Support signing route patterns without route lookup in url_builder

[0xtlt]

Summary

router.makeSignedUrl is deprecated in favor of signedUrlFor, but the new URL builder API does not seem to support the old disableRouteLookup behavior.

This removes a useful workflow: signing an external URL or a route pattern that is not registered in the current app router.

Current Workaround

This still works, but uses a deprecated API:

router.makeSignedUrl(
  '/preview/:resourceHandle',
  { resourceHandle: resource.handle },
  {
    disableRouteLookup: true,
    prefixUrl: 'http://localhost:4000',
    expiresIn: '15 minutes',
    purpose: 'preview',
    qs: {
      path: '/some/path',
      resourceId: resource.id,
    },
  }
)

Problem With The New API

signedUrlFor requires a registered route identifier. Passing a route pattern fails because the implementation performs a router lookup.

signedUrlFor('/preview/:resourceHandle', ...)

In a setup where previews are served by a separate preview server, this is limiting. For example:

• the main app runs on localhost:3000
• a local preview server runs on localhost:4000
• the main app needs to generate a signed preview URL
• the preview URL should include route params and query params
• the preview route is not registered in the main app router
• both services can share the same signing/encryption secret
• the preview server can verify the signed URL before serving the preview

Expected Behavior

It would be helpful to have a non-deprecated way to sign an external URL pattern without registering a mirror route in the current app.

For example:

signedUrlFor.external(
  'http://localhost:4000/preview/:resourceHandle',
  { resourceHandle: resource.handle },
  {
    expiresIn: '15 minutes',
    purpose: 'preview',
    qs: {
      path: '/some/path',
      resourceId: resource.id,
    },
  }
)

Or with a named option:

signedUrlFor(
  'http://localhost:4000/preview/:resourceHandle',
  { resourceHandle: resource.handle },
  {
    lookup: false,
    expiresIn: '15 minutes',
    purpose: 'preview',
    qs: {
      path: '/some/path',
      resourceId: resource.id,
    },
  }
)

Why This Matters

Without this, the available workarounds are not ideal:

1. Keep using the deprecated router.makeSignedUrl.
2. Register mirror routes in the main app only for URL generation.
3. Reimplement a custom signer outside the official Adonis URL signing flow.

The old behavior was useful for external signed URLs, preview systems, multi-app deployments, and any architecture where one service signs access to URLs served by another service.

[thetutlage]

Make sense. Can you please send a PR for the same? https://github.com/adonisjs/http-server

[0xtlt]

Thanks! I opened the implementation PR here:

• Code: feat: support signed URL patterns without route lookup http-server#129
• Docs: docs: document signed URL pattern lookup opt-out v7-docs#67

I ended up keeping the API close to the legacy behavior by supporting:

signedUrlFor('/files/:key', { key: 'invoice.pdf' }, {
  disableRouteLookup: true,
  prefixUrl: 'https://example.com',
})

So there is no new signedUrlFor.external API. Regular signedUrlFor calls still perform route lookup and keep route-name type safety. :)