Function validateEventS3Uris

packages/aws-lambda/src/handler.ts:503–517

* Verify every S3 URI in the event resolves to the configured render bucket. * Throws `S3_URI_NOT_ALLOWED` (non-retryable) when a URI targets a different * bucket, preventing event injection from reading or writing arbitrary S3 data. * * Skipped when `HYPERFRAMES_RENDER_BUCKET` is unset so exist

(event: PlanEvent | RenderChunkEvent | AssembleEvent)

 * without the env var continue to work.
 */
function validateEventS3Uris(event: PlanEvent | RenderChunkEvent | AssembleEvent): void {
  const allowedBucket = process.env.HYPERFRAMES_RENDER_BUCKET?.trim();
  if (!allowedBucket) return;

  for (const uri of getEventS3Uris(event)) {
    const { bucket } = parseS3Uri(uri);
    if (bucket !== allowedBucket) {
      const err = new Error(
        `[handler] S3_URI_NOT_ALLOWED: URI ${JSON.stringify(uri)} targets bucket "${bucket}" but only "${allowedBucket}" is permitted`,
      );
      err.name = "S3_URI_NOT_ALLOWED";
      throw err;
    }
  }
}

function pad(n: number): string {
  return n.toString().padStart(4, "0");