feat(history): consolidate durable costs and asset previews

.env.example

@@ -48,6 +48,14 @@ EMAIL_FROM=Livepeer Waitlist <waitlist@mail.example.com>
 EMAIL_REPLY_TO=help@example.com
 INTERNAL_OUTBOX_SECRET=replace-with-at-least-32-random-bytes
 NEXT_PUBLIC_SITE_URL=http://localhost:3000
+# Required in deployed environments. Generate a high-entropy secret and keep it
+# stable so one-hour first-party media links remain valid across instances.
+ASSET_URL_SIGNING_SECRET=replace-with-at-least-32-random-bytes
+# Exact hosts or wildcard subdomains, comma-separated. Redirects are rechecked.
+ASSET_PROXY_ALLOWED_HOSTS=fal.media,*.fal.media
+# Preview-only, branch-scoped verification records. Never enable in production.
+CONSOLE_PREVIEW_FIXTURES=0
+NEXT_PUBLIC_CONSOLE_PREVIEW_FIXTURES=0
 # Publishable token; analytics safely no-ops when unset.
 NEXT_PUBLIC_POSTHOG_KEY=
 

.gitattributes

@@ -0,0 +1,4 @@
+# Drizzle Kit writes a full schema dump per migration, not a delta.
+# Keep the files for generate/migrate; collapse them in GitHub review.
+drizzle-baseline/meta/*_snapshot.json linguist-generated=true
+drizzle/meta/*_snapshot.json linguist-generated=true

app/(app)/page.tsx

@@ -1,5 +1,4 @@
 import { redirect } from "next/navigation";
-import { identitySyncPath } from "@/lib/identity/sync-return";
 
 export const dynamic = "force-dynamic";
 
@@ -11,5 +10,5 @@ export default async function RootPage({
   const params = await searchParams;
   if (params.ref?.trim())
     redirect(`/waitlist?ref=${encodeURIComponent(params.ref.trim())}`);
-  redirect(identitySyncPath("/home"));
+  redirect("/home");
 }

app/(auth)/login/page.tsx

@@ -2,7 +2,7 @@ import { redirect } from "next/navigation";
 import { getAuthenticatedIdentity } from "@/lib/authentication/session";
 import { authLoginHref, safeReturnTo } from "@/lib/console/auth-login";
 import LoginPage from "@/components/console/LoginPage";
-import { identitySyncPath } from "@/lib/identity/sync-return";
+import { signedInLandingPath } from "@/lib/identity/signed-in-landing";
 
 import type { Metadata } from "next";
 
@@ -26,7 +26,9 @@ export default async function LoginRoute({
 
   const identity = await getAuthenticatedIdentity();
   if (identity)
-    redirect(identitySyncPath(mcpOauth ? MCP_CALLBACK_PATH : returnTo));
+    redirect(
+      await signedInLandingPath(mcpOauth ? MCP_CALLBACK_PATH : returnTo)
+    );
 
   // MCP flow must go directly to Auth0 — no interactive UI step.
   if (mcpOauth) {

app/(auth)/signup/page.tsx

@@ -3,7 +3,7 @@ import { redirect } from "next/navigation";
 import { getAuthenticatedIdentity } from "@/lib/authentication/session";
 import { safeReturnTo } from "@/lib/console/auth-login";
 import LoginPage from "@/components/console/LoginPage";
-import { identitySyncPath } from "@/lib/identity/sync-return";
+import { signedInLandingPath } from "@/lib/identity/signed-in-landing";
 
 export const metadata: Metadata = {
   title: "Sign up — Livepeer Early Access",
@@ -17,6 +17,6 @@ export default async function SignupRoute({
   const params = await searchParams;
   const returnTo = safeReturnTo(params.returnTo);
   const identity = await getAuthenticatedIdentity();
-  if (identity) redirect(identitySyncPath(returnTo));
+  if (identity) redirect(await signedInLandingPath(returnTo));
   return <LoginPage mode="signup" returnTo={returnTo} />;
 }

app/api/admin/runs/[id]/route.ts

@@ -1,6 +1,7 @@
 import { getAdminPrincipal } from "@/lib/admin/auth";
 import { getAdminRun } from "@/lib/runs/store";
 import { runError, RUN_HEADERS } from "@/lib/runs/http";
+import { publicRunDetail } from "@/lib/assets/public";
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 export async function GET(
@@ -17,7 +18,7 @@ export async function GET(
     const { id } = await context.params;
     const result = await getAdminRun(actor, id);
     if (!result) throw new Error("run_not_found");
-    return Response.json(result, { headers: RUN_HEADERS });
+    return Response.json(publicRunDetail(result), { headers: RUN_HEADERS });
   } catch (error) {
     return runError(error);
   }

app/api/assets/[id]/route.ts

@@ -0,0 +1,262 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { lookup } from "node:dns/promises";
+import { fetchPinnedAsset } from "@/lib/assets/transport";
+import { isIP } from "node:net";
+import { assetSignature, ASSET_URL_TTL_SECONDS } from "@/lib/assets/public";
+import { getAssetSource } from "@/lib/mcp/store";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const FORWARDED_HEADERS = [
+  "accept-ranges",
+  "content-length",
+  "content-range",
+  "etag",
+  "last-modified",
+] as const;
+
+const MEDIA_CONTENT_TYPE = /^(?:image|video|audio)\/[a-z0-9.+-]+$/i;
+
+function isPlayableMediaType(type: string): boolean {
+  return MEDIA_CONTENT_TYPE.test(type) && !/^image\/svg\b/i.test(type);
+}
+
+/** Provider media types pass through. HTML/JS/SVG never do; Chrome's player cannot sandbox a video document. */
+function mediaContentType(
+  upstream: string | null,
+  stored: string | null
+): string | null {
+  const offered = (upstream ?? "").split(";")[0]!.trim().toLowerCase();
+  if (isPlayableMediaType(offered)) return offered;
+  if (offered && offered !== "application/octet-stream") return null;
+  const kind = (stored ?? "").trim().toLowerCase();
+  if (isPlayableMediaType(kind)) return kind;
+  if (kind === "video") return "video/mp4";
+  if (kind === "image") return "image/jpeg";
+  if (kind === "audio") return "audio/mpeg";
+  return null;
+}
+
+function notFound(): Response {
+  return new Response("Not found", {
+    status: 404,
+    headers: { "cache-control": "private, no-store" },
+  });
+}
+
+function isPrivateIp(address: string): boolean {
+  let normalized = address.toLowerCase();
+  if (normalized.startsWith("::ffff:")) {
+    normalized = normalized.slice(7);
+    if (!normalized.includes(".")) {
+      const words = normalized.split(":").map((word) => parseInt(word, 16));
+      if (words.length !== 2 || words.some((word) => !Number.isFinite(word)))
+        return true;
+      normalized = [
+        words[0]! >> 8,
+        words[0]! & 255,
+        words[1]! >> 8,
+        words[1]! & 255,
+      ].join(".");
+    }
+  }
+  if (isIP(normalized) === 4) {
+    const [a, b] = normalized.split(".").map(Number);
+    return (
+      a === 0 ||
+      a === 10 ||
+      a === 127 ||
+      (a === 100 && b >= 64 && b <= 127) ||
+      (a === 198 && (b === 18 || b === 19)) ||
+      (a === 192 && b === 0) ||
+      (a === 169 && b === 254) ||
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      a >= 224
+    );
+  }
+  return (
+    isIP(normalized) !== 6 ||
+    !/^[23]/.test(normalized) ||
+    normalized.startsWith("2001:db8:") ||
+    normalized.startsWith("2001:0:") ||
+    normalized.startsWith("2001::") ||
+    normalized.startsWith("2002:") ||
+    normalized === "::" ||
+    normalized === "::1" ||
+    normalized.startsWith("fc") ||
+    normalized.startsWith("fd") ||
+    /^fe[89ab]/.test(normalized)
+  );
+}
+
+function allowedHosts(): string[] {
+  const configured = process.env.ASSET_PROXY_ALLOWED_HOSTS?.trim();
+  if (configured)
+    return configured
+      .split(",")
+      .map((host) => host.trim().toLowerCase())
+      .filter(Boolean);
+  if (process.env.NODE_ENV !== "production")
+    return ["fal.media", "*.fal.media", "media.example.test"];
+  throw new Error("ASSET_PROXY_ALLOWED_HOSTS is required");
+}
+
+function isAllowedHost(hostname: string): boolean {
+  const host = hostname.toLowerCase();
+  return allowedHosts().some((rule) =>
+    rule.startsWith("*.")
+      ? host.endsWith(rule.slice(1)) && host !== rule.slice(2)
+      : host === rule
+  );
+}
+
+async function assertPublicHttps(raw: string) {
+  const url = new URL(raw);
+  if (
+    url.protocol !== "https:" ||
+    url.port ||
+    url.username ||
+    url.password ||
+    !isAllowedHost(url.hostname)
+  )
+    throw new Error("unsafe_asset_origin");
+  const addresses = await lookup(url.hostname, { all: true, verbatim: true });
+  if (
+    !addresses.length ||
+    addresses.some(({ address }) => isPrivateIp(address))
+  )
+    throw new Error("unsafe_asset_origin");
+  return { url, addresses };
+}
+
+function validSignature(
+  id: string,
+  principalId: string,
+  exp: number,
+  supplied: string
+): boolean {
+  const expected = Buffer.from(assetSignature(id, principalId, exp));
+  const actual = Buffer.from(supplied);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+
+async function proxy(request: Request, id: string): Promise<Response> {
+  if (!/^[A-Za-z0-9_-]{1,160}$/.test(id)) return notFound();
+  const requestUrl = new URL(request.url);
+  const expText = requestUrl.searchParams.get("exp") ?? "";
+  const sig = requestUrl.searchParams.get("sig") ?? "";
+  const exp = Number(expText);
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  if (
+    !/^\d{10,}$/.test(expText) ||
+    !Number.isSafeInteger(exp) ||
+    exp <= nowSeconds ||
+    exp > nowSeconds + ASSET_URL_TTL_SECONDS
+  )
+    return notFound();
+
+  const asset = await getAssetSource(id);
+  if (
+    !asset ||
+    asset.unavailableAt ||
+    !validSignature(id, asset.principalId, exp, sig) ||
+    (asset.expiresAt && asset.expiresAt.getTime() <= Date.now())
+  )
+    return notFound();
+
+  // Synthetic fixtures are bundled public images, never arbitrary proxy origins.
+  if (
+    process.env.VERCEL_ENV === "preview" &&
+    process.env.CONSOLE_PREVIEW_FIXTURES === "1"
+  ) {
+    const suffix = createHash("sha256")
+      .update(asset.principalId)
+      .digest("hex")
+      .slice(0, 12);
+    const fixturePaths: Record<string, string> = {
+      [`asset_preview_v2_${suffix}_portrait`]:
+        "/images/console/explore/flux-schnell.webp",
+      [`asset_preview_v2_${suffix}_variation`]:
+        "/images/console/explore/img2img-sdxl.webp",
+    };
+    const location = fixturePaths[id];
+    if (location)
+      return new Response(null, {
+        status: 307,
+        headers: { location, "cache-control": "private, no-store" },
+      });
+  }
+
+  try {
+    let target = await assertPublicHttps(asset.url);
+    let upstream: Response | undefined;
+    for (let redirects = 0; redirects <= 3; redirects += 1) {
+      upstream = await fetchPinnedAsset(target.url, target.addresses, {
+        method: request.method,
+        signal: AbortSignal.any([request.signal, AbortSignal.timeout(30_000)]),
+        headers: {
+          Accept: request.headers.get("accept") ?? "*/*",
+          "Accept-Encoding": "identity",
+          ...(request.headers.get("range")
+            ? { Range: request.headers.get("range")! }
+            : {}),
+        },
+      });
+      if (![301, 302, 303, 307, 308].includes(upstream.status)) break;
+      const location = upstream.headers.get("location");
+      await upstream.body?.cancel();
+      if (!location || redirects === 3) throw new Error("asset_redirect");
+      target = await assertPublicHttps(new URL(location, target.url).href);
+    }
+    if (!upstream) throw new Error("asset_unavailable");
+    const providerSeconds = asset.expiresAt
+      ? Math.max(0, Math.floor((asset.expiresAt.getTime() - Date.now()) / 1000))
+      : Number.POSITIVE_INFINITY;
+    const maxAge = Math.max(
+      0,
+      Math.min(60, exp - Math.floor(Date.now() / 1000), providerSeconds)
+    );
+    const type = mediaContentType(
+      upstream.headers.get("content-type"),
+      asset.mediaType
+    );
+    const headers = new Headers({
+      "cache-control": upstream.ok
+        ? `private, max-age=${maxAge}`
+        : "private, no-store",
+      "x-content-type-options": "nosniff",
+      ...(type
+        ? { "content-type": type }
+        : { "content-security-policy": "default-src 'none'; sandbox" }),
+    });
+    for (const name of FORWARDED_HEADERS) {
+      const value = upstream.headers.get(name);
+      if (value) headers.set(name, value);
+    }
+    return new Response(request.method === "HEAD" ? null : upstream.body, {
+      status: upstream.status,
+      headers,
+    });
+  } catch {
+    return new Response("Asset unavailable", {
+      status: 502,
+      headers: { "cache-control": "private, no-store" },
+    });
+  }
+}
+
+export async function GET(
+  request: Request,
+  context: { params: Promise<{ id: string }> }
+) {
+  return proxy(request, (await context.params).id);
+}
+
+export async function HEAD(
+  request: Request,
+  context: { params: Promise<{ id: string }> }
+) {
+  return proxy(request, (await context.params).id);
+}

app/api/console/runs/[id]/route.ts

@@ -1,5 +1,6 @@
 import { getOwnRun } from "@/lib/runs/store";
 import { requireRunOwner, runError, RUN_HEADERS } from "@/lib/runs/http";
+import { publicRunDetail } from "@/lib/assets/public";
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 export async function GET(
@@ -11,7 +12,7 @@ export async function GET(
     const { id } = await context.params;
     const result = await getOwnRun(owner, id);
     if (!result) throw new Error("run_not_found");
-    return Response.json(result, { headers: RUN_HEADERS });
+    return Response.json(publicRunDetail(result), { headers: RUN_HEADERS });
   } catch (error) {
     return runError(error);
   }

app/api/console/runs/[id]/schema/route.ts

@@ -0,0 +1,27 @@
+import { getOwnRun } from "@/lib/runs/store";
+import { requireRunOwner, runError, RUN_HEADERS } from "@/lib/runs/http";
+import {
+  loadFalInputSchema,
+  resolveFalCatalogEntry,
+} from "@/lib/mcp/fal-input-schema";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ id: string }> }
+) {
+  try {
+    const owner = await requireRunOwner();
+    const result = await getOwnRun(owner, (await context.params).id);
+    if (!result) throw new Error("run_not_found");
+    const catalog = resolveFalCatalogEntry(result);
+    return Response.json(
+      { inputSchema: catalog ? await loadFalInputSchema(catalog) : null },
+      { headers: RUN_HEADERS }
+    );
+  } catch (error) {
+    return runError(error);
+  }
+}