CAMEL-16809: camel-aws2-s3 - support ACL grant headers on putObject and multipart upload

components/camel-aws/camel-aws2-s3/src/main/java/org/apache/camel/component/aws2/s3/AWS2S3Constants.java

@@ -112,6 +112,26 @@ public interface AWS2S3Constants {
     @Metadata(label = "producer", description = "A well constructed Amazon S3 Access Control List object.",
               javaType = "software.amazon.awssdk.services.s3.model.BucketCannedACL")
     String ACL = "CamelAwsS3Acl";
+    @Metadata(label = "producer", description = """
+            Gives the grantee READ, READ_ACP, and WRITE_ACP permissions on the object. The value is a grantee
+            expression such as `id=<canonical-user-id>`, `emailAddress=<email>` or `uri=<group-uri>`.""",
+              javaType = "String")
+    String GRANT_FULL_CONTROL = "CamelAwsS3GrantFullControl";
+    @Metadata(label = "producer", description = """
+            Allows the grantee to read the object data and its metadata. The value is a grantee expression such as
+            `id=<canonical-user-id>`, `emailAddress=<email>` or `uri=<group-uri>`.""",
+              javaType = "String")
+    String GRANT_READ = "CamelAwsS3GrantRead";
+    @Metadata(label = "producer", description = """
+            Allows the grantee to read the object ACL. The value is a grantee expression such as
+            `id=<canonical-user-id>`, `emailAddress=<email>` or `uri=<group-uri>`.""",
+              javaType = "String")
+    String GRANT_READ_ACP = "CamelAwsS3GrantReadACP";
+    @Metadata(label = "producer", description = """
+            Allows the grantee to write the ACL for the object. The value is a grantee expression such as
+            `id=<canonical-user-id>`, `emailAddress=<email>` or `uri=<group-uri>`.""",
+              javaType = "String")
+    String GRANT_WRITE_ACP = "CamelAwsS3GrantWriteACP";
     @Metadata(description = "The operation to perform. Permitted values are copyObject, deleteObject, listBuckets, deleteBucket, listObjects",
               javaType = "String")
     String S3_OPERATION = "CamelAwsS3Operation";

components/camel-aws/camel-aws2-s3/src/main/java/org/apache/camel/component/aws2/s3/AWS2S3Producer.java

@@ -241,6 +241,26 @@ public void processMultiPart(final Exchange exchange) throws Exception {
             createMultipartUploadRequest.acl(objectAcl);
         }
 
+        String grantFullControl = exchange.getIn().getHeader(AWS2S3Constants.GRANT_FULL_CONTROL, String.class);
+        if (ObjectHelper.isNotEmpty(grantFullControl)) {
+            createMultipartUploadRequest.grantFullControl(grantFullControl);
+        }
+
+        String grantRead = exchange.getIn().getHeader(AWS2S3Constants.GRANT_READ, String.class);
+        if (ObjectHelper.isNotEmpty(grantRead)) {
+            createMultipartUploadRequest.grantRead(grantRead);
+        }
+
+        String grantReadACP = exchange.getIn().getHeader(AWS2S3Constants.GRANT_READ_ACP, String.class);
+        if (ObjectHelper.isNotEmpty(grantReadACP)) {
+            createMultipartUploadRequest.grantReadACP(grantReadACP);
+        }
+
+        String grantWriteACP = exchange.getIn().getHeader(AWS2S3Constants.GRANT_WRITE_ACP, String.class);
+        if (ObjectHelper.isNotEmpty(grantWriteACP)) {
+            createMultipartUploadRequest.grantWriteACP(grantWriteACP);
+        }
+
         BucketCannedACL acl = exchange.getIn().getHeader(AWS2S3Constants.ACL, BucketCannedACL.class);
         if (ObjectHelper.isNotEmpty(acl)) {
             // note: if cannedacl and acl are both specified the last one will
@@ -396,6 +416,26 @@ private void doPutObject(
             putObjectRequest.acl(objectAcl);
         }
 
+        String grantFullControl = exchange.getIn().getHeader(AWS2S3Constants.GRANT_FULL_CONTROL, String.class);
+        if (ObjectHelper.isNotEmpty(grantFullControl)) {
+            putObjectRequest.grantFullControl(grantFullControl);
+        }
+
+        String grantRead = exchange.getIn().getHeader(AWS2S3Constants.GRANT_READ, String.class);
+        if (ObjectHelper.isNotEmpty(grantRead)) {
+            putObjectRequest.grantRead(grantRead);
+        }
+
+        String grantReadACP = exchange.getIn().getHeader(AWS2S3Constants.GRANT_READ_ACP, String.class);
+        if (ObjectHelper.isNotEmpty(grantReadACP)) {
+            putObjectRequest.grantReadACP(grantReadACP);
+        }
+
+        String grantWriteACP = exchange.getIn().getHeader(AWS2S3Constants.GRANT_WRITE_ACP, String.class);
+        if (ObjectHelper.isNotEmpty(grantWriteACP)) {
+            putObjectRequest.grantWriteACP(grantWriteACP);
+        }
+
         String contentType = exchange.getIn().getHeader(AWS2S3Constants.CONTENT_TYPE, String.class);
         if (ObjectHelper.isNotEmpty(contentType)) {
             putObjectRequest.contentType(contentType);

components/camel-aws/camel-aws2-s3/src/test/java/org/apache/camel/component/aws2/s3/AWS2S3ProducerAclGrantTest.java

@@ -0,0 +1,118 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.aws2.s3;
+
+import org.apache.camel.Exchange;
+import org.apache.camel.impl.DefaultCamelContext;
+import org.apache.camel.support.DefaultExchange;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import software.amazon.awssdk.core.sync.RequestBody;
+import software.amazon.awssdk.http.SdkHttpResponse;
+import software.amazon.awssdk.services.s3.S3Client;
+import software.amazon.awssdk.services.s3.model.PutObjectRequest;
+import software.amazon.awssdk.services.s3.model.PutObjectResponse;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+/**
+ * Verifies that the {@code CamelAwsS3Grant*} headers are applied as explicit ACL grants on the {@code PutObject}
+ * request (CAMEL-16809).
+ */
+class AWS2S3ProducerAclGrantTest {
+
+    @Mock
+    private AWS2S3Endpoint endpoint;
+
+    @Mock
+    private AWS2S3Configuration configuration;
+
+    @Mock
+    private S3Client s3Client;
+
+    private AWS2S3Producer producer;
+    private DefaultCamelContext camelContext;
+
+    @BeforeEach
+    void setUp() {
+        MockitoAnnotations.openMocks(this);
+        camelContext = new DefaultCamelContext();
+        when(endpoint.getConfiguration()).thenReturn(configuration);
+        when(endpoint.getCamelContext()).thenReturn(camelContext);
+        when(endpoint.getS3Client()).thenReturn(s3Client);
+        when(configuration.getBucketName()).thenReturn("test-bucket");
+        producer = new AWS2S3Producer(endpoint);
+    }
+
+    private void mockPutObject() {
+        when(s3Client.putObject(any(PutObjectRequest.class), any(RequestBody.class)))
+                .thenReturn((PutObjectResponse) PutObjectResponse.builder()
+                        .sdkHttpResponse(SdkHttpResponse.builder().statusCode(200).build())
+                        .build());
+    }
+
+    private PutObjectRequest capturePutObjectRequest() {
+        ArgumentCaptor<PutObjectRequest> captor = ArgumentCaptor.forClass(PutObjectRequest.class);
+        verify(s3Client).putObject(captor.capture(), any(RequestBody.class));
+        return captor.getValue();
+    }
+
+    @Test
+    void putObjectShouldApplyAclGrantHeaders() throws Exception {
+        mockPutObject();
+
+        Exchange exchange = new DefaultExchange(camelContext);
+        exchange.getIn().setHeader(AWS2S3Constants.KEY, "my-key");
+        exchange.getIn().setHeader(AWS2S3Constants.GRANT_FULL_CONTROL, "id=canonical-full");
+        exchange.getIn().setHeader(AWS2S3Constants.GRANT_READ, "id=canonical-read");
+        exchange.getIn().setHeader(AWS2S3Constants.GRANT_READ_ACP, "emailAddress=readacp@example.com");
+        exchange.getIn().setHeader(AWS2S3Constants.GRANT_WRITE_ACP,
+                "uri=http://acs.amazonaws.com/groups/global/AllUsers");
+        exchange.getIn().setBody("hello grant");
+
+        producer.process(exchange);
+
+        PutObjectRequest request = capturePutObjectRequest();
+        assertThat(request.grantFullControl()).isEqualTo("id=canonical-full");
+        assertThat(request.grantRead()).isEqualTo("id=canonical-read");
+        assertThat(request.grantReadACP()).isEqualTo("emailAddress=readacp@example.com");
+        assertThat(request.grantWriteACP()).isEqualTo("uri=http://acs.amazonaws.com/groups/global/AllUsers");
+    }
+
+    @Test
+    void putObjectWithoutGrantHeadersLeavesGrantsUnset() throws Exception {
+        mockPutObject();
+
+        Exchange exchange = new DefaultExchange(camelContext);
+        exchange.getIn().setHeader(AWS2S3Constants.KEY, "my-key");
+        exchange.getIn().setBody("hello");
+
+        producer.process(exchange);
+
+        PutObjectRequest request = capturePutObjectRequest();
+        assertThat(request.grantFullControl()).isNull();
+        assertThat(request.grantRead()).isNull();
+        assertThat(request.grantReadACP()).isNull();
+        assertThat(request.grantWriteACP()).isNull();
+    }
+}

dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/AWS2S3EndpointBuilderFactory.java

@@ -3982,6 +3982,59 @@ public String awsS3CannedAcl() {
         public String awsS3Acl() {
             return "CamelAwsS3Acl";
         }
+        /**
+         * Gives the grantee READ, READ_ACP, and WRITE_ACP permissions on the
+         * object. The value is a grantee expression such as id=, emailAddress=
+         * or uri=.
+         * 
+         * The option is a: {@code String} type.
+         * 
+         * Group: producer
+         * 
+         * @return the name of the header {@code AwsS3GrantFullControl}.
+         */
+        public String awsS3GrantFullControl() {
+            return "CamelAwsS3GrantFullControl";
+        }
+        /**
+         * Allows the grantee to read the object data and its metadata. The
+         * value is a grantee expression such as id=, emailAddress= or uri=.
+         * 
+         * The option is a: {@code String} type.
+         * 
+         * Group: producer
+         * 
+         * @return the name of the header {@code AwsS3GrantRead}.
+         */
+        public String awsS3GrantRead() {
+            return "CamelAwsS3GrantRead";
+        }
+        /**
+         * Allows the grantee to read the object ACL. The value is a grantee
+         * expression such as id=, emailAddress= or uri=.
+         * 
+         * The option is a: {@code String} type.
+         * 
+         * Group: producer
+         * 
+         * @return the name of the header {@code AwsS3GrantReadACP}.
+         */
+        public String awsS3GrantReadACP() {
+            return "CamelAwsS3GrantReadACP";
+        }
+        /**
+         * Allows the grantee to write the ACL for the object. The value is a
+         * grantee expression such as id=, emailAddress= or uri=.
+         * 
+         * The option is a: {@code String} type.
+         * 
+         * Group: producer
+         * 
+         * @return the name of the header {@code AwsS3GrantWriteACP}.
+         */
+        public String awsS3GrantWriteACP() {
+            return "CamelAwsS3GrantWriteACP";
+        }
         /**
          * The operation to perform. Permitted values are copyObject,
          * deleteObject, listBuckets, deleteBucket, listObjects.