ready to test

Testing Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>
2026-09-27 00:12:54 +08:00 · 2026-06-22 10:06:58 +08:00
parent bf48c95467
commit 439bb33f77
189 changed files with 17559 additions and 686 deletions
@@ -0,0 +1,90 @@
+/***********************************************************************************************************************************************************************
+ * File Name: media.controller.js  (admin)
+ * Type of Program: Controller
+ * Description: Issues short-lived JWT stream tokens for admin asset preview.
+ *              Works identically to the client media token flow but is scoped to
+ *              admin-authenticated requests and allows any asset regardless of
+ *              is_public.  The stream endpoint (/api/client/media/stream/:token)
+ *              is shared — the JWT payload shape is identical.
+ *
+ * Author: Kenneth Obsequio (@lash0000)
+ * Date Created: Jun. 22, 2026
+ ***********************************************************************************************************************************************************************/
+"use strict";
+
+const jwt = require("jsonwebtoken");
+
+const R          = require("../../utils/response.util");
+const mdl_Assets = require("../../models/assets/assets.mdl");
+const s3         = require("../../services/s3.service");
+
+const MEDIA_SECRET  = process.env.MEDIA_JWT_SECRET ?? process.env.JWT_SECRET;
+const TOKEN_TTL_SEC = 30 * 60; // 30 min — admin preview session
+
+const SUPPORTED_TYPES = ["video", "audio", "document", "image"];
+
+function resolveIp(req) {
+  const forwarded = req.headers["x-forwarded-for"];
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return req.ip ?? req.socket?.remoteAddress ?? "unknown";
+}
+
+// ─── POST /admin/media/token ──────────────────────────────────────────────────
+
+exports.issueToken = async (req, res) => {
+  try {
+    const { asset_id } = req.body;
+    if (!asset_id) return R.error(res, "asset_id is required.", 400);
+
+    const asset = await mdl_Assets.findOne({
+      where: { asset_id, deletedAt: null },
+      attributes: ["asset_id", "file_type", "storage_provider", "storage_key", "mime_type", "thumbnail_storage_key"],
+    });
+
+    if (!asset) return R.error(res, "Asset not found.", 404);
+
+    if (!SUPPORTED_TYPES.includes(asset.file_type)) {
+      return R.error(res, `Asset type "${asset.file_type}" is not supported.`, 400);
+    }
+
+    if (asset.storage_provider !== "s3") {
+      return R.error(res, "Token flow is for S3 assets only. Use the raw file_url for other providers.", 400);
+    }
+
+    const ip = resolveIp(req);
+
+    const token = jwt.sign(
+      {
+        asset_id,
+        user_id:     req.user.user_id,
+        storage_key: asset.storage_key,
+        file_type:   asset.file_type,
+        mime_type:   asset.mime_type,
+        ip,
+      },
+      MEDIA_SECRET,
+      { expiresIn: TOKEN_TTL_SEC }
+    );
+
+    // ── Presign thumbnail URL so the browser can load it directly ─────────────
+    let thumbnail_url = null;
+    if (asset.thumbnail_storage_key) {
+      try {
+        thumbnail_url = await s3.getSignedDownloadUrl(asset.thumbnail_storage_key, TOKEN_TTL_SEC);
+      } catch {
+        // Non-fatal — thumbnail is cosmetic
+      }
+    }
+
+    return R.success(res, "Token issued.", {
+      token,
+      provider:      "s3",
+      file_type:     asset.file_type,
+      thumbnail_url,
+    });
+
+  } catch (err) {
+    console.error("[ADMIN][MEDIA][TOKEN]", err);
+    return R.error(res, "Could not issue media token.", 500);
+  }
+};