feat: signed attachments

[mertmit]

Change Summary

Adds signed/temporary attachment support for both local and S3.

So we will return signedPath/signedUrl with api response which will be available only set period of time (Defaults to 2 hours can be changed via NC_ATTACHMENT_EXPIRE_SECONDS).
(Note: expiration time is rounded to next xy:z0 so within period of 10 mins we return same link)

This change is backwards compatible (supports old links) unless user specifies NC_SECURE_ATTACHMENTS=true in his environment.

Change type

• feat: (new feature for the user, not a new feature for build script)

[wingkwong]

1. I'm still trying to understand the flow. can you briefly describe it step by step? from my understanding, it is like when we read a file (says local), it checks the attachment object and generate some temp urls (adding to cache), and then return a url like https://xxxxxx/dltemp/xxx/xxxx. When we browse that link, it fetches from cache and return the original url / official presigned one (?)
2. Does tempUrl mean presigned url? If so, I'd prefer the latter name as the name indicates it has time limit in general while temp doesn't.
3. Can you show one tempUrl as an example
4. please put NC_SECURE_ATTACHMENTS and NC_ATTACHMENT_EXPIRE_SECONDS in noco-doc.

[mertmit]

1. Upload part is not changed other than naming, we used to get path from query params now we decide instead.

I am assuming we are running instance with NC_SECURE_ATTACHMENTS set to true.
Read/List apis over attachment columns will return signedPath/signedUrl beside path/url which will be available for set period of time and url's will be not accessible anymore.

The steps you are explaining is pretty much correct.

• We bind path prefixed by set expire time to a signed link (temporary link) within cache
• When user tries to fetch that link we get path using that link.
  As api calls trigger signing of the links only valid users can generate those links.

2. True, I will rename them accordingly
3. http://localhost:8080/dltemp/1696437000000/2023/10/04/cce6108e34fe68b83a0b056e0bae69b222037615/CT0kwYv3MQtocuBVwv.png
   In order to avoid brute force attacks I will add a random token there as well which is missing currently
4. Sure, thank you for pointing out

Let me know if you still have any doubts/recommendations

[github-actions]

Uffizzi Preview deployment-37613 was deleted.

[wingkwong]

add those env vars to doc then all good.