Enforce private-file authorization for Next.js

Summary

Enforce private-file authorization in a Next.js app on Ample. The route handler authorizes the request first, records file metadata in a managed PostgreSQL database, stores bytes in a private bucket and streams them back only to authorized callers. The bucket is never published, so objects are reachable only through the app.

Infrastructure requirements

• Compute: verified (Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.)
• Postgres: verified (Managed PostgreSQL 16 runs in its own microVM and is auto-provisioned when an app needs a database and no DATABASE_URL is supplied.)
• S3-compatible object storage: verified (Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary. Other S3 operations are not verified.)

Prerequisites

• An authorization check in the route handler (session, token or header) before any storage access
• pg reading DATABASE_URL and @aws-sdk/client-s3 reading the S3_* variables
• A private bucket (never ample bucket publish) and an auto-provisioned or supplied PostgreSQL database
• An Ample account token with servers:write, databases:read and buckets:read

Exact tested configuration

• template: node-22
• runtime: node
• size: s-1vcpu-1gb
• install: npm install
• build: npm run build --if-present
• start: npm run start

Steps

1. Authorize before touching storage. Return 401 for unauthenticated requests; never expose object keys or the bucket endpoint to the browser.

2. Record metadata in PostgreSQL. Keep the owner, name and object key in a table so authorization decisions come from your data, not from the bucket.

3. Store and stream through the app. PutObject on upload, GetObject on download, both server-side with the injected credentials.

   ample deploy . --name <app-name> --public --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=... 
   

4. Test both paths. An unauthenticated request must return 401; an authorized request must return the stored content.

5. Verify. Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.

   ample logs <deployment_id> --kind build
   

Tested examples

• Next.js private files canary (tests/deploy-canaries/next-private-files): 401 without a token; private=ok with the token after a database write and a bucket round-trip.

Success checks

• unauthenticated request is rejected (/files/demo on the live URL, expect unauthorized)
• authorized request returns the private object (/files/demo?token=<token> on the live URL, expect private=ok)

Limitations

• Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.
• Region, compliance attestations and request-duration limits are unknown and not claimed.
• Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.
• PutObject and GetObject with path-style addressing are verified; multipart upload, listing, presigned URLs and lifecycle rules are not verified.
• Bucket credentials are passed as encrypted environment variables; the catalog never creates the bucket for you (use ample bucket create).
• Storage is allocation-priced per bucket quota and capped by the account plan; the estimate below covers compute only.
• Authorization is application code; Ample does not provide managed end-user authentication.
• Streaming large files through the app is not verified; the fixture uses small text objects.

Cost estimate

Estimated 10.00 USD per month (size prices from pricing.toml at build revision a1b8c38919e59cd035ebabaced73cf84ece24371).

• app server x1 s-1vcpu-1gb: 5.00 USD
• managed PostgreSQL database x1 s-1vcpu-1gb: 5.00 USD

Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply.

Verification evidence

• canary_run on 2026-09-20T01:13:26Z at revision cc3d82057f1d5e9aa31f682cee71aabfbbbcaabe-dirty (CLI e3181f5): Next.js route handler that rejects unauthenticated requests with 401, records file metadata in an auto-provisioned managed PostgreSQL database, stores the bytes in a private bucket and streams them back only after authorization (private=ok). (expires 2027-03-19T01:13:26Z)
• canary_run on 2026-09-20T01:13:26Z at revision cc3d82057f1d5e9aa31f682cee71aabfbbbcaabe-dirty (CLI e3181f5): ample bucket create issued credentials; PutObject and GetObject succeeded through the public S3 endpoint; publish exposed the object through the CDN host with an ETag; unpublish and delete cleaned up. (expires 2027-03-19T01:13:26Z)

Last verified: 2026-09-20T01:13:26Z

Execution binding

MCP tool ample_deploy (registry mcp:ample_deploy), schema hash 876465fce906da0c observed 2026-09-20T01:55:48.667900+00:00 at revision 199ff1dfd526, binding state current, required scopes: servers:write, databases:read, buckets:read.