Global Guard
Request-level policy hook that runs before all operations and plugin endpoints.
Define guard on dimahS3() to run it for every incoming request before
route resolution or plugin execution.
Use it for system-wide checks like user authentication, IP filtering, or tenant context.
A signed-in session here does not prove the caller owns a particular object
key — that belongs on download.guard / delete.guard or db(). See
Security.
import { S3Client } from "@aws-sdk/client-s3";
import { dimahS3, errors, route } from "@dimah-s3/server";
export const awsS3 = new S3Client({/* env */});
export const s3 = dimahS3({
client: awsS3,
bucket: process.env.S3_BUCKET!,
guard: async ({ request }) => {
const session = await getSession(request);
if (!session) throw errors.unauthorized();
},
routes: {
avatar: route({
upload: {
fileTypes: ["image/*"],
maxFileSize: 2 * 1024 * 1024,
},
}),
},
});Guard context
The global guard receives the raw request object. Route name and target key are resolved later in the lifecycle.
import type { GuardContext } from "@dimah-s3/server";Prop
Type
Frequently asked questions
Use route.guard when only some routes need the policy. For example, an app
with public media uploads and private invoices can leave the global guard
unset and protect specific routes:
export const s3 = dimahS3({
routes: {
publicMedia: route({
upload: true,
}),
avatar: route({
guard: requireUserSession,
upload: true,
}),
},
});Configure headers in createS3Client:
export const s3Client = createS3Client({
headers: async () => ({
Authorization: `Bearer ${await getToken()}`,
}),
});