From 5b501fa8da8fcd081d48f3cd2ad7eba9b4a2f302 Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Wed, 15 Apr 2026 19:02:01 +0200
Subject: [PATCH] No attachment URLs

---
 src/util/entities/Attachment.ts               | 40 ++++++++++++-------
 .../1776270346000-DontStoreAttachmentUrls.ts  | 21 ++++++++++
 2 files changed, 47 insertions(+), 14 deletions(-)
 create mode 100644 src/util/migration/postgres/1776270346000-DontStoreAttachmentUrls.ts

diff --git a/src/util/entities/Attachment.ts b/src/util/entities/Attachment.ts
index 2ab7358d6..ab001cbe7 100644
--- a/src/util/entities/Attachment.ts
+++ b/src/util/entities/Attachment.ts
@@ -17,7 +17,7 @@
 */
 
 import { BeforeRemove, Column, Entity, JoinColumn, ManyToOne, RelationId } from "typeorm";
-import { deleteFile } from "../util";
+import { Config, deleteFile } from "../util";
 import { BaseClass } from "./BaseClass";
 import { getUrlSignature, NewUrlUserSignatureData, NewUrlSignatureData } from "../Signing";
 
@@ -31,12 +31,6 @@ export class Attachment extends BaseClass {
     @Column()
     size: number; // size of file in bytes
 
-    @Column()
-    url: string; // source url of file
-
-    @Column()
-    proxy_url: string; // a proxied url of file
-
     @Column({ nullable: true })
     height?: number; // height of file (if image)
 
@@ -50,28 +44,46 @@ export class Attachment extends BaseClass {
     @RelationId((attachment: Attachment) => attachment.message)
     message_id: string;
 
+    @Column({ nullable: true })
+    @RelationId((attachment: Attachment) => attachment.message)
+    channel_id: string;
+
     @JoinColumn({ name: "message_id" })
     @ManyToOne(() => require("./Message").Message, (message: import("./Message").Message) => message.attachments, {
         onDelete: "CASCADE",
     })
     message: import("./Message").Message;
 
+    @JoinColumn({ name: "channel_id" })
+    @ManyToOne(() => require("./Channel").Channel, (message: import("./Message").Message) => message.attachments, {
+        onDelete: "CASCADE",
+    })
+    channel: import("./Channel").Channel;
+
     @BeforeRemove()
     onDelete() {
         return deleteFile(new URL(this.url).pathname);
     }
 
-    signUrls(data: NewUrlUserSignatureData): Attachment {
+    toJSON() {
         return {
             ...this,
-            url: getUrlSignature(new NewUrlSignatureData({ ...data, url: this.url }))
-                .applyToUrl(this.url)
+            url: `${Config.get().cdn.endpointPublic}/attachments/${this.channel_id}/${this.message_id}/${this.filename}`,
+            proxy_url: `${Config.get().cdn.endpointPublic}/attachments/${this.channel_id}/${this.message_id}/${this.filename}`,
+        };
+    }
+    signUrls(data: NewUrlUserSignatureData): Attachment {
+        const att = this.toJSON();
+        return {
+            ...att,
+            url: getUrlSignature(new NewUrlSignatureData({ ...data, url: att.url }))
+                .applyToUrl(att.url)
                 .toString(),
-            proxy_url: this.proxy_url
-                ? getUrlSignature(new NewUrlSignatureData({ ...data, url: this.proxy_url }))
-                      .applyToUrl(this.proxy_url)
+            proxy_url: att.proxy_url
+                ? getUrlSignature(new NewUrlSignatureData({ ...data, url: att.proxy_url }))
+                      .applyToUrl(att.proxy_url)
                       .toString()
-                : this.proxy_url,
+                : att.proxy_url,
         };
     }
 }
diff --git a/src/util/migration/postgres/1776270346000-DontStoreAttachmentUrls.ts b/src/util/migration/postgres/1776270346000-DontStoreAttachmentUrls.ts
new file mode 100644
index 000000000..674a3e54d
--- /dev/null
+++ b/src/util/migration/postgres/1776270346000-DontStoreAttachmentUrls.ts
@@ -0,0 +1,21 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class DontStoreAttachmentUrls1776270346000 implements MigrationInterface {
+    name = "DontStoreAttachmentUrls1776270346000";
+
+    public async up(queryRunner: QueryRunner): Promise<void> {
+        await this.convertPks(queryRunner, "jsonb");
+    }
+
+    public async down(queryRunner: QueryRunner): Promise<void> {
+        await this.convertPks(queryRunner, "varchar");
+    }
+
+    private async convertPks(queryRunner: QueryRunner, to: string) {
+        await queryRunner.query(`ALTER TABLE attachments ADD channel_id int8 NULL;`);
+        await queryRunner.query(`ALTER TABLE attachments ADD CONSTRAINT attachments_channels_fk FOREIGN KEY (channel_id) REFERENCES public.channels(id) ON DELETE CASCADE;`);
+        await queryRunner.query(`UPDATE attachments att SET channel_id = (SELECT channel_id FROM messages WHERE id = att.message_id) WHERE message_id IS NOT NULL;`);
+        await queryRunner.query(`ALTER TABLE attachments DROP COLUMN url;`);
+        await queryRunner.query(`ALTER TABLE attachments DROP COLUMN proxy_url;`);
+    }
+}