From f54c93c879e3abfb7bf92d280bd48de78f95d539 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Mon, 24 Aug 2026 05:16:13 -0300
Subject: [PATCH] fix(video): key download flights with process HMAC

---
 src/lib/guardrails/videoBridge.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/lib/guardrails/videoBridge.ts b/src/lib/guardrails/videoBridge.ts
index b41dbcaf4d..dfd54db4bf 100644
--- a/src/lib/guardrails/videoBridge.ts
+++ b/src/lib/guardrails/videoBridge.ts
@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, createHmac, randomBytes } from "node:crypto";
 
 import { fetch as undiciFetch } from "undici";
 
@@ -90,6 +90,7 @@ const VIDEO_BRIDGE_RESULT_CACHE_VERSION = "v3";
 const VIDEO_BRIDGE_RESULT_CACHE_POLICY = "default";
 const VIDEO_BRIDGE_RESULT_CACHE_KEY_KIND = "video-result-v3";
 const VIDEO_BRIDGE_DOWNLOAD_FLIGHT_VERSION = "v1";
+const VIDEO_BRIDGE_DOWNLOAD_FLIGHT_HMAC_KEY = randomBytes(32);
 
 function buildVideoDownloadFlightKey(
   part: VideoPart,
@@ -117,7 +118,9 @@ function buildVideoDownloadFlightKey(
     timeoutMs,
     version: VIDEO_BRIDGE_DOWNLOAD_FLIGHT_VERSION,
   });
-  return `video-download:${createHash("sha256").update(canonicalIdentity).digest("hex")}`;
+  return `video-download:${createHmac("sha256", VIDEO_BRIDGE_DOWNLOAD_FLIGHT_HMAC_KEY)
+    .update(canonicalIdentity)
+    .digest("hex")}`;
 }
 
 interface VideoResultCacheMetadata {