feat: wire PresignedUrlPreset into ConstructivePreset (Step 2g)

- Add graphile-presigned-url-plugin as workspace dependency to graphile-settings
- Add @aws-sdk/client-s3 dependency for S3Client in presigned-url-resolver
- Create presigned-url-resolver.ts with lazy S3 client factory (same env var pattern as upload-resolver.ts)
- Wire PresignedUrlPreset into ConstructivePreset extends array
- Export getPresignedUrlS3Config from graphile-settings index

The presigned URL plugin (requestUploadUrl, confirmUpload, downloadUrl) is now
automatically included in ConstructivePreset. S3 config is lazily initialized
from CDN env vars (BUCKET_PROVIDER, BUCKET_NAME, AWS_REGION, etc.) on first use.

Author: pyramation

graphile/graphile-settings/package.json

@@ -29,6 +29,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1009.0",
     "@constructive-io/graphql-env": "workspace:^",
     "@constructive-io/graphql-types": "workspace:^",
     "@constructive-io/s3-streamer": "workspace:^",
@@ -48,6 +49,7 @@
     "graphile-config": "1.0.0",
     "graphile-connection-filter": "workspace:^",
     "graphile-postgis": "workspace:^",
+    "graphile-presigned-url-plugin": "workspace:^",
     "graphile-search": "workspace:^",
     "graphile-sql-expression-validator": "workspace:^",
     "graphile-upload-plugin": "workspace:^",

graphile/graphile-settings/src/index.ts

@@ -59,3 +59,6 @@ export { makePgService };
 
 // Upload utilities
 export { streamToStorage } from './upload-resolver';
+
+// Presigned URL utilities
+export { getPresignedUrlS3Config } from './presigned-url-resolver';

graphile/graphile-settings/src/presets/constructive-preset.ts

@@ -15,8 +15,10 @@ import {
 import { UnifiedSearchPreset, createMatchesOperatorFactory, createTrgmOperatorFactories } from 'graphile-search';
 import { GraphilePostgisPreset, createPostgisOperatorFactory } from 'graphile-postgis';
 import { UploadPreset } from 'graphile-upload-plugin';
+import { PresignedUrlPreset } from 'graphile-presigned-url-plugin';
 import { SqlExpressionValidatorPreset } from 'graphile-sql-expression-validator';
 import { constructiveUploadFieldDefinitions } from '../upload-resolver';
+import { getPresignedUrlS3Config } from '../presigned-url-resolver';
 
 /**
  * Constructive PostGraphile v5 Preset
@@ -36,6 +38,7 @@ import { constructiveUploadFieldDefinitions } from '../upload-resolver';
  * - PostGIS support (geometry/geography types, GeoJSON scalar — auto-detects PostGIS extension)
  * - PostGIS connection filter operators (spatial filtering on geometry/geography columns)
  * - Upload plugin (file upload to S3/MinIO for image, upload, attachment domain columns)
+ * - Presigned URL plugin (requestUploadUrl, confirmUpload mutations + downloadUrl computed field)
  * - SQL expression validator (validates @sqlExpression columns in mutations)
  * - PG type mappings (maps custom types like email, url to GraphQL scalars)
  * - pgvector search (auto-discovers vector columns: filter fields, distance computed fields,
@@ -83,6 +86,7 @@ export const ConstructivePreset: GraphileConfig.Preset = {
       uploadFieldDefinitions: constructiveUploadFieldDefinitions,
       maxFileSize: 10 * 1024 * 1024, // 10MB
     }),
+    PresignedUrlPreset({ s3: getPresignedUrlS3Config() }),
     SqlExpressionValidatorPreset(),
     PgTypeMappingsPreset,
     RequiredInputPreset,

graphile/graphile-settings/src/presigned-url-resolver.ts

@@ -0,0 +1,82 @@
+/**
+ * Presigned URL resolver for the Constructive presigned URL plugin.
+ *
+ * Reads CDN/S3/MinIO configuration from environment variables (via getEnvOptions)
+ * and lazily initializes an S3Client on first use to avoid requiring
+ * env vars at module load time.
+ *
+ * Follows the same lazy-init pattern as upload-resolver.ts.
+ *
+ * ENV VARS (via CDNOptions):
+ *   BUCKET_PROVIDER  - 'minio' | 's3' (default: 'minio')
+ *   BUCKET_NAME      - bucket name (default: 'test-bucket')
+ *   AWS_REGION       - AWS region (default: 'us-east-1')
+ *   AWS_ACCESS_KEY   - access key (default: 'minioadmin')
+ *   AWS_SECRET_KEY   - secret key (default: 'minioadmin')
+ *   MINIO_ENDPOINT   - MinIO endpoint (default: 'http://localhost:9000')
+ */
+
+import { S3Client } from '@aws-sdk/client-s3';
+import { getEnvOptions } from '@constructive-io/graphql-env';
+import { Logger } from '@pgpmjs/logger';
+import type { S3Config } from 'graphile-presigned-url-plugin';
+
+const log = new Logger('presigned-url-resolver');
+
+let s3Config: S3Config | null = null;
+
+/**
+ * Lazily initialize and return the S3Config for the presigned URL plugin.
+ *
+ * Reads CDN env vars on first call, creates an S3Client, and caches the
+ * config for subsequent calls. Same env vars as upload-resolver.ts.
+ *
+ * For MinIO, constructs a publicUrlPrefix from the endpoint + bucket name
+ * so that public file download URLs resolve correctly.
+ */
+export function getPresignedUrlS3Config(): S3Config {
+  if (s3Config) return s3Config;
+
+  const opts = getEnvOptions();
+  const cdn = opts.cdn || {};
+
+  const provider = cdn.provider || 'minio';
+  const isMinio = provider === 'minio';
+  const bucket = cdn.bucketName || 'test-bucket';
+  const region = cdn.awsRegion || 'us-east-1';
+  const accessKey = cdn.awsAccessKey || 'minioadmin';
+  const secretKey = cdn.awsSecretKey || 'minioadmin';
+  const endpoint = cdn.minioEndpoint || 'http://localhost:9000';
+
+  if (process.env.NODE_ENV === 'production') {
+    if (!cdn.awsAccessKey || !cdn.awsSecretKey) {
+      log.warn('[presigned-url-resolver] WARNING: Using default credentials in production.');
+    }
+  }
+
+  log.info(
+    `[presigned-url-resolver] Initializing: provider=${provider} bucket=${bucket}`,
+  );
+
+  const client = new S3Client({
+    region,
+    credentials: { accessKeyId: accessKey, secretAccessKey: secretKey },
+    ...(isMinio ? { endpoint, forcePathStyle: true } : {}),
+  });
+
+  // For MinIO (path-style), public URL prefix is endpoint/bucket.
+  // For S3 (virtual-hosted), it's https://{bucket}.s3.{region}.amazonaws.com
+  const publicUrlPrefix = isMinio
+    ? `${endpoint}/${bucket}`
+    : `https://${bucket}.s3.${region}.amazonaws.com`;
+
+  s3Config = {
+    client,
+    bucket,
+    region,
+    publicUrlPrefix,
+    ...(isMinio ? { endpoint, forcePathStyle: true } : {}),
+  };
+
+  return s3Config;
+}