apunkt/dograh
1
0
Fork 0
mirror of https://github.com/dograh-hq/dograh.git synced 2026-07-22 11:51:04 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix: fix signed key url path for custom recordings

Browse source
This commit is contained in:
Abhishek Kumar 2026-07-22 10:10:55 +05:30
parent ded23b1daa
commit c0559fed88
2 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
api/routes/s3_signed_url.py
View file

@ -47,8 +47,10 @@ def _extract_org_id_from_key(key: str) -> Optional[int]:
"""Try to extract an organization ID from a storage key. """Try to extract an organization ID from a storage key.
Matches known org-scoped keys of the form ``{prefix}/{org_id}/...`` where Matches known org-scoped keys of the form ``{prefix}/{org_id}/...`` where
*org_id* is a positive integer. Returns ``None`` when the pattern does not *org_id* is a positive integer. Workflow recordings require an additional
match. path segment so they cannot be confused with legacy workflow-run artifacts
such as ``recordings/{run_id}/user.wav``. Returns ``None`` when the pattern
does not match.
""" """
parts = key.split("/") parts = key.split("/")
if ( if (
@ -57,6 +59,9 @@ def _extract_org_id_from_key(key: str) -> Optional[int]:
and parts[1].isdigit() and parts[1].isdigit()
): ):
return int(parts[1]) return int(parts[1])
recording_match = re.fullmatch(r"recordings/(\d+)/[a-zA-Z0-9_-]+/.+", key)
if recording_match:
return int(recording_match.group(1))
return None return None
@ -178,8 +183,8 @@ async def get_signed_url(
Access Control: Access Control:
* Known org-scoped keys (for example ``campaigns/{org_id}/...`` and * Known org-scoped keys (for example ``campaigns/{org_id}/...`` and
``knowledge_base/{org_id}/...``) are authorized by matching the org_id ``recordings/{org_id}/{recording_id}/...``) are authorized by matching the
against the requesting user's organization. org_id against the requesting user's organization.
* Legacy keys (``recordings/{run_id}.wav``, ``transcripts/{run_id}.txt``) * Legacy keys (``recordings/{run_id}.wav``, ``transcripts/{run_id}.txt``)
are authorized via the workflow run they belong to. are authorized via the workflow run they belong to.
* Superusers can request any key. * Superusers can request any key.

2
api/tests/test_s3_signed_url.py
View file

@ -18,11 +18,13 @@ def test_legacy_recording_keys_do_not_fall_through_to_org_scoped_auth():
assert _extract_org_id_from_key("recordings/1855.wav") is None assert _extract_org_id_from_key("recordings/1855.wav") is None
assert _extract_org_id_from_key("recordings/1855/other.wav") is None assert _extract_org_id_from_key("recordings/1855/other.wav") is None
assert _extract_org_id_from_key("recordings/1855/user.wav/nested") is None
def test_known_org_scoped_keys_extract_org_id(): def test_known_org_scoped_keys_extract_org_id():
assert _extract_org_id_from_key("campaigns/42/source.csv") == 42 assert _extract_org_id_from_key("campaigns/42/source.csv") == 42
assert _extract_org_id_from_key("knowledge_base/42/document/file.pdf") == 42 assert _extract_org_id_from_key("knowledge_base/42/document/file.pdf") == 42
assert _extract_org_id_from_key("recordings/42/greeting-123/greeting.wav") == 42
assert _extract_legacy_workflow_run_id("campaigns/42/source.csv") is None assert _extract_legacy_workflow_run_id("campaigns/42/source.csv") is None