fix: use public endpoint for generated presigned storage URLs

.env.example

@@ -34,6 +34,7 @@ PLAYWRIGHT_SERVER_TIMEOUT_MS=120000
 LOAD_API_URL=http://localhost:4001/api
 SOAK_SECONDS=7200
 S3_ENDPOINT=http://localhost:19000
+S3_PUBLIC_ENDPOINT=http://localhost:19000
 S3_ACCESS_KEY=minio
 S3_SECRET_KEY=change-me
 S3_BUCKET=lingospeak

apps/api/src/config/defaults.ts

@@ -26,6 +26,7 @@ export const defaultConfig = {
   },
   storage: {
     endpoint: 'http://localhost:9000',
+    publicEndpoint: 'http://localhost:19000',
     region: 'us-east-1',
     forcePathStyle: true,
     maxUploadBytes: 52_428_800,

apps/api/src/config/env.validation.ts

@@ -69,6 +69,7 @@ export const envSchema = z.object({
   API_URL: z.string().url().default(defaultConfig.app.apiUrl),
   WEB_URL: z.string().url().default(defaultConfig.app.webUrl),
   S3_ENDPOINT: z.string().url().default(defaultConfig.storage.endpoint),
+  S3_PUBLIC_ENDPOINT: z.string().url().default(defaultConfig.storage.publicEndpoint),
   S3_ACCESS_KEY: z.string().min(1),
   S3_SECRET_KEY: z.string().min(1),
   S3_BUCKET: z.string().min(1),

apps/api/src/config/files.config.ts

@@ -4,6 +4,7 @@ export function filesConfig() {
   const env = config();
   return {
     endpoint: env.S3_ENDPOINT,
+    publicEndpoint: env.S3_PUBLIC_ENDPOINT,
     region: env.S3_REGION,
     forcePathStyle: env.S3_FORCE_PATH_STYLE,
     accessKey: env.S3_ACCESS_KEY,

apps/api/src/infrastructure/storage/s3-object-storage.adapter.ts

@@ -15,9 +15,16 @@ export class S3ObjectStorageAdapter implements ObjectStorage {
     credentials: { accessKeyId: this.cfg.accessKey, secretAccessKey: this.cfg.secretKey },
   });
 
+  private readonly publicClient = new S3Client({
+    region: this.cfg.region,
+    endpoint: this.cfg.publicEndpoint,
+    forcePathStyle: this.cfg.forcePathStyle,
+    credentials: { accessKeyId: this.cfg.accessKey, secretAccessKey: this.cfg.secretKey },
+  });
+
   createUploadUrl(input: { key: string; contentType: string; contentLength: number; checksum: string }) {
     return getSignedUrl(
-      this.client,
+      this.publicClient,
       new PutObjectCommand({
         Bucket: this.cfg.bucket,
         Key: input.key,
@@ -50,7 +57,7 @@ export class S3ObjectStorageAdapter implements ObjectStorage {
   }
 
   createDownloadUrl(key: string) {
-    return getSignedUrl(this.client, new GetObjectCommand({ Bucket: this.cfg.bucket, Key: key }), {
+    return getSignedUrl(this.publicClient, new GetObjectCommand({ Bucket: this.cfg.bucket, Key: key }), {
       expiresIn: this.cfg.downloadUrlTtlSeconds,
     });
   }