feat: add receipts endpoint

stacks/ucan-invocation-stack.js

@@ -36,6 +36,9 @@ export function UcanInvocationStack({ stack, app }) {
       bucket: getBucketConfig('workflow-store', app.stage)
     }
   })
+  // Without arguments, this method will grant read ("s3:GetObject") access to all objects ("*") in the bucket.
+  workflowBucket.cdk.bucket.grantPublicAccess()
+
   const invocationBucket = new Bucket(stack, 'invocation-store', {
     cors: true,
     cdk: {

stacks/upload-api-stack.js

@@ -121,6 +121,7 @@ export function UploadApiStack({ stack, app }) {
       'GET /error':   'functions/get.error',
       'GET /version': 'functions/get.version',
       'GET /metrics': 'functions/metrics.handler',
+      'GET /receipt/{taskCid}': 'functions/receipt.handler',
       'GET /storefront-cron': 'functions/storefront-cron.handler',
       // AWS API Gateway does not know trailing slash... and Grafana Agent puts trailing slash
       'GET /metrics/{proxy+}': 'functions/metrics.handler',

upload-api/buckets/invocation-store.js

@@ -116,12 +116,12 @@ export const useInvocationStore = (s3client, bucketName) => {
       })
       const listObject = await s3client.send(listObjectCmd)
       const carEntry = listObject.Contents?.find(
-        content => content.Key?.endsWith('.workflow')
+        content => content.Key?.endsWith('.out')
       )
       if (!carEntry) {
         return
       }
-      return carEntry.Key?.replace(prefix, '').replace('.workflow', '')
+      return carEntry.Key?.replace(prefix, '').replace('.out', '')
     }
   }
 }

upload-api/functions/receipt.js

@@ -0,0 +1,57 @@
+import * as Sentry from '@sentry/serverless'
+import { parseLink } from '@ucanto/server'
+
+import { createInvocationStore } from '../buckets/invocation-store.js'
+import { mustGetEnv } from './utils.js'
+
+Sentry.AWSLambda.init({
+  environment: process.env.SST_STAGE,
+  dsn: process.env.SENTRY_DSN,
+  tracesSampleRate: 1.0,
+})
+
+const AWS_REGION = process.env.AWS_REGION || 'us-west-2'
+
+/**
+ * AWS HTTP Gateway handler for GET /receipt.
+ *
+ * @param {import('aws-lambda').APIGatewayProxyEventV2} event
+ */
+export async function receiptGet (event) {
+  const {
+    invocationBucketName,
+    workflowBucketName,
+  } = getLambdaEnv()
+  const invocationBucket = createInvocationStore(
+    AWS_REGION,
+    invocationBucketName
+  )
+
+  if (!event.pathParameters?.taskCid) {
+    return {
+      statusCode: 400,
+      body: Buffer.from(`no task cid received`).toString('base64'),
+    }
+  }
+  const taskCid = parseLink(event.pathParameters.taskCid)
+
+  const workflowLinkWithReceipt = await invocationBucket.getWorkflowLink(taskCid.toString())
+  const url = `https://${workflowBucketName}.s3.${AWS_REGION}.amazonaws.com/${workflowLinkWithReceipt}/${workflowLinkWithReceipt}`
+
+  // redirect to bucket
+  return {
+    statusCode: 302,
+    headers: {
+      Location: url
+    }
+  }
+}
+
+function getLambdaEnv () {
+  return {
+    invocationBucketName: mustGetEnv('INVOCATION_BUCKET_NAME'),
+    workflowBucketName: mustGetEnv('WORKFLOW_BUCKET_NAME'),
+  }
+}
+
+export const handler = Sentry.AWSLambda.wrapHandler(receiptGet)

upload-api/types.ts

@@ -5,6 +5,9 @@ import { CID } from 'multiformats/cid'
 import { Kinesis } from '@aws-sdk/client-kinesis'
 import { AccountDID, ProviderDID, Service, SpaceDID } from '@web3-storage/upload-api'
 
+export interface StoreOperationError extends Error {
+  name: 'StoreOperationFailed'
+}
 
 export interface UcanLogCtx extends WorkflowCtx, ReceiptBlockCtx {
   basicAuth: string