Mono repo -> Master (#22553)

Combines the following repositories into one:

https://github.com/mattermost/mattermost-server
https://github.com/mattermost/mattermost-webapp
https://github.com/mattermost/focalboard
https://github.com/mattermost/mattermost-plugin-playbooks

server/platform/shared/filestore/filesstore.go

@@ -0,0 +1,102 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package filestore
+
+import (
+	"context"
+	"io"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+const (
+	driverS3    = "amazons3"
+	driverLocal = "local"
+)
+
+type ReadCloseSeeker interface {
+	io.ReadCloser
+	io.Seeker
+}
+
+type FileBackend interface {
+	TestConnection() error
+
+	Reader(path string) (ReadCloseSeeker, error)
+	ReadFile(path string) ([]byte, error)
+	FileExists(path string) (bool, error)
+	FileSize(path string) (int64, error)
+	CopyFile(oldPath, newPath string) error
+	MoveFile(oldPath, newPath string) error
+	WriteFile(fr io.Reader, path string) (int64, error)
+	AppendFile(fr io.Reader, path string) (int64, error)
+	RemoveFile(path string) error
+	FileModTime(path string) (time.Time, error)
+
+	ListDirectory(path string) ([]string, error)
+	ListDirectoryRecursively(path string) ([]string, error)
+	RemoveDirectory(path string) error
+}
+
+type FileBackendSettings struct {
+	DriverName                         string
+	Directory                          string
+	AmazonS3AccessKeyId                string
+	AmazonS3SecretAccessKey            string
+	AmazonS3Bucket                     string
+	AmazonS3PathPrefix                 string
+	AmazonS3Region                     string
+	AmazonS3Endpoint                   string
+	AmazonS3SSL                        bool
+	AmazonS3SignV2                     bool
+	AmazonS3SSE                        bool
+	AmazonS3Trace                      bool
+	SkipVerify                         bool
+	AmazonS3RequestTimeoutMilliseconds int64
+}
+
+func (settings *FileBackendSettings) CheckMandatoryS3Fields() error {
+	if settings.AmazonS3Bucket == "" {
+		return errors.New("missing s3 bucket settings")
+	}
+
+	// if S3 endpoint is not set call the set defaults to set that
+	if settings.AmazonS3Endpoint == "" {
+		settings.AmazonS3Endpoint = "s3.amazonaws.com"
+	}
+
+	return nil
+}
+
+func NewFileBackend(settings FileBackendSettings) (FileBackend, error) {
+	switch settings.DriverName {
+	case driverS3:
+		backend, err := NewS3FileBackend(settings)
+		if err != nil {
+			return nil, errors.Wrap(err, "unable to connect to the s3 backend")
+		}
+		return backend, nil
+	case driverLocal:
+		return &LocalFileBackend{
+			directory: settings.Directory,
+		}, nil
+	}
+	return nil, errors.New("no valid filestorage driver found")
+}
+
+// TryWriteFileContext checks if the file backend supports context writes and passes the context in that case.
+// Should the file backend not support contexts, it just calls WriteFile instead. This can be used to disable
+// the timeouts for long writes (like exports).
+func TryWriteFileContext(fb FileBackend, ctx context.Context, fr io.Reader, path string) (int64, error) {
+	type ContextWriter interface {
+		WriteFileContext(context.Context, io.Reader, string) (int64, error)
+	}
+
+	if cw, ok := fb.(ContextWriter); ok {
+		return cw.WriteFileContext(ctx, fr, path)
+	}
+
+	return fb.WriteFile(fr, path)
+}

server/platform/shared/filestore/filesstore_test.go

@@ -0,0 +1,623 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package filestore
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"math/rand"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"github.com/xtgo/uuid"
+
+	"github.com/mattermost/mattermost-server/v6/server/platform/shared/mlog"
+)
+
+func randomString() string {
+	return uuid.NewRandom().String()
+}
+
+type FileBackendTestSuite struct {
+	suite.Suite
+
+	settings FileBackendSettings
+	backend  FileBackend
+}
+
+func TestLocalFileBackendTestSuite(t *testing.T) {
+	// Setup a global logger to catch tests logging outside of app context
+	// The global logger will be stomped by apps initializing but that's fine for testing. Ideally this won't happen.
+	logger := mlog.CreateConsoleTestLogger(true, mlog.LvlError)
+	defer logger.Shutdown()
+
+	mlog.InitGlobalLogger(logger)
+
+	dir, err := os.MkdirTemp("", "")
+	require.NoError(t, err)
+	defer os.RemoveAll(dir)
+
+	suite.Run(t, &FileBackendTestSuite{
+		settings: FileBackendSettings{
+			DriverName: driverLocal,
+			Directory:  dir,
+		},
+	})
+}
+
+func TestS3FileBackendTestSuite(t *testing.T) {
+	runBackendTest(t, false)
+}
+
+func TestS3FileBackendTestSuiteWithEncryption(t *testing.T) {
+	runBackendTest(t, true)
+}
+
+func runBackendTest(t *testing.T, encrypt bool) {
+	s3Host := os.Getenv("CI_MINIO_HOST")
+	if s3Host == "" {
+		s3Host = "localhost"
+	}
+
+	s3Port := os.Getenv("CI_MINIO_PORT")
+	if s3Port == "" {
+		s3Port = "9000"
+	}
+
+	s3Endpoint := fmt.Sprintf("%s:%s", s3Host, s3Port)
+
+	suite.Run(t, &FileBackendTestSuite{
+		settings: FileBackendSettings{
+			DriverName:                         driverS3,
+			AmazonS3AccessKeyId:                "minioaccesskey",
+			AmazonS3SecretAccessKey:            "miniosecretkey",
+			AmazonS3Bucket:                     "mattermost-test",
+			AmazonS3Region:                     "",
+			AmazonS3Endpoint:                   s3Endpoint,
+			AmazonS3PathPrefix:                 "",
+			AmazonS3SSL:                        false,
+			AmazonS3SSE:                        encrypt,
+			AmazonS3RequestTimeoutMilliseconds: 5000,
+		},
+	})
+}
+
+func (s *FileBackendTestSuite) SetupTest() {
+	backend, err := NewFileBackend(s.settings)
+	require.NoError(s.T(), err)
+	s.backend = backend
+
+	// This is needed to create the bucket if it doesn't exist.
+	err = s.backend.TestConnection()
+	if _, ok := err.(*S3FileBackendNoBucketError); ok {
+		s3Backend := s.backend.(*S3FileBackend)
+		s.NoError(s3Backend.MakeBucket())
+	} else {
+		s.NoError(err)
+	}
+}
+
+func (s *FileBackendTestSuite) TestConnection() {
+	s.Nil(s.backend.TestConnection())
+}
+
+func (s *FileBackendTestSuite) TestReadWriteFile() {
+	b := []byte("test")
+	path := "tests/" + randomString()
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+	defer s.backend.RemoveFile(path)
+
+	read, err := s.backend.ReadFile(path)
+	s.Nil(err)
+
+	readString := string(read)
+	s.EqualValues(readString, "test")
+}
+
+func (s *FileBackendTestSuite) TestReadWriteFileContext() {
+	type ContextWriter interface {
+		WriteFileContext(context.Context, io.Reader, string) (int64, error)
+	}
+
+	data := "test"
+
+	s.T().Run("no deadline", func(t *testing.T) {
+		var (
+			written int64
+			err     error
+		)
+
+		path := "tests/" + randomString()
+
+		ctx := context.Background()
+		if cw, ok := s.backend.(ContextWriter); ok {
+			written, err = cw.WriteFileContext(ctx, strings.NewReader(data), path)
+		} else {
+			written, err = s.backend.WriteFile(strings.NewReader(data), path)
+		}
+		s.NoError(err)
+		s.EqualValues(len(data), written, "expected given number of bytes to have been written")
+		defer s.backend.RemoveFile(path)
+
+		read, err := s.backend.ReadFile(path)
+		s.NoError(err)
+
+		readString := string(read)
+		s.Equal(readString, data)
+	})
+
+	s.T().Run("long deadline", func(t *testing.T) {
+		var (
+			written int64
+			err     error
+		)
+
+		path := "tests/" + randomString()
+
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		if cw, ok := s.backend.(ContextWriter); ok {
+			written, err = cw.WriteFileContext(ctx, strings.NewReader(data), path)
+		} else {
+			written, err = s.backend.WriteFile(strings.NewReader(data), path)
+		}
+		s.NoError(err)
+		s.EqualValues(len(data), written, "expected given number of bytes to have been written")
+		defer s.backend.RemoveFile(path)
+
+		read, err := s.backend.ReadFile(path)
+		s.NoError(err)
+
+		readString := string(read)
+		s.Equal(readString, data)
+	})
+
+	s.T().Run("missed deadline", func(t *testing.T) {
+		var (
+			written int64
+			err     error
+		)
+
+		path := "tests/" + randomString()
+
+		r, w := io.Pipe()
+		go func() {
+			// close the writer after a short time
+			time.Sleep(500 * time.Millisecond)
+			w.Close()
+		}()
+		ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+		defer cancel()
+		if cw, ok := s.backend.(ContextWriter); ok {
+			written, err = cw.WriteFileContext(ctx, r, path)
+		} else {
+			// this test works only with a context writer
+			return
+		}
+		s.Error(err)
+		s.Zero(written)
+	})
+}
+
+func (s *FileBackendTestSuite) TestReadWriteFileImage() {
+	b := []byte("testimage")
+	path := "tests/" + randomString() + ".png"
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+	defer s.backend.RemoveFile(path)
+
+	read, err := s.backend.ReadFile(path)
+	s.Nil(err)
+
+	readString := string(read)
+	s.EqualValues(readString, "testimage")
+}
+
+func (s *FileBackendTestSuite) TestFileExists() {
+	b := []byte("testimage")
+	path := "tests/" + randomString() + ".png"
+
+	_, err := s.backend.WriteFile(bytes.NewReader(b), path)
+	s.Nil(err)
+	defer s.backend.RemoveFile(path)
+
+	res, err := s.backend.FileExists(path)
+	s.Nil(err)
+	s.True(res)
+
+	res, err = s.backend.FileExists("tests/idontexist.png")
+	s.Nil(err)
+	s.False(res)
+}
+
+func (s *FileBackendTestSuite) TestCopyFile() {
+	b := []byte("test")
+	path1 := "tests/" + randomString()
+	path2 := "tests/" + randomString()
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path1)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+	defer s.backend.RemoveFile(path1)
+
+	err = s.backend.CopyFile(path1, path2)
+	s.Nil(err)
+	defer s.backend.RemoveFile(path2)
+
+	data1, err := s.backend.ReadFile(path1)
+	s.Nil(err)
+
+	data2, err := s.backend.ReadFile(path2)
+	s.Nil(err)
+
+	s.Equal(b, data1)
+	s.Equal(b, data2)
+}
+
+func (s *FileBackendTestSuite) TestCopyFileToDirectoryThatDoesntExist() {
+	b := []byte("test")
+	path1 := "tests/" + randomString()
+	path2 := "tests/newdirectory/" + randomString()
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path1)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+	defer s.backend.RemoveFile(path1)
+
+	err = s.backend.CopyFile(path1, path2)
+	s.Nil(err)
+	defer s.backend.RemoveFile(path2)
+
+	_, err = s.backend.ReadFile(path1)
+	s.Nil(err)
+
+	_, err = s.backend.ReadFile(path2)
+	s.Nil(err)
+}
+
+func (s *FileBackendTestSuite) TestMoveFile() {
+	b := []byte("test")
+	path1 := "tests/" + randomString()
+	path2 := "tests/" + randomString()
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path1)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+	defer s.backend.RemoveFile(path1)
+
+	s.Nil(s.backend.MoveFile(path1, path2))
+	defer s.backend.RemoveFile(path2)
+
+	_, err = s.backend.ReadFile(path1)
+	s.Error(err)
+
+	data, err := s.backend.ReadFile(path2)
+	s.Nil(err)
+
+	s.Equal(b, data)
+}
+
+func (s *FileBackendTestSuite) TestRemoveFile() {
+	b := []byte("test")
+	path := "tests/" + randomString()
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+	s.Nil(s.backend.RemoveFile(path))
+
+	_, err = s.backend.ReadFile(path)
+	s.Error(err)
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), "tests2/foo")
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), "tests2/bar")
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), "tests2/asdf")
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	s.Nil(s.backend.RemoveDirectory("tests2"))
+}
+
+func (s *FileBackendTestSuite) TestListDirectory() {
+	b := []byte("test")
+	path1 := "19700101/" + randomString()
+	path2 := "19800101/" + randomString()
+
+	paths, err := s.backend.ListDirectory("19700101")
+	s.Nil(err)
+	s.Len(paths, 0)
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path1)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), path2)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	paths, err = s.backend.ListDirectory("19700101")
+	s.Nil(err)
+	s.Len(paths, 1)
+	s.Equal(path1, (paths)[0])
+
+	paths, err = s.backend.ListDirectory("19800101/")
+	s.Nil(err)
+	s.Len(paths, 1)
+	s.Equal(path2, (paths)[0])
+
+	if s.settings.DriverName == driverLocal {
+		paths, err = s.backend.ListDirectory("19800102")
+		s.Nil(err)
+		s.Len(paths, 0)
+	}
+
+	paths, err = s.backend.ListDirectory("")
+	s.Nil(err)
+	found1 := false
+	found2 := false
+	for _, path := range paths {
+		if path == "19700101" {
+			found1 = true
+		} else if path == "19800101" {
+			found2 = true
+		}
+	}
+	s.True(found1)
+	s.True(found2)
+
+	s.backend.RemoveFile(path1)
+	s.backend.RemoveFile(path2)
+}
+
+func (s *FileBackendTestSuite) TestListDirectoryRecursively() {
+	b := []byte("test")
+	path1 := "19700101/" + randomString()
+	path2 := "19800101/" + randomString()
+	longPath := "19800102/this/is/a/way/too/long/path/for/this/function/to/handle" + randomString()
+
+	paths, err := s.backend.ListDirectoryRecursively("19700101")
+	s.Nil(err)
+	s.Len(paths, 0)
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), path1)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), path2)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), longPath)
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	paths, err = s.backend.ListDirectoryRecursively("19700101")
+	s.Nil(err)
+	s.Len(paths, 1)
+	s.Equal(path1, (paths)[0])
+
+	paths, err = s.backend.ListDirectoryRecursively("19800101/")
+	s.Nil(err)
+	s.Len(paths, 1)
+	s.Equal(path2, (paths)[0])
+
+	if s.settings.DriverName == driverLocal {
+		paths, err = s.backend.ListDirectory("19800102")
+		s.Nil(err)
+		s.Len(paths, 1)
+	}
+
+	paths, err = s.backend.ListDirectoryRecursively("")
+	s.Nil(err)
+	found1 := false
+	found2 := false
+	found3 := false
+	for _, path := range paths {
+		if path == path1 {
+			found1 = true
+		} else if path == path2 {
+			found2 = true
+		} else if path == longPath {
+			found3 = true
+		}
+	}
+	s.True(found1)
+	s.True(found2)
+	if s.settings.DriverName == driverLocal {
+		s.False(found3)
+	}
+
+	s.backend.RemoveFile(path1)
+	s.backend.RemoveFile(path2)
+	s.backend.RemoveFile(longPath)
+}
+
+func (s *FileBackendTestSuite) TestRemoveDirectory() {
+	b := []byte("test")
+
+	written, err := s.backend.WriteFile(bytes.NewReader(b), "tests2/foo")
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), "tests2/bar")
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	written, err = s.backend.WriteFile(bytes.NewReader(b), "tests2/aaa")
+	s.Nil(err)
+	s.EqualValues(len(b), written, "expected given number of bytes to have been written")
+
+	s.Nil(s.backend.RemoveDirectory("tests2"))
+
+	_, err = s.backend.ReadFile("tests2/foo")
+	s.Error(err)
+	_, err = s.backend.ReadFile("tests2/bar")
+	s.Error(err)
+	_, err = s.backend.ReadFile("tests2/asdf")
+	s.Error(err)
+}
+
+func (s *FileBackendTestSuite) TestAppendFile() {
+	s.Run("should fail if target file is missing", func() {
+		path := "tests/" + randomString()
+		b := make([]byte, 1024)
+		written, err := s.backend.AppendFile(bytes.NewReader(b), path)
+		s.Error(err)
+		s.Zero(written)
+	})
+
+	s.Run("should correctly append the data", func() {
+		// First part needs to be at least 5MB for the S3 implementation to work.
+		size := 5 * 1024 * 1024
+		b := make([]byte, size)
+		for i := range b {
+			b[i] = 'A'
+		}
+		path := "tests/" + randomString()
+
+		written, err := s.backend.WriteFile(bytes.NewReader(b), path)
+		s.Nil(err)
+		s.EqualValues(len(b), written)
+		defer s.backend.RemoveFile(path)
+
+		b2 := make([]byte, 1024)
+		for i := range b2 {
+			b2[i] = 'B'
+		}
+
+		written, err = s.backend.AppendFile(bytes.NewReader(b2), path)
+		s.Nil(err)
+		s.EqualValues(int64(len(b2)), written)
+
+		read, err := s.backend.ReadFile(path)
+		s.Nil(err)
+		s.EqualValues(len(b)+len(b2), len(read))
+		s.True(bytes.Equal(append(b, b2...), read))
+
+		b3 := make([]byte, 1024)
+		for i := range b3 {
+			b3[i] = 'C'
+		}
+
+		written, err = s.backend.AppendFile(bytes.NewReader(b3), path)
+		s.Nil(err)
+		s.EqualValues(int64(len(b3)), written)
+
+		read, err = s.backend.ReadFile(path)
+		s.Nil(err)
+		s.EqualValues(len(b)+len(b2)+len(b3), len(read))
+		s.True(bytes.Equal(append(append(b, b2...), b3...), read))
+	})
+}
+
+func (s *FileBackendTestSuite) TestFileSize() {
+	s.Run("nonexistent file", func() {
+		size, err := s.backend.FileSize("tests/nonexistentfile")
+		s.NotNil(err)
+		s.Zero(size)
+	})
+
+	s.Run("valid file", func() {
+		data := make([]byte, rand.Intn(1024*1024)+1)
+		path := "tests/" + randomString()
+
+		written, err := s.backend.WriteFile(bytes.NewReader(data), path)
+		s.Nil(err)
+		s.EqualValues(len(data), written)
+		defer s.backend.RemoveFile(path)
+
+		size, err := s.backend.FileSize(path)
+		s.Nil(err)
+		s.Equal(int64(len(data)), size)
+	})
+}
+
+func (s *FileBackendTestSuite) TestFileModTime() {
+	s.Run("nonexistent file", func() {
+		modTime, err := s.backend.FileModTime("tests/nonexistentfile")
+		s.NotNil(err)
+		s.Empty(modTime)
+	})
+
+	s.Run("valid file", func() {
+		path := "tests/" + randomString()
+		data := []byte("some data")
+
+		written, err := s.backend.WriteFile(bytes.NewReader(data), path)
+		s.Nil(err)
+		s.EqualValues(len(data), written)
+		defer s.backend.RemoveFile(path)
+
+		modTime, err := s.backend.FileModTime(path)
+		s.Nil(err)
+		s.NotEmpty(modTime)
+
+		// We wait 1 second so that the times will differ enough to be testable.
+		time.Sleep(1 * time.Second)
+
+		path2 := "tests/" + randomString()
+		written, err = s.backend.WriteFile(bytes.NewReader(data), path2)
+		s.Nil(err)
+		s.EqualValues(len(data), written)
+		defer s.backend.RemoveFile(path2)
+
+		modTime2, err := s.backend.FileModTime(path2)
+		s.Nil(err)
+		s.NotEmpty(modTime2)
+		s.True(modTime2.After(modTime))
+	})
+}
+
+func BenchmarkS3WriteFile(b *testing.B) {
+	settings := FileBackendSettings{
+		DriverName:                         driverS3,
+		AmazonS3AccessKeyId:                "minioaccesskey",
+		AmazonS3SecretAccessKey:            "miniosecretkey",
+		AmazonS3Bucket:                     "mattermost-test",
+		AmazonS3Region:                     "",
+		AmazonS3Endpoint:                   "localhost:9000",
+		AmazonS3PathPrefix:                 "",
+		AmazonS3SSL:                        false,
+		AmazonS3SSE:                        false,
+		AmazonS3RequestTimeoutMilliseconds: 20000,
+	}
+
+	backend, err := NewFileBackend(settings)
+	require.NoError(b, err)
+
+	// This is needed to create the bucket if it doesn't exist.
+	require.NoError(b, backend.TestConnection())
+
+	path := "tests/" + randomString()
+	size := 1 * 1024 * 1024
+	data := make([]byte, size)
+
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		written, err := backend.WriteFile(bytes.NewReader(data), path)
+		defer backend.RemoveFile(path)
+		require.NoError(b, err)
+		require.Len(b, data, int(written))
+	}
+
+	b.StopTimer()
+}

server/platform/shared/filestore/localstore.go

@@ -0,0 +1,239 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package filestore
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/pkg/errors"
+
+	"github.com/mattermost/mattermost-server/v6/server/platform/shared/mlog"
+)
+
+const (
+	TestFilePath = "/testfile"
+)
+
+type LocalFileBackend struct {
+	directory string
+}
+
+// copyFile will copy a file from src path to dst path.
+// Overwrites any existing files at dst.
+// Permissions are copied from file at src to the new file at dst.
+func copyFile(src, dst string) (err error) {
+	in, err := os.Open(src)
+	if err != nil {
+		return
+	}
+	defer in.Close()
+
+	if err = os.MkdirAll(filepath.Dir(dst), os.ModePerm); err != nil {
+		return
+	}
+	out, err := os.Create(dst)
+	if err != nil {
+		return
+	}
+	defer func() {
+		if e := out.Close(); e != nil {
+			err = e
+		}
+	}()
+
+	_, err = io.Copy(out, in)
+	if err != nil {
+		return
+	}
+
+	err = out.Sync()
+	if err != nil {
+		return
+	}
+
+	stat, err := os.Stat(src)
+	if err != nil {
+		return
+	}
+	err = os.Chmod(dst, stat.Mode())
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (b *LocalFileBackend) TestConnection() error {
+	f := bytes.NewReader([]byte("testingwrite"))
+	if _, err := writeFileLocally(f, filepath.Join(b.directory, TestFilePath)); err != nil {
+		return errors.Wrap(err, "unable to write to the local filesystem storage")
+	}
+	os.Remove(filepath.Join(b.directory, TestFilePath))
+	mlog.Debug("Able to write files to local storage.")
+	return nil
+}
+
+func (b *LocalFileBackend) Reader(path string) (ReadCloseSeeker, error) {
+	f, err := os.Open(filepath.Join(b.directory, path))
+	if err != nil {
+		return nil, errors.Wrapf(err, "unable to open file %s", path)
+	}
+	return f, nil
+}
+
+func (b *LocalFileBackend) ReadFile(path string) ([]byte, error) {
+	f, err := os.ReadFile(filepath.Join(b.directory, path))
+	if err != nil {
+		return nil, errors.Wrapf(err, "unable to read file %s", path)
+	}
+	return f, nil
+}
+
+func (b *LocalFileBackend) FileExists(path string) (bool, error) {
+	_, err := os.Stat(filepath.Join(b.directory, path))
+
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+
+	if err != nil {
+		return false, errors.Wrapf(err, "unable to know if file %s exists", path)
+	}
+	return true, nil
+}
+
+func (b *LocalFileBackend) FileSize(path string) (int64, error) {
+	info, err := os.Stat(filepath.Join(b.directory, path))
+	if err != nil {
+		return 0, errors.Wrapf(err, "unable to get file size for %s", path)
+	}
+	return info.Size(), nil
+}
+
+func (b *LocalFileBackend) FileModTime(path string) (time.Time, error) {
+	info, err := os.Stat(filepath.Join(b.directory, path))
+	if err != nil {
+		return time.Time{}, errors.Wrapf(err, "unable to get modification time for file %s", path)
+	}
+	return info.ModTime(), nil
+}
+
+func (b *LocalFileBackend) CopyFile(oldPath, newPath string) error {
+	if err := copyFile(filepath.Join(b.directory, oldPath), filepath.Join(b.directory, newPath)); err != nil {
+		return errors.Wrapf(err, "unable to copy file from %s to %s", oldPath, newPath)
+	}
+	return nil
+}
+
+func (b *LocalFileBackend) MoveFile(oldPath, newPath string) error {
+	if err := os.MkdirAll(filepath.Dir(filepath.Join(b.directory, newPath)), 0750); err != nil {
+		return errors.Wrapf(err, "unable to create the new destination directory %s", filepath.Dir(newPath))
+	}
+
+	if err := os.Rename(filepath.Join(b.directory, oldPath), filepath.Join(b.directory, newPath)); err != nil {
+		return errors.Wrapf(err, "unable to move the file to %s to the destination directory", newPath)
+	}
+
+	return nil
+}
+
+func (b *LocalFileBackend) WriteFile(fr io.Reader, path string) (int64, error) {
+	return writeFileLocally(fr, filepath.Join(b.directory, path))
+}
+
+func writeFileLocally(fr io.Reader, path string) (int64, error) {
+	if err := os.MkdirAll(filepath.Dir(path), 0750); err != nil {
+		directory, _ := filepath.Abs(filepath.Dir(path))
+		return 0, errors.Wrapf(err, "unable to create the directory %s for the file %s", directory, path)
+	}
+	fw, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return 0, errors.Wrapf(err, "unable to open the file %s to write the data", path)
+	}
+	defer fw.Close()
+	written, err := io.Copy(fw, fr)
+	if err != nil {
+		return written, errors.Wrapf(err, "unable write the data in the file %s", path)
+	}
+	return written, nil
+}
+
+func (b *LocalFileBackend) AppendFile(fr io.Reader, path string) (int64, error) {
+	fp := filepath.Join(b.directory, path)
+	if _, err := os.Stat(fp); err != nil {
+		return 0, errors.Wrapf(err, "unable to find the file %s to append the data", path)
+	}
+	fw, err := os.OpenFile(fp, os.O_WRONLY|os.O_APPEND, 0600)
+	if err != nil {
+		return 0, errors.Wrapf(err, "unable to open the file %s to append the data", path)
+	}
+	defer fw.Close()
+	written, err := io.Copy(fw, fr)
+	if err != nil {
+		return written, errors.Wrapf(err, "unable append the data in the file %s", path)
+	}
+	return written, nil
+}
+
+func (b *LocalFileBackend) RemoveFile(path string) error {
+	if err := os.Remove(filepath.Join(b.directory, path)); err != nil {
+		return errors.Wrapf(err, "unable to remove the file %s", path)
+	}
+	return nil
+}
+
+// basePath: path to get to the file but won't be added to the end result
+// path: basePath+path current directory we are looking at
+// maxDepth: parameter to prevent infinite recursion, once this is reached we won't look any further
+func appendRecursively(basePath, path string, maxDepth int) ([]string, error) {
+	results := []string{}
+	dirEntries, err := os.ReadDir(filepath.Join(basePath, path))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return results, nil
+		}
+		return results, errors.Wrapf(err, "unable to list the directory %s", path)
+	}
+	for _, dirEntry := range dirEntries {
+		entryName := dirEntry.Name()
+		entryPath := filepath.Join(path, entryName)
+		if entryName == "." || entryName == ".." || entryPath == path {
+			continue
+		}
+		if dirEntry.IsDir() {
+			if maxDepth <= 0 {
+				mlog.Warn("Max Depth reached", mlog.String("path", entryPath))
+				results = append(results, entryPath)
+				continue // we'll ignore it if max depth is reached.
+			}
+			nestedResults, err := appendRecursively(basePath, entryPath, maxDepth-1)
+			if err != nil {
+				return results, err
+			}
+			results = append(results, nestedResults...)
+		} else {
+			results = append(results, entryPath)
+		}
+	}
+	return results, nil
+}
+
+func (b *LocalFileBackend) ListDirectory(path string) ([]string, error) {
+	return appendRecursively(b.directory, path, 0)
+}
+
+func (b *LocalFileBackend) ListDirectoryRecursively(path string) ([]string, error) {
+	return appendRecursively(b.directory, path, 10)
+}
+
+func (b *LocalFileBackend) RemoveDirectory(path string) error {
+	if err := os.RemoveAll(filepath.Join(b.directory, path)); err != nil {
+		return errors.Wrapf(err, "unable to remove the directory %s", path)
+	}
+	return nil
+}

server/platform/shared/filestore/mocks/FileBackend.go

@@ -0,0 +1,287 @@
+// Code generated by mockery v2.10.4. DO NOT EDIT.
+
+// Regenerate this file using `make filestore-mocks`.
+
+package mocks
+
+import (
+	io "io"
+
+	filestore "github.com/mattermost/mattermost-server/v6/server/platform/shared/filestore"
+
+	mock "github.com/stretchr/testify/mock"
+
+	time "time"
+)
+
+// FileBackend is an autogenerated mock type for the FileBackend type
+type FileBackend struct {
+	mock.Mock
+}
+
+// AppendFile provides a mock function with given fields: fr, path
+func (_m *FileBackend) AppendFile(fr io.Reader, path string) (int64, error) {
+	ret := _m.Called(fr, path)
+
+	var r0 int64
+	if rf, ok := ret.Get(0).(func(io.Reader, string) int64); ok {
+		r0 = rf(fr, path)
+	} else {
+		r0 = ret.Get(0).(int64)
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(io.Reader, string) error); ok {
+		r1 = rf(fr, path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// CopyFile provides a mock function with given fields: oldPath, newPath
+func (_m *FileBackend) CopyFile(oldPath string, newPath string) error {
+	ret := _m.Called(oldPath, newPath)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string, string) error); ok {
+		r0 = rf(oldPath, newPath)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// FileExists provides a mock function with given fields: path
+func (_m *FileBackend) FileExists(path string) (bool, error) {
+	ret := _m.Called(path)
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(string) bool); ok {
+		r0 = rf(path)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// FileModTime provides a mock function with given fields: path
+func (_m *FileBackend) FileModTime(path string) (time.Time, error) {
+	ret := _m.Called(path)
+
+	var r0 time.Time
+	if rf, ok := ret.Get(0).(func(string) time.Time); ok {
+		r0 = rf(path)
+	} else {
+		r0 = ret.Get(0).(time.Time)
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// FileSize provides a mock function with given fields: path
+func (_m *FileBackend) FileSize(path string) (int64, error) {
+	ret := _m.Called(path)
+
+	var r0 int64
+	if rf, ok := ret.Get(0).(func(string) int64); ok {
+		r0 = rf(path)
+	} else {
+		r0 = ret.Get(0).(int64)
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ListDirectory provides a mock function with given fields: path
+func (_m *FileBackend) ListDirectory(path string) ([]string, error) {
+	ret := _m.Called(path)
+
+	var r0 []string
+	if rf, ok := ret.Get(0).(func(string) []string); ok {
+		r0 = rf(path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]string)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ListDirectoryRecursively provides a mock function with given fields: path
+func (_m *FileBackend) ListDirectoryRecursively(path string) ([]string, error) {
+	ret := _m.Called(path)
+
+	var r0 []string
+	if rf, ok := ret.Get(0).(func(string) []string); ok {
+		r0 = rf(path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]string)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MoveFile provides a mock function with given fields: oldPath, newPath
+func (_m *FileBackend) MoveFile(oldPath string, newPath string) error {
+	ret := _m.Called(oldPath, newPath)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string, string) error); ok {
+		r0 = rf(oldPath, newPath)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// ReadFile provides a mock function with given fields: path
+func (_m *FileBackend) ReadFile(path string) ([]byte, error) {
+	ret := _m.Called(path)
+
+	var r0 []byte
+	if rf, ok := ret.Get(0).(func(string) []byte); ok {
+		r0 = rf(path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]byte)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Reader provides a mock function with given fields: path
+func (_m *FileBackend) Reader(path string) (filestore.ReadCloseSeeker, error) {
+	ret := _m.Called(path)
+
+	var r0 filestore.ReadCloseSeeker
+	if rf, ok := ret.Get(0).(func(string) filestore.ReadCloseSeeker); ok {
+		r0 = rf(path)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(filestore.ReadCloseSeeker)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// RemoveDirectory provides a mock function with given fields: path
+func (_m *FileBackend) RemoveDirectory(path string) error {
+	ret := _m.Called(path)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string) error); ok {
+		r0 = rf(path)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// RemoveFile provides a mock function with given fields: path
+func (_m *FileBackend) RemoveFile(path string) error {
+	ret := _m.Called(path)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string) error); ok {
+		r0 = rf(path)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// TestConnection provides a mock function with given fields:
+func (_m *FileBackend) TestConnection() error {
+	ret := _m.Called()
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// WriteFile provides a mock function with given fields: fr, path
+func (_m *FileBackend) WriteFile(fr io.Reader, path string) (int64, error) {
+	ret := _m.Called(fr, path)
+
+	var r0 int64
+	if rf, ok := ret.Get(0).(func(io.Reader, string) int64); ok {
+		r0 = rf(fr, path)
+	} else {
+		r0 = ret.Get(0).(int64)
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(io.Reader, string) error); ok {
+		r1 = rf(fr, path)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}

server/platform/shared/filestore/mocks/ReadCloseSeeker.go

@@ -0,0 +1,68 @@
+// Code generated by mockery v2.10.4. DO NOT EDIT.
+
+// Regenerate this file using `make filestore-mocks`.
+
+package mocks
+
+import mock "github.com/stretchr/testify/mock"
+
+// ReadCloseSeeker is an autogenerated mock type for the ReadCloseSeeker type
+type ReadCloseSeeker struct {
+	mock.Mock
+}
+
+// Close provides a mock function with given fields:
+func (_m *ReadCloseSeeker) Close() error {
+	ret := _m.Called()
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Read provides a mock function with given fields: p
+func (_m *ReadCloseSeeker) Read(p []byte) (int, error) {
+	ret := _m.Called(p)
+
+	var r0 int
+	if rf, ok := ret.Get(0).(func([]byte) int); ok {
+		r0 = rf(p)
+	} else {
+		r0 = ret.Get(0).(int)
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func([]byte) error); ok {
+		r1 = rf(p)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Seek provides a mock function with given fields: offset, whence
+func (_m *ReadCloseSeeker) Seek(offset int64, whence int) (int64, error) {
+	ret := _m.Called(offset, whence)
+
+	var r0 int64
+	if rf, ok := ret.Get(0).(func(int64, int) int64); ok {
+		r0 = rf(offset, whence)
+	} else {
+		r0 = ret.Get(0).(int64)
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(int64, int) error); ok {
+		r1 = rf(offset, whence)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}

server/platform/shared/filestore/s3_overrides.go

@@ -0,0 +1,55 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package filestore
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/minio/minio-go/v7/pkg/credentials"
+)
+
+// customTransport is used to point the request to a different server.
+// This is helpful in situations where a different service is handling AWS S3 requests
+// from multiple Mattermost applications, and the Mattermost service itself does not
+// have any S3 credentials.
+type customTransport struct {
+	host   string
+	scheme string
+	client http.Client
+}
+
+// RoundTrip implements the http.Roundtripper interface.
+func (t *customTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Roundtrippers should not modify the original request.
+	newReq := req.Clone(context.Background())
+	*newReq.URL = *req.URL
+	req.URL.Scheme = t.scheme
+	req.URL.Host = t.host
+	return t.client.Do(req)
+}
+
+// customProvider is a dummy credentials provider for the minio client to work
+// without actually providing credentials. This is needed with a custom transport
+// in cases where the minio client does not actually have credentials with itself,
+// rather needs responses from another entity.
+//
+// It satisfies the credentials.Provider interface.
+type customProvider struct {
+	isSignV2 bool
+}
+
+// Retrieve just returns empty credentials.
+func (cp customProvider) Retrieve() (credentials.Value, error) {
+	sign := credentials.SignatureV4
+	if cp.isSignV2 {
+		sign = credentials.SignatureV2
+	}
+	return credentials.Value{
+		SignerType: sign,
+	}, nil
+}
+
+// IsExpired always returns false.
+func (cp customProvider) IsExpired() bool { return false }

server/platform/shared/filestore/s3store.go

@@ -0,0 +1,584 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package filestore
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	s3 "github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+	"github.com/minio/minio-go/v7/pkg/encrypt"
+	"github.com/pkg/errors"
+
+	"github.com/mattermost/mattermost-server/v6/server/platform/shared/mlog"
+)
+
+// S3FileBackend contains all necessary information to communicate with
+// an AWS S3 compatible API backend.
+type S3FileBackend struct {
+	endpoint   string
+	accessKey  string
+	secretKey  string
+	secure     bool
+	signV2     bool
+	region     string
+	bucket     string
+	pathPrefix string
+	encrypt    bool
+	trace      bool
+	client     *s3.Client
+	skipVerify bool
+	timeout    time.Duration
+}
+
+type S3FileBackendAuthError struct {
+	DetailedError string
+}
+
+// S3FileBackendNoBucketError is returned when testing a connection and no S3 bucket is found
+type S3FileBackendNoBucketError struct{}
+
+const (
+	// This is not exported by minio. See: https://github.com/minio/minio-go/issues/1339
+	bucketNotFound = "NoSuchBucket"
+)
+
+var (
+	imageExtensions = map[string]bool{".jpg": true, ".jpeg": true, ".gif": true, ".bmp": true, ".png": true, ".tiff": true, "tif": true}
+	imageMimeTypes  = map[string]string{".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".bmp": "image/bmp", ".png": "image/png", ".tiff": "image/tiff", ".tif": "image/tif"}
+)
+
+var (
+	// Ensure that the ReaderAt interface is implemented.
+	_ io.ReaderAt = (*s3WithCancel)(nil)
+)
+
+func isFileExtImage(ext string) bool {
+	ext = strings.ToLower(ext)
+	return imageExtensions[ext]
+}
+
+func getImageMimeType(ext string) string {
+	ext = strings.ToLower(ext)
+	if imageMimeTypes[ext] == "" {
+		return "image"
+	}
+	return imageMimeTypes[ext]
+}
+
+func (s *S3FileBackendAuthError) Error() string {
+	return s.DetailedError
+}
+
+func (s *S3FileBackendNoBucketError) Error() string {
+	return "no such bucket"
+}
+
+// NewS3FileBackend returns an instance of an S3FileBackend.
+func NewS3FileBackend(settings FileBackendSettings) (*S3FileBackend, error) {
+	timeout := time.Duration(settings.AmazonS3RequestTimeoutMilliseconds) * time.Millisecond
+	backend := &S3FileBackend{
+		endpoint:   settings.AmazonS3Endpoint,
+		accessKey:  settings.AmazonS3AccessKeyId,
+		secretKey:  settings.AmazonS3SecretAccessKey,
+		secure:     settings.AmazonS3SSL,
+		signV2:     settings.AmazonS3SignV2,
+		region:     settings.AmazonS3Region,
+		bucket:     settings.AmazonS3Bucket,
+		pathPrefix: settings.AmazonS3PathPrefix,
+		encrypt:    settings.AmazonS3SSE,
+		trace:      settings.AmazonS3Trace,
+		skipVerify: settings.SkipVerify,
+		timeout:    timeout,
+	}
+	cli, err := backend.s3New()
+	if err != nil {
+		return nil, err
+	}
+	backend.client = cli
+	return backend, nil
+}
+
+// Similar to s3.New() but allows initialization of signature v2 or signature v4 client.
+// If signV2 input is false, function always returns signature v4.
+//
+// Additionally this function also takes a user defined region, if set
+// disables automatic region lookup.
+func (b *S3FileBackend) s3New() (*s3.Client, error) {
+	var creds *credentials.Credentials
+
+	isCloud := os.Getenv("MM_CLOUD_FILESTORE_BIFROST") != ""
+	if isCloud {
+		creds = credentials.New(customProvider{isSignV2: b.signV2})
+	} else if b.accessKey == "" && b.secretKey == "" {
+		creds = credentials.NewIAM("")
+	} else if b.signV2 {
+		creds = credentials.NewStatic(b.accessKey, b.secretKey, "", credentials.SignatureV2)
+	} else {
+		creds = credentials.NewStatic(b.accessKey, b.secretKey, "", credentials.SignatureV4)
+	}
+
+	opts := s3.Options{
+		Creds:  creds,
+		Secure: b.secure,
+		Region: b.region,
+	}
+
+	tr, err := s3.DefaultTransport(b.secure)
+	if err != nil {
+		return nil, err
+	}
+	if b.skipVerify {
+		tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+	opts.Transport = tr
+
+	// If this is a cloud installation, we override the default transport.
+	if isCloud {
+		scheme := "http"
+		if b.secure {
+			scheme = "https"
+		}
+		newTransport := http.DefaultTransport.(*http.Transport).Clone()
+		newTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: b.skipVerify}
+		opts.Transport = &customTransport{
+			host:   b.endpoint,
+			scheme: scheme,
+			client: http.Client{Transport: newTransport},
+		}
+	}
+
+	s3Clnt, err := s3.New(b.endpoint, &opts)
+	if err != nil {
+		return nil, err
+	}
+
+	if b.trace {
+		s3Clnt.TraceOn(os.Stdout)
+	}
+
+	return s3Clnt, nil
+}
+
+func (b *S3FileBackend) TestConnection() error {
+	exists := true
+	var err error
+	// If a path prefix is present, we attempt to test the bucket by listing objects under the path
+	// and just checking the first response. This is because the BucketExists call is only at a bucket level
+	// and sometimes the user might only be allowed access to the specified path prefix.
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	if b.pathPrefix != "" {
+		obj := <-b.client.ListObjects(ctx, b.bucket, s3.ListObjectsOptions{Prefix: b.pathPrefix})
+		if obj.Err != nil {
+			typedErr := s3.ToErrorResponse(obj.Err)
+			if typedErr.Code != bucketNotFound {
+				return &S3FileBackendAuthError{DetailedError: "unable to list objects in the S3 bucket"}
+			}
+			exists = false
+		}
+	} else {
+		exists, err = b.client.BucketExists(ctx, b.bucket)
+		if err != nil {
+			return &S3FileBackendAuthError{DetailedError: "unable to check if the S3 bucket exists"}
+		}
+	}
+
+	if !exists {
+		return &S3FileBackendNoBucketError{}
+	}
+	mlog.Debug("Connection to S3 or minio is good. Bucket exists.")
+	return nil
+}
+
+func (b *S3FileBackend) MakeBucket() error {
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	err := b.client.MakeBucket(ctx, b.bucket, s3.MakeBucketOptions{Region: b.region})
+	if err != nil {
+		return errors.Wrap(err, "unable to create the s3 bucket")
+	}
+	return nil
+}
+
+// s3WithCancel is a wrapper struct which cancels the context
+// when the object is closed.
+type s3WithCancel struct {
+	*s3.Object
+	timer  *time.Timer
+	cancel context.CancelFunc
+}
+
+func (sc *s3WithCancel) Close() error {
+	sc.timer.Stop()
+	sc.cancel()
+	return sc.Object.Close()
+}
+
+// CancelTimeout attempts to cancel the timeout for this reader. It allows calling
+// code to ignore the timeout in case of longer running operations. The methods returns
+// false if the timeout has already fired.
+func (sc *s3WithCancel) CancelTimeout() bool {
+	return sc.timer.Stop()
+}
+
+// Caller must close the first return value
+func (b *S3FileBackend) Reader(path string) (ReadCloseSeeker, error) {
+	path = filepath.Join(b.pathPrefix, path)
+	ctx, cancel := context.WithCancel(context.Background())
+	minioObject, err := b.client.GetObject(ctx, b.bucket, path, s3.GetObjectOptions{})
+	if err != nil {
+		cancel()
+		return nil, errors.Wrapf(err, "unable to open file %s", path)
+	}
+
+	sc := &s3WithCancel{
+		Object: minioObject,
+		timer:  time.AfterFunc(b.timeout, cancel),
+		cancel: cancel,
+	}
+
+	return sc, nil
+}
+
+func (b *S3FileBackend) ReadFile(path string) ([]byte, error) {
+	path = filepath.Join(b.pathPrefix, path)
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	minioObject, err := b.client.GetObject(ctx, b.bucket, path, s3.GetObjectOptions{})
+	if err != nil {
+		return nil, errors.Wrapf(err, "unable to open file %s", path)
+	}
+
+	defer minioObject.Close()
+	f, err := io.ReadAll(minioObject)
+	if err != nil {
+		return nil, errors.Wrapf(err, "unable to read file %s", path)
+	}
+	return f, nil
+}
+
+func (b *S3FileBackend) FileExists(path string) (bool, error) {
+	path = filepath.Join(b.pathPrefix, path)
+
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	_, err := b.client.StatObject(ctx, b.bucket, path, s3.StatObjectOptions{})
+	if err == nil {
+		return true, nil
+	}
+
+	var s3Err s3.ErrorResponse
+	if errors.As(err, &s3Err); s3Err.Code == "NoSuchKey" {
+		return false, nil
+	}
+
+	return false, errors.Wrapf(err, "unable to know if file %s exists", path)
+}
+
+func (b *S3FileBackend) FileSize(path string) (int64, error) {
+	path = filepath.Join(b.pathPrefix, path)
+
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	info, err := b.client.StatObject(ctx, b.bucket, path, s3.StatObjectOptions{})
+	if err != nil {
+		return 0, errors.Wrapf(err, "unable to get file size for %s", path)
+	}
+
+	return info.Size, nil
+}
+
+func (b *S3FileBackend) FileModTime(path string) (time.Time, error) {
+	path = filepath.Join(b.pathPrefix, path)
+
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	info, err := b.client.StatObject(ctx, b.bucket, path, s3.StatObjectOptions{})
+	if err != nil {
+		return time.Time{}, errors.Wrapf(err, "unable to get modification time for file %s", path)
+	}
+
+	return info.LastModified, nil
+}
+
+func (b *S3FileBackend) CopyFile(oldPath, newPath string) error {
+	oldPath = filepath.Join(b.pathPrefix, oldPath)
+	newPath = filepath.Join(b.pathPrefix, newPath)
+	srcOpts := s3.CopySrcOptions{
+		Bucket: b.bucket,
+		Object: oldPath,
+	}
+	if b.encrypt {
+		srcOpts.Encryption = encrypt.NewSSE()
+	}
+
+	dstOpts := s3.CopyDestOptions{
+		Bucket: b.bucket,
+		Object: newPath,
+	}
+	if b.encrypt {
+		dstOpts.Encryption = encrypt.NewSSE()
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	if _, err := b.client.CopyObject(ctx, dstOpts, srcOpts); err != nil {
+		return errors.Wrapf(err, "unable to copy file from %s to %s", oldPath, newPath)
+	}
+
+	return nil
+}
+
+func (b *S3FileBackend) MoveFile(oldPath, newPath string) error {
+	oldPath = filepath.Join(b.pathPrefix, oldPath)
+	newPath = filepath.Join(b.pathPrefix, newPath)
+	srcOpts := s3.CopySrcOptions{
+		Bucket: b.bucket,
+		Object: oldPath,
+	}
+	if b.encrypt {
+		srcOpts.Encryption = encrypt.NewSSE()
+	}
+
+	dstOpts := s3.CopyDestOptions{
+		Bucket: b.bucket,
+		Object: newPath,
+	}
+	if b.encrypt {
+		dstOpts.Encryption = encrypt.NewSSE()
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	if _, err := b.client.CopyObject(ctx, dstOpts, srcOpts); err != nil {
+		return errors.Wrapf(err, "unable to copy the file to %s to the new destination", newPath)
+	}
+
+	ctx2, cancel2 := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel2()
+	if err := b.client.RemoveObject(ctx2, b.bucket, oldPath, s3.RemoveObjectOptions{}); err != nil {
+		return errors.Wrapf(err, "unable to remove the file old file %s", oldPath)
+	}
+
+	return nil
+}
+
+func (b *S3FileBackend) WriteFile(fr io.Reader, path string) (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+
+	return b.WriteFileContext(ctx, fr, path)
+}
+
+func (b *S3FileBackend) WriteFileContext(ctx context.Context, fr io.Reader, path string) (int64, error) {
+	var contentType string
+	path = filepath.Join(b.pathPrefix, path)
+	if ext := filepath.Ext(path); isFileExtImage(ext) {
+		contentType = getImageMimeType(ext)
+	} else {
+		contentType = "binary/octet-stream"
+	}
+
+	options := s3PutOptions(b.encrypt, contentType)
+
+	objSize := int64(-1)
+	isCloud := os.Getenv("MM_CLOUD_FILESTORE_BIFROST") != ""
+	if isCloud {
+		options.DisableContentSha256 = true
+	} else {
+		// We pass an object size only in situations where bifrost is not
+		// used. Bifrost needs to run in HTTPS, which is not yet deployed.
+		switch t := fr.(type) {
+		case *bytes.Buffer:
+			objSize = int64(t.Len())
+		case *os.File:
+			if s, err := t.Stat(); err == nil {
+				objSize = s.Size()
+			}
+		}
+	}
+
+	info, err := b.client.PutObject(ctx, b.bucket, path, fr, objSize, options)
+	if err != nil {
+		return info.Size, errors.Wrapf(err, "unable write the data in the file %s", path)
+	}
+
+	return info.Size, nil
+}
+
+func (b *S3FileBackend) AppendFile(fr io.Reader, path string) (int64, error) {
+	fp := filepath.Join(b.pathPrefix, path)
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	if _, err := b.client.StatObject(ctx, b.bucket, fp, s3.StatObjectOptions{}); err != nil {
+		return 0, errors.Wrapf(err, "unable to find the file %s to append the data", path)
+	}
+
+	var contentType string
+	if ext := filepath.Ext(fp); isFileExtImage(ext) {
+		contentType = getImageMimeType(ext)
+	} else {
+		contentType = "binary/octet-stream"
+	}
+
+	options := s3PutOptions(b.encrypt, contentType)
+	sse := options.ServerSideEncryption
+	partName := fp + ".part"
+	ctx2, cancel2 := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel2()
+	objSize := -1
+	isCloud := os.Getenv("MM_CLOUD_FILESTORE_BIFROST") != ""
+	if isCloud {
+		options.DisableContentSha256 = true
+	}
+	// We pass an object size only in situations where bifrost is not
+	// used. Bifrost needs to run in HTTPS, which is not yet deployed.
+	if buf, ok := fr.(*bytes.Buffer); ok && !isCloud {
+		objSize = buf.Len()
+	}
+	info, err := b.client.PutObject(ctx2, b.bucket, partName, fr, int64(objSize), options)
+	if err != nil {
+		return 0, errors.Wrapf(err, "unable append the data in the file %s", path)
+	}
+	defer func() {
+		ctx4, cancel4 := context.WithTimeout(context.Background(), b.timeout)
+		defer cancel4()
+		b.client.RemoveObject(ctx4, b.bucket, partName, s3.RemoveObjectOptions{})
+	}()
+
+	src1Opts := s3.CopySrcOptions{
+		Bucket: b.bucket,
+		Object: fp,
+	}
+	src2Opts := s3.CopySrcOptions{
+		Bucket: b.bucket,
+		Object: partName,
+	}
+	dstOpts := s3.CopyDestOptions{
+		Bucket:     b.bucket,
+		Object:     fp,
+		Encryption: sse,
+	}
+	ctx3, cancel3 := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel3()
+	_, err = b.client.ComposeObject(ctx3, dstOpts, src1Opts, src2Opts)
+	if err != nil {
+		return 0, errors.Wrapf(err, "unable append the data in the file %s", path)
+	}
+	return info.Size, nil
+
+}
+
+func (b *S3FileBackend) RemoveFile(path string) error {
+	path = filepath.Join(b.pathPrefix, path)
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	if err := b.client.RemoveObject(ctx, b.bucket, path, s3.RemoveObjectOptions{}); err != nil {
+		return errors.Wrapf(err, "unable to remove the file %s", path)
+	}
+
+	return nil
+}
+
+func getPathsFromObjectInfos(in <-chan s3.ObjectInfo) <-chan s3.ObjectInfo {
+	out := make(chan s3.ObjectInfo, 1)
+
+	go func() {
+		defer close(out)
+
+		for {
+			info, done := <-in
+
+			if !done {
+				break
+			}
+
+			out <- info
+		}
+	}()
+
+	return out
+}
+
+func (b *S3FileBackend) listDirectory(path string, recursion bool) ([]string, error) {
+	path = filepath.Join(b.pathPrefix, path)
+	if !strings.HasSuffix(path, "/") && path != "" {
+		// s3Clnt returns only the path itself when "/" is not present
+		// appending "/" to make it consistent across all filestores
+		path = path + "/"
+	}
+
+	opts := s3.ListObjectsOptions{
+		Prefix:    path,
+		Recursive: recursion,
+	}
+	var paths []string
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	for object := range b.client.ListObjects(ctx, b.bucket, opts) {
+		if object.Err != nil {
+			return nil, errors.Wrapf(object.Err, "unable to list the directory %s", path)
+		}
+		// We strip the path prefix that gets applied,
+		// so that it remains transparent to the application.
+		object.Key = strings.TrimPrefix(object.Key, b.pathPrefix)
+		trimmed := strings.Trim(object.Key, "/")
+		if trimmed != "" {
+			paths = append(paths, trimmed)
+		}
+	}
+
+	return paths, nil
+}
+
+func (b *S3FileBackend) ListDirectory(path string) ([]string, error) {
+	return b.listDirectory(path, false)
+}
+
+func (b *S3FileBackend) ListDirectoryRecursively(path string) ([]string, error) {
+	return b.listDirectory(path, true)
+}
+
+func (b *S3FileBackend) RemoveDirectory(path string) error {
+	opts := s3.ListObjectsOptions{
+		Prefix:    filepath.Join(b.pathPrefix, path),
+		Recursive: true,
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel()
+	list := b.client.ListObjects(ctx, b.bucket, opts)
+
+	ctx2, cancel2 := context.WithTimeout(context.Background(), b.timeout)
+	defer cancel2()
+	objectsCh := b.client.RemoveObjects(ctx2, b.bucket, getPathsFromObjectInfos(list), s3.RemoveObjectsOptions{})
+	for err := range objectsCh {
+		if err.Err != nil {
+			return errors.Wrapf(err.Err, "unable to remove the directory %s", path)
+		}
+	}
+
+	return nil
+}
+
+func s3PutOptions(encrypted bool, contentType string) s3.PutObjectOptions {
+	options := s3.PutObjectOptions{}
+	if encrypted {
+		options.ServerSideEncryption = encrypt.NewSSE()
+	}
+	options.ContentType = contentType
+	// We set the part size to the minimum allowed value of 5MBs
+	// to avoid an excessive allocation in minio.PutObject implementation.
+	options.PartSize = 1024 * 1024 * 5
+
+	return options
+}

server/platform/shared/filestore/s3store_test.go

@@ -0,0 +1,307 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package filestore
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	s3 "github.com/minio/minio-go/v7"
+	"github.com/stretchr/testify/require"
+)
+
+// Copied from model/config.go to avoid an import cycle
+const (
+	MinioAccessKey = "minioaccesskey"
+	MinioSecretKey = "miniosecretkey"
+	ImageDriverS3  = "amazons3"
+)
+
+func TestCheckMandatoryS3Fields(t *testing.T) {
+	cfg := FileBackendSettings{}
+
+	err := cfg.CheckMandatoryS3Fields()
+	require.Error(t, err)
+	require.Equal(t, err.Error(), "missing s3 bucket settings", "should've failed with missing s3 bucket")
+
+	cfg.AmazonS3Bucket = "test-mm"
+	err = cfg.CheckMandatoryS3Fields()
+	require.NoError(t, err)
+
+	cfg.AmazonS3Endpoint = ""
+	err = cfg.CheckMandatoryS3Fields()
+	require.NoError(t, err)
+
+	require.Equal(t, "s3.amazonaws.com", cfg.AmazonS3Endpoint, "should've set the endpoint to the default")
+}
+
+func TestMakeBucket(t *testing.T) {
+	s3Host := os.Getenv("CI_MINIO_HOST")
+	if s3Host == "" {
+		s3Host = "localhost"
+	}
+
+	s3Port := os.Getenv("CI_MINIO_PORT")
+	if s3Port == "" {
+		s3Port = "9000"
+	}
+
+	s3Endpoint := fmt.Sprintf("%s:%s", s3Host, s3Port)
+
+	// Generate a random bucket name
+	b := make([]byte, 30)
+	rand.Read(b)
+	bucketName := base64.StdEncoding.EncodeToString(b)
+	bucketName = strings.ToLower(bucketName)
+	bucketName = strings.Replace(bucketName, "+", "", -1)
+	bucketName = strings.Replace(bucketName, "/", "", -1)
+
+	cfg := FileBackendSettings{
+		DriverName:                         ImageDriverS3,
+		AmazonS3AccessKeyId:                MinioAccessKey,
+		AmazonS3SecretAccessKey:            MinioSecretKey,
+		AmazonS3Bucket:                     bucketName,
+		AmazonS3Endpoint:                   s3Endpoint,
+		AmazonS3Region:                     "",
+		AmazonS3PathPrefix:                 "",
+		AmazonS3SSL:                        false,
+		SkipVerify:                         false,
+		AmazonS3RequestTimeoutMilliseconds: 5000,
+	}
+
+	fileBackend, err := NewS3FileBackend(cfg)
+	require.NoError(t, err)
+
+	err = fileBackend.MakeBucket()
+	require.NoError(t, err)
+}
+
+func TestTimeout(t *testing.T) {
+	s3Host := os.Getenv("CI_MINIO_HOST")
+	if s3Host == "" {
+		s3Host = "localhost"
+	}
+
+	s3Port := os.Getenv("CI_MINIO_PORT")
+	if s3Port == "" {
+		s3Port = "9000"
+	}
+
+	s3Endpoint := fmt.Sprintf("%s:%s", s3Host, s3Port)
+
+	// Generate a random bucket name
+	b := make([]byte, 30)
+	rand.Read(b)
+	bucketName := base64.StdEncoding.EncodeToString(b)
+	bucketName = strings.ToLower(bucketName)
+	bucketName = strings.Replace(bucketName, "+", "", -1)
+	bucketName = strings.Replace(bucketName, "/", "", -1)
+
+	cfg := FileBackendSettings{
+		DriverName:                         ImageDriverS3,
+		AmazonS3AccessKeyId:                MinioAccessKey,
+		AmazonS3SecretAccessKey:            MinioSecretKey,
+		AmazonS3Bucket:                     bucketName,
+		AmazonS3Endpoint:                   s3Endpoint,
+		AmazonS3Region:                     "",
+		AmazonS3PathPrefix:                 "",
+		AmazonS3SSL:                        false,
+		SkipVerify:                         false,
+		AmazonS3RequestTimeoutMilliseconds: 0,
+	}
+
+	fileBackend, err := NewS3FileBackend(cfg)
+	require.NoError(t, err)
+
+	err = fileBackend.MakeBucket()
+	require.True(t, errors.Is(err, context.DeadlineExceeded))
+
+	path := "tests/" + randomString() + ".png"
+	_, err = fileBackend.WriteFile(bytes.NewReader([]byte("testimage")), path)
+	require.True(t, errors.Is(err, context.DeadlineExceeded))
+}
+
+func TestInsecureMakeBucket(t *testing.T) {
+	s3Host := os.Getenv("CI_MINIO_HOST")
+	if s3Host == "" {
+		s3Host = "localhost"
+	}
+
+	s3Port := os.Getenv("CI_MINIO_PORT")
+	if s3Port == "" {
+		s3Port = "9000"
+	}
+
+	s3Endpoint := fmt.Sprintf("%s:%s", s3Host, s3Port)
+
+	proxySelfSignedHTTPS := newTLSProxyServer(&url.URL{Scheme: "http", Host: s3Endpoint})
+	defer proxySelfSignedHTTPS.Close()
+
+	enableInsecure, secure := true, false
+
+	testCases := []struct {
+		description     string
+		skipVerify      bool
+		expectedAllowed bool
+	}{
+		{"allow self-signed HTTPS when insecure enabled", enableInsecure, true},
+		{"reject self-signed HTTPS when secured", secure, false},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.description, func(t *testing.T) {
+			// Generate a random bucket name
+			b := make([]byte, 30)
+			rand.Read(b)
+			bucketName := base64.StdEncoding.EncodeToString(b)
+			bucketName = strings.ToLower(bucketName)
+			bucketName = strings.Replace(bucketName, "+", "", -1)
+			bucketName = strings.Replace(bucketName, "/", "", -1)
+
+			cfg := FileBackendSettings{
+				DriverName:                         ImageDriverS3,
+				AmazonS3AccessKeyId:                MinioAccessKey,
+				AmazonS3SecretAccessKey:            MinioSecretKey,
+				AmazonS3Bucket:                     bucketName,
+				AmazonS3Endpoint:                   proxySelfSignedHTTPS.URL[8:],
+				AmazonS3Region:                     "",
+				AmazonS3PathPrefix:                 "",
+				AmazonS3SSL:                        true,
+				SkipVerify:                         testCase.skipVerify,
+				AmazonS3RequestTimeoutMilliseconds: 5000,
+			}
+
+			fileBackend, err := NewS3FileBackend(cfg)
+			require.NoError(t, err)
+
+			err = fileBackend.MakeBucket()
+			if testCase.expectedAllowed {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+			}
+		})
+	}
+}
+func newTLSProxyServer(backend *url.URL) *httptest.Server {
+	return httptest.NewTLSServer(httputil.NewSingleHostReverseProxy(backend))
+}
+
+func TestS3WithCancel(t *testing.T) {
+	// Some of these tests use time.Sleep to wait for the timeout to expire.
+	// They are run in parallel to reduce wait times.
+
+	t.Run("zero timeout", func(t *testing.T) {
+		t.Parallel()
+		r, ctx := newMockS3WithCancel(0, nil)
+
+		time.Sleep(10 * time.Millisecond) // give the context time to cancel
+
+		require.False(t, r.CancelTimeout())
+		require.Error(t, ctx.Err())
+	})
+
+	t.Run("timeout", func(t *testing.T) {
+		t.Parallel()
+		r, ctx := newMockS3WithCancel(50*time.Millisecond, nil)
+
+		time.Sleep(100 * time.Millisecond) // give the context time to cancel
+
+		require.False(t, r.CancelTimeout())
+		require.Error(t, ctx.Err())
+	})
+
+	t.Run("timeout cancel", func(t *testing.T) {
+		t.Parallel()
+		r, ctx := newMockS3WithCancel(50*time.Millisecond, nil)
+
+		time.Sleep(10 * time.Millisecond) // give the context time to cancel
+
+		require.True(t, r.CancelTimeout())
+		require.NoError(t, ctx.Err())
+
+		time.Sleep(100 * time.Millisecond) // wait for the original (canceled) timeout to expire
+
+		require.False(t, r.CancelTimeout())
+		require.NoError(t, ctx.Err())
+		require.NoError(t, r.Close())
+	})
+
+	t.Run("timeout closed", func(t *testing.T) {
+		t.Parallel()
+		r, ctx := newMockS3WithCancel(50*time.Millisecond, nil)
+
+		time.Sleep(10 * time.Millisecond) // give the context time to cancel
+
+		require.True(t, r.CancelTimeout())
+		require.NoError(t, ctx.Err())
+		require.NoError(t, r.Close())
+
+		time.Sleep(100 * time.Millisecond) // wait for the original (canceled) timeout to expire
+
+		require.False(t, r.CancelTimeout())
+		require.Error(t, ctx.Err())
+		require.NoError(t, r.Close())
+	})
+
+	t.Run("close cancel close", func(t *testing.T) {
+		t.Parallel()
+		r, ctx := newMockS3WithCancel(50*time.Millisecond, nil)
+
+		time.Sleep(10 * time.Millisecond) // give the context time to cancel
+
+		require.True(t, r.CancelTimeout())
+		require.NoError(t, r.Close())
+		require.Error(t, ctx.Err())
+		require.False(t, r.CancelTimeout())
+		require.Error(t, ctx.Err())
+		require.NoError(t, r.Close())
+	})
+
+	t.Run("close error", func(t *testing.T) {
+		t.Parallel()
+		r, ctx := newMockS3WithCancel(50*time.Millisecond, errors.New("test error"))
+
+		time.Sleep(10 * time.Millisecond) // give the context time to cancel
+
+		require.NoError(t, ctx.Err())
+		require.Error(t, r.Close())
+		require.False(t, r.CancelTimeout())
+		require.Error(t, ctx.Err())
+	})
+}
+
+func newMockS3WithCancel(timeout time.Duration, closeErr error) (*fauxCloser, context.Context) {
+	ctx, cancel := context.WithCancel(context.Background())
+	return &fauxCloser{
+		s3WithCancel: &s3WithCancel{
+			Object: &s3.Object{},
+			timer:  time.AfterFunc(timeout, cancel),
+			cancel: cancel,
+		},
+		closeErr: closeErr,
+	}, ctx
+}
+
+type fauxCloser struct {
+	*s3WithCancel
+	closeErr error
+}
+
+func (fc fauxCloser) Close() error {
+	fc.s3WithCancel.timer.Stop()
+	fc.s3WithCancel.cancel()
+	return fc.closeErr
+}