🐛 fix: restore file access URL policy#15305
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4080af3f71
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| log('Cached presigned URL for file: %s (TTL: %ds)', id, PRESIGNED_URL_CACHE_TTL); | ||
| } | ||
| // Web: Generate a cached S3 presigned URL, normalizing legacy full S3 URLs. | ||
| const redirectUrl = await fileService.createCachedPreSignedUrlForPreview(file.url); |
There was a problem hiding this comment.
Preserve the proxy redirect's short expiry
When /f/:id is hit, this now omits the expiresIn argument, so the helper falls back to S3_PREVIEW_URL_EXPIRE_IN (7200 seconds by default in src/envs/file.ts) instead of the previous explicit 300-second proxy URL. Because this endpoint is public by file id and returns a direct S3 redirect, anyone who captures the Location header now gets much longer direct object access than the route previously allowed; pass the short proxy TTL through the cached helper to keep the old access policy.
Useful? React with 👍 / 👎.
💻 Change Type
🔗 Related Issue
Fixes #15143
🔀 Description of Change
FileServiceafter the previous revert./f/:idas a temporary presigned file proxy by adding a cached presigned preview URL API./f/:idaccess URLs.🧪 How to Test