etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-30 02:23:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): use signed media tokens for ticket attachments

Browse Source 
Backend now requires a signed, expiring token to download media (a raw file_id
404s). Carry the per-attachment `token` (and the legacy `media_token`) from the
ticket response through MessageMediaGrid and append it in ticketsApi.getMediaUrl,
so attachments keep rendering while leaked URLs expire. Must deploy together with
the backend change.
This commit is contained in:
c0mrade
2026-06-04 17:45:43 +03:00
parent b4f066942a
commit c6fc167d80
3 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/types/index.ts
View File

@@ -486,6 +486,8 @@ export interface TicketMediaItem {
type: 'photo' | 'video' | 'document';
file_id: string;
caption?: string | null;
/** Signed, expiring download token (response only). */
token?: string | null;
}
export interface TicketMessage {
@@ -495,6 +497,8 @@ export interface TicketMessage {
has_media: boolean;
media_type: string | null;
media_file_id: string | null;
/** Signed, expiring download token for the legacy single media_file_id. */
media_token?: string | null;
media_caption: string | null;
media_items?: TicketMediaItem[] | null;
created_at: string;