{"action":"created","comment":{"url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/comments/26134537","id":26134537,"diff_hunk":"@@ -424,6 +427,120 @@ api.declare({\n   });\n });\n \n+api.declare({\n+  method:     'get',\n+  route:      '/aws/s3/:level/:bucket/:prefix(*)',\n+  name:       'awsS3Credentials',\n+  input:      undefined,\n+  output:     SCHEMA_PREFIX_CONST + 'aws-s3-credentials-response.json#',\n+  deferAuth:  true,\n+  scopes:     ['auth:aws-s3:<level>:<bucket>/<prefix>'],\n+  title:      \"Get Temporary Read/Write Credentials S3\",\n+  description: [\n+    \"Get temporary AWS credentials for `read-write` or `read-only` access to\",\n+    \"a given `bucket` and `prefix` within that bucket.\",\n+    \"The `level` parameter can be `read-write` or `read-only` and determines\",\n+    \"which type of credentials is returned. Please note that the `level`\",\n+    \"parameter is required in the scope guarding access.\",\n+    \"\",\n+    \"The credentials are set of expire after an hour, but this behavior may be\",\n+    \"subject to change. Hence, you should always read the `expires` property\",\n+    \"from the response, if you intent to maintain active credentials in your\",\n+    \"application.\",\n+    \"\",\n+    \"Please notice that your `prefix` shouldn't start with slash `/`, it is\",\n+    \"allowed for completeness, but it will result in two slashes both in the\",\n+    \"scope and in the bucket. Therefore this pattern is strongly discouraged.\",\n+    \"Also note that if your `prefix` doesn't end in a slash `/` you will not\",\n+    \"be required to insert one. This is mainly a concern when assigning scopes\",\n+    \"to users and doing this right will prevent poor behavior.\"\n+  ].join('\\n')\n+}, function(req, res) {\n+  var level   = req.params.level;\n+  var bucket  = req.params.bucket;\n+  var prefix  = req.params.prefix;\n+\n+  // Validate that a proper value was given for level\n+  if (level !== 'read-write' && level !== 'read-only') {\n+    return res.status(400).json({\n+      message:      \"the 'level' URL parameter must be read-only or read-write\",\n+      levelGiven:   level\n+    });\n+  }\n+\n+  // Check that the client is authorized to access given bucket and prefix\n+  if (!req.satisfies({\n+    level:      level,\n+    bucket:     bucket,\n+    prefix:     prefix\n+  })) {\n+    return;\n+  }\n+\n+  return this.sts.getFederationToken({\n+    Name:               'TemporaryS3ReadWriteCredentials',\n+    Policy:             JSON.stringify({\n+      Version:          '2012-10-17',\n+      Statement:[\n+        {\n+          Sid:            'ReadWriteObjectsUnderPrefix',\n+          Effect:         'Allow',\n+          Action:         (level === 'read-write' ? [\n+            's3:GetObject',\n+            's3:PutObject',\n+            's3:DeleteObject'\n+          ] : [\n+            's3:GetObject'\n+          ]),\n+          Resource: [\n+            'arn:aws:s3:::{{bucket}}/{{prefix}}*'\n+              .replace('{{bucket}}', bucket)\n+              .replace('{{prefix}}', prefix)\n+          ]\n+        }, {\n+          Sid:            'ListObjectsUnderPrefix',\n+          Effect:         'Allow',\n+          Action: [\n+            's3:ListBucket'\n+          ],\n+          Resource: [\n+            'arn:aws:s3:::{{bucket}}'\n+              .replace('{{bucket}}', bucket)\n+          ],\n+          Condition: {\n+            StringLike: {\n+              's3:prefix': [\n+                '{{prefix}}*'.replace('{{prefix}}', prefix)\n+              ]\n+            }\n+          }\n+        }, {\n+          Sid:            'GetBucketLocation',\n+          Effect:         'Allow',\n+          Action: [\n+            's3:GetBucketLocation'\n+          ],\n+          Resource: [\n+            'arn:aws:s3:::{{bucket}}'\n+              .replace('{{bucket}}', bucket)\n+          ]\n+        }\n+      ]\n+    }),","path":"routes/api/v1.js","position":115,"original_position":115,"commit_id":"77441ff3cb88a862f46c6e02a6eb31a54794e290","original_commit_id":"77441ff3cb88a862f46c6e02a6eb31a54794e290","user":{"login":"jhford","id":607353,"avatar_url":"https://avatars.githubusercontent.com/u/607353?v=3","gravatar_id":"","url":"https://api.github.com/users/jhford","html_url":"https://github.com/jhford","followers_url":"https://api.github.com/users/jhford/followers","following_url":"https://api.github.com/users/jhford/following{/other_user}","gists_url":"https://api.github.com/users/jhford/gists{/gist_id}","starred_url":"https://api.github.com/users/jhford/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhford/subscriptions","organizations_url":"https://api.github.com/users/jhford/orgs","repos_url":"https://api.github.com/users/jhford/repos","events_url":"https://api.github.com/users/jhford/events{/privacy}","received_events_url":"https://api.github.com/users/jhford/received_events","type":"User","site_admin":false},"body":"I'm not sure if all this stuff is correct... how sure are you with it?","created_at":"2015-03-10T15:53:42Z","updated_at":"2015-03-10T15:53:42Z","html_url":"https://github.com/taskcluster/taskcluster-auth/pull/2#discussion_r26134537","pull_request_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2","_links":{"self":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/comments/26134537"},"html":{"href":"https://github.com/taskcluster/taskcluster-auth/pull/2#discussion_r26134537"},"pull_request":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2"}}},"pull_request":{"url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2","id":29782479,"html_url":"https://github.com/taskcluster/taskcluster-auth/pull/2","diff_url":"https://github.com/taskcluster/taskcluster-auth/pull/2.diff","patch_url":"https://github.com/taskcluster/taskcluster-auth/pull/2.patch","issue_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/2","number":2,"state":"open","locked":false,"title":"S3 delegation api","user":{"login":"jonasfj","id":149732,"avatar_url":"https://avatars.githubusercontent.com/u/149732?v=3","gravatar_id":"","url":"https://api.github.com/users/jonasfj","html_url":"https://github.com/jonasfj","followers_url":"https://api.github.com/users/jonasfj/followers","following_url":"https://api.github.com/users/jonasfj/following{/other_user}","gists_url":"https://api.github.com/users/jonasfj/gists{/gist_id}","starred_url":"https://api.github.com/users/jonasfj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonasfj/subscriptions","organizations_url":"https://api.github.com/users/jonasfj/orgs","repos_url":"https://api.github.com/users/jonasfj/repos","events_url":"https://api.github.com/users/jonasfj/events{/privacy}","received_events_url":"https://api.github.com/users/jonasfj/received_events","type":"User","site_admin":false},"body":"See bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1127126","created_at":"2015-02-23T02:09:15Z","updated_at":"2015-03-10T15:53:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d058a8fa82eb28b71ff092f0b056602f6fd9195f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2/commits","review_comments_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2/comments","review_comment_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/comments{/number}","comments_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/2/comments","statuses_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/statuses/77441ff3cb88a862f46c6e02a6eb31a54794e290","head":{"label":"taskcluster:s3-delegation-api","ref":"s3-delegation-api","sha":"77441ff3cb88a862f46c6e02a6eb31a54794e290","user":{"login":"taskcluster","id":6257436,"avatar_url":"https://avatars.githubusercontent.com/u/6257436?v=3","gravatar_id":"","url":"https://api.github.com/users/taskcluster","html_url":"https://github.com/taskcluster","followers_url":"https://api.github.com/users/taskcluster/followers","following_url":"https://api.github.com/users/taskcluster/following{/other_user}","gists_url":"https://api.github.com/users/taskcluster/gists{/gist_id}","starred_url":"https://api.github.com/users/taskcluster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taskcluster/subscriptions","organizations_url":"https://api.github.com/users/taskcluster/orgs","repos_url":"https://api.github.com/users/taskcluster/repos","events_url":"https://api.github.com/users/taskcluster/events{/privacy}","received_events_url":"https://api.github.com/users/taskcluster/received_events","type":"Organization","site_admin":false},"repo":{"id":20000474,"name":"taskcluster-auth","full_name":"taskcluster/taskcluster-auth","owner":{"login":"taskcluster","id":6257436,"avatar_url":"https://avatars.githubusercontent.com/u/6257436?v=3","gravatar_id":"","url":"https://api.github.com/users/taskcluster","html_url":"https://github.com/taskcluster","followers_url":"https://api.github.com/users/taskcluster/followers","following_url":"https://api.github.com/users/taskcluster/following{/other_user}","gists_url":"https://api.github.com/users/taskcluster/gists{/gist_id}","starred_url":"https://api.github.com/users/taskcluster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taskcluster/subscriptions","organizations_url":"https://api.github.com/users/taskcluster/orgs","repos_url":"https://api.github.com/users/taskcluster/repos","events_url":"https://api.github.com/users/taskcluster/events{/privacy}","received_events_url":"https://api.github.com/users/taskcluster/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/taskcluster/taskcluster-auth","description":"Authentication and authorization manager for taskcluster","fork":false,"url":"https://api.github.com/repos/taskcluster/taskcluster-auth","forks_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/forks","keys_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/teams","hooks_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/hooks","issue_events_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/events{/number}","events_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/events","assignees_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/assignees{/user}","branches_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/branches{/branch}","tags_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/tags","blobs_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/languages","stargazers_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/stargazers","contributors_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/contributors","subscribers_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/subscribers","subscription_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/subscription","commits_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/contents/{+path}","compare_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/merges","archive_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/downloads","issues_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues{/number}","pulls_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/labels{/name}","releases_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/releases{/id}","created_at":"2014-05-20T22:55:57Z","updated_at":"2015-01-20T17:39:35Z","pushed_at":"2015-02-23T02:08:45Z","git_url":"git://github.com/taskcluster/taskcluster-auth.git","ssh_url":"git@github.com:taskcluster/taskcluster-auth.git","clone_url":"https://github.com/taskcluster/taskcluster-auth.git","svn_url":"https://github.com/taskcluster/taskcluster-auth","homepage":null,"size":10388,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"taskcluster:master","ref":"master","sha":"ce0629817d80861dc2046523ca7b7f8a6f70ee86","user":{"login":"taskcluster","id":6257436,"avatar_url":"https://avatars.githubusercontent.com/u/6257436?v=3","gravatar_id":"","url":"https://api.github.com/users/taskcluster","html_url":"https://github.com/taskcluster","followers_url":"https://api.github.com/users/taskcluster/followers","following_url":"https://api.github.com/users/taskcluster/following{/other_user}","gists_url":"https://api.github.com/users/taskcluster/gists{/gist_id}","starred_url":"https://api.github.com/users/taskcluster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taskcluster/subscriptions","organizations_url":"https://api.github.com/users/taskcluster/orgs","repos_url":"https://api.github.com/users/taskcluster/repos","events_url":"https://api.github.com/users/taskcluster/events{/privacy}","received_events_url":"https://api.github.com/users/taskcluster/received_events","type":"Organization","site_admin":false},"repo":{"id":20000474,"name":"taskcluster-auth","full_name":"taskcluster/taskcluster-auth","owner":{"login":"taskcluster","id":6257436,"avatar_url":"https://avatars.githubusercontent.com/u/6257436?v=3","gravatar_id":"","url":"https://api.github.com/users/taskcluster","html_url":"https://github.com/taskcluster","followers_url":"https://api.github.com/users/taskcluster/followers","following_url":"https://api.github.com/users/taskcluster/following{/other_user}","gists_url":"https://api.github.com/users/taskcluster/gists{/gist_id}","starred_url":"https://api.github.com/users/taskcluster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taskcluster/subscriptions","organizations_url":"https://api.github.com/users/taskcluster/orgs","repos_url":"https://api.github.com/users/taskcluster/repos","events_url":"https://api.github.com/users/taskcluster/events{/privacy}","received_events_url":"https://api.github.com/users/taskcluster/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/taskcluster/taskcluster-auth","description":"Authentication and authorization manager for taskcluster","fork":false,"url":"https://api.github.com/repos/taskcluster/taskcluster-auth","forks_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/forks","keys_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/teams","hooks_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/hooks","issue_events_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/events{/number}","events_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/events","assignees_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/assignees{/user}","branches_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/branches{/branch}","tags_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/tags","blobs_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/languages","stargazers_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/stargazers","contributors_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/contributors","subscribers_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/subscribers","subscription_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/subscription","commits_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/contents/{+path}","compare_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/merges","archive_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/downloads","issues_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues{/number}","pulls_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/labels{/name}","releases_url":"https://api.github.com/repos/taskcluster/taskcluster-auth/releases{/id}","created_at":"2014-05-20T22:55:57Z","updated_at":"2015-01-20T17:39:35Z","pushed_at":"2015-02-23T02:08:45Z","git_url":"git://github.com/taskcluster/taskcluster-auth.git","ssh_url":"git@github.com:taskcluster/taskcluster-auth.git","clone_url":"https://github.com/taskcluster/taskcluster-auth.git","svn_url":"https://github.com/taskcluster/taskcluster-auth","homepage":null,"size":10388,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2"},"html":{"href":"https://github.com/taskcluster/taskcluster-auth/pull/2"},"issue":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/2"},"comments":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/issues/2/comments"},"review_comments":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2/comments"},"review_comment":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/pulls/2/commits"},"statuses":{"href":"https://api.github.com/repos/taskcluster/taskcluster-auth/statuses/77441ff3cb88a862f46c6e02a6eb31a54794e290"}}}}