feat: resource restriction in presign token (#2150)

packages/trpc/server/embedding-router/create-embedding-presign-token.ts

@@ -29,7 +29,7 @@ export const createEmbeddingPresignTokenRoute = procedure
         });
       }
 
-      const { expiresIn } = input;
+      const { expiresIn, scope } = input;
 
       if (IS_BILLING_ENABLED()) {
         const token = await getApiTokenByToken({ token: apiToken });
@@ -54,6 +54,7 @@ export const createEmbeddingPresignTokenRoute = procedure
       const presignToken = await createEmbeddingPresignToken({
         apiToken,
         expiresIn,
+        scope,
       });
 
       return { ...presignToken };

packages/trpc/server/embedding-router/create-embedding-presign-token.types.ts

@@ -21,6 +21,10 @@ export const ZCreateEmbeddingPresignTokenRequestSchema = z.object({
     .optional()
     .default(60)
     .describe('Expiration time in minutes (default: 60, max: 10,080)'),
+  scope: z
+    .string()
+    .optional()
+    .describe('Resource restriction. Example: documentId:1, templateId:2'),
 });
 
 export const ZCreateEmbeddingPresignTokenResponseSchema = z.object({

packages/trpc/server/embedding-router/update-embedding-document.ts

@@ -34,7 +34,10 @@ export const updateEmbeddingDocumentRoute = procedure
         });
       }
 
-      const apiToken = await verifyEmbeddingPresignToken({ token: presignToken });
+      const apiToken = await verifyEmbeddingPresignToken({
+        token: presignToken,
+        scope: `documentId:${input.documentId}`,
+      });
 
       const { documentId, title, externalId, recipients, meta } = input;
 

packages/trpc/server/embedding-router/update-embedding-template.ts

@@ -33,7 +33,10 @@ export const updateEmbeddingTemplateRoute = procedure
         });
       }
 
-      const apiToken = await verifyEmbeddingPresignToken({ token: presignToken });
+      const apiToken = await verifyEmbeddingPresignToken({
+        token: presignToken,
+        scope: `templateId:${input.templateId}`,
+      });
 
       const { templateId, title, externalId, recipients, meta } = input;
 

packages/trpc/server/embedding-router/verify-embedding-presign-token.ts

@@ -17,10 +17,11 @@ export const verifyEmbeddingPresignTokenRoute = procedure
   .output(ZVerifyEmbeddingPresignTokenResponseSchema)
   .mutation(async ({ input }) => {
     try {
-      const { token } = input;
+      const { token, scope } = input;
 
       const apiToken = await verifyEmbeddingPresignToken({
         token,
+        scope,
       }).catch(() => null);
 
       return { success: !!apiToken };

packages/trpc/server/embedding-router/verify-embedding-presign-token.types.ts

@@ -18,6 +18,7 @@ export const ZVerifyEmbeddingPresignTokenRequestSchema = z.object({
     .string()
     .min(1, { message: 'Token is required' })
     .describe('The presign token to verify'),
+  scope: z.string().optional().describe('The scope to verify'),
 });
 
 export const ZVerifyEmbeddingPresignTokenResponseSchema = z.object({