PM-5487 showcase media security#28
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR adds CloudFront Signed URL support for project showcase media, enabling private S3-backed media delivery via CloudFront while keeping URL signing on the backend.
Changes:
- Introduces a
signCloudFrontUrlutility (with key normalization) and wires it intoProjectShowcasePostServicemedia responses. - Adds CloudFront signing configuration to
APP_CONFIGand updates/extends unit tests to validate signed URL behavior. - Adds dependency (
@aws-sdk/cloudfront-signer) plus documentation for AWS setup and key management.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/shared/utils/cloudfront.utils.ts | Adds URL-signing helper (CloudFront signer + PEM normalization) used when returning media URLs. |
| src/shared/utils/cloudfront.utils.spec.ts | Unit tests for the signing helper behavior when keys are present/missing. |
| src/shared/config/app.config.ts | Adds env-driven CloudFront signing configuration fields (key pair id/key material/expiry). |
| src/api/project-showcase-post/project-showcase-post.service.ts | Signs returned showcase media URLs via signCloudFrontUrl. |
| src/api/project-showcase-post/project-showcase-post.service.spec.ts | Mocks signing util and updates assertions to expect signed media URLs. |
| package.json | Adds @aws-sdk/cloudfront-signer dependency. |
| pnpm-lock.yaml | Locks CloudFront signer deps; also includes additional unrelated lockfile changes. |
| docs/projects-showcase-media.md | Adds end-to-end setup guide for private S3 + CloudFront Signed URLs. |
| .env.example | Adds CloudFront showcase media key variables (example values). |
| appStartUp.sh | Removes defaulting of POSTGRES_SCHEMA in startup script. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+65
to
+67
| } catch { | ||
| return url; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces support for serving project showcase media through private S3 buckets using CloudFront Signed URLs. It adds the necessary dependencies, configuration, documentation, and code changes to generate and serve signed CloudFront URLs for media assets. Additionally, it updates tests and environment files to reflect the new setup.
CloudFront Signed URL Integration for Project Showcase Media:
1. Feature Implementation
signCloudFrontUrlutility is called when returning media URLs, ensuring that only signed requests can access protected S3 content. (src/api/project-showcase-post/project-showcase-post.service.ts[1] [2]2. Configuration Updates
.env.example[1]src/shared/config/app.config.ts[2]3. Dependency Management
@aws-sdk/cloudfront-signerand its dependencies topackage.jsonandpnpm-lock.yamlfor generating signed URLs. (package.json[1]pnpm-lock.yaml[2] [3] [4] [5] [6] [7] [8]4. Documentation
docs/projects-showcase-media.mddocs/projects-showcase-media.mdR1-R273)5. Tests and Minor Cleanups
BigIntfor IDs, clearing mocks). (src/api/project-showcase-post/project-showcase-post.service.spec.ts[1] [2] [3] [4] [5] [6] [7] [8]appStartUp.shappStartUp.shL6-L13)These changes collectively enable secure, signed delivery of project showcase media through CloudFront, improving both security and scalability.