feat(media-supply): integrate object storage for media supply service and enhance image upload handling

server/internal/tenant/transport/asset_handler.go

@@ -2,10 +2,6 @@ package transport
 
 import (
 	"bytes"
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
 	"image"
 	"image/jpeg"
 	"image/png"
@@ -17,6 +13,7 @@ import (
 	_ "golang.org/x/image/webp"
 
 	"github.com/geo-platform/tenant-api/internal/bootstrap"
+	"github.com/geo-platform/tenant-api/internal/shared/publicasset"
 )
 
 type AssetHandler struct {
@@ -104,11 +101,7 @@ func convertPublicAssetFormat(content []byte, format string) ([]byte, string, bo
 }
 
 func (h *AssetHandler) signObjectKey(objectKey string) string {
-	encodedKey := base64.RawURLEncoding.EncodeToString([]byte(objectKey))
-	mac := hmac.New(sha256.New, []byte(h.secret()))
-	_, _ = mac.Write([]byte(objectKey))
-	signature := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
-	return fmt.Sprintf("%s.%s", encodedKey, signature)
+	return publicasset.SignObjectKey(objectKey, h.secret())
 }
 
 func (h *AssetHandler) secret() string {
@@ -119,43 +112,11 @@ func (h *AssetHandler) secret() string {
 }
 
 func (h *AssetHandler) parseToken(token string) (string, bool) {
-	parts := strings.Split(token, ".")
-	if len(parts) != 2 {
-		return "", false
-	}
-
-	objectKeyBytes, err := base64.RawURLEncoding.DecodeString(parts[0])
-	if err != nil {
-		return "", false
-	}
-	objectKey := string(objectKeyBytes)
-	if strings.TrimSpace(objectKey) == "" {
-		return "", false
-	}
-
-	expected := h.signObjectKey(objectKey)
-	if !hmac.Equal([]byte(expected), []byte(token)) {
-		return "", false
-	}
-
-	return objectKey, true
+	return publicasset.ParseObjectKeyToken(token, h.secret())
 }
 
 func objectKeyFromAssetToken(token string) (string, bool) {
-	parts := strings.Split(token, ".")
-	if len(parts) != 2 {
-		return "", false
-	}
-
-	objectKeyBytes, err := base64.RawURLEncoding.DecodeString(parts[0])
-	if err != nil {
-		return "", false
-	}
-	objectKey := strings.TrimSpace(string(objectKeyBytes))
-	if objectKey == "" {
-		return "", false
-	}
-	return objectKey, true
+	return publicasset.ObjectKeyFromToken(token)
 }
 
 func isDesktopClientAssetKey(objectKey string, tenantID int64) bool {

server/internal/tenant/transport/media_supply_handler.go

@@ -19,7 +19,7 @@ type MediaSupplyHandler struct {
 func NewMediaSupplyHandler(a *bootstrap.App) *MediaSupplyHandler {
 	svc := a.MediaSupplyService
 	if svc == nil {
-		svc = app.NewMediaSupplyService(a.DB, a.Redis, a.Logger, a.ConfigStore)
+		svc = app.NewMediaSupplyService(a.DB, a.Redis, a.Logger, a.ConfigStore).WithObjectStorage(a.ObjectStorage)
 	}
 	return &MediaSupplyHandler{
 		svc: svc,