Add safe archive preview and extraction workflows

src/govoplan_files/backend/storage/backends.py

@@ -145,28 +145,35 @@ class S3StorageBackend:
     region_name: str
     access_key_id: str
     secret_access_key: str
+    deployment_managed: bool = False
     name: str = "s3"
 
     @property
     def client(self):
-        try:
-            endpoint_url = validate_unpinned_sdk_http_url(
-                self.endpoint_url,
-                label="File storage S3 endpoint",
-            )
-        except OutboundHttpError as exc:
-            raise StorageBackendError(str(exc)) from exc
+        if self.deployment_managed:
+            endpoint_url = _deployment_managed_garage_endpoint(self.endpoint_url)
+        else:
+            try:
+                endpoint_url = validate_unpinned_sdk_http_url(
+                    self.endpoint_url,
+                    label="File storage S3 endpoint",
+                )
+            except OutboundHttpError as exc:
+                raise StorageBackendError(str(exc)) from exc
         try:
             import boto3
+            from botocore.config import Config
         except ModuleNotFoundError as exc:
             raise StorageBackendError("boto3 is required for the S3 storage backend") from exc
-        return boto3.client(
-            "s3",
-            endpoint_url=endpoint_url,
-            region_name=self.region_name,
-            aws_access_key_id=self.access_key_id,
-            aws_secret_access_key=self.secret_access_key,
-        )
+        options: dict[str, object] = {
+            "endpoint_url": endpoint_url,
+            "region_name": self.region_name,
+            "aws_access_key_id": self.access_key_id,
+            "aws_secret_access_key": self.secret_access_key,
+        }
+        if self.deployment_managed:
+            options["config"] = Config(s3={"addressing_style": "path"})
+        return boto3.client("s3", **options)
 
     def put_bytes(self, key: str, data: bytes, *, content_type: str | None = None) -> None:
         max_bytes = response_limit("file")
@@ -303,6 +310,15 @@ def _s3_missing_error(exc: Exception) -> bool:
     return code in {"404", "NoSuchKey", "NotFound"} or status_code == 404
 
 
+def _deployment_managed_garage_endpoint(value: str) -> str:
+    endpoint = str(value or "").strip()
+    if endpoint != "http://garage:3900":
+        raise StorageBackendError(
+            "Deployment-managed S3 trust is restricted to http://garage:3900"
+        )
+    return endpoint
+
+
 def _fallback_roots() -> tuple[Path, ...]:
     raw = getattr(settings, "file_storage_local_fallback_roots", "") or ""
     return tuple(Path(item.strip()) for item in str(raw).split(",") if item.strip())
@@ -319,5 +335,12 @@ def get_storage_backend() -> StorageBackend:
             region_name=settings.file_storage_s3_region or settings.s3_region,
             access_key_id=settings.file_storage_s3_access_key_id or settings.s3_access_key_id,
             secret_access_key=settings.file_storage_s3_secret_access_key or settings.s3_secret_access_key,
+            deployment_managed=bool(
+                getattr(
+                    settings,
+                    "file_storage_s3_deployment_managed",
+                    False,
+                )
+            ),
         )
     raise StorageBackendError(f"Unsupported file storage backend: {settings.file_storage_backend}")