fix: preserve Drive identity checks through Vercel

Author: richiemcilroy

apps/media-server/src/__tests__/lib/media-transfer.test.ts

@@ -51,6 +51,33 @@ function fetcher(
 	return Object.assign(run, { preconnect: fetch.preconnect }) as typeof fetch;
 }
 describe("bounded revision downloads", () => {
+	test("pins the descriptor with an application header and rejects changed identity", async () => {
+		process.env.MEDIA_SERVER_WEBHOOK_SECRET = "worker-secret";
+		globalThis.fetch = fetcher((_input, init) => {
+			const headers = new Headers(init?.headers);
+			expect(headers.get("if-match")).toBeNull();
+			expect(headers.get("x-cap-recording-object-identity")).toBe('"identity"');
+			return Response.json(target());
+		});
+		expect(
+			await getMediaDownloadTarget(
+				"https://cap.so/api/storage/object",
+				undefined,
+				'"identity"',
+			),
+		).toEqual(target());
+		globalThis.fetch = fetcher(() =>
+			Response.json({ ...target(), objectIdentity: '"changed"' }),
+		);
+		await expect(
+			getMediaDownloadTarget(
+				"https://cap.so/api/storage/object",
+				undefined,
+				'"identity"',
+			),
+		).rejects.toThrow("Recording object changed");
+	});
+
 	test("resumes an interrupted pinned revision without rereading completed bytes", async () => {
 		const path = await destination();
 		let calls = 0;

apps/media-server/src/lib/media-transfer.ts

@@ -171,7 +171,9 @@ export async function getMediaDownloadTarget(
 		headers: {
 			"x-cap-internal-download": "1",
 			"x-media-server-secret": secret,
-			...(expectedIdentity ? { "if-match": expectedIdentity } : {}),
+			...(expectedIdentity
+				? { "x-cap-recording-object-identity": expectedIdentity }
+				: {}),
 		},
 		signal,
 		redirect: "manual",

apps/web/__tests__/unit/storage-object-verification.test.ts

@@ -99,26 +99,29 @@ describe("recording verification object reads", () => {
 		expect(mocks.download).not.toHaveBeenCalled();
 	});
 
-	it("authorizes an internal descriptor without downloading media", async () => {
-		mocks.download.mockReturnValue(
-			Effect.succeed({
-				version: 1,
-				url: "https://www.googleapis.com/drive/v3/files/file/revisions/revision?alt=media",
-			}),
-		);
-		const response = await request({
-			"x-cap-internal-download": "1",
-			"x-media-server-secret": "test-media-secret",
-			"if-match": '"identity"',
-		});
-		expect(response.status).toBe(200);
-		expect(response.headers.get("Cache-Control")).toBe("private, no-store");
-		expect(mocks.download).toHaveBeenCalledWith(
-			"owner/video/result.mp4",
-			expect.objectContaining({ objectIdentity: '"identity"' }),
-		);
-		expect(mocks.read).not.toHaveBeenCalled();
-	});
+	it.each(["if-match", "x-cap-recording-object-identity"])(
+		"authorizes an internal descriptor using %s without downloading media",
+		async (identityHeader) => {
+			mocks.download.mockReturnValue(
+				Effect.succeed({
+					version: 1,
+					url: "https://www.googleapis.com/drive/v3/files/file/revisions/revision?alt=media",
+				}),
+			);
+			const response = await request({
+				"x-cap-internal-download": "1",
+				"x-media-server-secret": "test-media-secret",
+				[identityHeader]: '"identity"',
+			});
+			expect(response.status).toBe(200);
+			expect(response.headers.get("Cache-Control")).toBe("private, no-store");
+			expect(mocks.download).toHaveBeenCalledWith(
+				"owner/video/result.mp4",
+				expect.objectContaining({ objectIdentity: '"identity"' }),
+			);
+			expect(mocks.read).not.toHaveBeenCalled();
+		},
+	);
 
 	it("does not add metadata requests to ordinary playback", async () => {
 		const response = await request();

apps/web/app/api/storage/object/route.ts

@@ -186,7 +186,10 @@ export async function GET(request: NextRequest) {
 			if (!("getInternalDownload" in storage))
 				return new Response("Unsupported storage", { status: 400 });
 			const target = yield* storage.getInternalDownload(key, {
-				objectIdentity: request.headers.get("if-match") ?? undefined,
+				objectIdentity:
+					request.headers.get("x-cap-recording-object-identity") ??
+					request.headers.get("if-match") ??
+					undefined,
 				signal: request.signal,
 			});
 			return Response.json(target, {