Add signing and expiry to local download URLs

src/app/api/storage/sign-download/route.test.ts

@@ -1,7 +1,12 @@
 import { Role } from "@prisma/client";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { auth } from "@/lib/auth";
+import prisma from "@/lib/db";
+import {
+  LOCAL_URL_EXPIRATION_SECONDS,
+  generateLocalSignature,
+} from "@/lib/storage/local-signature";
 import { POST as signDownload } from "./route";
 
 vi.mock("@/lib/auth", () => ({
@@ -26,6 +31,13 @@ const adminSession = {
   expires: new Date(Date.now() + 60_000).toISOString(),
 };
 
+const originalEnv = { ...process.env };
+
+afterEach(() => {
+  vi.resetAllMocks();
+  process.env = { ...originalEnv };
+});
+
 describe("/api/storage/sign-download", () => {
   it("retorna 403 quando a chave não pertence à organização do usuário", async () => {
     vi.mocked(auth).mockResolvedValue(adminSession as any);
@@ -42,4 +54,36 @@ describe("/api/storage/sign-download", () => {
       error: "Chave não pertence à organização.",
     });
   });
+
+  it("retorna uma URL assinada com expiração curta para o driver local", async () => {
+    process.env.STORAGE_DRIVER = "local";
+    process.env.NODE_ENV = "development";
+    process.env.AUTH_SECRET = "local-secret";
+
+    vi.mocked(auth).mockResolvedValue(adminSession as any);
+    vi.mocked(prisma.recording.findFirst).mockResolvedValue({ id: "rec-1" } as any);
+
+    const key = "org/org-1/students/s1/recordings/file.webm";
+    const response = await signDownload(
+      new Request("http://localhost/api/storage/sign-download", {
+        method: "POST",
+        body: JSON.stringify({ key }),
+      })
+    );
+
+    expect(response.status).toBe(200);
+
+    const { downloadUrl } = await response.json();
+    const parsed = new URL(downloadUrl);
+    const expires = Number(parsed.searchParams.get("expires"));
+    const signature = parsed.searchParams.get("signature");
+
+    expect(parsed.searchParams.get("key")).toBe(key);
+    expect(Number.isFinite(expires)).toBe(true);
+    expect(expires).toBeGreaterThan(Math.floor(Date.now() / 1000));
+    expect(expires).toBeLessThanOrEqual(
+      Math.floor(Date.now() / 1000) + LOCAL_URL_EXPIRATION_SECONDS + 1
+    );
+    expect(signature).toBe(generateLocalSignature(key, expires));
+  });
 });

src/app/api/storage/sign-download/route.ts

@@ -4,6 +4,10 @@ import { z } from "zod";
 import { auth } from "@/lib/auth";
 import prisma from "@/lib/db";
 import { getStorageProvider } from "@/lib/storage";
+import {
+  LOCAL_URL_EXPIRATION_SECONDS,
+  generateLocalSignature,
+} from "@/lib/storage/local-signature";
 
 const downloadSchema = z.object({
   key: z.string().min(1),
@@ -13,6 +17,23 @@ function keyMatchesOrg(key: string, orgId: string) {
   return key.startsWith(`org/${orgId}/`);
 }
 
+function buildLocalSignedDownloadUrl(baseUrl: string, key: string) {
+  const url = new URL(baseUrl);
+
+  // Garantimos que os parâmetros usados para validação estejam presentes e
+  // recém-gerados, evitando links reutilizáveis por tempo indefinido.
+  url.search = "";
+
+  const expires =
+    Math.floor(Date.now() / 1000) + LOCAL_URL_EXPIRATION_SECONDS;
+
+  url.searchParams.set("key", key);
+  url.searchParams.set("expires", expires.toString());
+  url.searchParams.set("signature", generateLocalSignature(key, expires));
+
+  return url.toString();
+}
+
 export async function POST(request: Request) {
   const session = await auth();
 
@@ -46,7 +67,13 @@ export async function POST(request: Request) {
     const storage = getStorageProvider();
     const { url } = await storage.getSignedDownloadUrl({ key: data.key });
 
-    return NextResponse.json({ downloadUrl: url });
+    const driver = process.env.STORAGE_DRIVER ?? "s3";
+    const downloadUrl =
+      driver === "local"
+        ? buildLocalSignedDownloadUrl(url, data.key)
+        : url;
+
+    return NextResponse.json({ downloadUrl });
   } catch (error) {
     if (error instanceof z.ZodError) {
       const message = error.issues[0]?.message ?? "Dados inválidos.";