknown error, exception or failure."
-  },
-  "IncompleteSignature": {
-    "code": 400,
-    "description": "The request signature does not conform to AWS standards."
-  },
-  "InternalFailure": {
-    "code": 500,
-    "description": "The request processing has failed because of an unknown error, exception or failure."
-  },
-  "InvalidAction": {
-    "code": 400,
-    "description": "The action or operation requested is invalid. Verify that the action is typed correctly."
-  },
-  "InvalidClientTokenId": {
-    "code": 403,
-    "description": "The X.509 certificate or AWS access key ID provided does not exist in our records."
-  },
-  "InvalidParameterCombination": {
-    "code": 400,
-    "description": "Parameters that must not be used together were used together."
-  },
-  "InvalidParameterValue": {
-    "code": 400,
-    "description": "An invalid or out-of-range value was supplied for the input parameter."
-  },
-  "InvalidQueryParameter": {
-    "code": 400,
-    "description": "The AWS query string is malformed or does not adhere to AWS standards."
-  },
-  "MalformedQueryString": {
-    "code": 404,
-    "description": "The query string contains a syntax error."
-  },
-  "MissingAction": {
-    "code": 400,
-    "description": "The request is missing an action or a required parameter."
-  },
-  "MissingAuthenticationToken": {
-    "code": 403,
-    "description": "The request must contain either a valid (registered) AWS access key ID or X.509 certificate."
-  },
-  "MissingParameter": {
-    "code": 400,
-    "description": "A required parameter for the specified action is not supplied."
-  },
-  "OptInRequired": {
-    "code": 403,
-    "description": "The AWS access key ID needs a subscription for the service."
-  },
-  "RequestExpired": {
-    "code": 400,
-    "description": "The request reached the service more than 15 minutes after the date stamp on the request or more than 15 minutes after the request expiration date (such as for pre-signed URLs), or the date stamp on the request is more than 15 minutes in the future."
-  },
-  "Throttling": {
-    "code": 400,
-    "description": "The request was denied due to request throttling."
-  },
-  "AccountNotFound": {
-    "code": 404,
-    "description": "No account was found in Vault, please contact your system administrator."
-  },
-  "ValidationError": {
-    "code": 400,
-    "description": "The specified value is invalid."
-  },
-  "MalformedPolicyDocument": {
-     "code": 400,
-     "description": "Syntax errors in policy."
-  },
-  "InvalidInput": {
-     "code": 400,
-     "description": "The request was rejected because an invalid or out-of-range value was supplied for an input parameter."
-  },
-  "MalformedPolicy": {
-    "code": 400,
-    "description": "This policy contains invalid Json"
-  },
-  "ReportExpired": {
-    "code": 410,
-    "description": "The request was rejected because the most recent credential report has expired. To generate a new credential report, use GenerateCredentialReport."
-  },
-  "ReportInProgress": {
-    "code": 404,
-    "description": "The request was rejected because the credential report is still being generated."
-  },
-  "ReportNotPresent": {
-    "code": 410,
-    "description": "The request was rejected because the credential report does not exist. To generate a credential report, use GenerateCredentialReport."
-  },
-  "_comment": "-------------- Special non-AWS S3 errors --------------",
-  "MPUinProgress": {
-    "code": 409,
-    "description": "The bucket you tried to delete has an ongoing multipart upload."
-  },
-  "_comment": "-------------- Internal project errors --------------",
-  "_comment": "----------------------- Vault -----------------------",
-  "_comment": "#### formatErrors ####",
-  "BadName": {
-    "description": "name not ok",
-    "code": 5001
-  },
-  "BadAccount": {
-    "description": "account not ok",
-    "code": 5002
-  },
-  "BadGroup": {
-    "description": "group not ok",
-    "code": 5003
-  },
-  "BadId": {
-    "description": "id not ok",
-    "code": 5004
-  },
-  "BadAccountName": {
-    "description": "accountName not ok",
-    "code": 5005
-  },
-  "BadNameFriendly": {
-    "description": "nameFriendly not ok",
-    "code": 5006
-  },
-  "BadEmailAddress": {
-    "description": "email address not ok",
-    "code": 5007
-  },
-  "BadPath": {
-    "description": "path not ok",
-    "code": 5008
-  },
-  "BadArn": {
-    "description": "arn not ok",
-    "code": 5009
-  },
-  "BadCreateDate": {
-    "description": "createDate not ok",
-    "code": 5010
-  },
-  "BadLastUsedDate": {
-    "description": "lastUsedDate not ok",
-    "code": 5011
-  },
-  "BadNotBefore": {
-    "description": "notBefore not ok",
-    "code": 5012
-  },
-  "BadNotAfter": {
-    "description": "notAfter not ok",
-    "code": 5013
-  },
-  "BadSaltedPwd": {
-    "description": "salted password not ok",
-    "code": 5014
-  },
-  "ok": {
-    "description": "No error",
-    "code": 200
-  },
-  "BadUser": {
-    "description": "user not ok",
-    "code": 5016
-  },
-  "BadSaltedPasswd": {
-    "description": "salted password not ok",
-    "code": 5017
-  },
-  "BadPasswdDate": {
-    "description": "password date not ok",
-    "code": 5018
-  },
-  "BadCanonicalId": {
-    "description": "canonicalId not ok",
-    "code": 5019
-  },
-  "BadAlias": {
-    "description": "alias not ok",
-    "code": 5020
-  },
-  "_comment": "#### internalErrors ####",
-  "DBPutFailed": {
-    "description": "DB put failed",
-    "code": 5021
-  },
-  "_comment": "#### alreadyExistErrors ####",
-  "AccountEmailAlreadyUsed": {
-    "description": "an other account already uses that email",
-    "code": 5022
-  },
-  "AccountNameAlreadyUsed": {
-    "description": "an other account already uses that name",
-    "code": 5023
-  },
-  "UserEmailAlreadyUsed": {
-    "description": "an other user already uses that email",
-    "code": 5024
-  },
-  "UserNameAlreadyUsed": {
-    "description": "an other user already uses that name",
-    "code": 5025
-  },
-  "_comment": "#### doesntExistErrors ####",
-  "NoParentAccount": {
-    "description": "parent account does not exist",
-    "code": 5026
-  },
-  "_comment": "#### authErrors ####",
-  "BadStringToSign": {
-    "description": "stringToSign not ok'",
-    "code": 5027
-  },
-  "BadSignatureFromRequest": {
-    "description": "signatureFromRequest not ok",
-    "code": 5028
-  },
-  "BadAlgorithm": {
-    "description": "hashAlgorithm not ok",
-    "code": 5029
-  },
-  "SecretKeyDoesNotExist": {
-    "description": "secret key does not exist",
-    "code": 5030
-  },
-  "InvalidRegion": {
-    "description": "Region was not provided or is not recognized by the system",
-    "code": 5031
-  },
-  "ScopeDate": {
-    "description": "scope date is missing, or format is invalid",
-    "code": 5032
-  },
-  "BadAccessKey": {
-    "description": "access key not ok",
-    "code": 5033
-  },
-  "NoDict": {
-    "description": "no dictionary of params provided for signature verification",
-    "code": 5034
-  },
-  "BadSecretKey": {
-    "description": "secretKey not ok",
-    "code": 5035
-  },
-  "BadSecretKeyValue": {
-    "description": "secretKey value not ok",
-    "code": 5036
-  },
-  "BadSecretKeyStatus": {
-    "description": "secretKey status not ok",
-    "code": 5037
-  },
-  "_comment": "#### OidcpErrors ####",
-  "BadUrl": {
-    "description": "url not ok",
-    "code": 5038
-  },
-  "BadClientIdList": {
-    "description": "client id list not ok'",
-    "code": 5039
-  },
-  "BadThumbprintList": {
-    "description": "thumbprint list not ok'",
-    "code": 5040
-  },
-  "BadObject": {
-    "description": "Object not ok'",
-    "code": 5041
-  },
-  "_comment": "#### RoleErrors ####",
-  "BadRole": {
-    "description": "role not ok",
-    "code": 5042
-  },
-  "_comment": "#### SamlpErrors ####",
-  "BadSamlp": {
-    "description": "samlp not ok",
-    "code": 5043
-  },
-  "BadMetadataDocument": {
-    "description": "metadata document not ok",
-    "code": 5044
-  },
-  "BadSessionIndex": {
-    "description": "session index not ok",
-    "code": 5045
-  },
-  "Unauthorized": {
-    "description": "not authenticated",
-    "code": 401
-  },
-  "_comment": "---------------------  MetaData ---------------------",
-  "_comment": "#### formatErrors ####",
-  "CacheUpdated": {
-    "description": "The cache has been updated",
-    "code": 500
-  },
-  "DBNotFound": {
-    "description": "This DB does not exist",
-    "code": 404
-  },
-  "DBAlreadyExists": {
-    "description": "This DB already exist",
-    "code": 409
-  },
-  "ObjNotFound": {
-    "description": "This object does not exist",
-    "code": 404
-  },
-  "PermissionDenied": {
-    "description": "Permission denied",
-    "code": 403
-  },
-  "BadRequest": {
-    "description": "BadRequest",
-    "code": 400
-  },
-  "RaftSessionNotLeader": {
-    "description": "NotLeader",
-    "code": 500
-  },
-  "RaftSessionLeaderNotConnected": {
-    "description": "RaftSessionLeaderNotConnected",
-    "code": 400
-  },
-  "NoLeaderForDB": {
-    "description": "NoLeaderForDB",
-    "code": 400
-  },
-  "RouteNotFound": {
-    "description": "RouteNotFound",
-    "code": 404
-  },
-  "NoMapsInConfig": {
-    "description": "NoMapsInConfig",
-    "code": 404
-  },
-  "DBAPINotReady": {
-    "message": "DBAPINotReady",
-    "code": 500
-  },
-  "NotEnoughMapsInConfig:": {
-    "description": "NotEnoughMapsInConfig",
-    "code": 400
-  },
-  "TooManyRequests": {
-    "description": "TooManyRequests",
-    "code": 429
-  },
-  "_comment": "----------------------- cdmiclient -----------------------",
-  "ReadOnly": {
-    "description": "trying to write to read only back-end",
-    "code": 403
-  }
-}

index.js

@@ -1,147 +0,0 @@
-module.exports = {
-    auth: require('./lib/auth/auth'),
-    constants: require('./lib/constants'),
-    db: require('./lib/db'),
-    errors: require('./lib/errors.js'),
-    shuffle: require('./lib/shuffle'),
-    stringHash: require('./lib/stringHash'),
-    ipCheck: require('./lib/ipCheck'),
-    jsutil: require('./lib/jsutil'),
-    https: {
-        ciphers: require('./lib/https/ciphers.js'),
-        dhparam: require('./lib/https/dh2048.js'),
-    },
-    algorithms: {
-        list: {
-            Basic: require('./lib/algos/list/basic').List,
-            Delimiter: require('./lib/algos/list/delimiter').Delimiter,
-            DelimiterVersions: require('./lib/algos/list/delimiterVersions')
-                .DelimiterVersions,
-            DelimiterMaster: require('./lib/algos/list/delimiterMaster')
-                .DelimiterMaster,
-            MPU: require('./lib/algos/list/MPU').MultipartUploads,
-        },
-        listTools: {
-            DelimiterTools: require('./lib/algos/list/tools'),
-        },
-        cache: {
-            LRUCache: require('./lib/algos/cache/LRUCache'),
-        },
-        stream: {
-            MergeStream: require('./lib/algos/stream/MergeStream'),
-        },
-        SortedSet: require('./lib/algos/set/SortedSet'),
-    },
-    policies: {
-        evaluators: require('./lib/policyEvaluator/evaluator.js'),
-        validateUserPolicy: require('./lib/policy/policyValidator')
-            .validateUserPolicy,
-        evaluatePrincipal: require('./lib/policyEvaluator/principal'),
-        RequestContext: require('./lib/policyEvaluator/RequestContext.js'),
-        requestUtils: require('./lib/policyEvaluator/requestUtils'),
-        actionMaps: require('./lib/policyEvaluator/utils/actionMaps'),
-    },
-    Clustering: require('./lib/Clustering'),
-    testing: {
-        matrix: require('./lib/testing/matrix.js'),
-    },
-    versioning: {
-        VersioningConstants: require('./lib/versioning/constants.js')
-            .VersioningConstants,
-        Version: require('./lib/versioning/Version.js').Version,
-        VersionID: require('./lib/versioning/VersionID.js'),
-        WriteGatheringManager: require('./lib/versioning/WriteGatheringManager.js'),
-        WriteCache: require('./lib/versioning/WriteCache.js'),
-        VersioningRequestProcessor: require('./lib/versioning/VersioningRequestProcessor.js'),
-    },
-    network: {
-        http: {
-            server: require('./lib/network/http/server'),
-        },
-        rpc: require('./lib/network/rpc/rpc'),
-        level: require('./lib/network/rpc/level-net'),
-        rest: {
-            RESTServer: require('./lib/network/rest/RESTServer'),
-            RESTClient: require('./lib/network/rest/RESTClient'),
-        },
-        probe: {
-            ProbeServer: require('./lib/network/probe/ProbeServer'),
-        },
-        RoundRobin: require('./lib/network/RoundRobin'),
-        kmip: require('./lib/network/kmip'),
-        kmipClient: require('./lib/network/kmip/Client'),
-    },
-    s3routes: {
-        routes: require('./lib/s3routes/routes'),
-        routesUtils: require('./lib/s3routes/routesUtils'),
-    },
-    s3middleware: {
-        userMetadata: require('./lib/s3middleware/userMetadata'),
-        convertToXml: require('./lib/s3middleware/convertToXml'),
-        escapeForXml: require('./lib/s3middleware/escapeForXml'),
-        objectLegalHold: require('./lib/s3middleware/objectLegalHold'),
-        tagging: require('./lib/s3middleware/tagging'),
-        validateConditionalHeaders:
-            require('./lib/s3middleware/validateConditionalHeaders')
-            .validateConditionalHeaders,
-        MD5Sum: require('./lib/s3middleware/MD5Sum'),
-        NullStream: require('./lib/s3middleware/nullStream'),
-        objectUtils: require('./lib/s3middleware/objectUtils'),
-        azureHelper: {
-            mpuUtils:
-                require('./lib/s3middleware/azureHelpers/mpuUtils'),
-            ResultsCollector:
-                require('./lib/s3middleware/azureHelpers/ResultsCollector'),
-            SubStreamInterface:
-                require('./lib/s3middleware/azureHelpers/SubStreamInterface'),
-        },
-        retention: require('./lib/s3middleware/objectRetention'),
-        lifecycleHelpers: require('./lib/s3middleware/lifecycleHelpers'),
-    },
-    storage: {
-        metadata: {
-            MetadataFileServer:
-            require('./lib/storage/metadata/file/MetadataFileServer'),
-            MetadataFileClient:
-            require('./lib/storage/metadata/file/MetadataFileClient'),
-            LogConsumer:
-            require('./lib/storage/metadata/bucketclient/LogConsumer'),
-        },
-        data: {
-            file: {
-                DataFileStore:
-                require('./lib/storage/data/file/DataFileStore'),
-            },
-        },
-        utils: require('./lib/storage/utils'),
-    },
-    models: {
-        BucketInfo: require('./lib/models/BucketInfo'),
-        ObjectMD: require('./lib/models/ObjectMD'),
-        ObjectMDLocation: require('./lib/models/ObjectMDLocation'),
-        ARN: require('./lib/models/ARN'),
-        WebsiteConfiguration: require('./lib/models/WebsiteConfiguration'),
-        ReplicationConfiguration:
-          require('./lib/models/ReplicationConfiguration'),
-        LifecycleConfiguration:
-            require('./lib/models/LifecycleConfiguration'),
-        LifecycleRule: require('./lib/models/LifecycleRule'),
-        BucketPolicy: require('./lib/models/BucketPolicy'),
-        ObjectLockConfiguration:
-            require('./lib/models/ObjectLockConfiguration'),
-        NotificationConfiguration:
-            require('./lib/models/NotificationConfiguration'),
-    },
-    metrics: {
-        StatsClient: require('./lib/metrics/StatsClient'),
-        StatsModel: require('./lib/metrics/StatsModel'),
-        RedisClient: require('./lib/metrics/RedisClient'),
-        ZenkoMetrics: require('./lib/metrics/ZenkoMetrics'),
-    },
-    pensieve: {
-        credentialUtils: require('./lib/executables/pensieveCreds/utils'),
-    },
-    stream: {
-        readJSONStreamObject: require('./lib/stream/readJSONStreamObject'),
-    },
-};

index.ts

@@ -0,0 +1,143 @@
+export { default as errors } from './lib/errors';
+
+export * as auth from './lib/auth/auth'
+export * as constants from './lib/constants';
+export const db = require('./lib/db');
+export const shuffle = require('./lib/shuffle');
+export const stringHash = require('./lib/stringHash');
+export const ipCheck = require('./lib/ipCheck');
+export const jsutil = require('./lib/jsutil');
+export const Clustering = require('./lib/Clustering');
+
+export const https = {
+    ciphers: require('./lib/https/ciphers.js'),
+    dhparam: require('./lib/https/dh2048.js'),
+};
+
+export const algorithms = {
+    list: {
+        Basic: require('./lib/algos/list/basic').List,
+        Delimiter: require('./lib/algos/list/delimiter').Delimiter,
+        DelimiterVersions: require('./lib/algos/list/delimiterVersions').DelimiterVersions,
+        DelimiterMaster: require('./lib/algos/list/delimiterMaster').DelimiterMaster,
+        MPU: require('./lib/algos/list/MPU').MultipartUploads,
+    },
+    listTools: {
+        DelimiterTools: require('./lib/algos/list/tools'),
+    },
+    cache: {
+        LRUCache: require('./lib/algos/cache/LRUCache'),
+    },
+    stream: {
+        MergeStream: require('./lib/algos/stream/MergeStream'),
+    },
+    SortedSet: require('./lib/algos/set/SortedSet'),
+};
+
+export const policies = {
+    evaluators: require('./lib/policyEvaluator/evaluator.js'),
+    validateUserPolicy: require('./lib/policy/policyValidator').validateUserPolicy,
+    evaluatePrincipal: require('./lib/policyEvaluator/principal'),
+    RequestContext: require('./lib/policyEvaluator/RequestContext.js'),
+    requestUtils: require('./lib/policyEvaluator/requestUtils'),
+    actionMaps: require('./lib/policyEvaluator/utils/actionMaps'),
+};
+
+export const testing = {
+    matrix: require('./lib/testing/matrix.js'),
+};
+
+export const versioning = {
+    VersioningConstants: require('./lib/versioning/constants.js').VersioningConstants,
+    Version: require('./lib/versioning/Version.js').Version,
+    VersionID: require('./lib/versioning/VersionID.js'),
+    WriteGatheringManager: require('./lib/versioning/WriteGatheringManager.js'),
+    WriteCache: require('./lib/versioning/WriteCache.js'),
+    VersioningRequestProcessor: require('./lib/versioning/VersioningRequestProcessor.js'),
+};
+
+export const network = {
+    http: {
+        server: require('./lib/network/http/server'),
+    },
+    rpc: require('./lib/network/rpc/rpc'),
+    level: require('./lib/network/rpc/level-net'),
+    rest: {
+        RESTServer: require('./lib/network/rest/RESTServer'),
+        RESTClient: require('./lib/network/rest/RESTClient'),
+    },
+    probe: {
+        ProbeServer: require('./lib/network/probe/ProbeServer'),
+    },
+    RoundRobin: require('./lib/network/RoundRobin'),
+    kmip: require('./lib/network/kmip'),
+    kmipClient: require('./lib/network/kmip/Client'),
+};
+
+export const s3routes = {
+    routes: require('./lib/s3routes/routes'),
+    routesUtils: require('./lib/s3routes/routesUtils'),
+};
+
+export const s3middleware = {
+    userMetadata: require('./lib/s3middleware/userMetadata'),
+    convertToXml: require('./lib/s3middleware/convertToXml'),
+    escapeForXml: require('./lib/s3middleware/escapeForXml'),
+    objectLegalHold: require('./lib/s3middleware/objectLegalHold'),
+    tagging: require('./lib/s3middleware/tagging'),
+    validateConditionalHeaders:
+        require('./lib/s3middleware/validateConditionalHeaders').validateConditionalHeaders,
+    MD5Sum: require('./lib/s3middleware/MD5Sum'),
+    NullStream: require('./lib/s3middleware/nullStream'),
+    objectUtils: require('./lib/s3middleware/objectUtils'),
+    azureHelper: {
+        mpuUtils: require('./lib/s3middleware/azureHelpers/mpuUtils'),
+        ResultsCollector: require('./lib/s3middleware/azureHelpers/ResultsCollector'),
+        SubStreamInterface: require('./lib/s3middleware/azureHelpers/SubStreamInterface'),
+    },
+    retention: require('./lib/s3middleware/objectRetention'),
+    lifecycleHelpers: require('./lib/s3middleware/lifecycleHelpers'),
+};
+
+export const storage = {
+    metadata: {
+        MetadataFileServer: require('./lib/storage/metadata/file/MetadataFileServer'),
+        MetadataFileClient: require('./lib/storage/metadata/file/MetadataFileClient'),
+        LogConsumer: require('./lib/storage/metadata/bucketclient/LogConsumer'),
+    },
+    data: {
+        file: {
+            DataFileStore: require('./lib/storage/data/file/DataFileStore'),
+        },
+    },
+    utils: require('./lib/storage/utils'),
+};
+
+export const models = {
+    BucketInfo: require('./lib/models/BucketInfo'),
+    ObjectMD: require('./lib/models/ObjectMD'),
+    ObjectMDLocation: require('./lib/models/ObjectMDLocation'),
+    ARN: require('./lib/models/ARN'),
+    WebsiteConfiguration: require('./lib/models/WebsiteConfiguration'),
+    ReplicationConfiguration: require('./lib/models/ReplicationConfiguration'),
+    LifecycleConfiguration: require('./lib/models/LifecycleConfiguration'),
+    LifecycleRule: require('./lib/models/LifecycleRule'),
+    BucketPolicy: require('./lib/models/BucketPolicy'),
+    ObjectLockConfiguration: require('./lib/models/ObjectLockConfiguration'),
+    NotificationConfiguration: require('./lib/models/NotificationConfiguration'),
+};
+
+export const metrics = {
+    StatsClient: require('./lib/metrics/StatsClient'),
+    StatsModel: require('./lib/metrics/StatsModel'),
+    RedisClient: require('./lib/metrics/RedisClient'),
+    ZenkoMetrics: require('./lib/metrics/ZenkoMetrics'),
+};
+
+export const pensieve = {
+    credentialUtils: require('./lib/executables/pensieveCreds/utils'),
+};
+
+export const stream = {
+    readJSONStreamObject: require('./lib/stream/readJSONStreamObject'),
+};

lib/algos/list/MPU.js

@@ -1,7 +1,7 @@
 'use strict'; // eslint-disable-line strict
 
 const { inc, checkLimit, listingParamsMasterKeysV0ToV1,
-        FILTER_END, FILTER_ACCEPT } = require('./tools');
+    FILTER_END, FILTER_ACCEPT } = require('./tools');
 const DEFAULT_MAX_KEYS = 1000;
 const VSConst = require('../../versioning/constants').VersioningConstants;
 const { DbPrefixes, BucketVersioningKeyFormat } = VSConst;

lib/algos/list/delimiter.js

@@ -2,7 +2,7 @@
 
 const Extension = require('./Extension').default;
 const { inc, listingParamsMasterKeysV0ToV1,
-        FILTER_END, FILTER_ACCEPT, FILTER_SKIP } = require('./tools');
+    FILTER_END, FILTER_ACCEPT, FILTER_SKIP } = require('./tools');
 const VSConst = require('../../versioning/constants').VersioningConstants;
 const { DbPrefixes, BucketVersioningKeyFormat } = VSConst;
 
@@ -66,7 +66,7 @@ class Delimiter extends Extension {
         this.continuationToken = parameters.continuationToken;
         this.alphabeticalOrder =
           typeof parameters.alphabeticalOrder !== 'undefined' ?
-                                 parameters.alphabeticalOrder : true;
+              parameters.alphabeticalOrder : true;
 
         this.vFormat = vFormat || BucketVersioningKeyFormat.v0;
         // results
@@ -87,7 +87,7 @@ class Delimiter extends Extension {
             this[this.nextContinueMarker].startsWith(this.prefix || '')) {
             const nextDelimiterIndex =
                 this[this.nextContinueMarker].indexOf(this.delimiter,
-                                        this.prefix ? this.prefix.length : 0);
+                    this.prefix ? this.prefix.length : 0);
             this[this.nextContinueMarker] =
                 this[this.nextContinueMarker].slice(0, nextDelimiterIndex +
                                         this.delimiter.length);

lib/algos/list/delimiterVersions.js

@@ -194,7 +194,7 @@ class DelimiterVersions extends Delimiter {
         // length is the same so we can remove their prefix without
         // looking at the type of key
         return this.filterCommon(obj.key.slice(DbPrefixes.Master.length),
-                                 obj.value);
+            obj.value);
     }
 
     filterCommon(key, value) {
@@ -250,7 +250,7 @@ class DelimiterVersions extends Delimiter {
         }
         // skip to the same object key in both M and V range listings
         return [DbPrefixes.Master + skipV0,
-                DbPrefixes.Version + skipV0];
+            DbPrefixes.Version + skipV0];
     }
 
     /**

lib/algos/set/SortedSet.js

@@ -1,7 +1,6 @@
 const ArrayUtils = require('./ArrayUtils');
 
 class SortedSet {
-
     constructor(obj) {
         if (obj) {
             this.keys = obj.keys;

lib/auth/AuthInfo.ts

@@ -1,6 +1,4 @@
-'use strict'; // eslint-disable-line strict
-
-const constants = require('../constants');
+import * as constants from '../constants';
 
 /**
  * Class containing requester's information received from Vault
@@ -8,9 +6,15 @@ const constants = require('../constants');
  * shortid, email, accountDisplayName and IAMdisplayName (if applicable)
  * @return {AuthInfo} an AuthInfo instance
  */
+export default class AuthInfo {
+    arn: string;
+    canonicalID: string;
+    shortid: string;
+    email: string;
+    accountDisplayName: string;
+    IAMdisplayName: string;
 
-class AuthInfo {
-    constructor(objectFromVault) {
+    constructor(objectFromVault: any) {
         // amazon resource name for IAM user (if applicable)
         this.arn = objectFromVault.arn;
         // account canonicalID
@@ -53,10 +57,8 @@ class AuthInfo {
         return this.canonicalID.startsWith(
             `${constants.zenkoServiceAccount}/`);
     }
-    isRequesterThisServiceAccount(serviceName) {
-        return this.canonicalID ===
-            `${constants.zenkoServiceAccount}/${serviceName}`;
+    isRequesterThisServiceAccount(serviceName: string) {
+        const computedCanonicalID = `${constants.zenkoServiceAccount}/${serviceName}`;
+        return this.canonicalID === computedCanonicalID;
     }
 }
-
-module.exports = AuthInfo;

lib/auth/Vault.ts

@@ -1,16 +1,22 @@
-const errors = require('../errors');
-const AuthInfo = require('./AuthInfo');
+import { Logger } from 'werelogs';
+import errors from '../errors';
+import AuthInfo from './AuthInfo';
 
 /** vaultSignatureCb parses message from Vault and instantiates
- * @param {object} err - error from vault
- * @param {object} authInfo - info from vault
- * @param {object} log - log for request
- * @param {function} callback - callback to authCheck functions
- * @param {object} [streamingV4Params] - present if v4 signature;
+ * @param err - error from vault
+ * @param authInfo - info from vault
+ * @param log - log for request
+ * @param callback - callback to authCheck functions
+ * @param [streamingV4Params] - present if v4 signature;
  * items used to calculate signature on chunks if streaming auth
- * @return {undefined}
  */
-function vaultSignatureCb(err, authInfo, log, callback, streamingV4Params) {
+function vaultSignatureCb(
+    err: Error | null,
+    authInfo: { message: { body: any } },
+    log: Logger,
+    callback: (err: Error | null, data?: any, results?: any, params?: any) => void,
+    streamingV4Params?: any
+) {
     // vaultclient API guarantees that it returns:
     // - either `err`, an Error object with `code` and `message` properties set
     // - or `err == null` and `info` is an object with `message.code` and
@@ -24,11 +30,13 @@ function vaultSignatureCb(err, authInfo, log, callback, streamingV4Params) {
     const info = authInfo.message.body;
     const userInfo = new AuthInfo(info.userInfo);
     const authorizationResults = info.authorizationResults;
-    const auditLog = { accountDisplayName: userInfo.getAccountDisplayName() };
+    const auditLog: { accountDisplayName: string, IAMdisplayName?: string } =
+        { accountDisplayName: userInfo.getAccountDisplayName() };
     const iamDisplayName = userInfo.getIAMdisplayName();
     if (iamDisplayName) {
         auditLog.IAMdisplayName = iamDisplayName;
     }
+    // @ts-ignore
     log.addDefaultFields(auditLog);
     return callback(null, userInfo, authorizationResults, streamingV4Params);
 }
@@ -39,43 +47,63 @@ function vaultSignatureCb(err, authInfo, log, callback, streamingV4Params) {
  * authentication backends.
  * @class Vault
  */
-class Vault {
+export default class Vault {
+    client: any;
+    implName: string;
+
     /**
      * @constructor
      * @param {object} client - authentication backend or vault client
      * @param {string} implName - implementation name for auth backend
      */
-    constructor(client, implName) {
+    constructor(client: any, implName: string) {
         this.client = client;
         this.implName = implName;
     }
     /**
      * authenticateV2Request
      *
-     * @param {string} params - the authentication parameters as returned by
+     * @param params - the authentication parameters as returned by
      *                          auth.extractParams
-     * @param {number} params.version - shall equal 2
-     * @param {string} params.data.accessKey - the user's accessKey
-     * @param {string} params.data.signatureFromRequest - the signature read
+     * @param params.version - shall equal 2
+     * @param params.data.accessKey - the user's accessKey
+     * @param params.data.signatureFromRequest - the signature read
      *                                                    from the request
-     * @param {string} params.data.stringToSign - the stringToSign
-     * @param {string} params.data.algo - the hashing algorithm used for the
+     * @param params.data.stringToSign - the stringToSign
+     * @param params.data.algo - the hashing algorithm used for the
      *                                    signature
-     * @param {string} params.data.authType - the type of authentication (query
+     * @param params.data.authType - the type of authentication (query
      *                                        or header)
-     * @param {string} params.data.signatureVersion - the version of the
+     * @param params.data.signatureVersion - the version of the
      *                                                signature (AWS or AWS4)
-     * @param {number} [params.data.signatureAge] - the age of the signature in
+     * @param [params.data.signatureAge] - the age of the signature in
      *                                              ms
-     * @param {string} params.data.log - the logger object
+     * @param params.data.log - the logger object
      * @param {RequestContext []} requestContexts - an array of RequestContext
      * instances which contain information for policy authorization check
-     * @param {function} callback - callback with either error or user info
-     * @returns {undefined}
+     * @param callback - callback with either error or user info
      */
-    authenticateV2Request(params, requestContexts, callback) {
+    authenticateV2Request(
+        params: {
+            version: 2;
+            log: Logger;
+            data: {
+                securityToken: string;
+                accessKey: string;
+                signatureFromRequest: string;
+                stringToSign: string;
+                algo: string;
+                authType: 'query' | 'header';
+                signatureVersion: string;
+                signatureAge?: number;
+                log: Logger;
+            };
+        },
+        requestContexts: any[],
+        callback: (err: Error | null, data?: any) => void
+    ) {
         params.log.debug('authenticating V2 request');
-        let serializedRCsArr;
+        let serializedRCsArr: any;
         if (requestContexts) {
             serializedRCsArr = requestContexts.map(rc => rc.serialize());
         }
@@ -85,44 +113,66 @@ class Vault {
             params.data.accessKey,
             {
                 algo: params.data.algo,
+                // @ts-ignore
                 reqUid: params.log.getSerializedUids(),
                 logger: params.log,
                 securityToken: params.data.securityToken,
                 requestContext: serializedRCsArr,
             },
-            (err, userInfo) => vaultSignatureCb(err, userInfo,
-                                                params.log, callback)
+            (err: Error | null, userInfo?: any) => vaultSignatureCb(err, userInfo,
+                params.log, callback),
         );
     }
 
     /** authenticateV4Request
-     * @param {object} params - the authentication parameters as returned by
+     * @param params - the authentication parameters as returned by
      *                          auth.extractParams
-     * @param {number} params.version - shall equal 4
-     * @param {string} params.data.log - the logger object
-     * @param {string} params.data.accessKey - the user's accessKey
-     * @param {string} params.data.signatureFromRequest - the signature read
+     * @param params.version - shall equal 4
+     * @param params.data.log - the logger object
+     * @param params.data.accessKey - the user's accessKey
+     * @param params.data.signatureFromRequest - the signature read
      *                                                    from the request
-     * @param {string} params.data.region - the AWS region
-     * @param {string} params.data.stringToSign - the stringToSign
-     * @param {string} params.data.scopeDate - the timespan to allow the request
-     * @param {string} params.data.authType - the type of authentication (query
+     * @param params.data.region - the AWS region
+     * @param params.data.stringToSign - the stringToSign
+     * @param params.data.scopeDate - the timespan to allow the request
+     * @param params.data.authType - the type of authentication (query
      *                                        or header)
-     * @param {string} params.data.signatureVersion - the version of the
+     * @param params.data.signatureVersion - the version of the
      *                                                signature (AWS or AWS4)
-     * @param {number} params.data.signatureAge - the age of the signature in ms
-     * @param {number} params.data.timestamp - signaure timestamp
-     * @param {string} params.credentialScope - credentialScope for signature
+     * @param params.data.signatureAge - the age of the signature in ms
+     * @param params.data.timestamp - signaure timestamp
+     * @param params.credentialScope - credentialScope for signature
      * @param {RequestContext [] | null} requestContexts -
      * an array of RequestContext or null if authenticaiton of a chunk
      * in streamingv4 auth
      * instances which contain information for policy authorization check
-     * @param {function} callback - callback with either error or user info
-     * @return {undefined}
+     * @param callback - callback with either error or user info
     */
-    authenticateV4Request(params, requestContexts, callback) {
+    authenticateV4Request(
+        params: {
+            version: 4;
+            log: Logger;
+            data: {
+                accessKey: string;
+                signatureFromRequest: string;
+                region: string;
+                stringToSign: string;
+                scopeDate: string;
+                authType: 'query' | 'header';
+                signatureVersion: string;
+                signatureAge?: number;
+                timestamp: number;
+                credentialScope: string;
+                securityToken: string;
+                algo: string;
+                log: Logger;
+            };
+        },
+        requestContexts: any[],
+        callback: (err: Error | null, data?: any) => void
+    ) {
         params.log.debug('authenticating V4 request');
-        let serializedRCs;
+        let serializedRCs: any;
         if (requestContexts) {
             serializedRCs = requestContexts.map(rc => rc.serialize());
         }
@@ -140,31 +190,39 @@ class Vault {
             params.data.region,
             params.data.scopeDate,
             {
+                // @ts-ignore
                 reqUid: params.log.getSerializedUids(),
                 logger: params.log,
                 securityToken: params.data.securityToken,
                 requestContext: serializedRCs,
             },
-            (err, userInfo) => vaultSignatureCb(err, userInfo,
-                params.log, callback, streamingV4Params)
+            (err: Error | null, userInfo?: any) => vaultSignatureCb(err, userInfo,
+                params.log, callback, streamingV4Params),
         );
     }
 
     /** getCanonicalIds -- call Vault to get canonicalIDs based on email
      * addresses
-     * @param {array} emailAddresses - list of emailAddresses
-     * @param {object} log - log object
-     * @param {function} callback - callback with either error or an array
+     * @param emailAddresses - list of emailAddresses
+     * @param log - log object
+     * @param callback - callback with either error or an array
      * of objects with each object containing the canonicalID and emailAddress
      * of an account as properties
-     * @return {undefined}
     */
-    getCanonicalIds(emailAddresses, log, callback) {
+    getCanonicalIds(
+        emailAddresses: string[],
+        log: Logger,
+        callback: (
+            err: Error | null,
+            data?: { canonicalID: string; email: string }[]
+        ) => void
+    ) {
         log.trace('getting canonicalIDs from Vault based on emailAddresses',
             { emailAddresses });
         this.client.getCanonicalIds(emailAddresses,
+            // @ts-ignore
             { reqUid: log.getSerializedUids() },
-            (err, info) => {
+            (err: Error | null, info?: any) => {
                 if (err) {
                     log.debug('received error message from auth provider',
                         { errorMessage: err });
@@ -172,17 +230,17 @@ class Vault {
                 }
                 const infoFromVault = info.message.body;
                 log.trace('info received from vault', { infoFromVault });
-                const foundIds = [];
+                const foundIds: { canonicalID: string; email: string }[] = [];
                 for (let i = 0; i < Object.keys(infoFromVault).length; i++) {
                     const key = Object.keys(infoFromVault)[i];
                     if (infoFromVault[key] === 'WrongFormat'
                     || infoFromVault[key] === 'NotFound') {
                         return callback(errors.UnresolvableGrantByEmailAddress);
                     }
-                    const obj = {};
-                    obj.email = key;
-                    obj.canonicalID = infoFromVault[key];
-                    foundIds.push(obj);
+                    foundIds.push({
+                        email: key,
+                        canonicalID: infoFromVault[key],
+                    })
                 }
                 return callback(null, foundIds);
             });
@@ -190,18 +248,22 @@ class Vault {
 
     /** getEmailAddresses -- call Vault to get email addresses based on
      * canonicalIDs
-     * @param {array} canonicalIDs - list of canonicalIDs
-     * @param {object} log - log object
-     * @param {function} callback - callback with either error or an object
+     * @param canonicalIDs - list of canonicalIDs
+     * @param log - log object
+     * @param callback - callback with either error or an object
      * with canonicalID keys and email address values
-     * @return {undefined}
     */
-    getEmailAddresses(canonicalIDs, log, callback) {
+    getEmailAddresses(
+        canonicalIDs: string[],
+        log: Logger,
+        callback: (err: Error | null, data?: { [key: string]: any }) => void
+    ) {
         log.trace('getting emailAddresses from Vault based on canonicalIDs',
             { canonicalIDs });
         this.client.getEmailAddresses(canonicalIDs,
+            // @ts-ignore
             { reqUid: log.getSerializedUids() },
-            (err, info) => {
+            (err: Error | null, info?: any) => {
                 if (err) {
                     log.debug('received error message from vault',
                         { errorMessage: err });
@@ -224,36 +286,40 @@ class Vault {
 
     /** getAccountIds -- call Vault to get accountIds based on
      * canonicalIDs
-     * @param {array} canonicalIDs - list of canonicalIDs
-     * @param {object} log - log object
-     * @param {function} callback - callback with either error or an object
+     * @param canonicalIDs - list of canonicalIDs
+     * @param log - log object
+     * @param callback - callback with either error or an object
      * with canonicalID keys and accountId values
-     * @return {undefined}
     */
-    getAccountIds(canonicalIDs, log, callback) {
+    getAccountIds(
+        canonicalIDs: string[],
+        log: Logger,
+        callback: (err: Error | null, data?: { [key: string]: string }) => void
+    ) {
         log.trace('getting accountIds from Vault based on canonicalIDs',
-        { canonicalIDs });
+            { canonicalIDs });
         this.client.getAccountIds(canonicalIDs,
-        { reqUid: log.getSerializedUids() },
-        (err, info) => {
-            if (err) {
-                log.debug('received error message from vault',
-                    { errorMessage: err });
-                return callback(err);
-            }
-            const infoFromVault = info.message.body;
-            log.trace('info received from vault', { infoFromVault });
-            const result = {};
-            /* If the accountId was not found in Vault, do not
-            send the canonicalID back to the API */
-            Object.keys(infoFromVault).forEach(key => {
-                if (infoFromVault[key] !== 'NotFound' &&
-                infoFromVault[key] !== 'WrongFormat') {
-                    result[key] = infoFromVault[key];
+            // @ts-ignore
+            { reqUid: log.getSerializedUids() },
+            (err: Error | null, info?: any) => {
+                if (err) {
+                    log.debug('received error message from vault',
+                        { errorMessage: err });
+                    return callback(err);
                 }
+                const infoFromVault = info.message.body;
+                log.trace('info received from vault', { infoFromVault });
+                const result = {};
+                /* If the accountId was not found in Vault, do not
+            send the canonicalID back to the API */
+                Object.keys(infoFromVault).forEach(key => {
+                    if (infoFromVault[key] !== 'NotFound' &&
+                infoFromVault[key] !== 'WrongFormat') {
+                        result[key] = infoFromVault[key];
+                    }
+                });
+                return callback(null, result);
             });
-            return callback(null, result);
-        });
     }
 
     /** checkPolicies -- call Vault to evaluate policies
@@ -268,14 +334,19 @@ class Vault {
      * @param {object} log - log object
      * @param {function} callback - callback with either error or an array
      * of authorization results
-     * @return {undefined}
     */
-    checkPolicies(requestContextParams, userArn, log, callback) {
+    checkPolicies(
+        requestContextParams: any[],
+        userArn: string,
+        log: Logger,
+        callback: (err: Error | null, data?: any[]) => void
+    ) {
         log.trace('sending request context params to vault to evaluate' +
         'policies');
         this.client.checkPolicies(requestContextParams, userArn, {
+            // @ts-ignore
             reqUid: log.getSerializedUids(),
-        }, (err, info) => {
+        }, (err: Error | null, info?: any) => {
             if (err) {
                 log.debug('received error message from auth provider',
                     { error: err });
@@ -286,13 +357,14 @@ class Vault {
         });
     }
 
-    checkHealth(log, callback) {
+    checkHealth(log: Logger, callback: (err: Error | null, data?: any) => void) {
         if (!this.client.healthcheck) {
             const defResp = {};
             defResp[this.implName] = { code: 200, message: 'OK' };
             return callback(null, defResp);
         }
-        return this.client.healthcheck(log.getSerializedUids(), (err, obj) => {
+        // @ts-ignore
+        return this.client.healthcheck(log.getSerializedUids(), (err: Error | null, obj?: any) => {
             const respBody = {};
             if (err) {
                 log.debug(`error from ${this.implName}`, { error: err });
@@ -312,5 +384,3 @@ class Vault {
         });
     }
 }
-
-module.exports = Vault;

lib/auth/auth.ts

@@ -1,22 +1,21 @@
-'use strict'; // eslint-disable-line strict
+import * as crypto from 'crypto';
+import { Logger } from 'werelogs';
+import errors from '../errors';
+import * as queryString from 'querystring';
+import AuthInfo from './AuthInfo';
+import * as v2 from './v2/authV2';
+import * as v4 from './v4/authV4';
+import * as constants from '../constants';
+import constructStringToSignV2 from './v2/constructStringToSign';
+import constructStringToSignV4 from './v4/constructStringToSign';
+import { convertUTCtoISO8601 } from './v4/timeUtils';
+import * as vaultUtilities from './in_memory/vaultUtilities';
+import * as backend from './in_memory/Backend';
+import validateAuthConfig from './in_memory/validateAuthConfig';
+import AuthLoader from './in_memory/AuthLoader';
+import Vault from './Vault';
 
-const crypto = require('crypto');
-const errors = require('../errors');
-const queryString = require('querystring');
-const AuthInfo = require('./AuthInfo');
-const v2 = require('./v2/authV2');
-const v4 = require('./v4/authV4');
-const constants = require('../constants');
-const constructStringToSignV2 = require('./v2/constructStringToSign');
-const constructStringToSignV4 = require('./v4/constructStringToSign');
-const convertUTCtoISO8601 = require('./v4/timeUtils').convertUTCtoISO8601;
-const vaultUtilities = require('./in_memory/vaultUtilities');
-const backend = require('./in_memory/Backend');
-const validateAuthConfig = require('./in_memory/validateAuthConfig');
-const AuthLoader = require('./in_memory/AuthLoader');
-const Vault = require('./Vault');
-
-let vault = null;
+let vault: Vault | null = null;
 const auth = {};
 const checkFunctions = {
     v2: {
@@ -33,7 +32,7 @@ const checkFunctions = {
 // 'All Users Group' so use this group as the canonicalID for the publicUser
 const publicUserInfo = new AuthInfo({ canonicalID: constants.publicId });
 
-function setAuthHandler(handler) {
+function setAuthHandler(handler: Vault) {
     vault = handler;
     return auth;
 }
@@ -41,25 +40,30 @@ function setAuthHandler(handler) {
 /**
  * This function will check validity of request parameters to authenticate
  *
- * @param {Http.Request} request - Http request object
- * @param {object} log - Logger object
- * @param {string} awsService - Aws service related
- * @param {object} data - Parameters from queryString parsing or body of
+ * @param request - Http request object
+ * @param log - Logger object
+ * @param awsService - Aws service related
+ * @param data - Parameters from queryString parsing or body of
  *      POST request
  *
- * @return {object} ret
- * @return {object} ret.err - arsenal.errors object if any error was found
- * @return {object} ret.params - auth parameters to use later on for signature
+ * @return ret
+ * @return ret.err - arsenal.errors object if any error was found
+ * @return ret.params - auth parameters to use later on for signature
  *                               computation and check
- * @return {object} ret.params.version - the auth scheme version
+ * @return ret.params.version - the auth scheme version
  *                                       (undefined, 2, 4)
- * @return {object} ret.params.data - the auth scheme's specific data
+ * @return ret.params.data - the auth scheme's specific data
  */
-function extractParams(request, log, awsService, data) {
+function extractParams(
+    request: any,
+    log: Logger,
+    awsService: string,
+    data: { [key: string]: string }
+) {
     log.trace('entered', { method: 'Arsenal.auth.server.extractParams' });
     const authHeader = request.headers.authorization;
-    let version = null;
-    let method = null;
+    let version: 'v2' |'v4' | null = null;
+    let method: 'query' | 'headers' | null = null;
 
     // Identify auth version and method to dispatch to the right check function
     if (authHeader) {
@@ -72,7 +76,7 @@ function extractParams(request, log, awsService, data) {
             version = 'v4';
         } else {
             log.trace('invalid authorization security header',
-                      { header: authHeader });
+                { header: authHeader });
             return { err: errors.AccessDenied };
         }
     } else if (data.Signature) {
@@ -87,7 +91,7 @@ function extractParams(request, log, awsService, data) {
     if (version !== null && method !== null) {
         if (!checkFunctions[version] || !checkFunctions[version][method]) {
             log.trace('invalid auth version or method',
-                      { version, authMethod: method });
+                { version, authMethod: method });
             return { err: errors.NotImplemented };
         }
         log.trace('identified auth method', { version, authMethod: method });
@@ -102,16 +106,21 @@ function extractParams(request, log, awsService, data) {
 /**
  * This function will check validity of request parameters to authenticate
  *
- * @param {Http.Request} request - Http request object
- * @param {object} log - Logger object
- * @param {function} cb - the callback
- * @param {string} awsService - Aws service related
+ * @param request - Http request object
+ * @param log - Logger object
+ * @param cb - the callback
+ * @param awsService - Aws service related
  * @param {RequestContext[] | null} requestContexts - array of RequestContext
  * or null if no requestContexts to be sent to Vault (for instance,
  * in multi-object delete request)
- * @return {undefined}
  */
-function doAuth(request, log, cb, awsService, requestContexts) {
+function doAuth(
+    request: any,
+    log: Logger,
+    cb: (err: Error | null, data?: any) => void,
+    awsService: string,
+    requestContexts: any[] | null
+) {
     const res = extractParams(request, log, awsService, request.query);
     if (res.err) {
         return cb(res.err);
@@ -119,23 +128,31 @@ function doAuth(request, log, cb, awsService, requestContexts) {
         return cb(null, res.params);
     }
     if (requestContexts) {
-        requestContexts.forEach(requestContext => {
-            requestContext.setAuthType(res.params.data.authType);
-            requestContext.setSignatureVersion(res.params
-                .data.signatureVersion);
-            requestContext.setSignatureAge(res.params.data.signatureAge);
-            requestContext.setSecurityToken(res.params.data.securityToken);
+        requestContexts.forEach((requestContext) => {
+            const { params } = res
+            if ('data' in params) {
+                const { data } = params
+                requestContext.setAuthType(data.authType);
+                requestContext.setSignatureVersion(data.signatureVersion);
+                requestContext.setSecurityToken(data.securityToken);
+                if ('signatureAge' in data) {
+                    requestContext.setSignatureAge(data.signatureAge);
+                }
+            }
         });
     }
 
     // Corner cases managed, we're left with normal auth
+    // TODO What's happening here?
+    // @ts-ignore
     res.params.log = log;
     if (res.params.version === 2) {
-        return vault.authenticateV2Request(res.params, requestContexts, cb);
+        // @ts-ignore
+        return vault!.authenticateV2Request(res.params, requestContexts, cb);
     }
     if (res.params.version === 4) {
-        return vault.authenticateV4Request(res.params, requestContexts, cb,
-            awsService);
+        // @ts-ignore
+        return vault!.authenticateV4Request(res.params, requestContexts, cb);
     }
 
     log.error('authentication method not found', {
@@ -147,19 +164,25 @@ function doAuth(request, log, cb, awsService, requestContexts) {
 /**
  * This function will generate a version 4 header
  *
- * @param {Http.Request} request - Http request object
- * @param {object} data - Parameters from queryString parsing or body of
+ * @param request - Http request object
+ * @param data - Parameters from queryString parsing or body of
  *                        POST request
- * @param {string} accessKey - the accessKey
- * @param {string} secretKeyValue - the secretKey
- * @param {string} awsService - Aws service related
- * @param {sting} [proxyPath] - path that gets proxied by reverse proxy
- * @param {string} [sessionToken] - security token if the access/secret keys
+ * @param accessKey - the accessKey
+ * @param secretKeyValue - the secretKey
+ * @param awsService - Aws service related
+ * @param [proxyPath] - path that gets proxied by reverse proxy
+ * @param [sessionToken] - security token if the access/secret keys
  *                                are temporary credentials from STS
- * @return {undefined}
  */
-function generateV4Headers(request, data, accessKey, secretKeyValue,
-                           awsService, proxyPath, sessionToken) {
+function generateV4Headers(
+    request: any,
+    data: { [key: string]: string },
+    accessKey: string,
+    secretKeyValue: string,
+    awsService: string,
+    proxyPath: string,
+    sessionToken: string
+) {
     Object.assign(request, { headers: {} });
     const amzDate = convertUTCtoISO8601(Date.now());
     // get date without time
@@ -173,7 +196,7 @@ function generateV4Headers(request, data, accessKey, secretKeyValue,
 
     let payload = '';
     if (request.method === 'POST') {
-        payload = queryString.stringify(data, null, null, {
+        payload = queryString.stringify(data, undefined, undefined, {
             encodeURIComponent,
         });
     }
@@ -192,18 +215,18 @@ function generateV4Headers(request, data, accessKey, secretKeyValue,
         .filter(headerName =>
             headerName.startsWith('x-amz-')
             || headerName.startsWith('x-scal-')
-            || headerName === 'host'
+            || headerName === 'host',
         ).sort().join(';');
     const params = { request, signedHeaders, payloadChecksum,
         credentialScope, timestamp, query: data,
         awsService: service, proxyPath };
     const stringToSign = constructStringToSignV4(params);
     const signingKey = vaultUtilities.calculateSigningKey(secretKeyValue,
-                                                          region,
-                                                          scopeDate,
-                                                          service);
+        region,
+        scopeDate,
+        service);
     const signature = crypto.createHmac('sha256', signingKey)
-        .update(stringToSign, 'binary').digest('hex');
+        .update(stringToSign as string, 'binary').digest('hex');
     const authorizationHeader = `${algorithm} Credential=${accessKey}` +
         `/${credentialScope}, SignedHeaders=${signedHeaders}, ` +
         `Signature=${signature}`;
@@ -211,21 +234,11 @@ function generateV4Headers(request, data, accessKey, secretKeyValue,
     Object.assign(request, { headers: {} });
 }
 
-module.exports = {
-    setHandler: setAuthHandler,
-    server: {
-        extractParams,
-        doAuth,
-    },
-    client: {
-        generateV4Headers,
-        constructStringToSignV2,
-    },
-    inMemory: {
-        backend,
-        validateAuthConfig,
-        AuthLoader,
-    },
+export const server = { extractParams, doAuth }
+export const client = { generateV4Headers, constructStringToSignV2 }
+export const inMemory = { backend, validateAuthConfig, AuthLoader }
+export {
+    setAuthHandler as setHandler,
     AuthInfo,
-    Vault,
-};
+    Vault
+}

lib/auth/in_memory/AuthLoader.js

@@ -1,223 +0,0 @@
-const fs = require('fs');
-const glob = require('simple-glob');
-const joi = require('@hapi/joi');
-const werelogs = require('werelogs');
-
-const ARN = require('../../models/ARN');
-
-/**
- * Load authentication information from files or pre-loaded account
- * objects
- *
- * @class AuthLoader
- */
-class AuthLoader {
-    constructor(logApi) {
-        this._log = new (logApi || werelogs).Logger('S3');
-        this._authData = { accounts: [] };
-        // null: unknown validity, true/false: valid or invalid
-        this._isValid = null;
-
-        this._joiKeysValidator = joi.array()
-            .items({
-                access: joi.string().required(),
-                secret: joi.string().required(),
-            })
-            .required();
-
-        const accountsJoi = joi.array()
-                .items({
-                    name: joi.string().required(),
-                    email: joi.string().email().required(),
-                    arn: joi.string().required(),
-                    canonicalID: joi.string().required(),
-                    shortid: joi.string().regex(/^[0-9]{12}$/).required(),
-                    keys: this._joiKeysValidator,
-                    // backward-compat
-                    users: joi.array(),
-                })
-                .required()
-                .unique('arn')
-                .unique('email')
-                .unique('canonicalID');
-        this._joiValidator = joi.object({ accounts: accountsJoi });
-    }
-
-    /**
-     * add one or more accounts to the authentication info
-     *
-     * @param {object} authData - authentication data
-     * @param {object[]} authData.accounts - array of account data
-     * @param {string} authData.accounts[].name - account name
-     * @param {string} authData.accounts[].email: email address
-     * @param {string} authData.accounts[].arn: account ARN,
-     *   e.g. 'arn:aws:iam::123456789012:root'
-     * @param {string} authData.accounts[].canonicalID account
-     *   canonical ID
-     * @param {string} authData.accounts[].shortid account ID number,
-     *   e.g. '123456789012'
-     * @param {object[]} authData.accounts[].keys array of
-     *   access/secret keys
-     * @param {object[]} authData.accounts[].keys[].access access key
-     * @param {object[]} authData.accounts[].keys[].secret secret key
-     * @param {string} [filePath] - optional file path info for
-     *   logging purpose
-     * @return {undefined}
-     */
-    addAccounts(authData, filePath) {
-        const isValid = this._validateData(authData, filePath);
-        if (isValid) {
-            this._authData.accounts =
-                this._authData.accounts.concat(authData.accounts);
-            // defer validity checking when getting data to avoid
-            // logging multiple times the errors (we need to validate
-            // all accounts at once to detect duplicate values)
-            if (this._isValid) {
-                this._isValid = null;
-            }
-        } else {
-            this._isValid = false;
-        }
-    }
-
-    /**
-     * add account information from a file
-     *
-     * @param {string} filePath - file path containing JSON
-     *   authentication info (see {@link addAccounts()} for format)
-     * @return {undefined}
-     */
-    addFile(filePath) {
-        const authData = JSON.parse(fs.readFileSync(filePath));
-        this.addAccounts(authData, filePath);
-    }
-
-    /**
-     * add account information from a filesystem path
-     *
-     * @param {string|string[]} globPattern - filesystem glob pattern,
-     *   can be a single string or an array of glob patterns. Globs
-     *   can be simple file paths or can contain glob matching
-     *   characters, like '/a/b/*.json'. The matching files are
-     *   individually loaded as JSON and accounts are added. See
-     *   {@link addAccounts()} for JSON format.
-     * @return {undefined}
-     */
-    addFilesByGlob(globPattern) {
-        const files = glob(globPattern);
-        files.forEach(filePath => this.addFile(filePath));
-    }
-
-    /**
-     * perform validation on authentication info previously
-     * loaded. Note that it has to be done on the entire set after an
-     * update to catch duplicate account IDs or access keys.
-     *
-     * @return {boolean} true if authentication info is valid
-     *                   false otherwise
-     */
-    validate() {
-        if (this._isValid === null) {
-            this._isValid = this._validateData(this._authData);
-        }
-        return this._isValid;
-    }
-
-    /**
-     * get authentication info as a plain JS object containing all accounts
-     * under the "accounts" attribute, with validation.
-     *
-     * @return {object|null} the validated authentication data
-     *                       null if invalid
-     */
-    getData() {
-        return this.validate() ? this._authData : null;
-    }
-
-    _validateData(authData, filePath) {
-        const res = joi.validate(authData, this._joiValidator,
-                                 { abortEarly: false });
-        if (res.error) {
-            this._dumpJoiErrors(res.error.details, filePath);
-            return false;
-        }
-        let allKeys = [];
-        let arnError = false;
-        const validatedAuth = res.value;
-        validatedAuth.accounts.forEach(account => {
-            // backward-compat: ignore arn if starts with 'aws:' and log a
-            // warning
-            if (account.arn.startsWith('aws:')) {
-                this._log.error(
-                    'account must have a valid AWS ARN, legacy examples ' +
-                        'starting with \'aws:\' are not supported anymore. ' +
-                        'Please convert to a proper account entry (see ' +
-                        'examples at https://github.com/scality/S3/blob/' +
-                        'master/conf/authdata.json). Also note that support ' +
-                        'for account users has been dropped.',
-                    { accountName: account.name, accountArn: account.arn,
-                      filePath });
-                arnError = true;
-                return;
-            }
-            if (account.users) {
-                this._log.error(
-                    'support for account users has been dropped, consider ' +
-                        'turning users into account entries (see examples at ' +
-                        'https://github.com/scality/S3/blob/master/conf/' +
-                        'authdata.json)',
-                    { accountName: account.name, accountArn: account.arn,
-                      filePath });
-                arnError = true;
-                return;
-            }
-            const arnObj = ARN.createFromString(account.arn);
-            if (arnObj.error) {
-                this._log.error(
-                    'authentication config validation error',
-                    { reason: arnObj.error.description,
-                      accountName: account.name, accountArn: account.arn,
-                      filePath });
-                arnError = true;
-                return;
-            }
-            if (!arnObj.isIAMAccount()) {
-                this._log.error(
-                    'authentication config validation error',
-                    { reason: 'not an IAM account ARN',
-                      accountName: account.name, accountArn: account.arn,
-                      filePath });
-                arnError = true;
-                return;
-            }
-            allKeys = allKeys.concat(account.keys);
-        });
-        if (arnError) {
-            return false;
-        }
-        const uniqueKeysRes = joi.validate(
-            allKeys, this._joiKeysValidator.unique('access'));
-        if (uniqueKeysRes.error) {
-            this._dumpJoiErrors(uniqueKeysRes.error.details, filePath);
-            return false;
-        }
-        return true;
-    }
-
-    _dumpJoiErrors(errors, filePath) {
-        errors.forEach(err => {
-            const logInfo = { item: err.path, filePath };
-            if (err.type === 'array.unique') {
-                logInfo.reason = `duplicate value '${err.context.path}'`;
-                logInfo.dupValue = err.context.value[err.context.path];
-            } else {
-                logInfo.reason = err.message;
-                logInfo.context = err.context;
-            }
-            this._log.error('authentication config validation error',
-                            logInfo);
-        });
-    }
-}
-
-module.exports = AuthLoader;

lib/auth/in_memory/AuthLoader.ts

@@ -0,0 +1,205 @@
+import * as fs from 'fs';
+import glob from 'simple-glob';
+import joi from 'joi';
+import werelogs from 'werelogs';
+import * as types from './types';
+import { Account, Accounts } from './types';
+
+const ARN = require('../../models/ARN');
+
+/** Load authentication information from files or pre-loaded account objects */
+export default class AuthLoader {
+    #log: werelogs.Logger;
+    #authData: Accounts;
+    #isValid: 'waiting-for-validation' | 'valid' | 'invalid';
+
+    constructor(logApi: { Logger: typeof werelogs.Logger } = werelogs) {
+        this.#log = new logApi.Logger('S3');
+        this.#authData = { accounts: [] };
+        this.#isValid = 'waiting-for-validation';
+    }
+
+    /** Add one or more accounts to the authentication info */
+    addAccounts(authData: Accounts, filePath?: string) {
+        const isValid = this.#isAuthDataValid(authData, filePath);
+        if (isValid) {
+            this.#authData.accounts = [
+                ...this.#authData.accounts,
+                ...authData.accounts,
+            ];
+            // defer validity checking when getting data to avoid
+            // logging multiple times the errors (we need to validate
+            // all accounts at once to detect duplicate values)
+            if (this.#isValid === 'valid') {
+                this.#isValid = 'waiting-for-validation';
+            }
+        } else {
+            this.#isValid = 'invalid';
+        }
+    }
+
+    /**
+     * Add account information from a file. Use { legacy: false } as an option
+     *  to use the new, Promise-based version.
+     *
+     * @param filePath - file path containing JSON
+     *   authentication info (see {@link addAccounts()} for format)
+     */
+    addFile(filePath: string, options: { legacy: false }): Promise<void>;
+    /** @deprecated Please use Promise-version instead. */
+    addFile(filePath: string, options?: { legacy: true }): void;
+    addFile(filePath: string, options = { legacy: true }) {
+        // On deprecation, remove the legacy part and keep the promises.
+        const fn: any = options.legacy ? fs.readFileSync : fs.promises.readFile;
+        const temp = fn(filePath, 'utf8') as Promise<string> | string;
+        const prom = Promise.resolve(temp).then((data) => {
+            const authData = JSON.parse(data);
+            this.addAccounts(authData, filePath);
+        });
+        return options.legacy ? undefined : prom;
+    }
+
+    /**
+     * Add account information from a filesystem path
+     *
+     * @param globPattern - filesystem glob pattern,
+     *   can be a single string or an array of glob patterns. Globs
+     *   can be simple file paths or can contain glob matching
+     *   characters, like '/a/b/*.json'. The matching files are
+     *   individually loaded as JSON and accounts are added. See
+     *   {@link addAccounts()} for JSON format.
+     */
+    addFilesByGlob(globPattern: string | string[]) {
+        // FIXME switch glob to async version
+        const files = glob(globPattern);
+        files.forEach((filePath) => this.addFile(filePath));
+    }
+
+    /**
+     * Perform validation on authentication info previously
+     * loaded. Note that it has to be done on the entire set after an
+     * update to catch duplicate account IDs or access keys.
+     */
+    validate() {
+        if (this.#isValid === 'waiting-for-validation') {
+            const isValid = this.#isAuthDataValid(this.#authData);
+            this.#isValid = isValid ? 'valid' : 'invalid';
+        }
+        return this.#isValid === 'valid';
+    }
+
+    /**
+     * Get authentication info as a plain JS object containing all accounts
+     * under the "accounts" attribute, with validation.
+     */
+    get data() {
+        return this.validate() ? this.#authData : null;
+    }
+
+    /** backward-compat: ignore arn if starts with 'aws:' and log a warning */
+    #isNotLegacyAWSARN(account: Account, filePath?: string) {
+        if (account.arn.startsWith('aws:')) {
+            const { name: accountName, arn: accountArn } = account;
+            this.#log.error(
+                'account must have a valid AWS ARN, legacy examples ' +
+                    "starting with 'aws:' are not supported anymore. " +
+                    'Please convert to a proper account entry (see ' +
+                    'examples at https://github.com/scality/S3/blob/' +
+                    'master/conf/authdata.json). Also note that support ' +
+                    'for account users has been dropped.',
+                { accountName, accountArn, filePath }
+            );
+            return false;
+        }
+        return true;
+    }
+
+    #isValidUsers(account: Account, filePath?: string) {
+        if (account.users) {
+            const { name: accountName, arn: accountArn } = account;
+            this.#log.error(
+                'support for account users has been dropped, consider ' +
+                    'turning users into account entries (see examples at ' +
+                    'https://github.com/scality/S3/blob/master/conf/' +
+                    'authdata.json)',
+                { accountName, accountArn, filePath }
+            );
+            return false;
+        }
+        return true;
+    }
+
+    #isValidARN(account: Account, filePath?: string) {
+        const arnObj = ARN.createFromString(account.arn);
+        const { name: accountName, arn: accountArn } = account;
+        if (arnObj instanceof ARN) {
+            if (!arnObj.isIAMAccount()) {
+                this.#log.error('authentication config validation error', {
+                    reason: 'not an IAM account ARN',
+                    accountName,
+                    accountArn,
+                    filePath,
+                });
+                return false;
+            }
+        } else {
+            this.#log.error('authentication config validation error', {
+                reason: arnObj.error.description,
+                accountName,
+                accountArn,
+                filePath,
+            });
+            return false;
+        }
+        return true;
+    }
+
+    #isAuthDataValid(authData: any, filePath?: string) {
+        const options = { abortEarly: true };
+        const response = types.validators.accounts.validate(authData, options);
+        if (response.error) {
+            this.#dumpJoiErrors(response.error.details, filePath);
+            return false;
+        }
+        const validAccounts = response.value.accounts.filter(
+            (account: Account) =>
+                this.#isNotLegacyAWSARN(account, filePath) &&
+                this.#isValidUsers(account, filePath) &&
+                this.#isValidARN(account, filePath)
+        );
+        const areSomeInvalidAccounts =
+            validAccounts.length !== response.value.accounts.length;
+        if (areSomeInvalidAccounts) {
+            return false;
+        }
+        const keys = validAccounts.flatMap((account) => account.keys);
+        const uniqueKeysValidator = types.validators.keys.unique('access');
+        const areKeysUnique = uniqueKeysValidator.validate(keys);
+        if (areKeysUnique.error) {
+            this.#dumpJoiErrors(areKeysUnique.error.details, filePath);
+            return false;
+        }
+        return true;
+    }
+
+    #dumpJoiErrors(errors: joi.ValidationErrorItem[], filePath?: string) {
+        errors.forEach((err) => {
+            const baseLogInfo = { item: err.path, filePath };
+            const logInfo = () => {
+                if (err.type === 'array.unique') {
+                    const reason = `duplicate value '${err.context?.path}'`;
+                    const dupValue = err.context?.value[err.context.path];
+                    return { ...baseLogInfo, reason, dupValue };
+                } else {
+                    const reason = err.message;
+                    const context = err.context;
+                    return { ...baseLogInfo, reason, context };
+                }
+            };
+            this.#log.error(
+                'authentication config validation error',
+                logInfo()
+            );
+        });
+    }
+}

lib/auth/in_memory/Backend.js

@@ -1,217 +0,0 @@
-'use strict'; // eslint-disable-line strict
-
-const crypto = require('crypto');
-
-const errors = require('../../errors');
-const calculateSigningKey = require('./vaultUtilities').calculateSigningKey;
-const hashSignature = require('./vaultUtilities').hashSignature;
-const Indexer = require('./Indexer');
-
-function _formatResponse(userInfoToSend) {
-    return {
-        message: {
-            body: { userInfo: userInfoToSend },
-        },
-    };
-}
-
-/**
- * Class that provides a memory backend for verifying signatures and getting
- * emails and canonical ids associated with an account.
- *
- * @class Backend
- */
-class Backend {
-    /**
-     * @constructor
-     * @param {string} service - service identifer for construction arn
-     * @param {Indexer} indexer - indexer instance for retrieving account info
-     * @param {function} formatter - function which accepts user info to send
-     * back and returns it in an object
-     */
-    constructor(service, indexer, formatter) {
-        this.service = service;
-        this.indexer = indexer;
-        this.formatResponse = formatter;
-    }
-
-    /** verifySignatureV2
-    * @param {string} stringToSign - string to sign built per AWS rules
-    * @param {string} signatureFromRequest - signature sent with request
-    * @param {string} accessKey - account accessKey
-    * @param {object} options - contains algorithm (SHA1 or SHA256)
-    * @param {function} callback - callback with either error or user info
-    * @return {function} calls callback
-    */
-    verifySignatureV2(stringToSign, signatureFromRequest,
-        accessKey, options, callback) {
-        const entity = this.indexer.getEntityByKey(accessKey);
-        if (!entity) {
-            return callback(errors.InvalidAccessKeyId);
-        }
-        const secretKey = this.indexer.getSecretKey(entity, accessKey);
-        const reconstructedSig =
-            hashSignature(stringToSign, secretKey, options.algo);
-        if (signatureFromRequest !== reconstructedSig) {
-            return callback(errors.SignatureDoesNotMatch);
-        }
-        const userInfoToSend = {
-            accountDisplayName: this.indexer.getAcctDisplayName(entity),
-            canonicalID: entity.canonicalID,
-            arn: entity.arn,
-            IAMdisplayName: entity.IAMdisplayName,
-        };
-        const vaultReturnObject = this.formatResponse(userInfoToSend);
-        return callback(null, vaultReturnObject);
-    }
-
-
-    /** verifySignatureV4
-     * @param {string} stringToSign - string to sign built per AWS rules
-     * @param {string} signatureFromRequest - signature sent with request
-     * @param {string} accessKey - account accessKey
-     * @param {string} region - region specified in request credential
-     * @param {string} scopeDate - date specified in request credential
-     * @param {object} options - options to send to Vault
-     * (just contains reqUid for logging in Vault)
-     * @param {function} callback - callback with either error or user info
-     * @return {function} calls callback
-     */
-    verifySignatureV4(stringToSign, signatureFromRequest, accessKey,
-        region, scopeDate, options, callback) {
-        const entity = this.indexer.getEntityByKey(accessKey);
-        if (!entity) {
-            return callback(errors.InvalidAccessKeyId);
-        }
-        const secretKey = this.indexer.getSecretKey(entity, accessKey);
-        const signingKey = calculateSigningKey(secretKey, region, scopeDate);
-        const reconstructedSig = crypto.createHmac('sha256', signingKey)
-            .update(stringToSign, 'binary').digest('hex');
-        if (signatureFromRequest !== reconstructedSig) {
-            return callback(errors.SignatureDoesNotMatch);
-        }
-        const userInfoToSend = {
-            accountDisplayName: this.indexer.getAcctDisplayName(entity),
-            canonicalID: entity.canonicalID,
-            arn: entity.arn,
-            IAMdisplayName: entity.IAMdisplayName,
-        };
-        const vaultReturnObject = this.formatResponse(userInfoToSend);
-        return callback(null, vaultReturnObject);
-    }
-
-    /**
-     * Gets canonical ID's for a list of accounts
-     * based on email associated with account
-     * @param {array} emails - list of email addresses
-     * @param {object} log - log object
-     * @param {function} cb - callback to calling function
-     * @returns {function} callback with either error or
-     * object with email addresses as keys and canonical IDs
-     * as values
-     */
-    getCanonicalIds(emails, log, cb) {
-        const results = {};
-        emails.forEach(email => {
-            const lowercasedEmail = email.toLowerCase();
-            const entity = this.indexer.getEntityByEmail(lowercasedEmail);
-            if (!entity) {
-                results[email] = 'NotFound';
-            } else {
-                results[email] =
-                    entity.canonicalID;
-            }
-        });
-        const vaultReturnObject = {
-            message: {
-                body: results,
-            },
-        };
-        return cb(null, vaultReturnObject);
-    }
-
-    /**
-     * Gets email addresses (referred to as diplay names for getACL's)
-     * for a list of accounts based on canonical IDs associated with account
-     * @param {array} canonicalIDs - list of canonicalIDs
-     * @param {object} options - to send log id to vault
-     * @param {function} cb - callback to calling function
-     * @returns {function} callback with either error or
-     * an object from Vault containing account canonicalID
-     * as each object key and an email address as the value (or "NotFound")
-     */
-    getEmailAddresses(canonicalIDs, options, cb) {
-        const results = {};
-        canonicalIDs.forEach(canonicalId => {
-            const foundEntity = this.indexer.getEntityByCanId(canonicalId);
-            if (!foundEntity || !foundEntity.email) {
-                results[canonicalId] = 'NotFound';
-            } else {
-                results[canonicalId] = foundEntity.email;
-            }
-        });
-        const vaultReturnObject = {
-            message: {
-                body: results,
-            },
-        };
-        return cb(null, vaultReturnObject);
-    }
-
-    /**
-     * Gets accountIds for a list of accounts based on
-     * the canonical IDs associated with the account
-     * @param {array} canonicalIDs - list of canonicalIDs
-     * @param {object} options - to send log id to vault
-     * @param {function} cb - callback to calling function
-     * @returns {function} callback with either error or
-     * an object from Vault containing account canonicalID
-     * as each object key and an accountId as the value (or "NotFound")
-     */
-    getAccountIds(canonicalIDs, options, cb) {
-        const results = {};
-        canonicalIDs.forEach(canonicalID => {
-            const foundEntity = this.indexer.getEntityByCanId(canonicalID);
-            if (!foundEntity || !foundEntity.shortid) {
-                results[canonicalID] = 'Not Found';
-            } else {
-                results[canonicalID] = foundEntity.shortid;
-            }
-        });
-        const vaultReturnObject = {
-            message: {
-                body: results,
-            },
-        };
-        return cb(null, vaultReturnObject);
-    }
-}
-
-
-class S3AuthBackend extends Backend {
-    /**
-     * @constructor
-     * @param {object} authdata - the authentication config file's data
-     * @param {object[]} authdata.accounts - array of account objects
-     * @param {string=} authdata.accounts[].name - account name
-     * @param {string} authdata.accounts[].email - account email
-     * @param {string} authdata.accounts[].arn - IAM resource name
-     * @param {string} authdata.accounts[].canonicalID - account canonical ID
-     * @param {string} authdata.accounts[].shortid - short account ID
-     * @param {object[]=} authdata.accounts[].keys - array of key objects
-     * @param {string} authdata.accounts[].keys[].access - access key
-     * @param {string} authdata.accounts[].keys[].secret - secret key
-     * @return {undefined}
-     */
-    constructor(authdata) {
-        super('s3', new Indexer(authdata), _formatResponse);
-    }
-
-    refreshAuthData(authData) {
-        this.indexer = new Indexer(authData);
-    }
-}
-
-module.exports = {
-    s3: S3AuthBackend,
-};

lib/auth/in_memory/Backend.ts

@@ -0,0 +1,194 @@
+import * as crypto from 'crypto';
+import errors from '../../errors';
+import { calculateSigningKey, hashSignature } from './vaultUtilities';
+import Indexer from './Indexer';
+import { Accounts } from './types';
+
+function _formatResponse(userInfoToSend: any) {
+    return {
+        message: {
+            body: { userInfo: userInfoToSend },
+        },
+    };
+}
+
+/**
+ * Class that provides a memory backend for verifying signatures and getting
+ * emails and canonical ids associated with an account.
+ */
+class Backend {
+    indexer: Indexer;
+    service: string;
+
+    constructor(service: string, indexer: Indexer) {
+        this.service = service;
+        this.indexer = indexer;
+    }
+
+    // CODEQUALITY-TODO-SYNC Should be synchronous
+    verifySignatureV2(
+        stringToSign: string,
+        signatureFromRequest: string,
+        accessKey: string,
+        options: { algo: 'SHA256' | 'SHA1' },
+        callback: (
+            error: Error | null,
+            data?: ReturnType<typeof _formatResponse>
+        ) => void
+    ) {
+        const entity = this.indexer.getEntityByKey(accessKey);
+        if (!entity) {
+            return callback(errors.InvalidAccessKeyId);
+        }
+        const secretKey = this.indexer.getSecretKey(entity, accessKey);
+        const reconstructedSig =
+            hashSignature(stringToSign, secretKey, options.algo);
+        if (signatureFromRequest !== reconstructedSig) {
+            return callback(errors.SignatureDoesNotMatch);
+        }
+        const userInfoToSend = {
+            accountDisplayName: this.indexer.getAcctDisplayName(entity),
+            canonicalID: entity.canonicalID,
+            arn: entity.arn,
+            // TODO Why?
+            // @ts-ignore
+            IAMdisplayName: entity.IAMdisplayName,
+        };
+        const vaultReturnObject = _formatResponse(userInfoToSend);
+        return callback(null, vaultReturnObject);
+    }
+
+    // TODO Options not used. Why ?
+    // CODEQUALITY-TODO-SYNC Should be synchronous
+    verifySignatureV4(
+        stringToSign: string,
+        signatureFromRequest: string,
+        accessKey: string,
+        region: string,
+        scopeDate: string,
+        _options: { algo: 'SHA256' | 'SHA1' },
+        callback: (
+            err: Error | null,
+            data?: ReturnType<typeof _formatResponse>
+        ) => void
+    ) {
+        const entity = this.indexer.getEntityByKey(accessKey);
+        if (!entity) {
+            return callback(errors.InvalidAccessKeyId);
+        }
+        const secretKey = this.indexer.getSecretKey(entity, accessKey);
+        const signingKey = calculateSigningKey(secretKey, region, scopeDate);
+        const reconstructedSig = crypto.createHmac('sha256', signingKey)
+            .update(stringToSign, 'binary').digest('hex');
+        if (signatureFromRequest !== reconstructedSig) {
+            return callback(errors.SignatureDoesNotMatch);
+        }
+        const userInfoToSend = {
+            accountDisplayName: this.indexer.getAcctDisplayName(entity),
+            canonicalID: entity.canonicalID,
+            arn: entity.arn,
+            // TODO Why?
+            // @ts-ignore
+            IAMdisplayName: entity.IAMdisplayName,
+        };
+        const vaultReturnObject = _formatResponse(userInfoToSend);
+        return callback(null, vaultReturnObject);
+    }
+
+    // TODO log not used. Why ?
+    // CODEQUALITY-TODO-SYNC Should be synchronous
+    getCanonicalIds(
+        emails: string[],
+        _log: any,
+        cb: (err: null, data: { message: { body: any } }) => void
+    ) {
+        const results = {};
+        emails.forEach(email => {
+            const lowercasedEmail = email.toLowerCase();
+            const entity = this.indexer.getEntityByEmail(lowercasedEmail);
+            if (!entity) {
+                results[email] = 'NotFound';
+            } else {
+                results[email] =
+                    entity.canonicalID;
+            }
+        });
+        const vaultReturnObject = {
+            message: {
+                body: results,
+            },
+        };
+        return cb(null, vaultReturnObject);
+    }
+
+    // TODO options not used. Why ?
+    // CODEQUALITY-TODO-SYNC Should be synchronous
+    getEmailAddresses(
+        canonicalIDs: string[],
+        _options: any,
+        cb: (err: null, data: { message: { body: any } }) => void
+    ) {
+        const results = {};
+        canonicalIDs.forEach(canonicalId => {
+            const foundEntity = this.indexer.getEntityByCanId(canonicalId);
+            if (!foundEntity || !foundEntity.email) {
+                results[canonicalId] = 'NotFound';
+            } else {
+                results[canonicalId] = foundEntity.email;
+            }
+        });
+        const vaultReturnObject = {
+            message: {
+                body: results,
+            },
+        };
+        return cb(null, vaultReturnObject);
+    }
+
+    // TODO options not used. Why ?
+    // CODEQUALITY-TODO-SYNC Should be synchronous
+    /**
+     * Gets accountIds for a list of accounts based on
+     * the canonical IDs associated with the account
+     * @param canonicalIDs - list of canonicalIDs
+     * @param _options - to send log id to vault
+     * @param cb - callback to calling function
+     * @returns The next is wrong. Here to keep archives.
+     * callback with either error or
+     * an object from Vault containing account canonicalID
+     * as each object key and an accountId as the value (or "NotFound")
+     */
+    getAccountIds(
+        canonicalIDs: string[],
+        _options: any,
+        cb: (err: null, data: { message: { body: any } }) => void
+    ) {
+        const results = {};
+        canonicalIDs.forEach(canonicalID => {
+            const foundEntity = this.indexer.getEntityByCanId(canonicalID);
+            if (!foundEntity || !foundEntity.shortid) {
+                results[canonicalID] = 'Not Found';
+            } else {
+                results[canonicalID] = foundEntity.shortid;
+            }
+        });
+        const vaultReturnObject = {
+            message: {
+                body: results,
+            },
+        };
+        return cb(null, vaultReturnObject);
+    }
+}
+
+class S3AuthBackend extends Backend {
+    constructor(authdata: Accounts) {
+        super('s3', new Indexer(authdata));
+    }
+
+    refreshAuthData(authData: Accounts) {
+        this.indexer = new Indexer(authData);
+    }
+}
+
+export { S3AuthBackend as s3 };

lib/auth/in_memory/Indexer.js

@@ -1,145 +0,0 @@
-/**
- * Class that provides an internal indexing over the simple data provided by
- * the authentication configuration file for the memory backend. This allows
- * accessing the different authentication entities through various types of
- * keys.
- *
- * @class Indexer
- */
-class Indexer {
-    /**
-     * @constructor
-     * @param {object} authdata - the authentication config file's data
-     * @param {object[]} authdata.accounts - array of account objects
-     * @param {string=} authdata.accounts[].name - account name
-     * @param {string} authdata.accounts[].email - account email
-     * @param {string} authdata.accounts[].arn - IAM resource name
-     * @param {string} authdata.accounts[].canonicalID - account canonical ID
-     * @param {string} authdata.accounts[].shortid - short account ID
-     * @param {object[]=} authdata.accounts[].keys - array of key objects
-     * @param {string} authdata.accounts[].keys[].access - access key
-     * @param {string} authdata.accounts[].keys[].secret - secret key
-     * @return {undefined}
-     */
-    constructor(authdata) {
-        this.accountsBy = {
-            canId: {},
-            accessKey: {},
-            email: {},
-        };
-
-        /*
-         * This may happen if the application is configured to use another
-         * authentication backend than in-memory.
-         * As such, we're managing the error here to avoid screwing up there.
-         */
-        if (!authdata) {
-            return;
-        }
-
-        this._build(authdata);
-    }
-
-    _indexAccount(account) {
-        const accountData = {
-            arn: account.arn,
-            canonicalID: account.canonicalID,
-            shortid: account.shortid,
-            accountDisplayName: account.name,
-            email: account.email.toLowerCase(),
-            keys: [],
-        };
-        this.accountsBy.canId[accountData.canonicalID] = accountData;
-        this.accountsBy.email[accountData.email] = accountData;
-        if (account.keys !== undefined) {
-            account.keys.forEach(key => {
-                accountData.keys.push(key);
-                this.accountsBy.accessKey[key.access] = accountData;
-            });
-        }
-    }
-
-    _build(authdata) {
-        authdata.accounts.forEach(account => {
-            this._indexAccount(account);
-        });
-    }
-
-    /**
-     * This method returns the account associated to a canonical ID.
-     *
-     * @param {string} canId - The canonicalId of the account
-     * @return {Object} account - The account object
-     * @return {Object} account.arn - The account's ARN
-     * @return {Object} account.canonicalID - The account's canonical ID
-     * @return {Object} account.shortid - The account's internal shortid
-     * @return {Object} account.accountDisplayName - The account's display name
-     * @return {Object} account.email - The account's lowercased email
-     */
-    getEntityByCanId(canId) {
-        return this.accountsBy.canId[canId];
-    }
-
-    /**
-     * This method returns the entity (either an account or a user) associated
-     * to a canonical ID.
-     *
-     * @param {string} key - The accessKey of the entity
-     * @return {Object} entity - The entity object
-     * @return {Object} entity.arn - The entity's ARN
-     * @return {Object} entity.canonicalID - The canonical ID for the entity's
-     *                                       account
-     * @return {Object} entity.shortid - The entity's internal shortid
-     * @return {Object} entity.accountDisplayName - The entity's account
-     *                                              display name
-     * @return {Object} entity.IAMDisplayName - The user's display name
-     *                                          (if the entity is an user)
-     * @return {Object} entity.email - The entity's lowercased email
-     */
-    getEntityByKey(key) {
-        return this.accountsBy.accessKey[key];
-    }
-
-    /**
-     * This method returns the entity (either an account or a user) associated
-     * to an email address.
-     *
-     * @param {string} email - The email address
-     * @return {Object} entity - The entity object
-     * @return {Object} entity.arn - The entity's ARN
-     * @return {Object} entity.canonicalID - The canonical ID for the entity's
-     *                                       account
-     * @return {Object} entity.shortid - The entity's internal shortid
-     * @return {Object} entity.accountDisplayName - The entity's account
-     *                                              display name
-     * @return {Object} entity.IAMDisplayName - The user's display name
-     *                                          (if the entity is an user)
-     * @return {Object} entity.email - The entity's lowercased email
-     */
-    getEntityByEmail(email) {
-        const lowerCasedEmail = email.toLowerCase();
-        return this.accountsBy.email[lowerCasedEmail];
-    }
-
-    /**
-    * This method returns the secret key associated with the entity.
-    * @param {Object} entity - the entity object
-    * @param {string} accessKey - access key
-    * @returns {string} secret key
-    */
-    getSecretKey(entity, accessKey) {
-        return entity.keys
-            .filter(kv => kv.access === accessKey)[0].secret;
-    }
-
-    /**
-    * This method returns the account display name associated with the entity.
-    * @param {Object} entity - the entity object
-    * @returns {string} account display name
-    */
-    getAcctDisplayName(entity) {
-        return entity.accountDisplayName;
-    }
-}
-
-module.exports = Indexer;

lib/auth/in_memory/Indexer.ts

@@ -0,0 +1,93 @@
+import { Accounts, Account, Entity } from './types';
+
+/**
+ * Class that provides an internal indexing over the simple data provided by
+ * the authentication configuration file for the memory backend. This allows
+ * accessing the different authentication entities through various types of
+ * keys.
+ */
+export default class Indexer {
+    accountsBy: {
+        canId: { [id: string]: Entity | undefined },
+        accessKey: { [id: string]: Entity | undefined },
+        email: { [id: string]: Entity | undefined },
+    }
+
+    constructor(authdata?: Accounts) {
+        this.accountsBy = {
+            canId: {},
+            accessKey: {},
+            email: {},
+        };
+
+        /*
+         * This may happen if the application is configured to use another
+         * authentication backend than in-memory.
+         * As such, we're managing the error here to avoid screwing up there.
+         */
+        if (!authdata) {
+            return;
+        }
+
+        this.#build(authdata);
+    }
+
+    #indexAccount(account: Account) {
+        const accountData: Entity = {
+            arn: account.arn,
+            canonicalID: account.canonicalID,
+            shortid: account.shortid,
+            accountDisplayName: account.name,
+            email: account.email.toLowerCase(),
+            keys: [],
+        };
+        this.accountsBy.canId[accountData.canonicalID] = accountData;
+        this.accountsBy.email[accountData.email] = accountData;
+        if (account.keys !== undefined) {
+            account.keys.forEach(key => {
+                accountData.keys.push(key);
+                this.accountsBy.accessKey[key.access] = accountData;
+            });
+        }
+    }
+
+    #build(authdata: Accounts) {
+        authdata.accounts.forEach(account => {
+            this.#indexAccount(account);
+        });
+    }
+
+    /** This method returns the account associated to a canonical ID. */
+    getEntityByCanId(canId: string): Entity | undefined {
+        return this.accountsBy.canId[canId];
+    }
+
+    /**
+     * This method returns the entity (either an account or a user) associated
+     * to a canonical ID.
+     * @param {string} key - The accessKey of the entity
+     */
+    getEntityByKey(key: string): Entity | undefined {
+        return this.accountsBy.accessKey[key];
+    }
+
+    /**
+     * This method returns the entity (either an account or a user) associated
+     * to an email address.
+     */
+    getEntityByEmail(email: string): Entity | undefined {
+        const lowerCasedEmail = email.toLowerCase();
+        return this.accountsBy.email[lowerCasedEmail];
+    }
+
+    /** This method returns the secret key associated with the entity. */
+    getSecretKey(entity: Entity, accessKey: string) {
+        const keys = entity.keys.filter(kv => kv.access === accessKey);
+        return keys[0].secret;
+    }
+
+    /** This method returns the account display name associated with the entity. */
+    getAcctDisplayName(entity: Entity) {
+        return entity.accountDisplayName;
+    }
+}

lib/auth/in_memory/types.ts

@@ -0,0 +1,51 @@
+import joi from 'joi';
+
+export type Callback<Data = any> = (err: Error | null | undefined, data?: Data) => void;
+
+export type Key = { access: string; secret: string };
+export type Base = {
+    arn: string;
+    canonicalID: string;
+    shortid: string;
+    email: string;
+    keys: Key[];
+};
+export type Account = Base & { name: string; users: any[] };
+export type Accounts = { accounts: Account[] };
+export type Entity = Base & { accountDisplayName: string };
+
+const keys = ((): joi.ArraySchema => {
+    const str = joi.string().required();
+    const items = { access: str, secret: str };
+    return joi.array().items(items).required();
+})();
+
+const account = (() => {
+    return joi.object<Account>({
+        name: joi.string().required(),
+        email: joi.string().email().required(),
+        arn: joi.string().required(),
+        canonicalID: joi.string().required(),
+        shortid: joi
+            .string()
+            .regex(/^[0-9]{12}$/)
+            .required(),
+        keys: keys,
+        // backward-compat
+        users: joi.array(),
+    });
+})();
+
+const accounts = (() => {
+    return joi.object<Accounts>({
+        accounts: joi
+            .array()
+            .items(account)
+            .required()
+            .unique('arn')
+            .unique('email')
+            .unique('canonicalID'),
+    });
+})();
+
+export const validators = { keys, account, accounts };

lib/auth/in_memory/validateAuthConfig.js

@@ -1,18 +0,0 @@
-const AuthLoader = require('./AuthLoader');
-
-/**
- * @deprecated please use {@link AuthLoader} class instead
- *
- * @param {object} authdata - the authentication config file's data
- * @param {werelogs.API} logApi - object providing a constructor function
- *                                for the Logger object
- * @return {boolean} true on erroneous data
- *                   false on success
- */
-function validateAuthConfig(authdata, logApi) {
-    const authLoader = new AuthLoader(logApi);
-    authLoader.addAccounts(authdata);
-    return !authLoader.validate();
-}
-
-module.exports = validateAuthConfig;

lib/auth/in_memory/validateAuthConfig.ts

@@ -0,0 +1,16 @@
+import { Logger } from 'werelogs';
+import AuthLoader from './AuthLoader';
+import { Accounts } from './types';
+
+/**
+ * @deprecated please use {@link AuthLoader} class instead
+ * @return true on erroneous data false on success
+ */
+export default function validateAuthConfig(
+    authdata: Accounts,
+    logApi?: { Logger: typeof Logger }
+) {
+    const authLoader = new AuthLoader(logApi);
+    authLoader.addAccounts(authdata);
+    return !authLoader.validate();
+}

lib/auth/in_memory/vaultUtilities.ts

@@ -1,6 +1,4 @@
-'use strict'; // eslint-disable-line strict
-
-const crypto = require('crypto');
+import * as crypto from 'crypto';
 
 /** hashSignature for v2 Auth
  * @param {string} stringToSign - built string to sign per AWS rules
@@ -8,11 +6,19 @@ const crypto = require('crypto');
  * @param {string} algorithm - either SHA256 or SHA1
  * @return {string} reconstructed signature
  */
-function hashSignature(stringToSign, secretKey, algorithm) {
+export function hashSignature(
+    stringToSign: string,
+    secretKey: string,
+    algorithm: 'SHA256' | 'SHA1'
+): string {
     const hmacObject = crypto.createHmac(algorithm, secretKey);
     return hmacObject.update(stringToSign, 'binary').digest('base64');
 }
 
+const sha256 = (key: string | Buffer, data: string) => {
+    return crypto.createHmac('sha256', key).update(data, 'binary').digest();
+};
+
 /** calculateSigningKey for v4 Auth
  * @param {string} secretKey - requester's secretKey
  * @param {string} region - region included in request
@@ -20,16 +26,15 @@ function hashSignature(stringToSign, secretKey, algorithm) {
  * @param {string} [service] - To specify another service than s3
  * @return {string} signingKey - signingKey to calculate signature
  */
-function calculateSigningKey(secretKey, region, scopeDate, service) {
-    const dateKey = crypto.createHmac('sha256', `AWS4${secretKey}`)
-        .update(scopeDate, 'binary').digest();
-    const dateRegionKey = crypto.createHmac('sha256', dateKey)
-        .update(region, 'binary').digest();
-    const dateRegionServiceKey = crypto.createHmac('sha256', dateRegionKey)
-        .update(service || 's3', 'binary').digest();
-    const signingKey = crypto.createHmac('sha256', dateRegionServiceKey)
-        .update('aws4_request', 'binary').digest();
+export function calculateSigningKey(
+    secretKey: string,
+    region: string,
+    scopeDate: string,
+    service?: string
+): Buffer {
+    const dateKey = sha256(`AWS4${secretKey}`, scopeDate);
+    const dateRegionKey = sha256(dateKey, region);
+    const dateRegionServiceKey = sha256(dateRegionKey, service || 's3');
+    const signingKey = sha256(dateRegionServiceKey, 'aws4_request');
     return signingKey;
 }
-
-module.exports = { hashSignature, calculateSigningKey };

lib/auth/v2/algoCheck.ts

@@ -1,7 +1,5 @@
-'use strict'; // eslint-disable-line strict
-
-function algoCheck(signatureLength) {
-    let algo;
+export default function algoCheck(signatureLength: number) {
+    let algo: 'sha256' | 'sha1';
     // If the signature sent is 44 characters,
     // this means that sha256 was used:
     // 44 characters in base64
@@ -13,7 +11,6 @@ function algoCheck(signatureLength) {
     if (signatureLength === SHA1LEN) {
         algo = 'sha1';
     }
+    // @ts-ignore
     return algo;
 }
-
-module.exports = algoCheck;

lib/auth/v2/authV2.js

@@ -1,11 +0,0 @@
-'use strict'; // eslint-disable-line strict
-
-const headerAuthCheck = require('./headerAuthCheck');
-const queryAuthCheck = require('./queryAuthCheck');
-
-const authV2 = {
-    header: headerAuthCheck,
-    query: queryAuthCheck,
-};
-
-module.exports = authV2;

lib/auth/v2/authV2.ts

@@ -0,0 +1,2 @@
+export * as header from './headerAuthCheck';
+export * as query from './queryAuthCheck';

lib/auth/v2/checkRequestExpiry.ts

@@ -1,9 +1,9 @@
-'use strict'; // eslint-disable-line strict
-const errors = require('../../errors');
+import { Logger } from 'werelogs';
+import errors from '../../errors';
 
 const epochTime = new Date('1970-01-01').getTime();
 
-function checkRequestExpiry(timestamp, log) {
+export default function checkRequestExpiry(timestamp: number, log: Logger) {
     // If timestamp is before epochTime, the request is invalid and return
     // errors.AccessDenied
     if (timestamp < epochTime) {
@@ -32,5 +32,3 @@ function checkRequestExpiry(timestamp, log) {
 
     return undefined;
 }
-
-module.exports = checkRequestExpiry;

lib/auth/v2/constructStringToSign.ts

@@ -1,11 +1,14 @@
-'use strict'; // eslint-disable-line strict
+import { Logger } from 'werelogs';
+import utf8 from 'utf8';
+import getCanonicalizedAmzHeaders from './getCanonicalizedAmzHeaders';
+import getCanonicalizedResource from './getCanonicalizedResource';
 
-const utf8 = require('utf8');
-
-const getCanonicalizedAmzHeaders = require('./getCanonicalizedAmzHeaders');
-const getCanonicalizedResource = require('./getCanonicalizedResource');
-
-function constructStringToSign(request, data, log, clientType) {
+export default function constructStringToSign(
+    request: any,
+    data: { [key: string]: string },
+    log: Logger,
+    clientType?: any
+) {
     /*
     Build signature per AWS requirements:
     StringToSign = HTTP-Verb + '\n' +
@@ -42,5 +45,3 @@ function constructStringToSign(request, data, log, clientType) {
         + getCanonicalizedResource(request, clientType);
     return utf8.encode(stringToSign);
 }
-
-module.exports = constructStringToSign;

lib/auth/v2/getCanonicalizedAmzHeaders.ts

@@ -1,14 +1,12 @@
-'use strict'; // eslint-disable-line strict
-
-function getCanonicalizedAmzHeaders(headers, clientType) {
+export default function getCanonicalizedAmzHeaders(headers: Headers, clientType: string) {
     /*
     Iterate through headers and pull any headers that are x-amz headers.
     Need to include 'x-amz-date' here even though AWS docs
     ambiguous on this.
     */
     const filterFn = clientType === 'GCP' ?
-        val => val.substr(0, 7) === 'x-goog-' :
-        val => val.substr(0, 6) === 'x-amz-';
+        (val: string) => val.substr(0, 7) === 'x-goog-' :
+        (val: string) => val.substr(0, 6) === 'x-amz-';
     const amzHeaders = Object.keys(headers)
         .filter(filterFn)
         .map(val => [val.trim(), headers[val].trim()]);
@@ -41,7 +39,5 @@ function getCanonicalizedAmzHeaders(headers, clientType) {
     // Build headerString
     return amzHeaders.reduce((headerStr, current) =>
         `${headerStr}${current[0]}:${current[1]}\n`,
-        '');
+    '');
 }
-
-module.exports = getCanonicalizedAmzHeaders;

lib/auth/v2/getCanonicalizedResource.ts

@@ -1,6 +1,4 @@
-'use strict'; // eslint-disable-line strict
-
-const url = require('url');
+import * as url from 'url';
 
 const gcpSubresources = [
     'acl',
@@ -41,7 +39,7 @@ const awsSubresources = [
     'website',
 ];
 
-function getCanonicalizedResource(request, clientType) {
+export default function getCanonicalizedResource(request: any, clientType: string) {
     /*
     This variable is used to determine whether to insert
     a '?' or '&'.  Once a query parameter is added to the resourceString,
@@ -117,5 +115,3 @@ function getCanonicalizedResource(request, clientType) {
     }
     return resourceString;
 }
-
-module.exports = getCanonicalizedResource;

lib/auth/v2/headerAuthCheck.ts

@@ -1,12 +1,11 @@
-'use strict'; // eslint-disable-line strict
+import { Logger } from 'werelogs';
+import errors from '../../errors';
+import * as constants from '../../constants';
+import constructStringToSign from './constructStringToSign';
+import checkRequestExpiry from './checkRequestExpiry';
+import algoCheck from './algoCheck';
 
-const errors = require('../../errors');
-const constants = require('../../constants');
-const constructStringToSign = require('./constructStringToSign');
-const checkRequestExpiry = require('./checkRequestExpiry');
-const algoCheck = require('./algoCheck');
-
-function check(request, log, data) {
+export function check(request: any, log: Logger, data: { [key: string]: string }) {
     log.trace('running header auth check');
     const headers = request.headers;
 
@@ -22,9 +21,9 @@ function check(request, log, data) {
     timestamp = Date.parse(timestamp);
     if (!timestamp) {
         log.debug('missing or invalid date header',
-        { method: 'auth/v2/headerAuthCheck.check' });
+            { method: 'auth/v2/headerAuthCheck.check' });
         return { err: errors.AccessDenied.
-          customizeDescription('Authentication requires a valid Date or ' +
+            customizeDescription('Authentication requires a valid Date or ' +
           'x-amz-date header') };
     }
 
@@ -52,6 +51,7 @@ function check(request, log, data) {
         log.trace('invalid authorization header', { authInfo });
         return { err: errors.MissingSecurityHeader };
     }
+    // @ts-ignore
     log.addDefaultFields({ accessKey });
 
     const signatureFromRequest = authInfo.substring(semicolonIndex + 1).trim();
@@ -80,5 +80,3 @@ function check(request, log, data) {
         },
     };
 }
-
-module.exports = { check };

lib/auth/v2/queryAuthCheck.ts

@@ -1,11 +1,10 @@
-'use strict'; // eslint-disable-line strict
+import { Logger } from 'werelogs';
+import errors from '../../errors';
+import * as constants from '../../constants';
+import algoCheck from './algoCheck';
+import constructStringToSign from './constructStringToSign';
 
-const errors = require('../../errors');
-const constants = require('../../constants');
-const algoCheck = require('./algoCheck');
-const constructStringToSign = require('./constructStringToSign');
-
-function check(request, log, data) {
+export function check(request: any, log: Logger, data: { [key: string]: string }) {
     log.trace('running query auth check');
     if (request.method === 'POST') {
         log.debug('query string auth not supported for post requests');
@@ -42,15 +41,16 @@ function check(request, log, data) {
 
     if (expirationTime > currentTime + preSignedURLExpiry) {
         log.debug('expires parameter too far in future',
-        { expires: request.query.Expires });
+            { expires: request.query.Expires });
         return { err: errors.AccessDenied };
     }
     if (currentTime > expirationTime) {
         log.debug('current time exceeds expires time',
-        { expires: request.query.Expires });
+            { expires: request.query.Expires });
         return { err: errors.RequestTimeTooSkewed };
     }
     const accessKey = data.AWSAccessKeyId;
+    // @ts-ignore
     log.addDefaultFields({ accessKey });
 
     const signatureFromRequest = decodeURIComponent(data.Signature);
@@ -82,5 +82,3 @@ function check(request, log, data) {
         },
     };
 }
-
-module.exports = { check };

lib/auth/v4/authV4.js

@@ -1,11 +0,0 @@
-'use strict'; // eslint-disable-line strict
-
-const headerAuthCheck = require('./headerAuthCheck');
-const queryAuthCheck = require('./queryAuthCheck');
-
-const authV4 = {
-    header: headerAuthCheck,
-    query: queryAuthCheck,
-};
-
-module.exports = authV4;

lib/auth/v4/authV4.ts

@@ -0,0 +1,2 @@
+export * as header from './headerAuthCheck';
+export * as query from './queryAuthCheck';

lib/auth/v4/awsURIencode.ts

@@ -1,5 +1,3 @@
-'use strict'; // eslint-disable-line strict
-
 /*
 AWS's URI encoding rules:
 URI encode every byte. Uri-Encode() must enforce the following rules:
@@ -19,7 +17,7 @@ See http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
 */
 
 // converts utf8 character to hex and pads "%" before every two hex digits
-function _toHexUTF8(char) {
+function _toHexUTF8(char: string) {
     const hexRep = Buffer.from(char, 'utf8').toString('hex').toUpperCase();
     let res = '';
     hexRep.split('').forEach((v, n) => {
@@ -32,7 +30,11 @@ function _toHexUTF8(char) {
     return res;
 }
 
-function awsURIencode(input, encodeSlash, noEncodeStar) {
+export default function awsURIencode(
+    input: string,
+    encodeSlash?: boolean,
+    noEncodeStar?: boolean
+) {
     const encSlash = encodeSlash === undefined ? true : encodeSlash;
     let encoded = '';
     /**
@@ -62,5 +64,3 @@ function awsURIencode(input, encodeSlash, noEncodeStar) {
     }
     return encoded;
 }
-
-module.exports = awsURIencode;

lib/auth/v4/constructStringToSign.ts

@@ -1,17 +1,33 @@
-'use strict'; // eslint-disable-line strict
-
-const crypto = require('crypto');
-
-const createCanonicalRequest = require('./createCanonicalRequest');
+import * as crypto from 'crypto';
+import { Logger } from 'werelogs';
+import createCanonicalRequest from './createCanonicalRequest';
 
 /**
  * constructStringToSign - creates V4 stringToSign
  * @param {object} params - params object
  * @returns {string} - stringToSign
  */
-function constructStringToSign(params) {
-    const { request, signedHeaders, payloadChecksum, credentialScope, timestamp,
-        query, log, proxyPath } = params;
+export default function constructStringToSign(params: {
+    request: any;
+    signedHeaders: any;
+    payloadChecksum: any;
+    credentialScope: string;
+    timestamp: string;
+    query: { [key: string]: string };
+    log?: Logger;
+    proxyPath?: string;
+    awsService: string;
+}): string | Error {
+    const {
+        request,
+        signedHeaders,
+        payloadChecksum,
+        credentialScope,
+        timestamp,
+        query,
+        log,
+        proxyPath,
+    } = params;
     const path = proxyPath || request.path;
 
     const canonicalReqResult = createCanonicalRequest({
@@ -24,6 +40,8 @@ function constructStringToSign(params) {
         service: params.awsService,
     });
 
+    // TODO Why that line?
+    // @ts-ignore
     if (canonicalReqResult instanceof Error) {
         if (log) {
             log.error('error creating canonicalRequest');
@@ -40,5 +58,3 @@ function constructStringToSign(params) {
     `${credentialScope}\n${canonicalHex}`;
     return stringToSign;
 }
-
-module.exports = constructStringToSign;

lib/auth/v4/createCanonicalRequest.ts

@@ -1,27 +1,33 @@
-'use strict'; // eslint-disable-line strict
-
-const awsURIencode = require('./awsURIencode');
-const crypto = require('crypto');
-const queryString = require('querystring');
+import * as crypto from 'crypto';
+import * as queryString from 'querystring';
+import awsURIencode from './awsURIencode';
 
 /**
  * createCanonicalRequest - creates V4 canonical request
- * @param {object} params - contains pHttpVerb (request type),
+ * @param params - contains pHttpVerb (request type),
  * pResource (parsed from URL), pQuery (request query),
  * pHeaders (request headers), pSignedHeaders (signed headers from request),
  * payloadChecksum (from request)
- * @returns {string} - canonicalRequest
+ * @returns - canonicalRequest
  */
-function createCanonicalRequest(params) {
+export default function createCanonicalRequest(
+    params: {
+        pHttpVerb: string;
+        pResource: string;
+        pQuery: { [key: string]: string };
+        pHeaders: any;
+        pSignedHeaders: any;
+        service: string;
+        payloadChecksum: string;
+    }
+) {
     const pHttpVerb = params.pHttpVerb;
     const pResource = params.pResource;
     const pQuery = params.pQuery;
     const pHeaders = params.pHeaders;
     const pSignedHeaders = params.pSignedHeaders;
     const service = params.service;
-
     let payloadChecksum = params.payloadChecksum;
-
     if (!payloadChecksum) {
         if (pHttpVerb === 'GET') {
             payloadChecksum = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b' +
@@ -34,7 +40,7 @@ function createCanonicalRequest(params) {
             if (/aws-sdk-java\/[0-9.]+/.test(pHeaders['user-agent'])) {
                 notEncodeStar = true;
             }
-            let payload = queryString.stringify(pQuery, null, null, {
+            let payload = queryString.stringify(pQuery, undefined, undefined, {
                 encodeURIComponent: input => awsURIencode(input, true,
                     notEncodeStar),
             });
@@ -61,11 +67,11 @@ function createCanonicalRequest(params) {
 
     // signed headers
     const signedHeadersList = pSignedHeaders.split(';');
-    signedHeadersList.sort((a, b) => a.localeCompare(b));
+    signedHeadersList.sort((a: any, b: any) => a.localeCompare(b));
     const signedHeaders = signedHeadersList.join(';');
 
     // canonical headers
-    const canonicalHeadersList = signedHeadersList.map(signedHeader => {
+    const canonicalHeadersList = signedHeadersList.map((signedHeader: any) => {
         if (pHeaders[signedHeader] !== undefined) {
             const trimmedHeader = pHeaders[signedHeader]
                 .trim().replace(/\s+/g, ' ');
@@ -87,5 +93,3 @@ function createCanonicalRequest(params) {
         `${signedHeaders}\n${payloadChecksum}`;
     return canonicalRequest;
 }
-
-module.exports = createCanonicalRequest;

lib/auth/v4/headerAuthCheck.ts

@@ -1,27 +1,32 @@
-'use strict'; // eslint-disable-line strict
-
-const errors = require('../../../lib/errors');
-const constants = require('../../constants');
-
-const constructStringToSign = require('./constructStringToSign');
-const checkTimeSkew = require('./timeUtils').checkTimeSkew;
-const convertUTCtoISO8601 = require('./timeUtils').convertUTCtoISO8601;
-const convertAmzTimeToMs = require('./timeUtils').convertAmzTimeToMs;
-const extractAuthItems = require('./validateInputs').extractAuthItems;
-const validateCredentials = require('./validateInputs').validateCredentials;
-const areSignedHeadersComplete =
-    require('./validateInputs').areSignedHeadersComplete;
+import { Logger } from 'werelogs';
+import errors from '../../../lib/errors';
+import * as constants from '../../constants';
+import constructStringToSign from './constructStringToSign';
+import {
+    checkTimeSkew,
+    convertUTCtoISO8601,
+    convertAmzTimeToMs,
+} from './timeUtils';
+import {
+    extractAuthItems,
+    validateCredentials,
+    areSignedHeadersComplete,
+} from './validateInputs';
 
 /**
  * V4 header auth check
- * @param {object} request - HTTP request object
- * @param {object} log - logging object
- * @param {object} data - Parameters from queryString parsing or body of
+ * @param request - HTTP request object
+ * @param log - logging object
+ * @param data - Parameters from queryString parsing or body of
  *      POST request
- * @param {string} awsService - Aws service ('iam' or 's3')
- * @return {callback} calls callback
+ * @param awsService - Aws service ('iam' or 's3')
  */
-function check(request, log, data, awsService) {
+export function check(
+    request: any,
+    log: Logger,
+    data: { [key: string]: string },
+    awsService: string
+) {
     log.trace('running header auth check');
 
     const token = request.headers['x-amz-security-token'];
@@ -62,16 +67,16 @@ function check(request, log, data, awsService) {
 
     log.trace('authorization header from request', { authHeader });
 
-    const signatureFromRequest = authHeaderItems.signatureFromRequest;
-    const credentialsArr = authHeaderItems.credentialsArr;
-    const signedHeaders = authHeaderItems.signedHeaders;
+    const signatureFromRequest = authHeaderItems.signatureFromRequest!;
+    const credentialsArr = authHeaderItems.credentialsArr!;
+    const signedHeaders = authHeaderItems.signedHeaders!;
 
     if (!areSignedHeadersComplete(signedHeaders, request.headers)) {
         log.debug('signedHeaders are incomplete', { signedHeaders });
         return { err: errors.AccessDenied };
     }
 
-    let timestamp;
+    let timestamp: string | undefined;
     // check request timestamp
     const xAmzDate = request.headers['x-amz-date'];
     if (xAmzDate) {
@@ -88,14 +93,14 @@ function check(request, log, data, awsService) {
     }
     if (!timestamp) {
         log.debug('missing or invalid date header',
-          { method: 'auth/v4/headerAuthCheck.check' });
+            { method: 'auth/v4/headerAuthCheck.check' });
         return { err: errors.AccessDenied.
-          customizeDescription('Authentication requires a valid Date or ' +
+            customizeDescription('Authentication requires a valid Date or ' +
           'x-amz-date header') };
     }
 
     const validationResult = validateCredentials(credentialsArr, timestamp,
-      log);
+        log);
     if (validationResult instanceof Error) {
         log.debug('credentials in improper format', { credentialsArr,
             timestamp, validationResult });
@@ -166,5 +171,3 @@ function check(request, log, data, awsService) {
         },
     };
 }
-
-module.exports = { check };

lib/auth/v4/queryAuthCheck.ts

@@ -1,24 +1,18 @@
-'use strict'; // eslint-disable-line strict
-
-const constants = require('../../constants');
-const errors = require('../../errors');
-
-const constructStringToSign = require('./constructStringToSign');
-const checkTimeSkew = require('./timeUtils').checkTimeSkew;
-const convertAmzTimeToMs = require('./timeUtils').convertAmzTimeToMs;
-const validateCredentials = require('./validateInputs').validateCredentials;
-const extractQueryParams = require('./validateInputs').extractQueryParams;
-const areSignedHeadersComplete =
-    require('./validateInputs').areSignedHeadersComplete;
+import { Logger } from 'werelogs';
+import * as constants from '../../constants';
+import errors from '../../errors';
+import constructStringToSign from './constructStringToSign';
+import { checkTimeSkew, convertAmzTimeToMs } from './timeUtils';
+import { validateCredentials, extractQueryParams } from './validateInputs';
+import { areSignedHeadersComplete } from './validateInputs';
 
 /**
  * V4 query auth check
- * @param {object} request - HTTP request object
- * @param {object} log - logging object
- * @param {object} data - Contain authentification params (GET or POST data)
- * @return {callback} calls callback
+ * @param request - HTTP request object
+ * @param log - logging object
+ * @param data - Contain authentification params (GET or POST data)
  */
-function check(request, log, data) {
+export function check(request: any, log: Logger, data: { [key: string]: string }) {
     const authParams = extractQueryParams(data, log);
 
     if (Object.keys(authParams).length !== 5) {
@@ -33,11 +27,11 @@ function check(request, log, data) {
         return { err: errors.InvalidToken };
     }
 
-    const signedHeaders = authParams.signedHeaders;
-    const signatureFromRequest = authParams.signatureFromRequest;
-    const timestamp = authParams.timestamp;
-    const expiry = authParams.expiry;
-    const credential = authParams.credential;
+    const signedHeaders = authParams.signedHeaders!;
+    const signatureFromRequest = authParams.signatureFromRequest!;
+    const timestamp = authParams.timestamp!;
+    const expiry = authParams.expiry!;
+    const credential = authParams.credential!;
 
     if (!areSignedHeadersComplete(signedHeaders, request.headers)) {
         log.debug('signedHeaders are incomplete', { signedHeaders });
@@ -45,7 +39,7 @@ function check(request, log, data) {
     }
 
     const validationResult = validateCredentials(credential, timestamp,
-      log);
+        log);
     if (validationResult instanceof Error) {
         log.debug('credentials in improper format', { credential,
             timestamp, validationResult });
@@ -110,5 +104,3 @@ function check(request, log, data) {
         },
     };
 }
-
-module.exports = { check };

lib/auth/v4/timeUtils.ts

@@ -1,12 +1,11 @@
-'use strict'; // eslint-disable-line strict
+import { Logger } from 'werelogs';
 
 /**
  * Convert timestamp to milliseconds since Unix Epoch
- * @param  {string} timestamp of ISO8601Timestamp format without
+ * @param timestamp of ISO8601Timestamp format without
  * dashes or colons, e.g. 20160202T220410Z
- * @return {number} number of milliseconds since Unix Epoch
  */
-function convertAmzTimeToMs(timestamp) {
+export function convertAmzTimeToMs(timestamp: string) {
     const arr = timestamp.split('');
     // Convert to YYYY-MM-DDTHH:mm:ss.sssZ
     const ISO8601time = `${arr.slice(0, 4).join('')}-${arr[4]}${arr[5]}` +
@@ -15,13 +14,12 @@ function convertAmzTimeToMs(timestamp) {
     return Date.parse(ISO8601time);
 }
 
-
 /**
  * Convert UTC timestamp to ISO 8601 timestamp
- * @param  {string} timestamp of UTC form: Fri, 10 Feb 2012 21:34:55 GMT
- * @return {string} ISO8601 timestamp of form: YYYYMMDDTHHMMSSZ
+ * @param timestamp of UTC form: Fri, 10 Feb 2012 21:34:55 GMT
+ * @return ISO8601 timestamp of form: YYYYMMDDTHHMMSSZ
  */
-function convertUTCtoISO8601(timestamp) {
+export function convertUTCtoISO8601(timestamp: string | number) {
     // convert to ISO string: YYYY-MM-DDTHH:mm:ss.sssZ.
     const converted = new Date(timestamp).toISOString();
     // Remove "-"s and "."s and milliseconds
@@ -30,13 +28,13 @@ function convertUTCtoISO8601(timestamp) {
 
 /**
  * Check whether timestamp predates request or is too old
- * @param  {string} timestamp of ISO8601Timestamp format without
+ * @param timestamp of ISO8601Timestamp format without
  * dashes or colons, e.g. 20160202T220410Z
- * @param {number} expiry - number of seconds signature should be valid
- * @param {object} log - log for request
- * @return {boolean} true if there is a time problem
+ * @param expiry - number of seconds signature should be valid
+ * @param log - log for request
+ * @return true if there is a time problem
  */
-function checkTimeSkew(timestamp, expiry, log) {
+export function checkTimeSkew(timestamp: string, expiry: number, log: Logger) {
     const currentTime = Date.now();
     const fifteenMinutes = (15 * 60 * 1000);
     const parsedTimestamp = convertAmzTimeToMs(timestamp);
@@ -56,5 +54,3 @@ function checkTimeSkew(timestamp, expiry, log) {
     }
     return false;
 }
-
-module.exports = { convertAmzTimeToMs, convertUTCtoISO8601, checkTimeSkew };

lib/auth/v4/validateInputs.ts

@@ -1,17 +1,19 @@
-'use strict'; // eslint-disable-line strict
-
-const errors = require('../../../lib/errors');
+import { Logger } from 'werelogs';
+import errors from '../../../lib/errors';
 
 /**
  * Validate Credentials
- * @param  {array} credentials - contains accessKey, scopeDate,
+ * @param credentials - contains accessKey, scopeDate,
  * region, service, requestType
- * @param {string} timestamp - timestamp from request in
+ * @param timestamp - timestamp from request in
  * the format of ISO 8601: YYYYMMDDTHHMMSSZ
- * @param {object} log - logging object
- * @return {boolean} true if credentials are correct format, false if not
+ * @param log - logging object
  */
-function validateCredentials(credentials, timestamp, log) {
+export function validateCredentials(
+    credentials: [string, string, string, string, string],
+    timestamp: string,
+    log: Logger
+): Error | {} {
     if (!Array.isArray(credentials) || credentials.length !== 5) {
         log.warn('credentials in improper format', { credentials });
         return errors.InvalidArgument;
@@ -25,20 +27,20 @@ function validateCredentials(credentials, timestamp, log) {
         log.warn('accessKey provided is wrong format', { accessKey });
         return errors.InvalidArgument;
     }
-     // The scope date (format YYYYMMDD) must be same date as the timestamp
-     // on the request from the x-amz-date param (if queryAuthCheck)
-     // or from the x-amz-date header or date header (if headerAuthCheck)
-     // Format of timestamp is ISO 8601: YYYYMMDDTHHMMSSZ.
-     // http://docs.aws.amazon.com/AmazonS3/latest/API/
-     // sigv4-query-string-auth.html
-     // http://docs.aws.amazon.com/general/latest/gr/
-     // sigv4-date-handling.html
+    // The scope date (format YYYYMMDD) must be same date as the timestamp
+    // on the request from the x-amz-date param (if queryAuthCheck)
+    // or from the x-amz-date header or date header (if headerAuthCheck)
+    // Format of timestamp is ISO 8601: YYYYMMDDTHHMMSSZ.
+    // http://docs.aws.amazon.com/AmazonS3/latest/API/
+    // sigv4-query-string-auth.html
+    // http://docs.aws.amazon.com/general/latest/gr/
+    // sigv4-date-handling.html
 
-     // convert timestamp to format of scopeDate YYYYMMDD
+    // convert timestamp to format of scopeDate YYYYMMDD
     const timestampDate = timestamp.split('T')[0];
     if (scopeDate.length !== 8 || scopeDate !== timestampDate) {
         log.warn('scope date must be the same date as the timestamp date',
-           { scopeDate, timestampDate });
+            { scopeDate, timestampDate });
         return errors.RequestTimeTooSkewed;
     }
     if (service !== 's3' && service !== 'iam' && service !== 'ring' &&
@@ -50,7 +52,7 @@ function validateCredentials(credentials, timestamp, log) {
     }
     if (requestType !== 'aws4_request') {
         log.warn('requestType contained in params is not aws4_request',
-           { requestType });
+            { requestType });
         return errors.InvalidArgument;
     }
     return {};
@@ -58,17 +60,26 @@ function validateCredentials(credentials, timestamp, log) {
 
 /**
  * Extract and validate components from query object
- * @param  {object} queryObj - query object from request
- * @param {object} log - logging object
- * @return {object} object containing extracted query params for authV4
+ * @param  queryObj - query object from request
+ * @param log - logging object
+ * @return object containing extracted query params for authV4
  */
-function extractQueryParams(queryObj, log) {
-    const authParams = {};
+export function extractQueryParams(
+    queryObj: { [key: string]: string | undefined },
+    log: Logger
+) {
+    const authParams: {
+        signedHeaders?: string;
+        signatureFromRequest?: string;
+        timestamp?: string;
+        expiry?: number;
+        credential?: [string, string, string, string, string];
+    } = {};
 
     // Do not need the algorithm sent back
     if (queryObj['X-Amz-Algorithm'] !== 'AWS4-HMAC-SHA256') {
         log.warn('algorithm param incorrect',
-        { algo: queryObj['X-Amz-Algorithm'] });
+            { algo: queryObj['X-Amz-Algorithm'] });
         return authParams;
     }
 
@@ -99,7 +110,7 @@ function extractQueryParams(queryObj, log) {
         return authParams;
     }
 
-    const expiry = Number.parseInt(queryObj['X-Amz-Expires'], 10);
+    const expiry = Number.parseInt(queryObj['X-Amz-Expires'] ?? 'nope', 10);
     const sevenDays = 604800;
     if (expiry && (expiry > 0 && expiry <= sevenDays)) {
         authParams.expiry = expiry;
@@ -110,6 +121,7 @@ function extractQueryParams(queryObj, log) {
 
     const credential = queryObj['X-Amz-Credential'];
     if (credential && credential.length > 28 && credential.indexOf('/') > -1) {
+        // @ts-ignore
         authParams.credential = credential.split('/');
     } else {
         log.warn('invalid credential param', { credential });
@@ -121,14 +133,17 @@ function extractQueryParams(queryObj, log) {
 
 /**
  * Extract and validate components from auth header
- * @param  {string} authHeader - authorization header from request
- * @param {object} log - logging object
- * @return {object} object containing extracted auth header items for authV4
+ * @param authHeader - authorization header from request
+ * @param log - logging object
+ * @return object containing extracted auth header items for authV4
  */
-function extractAuthItems(authHeader, log) {
-    const authItems = {};
-    const authArray = authHeader
-        .replace('AWS4-HMAC-SHA256 ', '').split(',');
+export function extractAuthItems(authHeader: string, log: Logger) {
+    const authItems: {
+        credentialsArr?: [string, string, string, string, string];
+        signedHeaders?: string;
+        signatureFromRequest?: string;
+    } = {};
+    const authArray = authHeader.replace('AWS4-HMAC-SHA256 ', '').split(',');
 
     if (authArray.length < 3) {
         return authItems;
@@ -138,8 +153,12 @@ function extractAuthItems(authHeader, log) {
     const signedHeadersStr = authArray[1];
     const signatureStr = authArray[2];
     log.trace('credentials from request', { credentialStr });
-    if (credentialStr && credentialStr.trim().startsWith('Credential=')
-        && credentialStr.indexOf('/') > -1) {
+    if (
+        credentialStr &&
+        credentialStr.trim().startsWith('Credential=') &&
+        credentialStr.indexOf('/') > -1
+    ) {
+        // @ts-ignore
         authItems.credentialsArr = credentialStr
             .trim().replace('Credential=', '').split('/');
     } else {
@@ -166,11 +185,11 @@ function extractAuthItems(authHeader, log) {
 /**
  * Checks whether the signed headers include the host header
  * and all x-amz- and x-scal- headers in request
- * @param {string} signedHeaders - signed headers sent with request
- * @param {object} allHeaders - request.headers
- * @return {boolean} true if all x-amz-headers included and false if not
+ * @param signedHeaders - signed headers sent with request
+ * @param allHeaders - request.headers
+ * @return true if all x-amz-headers included and false if not
  */
-function areSignedHeadersComplete(signedHeaders, allHeaders) {
+export function areSignedHeadersComplete(signedHeaders: string, allHeaders: Headers) {
     const signedHeadersList = signedHeaders.split(';');
     if (signedHeadersList.indexOf('host') === -1) {
         return false;
@@ -185,6 +204,3 @@ function areSignedHeadersComplete(signedHeaders, allHeaders) {
     }
     return true;
 }
-
-module.exports = { validateCredentials, extractQueryParams,
-    areSignedHeadersComplete, extractAuthItems };

lib/constants.js

@@ -1,108 +0,0 @@
-'use strict'; // eslint-disable-line strict
-
-// The min value here is to manage further backward compat if we
-// need it
-const iamSecurityTokenSizeMin = 128;
-const iamSecurityTokenSizeMax = 128;
-// Security token is an hex string (no real format from amazon)
-const iamSecurityTokenPattern =
-    new RegExp(`^[a-f0-9]{${iamSecurityTokenSizeMin},` +
-        `${iamSecurityTokenSizeMax}}$`);
-
-module.exports = {
-    // info about the iam security token
-    iamSecurityToken: {
-        min: iamSecurityTokenSizeMin,
-        max: iamSecurityTokenSizeMax,
-        pattern: iamSecurityTokenPattern,
-    },
-    // PublicId is used as the canonicalID for a request that contains
-    // no authentication information.  Requestor can access
-    // only public resources
-    publicId: 'http://acs.amazonaws.com/groups/global/AllUsers',
-    zenkoServiceAccount: 'http://acs.zenko.io/accounts/service',
-    metadataFileNamespace: '/MDFile',
-    dataFileURL: '/DataFile',
-    // AWS states max size for user-defined metadata
-    // (x-amz-meta- headers) is 2 KB:
-    // http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html
-    // In testing, AWS seems to allow up to 88 more bytes,
-    // so we do the same.
-    maximumMetaHeadersSize: 2136,
-    emptyFileMd5: 'd41d8cd98f00b204e9800998ecf8427e',
-    // Version 2 changes the format of the data location property
-    // Version 3 adds the dataStoreName attribute
-    mdModelVersion: 3,
-    /*
-     * Splitter is used to build the object name for the overview of a
-     * multipart upload and to build the object names for each part of a
-     * multipart upload.  These objects with large names are then stored in
-     * metadata in a "shadow bucket" to a real bucket.  The shadow bucket
-     * contains all ongoing multipart uploads.  We include in the object
-     * name some of the info we might need to pull about an open multipart
-     * upload or about an individual part with each piece of info separated
-     * by the splitter.  We can then extract each piece of info by splitting
-     * the object name string with this splitter.
-     * For instance, assuming a splitter of '...!*!',
-     * the name of the upload overview would be:
-     *   overview...!*!objectKey...!*!uploadId
-     * For instance, the name of a part would be:
-     *   uploadId...!*!partNumber
-     *
-     * The sequence of characters used in the splitter should not occur
-     * elsewhere in the pieces of info to avoid splitting where not
-     * intended.
-     *
-     * Splitter is also used in adding bucketnames to the
-     * namespacerusersbucket.  The object names added to the
-     * namespaceusersbucket are of the form:
-     * canonicalID...!*!bucketname
-     */
-
-    splitter: '..|..',
-    usersBucket: 'users..bucket',
-    // MPU Bucket Prefix is used to create the name of the shadow
-    // bucket used for multipart uploads.  There is one shadow mpu
-    // bucket per bucket and its name is the mpuBucketPrefix followed
-    // by the name of the final destination bucket for the object
-    // once the multipart upload is complete.
-    mpuBucketPrefix: 'mpuShadowBucket',
-    // since aws s3 does not allow capitalized buckets, these may be
-    // used for special internal purposes
-    permittedCapitalizedBuckets: {
-        METADATA: true,
-    },
-    // Default expiration value of the S3 pre-signed URL duration
-    // 604800 seconds (seven days).
-    defaultPreSignedURLExpiry: 7 * 24 * 60 * 60,
-    // Regex for ISO-8601 formatted date
-    shortIso8601Regex: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z/,
-    longIso8601Regex: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z/,
-    supportedNotificationEvents: new Set([
-        's3:ObjectCreated:*',
-        's3:ObjectCreated:Put',
-        's3:ObjectCreated:Copy',
-        's3:ObjectCreated:CompleteMultipartUpload',
-        's3:ObjectRemoved:*',
-        's3:ObjectRemoved:Delete',
-        's3:ObjectRemoved:DeleteMarkerCreated',
-    ]),
-    notificationArnPrefix: 'arn:scality:bucketnotif',
-    // HTTP server keep-alive timeout is set to a higher value than
-    // client's free sockets timeout to avoid the risk of triggering
-    // ECONNRESET errors if the server closes the connection at the
-    // exact moment clients attempt to reuse an established connection
-    // for a new request.
-    //
-    // Note: the ability to close inactive connections on the client
-    // after httpClientFreeSocketsTimeout milliseconds requires the
-    // use of "agentkeepalive" module instead of the regular node.js
-    // http.Agent.
-    httpServerKeepAliveTimeout: 60000,
-    httpClientFreeSocketTimeout: 55000,
-    supportedLifecycleRules: [
-        'expiration',
-        'noncurrentVersionExpiration',
-        'abortIncompleteMultipartUpload',
-    ],
-};

lib/constants.ts

@@ -0,0 +1,104 @@
+// The min value here is to manage further backward compat if we
+// need it
+const iamSecurityTokenSizeMin = 128;
+const iamSecurityTokenSizeMax = 128;
+// Security token is an hex string (no real format from amazon)
+const iamSecurityTokenPattern = new RegExp(
+    `^[a-f0-9]{${iamSecurityTokenSizeMin},${iamSecurityTokenSizeMax}}$`,
+);
+
+// info about the iam security token
+export const iamSecurityToken = {
+    min: iamSecurityTokenSizeMin,
+    max: iamSecurityTokenSizeMax,
+    pattern: iamSecurityTokenPattern,
+};
+// PublicId is used as the canonicalID for a request that contains
+// no authentication information.  Requestor can access
+// only public resources
+export const publicId = 'http://acs.amazonaws.com/groups/global/AllUsers';
+export const zenkoServiceAccount = 'http://acs.zenko.io/accounts/service';
+export const metadataFileNamespace = '/MDFile';
+export const dataFileURL = '/DataFile';
+// AWS states max size for user-defined metadata
+// (x-amz-meta- headers) is 2 KB:
+// http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html
+// In testing, AWS seems to allow up to 88 more bytes,
+// so we do the same.
+export const maximumMetaHeadersSize = 2136;
+export const emptyFileMd5 = 'd41d8cd98f00b204e9800998ecf8427e';
+// Version 2 changes the format of the data location property
+// Version 3 adds the dataStoreName attribute
+export const mdModelVersion = 3;
+/*
+ * Splitter is used to build the object name for the overview of a
+ * multipart upload and to build the object names for each part of a
+ * multipart upload.  These objects with large names are then stored in
+ * metadata in a "shadow bucket" to a real bucket.  The shadow bucket
+ * contains all ongoing multipart uploads.  We include in the object
+ * name some of the info we might need to pull about an open multipart
+ * upload or about an individual part with each piece of info separated
+ * by the splitter.  We can then extract each piece of info by splitting
+ * the object name string with this splitter.
+ * For instance, assuming a splitter of '...!*!',
+ * the name of the upload overview would be:
+ *   overview...!*!objectKey...!*!uploadId
+ * For instance, the name of a part would be:
+ *   uploadId...!*!partNumber
+ *
+ * The sequence of characters used in the splitter should not occur
+ * elsewhere in the pieces of info to avoid splitting where not
+ * intended.
+ *
+ * Splitter is also used in adding bucketnames to the
+ * namespacerusersbucket.  The object names added to the
+ * namespaceusersbucket are of the form:
+ * canonicalID...!*!bucketname
+ */
+
+export const splitter = '..|..';
+export const usersBucket = 'users..bucket';
+// MPU Bucket Prefix is used to create the name of the shadow
+// bucket used for multipart uploads.  There is one shadow mpu
+// bucket per bucket and its name is the mpuBucketPrefix followed
+// by the name of the final destination bucket for the object
+// once the multipart upload is complete.
+export const mpuBucketPrefix = 'mpuShadowBucket';
+// since aws s3 does not allow capitalized buckets, these may be
+// used for special internal purposes
+export const permittedCapitalizedBuckets = {
+    METADATA: true,
+};
+// Default expiration value of the S3 pre-signed URL duration
+// 604800 seconds (seven days).
+export const defaultPreSignedURLExpiry = 7 * 24 * 60 * 60;
+// Regex for ISO-8601 formatted date
+export const shortIso8601Regex = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z/;
+export const longIso8601Regex = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z/;
+export const supportedNotificationEvents = new Set([
+    's3:ObjectCreated:*',
+    's3:ObjectCreated:Put',
+    's3:ObjectCreated:Copy',
+    's3:ObjectCreated:CompleteMultipartUpload',
+    's3:ObjectRemoved:*',
+    's3:ObjectRemoved:Delete',
+    's3:ObjectRemoved:DeleteMarkerCreated',
+]);
+export const notificationArnPrefix = 'arn:scality:bucketnotif';
+// HTTP server keep-alive timeout is set to a higher value than
+// client's free sockets timeout to avoid the risk of triggering
+// ECONNRESET errors if the server closes the connection at the
+// exact moment clients attempt to reuse an established connection
+// for a new request.
+//
+// Note: the ability to close inactive connections on the client
+// after httpClientFreeSocketsTimeout milliseconds requires the
+// use of "agentkeepalive" module instead of the regular node.js
+// http.Agent.
+export const httpServerKeepAliveTimeout = 60000;
+export const httpClientFreeSocketTimeout = 55000;
+export const supportedLifecycleRules = [
+    'expiration',
+    'noncurrentVersionExpiration',
+    'abortIncompleteMultipartUpload',
+];

lib/db.js

@@ -64,12 +64,12 @@ class IndexTransaction {
     push(op) {
         if (this.closed) {
             throw propError('pushOnCommittedTransaction',
-                            'can not add ops to already committed transaction');
+                'can not add ops to already committed transaction');
         }
 
         if (op.type !== 'put' && op.type !== 'del') {
             throw propError('invalidTransactionVerb',
-                            `unknown action type: ${op.type}`);
+                `unknown action type: ${op.type}`);
         }
 
         if (op.key === undefined) {
@@ -137,7 +137,7 @@ class IndexTransaction {
     addCondition(condition) {
         if (this.closed) {
             throw propError('pushOnCommittedTransaction',
-                            'can not add conditions to already committed transaction');
+                'can not add conditions to already committed transaction');
         }
         if (condition === undefined || Object.keys(condition).length === 0) {
             throw propError('missingCondition', 'missing condition for conditional put');
@@ -159,12 +159,12 @@ class IndexTransaction {
     commit(cb) {
         if (this.closed) {
             return cb(propError('alreadyCommitted',
-                                'transaction was already committed'));
+                'transaction was already committed'));
         }
 
         if (this.operations.length === 0) {
             return cb(propError('emptyTransaction',
-                                'tried to commit an empty transaction'));
+                'tried to commit an empty transaction'));
         }
 
         this.closed = true;

lib/errors.js

@@ -1,87 +0,0 @@
-'use strict'; // eslint-disable-line strict
-
-/**
- * ArsenalError
- *
- * @extends {Error}
- */
-class ArsenalError extends Error {
-    /**
-     * constructor.
-     *
-     * @param {string} type - Type of error or message
-     * @param {number} code - HTTP status code
-     * @param {string} desc - Verbose description of error
-     */
-    constructor(type, code, desc) {
-        super(type);
-
-        /**
-         * HTTP status code of error
-         * @type {number}
-         */
-        this.code = code;
-
-        /**
-         * Description of error
-         * @type {string}
-         */
-        this.description = desc;
-
-        this[type] = true;
-    }
-
-    /**
-     * Output the error as a JSON string
-     * @returns {string} Error as JSON string
-     */
-    toString() {
-        return JSON.stringify({
-            errorType: this.message,
-            errorMessage: this.description,
-        });
-    }
-
-    /**
-     * Write the error in an HTTP response
-     *
-     * @param { http.ServerResponse } res - Response we are responding to
-     * @returns {undefined}
-     */
-    writeResponse(res) {
-        res.writeHead(this.code);
-        res.end(this.toString());
-    }
-
-    /**
-     * customizeDescription returns a new ArsenalError with a new description
-     * with the same HTTP code and message.
-     *
-     * @param {string} description - New error description
-     * @returns {ArsenalError} New error
-     */
-    customizeDescription(description) {
-        return new ArsenalError(this.message, this.code, description);
-    }
-}
-
-/**
- * Generate an Errors instances object.
- *
- * @returns {Object.<string, ArsenalError>} - object field by arsenalError
- *                                            instances
- */
-function errorsGen() {
-    const errors = {};
-    const errorsObj = require('../errors/arsenalErrors.json');
-
-    Object.keys(errorsObj)
-          .filter(index => index !== '_comment')
-          .forEach(index => {
-              errors[index] = new ArsenalError(index, errorsObj[index].code,
-                                               errorsObj[index].description);
-          });
-    return errors;
-}
-
-module.exports = errorsGen();

lib/errors/index.ts

@@ -0,0 +1,99 @@
+import type { ServerResponse } from 'http';
+import * as rawErrors from './arsenalErrors';
+
+/** All possible errors names. */
+export type Name = keyof typeof rawErrors
+/** Object containing all errors names. It has the format { [Name]: "Name" } */
+export type Names = { [Name_ in Name]: Name_ };
+/** Mapping used to determine an error type. It has the format { [Name]: boolean } */
+export type Is = { [_ in Name]: boolean };
+/** Mapping of all possible Errors. It has the format { [Name]: Error } */
+export type Errors = { [_ in Name]: ArsenalError };
+
+// This contains some metaprog. Be careful.
+// Proxy can be found on MDN.
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy
+// While this could seems better to avoid metaprog, this allows us to enforce
+// type-checking properly while avoiding all errors that could happen at runtime.
+const createIs = (type: Name) => {
+    const get = (_: {}, value: string | symbol) => type === value;
+    return new Proxy({}, { get }) as Is;
+};
+
+export class ArsenalError extends Error {
+    /** HTTP status code. Example: 401, 403, 500, ... */
+    #code: number;
+    /** Text description of the error. */
+    #description: string;
+    /** Type of the error. */
+    #type: Name;
+    /** Object used to determine the error type.
+     * Example: error.is.InternalError */
+    #is: Is;
+
+    private constructor(type: Name, code: number, description: string) {
+        super(type);
+        this.#code = code;
+        this.#description = description;
+        this.#type = type;
+        this.#is = createIs(type);
+    }
+
+    /** Output the error as a JSON string */
+    toString() {
+        const errorType = this.message;
+        const errorMessage = this.#description;
+        return JSON.stringify({ errorType, errorMessage });
+    }
+
+    /** Write the error in an HTTP response */
+    writeResponse(res: ServerResponse) {
+        res.writeHead(this.#code);
+        const asStr = this.toString();
+        res.end(asStr);
+    }
+
+    /** Clone the error with a new description.*/
+    customizeDescription(description: string): ArsenalError {
+        const type = this.#type;
+        const code = this.#code;
+        return new ArsenalError(type, code, description);
+    }
+
+    /** Used to determine the error type. Example: error.is.InternalError */
+    get is() {
+        return this.#is;
+    }
+
+    /** HTTP status code. Example: 401, 403, 500, ... */
+    get code() {
+        return this.#code;
+    }
+
+    /** Text description of the error. */
+    get description() {
+        return this.#description;
+    }
+
+    /**
+     * Type of the error, belonging to Name. is should be prefered instead of
+     * type in a daily-basis, but type remains accessible for future use. */
+    get type() {
+        return this.#type;
+    }
+
+    /** Generate all possible errors. An instance is created by default. */
+    static errors() {
+        return Object.entries(rawErrors).reduce((acc, value) => {
+            const name = value[0] as Name;
+            const error = value[1];
+            const { code, description } = error;
+            const err = new ArsenalError(name, code, description);
+            return { ...acc, [name]: err };
+        }, {} as Errors);
+    }
+}
+
+/** Mapping of all possible Errors.
+ * Use them with errors[error].customizeDescription for any customization. */
+export default ArsenalError.errors();

lib/executables/pensieveCreds/tests/unit/utilsSpec.js

@@ -17,9 +17,9 @@ describe('decyrptSecret', () => {
 describe('parseServiceCredentials', () => {
     const conf = {
         users: [{ accessKey,
-        accountType: 'service-clueso',
-        secretKey,
-        userName: 'Search Service Account' }],
+            accountType: 'service-clueso',
+            secretKey,
+            userName: 'Search Service Account' }],
     };
     const auth = JSON.stringify({ privateKey });
 

lib/jsutil.js

@@ -25,7 +25,7 @@ module.exports.once = function once(func) {
             state.res = func.apply(func, args);
         } else {
             debug('function already called:', func,
-                  'returning cached result:', state.res);
+                'returning cached result:', state.res);
         }
         return state.res;
     };

lib/metrics/RedisClient.js

@@ -17,7 +17,7 @@ class RedisClient {
                 method: 'RedisClient.constructor',
                 redisHost: config.host,
                 redisPort: config.port,
-            })
+            }),
         );
         return this;
     }

lib/metrics/StatsModel.js

@@ -1,5 +1,5 @@
 const StatsClient = require('./StatsClient');
- /**
+/**
  * @class StatsModel
  *
  * @classdesc Extend and overwrite how timestamps are normalized by minutes

lib/metrics/ZenkoMetrics.js

@@ -2,8 +2,8 @@ const promClient = require('prom-client');
 
 const collectDefaultMetricsIntervalMs =
       process.env.COLLECT_DEFAULT_METRICS_INTERVAL_MS !== undefined ?
-      Number.parseInt(process.env.COLLECT_DEFAULT_METRICS_INTERVAL_MS, 10) :
-      10000;
+          Number.parseInt(process.env.COLLECT_DEFAULT_METRICS_INTERVAL_MS, 10) :
+          10000;
 
 promClient.collectDefaultMetrics({ timeout: collectDefaultMetricsIntervalMs });
 

lib/models/ARN.js

@@ -1,4 +1,4 @@
-const errors = require('../errors');
+const errors = require('../errors').default;
 
 const validServices = {
     aws: ['s3', 'iam', 'sts', 'ring'],
@@ -27,7 +27,7 @@ class ARN {
 
     static createFromString(arnStr) {
         const [arn, partition, service, region, accountId,
-               resourceType, resource] = arnStr.split(':');
+            resourceType, resource] = arnStr.split(':');
 
         if (arn !== 'arn') {
             return { error: errors.InvalidArgument.customizeDescription(
@@ -58,7 +58,7 @@ class ARN {
                     'must be a 12-digit number or "*"') };
         }
         const fullResource = (resource !== undefined ?
-                              `${resourceType}:${resource}` : resourceType);
+            `${resourceType}:${resource}` : resourceType);
         return new ARN(partition, service, region, accountId, fullResource);
     }
 
@@ -98,7 +98,7 @@ class ARN {
 
     toString() {
         return ['arn', this.getPartition(), this.getService(),
-                this.getRegion(), this.getAccountId(), this.getResource()]
+            this.getRegion(), this.getAccountId(), this.getResource()]
             .join(':');
     }
 }

lib/models/BucketInfo.js

@@ -62,12 +62,12 @@ class BucketInfo {
     * @param {object} [notificationConfiguration] - bucket notification configuration
     */
     constructor(name, owner, ownerDisplayName, creationDate,
-                mdBucketModelVersion, acl, transient, deleted,
-                serverSideEncryption, versioningConfiguration,
-                locationConstraint, websiteConfiguration, cors,
-                replicationConfiguration, lifecycleConfiguration,
-                bucketPolicy, uid, objectLockEnabled, objectLockConfiguration,
-                notificationConfiguration) {
+        mdBucketModelVersion, acl, transient, deleted,
+        serverSideEncryption, versioningConfiguration,
+        locationConstraint, websiteConfiguration, cors,
+        replicationConfiguration, lifecycleConfiguration,
+        bucketPolicy, uid, objectLockEnabled,
+        objectLockConfiguration, notificationConfiguration) {
         assert.strictEqual(typeof name, 'string');
         assert.strictEqual(typeof owner, 'string');
         assert.strictEqual(typeof ownerDisplayName, 'string');
@@ -86,7 +86,7 @@ class BucketInfo {
         if (serverSideEncryption) {
             assert.strictEqual(typeof serverSideEncryption, 'object');
             const { cryptoScheme, algorithm, masterKeyId,
-                    configuredMasterKeyId, mandatory } = serverSideEncryption;
+                configuredMasterKeyId, mandatory } = serverSideEncryption;
             assert.strictEqual(typeof cryptoScheme, 'number');
             assert.strictEqual(typeof algorithm, 'string');
             assert.strictEqual(typeof masterKeyId, 'string');

lib/models/BucketPolicy.js

@@ -1,6 +1,6 @@
 const assert = require('assert');
 
-const errors = require('../errors');
+const errors = require('../errors').default;
 const { validateResourcePolicy } = require('../policy/policyValidator');
 
 /**

lib/models/LifecycleConfiguration.js

@@ -1,7 +1,7 @@
 const assert = require('assert');
 const UUID = require('uuid');
 
-const errors = require('../errors');
+const errors = require('../errors').default;
 const LifecycleRule = require('./LifecycleRule');
 const escapeForXml = require('../s3middleware/escapeForXml');
 
@@ -375,7 +375,7 @@ class LifecycleConfiguration {
             if (!tags[i].Key || !tags[i].Value) {
                 tagObj.error =
                     errors.MissingRequiredParameter.customizeDescription(
-                    'Tag XML does not contain both Key and Value');
+                        'Tag XML does not contain both Key and Value');
                 break;
             }
 
@@ -611,7 +611,7 @@ class LifecycleConfiguration {
             const daysInt = parseInt(subExp.Days[0], 10);
             if (daysInt < 1) {
                 expObj.error = errors.InvalidArgument.customizeDescription(
-                   'Expiration days is not a positive integer');
+                    'Expiration days is not a positive integer');
             } else {
                 expObj.days = daysInt;
             }

lib/models/NotificationConfiguration.js

@@ -5,7 +5,7 @@ const {
     supportedNotificationEvents,
     notificationArnPrefix,
 } = require('../constants');
-const errors = require('../errors');
+const errors = require('../errors').default;
 
 /**
  * Format of xml request:
@@ -27,7 +27,7 @@ const errors = require('../errors');
  * </NotificationConfiguration>
  */
 
- /**
+/**
   * Format of config:
   *
   * config = {

lib/models/ObjectLockConfiguration.js

@@ -1,6 +1,6 @@
 const assert = require('assert');
 
-const errors = require('../errors');
+const errors = require('../errors').default;
 
 /**
  * Format of xml request:
@@ -17,7 +17,7 @@ const errors = require('../errors');
  * </ObjectLockConfiguration>
  */
 
- /**
+/**
   * Format of config:
   *
   * config = {

lib/models/ObjectMD.js

@@ -8,7 +8,6 @@ const ObjectMDLocation = require('./ObjectMDLocation');
  * mpuPart metadata for example)
  */
 class ObjectMD {
-
     /**
      * Create a new instance of ObjectMD. Parameter <tt>objMd</tt> is
      * reserved for internal use, users should call
@@ -138,7 +137,7 @@ class ObjectMD {
 
         Object.assign(this._data, objMd._data);
         Object.assign(this._data.replicationInfo,
-                      objMd._data.replicationInfo);
+            objMd._data.replicationInfo);
     }
 
     _updateFromParsedJSON(objMd) {

lib/models/ObjectMDLocation.js

@@ -3,7 +3,6 @@
  * 'location' array
  */
 class ObjectMDLocation {
-
     /**
      * @constructor
      * @param {object} locationObj - single data location info

lib/models/ReplicationConfiguration.js

@@ -2,7 +2,7 @@ const assert = require('assert');
 const UUID = require('uuid');
 
 const escapeForXml = require('../s3middleware/escapeForXml');
-const errors = require('../errors');
+const errors = require('../errors').default;
 const { isValidBucketName } = require('../s3routes/routesUtils');
 
 const MAX_RULES = 1000;

lib/network/RoundRobin.js

@@ -111,7 +111,7 @@ class RoundRobin {
     pickHost() {
         if (this.logger) {
             this.logger.debug('pick host',
-                              { host: this.getCurrentHost() });
+                { host: this.getCurrentHost() });
         }
         const curHost = this.getCurrentHost();
         ++this.pickCount;
@@ -163,7 +163,7 @@ class RoundRobin {
         }
         if (this.logger) {
             this.logger.debug('round robin host',
-                              { newHost: this.getCurrentHost() });
+                { newHost: this.getCurrentHost() });
         }
     }
 }

lib/network/http/server.js

@@ -5,12 +5,11 @@ const https = require('https');
 const assert = require('assert');
 const dhparam = require('../../https/dh2048').dhparam;
 const ciphers = require('../../https/ciphers').ciphers;
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const { checkSupportIPv6 } = require('./utils');
 
 
 class Server {
-
     /**
      * @constructor
      *
@@ -429,16 +428,16 @@ class Server {
                 // Setting no delay of the socket to the value configured
                 sock.setNoDelay(this.isNoDelay());
                 sock.on('error', err => this._logger.info(
-                 'socket error - request rejected', { error: err }));
+                    'socket error - request rejected', { error: err }));
             });
             this._server.on('tlsClientError', (err, sock) =>
-                    this._onClientError(err, sock));
+                this._onClientError(err, sock));
             this._server.on('clientError', (err, sock) =>
-                    this._onClientError(err, sock));
+                this._onClientError(err, sock));
             this._server.on('checkContinue', (req, res) =>
-                    this._onCheckContinue(req, res));
+                this._onCheckContinue(req, res));
             this._server.on('checkExpectation', (req, res) =>
-                    this._onCheckExpectation(req, res));
+                this._onCheckExpectation(req, res));
             this._server.on('listening', () => this._onListening());
         }
         this._server.listen(this._port, this._address);

lib/network/http/utils.js

@@ -1,7 +1,7 @@
 'use strict'; // eslint-disable-line
 
 const os = require('os');
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 
 /**
  * Parse the Range header into an object
@@ -72,8 +72,8 @@ function getByteRangeFromSpec(rangeSpec, objectSize) {
     if (rangeSpec.start < objectSize) {
         // test is false if end is undefined
         return { range: [rangeSpec.start,
-                         (rangeSpec.end < objectSize ?
-                          rangeSpec.end : objectSize - 1)] };
+            (rangeSpec.end < objectSize ?
+                rangeSpec.end : objectSize - 1)] };
     }
     return { error: errors.InvalidRange };
 }

lib/network/kmip/Client.js

@@ -3,7 +3,7 @@
 
 const async = require('async');
 
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const TTLVCodec = require('./codec/ttlv.js');
 const TlsTransport = require('./transport/tls.js');
 const KMIP = require('.');
@@ -55,7 +55,12 @@ function _arsenalError(err) {
     if (typeof err === 'string') {
         return errors.InternalError
             .customizeDescription(`${messagePrefix} ${err}`);
-    } else if (err instanceof Error) {
+    } else if (
+        err instanceof Error ||
+        // INFO: The second part is here only for Jest, to remove when we'll be
+        //   fully migrated to TS
+        (err && typeof err.message === 'string')
+    ) {
         return errors.InternalError
             .customizeDescription(`${messagePrefix} ${err.message}`);
     }
@@ -90,8 +95,8 @@ function _negotiateProtocolVersion(client, logger, cb) {
         if (err) {
             const error = _arsenalError(err);
             logger.error('KMIP::negotiateProtocolVersion',
-                         { error,
-                           vendorIdentification: client.vendorIdentification });
+                { error,
+                    vendorIdentification: client.vendorIdentification });
             return cb(error);
         }
         const majorVersions =
@@ -102,8 +107,8 @@ function _negotiateProtocolVersion(client, logger, cb) {
             majorVersions.length !== minorVersions.length) {
             const error = _arsenalError('No suitable protocol version');
             logger.error('KMIP::negotiateProtocolVersion',
-                         { error,
-                           vendorIdentification: client.vendorIdentification });
+                { error,
+                    vendorIdentification: client.vendorIdentification });
             return cb(error);
         }
         client.kmip.changeProtocolVersion(majorVersions[0], minorVersions[0]);
@@ -126,8 +131,8 @@ function _mapExtensions(client, logger, cb) {
         if (err) {
             const error = _arsenalError(err);
             logger.error('KMIP::mapExtensions',
-                         { error,
-                           vendorIdentification: client.vendorIdentification });
+                { error,
+                    vendorIdentification: client.vendorIdentification });
             return cb(error);
         }
         const extensionNames = response.lookup(searchFilter.extensionName);
@@ -135,8 +140,8 @@ function _mapExtensions(client, logger, cb) {
         if (extensionNames.length !== extensionTags.length) {
             const error = _arsenalError('Inconsistent extension list');
             logger.error('KMIP::mapExtensions',
-                         { error,
-                           vendorIdentification: client.vendorIdentification });
+                { error,
+                    vendorIdentification: client.vendorIdentification });
             return cb(error);
         }
         extensionNames.forEach((extensionName, idx) => {
@@ -160,7 +165,7 @@ function _queryServerInformation(client, logger, cb) {
         if (err) {
             const error = _arsenalError(err);
             logger.warn('KMIP::queryServerInformation',
-                        { error });
+                { error });
             /* no error returned, caller can keep going */
             return cb();
         }
@@ -170,9 +175,9 @@ function _queryServerInformation(client, logger, cb) {
             JSON.stringify(response.lookup(searchFilter.serverInformation)[0]));
 
         logger.info('KMIP Server identified',
-                    { vendorIdentification: client.vendorIdentification,
-                      serverInformation: client.serverInformation,
-                      negotiatedProtocolVersion: client.kmip.protocolVersion });
+            { vendorIdentification: client.vendorIdentification,
+                serverInformation: client.serverInformation,
+                negotiatedProtocolVersion: client.kmip.protocolVersion });
         return cb();
     });
 }
@@ -196,8 +201,8 @@ function _queryOperationsAndObjects(client, logger, cb) {
         if (err) {
             const error = _arsenalError(err);
             logger.error('KMIP::queryOperationsAndObjects',
-                         { error,
-                           vendorIdentification: client.vendorIdentification });
+                { error,
+                    vendorIdentification: client.vendorIdentification });
             return cb(error);
         }
         const supportedOperations = response.lookup(searchFilter.operation);
@@ -222,15 +227,15 @@ function _queryOperationsAndObjects(client, logger, cb) {
             logger.warn('KMIP::queryOperationsAndObjects: ' +
                         'The KMIP Server announces that it ' +
                         'does not support all of the required features',
-                        { vendorIdentification: client.vendorIdentification,
-                          serverInformation: client.serverInformation,
-                          supportsEncrypt, supportsDecrypt,
-                          supportsActivate, supportsRevoke,
-                          supportsCreate, supportsDestroy,
-                          supportsQuery, supportsSymmetricKeys });
+            { vendorIdentification: client.vendorIdentification,
+                serverInformation: client.serverInformation,
+                supportsEncrypt, supportsDecrypt,
+                supportsActivate, supportsRevoke,
+                supportsCreate, supportsDestroy,
+                supportsQuery, supportsSymmetricKeys });
         } else {
             logger.info('KMIP Server provides the necessary feature set',
-                        { vendorIdentification: client.vendorIdentification });
+                { vendorIdentification: client.vendorIdentification });
         }
         return cb();
     });
@@ -264,8 +269,8 @@ class Client {
         this.vendorIdentification = '';
         this.serverInformation = [];
         this.kmip = new KMIP(CodecClass || TTLVCodec,
-                             TransportClass || TlsTransport,
-                             options);
+            TransportClass || TlsTransport,
+            options);
         this.kmip.registerHandshakeFunction((logger, cb) => {
             this._kmipHandshake(logger, cb);
         });
@@ -322,8 +327,8 @@ class Client {
             if (err) {
                 const error = _arsenalError(err);
                 logger.error('KMIP::_activateBucketKey',
-                             { error,
-                               serverInformation: this.serverInformation });
+                    { error,
+                        serverInformation: this.serverInformation });
                 return cb(error);
             }
             const uniqueIdentifier =
@@ -332,7 +337,7 @@ class Client {
                 const error = _arsenalError(
                     'Server did not return the expected identifier');
                 logger.error('KMIP::cipherDataKey',
-                             { error, uniqueIdentifier });
+                    { error, uniqueIdentifier });
                 return cb(error);
             }
             return cb(null, keyIdentifier);
@@ -351,20 +356,20 @@ class Client {
         const attributes = [];
         if (!!this.options.bucketNameAttributeName) {
             attributes.push(KMIP.Attribute('TextString',
-                                           this.options.bucketNameAttributeName,
-                                           bucketName));
+                this.options.bucketNameAttributeName,
+                bucketName));
         }
         attributes.push(...[
             KMIP.Attribute('Enumeration', 'Cryptographic Algorithm',
-                           CRYPTOGRAPHIC_ALGORITHM),
+                CRYPTOGRAPHIC_ALGORITHM),
             KMIP.Attribute('Integer', 'Cryptographic Length',
-                           CRYPTOGRAPHIC_LENGTH),
+                CRYPTOGRAPHIC_LENGTH),
             KMIP.Attribute('Integer', 'Cryptographic Usage Mask',
-                           this.kmip.encodeMask('Cryptographic Usage Mask',
-                                                CRYPTOGRAPHIC_USAGE_MASK))]);
+                this.kmip.encodeMask('Cryptographic Usage Mask',
+                    CRYPTOGRAPHIC_USAGE_MASK))]);
         if (this.options.compoundCreateActivate) {
             attributes.push(KMIP.Attribute('Date-Time', 'Activation Date',
-                                           new Date(Date.UTC())));
+                new Date(Date.UTC())));
         }
 
         return this.kmip.request(logger, 'Create', [
@@ -374,8 +379,8 @@ class Client {
             if (err) {
                 const error = _arsenalError(err);
                 logger.error('KMIP::createBucketKey',
-                             { error,
-                               serverInformation: this.serverInformation });
+                    { error,
+                        serverInformation: this.serverInformation });
                 return cb(error);
             }
             const createdObjectType =
@@ -386,7 +391,7 @@ class Client {
                 const error = _arsenalError(
                     'Server created an object of wrong type');
                 logger.error('KMIP::createBucketKey',
-                             { error, createdObjectType });
+                    { error, createdObjectType });
                 return cb(error);
             }
             if (!this.options.compoundCreateActivate) {
@@ -411,16 +416,16 @@ class Client {
             KMIP.TextString('Unique Identifier', bucketKeyId),
             KMIP.Structure('Revocation Reason', [
                 KMIP.Enumeration('Revocation Reason Code',
-                                 'Cessation of Operation'),
+                    'Cessation of Operation'),
                 KMIP.TextString('Revocation Message',
-                                'About to be deleted'),
+                    'About to be deleted'),
             ]),
         ], (err, response) => {
             if (err) {
                 const error = _arsenalError(err);
                 logger.error('KMIP::_revokeBucketKey',
-                             { error,
-                               serverInformation: this.serverInformation });
+                    { error,
+                        serverInformation: this.serverInformation });
                 return cb(error);
             }
             const uniqueIdentifier =
@@ -429,7 +434,7 @@ class Client {
                 const error = _arsenalError(
                     'Server did not return the expected identifier');
                 logger.error('KMIP::_revokeBucketKey',
-                             { error, uniqueIdentifier });
+                    { error, uniqueIdentifier });
                 return cb(error);
             }
             return cb();
@@ -448,8 +453,8 @@ class Client {
             if (err) {
                 const error = _arsenalError(err);
                 logger.error('KMIP::destroyBucketKey: revocation failed',
-                             { error,
-                               serverInformation: this.serverInformation });
+                    { error,
+                        serverInformation: this.serverInformation });
                 return cb(error);
             }
             return this.kmip.request(logger, 'Destroy', [
@@ -458,8 +463,8 @@ class Client {
                 if (err) {
                     const error = _arsenalError(err);
                     logger.error('KMIP::destroyBucketKey',
-                                 { error,
-                                   serverInformation: this.serverInformation });
+                        { error,
+                            serverInformation: this.serverInformation });
                     return cb(error);
                 }
                 const uniqueIdentifier =
@@ -468,7 +473,7 @@ class Client {
                     const error = _arsenalError(
                         'Server did not return the expected identifier');
                     logger.error('KMIP::destroyBucketKey',
-                                 { error, uniqueIdentifier });
+                        { error, uniqueIdentifier });
                     return cb(error);
                 }
                 return cb();
@@ -487,19 +492,19 @@ class Client {
      * @callback called with (err, cipheredDataKey: Buffer)
      */
     cipherDataKey(cryptoScheme,
-                  masterKeyId,
-                  plainTextDataKey,
-                  logger,
-                  cb) {
+        masterKeyId,
+        plainTextDataKey,
+        logger,
+        cb) {
         return this.kmip.request(logger, 'Encrypt', [
             KMIP.TextString('Unique Identifier', masterKeyId),
             KMIP.Structure('Cryptographic Parameters', [
                 KMIP.Enumeration('Block Cipher Mode',
-                                CRYPTOGRAPHIC_CIPHER_MODE),
+                    CRYPTOGRAPHIC_CIPHER_MODE),
                 KMIP.Enumeration('Padding Method',
-                                CRYPTOGRAPHIC_PADDING_METHOD),
+                    CRYPTOGRAPHIC_PADDING_METHOD),
                 KMIP.Enumeration('Cryptographic Algorithm',
-                               CRYPTOGRAPHIC_ALGORITHM),
+                    CRYPTOGRAPHIC_ALGORITHM),
             ]),
             KMIP.ByteString('Data', plainTextDataKey),
             KMIP.ByteString('IV/Counter/Nonce', CRYPTOGRAPHIC_DEFAULT_IV),
@@ -507,8 +512,8 @@ class Client {
             if (err) {
                 const error = _arsenalError(err);
                 logger.error('KMIP::cipherDataKey',
-                             { error,
-                               serverInformation: this.serverInformation });
+                    { error,
+                        serverInformation: this.serverInformation });
                 return cb(error);
             }
             const uniqueIdentifier =
@@ -518,7 +523,7 @@ class Client {
                 const error = _arsenalError(
                     'Server did not return the expected identifier');
                 logger.error('KMIP::cipherDataKey',
-                             { error, uniqueIdentifier });
+                    { error, uniqueIdentifier });
                 return cb(error);
             }
             return cb(null, data);
@@ -536,19 +541,19 @@ class Client {
      * @callback called with (err, plainTextDataKey: Buffer)
      */
     decipherDataKey(cryptoScheme,
-                    masterKeyId,
-                    cipheredDataKey,
-                    logger,
-                    cb) {
+        masterKeyId,
+        cipheredDataKey,
+        logger,
+        cb) {
         return this.kmip.request(logger, 'Decrypt', [
             KMIP.TextString('Unique Identifier', masterKeyId),
             KMIP.Structure('Cryptographic Parameters', [
                 KMIP.Enumeration('Block Cipher Mode',
-                                CRYPTOGRAPHIC_CIPHER_MODE),
+                    CRYPTOGRAPHIC_CIPHER_MODE),
                 KMIP.Enumeration('Padding Method',
-                                 CRYPTOGRAPHIC_PADDING_METHOD),
+                    CRYPTOGRAPHIC_PADDING_METHOD),
                 KMIP.Enumeration('Cryptographic Algorithm',
-                                 CRYPTOGRAPHIC_ALGORITHM),
+                    CRYPTOGRAPHIC_ALGORITHM),
             ]),
             KMIP.ByteString('Data', cipheredDataKey),
             KMIP.ByteString('IV/Counter/Nonce', CRYPTOGRAPHIC_DEFAULT_IV),
@@ -556,8 +561,8 @@ class Client {
             if (err) {
                 const error = _arsenalError(err);
                 logger.error('KMIP::decipherDataKey',
-                             { error,
-                               serverInformation: this.serverInformation });
+                    { error,
+                        serverInformation: this.serverInformation });
                 return cb(error);
             }
             const uniqueIdentifier =
@@ -567,7 +572,7 @@ class Client {
                 const error = _arsenalError(
                     'Server did not return the right identifier');
                 logger.error('KMIP::decipherDataKey',
-                             { error, uniqueIdentifier });
+                    { error, uniqueIdentifier });
                 return cb(error);
             }
             return cb(null, data);

lib/network/kmip/codec/ttlv.js

@@ -55,15 +55,15 @@ function TTLVCodec() {
                     const property = {};
                     if (!TypeDecoder[elementType]) {
                         _throwError(logger,
-                                    'Unknown element type',
-                                    { funcName, elementTag, elementType });
+                            'Unknown element type',
+                            { funcName, elementTag, elementType });
                     }
                     const elementValue = value.slice(i + 8,
-                                                   i + 8 + elementLength);
+                        i + 8 + elementLength);
                     if (elementValue.length !== elementLength) {
                         _throwError(logger, 'BUG: Wrong buffer size',
-                                    { funcName, elementLength,
-                                      bufferLength: elementValue.length });
+                            { funcName, elementLength,
+                                bufferLength: elementValue.length });
                     }
                     property.type = TypeDecoder[elementType].name;
                     property.value = TypeDecoder[elementType]
@@ -75,7 +75,7 @@ function TTLVCodec() {
                     const tagInfo = TagDecoder[elementTag];
                     if (!tagInfo) {
                         logger.debug('Unknown element tag',
-                                     { funcName, elementTag });
+                            { funcName, elementTag });
                         property.tag = elementTag;
                         element['Unknown Tag'] = property;
                     } else {
@@ -83,8 +83,8 @@ function TTLVCodec() {
                         if (tagInfo.name === 'Attribute Name') {
                             if (property.type !== 'TextString') {
                                 _throwError(logger,
-                                            'Invalide type',
-                                            { funcName, type: property.type });
+                                    'Invalide type',
+                                    { funcName, type: property.type });
                             }
                             diversion = property.value;
                         }
@@ -114,8 +114,8 @@ function TTLVCodec() {
                         }
                         const itemResult =
                               TypeEncoder[itemType].encode(itemTagName,
-                                                           itemValue,
-                                                           itemDiversion);
+                                  itemValue,
+                                  itemDiversion);
                         encodedValue = encodedValue
                             .concat(_ttlvPadVector(itemResult));
                     });
@@ -133,9 +133,9 @@ function TTLVCodec() {
                 const fixedLength = 4;
                 if (fixedLength !== value.length) {
                     _throwError(logger,
-                                'Length mismatch',
-                                { funcName, fixedLength,
-                                  bufferLength: value.length });
+                        'Length mismatch',
+                        { funcName, fixedLength,
+                            bufferLength: value.length });
                 }
                 return value.readUInt32BE(0);
             },
@@ -156,16 +156,16 @@ function TTLVCodec() {
                 const fixedLength = 8;
                 if (fixedLength !== value.length) {
                     _throwError(logger,
-                                'Length mismatch',
-                                { funcName, fixedLength,
-                                  bufferLength: value.length });
+                        'Length mismatch',
+                        { funcName, fixedLength,
+                            bufferLength: value.length });
                 }
                 const longUInt = UINT32_MAX * value.readUInt32BE(0) +
                       value.readUInt32BE(4);
                 if (longUInt > Number.MAX_SAFE_INTEGER) {
                     _throwError(logger,
-                                '53-bit overflow',
-                                { funcName, longUInt });
+                        '53-bit overflow',
+                        { funcName, longUInt });
                 }
                 return longUInt;
             },
@@ -200,9 +200,9 @@ function TTLVCodec() {
                 const fixedLength = 4;
                 if (fixedLength !== value.length) {
                     _throwError(logger,
-                                'Length mismatch',
-                                { funcName, fixedLength,
-                                  bufferLength: value.length });
+                        'Length mismatch',
+                        { funcName, fixedLength,
+                            bufferLength: value.length });
                 }
                 const enumValue = value.toString('hex');
                 const actualTag = diversion ? TagEncoder[diversion].value : tag;
@@ -211,10 +211,10 @@ function TTLVCodec() {
                     !enumInfo.enumeration ||
                     !enumInfo.enumeration[enumValue]) {
                     return { tag,
-                             value: enumValue,
-                             message: 'Unknown enumeration value',
-                             diversion,
-                           };
+                        value: enumValue,
+                        message: 'Unknown enumeration value',
+                        diversion,
+                    };
                 }
                 return enumInfo.enumeration[enumValue];
             },
@@ -227,7 +227,7 @@ function TTLVCodec() {
                 const actualTag = diversion || tagName;
                 const encodedValue =
                       Buffer.from(TagEncoder[actualTag].enumeration[value],
-                                  'hex');
+                          'hex');
                 return _ttlvPadVector([tag, type, length, encodedValue]);
             },
         },
@@ -238,9 +238,9 @@ function TTLVCodec() {
                 const fixedLength = 8;
                 if (fixedLength !== value.length) {
                     _throwError(logger,
-                                'Length mismatch',
-                                { funcName, fixedLength,
-                                  bufferLength: value.length });
+                        'Length mismatch',
+                        { funcName, fixedLength,
+                            bufferLength: value.length });
                 }
                 const msUInt = value.readUInt32BE(0);
                 const lsUInt = value.readUInt32BE(4);
@@ -267,7 +267,7 @@ function TTLVCodec() {
                 const length = Buffer.alloc(4);
                 length.writeUInt32BE(value.length);
                 return _ttlvPadVector([tag, type, length,
-                               Buffer.from(value, 'utf8')]);
+                    Buffer.from(value, 'utf8')]);
             },
         },
         '08': {
@@ -289,17 +289,17 @@ function TTLVCodec() {
                 const fixedLength = 8;
                 if (fixedLength !== value.length) {
                     _throwError(logger,
-                                'Length mismatch',
-                                { funcName, fixedLength,
-                                  bufferLength: value.length });
+                        'Length mismatch',
+                        { funcName, fixedLength,
+                            bufferLength: value.length });
                 }
                 const d = new Date(0);
                 const utcSeconds = UINT32_MAX * value.readUInt32BE(0) +
                       value.readUInt32BE(4);
                 if (utcSeconds > Number.MAX_SAFE_INTEGER) {
                     _throwError(logger,
-                                '53-bit overflow',
-                                { funcName, utcSeconds });
+                        '53-bit overflow',
+                        { funcName, utcSeconds });
                 }
                 d.setUTCSeconds(utcSeconds);
                 return d;
@@ -323,9 +323,9 @@ function TTLVCodec() {
                 const fixedLength = 4;
                 if (fixedLength !== value.length) {
                     _throwError(logger,
-                                'Length mismatch',
-                                { funcName, fixedLength,
-                                  bufferLength: value.length });
+                        'Length mismatch',
+                        { funcName, fixedLength,
+                            bufferLength: value.length });
                 }
                 return value.readInt32BE(0);
             },
@@ -415,8 +415,8 @@ function TTLVCodec() {
                     throw Error(`Unknown Type '${type}'`);
                 }
                 const itemValue = TypeEncoder[type].encode(key,
-                                                        item[key].value,
-                                                        item[key].diversion);
+                    item[key].value,
+                    item[key].diversion);
                 result = result.concat(_ttlvPadVector(itemValue));
             });
         });

lib/network/kmip/index.js

@@ -275,11 +275,11 @@ class KMIP {
                 KMIP.Structure('Request Header', [
                     KMIP.Structure('Protocol Version', [
                         KMIP.Integer('Protocol Version Major',
-                                     this.protocolVersion.major),
+                            this.protocolVersion.major),
                         KMIP.Integer('Protocol Version Minor',
-                                     this.protocolVersion.minor)]),
+                            this.protocolVersion.minor)]),
                     KMIP.Integer('Maximum Response Size',
-                                 this.maximumResponseSize),
+                        this.maximumResponseSize),
                     KMIP.Integer('Batch Count', 1)]),
                 KMIP.Structure('Batch Item', [
                     KMIP.Enumeration('Operation', operation),
@@ -292,7 +292,7 @@ class KMIP {
             (err, conversation, rawResponse) => {
                 if (err) {
                     logger.error('KMIP::request: Failed to send message',
-                                 { error: err });
+                        { error: err });
                     return cb(err);
                 }
                 const response = this._decodeMessage(logger, rawResponse);
@@ -311,16 +311,16 @@ class KMIP {
                     this.transport.abortPipeline(conversation);
                     const error = Error('Invalid batch item ID returned');
                     logger.error('KMIP::request: failed',
-                                 { resultUniqueBatchItemID, uuid, error });
+                        { resultUniqueBatchItemID, uuid, error });
                     return cb(error);
                 }
                 if (performedOperation !== operation) {
                     this.transport.abortPipeline(conversation);
                     const error = Error('Operation mismatch',
-                                        { got: performedOperation,
-                                         expected: operation });
+                        { got: performedOperation,
+                            expected: operation });
                     logger.error('KMIP::request: Operation mismatch',
-                                 { error });
+                        { error });
                     return cb(error);
                 }
                 if (resultStatus !== 'Success') {
@@ -331,19 +331,17 @@ class KMIP {
                           response.lookup(
                               'Response Message/Batch Item/Result Message')[0];
                     const error = Error('KMIP request failure',
-                                        { resultStatus,
-                                          resultReason,
-                                          resultMessage });
+                        { resultStatus,
+                            resultReason,
+                            resultMessage });
                     logger.error('KMIP::request: request failed',
-                                 { error, resultStatus,
-                                   resultReason, resultMessage });
+                        { error, resultStatus,
+                            resultReason, resultMessage });
                     return cb(error);
                 }
                 return cb(null, response);
             });
     }
-
-
 }
 
 

lib/network/kmip/transport/TransportTemplate.js

@@ -86,8 +86,8 @@ class TransportTemplate {
                     const deferedRequest = this.deferedRequests.shift();
                     process.nextTick(() => {
                         this.send(logger,
-                                  deferedRequest.encodedMessage,
-                                  deferedRequest.cb);
+                            deferedRequest.encodedMessage,
+                            deferedRequest.cb);
                     });
                 } else if (this.callbackPipeline.length === 0 &&
                            this.deferedRequests.length === 0 &&

lib/network/probe/ProbeServer.js

@@ -1,6 +1,6 @@
 const httpServer = require('../http/server');
 const werelogs = require('werelogs');
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 
 const DEFAULT_LIVE_ROUTE = '/_/live';
 const DEFAULT_READY_ROUTE = '/_/live';

lib/network/rest/RESTClient.js

@@ -6,7 +6,7 @@ const werelogs = require('werelogs');
 
 const constants = require('../../constants');
 const utils = require('./utils');
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 
 const HttpAgent = require('agentkeepalive');
 

lib/network/rest/RESTServer.js

@@ -9,7 +9,7 @@ const httpServer = require('../http/server');
 const constants = require('../../constants');
 const utils = require('./utils');
 const httpUtils = require('../http/utils');
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 
 function setContentLength(response, contentLength) {
     response.setHeader('Content-Length', contentLength.toString());
@@ -19,7 +19,7 @@ function setContentRange(response, byteRange, objectSize) {
     const [start, end] = byteRange;
     assert(start !== undefined && end !== undefined);
     response.setHeader('Content-Range',
-                       `bytes ${start}-${end}/${objectSize}`);
+        `bytes ${start}-${end}/${objectSize}`);
 }
 
 function sendError(res, log, error, optMessage) {
@@ -81,7 +81,6 @@ function parseURL(urlStr, expectKey) {
  * start() to start listening to the configured port.
  */
 class RESTServer extends httpServer {
-
     /**
      * @constructor
      * @param {Object} params - constructor params
@@ -263,7 +262,7 @@ class RESTServer extends httpServer {
                     return sendError(res, log, err);
                 }
                 log.debug('sending back 200/206 response with contents',
-                          { key: pathInfo.key });
+                    { key: pathInfo.key });
                 setContentLength(res, contentLength);
                 res.setHeader('Accept-Ranges', 'bytes');
                 if (byteRange) {
@@ -301,7 +300,7 @@ class RESTServer extends httpServer {
                 return sendError(res, log, err);
             }
             log.debug('sending back 204 response to DELETE',
-                      { key: pathInfo.key });
+                { key: pathInfo.key });
             res.writeHead(204);
             return res.end(() => {
                 log.debug('DELETE response sent', { key: pathInfo.key });

lib/network/rest/utils.js

@@ -1,6 +1,6 @@
 'use strict'; // eslint-disable-line
 
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 
 module.exports.explodePath = function explodePath(path) {
     const pathMatch = /^(\/[a-zA-Z0-9]+)(\/([0-9a-f]*))?$/.exec(path);
@@ -8,7 +8,7 @@ module.exports.explodePath = function explodePath(path) {
         return {
             service: pathMatch[1],
             key: (pathMatch[3] !== undefined && pathMatch[3].length > 0 ?
-                  pathMatch[3] : undefined),
+                pathMatch[3] : undefined),
         };
     }
     throw errors.InvalidURI.customizeDescription('malformed URI');

lib/network/rpc/level-net.js

@@ -17,7 +17,6 @@ const rpc = require('./rpc.js');
  * RPC client object accessing the sub-level transparently.
  */
 class LevelDbClient extends rpc.BaseClient {
-
     /**
      * @constructor
      *
@@ -78,7 +77,6 @@ class LevelDbClient extends rpc.BaseClient {
  * env.subDb (env is passed as first parameter of received RPC calls).
  */
 class LevelDbService extends rpc.BaseService {
-
     /**
      * @constructor
      *

lib/network/rpc/rpc.js

@@ -10,7 +10,7 @@ const EventEmitter = require('events').EventEmitter;
 
 const flattenError = require('./utils').flattenError;
 const reconstructError = require('./utils').reconstructError;
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const jsutil = require('../../jsutil');
 
 const DEFAULT_CALL_TIMEOUT_MS = 30000;
@@ -37,7 +37,6 @@ let streamRPCJSONObj;
  *   an error occurred).
  */
 class BaseClient extends EventEmitter {
-
     /**
      * @constructor
      *
@@ -54,7 +53,7 @@ class BaseClient extends EventEmitter {
      */
     constructor(params) {
         const { url, logger, callTimeoutMs,
-                streamMaxPendingAck, streamAckTimeoutMs } = params;
+            streamMaxPendingAck, streamAckTimeoutMs } = params;
         assert(url);
         assert(logger);
 
@@ -82,11 +81,11 @@ class BaseClient extends EventEmitter {
     _call(remoteCall, args, cb) {
         const wrapCb = (err, data) => {
             cb(reconstructError(err),
-               this.socketStreams.decodeStreams(data));
+                this.socketStreams.decodeStreams(data));
         };
         this.logger.debug('remote call', { remoteCall, args });
         this.socket.emit('call', remoteCall,
-                         this.socketStreams.encodeStreams(args), wrapCb);
+            this.socketStreams.encodeStreams(args), wrapCb);
         return undefined;
     }
 
@@ -113,8 +112,8 @@ class BaseClient extends EventEmitter {
             throw new Error(`argument cb=${cb} is not a callback`);
         }
         async.timeout(this._call.bind(this), timeoutMs,
-                      `operation ${remoteCall} timed out`)(remoteCall,
-                                                           args, cb);
+            `operation ${remoteCall} timed out`)(remoteCall,
+            args, cb);
         return undefined;
     }
 
@@ -142,7 +141,7 @@ class BaseClient extends EventEmitter {
         const url = this.url;
         this.socket.on('error', err => {
             this.logger.warn('connectivity error to the RPC service',
-                             { url, error: err });
+                { url, error: err });
         });
         this.socket.on('connect', () => {
             this.emit('connect');
@@ -156,7 +155,7 @@ class BaseClient extends EventEmitter {
         this.getManifest((err, manifest) => {
             if (err) {
                 this.logger.error('Error fetching manifest from RPC server',
-                                  { error: err });
+                    { error: err });
             } else {
                 manifest.api.forEach(apiItem => {
                     this.createCall(apiItem.name);
@@ -251,7 +250,6 @@ class BaseClient extends EventEmitter {
  *
  */
 class BaseService {
-
     /**
      * @constructor
      *
@@ -497,7 +495,7 @@ function RPCServer(params) {
 
                 conn.on('error', err => {
                     log.error('error on socket.io connection',
-                              { namespace: service.namespace, error: err });
+                        { namespace: service.namespace, error: err });
                 });
                 conn.on('call', (remoteCall, args, cb) => {
                     const decodedArgs = streamsSocket.decodeStreams(args);
@@ -647,8 +645,8 @@ streamRPCJSONObj = function _streamRPCJSONObj(obj, wstream, cb) {
     // primitive types
     if (obj === undefined) {
         wstream.write('null'); // if undefined elements are present in
-                               // arrays, convert them to JSON null
-                               // objects
+        // arrays, convert them to JSON null
+        // objects
     } else {
         wstream.write(JSON.stringify(obj));
     }

lib/network/rpc/sio-stream.js

@@ -16,7 +16,7 @@ class SIOOutputStream extends stream.Writable {
     constructor(socket, streamId, maxPendingAck, ackTimeoutMs) {
         super({ objectMode: true });
         this._initOutputStream(socket, streamId, maxPendingAck,
-                               ackTimeoutMs);
+            ackTimeoutMs);
     }
 
     _initOutputStream(socket, streamId, maxPendingAck, ackTimeoutMs) {
@@ -194,7 +194,7 @@ class SIOStreamSocket {
         this.socket.on('stream-data', (payload, cb) => {
             const { streamId, data } = payload;
             log.debug('received \'stream-data\' event',
-                      { streamId, size: data.length });
+                { streamId, size: data.length });
             const stream = this.remoteStreams[streamId];
             if (!stream) {
                 log.debug('no such remote stream registered', { streamId });
@@ -280,15 +280,15 @@ class SIOStreamSocket {
             let transportStream;
             if (isReadStream) {
                 transportStream = new SIOOutputStream(this, streamId,
-                                                      this.maxPendingAck,
-                                                      this.ackTimeoutMs);
+                    this.maxPendingAck,
+                    this.ackTimeoutMs);
             } else {
                 transportStream = new SIOInputStream(this, streamId);
             }
             this.localStreams[streamId] = arg;
             arg.once('close', () => {
                 log.debug('stream closed, removing from local streams',
-                          { streamId });
+                    { streamId });
                 delete this.localStreams[streamId];
             });
             arg.on('error', error => {
@@ -350,8 +350,8 @@ class SIOStreamSocket {
                 stream = new SIOInputStream(this, streamId);
             } else if (arg.writable) {
                 stream = new SIOOutputStream(this, streamId,
-                                             this.maxPendingAck,
-                                             this.ackTimeoutMs);
+                    this.maxPendingAck,
+                    this.ackTimeoutMs);
             } else {
                 throw new Error('can\'t decode stream neither readable ' +
                                 'nor writable');
@@ -360,14 +360,14 @@ class SIOStreamSocket {
             if (arg.readable) {
                 stream.once('close', () => {
                     log.debug('stream closed, removing from remote streams',
-                              { streamId });
+                        { streamId });
                     delete this.remoteStreams[streamId];
                 });
             }
             if (arg.writable) {
                 stream.once('finish', () => {
                     log.debug('stream finished, removing from remote streams',
-                              { streamId });
+                        { streamId });
                     delete this.remoteStreams[streamId];
                 });
             }
@@ -399,7 +399,7 @@ class SIOStreamSocket {
 
     _write(streamId, data, cb) {
         this.logger.debug('emit \'stream-data\' event',
-                          { streamId, size: data.length });
+            { streamId, size: data.length });
         this.socket.emit('stream-data', { streamId, data }, cb);
     }
 

lib/policy/policyValidator.js

@@ -1,9 +1,9 @@
 'use strict'; // eslint-disable-line strict
 
 const Ajv = require('ajv');
-const userPolicySchema = require('./userPolicySchema');
-const resourcePolicySchema = require('./resourcePolicySchema');
-const errors = require('../errors');
+const userPolicySchema = require('./userPolicySchema.json');
+const resourcePolicySchema = require('./resourcePolicySchema.json');
+const errors = require('../errors').default;
 
 const ajValidate = new Ajv({ allErrors: true });
 ajValidate.addMetaSchema(require('ajv/lib/refs/json-schema-draft-06.json'));

lib/policyEvaluator/evaluator.js

@@ -50,7 +50,7 @@ evaluators.isResourceApplicable = (requestContext, statementResource, log) => {
                 requestResourceArr, true);
         if (arnSegmentsMatch) {
             log.trace('policy resource is applicable to request',
-            { requestResource: resource, policyResource });
+                { requestResource: resource, policyResource });
             return true;
         }
         continue;
@@ -224,21 +224,21 @@ evaluators.evaluatePolicy = (requestContext, policy, log) => {
         // in policy, move on to next statement
         if (currentStatement.NotResource &&
             evaluators.isResourceApplicable(requestContext,
-            currentStatement.NotResource, log)) {
+                currentStatement.NotResource, log)) {
             continue;
         }
         // If affirmative action is in policy and request action is not
         // applicable, move on to next statement
         if (currentStatement.Action &&
             !evaluators.isActionApplicable(requestContext.getAction(),
-            currentStatement.Action, log)) {
+                currentStatement.Action, log)) {
             continue;
         }
         // If NotAction is in policy and action matches NotAction in policy,
         // move on to next statement
         if (currentStatement.NotAction &&
             evaluators.isActionApplicable(requestContext.getAction(),
-            currentStatement.NotAction, log)) {
+                currentStatement.NotAction, log)) {
             continue;
         }
         const conditionEval = currentStatement.Condition ?

lib/policyEvaluator/utils/conditions.js

@@ -39,11 +39,11 @@ conditions.findConditionKey = (key, requestContext) => {
     // (see Boolean Condition Operators).
     // Note: This key is only present if MFA was used. So, the following
     // will not work:
-        //     "Condition" :
-        //     { "Bool" : { "aws:MultiFactorAuthPresent" : false } }
+    //     "Condition" :
+    //     { "Bool" : { "aws:MultiFactorAuthPresent" : false } }
     // Instead use:
-        //     "Condition" :
-        //     { "Null" : { "aws:MultiFactorAuthPresent" : true } }
+    //     "Condition" :
+    //     { "Null" : { "aws:MultiFactorAuthPresent" : true } }
     map.set('aws:MultiFactorAuthPresent',
         requestContext.getMultiFactorAuthPresent());
     // aws:MultiFactorAuthAge – Used to check how many seconds since
@@ -164,8 +164,8 @@ conditions.findConditionKey = (key, requestContext) => {
     // so evaluation should be skipped
     map.set('s3:RequestObjectTagKeys',
         requestContext.getNeedTagEval() && requestContext.getRequestObjTags()
-        ? getTagKeys(requestContext.getRequestObjTags())
-        : undefined);
+            ? getTagKeys(requestContext.getRequestObjTags())
+            : undefined);
     return map.get(key);
 };
 
@@ -189,7 +189,7 @@ function convertSpecialChars(string) {
         return map[char];
     }
     return string.replace(/(\$\{\*\})|(\$\{\?\})|(\$\{\$\})/g,
-    characterMap);
+        characterMap);
 }
 
 /**
@@ -423,10 +423,10 @@ conditions.convertConditionOperator = operator => {
             return !operatorMap.ArnLike(key, value);
         },
         Null: function nullOperator(key, value) {
-         // Null is used to check if a condition key is present.
-         // The policy statement value should be either true (the key doesn't
-         // exist — it is null) or false (the key exists and its value is
-         // not null).
+            // Null is used to check if a condition key is present.
+            // The policy statement value should be either true (the key doesn't
+            // exist — it is null) or false (the key exists and its value is
+            // not null).
             if ((key === undefined || key === null)
                 && value[0] === 'true' ||
                 (key !== undefined && key !== null)

lib/policyEvaluator/utils/wildcards.js

@@ -51,10 +51,10 @@ wildcards.handleWildcardInResource = arn => {
 // Wildcards can be part of the resource ARN.
 // Wildcards do NOT span segments of the ARN (separated by ":")
 
-// Example: all elements in specific bucket:
-// "Resource": "arn:aws:s3:::my_corporate_bucket/*"
-// ARN format:
-// arn:partition:service:region:namespace:relative-id
+    // Example: all elements in specific bucket:
+    // "Resource": "arn:aws:s3:::my_corporate_bucket/*"
+    // ARN format:
+    // arn:partition:service:region:namespace:relative-id
     const arnArr = arn.split(':');
     return arnArr.map(portion => wildcards.handleWildcards(portion));
 };

lib/s3middleware/MD5Sum.js

@@ -6,7 +6,6 @@ const crypto = require('crypto');
  * data through a stream
  */
 class MD5Sum extends Transform {
-
     /**
      * @constructor
      */
@@ -40,7 +39,6 @@ class MD5Sum extends Transform {
         this.emit('hashed');
         callback(null);
     }
-
 }
 
 module.exports = MD5Sum;

lib/s3middleware/azureHelpers/ResultsCollector.js

@@ -73,7 +73,7 @@ class ResultsCollector extends EventEmitter {
  * @property {Error} [results[].error] - error returned by Azure putting subpart
  * @property {number} results[].subPartIndex - index of the subpart
  */
- /**
+/**
   * "error" event
   * @event ResultCollector#error
   * @type {(Error|undefined)} error - error returned by Azure last subpart

lib/s3middleware/azureHelpers/mpuUtils.js

@@ -6,7 +6,7 @@ const ResultsCollector = require('./ResultsCollector');
 const SubStreamInterface = require('./SubStreamInterface');
 const objectUtils = require('../objectUtils');
 const MD5Sum = require('../MD5Sum');
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 
 const azureMpuUtils = {};
 
@@ -94,7 +94,7 @@ azureMpuUtils.getSubPartIds = (part, uploadId) =>
         azureMpuUtils.getBlockId(uploadId, part.partNumber, subPartIndex));
 
 azureMpuUtils.putSinglePart = (errorWrapperFn, request, params, dataStoreName,
-log, cb) => {
+    log, cb) => {
     const { bucketName, partNumber, size, objectKey, contentMD5, uploadId }
         = params;
     const blockId = azureMpuUtils.getBlockId(uploadId, partNumber, 0);
@@ -107,31 +107,31 @@ log, cb) => {
     request.pipe(passThrough);
     return errorWrapperFn('uploadPart', 'createBlockFromStream',
         [blockId, bucketName, objectKey, passThrough, size, options,
-        (err, result) => {
-            if (err) {
-                log.error('Error from Azure data backend uploadPart',
-                    { error: err.message, dataStoreName });
-                if (err.code === 'ContainerNotFound') {
-                    return cb(errors.NoSuchBucket);
+            (err, result) => {
+                if (err) {
+                    log.error('Error from Azure data backend uploadPart',
+                        { error: err.message, dataStoreName });
+                    if (err.code === 'ContainerNotFound') {
+                        return cb(errors.NoSuchBucket);
+                    }
+                    if (err.code === 'InvalidMd5') {
+                        return cb(errors.InvalidDigest);
+                    }
+                    if (err.code === 'Md5Mismatch') {
+                        return cb(errors.BadDigest);
+                    }
+                    return cb(errors.InternalError.customizeDescription(
+                        `Error returned from Azure: ${err.message}`),
+                    );
                 }
-                if (err.code === 'InvalidMd5') {
-                    return cb(errors.InvalidDigest);
-                }
-                if (err.code === 'Md5Mismatch') {
-                    return cb(errors.BadDigest);
-                }
-                return cb(errors.InternalError.customizeDescription(
-                    `Error returned from Azure: ${err.message}`)
-                );
-            }
-            const md5 = result.headers['content-md5'] || '';
-            const eTag = objectUtils.getHexMD5(md5);
-            return cb(null, eTag, size);
-        }], log, cb);
+                const md5 = result.headers['content-md5'] || '';
+                const eTag = objectUtils.getHexMD5(md5);
+                return cb(null, eTag, size);
+            }], log, cb);
 };
 
 azureMpuUtils.putNextSubPart = (errorWrapperFn, partParams, subPartInfo,
-subPartStream, subPartIndex, resultsCollector, log, cb) => {
+    subPartStream, subPartIndex, resultsCollector, log, cb) => {
     const { uploadId, partNumber, bucketName, objectKey } = partParams;
     const subPartSize = azureMpuUtils.getSubPartSize(
         subPartInfo, subPartIndex);
@@ -140,11 +140,11 @@ subPartStream, subPartIndex, resultsCollector, log, cb) => {
     resultsCollector.pushOp();
     errorWrapperFn('uploadPart', 'createBlockFromStream',
         [subPartId, bucketName, objectKey, subPartStream, subPartSize,
-        {}, err => resultsCollector.pushResult(err, subPartIndex)], log, cb);
+            {}, err => resultsCollector.pushResult(err, subPartIndex)], log, cb);
 };
 
 azureMpuUtils.putSubParts = (errorWrapperFn, request, params,
-dataStoreName, log, cb) => {
+    dataStoreName, log, cb) => {
     const subPartInfo = azureMpuUtils.getSubPartInfo(params.size);
     const resultsCollector = new ResultsCollector();
     const hashedStream = new MD5Sum();

lib/s3middleware/convertToXml.js

@@ -31,9 +31,9 @@ convertMethods.listMultipartUploads = xmlParams => {
     const l = xmlParams.list;
 
     xml.push('<?xml version="1.0" encoding="UTF-8"?>',
-             '<ListMultipartUploadsResult ' +
+        '<ListMultipartUploadsResult ' +
                 'xmlns="http://s3.amazonaws.com/doc/2006-03-01/">',
-             `<Bucket>${escapeForXml(xmlParams.bucketName)}</Bucket>`
+        `<Bucket>${escapeForXml(xmlParams.bucketName)}</Bucket>`,
     );
 
     // For certain XML elements, if it is `undefined`, AWS returns either an
@@ -58,7 +58,7 @@ convertMethods.listMultipartUploads = xmlParams => {
     });
 
     xml.push(`<MaxUploads>${escapeForXml(l.MaxKeys)}</MaxUploads>`,
-             `<IsTruncated>${escapeForXml(l.IsTruncated)}</IsTruncated>`
+        `<IsTruncated>${escapeForXml(l.IsTruncated)}</IsTruncated>`,
     );
 
     l.Uploads.forEach(upload => {
@@ -69,29 +69,29 @@ convertMethods.listMultipartUploads = xmlParams => {
         }
 
         xml.push('<Upload>',
-                 `<Key>${escapeForXml(key)}</Key>`,
-                 `<UploadId>${escapeForXml(val.UploadId)}</UploadId>`,
-                 '<Initiator>',
-                 `<ID>${escapeForXml(val.Initiator.ID)}</ID>`,
-                 `<DisplayName>${escapeForXml(val.Initiator.DisplayName)}` +
+            `<Key>${escapeForXml(key)}</Key>`,
+            `<UploadId>${escapeForXml(val.UploadId)}</UploadId>`,
+            '<Initiator>',
+            `<ID>${escapeForXml(val.Initiator.ID)}</ID>`,
+            `<DisplayName>${escapeForXml(val.Initiator.DisplayName)}` +
                     '</DisplayName>',
-                 '</Initiator>',
-                 '<Owner>',
-                 `<ID>${escapeForXml(val.Owner.ID)}</ID>`,
-                 `<DisplayName>${escapeForXml(val.Owner.DisplayName)}` +
+            '</Initiator>',
+            '<Owner>',
+            `<ID>${escapeForXml(val.Owner.ID)}</ID>`,
+            `<DisplayName>${escapeForXml(val.Owner.DisplayName)}` +
                     '</DisplayName>',
-                 '</Owner>',
-                 `<StorageClass>${escapeForXml(val.StorageClass)}` +
+            '</Owner>',
+            `<StorageClass>${escapeForXml(val.StorageClass)}` +
                     '</StorageClass>',
-                 `<Initiated>${escapeForXml(val.Initiated)}</Initiated>`,
-                 '</Upload>'
+            `<Initiated>${escapeForXml(val.Initiated)}</Initiated>`,
+            '</Upload>',
         );
     });
 
     l.CommonPrefixes.forEach(prefix => {
         xml.push('<CommonPrefixes>',
-                 `<Prefix>${escapeForXml(prefix)}</Prefix>`,
-                 '</CommonPrefixes>'
+            `<Prefix>${escapeForXml(prefix)}</Prefix>`,
+            '</CommonPrefixes>',
         );
     });
 

lib/s3middleware/nullStream.js

@@ -5,7 +5,6 @@ const Readable = require('stream').Readable;
  * This class is used to produce zeros filled buffers for a reader consumption
  */
 class NullStream extends Readable {
-
     /**
      * Construct a new zeros filled buffers producer that will
      * produce as much bytes as specified by the range parameter, or the size
@@ -32,8 +31,8 @@ class NullStream extends Readable {
     _read(size) {
         const toRead = Math.min(size, this.bytesToRead);
         const buffer = toRead > 0
-                  ? Buffer.alloc(toRead, 0)
-                  : null;
+            ? Buffer.alloc(toRead, 0)
+            : null;
         this.bytesToRead -= toRead;
         this.push(buffer);
     }

lib/s3middleware/objectLegalHold.js

@@ -1,5 +1,5 @@
 const { parseString } = require('xml2js');
-const errors = require('../errors');
+const errors = require('../errors').default;
 
 /*
     Format of the xml request:

lib/s3middleware/objectRetention.js

@@ -1,6 +1,6 @@
 const { parseString } = require('xml2js');
 
-const errors = require('../errors');
+const errors = require('../errors').default;
 
 /*
     Format of xml request:

lib/s3middleware/tagging.js

@@ -1,14 +1,14 @@
 const { parseString } = require('xml2js');
 
-const errors = require('../errors');
+const errors = require('../errors').default;
 const escapeForXml = require('./escapeForXml');
 
 const errorInvalidArgument = errors.InvalidArgument
-  .customizeDescription('The header \'x-amz-tagging\' shall be ' +
+    .customizeDescription('The header \'x-amz-tagging\' shall be ' +
   'encoded as UTF-8 then URLEncoded URL query parameters without ' +
   'tag name duplicates.');
 const errorBadRequestLimit50 = errors.BadRequest
-  .customizeDescription('Object tags cannot be greater than 50');
+    .customizeDescription('Object tags cannot be greater than 50');
 
 /*
     Format of xml request:
@@ -38,7 +38,7 @@ const _validator = {
         result.Tagging.TagSet &&
         result.Tagging.TagSet.length === 1 &&
         (
-          result.Tagging.TagSet[0] === '' ||
+            result.Tagging.TagSet[0] === '' ||
           result.Tagging.TagSet[0] &&
           Object.keys(result.Tagging.TagSet[0]).length === 1 &&
           result.Tagging.TagSet[0].Tag &&
@@ -155,7 +155,7 @@ function parseTagXml(xml, log, cb) {
 function convertToXml(objectTags) {
     const xml = [];
     xml.push('<?xml version="1.0" encoding="UTF-8" standalone="yes"?>',
-    '<Tagging> <TagSet>');
+        '<Tagging> <TagSet>');
     if (objectTags && Object.keys(objectTags).length > 0) {
         Object.keys(objectTags).forEach(key => {
             xml.push(`<Tag><Key>${escapeForXml(key)}</Key>` +

lib/s3middleware/userMetadata.js

@@ -1,5 +1,5 @@
 const constants = require('../constants');
-const errors = require('../errors');
+const errors = require('../errors').default;
 
 const userMetadata = {};
 /**

lib/s3middleware/validateConditionalHeaders.js

@@ -1,4 +1,4 @@
-const errors = require('../errors');
+const errors = require('../errors').default;
 
 function _matchesETag(item, contentMD5) {
     return (item === contentMD5 || item === '*' || item === `"${contentMD5}"`);

lib/s3routes/routes.js

@@ -1,6 +1,6 @@
 const assert = require('assert');
 
-const errors = require('../errors');
+const errors = require('../errors').default;
 const routeGET = require('./routes/routeGET');
 const routePUT = require('./routes/routePUT');
 const routeDELETE = require('./routes/routeDELETE');
@@ -42,7 +42,7 @@ function checkBucketAndKey(bucketName, objectKey, method, reqQuery,
         log.debug('empty bucket name', { method: 'routes' });
         return (method !== 'OPTIONS') ?
             errors.MethodNotAllowed : errors.AccessForbidden
-            .customizeDescription('CORSResponse: Bucket not found');
+                .customizeDescription('CORSResponse: Bucket not found');
     }
     if (bucketName !== undefined && routesUtils.isValidBucketName(bucketName,
         blacklistedPrefixes.bucket) === false) {
@@ -85,7 +85,7 @@ function checkTypes(req, res, params, logger, s3config) {
         'bad routes param: internalHandlers must be an object');
     if (params.statsClient) {
         assert.strictEqual(typeof params.statsClient, 'object',
-        'bad routes param: statsClient must be an object');
+            'bad routes param: statsClient must be an object');
     }
     assert(Array.isArray(params.allEndpoints),
         'bad routes param: allEndpoints must be an array');
@@ -93,13 +93,13 @@ function checkTypes(req, res, params, logger, s3config) {
         'bad routes param: allEndpoints must have at least one endpoint');
     params.allEndpoints.forEach(endpoint => {
         assert.strictEqual(typeof endpoint, 'string',
-        'bad routes param: each item in allEndpoints must be a string');
+            'bad routes param: each item in allEndpoints must be a string');
     });
     assert(Array.isArray(params.websiteEndpoints),
         'bad routes param: allEndpoints must be an array');
     params.websiteEndpoints.forEach(endpoint => {
         assert.strictEqual(typeof endpoint, 'string',
-        'bad routes param: each item in websiteEndpoints must be a string');
+            'bad routes param: each item in websiteEndpoints must be a string');
     });
     assert.strictEqual(typeof params.blacklistedPrefixes, 'object',
         'bad routes param: blacklistedPrefixes must be an object');
@@ -107,13 +107,13 @@ function checkTypes(req, res, params, logger, s3config) {
         'bad routes param: blacklistedPrefixes.bucket must be an array');
     params.blacklistedPrefixes.bucket.forEach(pre => {
         assert.strictEqual(typeof pre, 'string',
-        'bad routes param: each blacklisted bucket prefix must be a string');
+            'bad routes param: each blacklisted bucket prefix must be a string');
     });
     assert(Array.isArray(params.blacklistedPrefixes.object),
         'bad routes param: blacklistedPrefixes.object must be an array');
     params.blacklistedPrefixes.object.forEach(pre => {
         assert.strictEqual(typeof pre, 'string',
-        'bad routes param: each blacklisted object prefix must be a string');
+            'bad routes param: each blacklisted object prefix must be a string');
     });
     assert.strictEqual(typeof params.dataRetrievalFn, 'function',
         'bad routes param: dataRetrievalFn must be a defined function');
@@ -171,8 +171,8 @@ function routes(req, res, params, logger, s3config) {
         reqUids = undefined;
     }
     const log = (reqUids !== undefined ?
-                 logger.newRequestLoggerFromSerializedUids(reqUids) :
-                 logger.newRequestLogger());
+        logger.newRequestLoggerFromSerializedUids(reqUids) :
+        logger.newRequestLogger());
 
     if (!req.url.startsWith('/_/healthcheck')) {
         log.info('received request', clientInfo);
@@ -207,7 +207,7 @@ function routes(req, res, params, logger, s3config) {
         return routesUtils.responseXMLBody(
             errors.InvalidURI.customizeDescription('Could not parse the ' +
                 'specified URI. Check your restEndpoints configuration.'),
-                undefined, res, log);
+            undefined, res, log);
     }
 
     log.addDefaultFields({
@@ -229,7 +229,7 @@ function routes(req, res, params, logger, s3config) {
 
     if (bucketOrKeyError) {
         log.trace('error with bucket or key value',
-        { error: bucketOrKeyError });
+            { error: bucketOrKeyError });
         return routesUtils.responseXMLBody(bucketOrKeyError, null, res, log);
     }
 

lib/s3routes/routes/routeDELETE.js

@@ -1,5 +1,5 @@
 const routesUtils = require('../routesUtils');
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 
 function routeDELETE(request, response, api, log, statsClient) {
     log.debug('routing request', { method: 'routeDELETE' });
@@ -7,7 +7,7 @@ function routeDELETE(request, response, api, log, statsClient) {
     if (request.query.uploadId) {
         if (request.objectKey === undefined) {
             return routesUtils.responseNoBody(
-              errors.InvalidRequest.customizeDescription('A key must be ' +
+                errors.InvalidRequest.customizeDescription('A key must be ' +
               'specified'), null, response, 200, log);
         }
         api.callApiMethod('multipartDelete', request, response, log,
@@ -19,77 +19,77 @@ function routeDELETE(request, response, api, log, statsClient) {
     } else if (request.objectKey === undefined) {
         if (request.query.website !== undefined) {
             return api.callApiMethod('bucketDeleteWebsite', request,
-            response, log, (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 204, log);
-            });
+                response, log, (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 204, log);
+                });
         } else if (request.query.cors !== undefined) {
             return api.callApiMethod('bucketDeleteCors', request, response,
-            log, (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 204, log);
-            });
+                log, (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 204, log);
+                });
         } else if (request.query.replication !== undefined) {
             return api.callApiMethod('bucketDeleteReplication', request,
-            response, log, (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 204, log);
-            });
+                response, log, (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 204, log);
+                });
         } else if (request.query.lifecycle !== undefined) {
             return api.callApiMethod('bucketDeleteLifecycle', request,
-            response, log, (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 204, log);
-            });
+                response, log, (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 204, log);
+                });
         } else if (request.query.policy !== undefined) {
             return api.callApiMethod('bucketDeletePolicy', request,
-            response, log, (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 204, log);
-            });
+                response, log, (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 204, log);
+                });
         } else if (request.query.encryption !== undefined) {
             return api.callApiMethod('bucketDeleteEncryption', request,
-            response, log, (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 204, log);
-            });
+                response, log, (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 204, log);
+                });
         }
         api.callApiMethod('bucketDelete', request, response, log,
-        (err, corsHeaders) => {
-            routesUtils.statsReport500(err, statsClient);
-            return routesUtils.responseNoBody(err, corsHeaders, response,
-              204, log);
-        });
+            (err, corsHeaders) => {
+                routesUtils.statsReport500(err, statsClient);
+                return routesUtils.responseNoBody(err, corsHeaders, response,
+                    204, log);
+            });
     } else {
         if (request.query.tagging !== undefined) {
             return api.callApiMethod('objectDeleteTagging', request,
-            response, log, (err, resHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, resHeaders,
-                    response, 204, log);
-            });
+                response, log, (err, resHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, resHeaders,
+                        response, 204, log);
+                });
         }
         api.callApiMethod('objectDelete', request, response, log,
-          (err, corsHeaders) => {
-              /*
+            (err, corsHeaders) => {
+                /*
               * Since AWS expects a 204 regardless of the existence of
               the object, the errors NoSuchKey and NoSuchVersion should not
               * be sent back as a response.
               */
-              if (err && !err.NoSuchKey && !err.NoSuchVersion) {
-                  return routesUtils.responseNoBody(err, corsHeaders,
-                    response, null, log);
-              }
-              routesUtils.statsReport500(err, statsClient);
-              return routesUtils.responseNoBody(null, corsHeaders, response,
-                204, log);
-          });
+                if (err && !err.is.NoSuchKey && !err.is.NoSuchVersion) {
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, null, log);
+                }
+                routesUtils.statsReport500(err, statsClient);
+                return routesUtils.responseNoBody(null, corsHeaders, response,
+                    204, log);
+            });
     }
     return undefined;
 }

lib/s3routes/routes/routeGET.js

@@ -1,4 +1,4 @@
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const routesUtils = require('../routesUtils');
 
 function routerGET(request, response, api, log, statsClient, dataRetrievalFn) {
@@ -16,18 +16,18 @@ function routerGET(request, response, api, log, statsClient, dataRetrievalFn) {
         // GET bucket ACL
         if (request.query.acl !== undefined) {
             api.callApiMethod('bucketGetACL', request, response, log,
-            (err, xml, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseXMLBody(err, xml, response, log,
-                    corsHeaders);
-            });
+                (err, xml, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseXMLBody(err, xml, response, log,
+                        corsHeaders);
+                });
         } else if (request.query.replication !== undefined) {
             api.callApiMethod('bucketGetReplication', request, response, log,
-            (err, xml, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseXMLBody(err, xml, response, log,
-                    corsHeaders);
-            });
+                (err, xml, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseXMLBody(err, xml, response, log,
+                        corsHeaders);
+                });
         } else if (request.query.cors !== undefined) {
             api.callApiMethod('bucketGetCors', request, response, log,
                 (err, xml, corsHeaders) => {
@@ -69,7 +69,7 @@ function routerGET(request, response, api, log, statsClient, dataRetrievalFn) {
                 (err, xml, corsHeaders) => {
                     routesUtils.statsReport500(err, statsClient);
                     return routesUtils.responseXMLBody(err, xml, response, log,
-                      corsHeaders);
+                        corsHeaders);
                 });
         } else if (request.query.policy !== undefined) {
             api.callApiMethod('bucketGetPolicy', request, response, log,
@@ -94,11 +94,11 @@ function routerGET(request, response, api, log, statsClient, dataRetrievalFn) {
                 });
         } else if (request.query.encryption !== undefined) {
             api.callApiMethod('bucketGetEncryption', request, response, log,
-            (err, xml, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseXMLBody(err, xml, response,
-                    log, corsHeaders);
-            });
+                (err, xml, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseXMLBody(err, xml, response,
+                        log, corsHeaders);
+                });
         } else {
             // GET bucket
             api.callApiMethod('bucketGet', request, response, log,

lib/s3routes/routes/routeHEAD.js

@@ -1,4 +1,4 @@
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const routesUtils = require('../routesUtils');
 
 function routeHEAD(request, response, api, log, statsClient) {

lib/s3routes/routes/routeOPTIONS.js

@@ -1,4 +1,4 @@
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const routesUtils = require('../routesUtils');
 
 function routeOPTIONS(request, response, api, log, statsClient) {
@@ -21,11 +21,11 @@ function routeOPTIONS(request, response, api, log, statsClient) {
     }
 
     return api.callApiMethod('corsPreflight', request, response, log,
-    (err, resHeaders) => {
-        routesUtils.statsReport500(err, statsClient);
-        return routesUtils.responseNoBody(err, resHeaders, response, 200,
-            log);
-    });
+        (err, resHeaders) => {
+            routesUtils.statsReport500(err, statsClient);
+            return routesUtils.responseNoBody(err, resHeaders, response, 200,
+                log);
+        });
 }
 
 module.exports = routeOPTIONS;

lib/s3routes/routes/routePOST.js

@@ -1,4 +1,4 @@
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const routesUtils = require('../routesUtils');
 
 /* eslint-disable no-param-reassign */
@@ -27,28 +27,28 @@ function routePOST(request, response, api, log) {
     if (request.query.uploads !== undefined) {
         return api.callApiMethod('initiateMultipartUpload', request,
             response, log, (err, result, corsHeaders) =>
-            routesUtils.responseXMLBody(err, result, response, log,
-                corsHeaders));
+                routesUtils.responseXMLBody(err, result, response, log,
+                    corsHeaders));
     }
 
     // POST complete multipart upload
     if (request.query.uploadId !== undefined) {
         return api.callApiMethod('completeMultipartUpload', request,
             response, log, (err, result, resHeaders) =>
-            routesUtils.responseXMLBody(err, result, response, log,
-                resHeaders));
+                routesUtils.responseXMLBody(err, result, response, log,
+                    resHeaders));
     }
 
     // POST multiObjectDelete
     if (request.query.delete !== undefined) {
         return api.callApiMethod('multiObjectDelete', request, response,
             log, (err, xml, corsHeaders) =>
-            routesUtils.responseXMLBody(err, xml, response, log,
-                corsHeaders));
+                routesUtils.responseXMLBody(err, xml, response, log,
+                    corsHeaders));
     }
 
     return routesUtils.responseNoBody(errors.NotImplemented, null, response,
-                200, log);
+        200, log);
 }
 /* eslint-enable no-param-reassign */
 module.exports = routePOST;

lib/s3routes/routes/routePUT.js

@@ -1,4 +1,4 @@
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const routesUtils = require('../routesUtils');
 
 /* eslint-disable no-param-reassign */
@@ -14,16 +14,16 @@ function routePUT(request, response, api, log, statsClient) {
         || contentLength < 0)) || contentLength === '') {
             log.debug('invalid content-length header');
             return routesUtils.responseNoBody(
-              errors.BadRequest, null, response, null, log);
+                errors.BadRequest, null, response, null, log);
         }
         // PUT bucket ACL
         if (request.query.acl !== undefined) {
             api.callApiMethod('bucketPutACL', request, response, log,
-            (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 200, log);
-            });
+                (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 200, log);
+                });
         } else if (request.query.versioning !== undefined) {
             api.callApiMethod('bucketPutVersioning', request, response, log,
                 (err, corsHeaders) => {
@@ -82,11 +82,11 @@ function routePUT(request, response, api, log, statsClient) {
                 });
         } else if (request.query.encryption !== undefined) {
             api.callApiMethod('bucketPutEncryption', request, response, log,
-            (err, corsHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, corsHeaders,
-                    response, 200, log);
-            });
+                (err, corsHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, corsHeaders,
+                        response, 200, log);
+                });
         } else {
             // PUT bucket
             return api.callApiMethod('bucketPut', request, response, log,
@@ -110,7 +110,7 @@ function routePUT(request, response, api, log, statsClient) {
                 method: 'routePUT',
             });
             return routesUtils
-            .responseNoBody(errors.InvalidDigest, null, response, 200, log);
+                .responseNoBody(errors.InvalidDigest, null, response, 200, log);
         }
         if (request.headers['content-md5']) {
             request.contentMD5 = request.headers['content-md5'];
@@ -126,17 +126,17 @@ function routePUT(request, response, api, log, statsClient) {
                 });
                 return routesUtils
                     .responseNoBody(errors.InvalidDigest, null, response, 200,
-                                    log);
+                        log);
             }
         }
         if (request.query.partNumber) {
             if (request.headers['x-amz-copy-source']) {
                 api.callApiMethod('objectPutCopyPart', request, response, log,
-                (err, xml, additionalHeaders) => {
-                    routesUtils.statsReport500(err, statsClient);
-                    return routesUtils.responseXMLBody(err, xml, response, log,
+                    (err, xml, additionalHeaders) => {
+                        routesUtils.statsReport500(err, statsClient);
+                        return routesUtils.responseXMLBody(err, xml, response, log,
                             additionalHeaders);
-                });
+                    });
             } else {
                 api.callApiMethod('objectPutPart', request, response, log,
                     (err, calculatedHash, corsHeaders) => {
@@ -202,11 +202,11 @@ function routePUT(request, response, api, log, statsClient) {
                 contentLength: request.parsedContentLength,
             });
             api.callApiMethod('objectPut', request, response, log,
-            (err, resHeaders) => {
-                routesUtils.statsReport500(err, statsClient);
-                return routesUtils.responseNoBody(err, resHeaders,
-                    response, 200, log);
-            });
+                (err, resHeaders) => {
+                    routesUtils.statsReport500(err, statsClient);
+                    return routesUtils.responseNoBody(err, resHeaders,
+                        response, 200, log);
+                });
         }
     }
     return undefined;

lib/s3routes/routes/routeWebsite.js

@@ -1,4 +1,4 @@
-const errors = require('../../errors');
+const errors = require('../../errors').default;
 const routesUtils = require('../routesUtils');
 
 function routerWebsite(request, response, api, log, statsClient,
@@ -14,7 +14,7 @@ function routerWebsite(request, response, api, log, statsClient,
     if (request.method === 'GET') {
         return api.callApiMethod('websiteGet', request, response, log,
             (err, userErrorPageFailure, dataGetInfo, resMetaHeaders,
-            redirectInfo, key) => {
+                redirectInfo, key) => {
                 routesUtils.statsReport500(err, statsClient);
                 // request being redirected
                 if (redirectInfo) {
@@ -43,21 +43,21 @@ function routerWebsite(request, response, api, log, statsClient,
     }
     if (request.method === 'HEAD') {
         return api.callApiMethod('websiteHead', request, response, log,
-        (err, resMetaHeaders, redirectInfo, key) => {
-            routesUtils.statsReport500(err, statsClient);
-            if (redirectInfo) {
-                return routesUtils.redirectRequest(redirectInfo,
-                    key, request.connection.encrypted,
-                    response, request.headers.host, resMetaHeaders, log);
-            }
-            // could redirect on err so check for redirectInfo first
-            if (err) {
-                return routesUtils.errorHeaderResponse(err, response,
-                    resMetaHeaders, log);
-            }
-            return routesUtils.responseContentHeaders(err, {}, resMetaHeaders,
-                response, log);
-        });
+            (err, resMetaHeaders, redirectInfo, key) => {
+                routesUtils.statsReport500(err, statsClient);
+                if (redirectInfo) {
+                    return routesUtils.redirectRequest(redirectInfo,
+                        key, request.connection.encrypted,
+                        response, request.headers.host, resMetaHeaders, log);
+                }
+                // could redirect on err so check for redirectInfo first
+                if (err) {
+                    return routesUtils.errorHeaderResponse(err, response,
+                        resMetaHeaders, log);
+                }
+                return routesUtils.responseContentHeaders(err, {}, resMetaHeaders,
+                    response, log);
+            });
     }
     return undefined;
 }

lib/s3routes/routesUtils.js

@@ -1,6 +1,6 @@
 const url = require('url');
 const ipCheck = require('../ipCheck');
-const errors = require('../errors');
+const errors = require('../errors').default;
 const constants = require('../constants');
 const { eachSeries } = require('async');
 
@@ -25,7 +25,7 @@ function setCommonResponseHeaders(headers, response, log) {
                 } catch (e) {
                     log.debug('header can not be added ' +
                       'to the response', { header: headers[key],
-                          error: e.stack, method: 'setCommonResponseHeaders' });
+                        error: e.stack, method: 'setCommonResponseHeaders' });
                 }
             }
         });
@@ -68,7 +68,7 @@ const XMLResponseBackend = {
      * @return {object} response - response object with additional headers
      */
     okResponse: function okXMLResponse(xml, response, log,
-                                       additionalHeaders) {
+        additionalHeaders) {
         const bytesSent = Buffer.byteLength(xml);
         log.trace('sending success xml response');
         log.addDefaultFields({
@@ -115,7 +115,7 @@ const XMLResponseBackend = {
             `<Message>${errCode.description}</Message>`,
             '<Resource></Resource>',
             `<RequestId>${log.getSerializedUids()}</RequestId>`,
-            '</Error>'
+            '</Error>',
         );
         const xmlStr = xml.join('');
         const bytesSent = Buffer.byteLength(xmlStr);
@@ -145,7 +145,7 @@ const JSONResponseBackend = {
      * @return {object} response - response object with additional headers
      */
     okResponse: function okJSONResponse(json, response, log,
-                                        additionalHeaders) {
+        additionalHeaders) {
         const bytesSent = Buffer.byteLength(json);
         log.trace('sending success json response');
         log.addDefaultFields({
@@ -163,7 +163,7 @@ const JSONResponseBackend = {
     },
 
     errorResponse: function errorJSONResponse(errCode, response, log,
-                                              corsHeaders) {
+        corsHeaders) {
         log.trace('sending error json response', { errCode });
         /*
          {
@@ -337,27 +337,27 @@ function retrieveData(locations, retrieveDataFn, response, log) {
                 currentStream = readable;
                 return readable.pipe(response, { end: false });
             }), err => {
-                currentStream = null;
-                if (err) {
-                    log.debug('abort response due to error', {
-                        error: err.code, errMsg: err.message });
-                }
-                // call end for all cases (error/success) per node.js docs
-                // recommendation
-                response.end();
+            currentStream = null;
+            if (err) {
+                log.debug('abort response due to error', {
+                    error: err.code, errMsg: err.message });
             }
+            // call end for all cases (error/success) per node.js docs
+            // recommendation
+            response.end();
+        },
     );
 }
 
 function _responseBody(responseBackend, errCode, payload, response, log,
-                       additionalHeaders) {
+    additionalHeaders) {
     if (errCode && !response.headersSent) {
         return responseBackend.errorResponse(errCode, response, log,
-                                             additionalHeaders);
+            additionalHeaders);
     }
     if (!response.headersSent) {
         return responseBackend.okResponse(payload, response, log,
-                                          additionalHeaders);
+            additionalHeaders);
     }
     return undefined;
 }
@@ -366,8 +366,8 @@ function _computeContentLengthFromLocation(dataLocations) {
     return dataLocations.reduce(
         (sum, location) => (sum !== undefined &&
                             (typeof location.size === 'number' || typeof location.size === 'string') ?
-                            sum + Number.parseInt(location.size, 10) :
-                            undefined), 0);
+            sum + Number.parseInt(location.size, 10) :
+            undefined), 0);
 }
 
 function _contentLengthMatchesLocations(contentLength, dataLocations) {
@@ -388,7 +388,7 @@ const routesUtils = {
      */
     responseXMLBody(errCode, xml, response, log, additionalHeaders) {
         return _responseBody(XMLResponseBackend, errCode, xml, response,
-                             log, additionalHeaders);
+            log, additionalHeaders);
     },
 
     /**
@@ -402,7 +402,7 @@ const routesUtils = {
      */
     responseJSONBody(errCode, json, response, log, additionalHeaders) {
         return _responseBody(JSONResponseBackend, errCode, json, response,
-                             log, additionalHeaders);
+            log, additionalHeaders);
     },
 
     /**
@@ -417,7 +417,7 @@ const routesUtils = {
     responseNoBody(errCode, resHeaders, response, httpCode = 200, log) {
         if (errCode && !response.headersSent) {
             return XMLResponseBackend.errorResponse(errCode, response, log,
-                                                    resHeaders);
+                resHeaders);
         }
         if (!response.headersSent) {
             return okHeaderResponse(resHeaders, response, httpCode, log);
@@ -435,10 +435,10 @@ const routesUtils = {
      * @return {object} - router's response object
      */
     responseContentHeaders(errCode, overrideParams, resHeaders, response,
-                           log) {
+        log) {
         if (errCode && !response.headersSent) {
             return XMLResponseBackend.errorResponse(errCode, response, log,
-                                                    resHeaders);
+                resHeaders);
         }
         if (!response.headersSent) {
             // Undefined added as an argument since need to send range to
@@ -472,7 +472,7 @@ const routesUtils = {
         retrieveDataFn, response, range, log) {
         if (errCode && !response.headersSent) {
             return XMLResponseBackend.errorResponse(errCode, response, log,
-                                                    resHeaders);
+                resHeaders);
         }
         if (dataLocations !== null && !response.headersSent) {
             // sanity check of content length against individual data
@@ -480,13 +480,13 @@ const routesUtils = {
             const contentLength = resHeaders && resHeaders['Content-Length'];
             if (contentLength !== undefined &&
                 !_contentLengthMatchesLocations(contentLength,
-                                                dataLocations)) {
+                    dataLocations)) {
                 log.error('logic error: total length of fetched data ' +
                           'locations does not match returned content-length',
-                          { contentLength, dataLocations });
+                { contentLength, dataLocations });
                 return XMLResponseBackend.errorResponse(errors.InternalError,
-                                                        response, log,
-                                                        resHeaders);
+                    response, log,
+                    resHeaders);
             }
         }
         if (!response.headersSent) {
@@ -558,7 +558,7 @@ const routesUtils = {
             `<h1>${err.code} ${response.statusMessage}</h1>`,
             '<ul>',
             `<li>Code: ${err.message}</li>`,
-            `<li>Message: ${err.description}</li>`
+            `<li>Message: ${err.description}</li>`,
         );
 
         if (!userErrorPageFailure && bucketName) {
@@ -568,7 +568,7 @@ const routesUtils = {
             `<li>RequestId: ${log.getSerializedUids()}</li>`,
             // AWS response contains HostId here.
             // TODO: consider adding
-            '</ul>'
+            '</ul>',
         );
         if (userErrorPageFailure) {
             html.push(
@@ -578,13 +578,13 @@ const routesUtils = {
                 '<ul>',
                 `<li>Code: ${err.message}</li>`,
                 `<li>Message: ${err.description}</li>`,
-                '</ul>'
+                '</ul>',
             );
         }
         html.push(
             '<hr/>',
             '</body>',
-            '</html>'
+            '</html>',
         );
 
         return response.end(html.join(''), 'utf8', () => {
@@ -806,7 +806,7 @@ const routesUtils = {
                     // most specific potential hostname
                     bucketName =
                         potentialBucketName.length < bucketName.length ?
-                        potentialBucketName : bucketName;
+                            potentialBucketName : bucketName;
                 }
             }
         }
@@ -814,7 +814,7 @@ const routesUtils = {
             return bucketName;
         }
         throw new Error(
-            `bad request: hostname ${host} is not in valid endpoints`
+            `bad request: hostname ${host} is not in valid endpoints`,
         );
     },
 

lib/simple-glob.d.ts

@@ -0,0 +1,8 @@
+// This module declare the interface for simple-glob.
+//   simple-glob should probably be discarded in favor of node-glob.
+//   node-glob is an up to date glob implementation, with support for sync and
+//   async, and well maintained by the community.
+//   node-glob is performance oriented and is a little lighter than simple-glob.
+declare module 'simple-glob' {
+    export default function (pattern: string | string[]): string[];
+}