Surface bucket in audit records and stop blocking the presign Upload button

Audit lines now carry a bucket field next to namespace — both as a
LogRecord extra and as a bucket=<name> token sitting right after
namespace= in the message body. The blueprint's url_value_preprocessor
parks the active viewer's bucket name on g.FSV_AUDIT_BUCKET and emit()
picks it up automatically, so the value rides alongside request_id for
free. Out-of-request emits fall back to an empty bucket so JSON
pipelines see a consistent shape. The sanitiser and length cap apply
to the new field the same way they do to namespace.

The presign upload form no longer blocks the Upload button on a chain
of HEAD + sign round-trips. Selecting files just renders the chips and
the Upload button immediately; the presign batch is fetched on click
with a brief "Preparing…" spinner and a re-click guard. The core JS
keeps the same public surface — only _upload_form.html changed — and
the default (multipart) upload path is untouched.

Tests grow a TestBucketField suite and a multi-namespace assertion;
docs note the new field, the message-token order, and the new
presign-mode UX. The change is grouped under the existing 1.1.0
unreleased block in CHANGELOG.

Author: hidekuma

CHANGELOG.md

@@ -39,6 +39,13 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
   `req=<id>` token appended to the human-readable message body.
   Outside a request context every `emit()` gets a fresh id. The
   `emit()` public signature is unchanged.
+- Audit records now include a `bucket` field (record extra +
+  `bucket=<name>` message token) reflecting the viewer's S3 bucket
+  name. The blueprint's `url_value_preprocessor` resolves the bucket
+  once per request so every audit row carries it without any
+  per-view bookkeeping; emits from outside a request context yield an
+  empty bucket unless the caller pre-sets `g.FSV_AUDIT_BUCKET`. The
+  `emit()` public signature is unchanged.
 
 **Changed**
 
@@ -62,6 +69,18 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
   `file_list` presign, invalid prefix, denied auth) still emit a
   single prefix-keyed row. The `emit()` public signature is unchanged;
   only the per-request emit count grew (1 → N).
+- `upload_type='presign'` mode no longer pre-issues conflict-check
+  presign URLs at file-selection time. The previous flow walked every
+  selected file through a serial `post_presign` round-trip before any
+  chip rendered, so picking N files incurred N sequential S3 / signer
+  hops before the user could even see what they had staged. Chips and
+  the Upload button now appear immediately after the file picker
+  resolves; presign URL issuance is deferred to the Upload click.
+  Conflict (HTTP 409) and permission-denied (HTTP 403) dialogs
+  therefore surface after Upload instead of after file selection.
+  `default` upload mode is unaffected. `core.js` public surface
+  (`readyFileHandling`, `uploadFiles`, `preventDefaults`) is unchanged
+  — only `_upload_form.html` was touched.
 
 **Fixed**
 

docs/doctrees/changelog.doctree

@@ -438,6 +438,11 @@ exceptions emit at ``ERROR``.
   - ``action`` — one of ``list``, ``download``, ``upload``, ``delete``,
     ``presign``
   - ``namespace`` — viewer namespace the request landed on
+  - ``bucket`` — S3 bucket name resolved from the viewer config for the
+    current request. Populated automatically by the blueprint's
+    ``url_value_preprocessor``; the empty string when ``emit()`` is
+    called outside a Flask request context unless the caller pre-sets
+    ``g.FSV_AUDIT_BUCKET`` themselves.
   - ``key`` — canonical S3 key / prefix (post-``base_path``)
   - ``user`` — authenticated email or the literal string ``anonymous``
   - ``result`` — ``ok`` / ``denied`` / ``error``
@@ -458,8 +463,9 @@ The human-readable message is a single space-separated key=value line:
 
 .. code-block:: text
 
-    action=download namespace=fsv-test key=docs/report.pdf
-    user=alice@example.com result=ok status=200 req=a1b2c3d4
+    action=download namespace=fsv-test bucket=fsv-bucket
+    key=docs/report.pdf user=alice@example.com result=ok status=200
+    req=a1b2c3d4
 
 Newlines, carriage returns, and other ASCII control bytes inside
 attacker-controllable fields (key, email, User-Agent, exception
@@ -510,7 +516,7 @@ one request produce one row, not two.
     audit_handler = logging.FileHandler('/var/log/flask_s3_viewer/audit.jsonl')
     audit_handler.setFormatter(jsonlogger.JsonFormatter(
         '%(asctime)s %(levelname)s %(action)s %(namespace)s '
-        '%(key)s %(user)s %(result)s %(status_code)s '
+        '%(bucket)s %(key)s %(user)s %(result)s %(status_code)s '
         '%(client_ip)s %(user_agent)s'
     ))
     audit = logging.getLogger('flask_s3_viewer.audit')

docs/doctrees/environment.pickle

@@ -145,6 +145,13 @@ <h2>[1.1.0] - unreleased<a class="headerlink" href="#unreleased" title="Link to
 <code class="docutils literal notranslate"><span class="pre">req=&lt;id&gt;</span></code> token appended to the human-readable message body.
 Outside a request context every <code class="docutils literal notranslate"><span class="pre">emit()</span></code> gets a fresh id. The
 <code class="docutils literal notranslate"><span class="pre">emit()</span></code> public signature is unchanged.</p></li>
+<li><p>Audit records now include a <code class="docutils literal notranslate"><span class="pre">bucket</span></code> field (record extra +
+<code class="docutils literal notranslate"><span class="pre">bucket=&lt;name&gt;</span></code> message token) reflecting the viewer’s S3 bucket
+name. The blueprint’s <code class="docutils literal notranslate"><span class="pre">url_value_preprocessor</span></code> resolves the bucket
+once per request so every audit row carries it without any
+per-view bookkeeping; emits from outside a request context yield an
+empty bucket unless the caller pre-sets <code class="docutils literal notranslate"><span class="pre">g.FSV_AUDIT_BUCKET</span></code>. The
+<code class="docutils literal notranslate"><span class="pre">emit()</span></code> public signature is unchanged.</p></li>
 </ul>
 <p><strong>Changed</strong></p>
 <ul class="simple">

docs/doctrees/usage/configuration.doctree

@@ -470,6 +470,11 @@ <h2>Audit logging<a class="headerlink" href="#audit-logging" title="Link to this
 <li><p><code class="docutils literal notranslate"><span class="pre">action</span></code> — one of <code class="docutils literal notranslate"><span class="pre">list</span></code>, <code class="docutils literal notranslate"><span class="pre">download</span></code>, <code class="docutils literal notranslate"><span class="pre">upload</span></code>, <code class="docutils literal notranslate"><span class="pre">delete</span></code>,
 <code class="docutils literal notranslate"><span class="pre">presign</span></code></p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">namespace</span></code> — viewer namespace the request landed on</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">bucket</span></code> — S3 bucket name resolved from the viewer config for the
+current request. Populated automatically by the blueprint’s
+<code class="docutils literal notranslate"><span class="pre">url_value_preprocessor</span></code>; the empty string when <code class="docutils literal notranslate"><span class="pre">emit()</span></code> is
+called outside a Flask request context unless the caller pre-sets
+<code class="docutils literal notranslate"><span class="pre">g.FSV_AUDIT_BUCKET</span></code> themselves.</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">key</span></code> — canonical S3 key / prefix (post-<code class="docutils literal notranslate"><span class="pre">base_path</span></code>)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">user</span></code> — authenticated email or the literal string <code class="docutils literal notranslate"><span class="pre">anonymous</span></code></p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">result</span></code> — <code class="docutils literal notranslate"><span class="pre">ok</span></code> / <code class="docutils literal notranslate"><span class="pre">denied</span></code> / <code class="docutils literal notranslate"><span class="pre">error</span></code></p></li>
@@ -488,8 +493,9 @@ <h2>Audit logging<a class="headerlink" href="#audit-logging" title="Link to this
 </ul>
 </div></blockquote>
 <p>The human-readable message is a single space-separated key=value line:</p>
-<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>action=download namespace=fsv-test key=docs/report.pdf
-user=alice@example.com result=ok status=200 req=a1b2c3d4
+<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>action=download namespace=fsv-test bucket=fsv-bucket
+key=docs/report.pdf user=alice@example.com result=ok status=200
+req=a1b2c3d4
 </pre></div>
 </div>
 <p>Newlines, carriage returns, and other ASCII control bytes inside
@@ -531,7 +537,7 @@ <h2>Audit logging<a class="headerlink" href="#audit-logging" title="Link to this
 <span class="linenos"> 4</span><span class="n">audit_handler</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">FileHandler</span><span class="p">(</span><span class="s1">&#39;/var/log/flask_s3_viewer/audit.jsonl&#39;</span><span class="p">)</span>
 <span class="linenos"> 5</span><span class="n">audit_handler</span><span class="o">.</span><span class="n">setFormatter</span><span class="p">(</span><span class="n">jsonlogger</span><span class="o">.</span><span class="n">JsonFormatter</span><span class="p">(</span>
 <span class="linenos"> 6</span>    <span class="s1">&#39;</span><span class="si">%(asctime)s</span><span class="s1"> </span><span class="si">%(levelname)s</span><span class="s1"> </span><span class="si">%(action)s</span><span class="s1"> </span><span class="si">%(namespace)s</span><span class="s1"> &#39;</span>
-<span class="linenos"> 7</span>    <span class="s1">&#39;</span><span class="si">%(key)s</span><span class="s1"> </span><span class="si">%(user)s</span><span class="s1"> </span><span class="si">%(result)s</span><span class="s1"> </span><span class="si">%(status_code)s</span><span class="s1"> &#39;</span>
+<span class="linenos"> 7</span>    <span class="s1">&#39;</span><span class="si">%(bucket)s</span><span class="s1"> </span><span class="si">%(key)s</span><span class="s1"> </span><span class="si">%(user)s</span><span class="s1"> </span><span class="si">%(result)s</span><span class="s1"> </span><span class="si">%(status_code)s</span><span class="s1"> &#39;</span>
 <span class="linenos"> 8</span>    <span class="s1">&#39;</span><span class="si">%(client_ip)s</span><span class="s1"> </span><span class="si">%(user_agent)s</span><span class="s1">&#39;</span>
 <span class="linenos"> 9</span><span class="p">))</span>
 <span class="linenos">10</span><span class="n">audit</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s1">&#39;flask_s3_viewer.audit&#39;</span><span class="p">)</span>

docs/html/_sources/usage/configuration.rst.txt

@@ -438,6 +438,11 @@ exceptions emit at ``ERROR``.
   - ``action`` — one of ``list``, ``download``, ``upload``, ``delete``,
     ``presign``
   - ``namespace`` — viewer namespace the request landed on
+  - ``bucket`` — S3 bucket name resolved from the viewer config for the
+    current request. Populated automatically by the blueprint's
+    ``url_value_preprocessor``; the empty string when ``emit()`` is
+    called outside a Flask request context unless the caller pre-sets
+    ``g.FSV_AUDIT_BUCKET`` themselves.
   - ``key`` — canonical S3 key / prefix (post-``base_path``)
   - ``user`` — authenticated email or the literal string ``anonymous``
   - ``result`` — ``ok`` / ``denied`` / ``error``
@@ -458,8 +463,9 @@ The human-readable message is a single space-separated key=value line:
 
 .. code-block:: text
 
-    action=download namespace=fsv-test key=docs/report.pdf
-    user=alice@example.com result=ok status=200 req=a1b2c3d4
+    action=download namespace=fsv-test bucket=fsv-bucket
+    key=docs/report.pdf user=alice@example.com result=ok status=200
+    req=a1b2c3d4
 
 Newlines, carriage returns, and other ASCII control bytes inside
 attacker-controllable fields (key, email, User-Agent, exception
@@ -510,7 +516,7 @@ one request produce one row, not two.
     audit_handler = logging.FileHandler('/var/log/flask_s3_viewer/audit.jsonl')
     audit_handler.setFormatter(jsonlogger.JsonFormatter(
         '%(asctime)s %(levelname)s %(action)s %(namespace)s '
-        '%(key)s %(user)s %(result)s %(status_code)s '
+        '%(bucket)s %(key)s %(user)s %(result)s %(status_code)s '
         '%(client_ip)s %(user_agent)s'
     ))
     audit = logging.getLogger('flask_s3_viewer.audit')

docs/html/changelog.html

@@ -20,6 +20,9 @@
 
   - ``action`` — one of ``list``/``download``/``upload``/``delete``/``presign``
   - ``namespace`` — the viewer namespace this request landed on
+  - ``bucket`` — S3 bucket name resolved from the viewer config for the
+    current request (``''`` outside a request context unless the caller
+    pre-set ``g.FSV_AUDIT_BUCKET``)
   - ``key`` — the canonical S3 key / prefix touched (``''`` for listings
     that operate on the namespace root)
   - ``user`` — authenticated email or ``"anonymous"``
@@ -141,12 +144,20 @@ def emit(
 
     client_ip = ''
     user_agent = ''
+    bucket_raw = ''
     if has_request_context():
         client_ip = _sanitize(request.remote_addr, limit=64)
         user_agent = _sanitize(
             request.headers.get('User-Agent', ''),
             limit=MAX_UA_LEN,
         )
+        # ``g.FSV_AUDIT_BUCKET`` is set by the blueprint's
+        # ``url_value_preprocessor`` once per request so every audit row
+        # in this request carries the resolved viewer's S3 bucket name
+        # without each view having to set it. Host code emitting from
+        # outside the blueprint may pre-set ``g.FSV_AUDIT_BUCKET``
+        # themselves; otherwise it falls back to the empty string.
+        bucket_raw = getattr(g, 'FSV_AUDIT_BUCKET', '') or ''
         # Lazy-init a per-request id on flask.g so every emit inside one
         # request shares the same correlation token. The key name is an
         # internal sentinel — host code should consume the id via
@@ -161,6 +172,8 @@ def emit(
         # every call gets its own id.
         request_id = secrets.token_hex(4)
 
+    safe_bucket = _sanitize(bucket_raw, limit=_MAX_FIELD_LEN)
+
     error_msg = ''
     if exc is not None:
         error_msg = _sanitize(
@@ -171,6 +184,7 @@ def emit(
     extra: dict[str, Any] = {
         'action': safe_action,
         'namespace': safe_namespace,
+        'bucket': safe_bucket,
         'key': safe_key,
         'user': safe_user,
         'result': safe_result,
@@ -184,7 +198,7 @@ def emit(
 
     message = (
         f'action={safe_action} namespace={safe_namespace} '
-        f'key={safe_key} user={safe_user} '
+        f'bucket={safe_bucket} key={safe_key} user={safe_user} '
         f'result={safe_result} status={extra["status_code"]} '
         f'req={request_id}'
     )