feat(media-supply): integrate object storage for media supply service and enhance image upload handling

server/internal/tenant/transport/asset_handler.go

@@ -2,10 +2,6 @@ package transport
 
 import (
 	"bytes"
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
 	"image"
 	"image/jpeg"
 	"image/png"
@@ -17,6 +13,7 @@ import (
 	_ "golang.org/x/image/webp"
 
 	"github.com/geo-platform/tenant-api/internal/bootstrap"
+	"github.com/geo-platform/tenant-api/internal/shared/publicasset"
 )
 
 type AssetHandler struct {
@@ -104,11 +101,7 @@ func convertPublicAssetFormat(content []byte, format string) ([]byte, string, bo
 }
 
 func (h *AssetHandler) signObjectKey(objectKey string) string {
-	encodedKey := base64.RawURLEncoding.EncodeToString([]byte(objectKey))
-	mac := hmac.New(sha256.New, []byte(h.secret()))
-	_, _ = mac.Write([]byte(objectKey))
-	signature := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
-	return fmt.Sprintf("%s.%s", encodedKey, signature)
+	return publicasset.SignObjectKey(objectKey, h.secret())
 }
 
 func (h *AssetHandler) secret() string {
@@ -119,43 +112,11 @@ func (h *AssetHandler) secret() string {
 }
 
 func (h *AssetHandler) parseToken(token string) (string, bool) {
-	parts := strings.Split(token, ".")
-	if len(parts) != 2 {
-		return "", false
-	}
-
-	objectKeyBytes, err := base64.RawURLEncoding.DecodeString(parts[0])
-	if err != nil {
-		return "", false
-	}
-	objectKey := string(objectKeyBytes)
-	if strings.TrimSpace(objectKey) == "" {
-		return "", false
-	}
-
-	expected := h.signObjectKey(objectKey)
-	if !hmac.Equal([]byte(expected), []byte(token)) {
-		return "", false
-	}
-
-	return objectKey, true
+	return publicasset.ParseObjectKeyToken(token, h.secret())
 }
 
 func objectKeyFromAssetToken(token string) (string, bool) {
-	parts := strings.Split(token, ".")
-	if len(parts) != 2 {
-		return "", false
-	}
-
-	objectKeyBytes, err := base64.RawURLEncoding.DecodeString(parts[0])
-	if err != nil {
-		return "", false
-	}
-	objectKey := strings.TrimSpace(string(objectKeyBytes))
-	if objectKey == "" {
-		return "", false
-	}
-	return objectKey, true
+	return publicasset.ObjectKeyFromToken(token)
 }
 
 func isDesktopClientAssetKey(objectKey string, tenantID int64) bool {