Add guest upload tokens and share-session aware permissions

app/api/upload/audio/[filename]/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from 'next/server';
 import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
-import { GetObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3';
+import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3';
 import { apiErrors } from '@/lib/api-response';
+import { db } from '@/lib/db';
 
 // Only allow UUID filenames with safe extensions
 const SAFE_FILENAME = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[a-z0-9]+$/i;
@@ -15,6 +16,7 @@ const CONTENT_TYPE_MAP: Record<string, string> = {
   ogg: 'audio/ogg',
   wav: 'audio/wav',
 };
+const UNATTACHED_UPLOAD_TTL_MS = 15 * 60 * 1000;
 
 function getContentType(filename: string): string {
   const ext = filename.split('.').pop()?.toLowerCase() || '';
@@ -34,6 +36,7 @@ export async function GET(
     }
 
     const key = `voice/${filename}`;
+    const mediaUrl = `/api/upload/audio/${filename}`;
 
     // Get file metadata to determine content type
     const headResponse = await r2Client.send(
@@ -43,6 +46,23 @@ export async function GET(
       })
     );
 
+    const lastModified = headResponse.LastModified;
+    if (lastModified && Date.now() - lastModified.getTime() > UNATTACHED_UPLOAD_TTL_MS) {
+      const referenced = await db.comment.findFirst({
+        where: { voiceUrl: mediaUrl },
+        select: { id: true },
+      });
+      if (!referenced) {
+        await r2Client.send(
+          new DeleteObjectCommand({
+            Bucket: R2_BUCKET_NAME,
+            Key: key,
+          })
+        ).catch(() => undefined);
+        return apiErrors.notFound('File');
+      }
+    }
+
     // Use the stored content-type or infer from filename extension
     const contentType = headResponse.ContentType || getContentType(filename);
 
@@ -78,7 +98,7 @@ export async function GET(
       status: 200,
       headers: {
         'Content-Type': contentType,
-        'Cache-Control': 'public, max-age=31536000, immutable',
+        'Cache-Control': 'private, no-store',
         'Accept-Ranges': 'bytes',
       },
     });

app/api/upload/audio/route.ts

@@ -1,14 +1,23 @@
-import { auth } from '@/lib/auth';
+import { NextRequest } from 'next/server';
+import { auth, checkProjectAccess } from '@/lib/auth';
+import { db } from '@/lib/db';
 import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
 import { PutObjectCommand } from '@aws-sdk/client-s3';
 import { randomUUID } from 'crypto';
 import { rateLimit } from '@/lib/rate-limit';
+import { validateShareLinkAccess } from '@/lib/share-links';
+import { getShareSessionFromRequest } from '@/lib/share-session';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
+import {
+  deriveGuestUploadContext,
+  enforceGuestUploadQuota,
+  verifyGuestUploadToken,
+} from '@/lib/guest-upload-token';
 
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 const ALLOWED_TYPES = ['audio/webm', 'audio/ogg', 'audio/mp4', 'audio/mpeg', 'audio/wav'];
 
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
   try {
     // Check Content-Length header BEFORE loading the file
     const contentLength = request.headers.get('content-length');
@@ -23,18 +32,69 @@ export async function POST(request: Request) {
     const limited = await rateLimit(request, 'voice-upload');
     if (limited) return limited;
 
-    // Require authentication
     const session = await auth();
-    if (!session?.user?.id) {
-      return apiErrors.unauthorized();
-    }
 
     const formData = await request.formData();
     const file = formData.get('audio') as File | null;
+    const videoId = formData.get('videoId');
+    const uploadToken = formData.get('uploadToken');
 
     if (!file) {
       return apiErrors.badRequest('No audio file provided');
     }
+    if (typeof videoId !== 'string' || !videoId.trim()) {
+      return apiErrors.badRequest('videoId is required');
+    }
+
+    const safeVideoId = videoId.trim();
+    const video = await db.video.findUnique({
+      where: { id: safeVideoId },
+      include: { project: true },
+    });
+    if (!video) {
+      return apiErrors.notFound('Video');
+    }
+
+    const access = await checkProjectAccess(video.project, session?.user?.id);
+    const shareSession = getShareSessionFromRequest(request, safeVideoId);
+    const shareAccess = shareSession
+      ? await validateShareLinkAccess({
+        token: shareSession.token,
+        projectId: video.projectId,
+        videoId: safeVideoId,
+        requiredPermission: 'COMMENT',
+        passwordVerified: shareSession.passwordVerified,
+      })
+      : { hasAccess: false, canComment: false, canDownload: false, allowGuests: false, requiresPassword: false };
+    const canCommentWithMembership = !!session?.user?.id && access.hasAccess;
+    const canCommentWithShareLink = shareAccess.canComment && (session?.user?.id ? true : shareAccess.allowGuests);
+    if (!canCommentWithMembership && !canCommentWithShareLink) {
+      return apiErrors.forbidden('Access denied');
+    }
+
+    if (!session?.user?.id) {
+      if (typeof uploadToken !== 'string' || !uploadToken.trim()) {
+        return apiErrors.badRequest('uploadToken is required for guest uploads');
+      }
+
+      const expectedContext = deriveGuestUploadContext(request, shareSession?.token ?? null);
+      if (!expectedContext) {
+        return apiErrors.forbidden('Missing trusted client IP header');
+      }
+
+      const isValidUploadToken = verifyGuestUploadToken(uploadToken.trim(), {
+        projectId: video.projectId,
+        videoId: safeVideoId,
+        intent: 'audio',
+        context: expectedContext,
+      });
+      if (!isValidUploadToken) {
+        return apiErrors.forbidden('Invalid upload token');
+      }
+
+      const quotaError = await enforceGuestUploadQuota(request, safeVideoId, 'audio', shareSession?.token ?? null);
+      if (quotaError) return quotaError;
+    }
 
     // Double-check file size (defense in depth - Content-Length can be spoofed)
     if (file.size > MAX_FILE_SIZE) {