Skip to content

fix(uploads): unblock browser PUTs to the reports bucket #402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nourshoreibah merged 3 commits into from
Sep 8, 2026
Merged

fix(uploads): unblock browser PUTs to the reports bucket #402

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
563b38e
fix(uploads): unblock browser PUTs to the reports bucket
nourshoreibah Sep 8, 2026
197f3e2
chore: trim comments
nourshoreibah Sep 8, 2026
72b6eb4
chore: auto-format terraform and update documentation
github-actions[bot] Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion apps/backend/lambdas/expenditures/services/expenditures.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ import { applyExpenditureScope, type ExpenditureScope } from './scope';

const REGION = process.env.AWS_REGION ?? 'us-east-2';
const BUCKET = process.env.REPORTS_BUCKET_NAME ?? '';
const s3 = new S3Client({ region: REGION });
// SDK default signs a checksum of the presigner's empty body; real bytes then fail the PUT.
const s3 = new S3Client({ region: REGION, requestChecksumCalculation: 'WHEN_REQUIRED' });

// Receipts are PDFs only, matching the dropzone in AddExpenseModal.
export const RECEIPT_CONTENT_TYPE = 'application/pdf';
Expand Down
5 changes: 4 additions & 1 deletion apps/backend/lambdas/reports/controllers/reports.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,10 @@ import {
getObjectSize,
} from '../report-service';

const s3 = new S3Client({ region: process.env.AWS_REGION ?? 'us-east-2' });
const s3 = new S3Client({
region: process.env.AWS_REGION ?? 'us-east-2',
requestChecksumCalculation: 'WHEN_REQUIRED',
});
const BUCKET = process.env.REPORTS_BUCKET_NAME ?? '';

const ALLOWED_EXTENSIONS = ['pdf', 'docx'] as const;
Expand Down
2 changes: 1 addition & 1 deletion apps/backend/lambdas/users/photos.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ import { reportError } from '@branch/lambda-http';

const REGION = process.env.AWS_REGION ?? 'us-east-2';
const BUCKET = process.env.REPORTS_BUCKET_NAME ?? '';
const s3 = new S3Client({ region: REGION });
const s3 = new S3Client({ region: REGION, requestChecksumCalculation: 'WHEN_REQUIRED' });

/** Profile photos share the reports bucket, under their own prefix. */
export const AVATAR_PREFIX = 'avatars/';
Expand Down
1 change: 1 addition & 0 deletions infrastructure/aws/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,7 @@
| [aws_s3_bucket.frontend](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket.lambda_deployments](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket.reports_bucket](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket_cors_configuration.reports_bucket_cors](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/s3_bucket_cors_configuration) | resource |
| [aws_s3_bucket_policy.frontend](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/s3_bucket_policy) | resource |
| [aws_s3_bucket_public_access_block.frontend](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/s3_bucket_public_access_block) | resource |
| [aws_s3_bucket_public_access_block.reports_bucket_public_access](https://registry.terraform.io/providers/hashicorp/aws/6.14.1/docs/resources/s3_bucket_public_access_block) | resource |
Expand Down
15 changes: 15 additions & 0 deletions infrastructure/aws/s3.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,21 @@ resource "aws_s3_bucket_public_access_block" "reports_bucket_public_access" {
restrict_public_buckets = true
}

resource "aws_s3_bucket_cors_configuration" "reports_bucket_cors" {
bucket = aws_s3_bucket.reports_bucket.id

cors_rule {
allowed_methods = ["PUT"]
allowed_headers = ["content-type"]
max_age_seconds = 7200

allowed_origins = compact([
"https://${aws_cloudfront_distribution.frontend.domain_name}",
local.attach_dns ? "https://${var.app_domain}" : "",
])
}
}

output "reports_bucket_name" {
description = "Name of the S3 bucket for generated reports"
value = aws_s3_bucket.reports_bucket.id
Expand Down
Loading