Repository navigation
docs: sync spec and pipeline with multipart upload and hls token - #82
Merged
Merged
Conversation
Ignore rules for ZCode agent workspace context: env files (keep .env.example), python caches, node_modules, build artifacts.
- upload: s3 multipart is the primary path (issue #56) - 8MB presigned chunks direct to minio, legacy proxy/presign/resumable as fallbacks - gateway: hls-token endpoint (15m signed jwt) and HLSAuth private video protection with metadata lru cache (issue #54) - auth: /me requires type=access (issue #76), refresh rotation with jti revocation in redis - frontend: multipart upload with resume, silent refresh with cross-tab guard, logout kills private player - stack: redis in infra list, nginx-vod internal without published port (issue #43), next.js 14 app router + zustand
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Syncs
docs/spec.mdanddocs/services-pipeline.mdwith code that landed after the last docs commit (9b12094) — phases 17–18 hardening plus the upload/playback flows they changed.services-pipeline.md
POST /api/v1/videos/multipart→ presigned 8MB chunks direct browser→MinIO →completewith assembled-object verification; legacy paths (/uploadproxy,/presign,/resumable) listed. Gateway row addsGET /api/v1/videos/{id}/hls-token(15m signed token). Auth row adds refresh rotation (activejtiin Redis, reuse → 401) and/merequiringtype=access(issue P1 auth: require type=access in /me (refresh token must not be an identity) #76). Frontend row adds multipart upload with resume, hls-token for private videos, logout killing the player, silent refresh with cross-tab guard. New infra: Redis row.PutObject.?token=on the manifest URL (15m TTL), logout clears the player source.spec.md
HLSAuthon/hls/*(public/unlisted pass, private needs hls-token or owner access token), metadata LRU cache (TTL 10s, negative 5s, issue P1 gateway: add metadata cache and shared http client to HLSAuth #54)./meand Go middlewares accept onlytype=access(issues P1 infra: fail fast on empty JWT_SECRET/INTERNAL_TOKEN and require exp in JWT #53, P1 auth: require type=access in /me (refresh token must not be an identity) #76).:8080, issue P0 infra: restrict MinIO anonymous policy and close 9000/8081 exposure #43); Redis added to the started-services list.Checklist
services/gateway/internal/middleware/hlsauth.go,services/upload/cmd/server/main.go,services/upload/internal/handler/multipart.go,services/auth/src/routers/auth.py,frontend/src/lib/api.ts,deploy/docker-compose.ymlVerification
git diff main..docs/sync-spec-pipeline --stat— 2 files, +19/−13, docs onlyRemaining risks