Media access audit and private storage (2026-10-12)

Status (2026-10-12): private bucket + CORS created; new secrets set (forms key on media/forms; new INTERNAL_SERVICE_TOKEN on media, forms, collections, content-engine, mailbox); core migration applied; workers deployed: media a5dd2f5e (rollback fb32afd8), forms d3145564 (061f57c2), mailbox 4d65a9ee + token (95b5ab06), content-engine 01f4e334 (8dd2d581), mcp-gateway 1d2394c7 (283345cd). Janitor armed and ran clean. Data done: the 4 form files moved to vlozi-media-private (r2.dev links 404; rows 26 public/public + 4 private), main pushed (87f6d7ff..aa74e013, dashboard), the 4 files filed under their submissions with stored links stripped; mailbox had nothing to fix. Clean-up and lock-down done (founder's go-ahead, same day): 32 orphaned objects of 11 deleted workspaces deleted (G23), the old bucket logicspike-media emptied, made private and deleted (G13), scripts/set-r2-cors.ps1 removed (G14); lock-down applied (default private, CHECK validated) and v1 tokens retired, media redeployed 9e941d68 (G17). The public bucket now holds exactly the 26 tracked public files. In-app checks passed (2026-10-12): a mail with 2 attachments reached the founder's Gmail under their real names, and the staged copies were released from media; a form file opened through the short-lived link (the 4 legacy files are fake smoke-test bytes, so Chrome can't render them); a Library upload landed Workspace/private at full size with no public link (the R2 key reaches the new bucket). Rollout complete. G24 shipped the same day (Library visibility switch at upload and in the detail panel; media 5b619234, rollback 9e941d68; dashboard via the main push). Rolling media back to a pre-branch version is no longer possible without first dropping the CHECK (old code doesn't set storage). Owner: founder for every rollout step (secrets, buckets, migrations, deploys); code by the build session. Plan: can-we-start-planning-misty-kernighan.md (session plan). This file is the record.

The question was: is the media service properly connected to the mailbox, does it enforce access, and what other gaps exist.

Short answer. The mailbox's own gates were right. The weak point was underneath: every media file, whatever its visibility, sat in one public R2 bucket, and several routes handed out the permanent public link for "workspace", "private", form and mail files. So a form CV marked workspace-only was downloadable by anyone holding its link, forever. The branch moves every non-public file to a bucket with no public access and replaces permanent links with short-lived ones.

1. Findings

2. Decisions (founder, 2026-10-12)

1. Separate private bucket. Public files (blog, newsletter, social, collections, logos, avatars) stay where they are with unchanged links. Every other file moves to vlozi-media-private, which has no public access. Old links to private files stop working; that is intended.
2. Form files are Forms-only. Out of the Media library; opened from the submission by roles with forms:read; stored delegated to forms under the submission id.
3. Expiring links for integrations. Webhooks and Flows events carry a 7-day signed link (the SigV4 maximum), MCP get_submission a 1-hour one. The public submit response, lists and exports carry no link.

3. How access works now

Where bytes live is the row's storage column (public / private), and every reader follows it. During the migration a non-public row can still say public (bytes not moved yet); it is then served from the public bucket through the same checks, and never given its CDN URL.

Tokens: v2 capability tokens (packages/core-media/src/media.capability.ts) bind tenant and aclRefId (mailbox / submission); each service signs with its own key (mailbox MEDIA_CAPABILITY_SECRET, forms MEDIA_CAPABILITY_SECRET_FORMS on media). v1 tokens are still accepted until the lock-down.

Cleanup: a MediaJanitor Durable Object alarm (every 6 h, armed on the first request after deploy) removes uploads never completed (1 day), archived non-public files (30 days after archiving) and mail attachments never sent (30 days). Bytes are deleted before rows; a failed byte delete keeps the row for the next run. Public files are never auto-deleted (their URLs live in published content).

4. Commits

5. Phase 0 facts (read-only checks, 2026-10-12)

• The worker's bucket logicspike-media-local is served at pub-a2acd43000854b76860fa1b2f86aa406.r2.dev. The older bucket logicspike-media is also public (pub-7855…r2.dev) but no row points into it (all 30 keys: 200 on the new host, 404 on the old).
• media.vlozi.app has no DNS: only a dashboard fallback name, not an entry point.
• Production has 30 media rows: 26 public (blog 15, content 6, collections 4, newsletter 1) and 4 form uploads (tenant). No mailbox, avatar or logo rows.
• The 4 form files were publicly downloadable (HTTP 200 on their r2.dev links).
• The R2 S3 credentials in apps/media-service/.dev.vars get 400 from R2: they are not the production ones.

6. Rollout runbook (founder)

Run from the repo root in PowerShell, with $env:CLOUDFLARE_ACCOUNT_ID="72fe41e9f39ad60cfb6937bb26ab50c3" set (wrangler caches a stale account otherwise). Each step is safe to stop after; the order matters.

1. Private bucket + CORS.

npx wrangler r2 bucket create vlozi-media-private
npx wrangler r2 bucket cors list logicspike-media-local     # copy these rules
# Write them to cors.json with https://go.vlozi.app among the origins (PUT, GET, HEAD;
# headers Content-Type, Content-Length), then:
npx wrangler r2 bucket cors set vlozi-media-private --file cors.json

Leave public access off (no r2.dev URL, no custom domain). In the dashboard, check the R2 API token used by media (R2_ACCESS_KEY_ID) can read and write both buckets; presigned links fail otherwise.

2. Secrets. Two new values: the forms capability key (media + forms) and a new shared INTERNAL_SERVICE_TOKEN. The token is needed because, on 2026-10-12, mailbox and content-engine had no INTERNAL_SERVICE_TOKEN secret at all (G21, G22): mail attachments were unavailable and content-engine's media resolve was refused. Nobody holds a copy of the old value (secrets can't be read back), so all five holders get a new one. Only media checks it; forms, collections, content-engine and mailbox send it. Use secret bulk with files written by node (PowerShell's Set-Content adds a BOM, and piping into secret put corrupts it). See the step-by-step guide given to the founder for the exact commands; in short: write media.json (MEDIA_CAPABILITY_SECRET_FORMS, INTERNAL_SERVICE_TOKEN), forms.json (MEDIA_CAPABILITY_SECRET, INTERNAL_SERVICE_TOKEN) and token.json (INTERNAL_SERVICE_TOKEN) to %TEMP%\vlozi-keys; secret bulk media, forms, collections and content-engine back to back (form and collections uploads fail for the seconds in between); keep token.json for mailbox in step 5; delete the folder after step 5. Forms' key must not equal mailbox's MEDIA_CAPABILITY_SECRET.

3. Core migration (before the media deploy: the new worker selects storage).

node packages/core-database/scripts/apply-media-storage.mjs           # dry run
node packages/core-database/scripts/apply-media-storage.mjs --apply
npx tsx scripts/check-prod-schema.ts --app core

4. Deploy media. cd apps/media-service; npx wrangler deploy --minify. Then check:

• npx wrangler deployments list shows the new version; note the previous one (rollback target);
• the workers.dev URL no longer answers (workers_dev = false);
• the janitor runs: npx wrangler tail logicspike-media shows [janitor] done {…} about a minute after the first request (its counts say what it removed). /internal/janitor/{status,run} exist for service-binding callers only. The first run deletes uploads pending over a day and archived non-public files archived over 30 days ago; that is the cron that never ran.

Old forms and old mailbox keep working against new media (old forms still gets a non-empty fileUrl; old mailbox gets same-origin signed links).

5. Deploy forms, mailbox, content-engine, and mcp-gateway (mcp-gateway carries the updated forms tool descriptions). Note each previous version. The old dashboard keeps working against them: it opens existing form files through the content route; only files uploaded between this step and step 6 won't open until the dashboard is pushed.

6. Push the dashboard (Vercel deploys on push). Not before step 5: the new drawer opens form files only through forms' new file-link route, which the old forms worker doesn't have, so every form file would show "can't be opened" until forms is deployed.

7. Data.

node apps/forms-service/scripts/migrate-form-media.mjs                   # dry run: read the report
node apps/forms-service/scripts/migrate-form-media.mjs --apply --strip-urls
node apps/mailbox/scripts/migrate-mailbox-media.mjs                      # expected: nothing to do
node apps/media-service/scripts/move-private-objects.mjs                 # dry run: lists the 4 form files
node apps/media-service/scripts/move-private-objects.mjs --apply

The move copies, verifies byte-for-byte, flips storage, deletes the public copy and checks the old r2.dev link answers 404. Re-run it to finish anything it reports.

8. Live checks.

• An old r2.dev link to a form CV → 404.
• The file opens from the submission in the dashboard.
• A test webhook delivery carries a signed link dated 7 days out.
• A mail sent with an attachment arrives with its real filename (test mail only to the founder's own Gmail).
• A Library upload (Workspace visibility) works (exercises the private bucket's CORS).

9. Lock-down (after a quiet week).

node packages/core-database/scripts/apply-media-storage-lockdown.mjs     # refuses while any row breaks the rule
node packages/core-database/scripts/apply-media-storage-lockdown.mjs --apply

Then in code: mediaFiles.storage .default("private") in packages/core-database/src/schema.ts; drop v1 token parsing in media.capability.ts; run the schema check.

Rollback. Workers: npx wrangler rollback <version> per worker. Data: until a file's public copy is deleted, setting its storage back to public restores the old path; after the move, the private copy is the only one (it is not lost, just not public). The schema changes are additive.

7. Gap log (found, not fixed in this round)

Review fixes (independent review of the branch, 2026-10-12)