Initial gh-pages

backend/internal/services/garage_admin.go

@@ -0,0 +1,460 @@
+package services
+
+import (
+	"Noooste/garage-ui/internal/config"
+	"Noooste/garage-ui/internal/models"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/Noooste/azuretls-client"
+)
+
+// GarageAdminService handles interactions with the Garage Admin API
+type GarageAdminService struct {
+	baseURL    string
+	token      string
+	httpClient *azuretls.Session
+}
+
+// NewGarageAdminService creates a new Garage Admin API service
+func NewGarageAdminService(cfg *config.GarageConfig) *GarageAdminService {
+	session := azuretls.NewSession()
+	session.Log()
+
+	return &GarageAdminService{
+		baseURL:    cfg.AdminEndpoint,
+		token:      cfg.AdminToken,
+		httpClient: session,
+	}
+}
+
+// doRequest performs an HTTP request to the Admin API
+func (s *GarageAdminService) doRequest(ctx context.Context, method, path string, body interface{}) (*azuretls.Response, error) {
+	return s.httpClient.Do(&azuretls.Request{
+		Method:     method,
+		Url:        s.baseURL + path,
+		Body:       body,
+		IgnoreBody: true, // decodeResponse will handle body reading
+		OrderedHeaders: azuretls.OrderedHeaders{
+			{"Authorization", fmt.Sprintf("Bearer %s", s.token)},
+		},
+	}, ctx)
+}
+
+// decodeResponse decodes a JSON response into the target structure
+func decodeResponse(resp *azuretls.Response, target interface{}) error {
+	defer resp.RawBody.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		bodyBytes, _ := io.ReadAll(resp.RawBody)
+		return fmt.Errorf("API returned status %d: %s", resp.StatusCode, string(bodyBytes))
+	}
+
+	if target != nil {
+		if err := json.NewDecoder(resp.RawBody).Decode(target); err != nil {
+			return fmt.Errorf("failed to decode response: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// ====================================
+// Access Key Operations
+// ====================================
+
+// ListKeys returns all access keys in the cluster
+func (s *GarageAdminService) ListKeys(ctx context.Context) ([]models.ListKeysResponseItem, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/ListKeys", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result []models.ListKeysResponseItem
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return result, nil
+}
+
+// CreateKey creates a new API access key
+func (s *GarageAdminService) CreateKey(ctx context.Context, req models.CreateKeyRequest) (*models.GarageKeyInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/CreateKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetKeyInfo returns information about a specific access key
+func (s *GarageAdminService) GetKeyInfo(ctx context.Context, keyID string, showSecret bool) (*models.GarageKeyInfo, error) {
+	path := fmt.Sprintf("/v2/GetKeyInfo?id=%s", keyID)
+	if showSecret {
+		path += "&showSecretKey=true"
+	}
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// UpdateKey updates information about an access key
+func (s *GarageAdminService) UpdateKey(ctx context.Context, keyID string, req models.UpdateKeyRequest) (*models.GarageKeyInfo, error) {
+	path := fmt.Sprintf("/v2/UpdateKey?id=%s", keyID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// DeleteKey deletes an access key from the cluster
+func (s *GarageAdminService) DeleteKey(ctx context.Context, keyID string) error {
+	path := fmt.Sprintf("/v2/DeleteKey?id=%s", keyID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, nil)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+
+	if err := decodeResponse(resp, nil); err != nil {
+		return fmt.Errorf("failed to process response: %w", err)
+	}
+
+	return nil
+}
+
+// ImportKey imports an existing API access key
+func (s *GarageAdminService) ImportKey(ctx context.Context, req models.ImportKeyRequest) (*models.GarageKeyInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/ImportKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Bucket Operations (Admin API)
+// ====================================
+
+// ListBuckets returns all buckets in the cluster
+func (s *GarageAdminService) ListBuckets(ctx context.Context) ([]models.ListBucketsResponseItem, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/ListBuckets", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result []models.ListBucketsResponseItem
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return result, nil
+}
+
+// GetBucketInfo returns detailed information about a bucket by ID
+func (s *GarageAdminService) GetBucketInfo(ctx context.Context, bucketID string) (*models.GarageBucketInfo, error) {
+	path := fmt.Sprintf("/v2/GetBucketInfo?id=%s", bucketID)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetBucketInfoByAlias returns detailed information about a bucket by its global alias
+func (s *GarageAdminService) GetBucketInfoByAlias(ctx context.Context, globalAlias string) (*models.GarageBucketInfo, error) {
+	path := fmt.Sprintf("/v2/GetBucketInfo?globalAlias=%s", globalAlias)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// CreateBucket creates a new bucket via the Admin API
+func (s *GarageAdminService) CreateBucket(ctx context.Context, req models.CreateBucketAdminRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/CreateBucket", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// UpdateBucket updates bucket settings
+func (s *GarageAdminService) UpdateBucket(ctx context.Context, bucketID string, req models.UpdateBucketRequest) (*models.GarageBucketInfo, error) {
+	path := fmt.Sprintf("/v2/UpdateBucket?id=%s", bucketID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// DeleteBucket deletes a bucket
+func (s *GarageAdminService) DeleteBucket(ctx context.Context, bucketID string) error {
+	path := fmt.Sprintf("/v2/DeleteBucket?id=%s", bucketID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, nil)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+
+	if err := decodeResponse(resp, nil); err != nil {
+		return fmt.Errorf("failed to process response: %w", err)
+	}
+
+	return nil
+}
+
+// ====================================
+// Bucket Alias Operations
+// ====================================
+
+// AddBucketAlias adds an alias to a bucket
+func (s *GarageAdminService) AddBucketAlias(ctx context.Context, req models.AddBucketAliasRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/AddBucketAlias", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// RemoveBucketAlias removes an alias from a bucket
+func (s *GarageAdminService) RemoveBucketAlias(ctx context.Context, req models.RemoveBucketAliasRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/RemoveBucketAlias", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Permission Operations
+// ====================================
+
+// AllowBucketKey grants permissions for a key on a bucket
+func (s *GarageAdminService) AllowBucketKey(ctx context.Context, req models.BucketKeyPermRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/AllowBucketKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// DenyBucketKey revokes permissions for a key on a bucket
+func (s *GarageAdminService) DenyBucketKey(ctx context.Context, req models.BucketKeyPermRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/DenyBucketKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Cluster Operations
+// ====================================
+
+// GetClusterHealth returns the health status of the cluster
+func (s *GarageAdminService) GetClusterHealth(ctx context.Context) (*models.ClusterHealth, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/GetClusterHealth", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.ClusterHealth
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetClusterStatus returns the current status of the cluster
+func (s *GarageAdminService) GetClusterStatus(ctx context.Context) (*models.ClusterStatus, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/GetClusterStatus", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.ClusterStatus
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetClusterStatistics returns global cluster statistics
+func (s *GarageAdminService) GetClusterStatistics(ctx context.Context) (*models.ClusterStatistics, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/GetClusterStatistics", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.ClusterStatistics
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Node Operations
+// ====================================
+
+// GetNodeInfo returns information about a specific node
+func (s *GarageAdminService) GetNodeInfo(ctx context.Context, nodeID string) (*models.MultiNodeResponse, error) {
+	path := fmt.Sprintf("/v2/GetNodeInfo?node=%s", nodeID)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.MultiNodeResponse
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetNodeStatistics returns statistics for a specific node
+func (s *GarageAdminService) GetNodeStatistics(ctx context.Context, nodeID string) (*models.MultiNodeResponse, error) {
+	path := fmt.Sprintf("/v2/GetNodeStatistics?node=%s", nodeID)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.MultiNodeResponse
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Monitoring Operations
+// ====================================
+
+// HealthCheck checks if the Admin API is reachable
+func (s *GarageAdminService) HealthCheck(ctx context.Context) error {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/health", nil)
+	if err != nil {
+		return fmt.Errorf("health check failed: %w", err)
+	}
+
+	if err := decodeResponse(resp, nil); err != nil {
+		return fmt.Errorf("health check returned error: %w", err)
+	}
+
+	return nil
+}
+
+// GetMetrics returns Prometheus metrics from the Admin API
+func (s *GarageAdminService) GetMetrics(ctx context.Context) (string, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/metrics", nil)
+	if err != nil {
+		return "", fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.RawBody.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		bodyBytes, _ := io.ReadAll(resp.RawBody)
+		return "", fmt.Errorf("API returned status %d: %s", resp.StatusCode, string(bodyBytes))
+	}
+
+	bodyBytes, err := io.ReadAll(resp.RawBody)
+	if err != nil {
+		return "", fmt.Errorf("failed to read response: %w", err)
+	}
+
+	return string(bodyBytes), nil
+}

backend/internal/services/s3.go

@@ -0,0 +1,500 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"Noooste/garage-ui/internal/config"
+	"Noooste/garage-ui/internal/models"
+	"Noooste/garage-ui/pkg/utils"
+
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+)
+
+// S3Service handles all S3 operations with Garage using MinIO SDK
+type S3Service struct {
+	client       *minio.Client
+	config       *config.GarageConfig
+	adminService *GarageAdminService
+}
+
+// NewS3Service creates a new S3 service instance using MinIO SDK
+func NewS3Service(cfg *config.GarageConfig, adminService *GarageAdminService) *S3Service {
+	// Create MinIO client for Garage
+	client, err := minio.New(cfg.Endpoint, &minio.Options{
+		//Creds:  credentials.NewStaticV4(cfg.AccessKey, cfg.SecretKey, ""),
+		Secure: cfg.UseSSL,
+	})
+	if err != nil {
+		panic(fmt.Errorf("failed to create MinIO client: %w", err))
+	}
+
+	return &S3Service{
+		client:       client,
+		config:       cfg,
+		adminService: adminService,
+	}
+}
+
+// getBucketCredentials retrieves credentials for a specific bucket
+// It checks the cache first, then queries the Garage Admin API
+func (s *S3Service) getBucketCredentials(ctx context.Context, bucketName string) (*credentials.Credentials, error) {
+	cacheKey := fmt.Sprintf("key:%s", bucketName)
+	cacheData := utils.GlobalCache.Get(cacheKey)
+
+	if cacheData != nil {
+		return cacheData.(*credentials.Credentials), nil
+	}
+
+	// Get bucket info from Garage Admin API
+	bucketInfo, err := s.adminService.GetBucketInfoByAlias(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get bucket info: %w", err)
+	}
+
+	// Find a key with read and write permissions
+	var accessKeyID, secretAccessKey string
+	for _, keyInfo := range bucketInfo.Keys {
+		if !keyInfo.Permissions.Read || !keyInfo.Permissions.Write {
+			continue
+		}
+
+		// Get key details with secret
+		keyDetails, err := s.adminService.GetKeyInfo(ctx, keyInfo.AccessKeyID, true)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get key info: %w", err)
+		}
+
+		if keyDetails.SecretAccessKey != nil {
+			accessKeyID = keyDetails.AccessKeyID
+			secretAccessKey = *keyDetails.SecretAccessKey
+			break
+		}
+	}
+
+	if accessKeyID == "" || secretAccessKey == "" {
+		return nil, fmt.Errorf("no valid credentials found for bucket %s", bucketName)
+	}
+
+	// Create credentials
+	creds := credentials.NewStaticV4(accessKeyID, secretAccessKey, "")
+
+	// Cache credentials for 1 hour
+	utils.GlobalCache.Set(cacheKey, creds, time.Hour)
+
+	return creds, nil
+}
+
+// getMinioClient creates a MinIO client for a specific bucket with dynamic credentials
+func (s *S3Service) getMinioClient(ctx context.Context, bucketName string) (*minio.Client, error) {
+	creds, err := s.getBucketCredentials(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get credentials for bucket %s: %w", bucketName, err)
+	}
+
+	// Create MinIO client with bucket-specific credentials
+	client, err := minio.New(s.config.Endpoint, &minio.Options{
+		Creds:  creds,
+		Secure: s.config.UseSSL,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	return client, nil
+}
+
+// ListBuckets retrieves all buckets from Garage
+func (s *S3Service) ListBuckets(ctx context.Context) (*models.BucketListResponse, error) {
+	// Call MinIO ListBuckets API
+	bucketInfos, err := s.client.ListBuckets(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list buckets: %w", err)
+	}
+
+	// Convert MinIO buckets to our model
+	buckets := make([]models.BucketInfo, 0, len(bucketInfos))
+	for _, bucket := range bucketInfos {
+		buckets = append(buckets, models.BucketInfo{
+			Name:         bucket.Name,
+			CreationDate: bucket.CreationDate,
+		})
+	}
+
+	return &models.BucketListResponse{
+		Buckets: buckets,
+		Count:   len(buckets),
+	}, nil
+}
+
+// CreateBucket creates a new bucket in Garage
+func (s *S3Service) CreateBucket(ctx context.Context, bucketName string) error {
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Call MinIO MakeBucket API
+	err = client.MakeBucket(ctx, bucketName, minio.MakeBucketOptions{
+		Region: s.config.Region,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to create bucket %s: %w", bucketName, err)
+	}
+
+	return nil
+}
+
+// DeleteBucket deletes a bucket from Garage
+func (s *S3Service) DeleteBucket(ctx context.Context, bucketName string) error {
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Call MinIO RemoveBucket API
+	err = client.RemoveBucket(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to delete bucket %s: %w", bucketName, err)
+	}
+
+	return nil
+}
+
+// ListObjects lists objects in a bucket with optional prefix filter and pagination
+func (s *S3Service) ListObjects(ctx context.Context, bucketName, prefix string, maxKeys int, continuationToken string) (*models.ObjectListResponse, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Set default max keys if not specified
+	if maxKeys <= 0 {
+		maxKeys = 1000
+	}
+
+	// Use ListObjectsV2 for proper pagination support
+	opts := minio.ListObjectsOptions{
+		Prefix:     prefix,
+		Recursive:  false,
+		MaxKeys:    maxKeys,
+		StartAfter: continuationToken,
+		UseV1:      false,
+	}
+
+	objects := make([]models.ObjectInfo, 0)
+	prefixesMap := make(map[string]bool)
+
+	var lastKey string
+	isTruncated := false
+	itemCount := 0
+
+	// List objects using the channel-based API
+	for object := range client.ListObjects(ctx, bucketName, opts) {
+		if object.Err != nil {
+			return nil, fmt.Errorf("failed to list objects in bucket %s: %w", bucketName, object.Err)
+		}
+
+		// Check if this is a prefix (directory)
+		if len(object.Key) > 0 && object.Key[len(object.Key)-1:] == "/" && object.Size == 0 {
+			prefixesMap[object.Key] = true
+			continue
+		}
+
+		// Track the last key for pagination
+		lastKey = object.Key
+
+		// Add to objects list
+		objects = append(objects, models.ObjectInfo{
+			Key:          object.Key,
+			Size:         object.Size,
+			LastModified: object.LastModified,
+			ETag:         object.ETag,
+			ContentType:  object.ContentType,
+			StorageClass: object.StorageClass,
+		})
+
+		itemCount++
+		if itemCount >= maxKeys {
+			isTruncated = true
+			break
+		}
+	}
+
+	// Convert prefixes map to slice
+	prefixList := make([]string, 0, len(prefixesMap))
+	for p := range prefixesMap {
+		prefixList = append(prefixList, p)
+	}
+
+	// Prepare next continuation token
+	var nextToken string
+	if isTruncated && lastKey != "" {
+		nextToken = lastKey
+	}
+
+	return &models.ObjectListResponse{
+		Bucket:                bucketName,
+		Objects:               objects,
+		Prefixes:              prefixList,
+		Count:                 len(objects),
+		IsTruncated:           isTruncated,
+		NextContinuationToken: nextToken,
+	}, nil
+}
+
+// UploadObject uploads an object to a bucket
+func (s *S3Service) UploadObject(ctx context.Context, bucketName, key string, body io.Reader, contentType string) (*models.ObjectUploadResponse, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Upload options
+	opts := minio.PutObjectOptions{
+		ContentType: contentType,
+	}
+
+	// Call MinIO PutObject API
+	info, err := client.PutObject(ctx, bucketName, key, body, -1, opts)
+	if err != nil {
+		return nil, fmt.Errorf("failed to upload object %s to bucket %s: %w", key, bucketName, err)
+	}
+
+	return &models.ObjectUploadResponse{
+		Bucket:      bucketName,
+		Key:         key,
+		ETag:        info.ETag,
+		Size:        info.Size,
+		ContentType: contentType,
+	}, nil
+}
+
+// GetObject retrieves an object from a bucket
+func (s *S3Service) GetObject(ctx context.Context, bucketName, key string) (io.ReadCloser, *models.ObjectInfo, error) {
+	// Call MinIO GetObject API
+	object, err := s.client.GetObject(ctx, bucketName, key, minio.GetObjectOptions{})
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to get object %s from bucket %s: %w", key, bucketName, err)
+	}
+
+	// Get object info
+	stat, err := object.Stat()
+	if err != nil {
+		object.Close()
+		return nil, nil, fmt.Errorf("failed to get object info for %s in bucket %s: %w", key, bucketName, err)
+	}
+
+	// Create object info
+	objectInfo := &models.ObjectInfo{
+		Key:          key,
+		Size:         stat.Size,
+		LastModified: stat.LastModified,
+		ETag:         stat.ETag,
+		ContentType:  stat.ContentType,
+	}
+
+	return object, objectInfo, nil
+}
+
+// DeleteObject deletes an object from a bucket
+func (s *S3Service) DeleteObject(ctx context.Context, bucketName, key string) error {
+	// Call MinIO RemoveObject API
+	err := s.client.RemoveObject(ctx, bucketName, key, minio.RemoveObjectOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to delete object %s from bucket %s: %w", key, bucketName, err)
+	}
+
+	return nil
+}
+
+// ObjectExists checks if an object exists in a bucket
+func (s *S3Service) ObjectExists(ctx context.Context, bucketName, key string) (bool, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return false, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	_, err = client.StatObject(ctx, bucketName, key, minio.StatObjectOptions{})
+	if err != nil {
+		// Check if error is "object not found"
+		errResponse := minio.ToErrorResponse(err)
+		if errResponse.Code == "NoSuchKey" {
+			return false, nil
+		}
+		return false, fmt.Errorf("failed to check if object exists: %w", err)
+	}
+	return true, nil
+}
+
+// GetObjectMetadata retrieves metadata for an object without downloading it
+func (s *S3Service) GetObjectMetadata(ctx context.Context, bucketName, key string) (*models.ObjectInfo, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	stat, err := client.StatObject(ctx, bucketName, key, minio.StatObjectOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata for object %s in bucket %s: %w", key, bucketName, err)
+	}
+
+	return &models.ObjectInfo{
+		Key:          key,
+		Size:         stat.Size,
+		LastModified: stat.LastModified,
+		ETag:         stat.ETag,
+		ContentType:  stat.ContentType,
+	}, nil
+}
+
+// DeleteMultipleObjects deletes multiple objects from a bucket
+func (s *S3Service) DeleteMultipleObjects(ctx context.Context, bucketName string, keys []string) error {
+	if len(keys) == 0 {
+		return nil
+	}
+
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Create channel for objects to delete
+	objectsCh := make(chan minio.ObjectInfo)
+
+	// Send objects to delete in a goroutine
+	go func() {
+		defer close(objectsCh)
+		for _, key := range keys {
+			objectsCh <- minio.ObjectInfo{
+				Key: key,
+			}
+		}
+	}()
+
+	// Call MinIO RemoveObjects API (batch delete)
+	errorCh := client.RemoveObjects(ctx, bucketName, objectsCh, minio.RemoveObjectsOptions{})
+
+	// Check for errors
+	for err := range errorCh {
+		if err.Err != nil {
+			return fmt.Errorf("failed to delete object %s from bucket %s: %w", err.ObjectName, bucketName, err.Err)
+		}
+	}
+
+	return nil
+}
+
+// GetPresignedURL generates a pre-signed URL for temporary access to an object
+// This is useful for sharing files without exposing credentials
+func (s *S3Service) GetPresignedURL(ctx context.Context, bucketName, key string, expiresIn time.Duration) (string, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return "", fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Generate presigned GET URL
+	presignedURL, err := client.PresignedGetObject(ctx, bucketName, key, expiresIn, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate presigned URL for %s/%s: %w", bucketName, key, err)
+	}
+
+	return presignedURL.String(), nil
+}
+
+// UploadResult represents the result of a single file upload
+type UploadResult struct {
+	Key         string
+	Success     bool
+	Error       error
+	ETag        string
+	Size        int64
+	ContentType string
+}
+
+// UploadMultipleObjects uploads multiple objects to a bucket
+// It handles uploads in batches to respect any S3/Garage limits
+// Returns results for each file, including both successes and failures
+func (s *S3Service) UploadMultipleObjects(ctx context.Context, bucketName string, files []struct {
+	Key         string
+	Body        io.Reader
+	ContentType string
+}) []UploadResult {
+	results := make([]UploadResult, len(files))
+
+	// Get bucket-specific MinIO client once for all uploads
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		// If we can't get the client, all uploads fail
+		for i := range files {
+			results[i] = UploadResult{
+				Key:     files[i].Key,
+				Success: false,
+				Error:   fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err),
+			}
+		}
+		return results
+	}
+
+	// Upload each file
+	for i, file := range files {
+		// Upload options
+		opts := minio.PutObjectOptions{
+			ContentType: file.ContentType,
+		}
+
+		// Attempt upload
+		info, err := client.PutObject(ctx, bucketName, file.Key, file.Body, -1, opts)
+		if err != nil {
+			results[i] = UploadResult{
+				Key:         file.Key,
+				Success:     false,
+				Error:       fmt.Errorf("failed to upload object %s: %w", file.Key, err),
+				ContentType: file.ContentType,
+			}
+			continue
+		}
+
+		results[i] = UploadResult{
+			Key:         file.Key,
+			Success:     true,
+			Error:       nil,
+			ETag:        info.ETag,
+			Size:        info.Size,
+			ContentType: file.ContentType,
+		}
+	}
+
+	return results
+}
+
+// BucketStatistics holds statistical information about a bucket
+type BucketStatistics struct {
+	ObjectCount int64
+	TotalSize   int64
+}
+
+// GetBucketStatistics retrieves bucket statistics from Garage Admin API
+// This is much more efficient than iterating through all objects
+func (s *S3Service) GetBucketStatistics(ctx context.Context, bucketName string) (*BucketStatistics, error) {
+	// Get bucket info from Garage Admin API which includes object count and size
+	bucketInfo, err := s.adminService.GetBucketInfoByAlias(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get bucket info for %s: %w", bucketName, err)
+	}
+
+	// Return statistics from Admin API
+	return &BucketStatistics{
+		ObjectCount: bucketInfo.Objects,
+		TotalSize:   bucketInfo.Bytes,
+	}, nil
+}