feat: generate random url for download

Author: LouisHaftmann

lib/env.ts

@@ -4,7 +4,6 @@ const booleanSchema = z.string().transform((v) => v.toLowerCase() === 'true')
 
 const envSchema = z.object({
   ENABLE_DIRECT_DOWNLOADS: booleanSchema.default('false'),
-  DOWNLOAD_SECRET_KEY: z.string(),
   URL_ACCESS_TOKEN: z.string().min(1),
   CLEANUP_OLDER_THAN_DAYS: z.coerce.number().int().min(0).default(90),
   API_BASE_URL: z.string().url(),

lib/storage/index.ts

@@ -1,4 +1,4 @@
-import { createHash, randomInt } from 'node:crypto'
+import { randomBytes, randomInt } from 'node:crypto'
 
 import consola from 'consola'
 
@@ -266,11 +266,7 @@ export async function initializeStorage() {
 }
 
 function createLocalDownloadUrl(objectName: string) {
-  const hashedKey = createHash('sha256')
-    .update(objectName + ENV.DOWNLOAD_SECRET_KEY)
-    .digest('base64url')
-
-  return `${ENV.API_BASE_URL}/download/${hashedKey}/${objectName}`
+  return `${ENV.API_BASE_URL}/download/${randomBytes(64).toString('base64')}/${objectName}`
 }
 
 export function useStorageAdapter() {

routes/download/[hash]/[objectName].ts renamed to routes/download/[random]/[objectName].ts

@@ -1,8 +1,5 @@
-import { createHash } from 'node:crypto'
-
 import { z } from 'zod'
 
-import { ENV } from '~/lib/env'
 import { useStorageAdapter } from '~/lib/storage'
 
 const pathParamsSchema = z.object({
@@ -18,12 +15,7 @@ export default defineEventHandler(async (event) => {
       statusMessage: `Invalid path parameters: ${parsedPathParams.error.message}`,
     })
 
-  const { objectName, hash } = parsedPathParams.data
-
-  const hashedCacheId = createHash('sha256')
-    .update(objectName + ENV.DOWNLOAD_SECRET_KEY)
-    .digest('base64url')
-  if (hashedCacheId !== hash) throw createError({ statusCode: 403, statusMessage: 'Forbidden' })
+  const { objectName } = parsedPathParams.data
 
   const stream = await useStorageAdapter().download(objectName)
 

tests/.env.base

@@ -2,5 +2,4 @@ URL_ACCESS_TOKEN=test_token
 API_BASE_URL=http://localhost:3000
 NODE_ENV=development
 RUNNER_TEMP=tests/temp/runner
-ACTIONS_CACHE_URL=http://localhost:3000/test_token/
-DOWNLOAD_SECRET_KEY=test_key
+ACTIONS_CACHE_URL=http://localhost:3000/test_token/