Merge pull request #886 from marksgraham/image-out2

Generate signed URLs for images

Author: aldenhallak

functions/src/utils/storage.ts

@@ -6,7 +6,9 @@ import {generateId} from '@deliberation-lab/utils';
  * @param base64Data The base64 encoded image string.
  * @param mimeType The MIME type of the image.
  * @param prefix A prefix for the file name in the bucket.
- * @returns The public URL of the uploaded image.
+ * @returns A URL for the uploaded image.
+ *   - In production: signed URL valid for 7 days
+ *   - In emulator: public URL (emulator can't sign)
  */
 export async function uploadBase64ImageToGCS(
   base64Data: string,
@@ -20,11 +22,30 @@ export async function uploadBase64ImageToGCS(
 
   const buffer = Buffer.from(base64Data, 'base64');
 
-  await file.save(buffer, {
-    metadata: {
-      contentType: mimeType,
-    },
-  });
+  const isEmulator = process.env.FUNCTIONS_EMULATOR === 'true';
 
-  return file.publicUrl();
+  if (isEmulator) {
+    // Emulator: save and return public URL (emulator can't sign URLs)
+    await file.save(buffer, {
+      metadata: {
+        contentType: mimeType,
+      },
+      public: true,
+    });
+    return file.publicUrl();
+  } else {
+    // Production: save and return signed URL (works regardless of bucket ACL settings)
+    await file.save(buffer, {
+      metadata: {
+        contentType: mimeType,
+      },
+    });
+
+    const [signedUrl] = await file.getSignedUrl({
+      action: 'read',
+      expires: Date.now() + 7 * 24 * 60 * 60 * 1000, // 7 days
+    });
+
+    return signedUrl;
+  }
 }