chore: relocate backend into apps/api ahead of monorepo merge

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-27 00:12:54 +08:00 · 2026-08-24 12:20:40 +08:00
parent af44598df6
commit eaa6d2276a
388 changed files with 0 additions and 13998 deletions
@@ -0,0 +1,85 @@
+/***********************************************************************************************************************************************************************
+ * File Name: media.controller.js  (public)
+ * Type of Program: Controller
+ * Description: Issues stream tokens for publicly accessible S3 assets — no auth required.
+ *              Guards:
+ *                1. Asset must exist and not be deleted
+ *                2. is_public must be true — private assets are always rejected (403)
+ *                3. storage_provider must be "s3" — Chibisafe uses its raw CDN URL
+ *              Token shape is identical to the client/admin token flows so the
+ *              shared stream endpoint (/api/client/media/stream/:token) accepts it.
+ *              No user_id is embedded — the token is anonymous.
+ *              IP is still bound so a leaked token is useless on another machine.
+ *
+ * Author: Kenneth Obsequio (@lash0000)
+ * Date Created: Jun. 22, 2026
+ ***********************************************************************************************************************************************************************/
+"use strict";
+
+const jwt = require("jsonwebtoken");
+
+const R          = require("../../utils/response.util");
+const mdl_Assets = require("../../models/assets/assets.mdl");
+
+const MEDIA_SECRET  = process.env.MEDIA_JWT_SECRET ?? process.env.JWT_SECRET;
+const TOKEN_TTL_SEC = 4 * 60 * 60; // 4 hours — matches client TTL
+
+const SUPPORTED_TYPES = ["video", "audio", "document", "image"];
+
+function resolveIp(req) {
+  const forwarded = req.headers["x-forwarded-for"];
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return req.ip ?? req.socket?.remoteAddress ?? "unknown";
+}
+
+// ─── GET /public/media/token?asset_id=X ──────────────────────────────────────
+
+exports.issueToken = async (req, res) => {
+  try {
+    const asset_id = req.query.asset_id ?? req.body?.asset_id;
+    if (!asset_id) return R.error(res, "asset_id is required.", 400);
+
+    const asset = await mdl_Assets.findOne({
+      where: { asset_id, deletedAt: null },
+      attributes: ["asset_id", "file_type", "storage_provider", "storage_key", "mime_type", "is_public"],
+    });
+
+    if (!asset) return R.error(res, "File not found.", 404);
+
+    // Private assets are never served through the public endpoint
+    if (!asset.is_public) return R.error(res, "Forbidden.", 403);
+
+    if (!SUPPORTED_TYPES.includes(asset.file_type)) {
+      return R.error(res, `File type "${asset.file_type}" is not supported.`, 400);
+    }
+
+    if (asset.storage_provider !== "s3") {
+      return R.error(res, "Token flow is for S3 files only. Use the raw file_url for other providers.", 400);
+    }
+
+    const ip = resolveIp(req);
+
+    const token = jwt.sign(
+      {
+        asset_id,
+        // no user_id — anonymous public token
+        storage_key: asset.storage_key,
+        file_type:   asset.file_type,
+        mime_type:   asset.mime_type,
+        ip,
+      },
+      MEDIA_SECRET,
+      { expiresIn: TOKEN_TTL_SEC }
+    );
+
+    return R.success(res, "Token issued.", {
+      token,
+      provider:  "s3",
+      file_type: asset.file_type,
+    });
+
+  } catch (err) {
+    console.error("[PUBLIC][MEDIA][TOKEN]", err);
+    return R.error(res, "Could not issue media token.", 500);
+  }
+};