pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-24 16:12:23 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(video): separate tenant scope from download hash

Browse Source
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-08-24 05:55:00 -03:00
parent f54c93c879
commit d4ade9d1d3
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/lib/guardrails/videoBridge.ts
View File

@@ -1,4 +1,4 @@
import { createHash, createHmac, randomBytes } from "node:crypto";
import { createHash } from "node:crypto";
import { fetch as undiciFetch } from "undici";
@@ -90,7 +90,6 @@ const VIDEO_BRIDGE_RESULT_CACHE_VERSION = "v3";
const VIDEO_BRIDGE_RESULT_CACHE_POLICY = "default";
const VIDEO_BRIDGE_RESULT_CACHE_KEY_KIND = "video-result-v3";
const VIDEO_BRIDGE_DOWNLOAD_FLIGHT_VERSION = "v1";
const VIDEO_BRIDGE_DOWNLOAD_FLIGHT_HMAC_KEY = randomBytes(32);
function buildVideoDownloadFlightKey(
part: VideoPart,
@@ -109,7 +108,6 @@ function buildVideoDownloadFlightKey(
maxBytes,
method: context.method ?? null,
model: context.model ?? null,
principalId,
provider: context.provider ?? null,
ref: part.ref,
shape: part.shape,
@@ -118,9 +116,11 @@ function buildVideoDownloadFlightKey(
timeoutMs,
version: VIDEO_BRIDGE_DOWNLOAD_FLIGHT_VERSION,
});
return `video-download:${createHmac("sha256", VIDEO_BRIDGE_DOWNLOAD_FLIGHT_HMAC_KEY)
.update(canonicalIdentity)
.digest("hex")}`;
const requestFingerprint = createHash("sha256").update(canonicalIdentity).digest("hex");
// The authenticated database id is an ephemeral in-memory scope, not a
// password or persisted credential. Keep it out of cryptographic hashes so
// password-hash analysis cannot conflate tenant partitioning with storage.
return `video-download:${JSON.stringify([principalId, requestFingerprint])}`;
}
interface VideoResultCacheMetadata {