Add guest upload tokens and share-session aware permissions

app/api/upload/audio/[filename]/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from 'next/server';
 import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
-import { GetObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3';
+import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3';
 import { apiErrors } from '@/lib/api-response';
+import { db } from '@/lib/db';
 
 // Only allow UUID filenames with safe extensions
 const SAFE_FILENAME = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[a-z0-9]+$/i;
@@ -15,6 +16,7 @@ const CONTENT_TYPE_MAP: Record<string, string> = {
   ogg: 'audio/ogg',
   wav: 'audio/wav',
 };
+const UNATTACHED_UPLOAD_TTL_MS = 15 * 60 * 1000;
 
 function getContentType(filename: string): string {
   const ext = filename.split('.').pop()?.toLowerCase() || '';
@@ -34,6 +36,7 @@ export async function GET(
     }
 
     const key = `voice/${filename}`;
+    const mediaUrl = `/api/upload/audio/${filename}`;
 
     // Get file metadata to determine content type
     const headResponse = await r2Client.send(
@@ -43,6 +46,23 @@ export async function GET(
       })
     );
 
+    const lastModified = headResponse.LastModified;
+    if (lastModified && Date.now() - lastModified.getTime() > UNATTACHED_UPLOAD_TTL_MS) {
+      const referenced = await db.comment.findFirst({
+        where: { voiceUrl: mediaUrl },
+        select: { id: true },
+      });
+      if (!referenced) {
+        await r2Client.send(
+          new DeleteObjectCommand({
+            Bucket: R2_BUCKET_NAME,
+            Key: key,
+          })
+        ).catch(() => undefined);
+        return apiErrors.notFound('File');
+      }
+    }
+
     // Use the stored content-type or infer from filename extension
     const contentType = headResponse.ContentType || getContentType(filename);
 
@@ -78,7 +98,7 @@ export async function GET(
       status: 200,
       headers: {
         'Content-Type': contentType,
-        'Cache-Control': 'public, max-age=31536000, immutable',
+        'Cache-Control': 'private, no-store',
         'Accept-Ranges': 'bytes',
       },
     });

app/api/upload/audio/route.ts

@@ -1,14 +1,23 @@
-import { auth } from '@/lib/auth';
+import { NextRequest } from 'next/server';
+import { auth, checkProjectAccess } from '@/lib/auth';
+import { db } from '@/lib/db';
 import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
 import { PutObjectCommand } from '@aws-sdk/client-s3';
 import { randomUUID } from 'crypto';
 import { rateLimit } from '@/lib/rate-limit';
+import { validateShareLinkAccess } from '@/lib/share-links';
+import { getShareSessionFromRequest } from '@/lib/share-session';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
+import {
+  deriveGuestUploadContext,
+  enforceGuestUploadQuota,
+  verifyGuestUploadToken,
+} from '@/lib/guest-upload-token';
 
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 const ALLOWED_TYPES = ['audio/webm', 'audio/ogg', 'audio/mp4', 'audio/mpeg', 'audio/wav'];
 
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
   try {
     // Check Content-Length header BEFORE loading the file
     const contentLength = request.headers.get('content-length');
@@ -23,18 +32,69 @@ export async function POST(request: Request) {
     const limited = await rateLimit(request, 'voice-upload');
     if (limited) return limited;
 
-    // Require authentication
     const session = await auth();
-    if (!session?.user?.id) {
-      return apiErrors.unauthorized();
-    }
 
     const formData = await request.formData();
     const file = formData.get('audio') as File | null;
+    const videoId = formData.get('videoId');
+    const uploadToken = formData.get('uploadToken');
 
     if (!file) {
       return apiErrors.badRequest('No audio file provided');
     }
+    if (typeof videoId !== 'string' || !videoId.trim()) {
+      return apiErrors.badRequest('videoId is required');
+    }
+
+    const safeVideoId = videoId.trim();
+    const video = await db.video.findUnique({
+      where: { id: safeVideoId },
+      include: { project: true },
+    });
+    if (!video) {
+      return apiErrors.notFound('Video');
+    }
+
+    const access = await checkProjectAccess(video.project, session?.user?.id);
+    const shareSession = getShareSessionFromRequest(request, safeVideoId);
+    const shareAccess = shareSession
+      ? await validateShareLinkAccess({
+        token: shareSession.token,
+        projectId: video.projectId,
+        videoId: safeVideoId,
+        requiredPermission: 'COMMENT',
+        passwordVerified: shareSession.passwordVerified,
+      })
+      : { hasAccess: false, canComment: false, canDownload: false, allowGuests: false, requiresPassword: false };
+    const canCommentWithMembership = !!session?.user?.id && access.hasAccess;
+    const canCommentWithShareLink = shareAccess.canComment && (session?.user?.id ? true : shareAccess.allowGuests);
+    if (!canCommentWithMembership && !canCommentWithShareLink) {
+      return apiErrors.forbidden('Access denied');
+    }
+
+    if (!session?.user?.id) {
+      if (typeof uploadToken !== 'string' || !uploadToken.trim()) {
+        return apiErrors.badRequest('uploadToken is required for guest uploads');
+      }
+
+      const expectedContext = deriveGuestUploadContext(request, shareSession?.token ?? null);
+      if (!expectedContext) {
+        return apiErrors.forbidden('Missing trusted client IP header');
+      }
+
+      const isValidUploadToken = verifyGuestUploadToken(uploadToken.trim(), {
+        projectId: video.projectId,
+        videoId: safeVideoId,
+        intent: 'audio',
+        context: expectedContext,
+      });
+      if (!isValidUploadToken) {
+        return apiErrors.forbidden('Invalid upload token');
+      }
+
+      const quotaError = await enforceGuestUploadQuota(request, safeVideoId, 'audio', shareSession?.token ?? null);
+      if (quotaError) return quotaError;
+    }
 
     // Double-check file size (defense in depth - Content-Length can be spoofed)
     if (file.size > MAX_FILE_SIZE) {

app/api/upload/image/[filename]/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from 'next/server';
 import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
-import { GetObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3';
+import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3';
 import { apiErrors } from '@/lib/api-response';
+import { db } from '@/lib/db';
 
 // Only allow UUID filenames with safe extensions
 const SAFE_FILENAME = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[a-z0-9]+$/i;
@@ -14,6 +15,7 @@ const CONTENT_TYPE_MAP: Record<string, string> = {
     gif: 'image/gif',
     svg: 'image/svg+xml',
 };
+const UNATTACHED_UPLOAD_TTL_MS = 15 * 60 * 1000;
 
 function getContentType(filename: string): string {
     const ext = filename.split('.').pop()?.toLowerCase() || '';
@@ -33,6 +35,7 @@ export async function GET(
         }
 
         const key = `images/${filename}`;
+        const mediaUrl = `/api/upload/image/${filename}`;
 
         // Get file metadata to determine content type
         const headResponse = await r2Client.send(
@@ -42,6 +45,23 @@ export async function GET(
             })
         );
 
+        const lastModified = headResponse.LastModified;
+        if (lastModified && Date.now() - lastModified.getTime() > UNATTACHED_UPLOAD_TTL_MS) {
+            const referenced = await db.comment.findFirst({
+                where: { imageUrl: mediaUrl },
+                select: { id: true },
+            });
+            if (!referenced) {
+                await r2Client.send(
+                    new DeleteObjectCommand({
+                        Bucket: R2_BUCKET_NAME,
+                        Key: key,
+                    })
+                ).catch(() => undefined);
+                return apiErrors.notFound('File');
+            }
+        }
+
         const contentType = headResponse.ContentType || getContentType(filename);
 
         const objectResponse = await r2Client.send(
@@ -72,7 +92,7 @@ export async function GET(
             status: 200,
             headers: {
                 'Content-Type': contentType,
-                'Cache-Control': 'public, max-age=31536000, immutable',
+                'Cache-Control': 'private, no-store',
                 'Accept-Ranges': 'bytes',
             },
         });
@@ -85,4 +105,3 @@ export async function GET(
         return apiErrors.internalError('Failed to retrieve image');
     }
 }
-

app/api/upload/image/route.ts

@@ -1,9 +1,18 @@
-import { auth } from '@/lib/auth';
+import { NextRequest } from 'next/server';
+import { auth, checkProjectAccess } from '@/lib/auth';
+import { db } from '@/lib/db';
 import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
 import { PutObjectCommand } from '@aws-sdk/client-s3';
 import { randomUUID } from 'crypto';
 import { rateLimit } from '@/lib/rate-limit';
+import { validateShareLinkAccess } from '@/lib/share-links';
+import { getShareSessionFromRequest } from '@/lib/share-session';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
+import {
+    deriveGuestUploadContext,
+    enforceGuestUploadQuota,
+    verifyGuestUploadToken,
+} from '@/lib/guest-upload-token';
 
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 const ALLOWED_TYPES = [
@@ -11,10 +20,9 @@ const ALLOWED_TYPES = [
     'image/png',
     'image/webp',
     'image/gif',
-    'image/svg+xml'
 ];
 
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
     try {
         // Check Content-Length header BEFORE loading the file
         const contentLength = request.headers.get('content-length');
@@ -29,18 +37,69 @@ export async function POST(request: Request) {
         const limited = await rateLimit(request, 'image-upload');
         if (limited) return limited;
 
-        // Require authentication
         const session = await auth();
-        if (!session?.user?.id) {
-            return apiErrors.unauthorized();
-        }
 
         const formData = await request.formData();
         const file = formData.get('image') as File | null;
+        const videoId = formData.get('videoId');
+        const uploadToken = formData.get('uploadToken');
 
         if (!file) {
             return apiErrors.badRequest('No image file provided');
         }
+        if (typeof videoId !== 'string' || !videoId.trim()) {
+            return apiErrors.badRequest('videoId is required');
+        }
+
+        const safeVideoId = videoId.trim();
+        const video = await db.video.findUnique({
+            where: { id: safeVideoId },
+            include: { project: true },
+        });
+        if (!video) {
+            return apiErrors.notFound('Video');
+        }
+
+        const access = await checkProjectAccess(video.project, session?.user?.id);
+        const shareSession = getShareSessionFromRequest(request, safeVideoId);
+        const shareAccess = shareSession
+            ? await validateShareLinkAccess({
+                token: shareSession.token,
+                projectId: video.projectId,
+                videoId: safeVideoId,
+                requiredPermission: 'COMMENT',
+                passwordVerified: shareSession.passwordVerified,
+            })
+            : { hasAccess: false, canComment: false, canDownload: false, allowGuests: false, requiresPassword: false };
+        const canCommentWithMembership = !!session?.user?.id && access.hasAccess;
+        const canCommentWithShareLink = shareAccess.canComment && (session?.user?.id ? true : shareAccess.allowGuests);
+        if (!canCommentWithMembership && !canCommentWithShareLink) {
+            return apiErrors.forbidden('Access denied');
+        }
+
+        if (!session?.user?.id) {
+            if (typeof uploadToken !== 'string' || !uploadToken.trim()) {
+                return apiErrors.badRequest('uploadToken is required for guest uploads');
+            }
+
+            const expectedContext = deriveGuestUploadContext(request, shareSession?.token ?? null);
+            if (!expectedContext) {
+                return apiErrors.forbidden('Missing trusted client IP header');
+            }
+
+            const isValidUploadToken = verifyGuestUploadToken(uploadToken.trim(), {
+                projectId: video.projectId,
+                videoId: safeVideoId,
+                intent: 'image',
+                context: expectedContext,
+            });
+            if (!isValidUploadToken) {
+                return apiErrors.forbidden('Invalid upload token');
+            }
+
+            const quotaError = await enforceGuestUploadQuota(request, safeVideoId, 'image', shareSession?.token ?? null);
+            if (quotaError) return quotaError;
+        }
 
         // Double-check file size (defense in depth - Content-Length can be spoofed)
         if (file.size > MAX_FILE_SIZE) {
@@ -54,7 +113,7 @@ export async function POST(request: Request) {
         }
 
         // Generate unique filename
-        const ext = contentType.split('/')[1] === 'svg+xml' ? 'svg' : contentType.split('/')[1] || 'jpeg';
+        const ext = contentType.split('/')[1] || 'jpeg';
         const filename = `${randomUUID()}.${ext}`;
         const key = `images/${filename}`;