fix

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

services/mediaToken.service.js

@@ -69,21 +69,31 @@ function resolveIp(req) {
   return normalizeIp(raw);
 }
 
-function signToken(asset, userId, ip) {
+// ─── signMediaToken ─────────────────────────────────────────────────────────────
+//
+// Low-level JWT signer shared by every media-token caller (asset previews here,
+// avatar resolution in utils/resolveAvatar.util.js) so the secret-resolution +
+// payload shape only lives in one place. `asset_id`/`user_id`/`ip` are optional —
+// omitting `ip` means the stream endpoint's IP-pin check is skipped for that token.
+function signMediaToken({ asset_id, storage_key, file_type, mime_type, user_id, ip, expiresIn = TOKEN_TTL_SEC }) {
   return jwt.sign(
-    {
-      asset_id:    asset.asset_id,
-      user_id:     userId,
-      storage_key: asset.storage_key,
-      file_type:   asset.file_type,
-      mime_type:   asset.mime_type,
-      ip,
-    },
+    { asset_id, user_id, storage_key, file_type, mime_type, ip },
     MEDIA_SECRET,
-    { expiresIn: TOKEN_TTL_SEC }
+    { expiresIn }
   );
 }
 
+function signToken(asset, userId, ip) {
+  return signMediaToken({
+    asset_id:    asset.asset_id,
+    storage_key: asset.storage_key,
+    file_type:   asset.file_type,
+    mime_type:   asset.mime_type,
+    user_id:     userId,
+    ip,
+  });
+}
+
 // ─── issueForAsset ─────────────────────────────────────────────────────────────
 //
 // Returns { token, thumbnail_url } for an S3 asset, minting + caching on first
@@ -114,4 +124,5 @@ module.exports = {
   SUPPORTED_TYPES,
   resolveIp,
   issueForAsset,
+  signMediaToken,
 };