- Shipped
- 8 ஜூலை, 2026 அன்று 1:09 AM UTC
- Author
- Kamo
- Commit
- 34f2809
Lets social providers (Meta) and email fetch a specific material for a bounded window without exposing the private imaging-materials bucket. - MaterialUrlSigner: HMAC-SHA256 (platform.enc-key) token = imgId:orgId:exp, 1h TTL - MaterialsController: POST /api/media/materials/link (auth → mint URL for an org-owned MATERIALS image) + GET **************** (unauth → serve bytes for a valid token; org + assoc checked). Rides the existing sessionless /api/media/** forward — no APIService change needed.