Global Guard
Request-level policy hook executing before all operations and plugin endpoints.
guard is defined on dimahS3() and executes on every incoming request prior to route resolution or plugin execution.
Use it for system-wide checks like user authentication, IP filtering, or tenant context.
import { S3Client } from "@aws-sdk/client-s3";
import { dimahS3, errors, route } from "@dimah-s3/server";
export const awsS3 = new S3Client({/* env */});
export const s3 = dimahS3({
client: awsS3,
bucket: process.env.S3_BUCKET!,
guard: async ({ request }) => {
const session = await getSession(request);
if (!session) throw errors.unauthorized();
},
routes: {
avatar: route({
upload: {
fileTypes: ["image/*"],
maxFileSize: 2 * 1024 * 1024,
},
}),
},
});Guard context
The global guard receives the raw request object. Route name and target key are resolved later in the lifecycle.
import type { GuardContext, RouteGuardContext } from "@dimah-s3/server";Prop
Type
Frequently asked questions
If your application has public routes (e.g. public media upload) and protected routes (e.g. private invoices), leave the global guard empty and apply guard on specific routes:
export const s3 = dimahS3({
routes: {
publicMedia: route({
upload: true,
}),
avatar: route({
guard: requireUserSession,
upload: true,
}),
},
});On the client, pass headers in createS3Client:
export const s3Client = createS3Client({
headers: async () => ({
Authorization: `Bearer ${await getToken()}`,
}),
});