Merge branch 'main' into feat-notifications

Author: abhinavxd

cmd/handlers.go

@@ -26,8 +26,8 @@ func initHandlers(g *fastglue.Fastglue, hub *ws.Hub) {
 	// Public config for app initialization.
 	g.GET("/api/v1/config", handleGetConfig)
 
-	// Media.
-	g.GET("/uploads/{uuid}", auth(handleServeMedia))
+	// Media - supports both authenticated access and signed URLs.
+	g.GET("/uploads/{uuid}", authOrSignedURL(handleServeMedia))
 	g.POST("/api/v1/media", auth(handleMediaUpload))
 
 	// Settings.

cmd/init.go

@@ -480,6 +480,11 @@ func initMedia(db *sqlx.DB, i18n *i18n.I18n, settings *setting.Manager) *media.M
 			log.Fatalf("error initializing s3 media store: %v", err)
 		}
 	case "fs":
+		// Default expiry to 1h if not set.
+		fsExpiry := ko.Duration("upload.fs.expiry")
+		if fsExpiry == 0 {
+			fsExpiry = 1 * time.Hour
+		}
 		store, err = fs.New(fs.Opts{
 			UploadURI:  "/uploads",
 			UploadPath: filepath.Clean(ko.String("upload.fs.upload_path")),
@@ -491,6 +496,8 @@ func initMedia(db *sqlx.DB, i18n *i18n.I18n, settings *setting.Manager) *media.M
 				}
 				return rootURL
 			},
+			SigningKey: ko.MustString("app.encryption_key"),
+			Expiry:     fsExpiry,
 		})
 		if err != nil {
 			log.Fatalf("error initializing fs media store: %v", err)

cmd/media.go

@@ -13,6 +13,7 @@ import (
 	amodels "github.com/abhinavxd/libredesk/internal/auth/models"
 	"github.com/abhinavxd/libredesk/internal/envelope"
 	"github.com/abhinavxd/libredesk/internal/image"
+	mmodels "github.com/abhinavxd/libredesk/internal/media/models"
 	"github.com/abhinavxd/libredesk/internal/stringutil"
 	"github.com/google/uuid"
 	"github.com/valyala/fasthttp"
@@ -148,20 +149,29 @@ func handleMediaUpload(r *fastglue.Request) error {
 }
 
 // handleServeMedia serves uploaded media.
+// Supports both authenticated access (with permission checks) and signed URL access (no permission checks).
 func handleServeMedia(r *fastglue.Request) error {
 	var (
-		app   = r.Context.(*App)
-		auser = r.RequestCtx.UserValue("user").(amodels.User)
-		uuid  = r.RequestCtx.UserValue("uuid").(string)
+		app  = r.Context.(*App)
+		uuid = r.RequestCtx.UserValue("uuid").(string)
+		authMethod = r.RequestCtx.UserValue("auth_method")
 	)
 
+	// If accessed via signed URL, skip permission checks and serve file directly.
+	if authMethod == "signed_url" {
+		return serveMediaFile(r, app, uuid, nil)
+	}
+
+	// Session/API key authenticated - perform full permission check.
+	auser := r.RequestCtx.UserValue("user").(amodels.User)
+
 	user, err := app.user.GetAgent(auser.ID, "")
 	if err != nil {
 		return sendErrorEnvelope(r, err)
 	}
 
 	// Fetch media from DB.
-	media, err := app.media.Get(0, strings.TrimPrefix(uuid, image.ThumbPrefix))
+	media, err := getMediaByUUID(app, uuid)
 	if err != nil {
 		return sendErrorEnvelope(r, err)
 	}
@@ -187,6 +197,22 @@ func handleServeMedia(r *fastglue.Request) error {
 	if !allowed {
 		return r.SendErrorEnvelope(http.StatusUnauthorized, app.i18n.Ts("globals.messages.denied", "name", "{globals.terms.permission}"), nil, envelope.UnauthorizedError)
 	}
+
+	return serveMediaFile(r, app, uuid, &media)
+}
+
+// serveMediaFile serves the actual file content based on the storage provider.
+// If media is nil, it will be fetched from DB.
+func serveMediaFile(r *fastglue.Request, app *App, uuid string, media *mmodels.Media) error {
+	// Fetch media metadata from DB if not provided.
+	if media == nil {
+		m, err := getMediaByUUID(app, uuid)
+		if err != nil {
+			return sendErrorEnvelope(r, err)
+		}
+		media = &m
+	}
+
 	consts := app.consts.Load().(*constants)
 	switch consts.UploadProvider {
 	case "fs":
@@ -213,3 +239,8 @@ func handleServeMedia(r *fastglue.Request) error {
 func bytesToMegabytes(bytes int64) float64 {
 	return float64(bytes) / 1024 / 1024
 }
+
+// getMediaByUUID fetches media metadata from DB, handling thumbnail prefix.
+func getMediaByUUID(app *App, uuid string) (mmodels.Media, error) {
+	return app.media.Get(0, strings.TrimPrefix(uuid, image.ThumbPrefix))
+}

cmd/messages.go

@@ -28,14 +28,27 @@ type messageReq struct {
 // handleGetMessages returns messages for a conversation.
 func handleGetMessages(r *fastglue.Request) error {
 	var (
-		app         = r.Context.(*App)
-		uuid        = r.RequestCtx.UserValue("uuid").(string)
-		auser       = r.RequestCtx.UserValue("user").(amodels.User)
-		page, _     = strconv.Atoi(string(r.RequestCtx.QueryArgs().Peek("page")))
-		pageSize, _ = strconv.Atoi(string(r.RequestCtx.QueryArgs().Peek("page_size")))
-		total       = 0
+		app      = r.Context.(*App)
+		uuid     = r.RequestCtx.UserValue("uuid").(string)
+		auser    = r.RequestCtx.UserValue("user").(amodels.User)
+		page, _  = strconv.Atoi(string(r.RequestCtx.QueryArgs().Peek("page")))
+		pageSize = r.RequestCtx.QueryArgs().GetUintOrZero("page_size")
+		total    = 0
+		private  *bool
 	)
 
+	// Parse optional private filter (null = no filter)
+	if r.RequestCtx.QueryArgs().Has("private") {
+		p := r.RequestCtx.QueryArgs().GetBool("private")
+		private = &p
+	}
+
+	// Parse repeated type params: ?type=incoming&type=outgoing
+	var msgTypes []string
+	for _, v := range r.RequestCtx.QueryArgs().PeekMulti("type") {
+		msgTypes = append(msgTypes, string(v))
+	}
+
 	user, err := app.user.GetAgent(auser.ID, "")
 	if err != nil {
 		return sendErrorEnvelope(r, err)
@@ -47,7 +60,7 @@ func handleGetMessages(r *fastglue.Request) error {
 		return sendErrorEnvelope(r, err)
 	}
 
-	messages, pageSize, err := app.conversation.GetConversationMessages(uuid, page, pageSize)
+	messages, pageSize, err := app.conversation.GetConversationMessages(uuid, page, pageSize, private, msgTypes)
 	if err != nil {
 		return sendErrorEnvelope(r, err)
 	}

cmd/middlewares.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"net/http"
+	"strconv"
 	"strings"
 
 	amodels "github.com/abhinavxd/libredesk/internal/auth/models"
@@ -220,3 +221,61 @@ func notAuthPage(handler fastglue.FastRequestHandler) fastglue.FastRequestHandle
 		return handler(r)
 	}
 }
+
+// authOrSignedURL allows access if user is authenticated OR if URL has valid signature.
+// Used for media endpoints that support both access methods.
+func authOrSignedURL(handler fastglue.FastRequestHandler) fastglue.FastRequestHandler {
+	return func(r *fastglue.Request) error {
+		app := r.Context.(*App)
+
+		// First, try to authenticate normally.
+		user, err := authenticateUser(r, app)
+		if err == nil && user.ID > 0 {
+			// User is authenticated, set user context and proceed.
+			r.RequestCtx.SetUserValue("user", amodels.User{
+				ID:        user.ID,
+				Email:     user.Email.String,
+				FirstName: user.FirstName,
+				LastName:  user.LastName,
+			})
+			r.RequestCtx.SetUserValue("auth_method", "session")
+			return handler(r)
+		}
+
+		// Authentication failed, check for signed URL.
+		validator := app.media.SignedURLValidator()
+		if validator == nil {
+			// Store doesn't support signed URLs, require auth.
+			return r.SendErrorEnvelope(http.StatusUnauthorized,
+				app.i18n.T("auth.invalidOrExpiredSession"), nil, envelope.GeneralError)
+		}
+
+		// Parse signature and expiry from query params.
+		sig := string(r.RequestCtx.QueryArgs().Peek("sig"))
+		expStr := string(r.RequestCtx.QueryArgs().Peek("exp"))
+
+		if sig == "" || expStr == "" {
+			return r.SendErrorEnvelope(http.StatusUnauthorized,
+				app.i18n.T("auth.invalidOrExpiredSession"), nil, envelope.GeneralError)
+		}
+
+		exp, err := strconv.ParseInt(expStr, 10, 64)
+		if err != nil {
+			return r.SendErrorEnvelope(http.StatusBadRequest,
+				app.i18n.Ts("globals.messages.invalid", "name", "expiry"), nil, envelope.InputError)
+		}
+
+		// Get the UUID from the route.
+		uuid := r.RequestCtx.UserValue("uuid").(string)
+
+		// Validate signature.
+		if !validator(uuid, sig, exp) {
+			return r.SendErrorEnvelope(http.StatusForbidden,
+				app.i18n.T("media.invalidOrExpiredURL"), nil, envelope.PermissionError)
+		}
+
+		// Mark as signed URL access (no user context).
+		r.RequestCtx.SetUserValue("auth_method", "signed_url")
+		return handler(r)
+	}
+}

frontend/package.json

@@ -48,7 +48,7 @@
     "lucide-vue-next": "^0.378.0",
     "mitt": "^3.0.1",
     "pinia": "^2.1.7",
-    "qs": "^6.12.1",
+    "qs": "^6.14.1",
     "radix-vue": "^1.9.17",
     "reka-ui": "^2.2.0",
     "tailwind-merge": "^2.3.0",