98b370c925
- POST /api/documents/token issues JWT HS256 (claims userid/username/fid/template) after x-api-key check against new env DOCVER_API_KEY (fail-closed, timing-safe, uniform 401) - all docver endpoints now require Authorization: Bearer, verified with env DOCVER_TOKEN_SECRET (TTL via DOCVER_TOKEN_TTL_SECONDS, default 3600); secret unset = 401 on verify / 500 on issue - identity (userId/userName) + templateId extracted from token claims instead of request payload; removed from multipart form (legacy fields now 400) - lib/docver-token.ts: hand-rolled JWT via node:crypto only — alg pinned to HS256 (anti alg-confusion), timing-safe compare with both sides hashed, exp enforced, identical 401 for all bearer failure modes - openapi spec: /api/documents/token path + DocverBearer scheme; PLAN-DOCVER.md / CLAUDE.md / .env.example updated - tests: new tests/lib/docver-token.test.ts + adjusted parseVersionUploadForm tests (258 pass, no DB env needed) - package-lock.json: sync minio (^8.0.7) that was missing from the earlier docver commit Co-Authored-By: Claude Code <noreply@anthropic.com>
53 lines
2.4 KiB
TypeScript
53 lines
2.4 KiB
TypeScript
// PLAN-DOCVER.md §1 — GET /api/documents/{docId}/versions/{versionId}/download-link?format=docx|pdf
|
|
// คืน presigned URL อายุสั้น (env DOCVER_LINK_TTL_SECONDS) ให้ UI เปิดในเบราว์เซอร์จริง
|
|
// ของผู้ใช้ — เช็คทั้ง docId และ versionId พร้อมกันกันโยน id ข้ามเอกสาร
|
|
// auth: Authorization: Bearer (access_token จาก POST /api/documents/token — ทุก endpoint ของกลุ่ม)
|
|
import {
|
|
docverError,
|
|
parseDocId,
|
|
parseDownloadFormat,
|
|
parseVersionIdParam,
|
|
} from "@/lib/document-versioning";
|
|
import { requireDocverBearer } from "@/lib/docver-token";
|
|
import { findVersionForDoc, presignVersionUrl } from "@/lib/docver-store";
|
|
|
|
export const runtime = "nodejs";
|
|
export const dynamic = "force-dynamic";
|
|
|
|
export async function GET(
|
|
request: Request,
|
|
{ params }: { params: { docId: string; versionId: string } },
|
|
) {
|
|
const auth = requireDocverBearer(request);
|
|
if (!auth.ok) return auth.response;
|
|
|
|
const docId = parseDocId(params.docId);
|
|
if (!docId.ok) return docverError(docId.error, 400);
|
|
const versionId = parseVersionIdParam(params.versionId);
|
|
if (!versionId.ok) return docverError(versionId.error, 400);
|
|
let format: string | null = null;
|
|
try {
|
|
format = new URL(request.url).searchParams.get("format");
|
|
} catch {
|
|
return docverError("URL ของ request ไม่ถูกต้อง", 400);
|
|
}
|
|
const parsedFormat = parseDownloadFormat(format);
|
|
if (!parsedFormat.ok) return docverError(parsedFormat.error, 400);
|
|
|
|
try {
|
|
const row = await findVersionForDoc(docId.docId, versionId.versionId);
|
|
if (!row) {
|
|
return docverError("ไม่พบ version นี้ของเอกสาร", 404);
|
|
}
|
|
if (parsedFormat.format === "pdf" && row.pdfObjectKey === null) {
|
|
return docverError("version นี้ไม่มีสำเนา PDF", 404);
|
|
}
|
|
const link = await presignVersionUrl(row.id, parsedFormat.format);
|
|
return new Response(JSON.stringify(link), {
|
|
headers: { "content-type": "application/json; charset=utf-8" },
|
|
});
|
|
} catch (err) {
|
|
console.error("docver: สร้าง download link ล้ม", err);
|
|
return docverError("เกิดข้อผิดพลาดของระบบ โปรดลองใหม่อีกครั้ง", 500);
|
|
}
|
|
}
|