# v5 Demo Signers — activation guide

The Strategy S3 and Strategy Azure demo pages render in **setup-instructions mode** by
default. Follow these steps to make the live uploader boxes on those pages actually
upload to your bucket / container.

## What's in this folder

| File | Role |
|---|---|
| `DemoS3Signer.cs.template` | Reference `IS3Signer` implementation wrapping AWSSDK.S3 |
| `DemoAzureSigner.cs.template` | Reference `IAzureSigner` implementation wrapping Azure.Storage.Blobs |

These are kept **outside** `App_Code/` and **inactive** (`.cs.template` extension)
because they depend on SDK DLLs that aren't in `bin/` by default. If they were auto-
compiled without those DLLs present, the whole site would fail to build.

`Global.asax.cs` probes for the compiled signer types via reflection and registers
whichever are found. Until you activate one, the corresponding endpoints return **501**.

## Activating the S3 demo

### 1. Install AWSSDK.S3

From a Developer Command Prompt in the site root:

```
nuget install AWSSDK.S3 -Version 3.7.* -OutputDirectory packages
```

Then copy the `net472` DLLs into `bin/`:

```
copy packages\AWSSDK.Core.*\lib\net472\AWSSDK.Core.dll bin\
copy packages\AWSSDK.S3.*\lib\net472\AWSSDK.S3.dll bin\
```

Or, from Visual Studio: right-click the website → Manage NuGet Packages → install
`AWSSDK.S3`. That drops the DLLs into `bin/` automatically.

### 2. Move the signer into `App_Code/`

```
md App_Code
move v5-signers\DemoS3Signer.cs.template App_Code\DemoS3Signer.cs
```

### 3. Fill in credentials in `web.config`

```xml
<add key="DemoS3:BucketName" value="your-bucket" />
<add key="DemoS3:Region" value="us-east-1" />
<add key="DemoS3:AccessKeyId" value="AKIA..." />
<add key="DemoS3:SecretAccessKey" value="..." />
```

For S3-compatible services (MinIO, Backblaze B2, Cloudflare R2, Wasabi):

```xml
<add key="DemoS3:ServiceUrl" value="https://minio.example.com" />
<add key="DemoS3:ForcePathStyle" value="true" />
```

### 4. Configure bucket CORS

The browser PUTs directly to S3. Your bucket must allow cross-origin PUT and expose
`ETag`:

```json
[{
  "AllowedOrigins": ["https://ajaxuploader.com"],
  "AllowedMethods": ["PUT"],
  "AllowedHeaders": ["*"],
  "ExposeHeaders": ["ETag"],
  "MaxAgeSeconds": 3000
}]
```

### 5. Recycle the app pool

```
iisreset /noforce
```

Visit `/Demos/V5Features/StrategyS3.aspx`. The setup banner should be gone and the
uploader should accept files.

## Activating the Azure demo

Identical flow — substitute:

- Package: `Azure.Storage.Blobs` (installs `Azure.Storage.Common`, `Azure.Core`,
  `System.Memory.Data`, `System.Text.Json` etc. as transitive dependencies — copy all
  `net462`+ DLLs from `packages\*\lib\netstandard2.0\` or the highest compatible TFM
  into `bin/`).
- File to move: `DemoAzureSigner.cs.template` → `App_Code/DemoAzureSigner.cs`.
- web.config keys:
  ```xml
  <add key="DemoAzure:ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=...;AccountKey=...;EndpointSuffix=core.windows.net" />
  <add key="DemoAzure:ContainerName" value="your-container" />
  ```
- Container CORS (run once from Azure CLI):
  ```
  az storage cors add --methods PUT --origins https://ajaxuploader.com \
    --allowed-headers "*" --exposed-headers "*" --services b --max-age 3600
  ```

## How activation is detected

`Global.asax.cs` at `Application_Start` does:

1. Reflection-search loaded assemblies for type
   `AjaxUploaderSite.DemoS3Signer` (/`DemoAzureSigner`).
2. If found **and** the matching `Options.IsConfigured` returns `true`, construct the
   signer and assign to `AjaxUploader.Providers.S3.Signer` (/`Azure.Signer`).
3. If the type isn't found (files still under `/v5-signers/`), or options are
   incomplete (blank `web.config` values), the assignment is skipped and the endpoints
   return **501**.

No compile-time dependency on the AWS/Azure SDKs — the site stays healthy whether or
not you've activated the demos.

## SSRF / security warning

- Never ship the demo signers to production with S3 admin credentials or a full-access
  Azure connection string. Scope the IAM user / SAS to the upload bucket/container
  only.
- The `/ajaxupload.axd/s3/create` endpoint gates on `UploadService.ValidateFile`
  before signing — but in a public-facing deployment, add auth + rate limits in front.