Como construí uma galeria serverless na AWS: do File Gateway ao S3 com Lambda, Cognito e CloudFront

# AWS CLI
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# SAM CLI
brew install aws-sam-cli
# ou via pip:
pip install aws-sam-cli

# Node.js 20 (via nvm)
nvm install 20
nvm use 20

# Verificar tudo
aws --version
sam --version
node --version

# AWS CLI — baixe o MSI:
# https://awscli.amazonaws.com/AWSCLIV2.msi

# SAM CLI — baixe o MSI:
# https://github.com/aws/aws-sam-cli/releases/latest

# Node.js 20 — baixe o instalador:
# https://nodejs.org/

# Verificar tudo (PowerShell ou Git Bash)
aws --version
sam --version
node --version

# Inicializar o projeto
mkdir galeria-midia && cd galeria-midia
sam init --runtime nodejs20.x --name galeria-midia --app-template hello-world

# Estrutura final que vamos construir:
# galeria-midia/
# ├── template.yaml          ← SAM template (infraestrutura)
# ├── src/
# │   ├── index.js           ← Lambda principal
# │   ├── relatorio.js       ← Lambda de relatório diário
# │   ├── package.json
# │   └── frontend/
# │       ├── index.html      ← Interface do operador
# │       ├── login.html      ← Tela de login
# │       └── admin.html      ← Painel de administração
# └── .gitignore

{
  "name": "galeria-midia",
  "version": "1.0.0",
  "description": "Galeria de mídia serverless - Pedra Sul Mineração",
  "private": true,
  "dependencies": {
    "@aws-sdk/client-s3": "^3.500.0",
    "@aws-sdk/s3-request-presigner": "^3.500.0",
    "@aws-sdk/client-dynamodb": "^3.500.0",
    "@aws-sdk/client-cognito-identity-provider": "^3.500.0",
    "@aws-sdk/client-ssm": "^3.500.0",
    "@aws-sdk/client-ses": "^3.500.0"
  }
}

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Galeria de Midia Serverless

# ─── Globais ────────────────────────────────────────────────────
Globals:
  Api:
    BinaryMediaTypes:
      - "*/*"
    Cors:
      AllowMethods: "'GET,POST,PUT,DELETE,OPTIONS'"
      AllowHeaders: "'Content-Type,Authorization'"
      AllowOrigin: "'*'"

# ─── Parâmetros ─────────────────────────────────────────────────
Parameters:
  DestBucket:
    Type: String
    Description: Nome do bucket S3 para armazenar as midias
    Default: meu-bucket-de-fotos

  SesFromEmail:
    Type: String
    Description: Email remetente para relatorios (verificado no SES)
    Default: noreply@meudominio.com

  SesToEmail:
    Type: String
    Description: Email destinatario dos relatorios
    Default: admin@meudominio.com

# ─── Recursos ───────────────────────────────────────────────────
Resources:

  # ── DynamoDB: Tabela de Auditoria ──
  AuditTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      TableName: galeria-audit-log
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: pk
          AttributeType: S
        - AttributeName: sk
          AttributeType: S
        - AttributeName: bloco
          AttributeType: S
        - AttributeName: ts
          AttributeType: S
      KeySchema:
        - AttributeName: pk
          KeyType: HASH
        - AttributeName: sk
          KeyType: RANGE
      GlobalSecondaryIndexes:
        - IndexName: bloco-ts-index
          KeySchema:
            - AttributeName: bloco
              KeyType: HASH
            - AttributeName: ts
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: true

  # ── Cognito: User Pool ──
  GaleriaUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: galeria-user-pool
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
        InviteMessageTemplate:
          EmailMessage: >
            Seu acesso a Galeria de Midia foi criado.
            Usuario: {username} | Senha temporaria: {####}
            Acesse e troque sua senha no primeiro login.
          EmailSubject: "Galeria de Midia - Seu acesso foi criado"
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: false
          RequireUppercase: false
      Schema:
        - Name: email
          AttributeDataType: String
          Required: true
          Mutable: true
        - Name: custom:role
          AttributeDataType: String
          Mutable: true

  GaleriaUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: galeria-web-client
      UserPoolId: !Ref GaleriaUserPool
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      GenerateSecret: false

  # ── Lambda: Função Principal ──
  GaleriaFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: galeria-midia-api
      Handler: index.handler
      Runtime: nodejs20.x
      CodeUri: src/
      MemorySize: 512
      Timeout: 30
      Environment:
        Variables:
          DEST_BUCKET: !Ref DestBucket
          AUDIT_TABLE: !Ref AuditTable
          USER_POOL_ID: !Ref GaleriaUserPool
          USER_POOL_CLIENT_ID: !Ref GaleriaUserPoolClient
          SES_FROM_EMAIL: !Ref SesFromEmail
          SES_TO_EMAIL: !Ref SesToEmail
      Policies:
        # S3: ler, escrever e listar objetos
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - s3:PutObject
                - s3:GetObject
                - s3:DeleteObject
              Resource: !Sub "arn:aws:s3:::${DestBucket}/*"
            - Effect: Allow
              Action:
                - s3:ListBucket
              Resource: !Sub "arn:aws:s3:::${DestBucket}"
        # DynamoDB: leitura e escrita na tabela de auditoria
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - dynamodb:PutItem
                - dynamodb:GetItem
                - dynamodb:Query
                - dynamodb:Scan
              Resource:
                - !GetAtt AuditTable.Arn
                - !Sub "${AuditTable.Arn}/index/*"
        # Cognito: gerenciar usuários
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - cognito-idp:AdminCreateUser
                - cognito-idp:AdminDeleteUser
                - cognito-idp:AdminGetUser
                - cognito-idp:AdminInitiateAuth
                - cognito-idp:AdminRespondToAuthChallenge
                - cognito-idp:ListUsers
              Resource: !GetAtt GaleriaUserPool.Arn
        # SSM: ler parâmetros de configuração
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - ssm:GetParameter
                - ssm:GetParameters
              Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/galeria/*"
        # SES: enviar relatórios por email
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: "*"
      Events:
        # Rotas da API
        RootGet:
          Type: Api
          Properties:
            Path: /
            Method: get
        LoginPage:
          Type: Api
          Properties:
            Path: /login
            Method: get
        AdminPage:
          Type: Api
          Properties:
            Path: /admin
            Method: get
        ApiLogin:
          Type: Api
          Properties:
            Path: /api/login
            Method: post
        ApiPresign:
          Type: Api
          Properties:
            Path: /api/presign
            Method: post
        ApiNotify:
          Type: Api
          Properties:
            Path: /api/notify
            Method: post
        ApiList:
          Type: Api
          Properties:
            Path: /api/list
            Method: get
        ApiDelete:
          Type: Api
          Properties:
            Path: /api/delete
            Method: post
        ApiUsers:
          Type: Api
          Properties:
            Path: /api/users
            Method: get
        ApiCreateUser:
          Type: Api
          Properties:
            Path: /api/users
            Method: post
        ApiDeleteUser:
          Type: Api
          Properties:
            Path: /api/users/delete
            Method: post
        ApiAudit:
          Type: Api
          Properties:
            Path: /api/audit
            Method: get
        CorsOptions:
          Type: Api
          Properties:
            Path: /{proxy+}
            Method: options

  # ── Lambda: Relatório Diário ──
  RelatorioFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: galeria-relatorio-diario
      Handler: relatorio.handler
      Runtime: nodejs20.x
      CodeUri: src/
      MemorySize: 256
      Timeout: 60
      Environment:
        Variables:
          DEST_BUCKET: !Ref DestBucket
          AUDIT_TABLE: !Ref AuditTable
          SES_FROM_EMAIL: !Ref SesFromEmail
          SES_TO_EMAIL: !Ref SesToEmail
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - dynamodb:Query
                - dynamodb:Scan
              Resource:
                - !GetAtt AuditTable.Arn
                - !Sub "${AuditTable.Arn}/index/*"
            - Effect: Allow
              Action:
                - ses:SendEmail
              Resource: "*"
      Events:
        DailySchedule:
          Type: Schedule
          Properties:
            Schedule: cron(0 21 * * ? *)
            Description: Relatorio diario as 18h BRT (21h UTC)
            Enabled: true

# ─── Outputs ────────────────────────────────────────────────────
Outputs:
  ApiEndpoint:
    Description: URL da API Gateway
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"

  UserPoolId:
    Description: ID do Cognito User Pool
    Value: !Ref GaleriaUserPool

  UserPoolClientId:
    Description: ID do Cognito User Pool Client
    Value: !Ref GaleriaUserPoolClient

  AuditTableName:
    Description: Nome da tabela DynamoDB
    Value: !Ref AuditTable

// ─── Imports do AWS SDK v3 ────────────────────────────────────
const { S3Client, PutObjectCommand, DeleteObjectCommand,
        ListObjectsV2Command } = require("@aws-sdk/client-s3");
const { getSignedUrl } = require("@aws-sdk/s3-request-presigner");
const { DynamoDBClient, PutItemCommand, QueryCommand,
        ScanCommand } = require("@aws-sdk/client-dynamodb");
const { CognitoIdentityProviderClient, AdminCreateUserCommand,
        AdminDeleteUserCommand, AdminInitiateAuthCommand,
        AdminRespondToAuthChallengeCommand,
        ListUsersCommand } = require("@aws-sdk/client-cognito-identity-provider");
const { SSMClient, GetParameterCommand } = require("@aws-sdk/client-ssm");
const fs = require("fs");
const path = require("path");

// ─── Clientes (inicializados fora do handler para reutilizar entre invocações)
const s3 = new S3Client({});
const ddb = new DynamoDBClient({});
const cognito = new CognitoIdentityProviderClient({});
const ssm = new SSMClient({});

// ─── Variáveis de Ambiente ────────────────────────────────────
const BUCKET = process.env.DEST_BUCKET;
const TABLE = process.env.AUDIT_TABLE;
const POOL_ID = process.env.USER_POOL_ID;
const CLIENT_ID = process.env.USER_POOL_CLIENT_ID;

// ─── Cache de configurações do SSM ───────────────────────────
const ssmCache = {};
const SSM_TTL = 5 * 60 * 1000; // 5 minutos

async function getConfig(paramName) {
  const now = Date.now();
  if (ssmCache[paramName] && (now - ssmCache[paramName].ts) < SSM_TTL) {
    return ssmCache[paramName].value;
  }
  try {
    const resp = await ssm.send(new GetParameterCommand({
      Name: `/galeria/${paramName}`,
      WithDecryption: true,
    }));
    ssmCache[paramName] = { value: resp.Parameter.Value, ts: now };
    return resp.Parameter.Value;
  } catch (err) {
    console.warn(`SSM param /galeria/${paramName} nao encontrado:`, err.message);
    return null;
  }
}

// ─── Cache de arquivos HTML do frontend ──────────────────────
const htmlCache = {};

function loadHtml(fileName) {
  if (htmlCache[fileName]) return htmlCache[fileName];
  const filePath = path.join(__dirname, "frontend", fileName);
  const content = fs.readFileSync(filePath, "utf-8");
  htmlCache[fileName] = content;
  return content;
}

// ─── Helpers de Resposta ─────────────────────────────────────
function jsonResponse(statusCode, body) {
  return {
    statusCode,
    headers: {
      "Content-Type": "application/json",
      "Access-Control-Allow-Origin": "*",
      "Access-Control-Allow-Headers": "Content-Type,Authorization",
    },
    body: JSON.stringify(body),
  };
}

function htmlResponse(html) {
  return {
    statusCode: 200,
    headers: {
      "Content-Type": "text/html; charset=utf-8",
      "Access-Control-Allow-Origin": "*",
    },
    body: html,
    isBase64Encoded: false,
  };
}

function cors204() {
  return {
    statusCode: 204,
    headers: {
      "Access-Control-Allow-Origin": "*",
      "Access-Control-Allow-Methods": "GET,POST,PUT,DELETE,OPTIONS",
      "Access-Control-Allow-Headers": "Content-Type,Authorization",
    },
    body: "",
  };
}

// ─── Auditoria (fire-and-forget) ─────────────────────────────
async function logAudit(action, user, bloco, details = {}) {
  try {
    const now = new Date().toISOString();
    await ddb.send(new PutItemCommand({
      TableName: TABLE,
      Item: {
        pk: { S: `AUDIT#${now.slice(0, 10)}` },
        sk: { S: `${now}#${Math.random().toString(36).slice(2, 8)}` },
        action: { S: action },
        user: { S: user || "anonymous" },
        bloco: { S: bloco || "N/A" },
        ts: { S: now },
        details: { S: JSON.stringify(details) },
        ttl: { N: String(Math.floor(Date.now() / 1000) + 90 * 86400) }, // 90 dias
      },
    }));
  } catch (err) {
    // Fire-and-forget: não queremos que falha de auditoria quebre o upload
    console.error("Erro ao registrar auditoria:", err.message);
  }
}

// ─── Handler Principal (Router Manual) ───────────────────────
exports.handler = async (event) => {
  const method = event.httpMethod;
  const routePath = event.path;

  console.log(`${method} ${routePath}`);

  // CORS preflight
  if (method === "OPTIONS") {
    return cors204();
  }

  try {
    // ── Rotas de Páginas HTML ──
    if (method === "GET" && routePath === "/") {
      return htmlResponse(loadHtml("index.html"));
    }
    if (method === "GET" && routePath === "/login") {
      return htmlResponse(loadHtml("login.html"));
    }
    if (method === "GET" && routePath === "/admin") {
      return htmlResponse(loadHtml("admin.html"));
    }

    // ── API: Login ──
    if (method === "POST" && routePath === "/api/login") {
      return await handleLogin(JSON.parse(event.body));
    }

    // ── API: Presigned URL ──
    if (method === "POST" && routePath === "/api/presign") {
      return await handlePresign(JSON.parse(event.body));
    }

    // ── API: Notificação pós-upload ──
    if (method === "POST" && routePath === "/api/notify") {
      return await handleNotify(JSON.parse(event.body));
    }

    // ── API: Listar arquivos de um bloco ──
    if (method === "GET" && routePath === "/api/list") {
      const bloco = event.queryStringParameters?.bloco;
      return await handleList(bloco);
    }

    // ── API: Deletar arquivo ──
    if (method === "POST" && routePath === "/api/delete") {
      return await handleDelete(JSON.parse(event.body));
    }

    // ── API: Listar usuários ──
    if (method === "GET" && routePath === "/api/users") {
      return await handleListUsers();
    }

    // ── API: Criar usuário ──
    if (method === "POST" && routePath === "/api/users") {
      return await handleCreateUser(JSON.parse(event.body));
    }

    // ── API: Deletar usuário ──
    if (method === "POST" && routePath === "/api/users/delete") {
      return await handleDeleteUser(JSON.parse(event.body));
    }

    // ── API: Consultar auditoria ──
    if (method === "GET" && routePath === "/api/audit") {
      const bloco = event.queryStringParameters?.bloco;
      const date = event.queryStringParameters?.date;
      return await handleAudit(bloco, date);
    }

    return jsonResponse(404, { error: "Rota nao encontrada" });

  } catch (err) {
    console.error("Erro no handler:", err);
    return jsonResponse(500, { error: "Erro interno do servidor" });
  }
};

// ─── Handlers de Rota ────────────────────────────────────────

async function handleLogin({ username, password }) {
  try {
    const authResp = await cognito.send(new AdminInitiateAuthCommand({
      UserPoolId: POOL_ID,
      ClientId: CLIENT_ID,
      AuthFlow: "ADMIN_USER_PASSWORD_AUTH",
      AuthParameters: {
        USERNAME: username,
        PASSWORD: password,
      },
    }));

    // Primeiro login: Cognito exige troca de senha
    if (authResp.ChallengeName === "NEW_PASSWORD_REQUIRED") {
      return jsonResponse(200, {
        challenge: "NEW_PASSWORD_REQUIRED",
        session: authResp.Session,
        message: "Troque sua senha temporaria",
      });
    }

    const token = authResp.AuthenticationResult.IdToken;
    await logAudit("LOGIN", username, null);

    return jsonResponse(200, {
      token,
      message: "Login realizado com sucesso",
    });

  } catch (err) {
    console.error("Erro no login:", err.message);
    return jsonResponse(401, { error: "Credenciais invalidas" });
  }
}

async function handlePresign({ bloco, fileName, contentType, tipo }) {
  if (!bloco || !fileName) {
    return jsonResponse(400, { error: "bloco e fileName sao obrigatorios" });
  }

  // Montar a key no S3: blocos/{codigo}/{tipo}/{arquivo}
  const prefix = tipo === "thumb" ? "thumbs" : "originais";
  const key = `blocos/${bloco}/${prefix}/${fileName}`;

  // Presigned URL com expiração curta
  // Fotos: 5 min | Vídeos: 15 min (arquivos maiores)
  const isVideo = contentType?.startsWith("video/");
  const expiresIn = isVideo ? 900 : 300;

  const command = new PutObjectCommand({
    Bucket: BUCKET,
    Key: key,
    ContentType: contentType || "application/octet-stream",
  });

  const presignedUrl = await getSignedUrl(s3, command, { expiresIn });

  return jsonResponse(200, {
    url: presignedUrl,
    key,
    expiresIn,
  });
}

async function handleNotify({ bloco, key, user, action = "UPLOAD" }) {
  await logAudit(action, user, bloco, { key });

  return jsonResponse(200, { message: "Registrado" });
}

async function handleList(bloco) {
  if (!bloco) {
    return jsonResponse(400, { error: "Parametro bloco e obrigatorio" });
  }

  const prefix = `blocos/${bloco}/originais/`;
  const thumbPrefix = `blocos/${bloco}/thumbs/`;

  // Listar originais e thumbnails em paralelo
  const [origResp, thumbResp] = await Promise.all([
    s3.send(new ListObjectsV2Command({ Bucket: BUCKET, Prefix: prefix })),
    s3.send(new ListObjectsV2Command({ Bucket: BUCKET, Prefix: thumbPrefix })),
  ]);

  const originais = (origResp.Contents || []).map((obj) => ({
    key: obj.Key,
    size: obj.Size,
    lastModified: obj.LastModified,
    fileName: obj.Key.split("/").pop(),
  }));

  const thumbs = (thumbResp.Contents || []).map((obj) => ({
    key: obj.Key,
    fileName: obj.Key.split("/").pop(),
  }));

  return jsonResponse(200, { bloco, originais, thumbs });
}

async function handleDelete({ key, user, bloco }) {
  if (!key) {
    return jsonResponse(400, { error: "Parametro key e obrigatorio" });
  }

  await s3.send(new DeleteObjectCommand({ Bucket: BUCKET, Key: key }));
  await logAudit("DELETE", user, bloco, { key });

  return jsonResponse(200, { message: "Arquivo deletado" });
}

async function handleListUsers() {
  const resp = await cognito.send(new ListUsersCommand({
    UserPoolId: POOL_ID,
    Limit: 60,
  }));

  const users = (resp.Users || []).map((u) => ({
    username: u.Username,
    status: u.UserStatus,
    enabled: u.Enabled,
    created: u.UserCreateDate,
    email: u.Attributes?.find((a) => a.Name === "email")?.Value,
    role: u.Attributes?.find((a) => a.Name === "custom:role")?.Value || "operador",
  }));

  return jsonResponse(200, { users });
}

async function handleCreateUser({ username, email, role = "operador" }) {
  if (!username || !email) {
    return jsonResponse(400, { error: "username e email sao obrigatorios" });
  }

  await cognito.send(new AdminCreateUserCommand({
    UserPoolId: POOL_ID,
    Username: username,
    UserAttributes: [
      { Name: "email", Value: email },
      { Name: "email_verified", Value: "true" },
      { Name: "custom:role", Value: role },
    ],
    DesiredDelivery: "EMAIL",
  }));

  await logAudit("CREATE_USER", "admin", null, { username, email, role });

  return jsonResponse(201, { message: `Usuario ${username} criado com sucesso` });
}

async function handleDeleteUser({ username }) {
  if (!username) {
    return jsonResponse(400, { error: "username e obrigatorio" });
  }

  await cognito.send(new AdminDeleteUserCommand({
    UserPoolId: POOL_ID,
    Username: username,
  }));

  await logAudit("DELETE_USER", "admin", null, { username });

  return jsonResponse(200, { message: `Usuario ${username} removido` });
}

async function handleAudit(bloco, date) {
  if (bloco) {
    // Consultar por bloco usando o GSI
    const resp = await ddb.send(new QueryCommand({
      TableName: TABLE,
      IndexName: "bloco-ts-index",
      KeyConditionExpression: "bloco = :b",
      ExpressionAttributeValues: { ":b": { S: bloco } },
      ScanIndexForward: false,
      Limit: 100,
    }));
    return jsonResponse(200, { items: resp.Items });
  }

  if (date) {
    // Consultar por data na partition key
    const resp = await ddb.send(new QueryCommand({
      TableName: TABLE,
      KeyConditionExpression: "pk = :pk",
      ExpressionAttributeValues: { ":pk": { S: `AUDIT#${date}` } },
      ScanIndexForward: false,
      Limit: 100,
    }));
    return jsonResponse(200, { items: resp.Items });
  }

  // Sem filtros: scan limitado (últimos registros)
  const resp = await ddb.send(new ScanCommand({
    TableName: TABLE,
    Limit: 50,
  }));
  return jsonResponse(200, { items: resp.Items });
}

// Este trecho já está no index.js acima, mas vale destaque:
const htmlCache = {};

function loadHtml(fileName) {
  if (htmlCache[fileName]) return htmlCache[fileName];
  const filePath = path.join(__dirname, "frontend", fileName);
  const content = fs.readFileSync(filePath, "utf-8");
  htmlCache[fileName] = content;
  return content;
}

// Na rota GET /:
if (method === "GET" && routePath === "/") {
  return htmlResponse(loadHtml("index.html"));
}

// ─── Upload com Presigned URL (frontend) ─────────────────────

async function uploadFile(file, bloco, user) {
  const statusEl = document.getElementById("upload-status");

  try {
    // Etapa 1: Obter Presigned URL
    statusEl.textContent = "Gerando URL de upload...";

    const presignResp = await fetch("/api/presign", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        bloco: bloco,
        fileName: file.name,
        contentType: file.type,
        tipo: "original",
      }),
    });

    if (!presignResp.ok) throw new Error("Erro ao gerar URL");
    const { url, key } = await presignResp.json();

    // Etapa 2: Upload direto ao S3
    statusEl.textContent = `Enviando ${file.name}...`;

    const uploadResp = await fetch(url, {
      method: "PUT",
      headers: { "Content-Type": file.type },
      body: file,
    });

    if (!uploadResp.ok) throw new Error("Erro no upload para S3");

    // Etapa 3: Notificar a Lambda (auditoria)
    statusEl.textContent = "Registrando...";

    await fetch("/api/notify", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        bloco: bloco,
        key: key,
        user: user,
        action: "UPLOAD",
      }),
    });

    statusEl.textContent = `${file.name} enviado com sucesso!`;

  } catch (err) {
    console.error("Erro no upload:", err);
    statusEl.textContent = `Erro: ${err.message}`;
  }
}

// ─── Upload de múltiplos arquivos (sequencial) ───────────────
async function uploadMultiple(files, bloco, user) {
  for (let i = 0; i < files.length; i++) {
    const progress = `[${i + 1}/${files.length}]`;
    document.getElementById("upload-progress").textContent = progress;
    await uploadFile(files[i], bloco, user);
  }
  document.getElementById("upload-progress").textContent = "Todos os arquivos enviados!";
}

// ─── Geração de Thumbnail no Cliente ─────────────────────────

function generateThumbnail(file, maxWidth = 300) {
  return new Promise((resolve, reject) => {
    // Só gera thumb para imagens, não para vídeos
    if (!file.type.startsWith("image/")) {
      resolve(null);
      return;
    }

    const img = new Image();
    const canvas = document.createElement("canvas");
    const ctx = canvas.getContext("2d");

    img.onload = () => {
      // Calcular dimensões mantendo proporção
      const ratio = maxWidth / img.width;
      canvas.width = maxWidth;
      canvas.height = img.height * ratio;

      // Desenhar a imagem redimensionada
      ctx.drawImage(img, 0, 0, canvas.width, canvas.height);

      // Converter para Blob (JPEG com qualidade 70%)
      canvas.toBlob(
        (blob) => {
          if (blob) {
            resolve(new File([blob], `thumb_${file.name}`, {
              type: "image/jpeg",
            }));
          } else {
            reject(new Error("Falha ao gerar thumbnail"));
          }
        },
        "image/jpeg",
        0.7
      );
    };

    img.onerror = () => reject(new Error("Falha ao carregar imagem"));
    img.src = URL.createObjectURL(file);
  });
}

// ─── Upload completo: original + thumbnail ───────────────────
async function uploadWithThumbnail(file, bloco, user) {
  // 1. Gerar thumbnail (se for imagem)
  const thumb = await generateThumbnail(file);

  // 2. Upload do original
  await uploadFile(file, bloco, user);

  // 3. Upload do thumbnail (se existir)
  if (thumb) {
    const presignResp = await fetch("/api/presign", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        bloco: bloco,
        fileName: thumb.name,
        contentType: "image/jpeg",
        tipo: "thumb",
      }),
    });

    const { url } = await presignResp.json();

    await fetch(url, {
      method: "PUT",
      headers: { "Content-Type": "image/jpeg" },
      body: thumb,
    });
  }
}

# Criar parâmetros no SSM (executar uma vez)
aws ssm put-parameter \
  --name "/galeria/api-key" \
  --type "SecureString" \
  --value "seu-segredo-aqui" \
  --description "Chave de API para integracao externa"

aws ssm put-parameter \
  --name "/galeria/allowed-origins" \
  --type "String" \
  --value "https://galeria.meudominio.com" \
  --description "Origens permitidas para CORS"

aws ssm put-parameter \
  --name "/galeria/max-file-size" \
  --type "String" \
  --value "104857600" \
  --description "Tamanho maximo de arquivo em bytes (100MB)"

// Cache com TTL de 5 minutos
// Se o parâmetro mudar no SSM, a Lambda pega o novo valor
// no máximo 5 minutos depois — sem precisar de redeploy.
const ssmCache = {};
const SSM_TTL = 5 * 60 * 1000;

async function getConfig(paramName) {
  const now = Date.now();
  if (ssmCache[paramName] && (now - ssmCache[paramName].ts) < SSM_TTL) {
    return ssmCache[paramName].value;
  }
  const resp = await ssm.send(new GetParameterCommand({
    Name: `/galeria/${paramName}`,
    WithDecryption: true, // descriptografa SecureString automaticamente
  }));
  ssmCache[paramName] = { value: resp.Parameter.Value, ts: now };
  return resp.Parameter.Value;
}

{
  "CORSRules": [
    {
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["PUT", "GET"],
      "AllowedOrigins": ["https://galeria.meudominio.com"],
      "ExposeHeaders": ["ETag"],
      "MaxAgeSeconds": 3600
    }
  ]
}

# Aplicar configuração CORS ao bucket
aws s3api put-bucket-cors \
  --bucket meu-bucket-de-fotos \
  --cors-configuration file://cors.json

# Instalar dependências
cd src && npm install && cd ..

# Build (empacota a Lambda)
sam build

# Deploy guiado (primeira vez)
sam deploy --guided

Configuring SAM deploy
======================

  Setting default arguments for 'sam deploy'
  =========================================
  Stack Name [galeria-midia]:                    # Nome do CloudFormation stack
  AWS Region [us-east-1]: sa-east-1              # São Paulo (mais perto)
  Parameter DestBucket [meu-bucket-de-fotos]:    # Nome do seu bucket
  Parameter SesFromEmail [noreply@meudominio.com]:
  Parameter SesToEmail [admin@meudominio.com]:
  Confirm changes before deploy [Y/n]: y
  Allow SAM CLI IAM role creation [Y/n]: y       # SAM cria os roles IAM
  Disable rollback [y/N]: n
  Save arguments to configuration file [Y/n]: y  # Salva em samconfig.toml
  SAM configuration file [samconfig.toml]:
  SAM configuration environment [default]:

# Output do deploy:
CloudFormation outputs from deployed stack
───────────────────────────────────────────────────────────
Key                 Value
───────────────────────────────────────────────────────────
ApiEndpoint         https://abc123xyz.execute-api.sa-east-1.amazonaws.com/Prod/
UserPoolId          sa-east-1_AbCdEfGhI
UserPoolClientId    1a2b3c4d5e6f7g8h9i0j
AuditTableName      galeria-audit-log
───────────────────────────────────────────────────────────

# .gitignore
node_modules/
.aws-sam/
samconfig.toml      # contém nome do bucket e região
.env
*.zip

# Arquivos do OS
.DS_Store
Thumbs.db

# SEM isso no Globals:
Globals:
  Api:
    BinaryMediaTypes:
      - "*/*"

# O API Gateway converte a resposta HTML da Lambda para Base64,
# e o navegador exibe lixo em vez da página.
# Com "*/*", ele trata tudo como binário e a resposta chega intacta.

# ERRADO (não funciona):
- Effect: Allow
  Action:
    - s3:ListBucket
  Resource: !Sub "arn:aws:s3:::${DestBucket}/*"
  # ← O /* é para OBJETOS, não para o BUCKET

# CORRETO:
- Effect: Allow
  Action:
    - s3:ListBucket
  Resource: !Sub "arn:aws:s3:::${DestBucket}"
  # ← Sem /* — é uma operação no bucket, não nos objetos

# Se a Lambda tem um handler para /api/audit
# mas o template.yaml não declara o Event:
#
#   ApiAudit:
#     Type: Api
#     Properties:
#       Path: /api/audit
#       Method: get
#
# Resultado: a rota funciona com `sam local start-api`
# mas retorna 403 {"message":"Missing Authentication Token"}
# depois do deploy.
#
# O API Gateway só conhece as rotas declaradas no template.

# Se existem dois behaviors:
#   /blocos/*  → S3
#   /*         → API Gateway (default)
#
# E adiciona um terceiro:
#   /blocos/thumbs/*  → S3 (com cache diferente)
#
# O CloudFront usa a rota MAIS ESPECÍFICA que bater.
# /blocos/thumbs/foto.jpg bate em /blocos/thumbs/* (prioridade 2)
# /blocos/originais/foto.jpg bate em /blocos/* (prioridade 1)
#
# Se a prioridade estiver errada, o behavior errado responde
# e o resultado é 403 ou conteúdo cacheado quando não devia.

# Quando o frontend é servido pela Lambda como string:
# Um </div> faltando ou sobrando pode não causar erro visual
# no Chrome (que é tolerante), mas quebra completamente
# no Safari mobile (que é mais rigoroso).
#
# Solução: use um validador HTML antes do deploy.
# https://validator.w3.org/ ou extensão do VS Code.