From d30fd59ade32cfb15e680bcc482905ef2ffb3ea4 Mon Sep 17 00:00:00 2001 From: Zichao Lin Date: Sat, 18 Jul 2026 08:24:40 +0800 Subject: [PATCH] fix(storage): use presigned URLs for private S3 buckets (7-day expiry) --- app/storage.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/app/storage.py b/app/storage.py index 4c7b2ea..099fe96 100644 --- a/app/storage.py +++ b/app/storage.py @@ -121,9 +121,12 @@ class S3Storage: k = _strip_prefix(key) if self.public_url: return f"{self.public_url}/{k}" - # fallback: path-style URL from endpoint + bucket - ep = self._client._endpoint.host - return f"{ep}/{self.bucket}/{k}" + # private bucket: generate presigned URL (7 days expiry) + return self._client.generate_presigned_url( + "get_object", + Params={"Bucket": self.bucket, "Key": k}, + ExpiresIn=604800, + ) # ── Helpers ────────────────────────────────────────────────────────