feat: setup s3 util funcs

packages/api/package.json

@@ -35,6 +35,8 @@
     "typecheck": "tsc --noEmit --emitDeclarationOnly false"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.802.0",
+    "@aws-sdk/s3-request-presigner": "^3.812.0",
     "@kan/auth": "workspace:*",
     "@kan/db": "workspace:*",
     "@kan/email": "workspace:^",

packages/api/src/utils/s3.ts

@@ -0,0 +1,53 @@
+import {
+  GetObjectCommand,
+  PutObjectCommand,
+  S3Client,
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+
+export function createS3Client() {
+  return new S3Client({
+    region: process.env.S3_REGION ?? "",
+    endpoint: process.env.S3_ENDPOINT ?? "",
+    forcePathStyle: process.env.S3_FORCE_PATH_STYLE === "true",
+    credentials: {
+      accessKeyId: process.env.S3_ACCESS_KEY_ID ?? "",
+      secretAccessKey: process.env.S3_SECRET_ACCESS_KEY ?? "",
+    },
+  });
+}
+
+export async function generateUploadUrl(
+  bucket: string,
+  key: string,
+  contentType: string,
+  expiresIn = 3600,
+) {
+  const client = createS3Client();
+  return getSignedUrl(
+    client,
+    new PutObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      ContentType: contentType,
+      // Don't set ACL for private files
+    }),
+    { expiresIn },
+  );
+}
+
+export async function generateDownloadUrl(
+  bucket: string,
+  key: string,
+  expiresIn = 3600,
+) {
+  const client = createS3Client();
+  return getSignedUrl(
+    client,
+    new GetObjectCommand({
+      Bucket: bucket,
+      Key: key,
+    }),
+    { expiresIn },
+  );
+}