Send hotlink access token hash on upload; keep secret client-side only.

2026-11-02 01:46:51 +01:00
parent 0ef4993ad9
commit 2396c5d16d
6 changed files with 94 additions and 4 deletions
@@ -1,5 +1,6 @@
 import type { PreparedHotlinkUploadRequest } from '@/types/upload/PreparedHotlinkUploadRequest';
 import type { UploadOptionsRequest } from '@/types/upload/UploadOptionsRequest';
+import { hashHotlinkAccessToken } from '@/utils/crypto/hashHotlinkAccessToken';
 import { bytesToBase64 } from '@/utils/encoding/bytesToBase64';
 import { encryptHotlinkUpload } from '@/utils/upload/encryptHotlinkUpload';

@@ -9,6 +10,7 @@ export const prepareHotlinkUploadRequest = async (
    options: UploadOptionsRequest
 ): Promise<PreparedHotlinkUploadRequest> => {
    const encrypted = await encryptHotlinkUpload(plaintext);
+    const accessTokenHash = await hashHotlinkAccessToken(encrypted.secret);

    return {
        secret: encrypted.secret,
@@ -16,7 +18,8 @@ export const prepareHotlinkUploadRequest = async (
            ...options,
            iv: bytesToBase64(encrypted.iv),
            ciphertext: bytesToBase64(encrypted.ciphertext),
-            mimeType
+            mimeType,
+            accessTokenHash
        }
    };
 };