break: secure file upload and download (public and private)

- prevents user uploads from being publicly accesible
- makes all S3 routes go through the API
- adds a new API Token concept to only allow BoPS to download user files
- side-effect: prevents users from downloading their own files

api.planx.uk/.env.test.example

@@ -39,3 +39,4 @@ UNIFORM_TOKEN_URL=👻
 UNIFORM_SUBMISSION_URL=👻
 
 SLACK_WEBHOOK_URL=👻
+FILE_API_KEY=👻

api.planx.uk/Dockerfile

@@ -32,7 +32,7 @@ ENV NODE_ENV development
 ADD . .
 
 RUN pnpm fetch
-RUN pnpm install --recursive --offline 
+RUN pnpm install --recursive --offline -f
 COPY . .
 
 CMD ["pnpm", "dev"]

api.planx.uk/package.json

@@ -26,6 +26,7 @@
     "jsondiffpatch": "^0.4.1",
     "jsonwebtoken": "^8.5.1",
     "mime": "^3.0.0",
+    "multer": "^1.4.4",
     "nanoid": "^3.3.4",
     "notifications-node-client": "^5.1.1",
     "passport": "^0.5.3",
@@ -51,6 +52,7 @@
     "@types/jest": "^28.1.4",
     "@types/jsonwebtoken": "^8.5.9",
     "@types/mime": "^3.0.1",
+    "@types/multer": "^1.4.7",
     "@types/node": "^16.11.43",
     "@types/passport": "^1.0.11",
     "@types/passport-google-oauth20": "^2.0.11",