cabloy 5.1.102 → 5.1.103

package/vona/src/suite-vendor/a-file/modules/file-native/src/bean/fileProvider.native.ts

@@ -1,8 +1,8 @@
 import type {
   EntityFile,
   IDecoratorFileProviderOptions,
-  IFileDeliveryOptions,
   IFileDownloadResult,
+  IFileProviderDeliveryOptions,
   IFileProviderClientOptions,
   IFileProviderClientRecord,
   IFileProviderExecute,
@@ -82,7 +82,7 @@ export class FileProviderNative
     file: EntityFile,
     clientOptions: IFileProviderNativeClientOptions,
     _options: IFileProviderOptionsNative,
-    deliveryOptions?: IFileDeliveryOptions,
+    deliveryOptions?: IFileProviderDeliveryOptions,
   ) {
     return await this.scope.service.fileNative.getDownloadUrl(
       file,
@@ -100,9 +100,9 @@ export class FileProviderNative
     file: EntityFile,
     clientOptions: IFileProviderNativeClientOptions,
     options: IFileProviderOptionsNative,
-    deliveryOptions?: IFileDeliveryOptions,
+    deliveryOptions?: IFileProviderDeliveryOptions,
   ): Promise<IFileDownloadResult> {
-    if ((deliveryOptions?.responseMode ?? 'auto') !== 'url' && !deliveryOptions?.signed) {
+    if ((deliveryOptions?.responseMode ?? 'auto') !== 'url') {
       const buffer = file.storagePath ? await fse.readFile(file.storagePath) : undefined;
       if (buffer) {
         return {
@@ -119,7 +119,7 @@ export class FileProviderNative
       url: await this.getDownloadUrl(file, clientOptions, options, deliveryOptions),
       filename: file.filename,
       contentType: file.contentType,
-      signed: !!deliveryOptions?.signed,
+      signed: !!deliveryOptions?.protected,
     };
   }
 }

package/vona/src/suite-vendor/a-file/modules/file-native/src/service/fileNative.ts

@@ -1,6 +1,6 @@
 import type {
   EntityFile,
-  IFileDeliveryOptions,
+  IFileProviderDeliveryOptions,
   IFileProviderResource,
   IFileUploadInput,
 } from 'vona-module-a-file';
@@ -54,18 +54,17 @@ export class ServiceFileNative extends BeanBase {
   async getDownloadUrl(
     file: IFileNativeStoredFile,
     options: IFileProviderNativeClientOptions,
-    _deliveryOptions?: IFileDeliveryOptions,
+    _deliveryOptions?: IFileProviderDeliveryOptions,
   ) {
     if (!file.storagePath) {
       throw new Error(`File storage path missing: ${file.resourceId}`);
     }
     if (!(file.public ?? options.public)) {
-      const routePath = this.scope.util.combineApiPath(
-        `file/download/${file.id ?? file.resourceId}`,
-        false,
-        true,
-      );
-      return this.app.util.getAbsoluteUrlByApiPath(routePath);
+      const routePath = this.scope.util.combineApiPath('file/download', false, true);
+      const routeUrl = this.app.util.getAbsoluteUrlByApiPath(routePath);
+      const url = new URL(routeUrl);
+      url.searchParams.set('fileId', String(file.id ?? file.resourceId));
+      return url.toString();
     }
     return await this._buildUrl(file.storagePath, options.deliveryBaseUrl);
   }

package/vona/src/suite-vendor/a-file/package.json

@@ -1,14 +1,14 @@
 {
   "name": "vona-suite-a-file",
-  "version": "5.0.4",
+  "version": "5.0.5",
   "description": "",
   "author": "",
   "files": [],
   "type": "module",
   "dependencies": {
-    "vona-module-a-file": "^5.0.4",
-    "vona-module-file-cloudflare": "^5.0.3",
-    "vona-module-file-native": "^5.0.3"
+    "vona-module-a-file": "^5.0.5",
+    "vona-module-file-cloudflare": "^5.0.4",
+    "vona-module-file-native": "^5.0.4"
   },
   "title": "a-file"
 }

package/vona/src/suite-vendor/a-image/modules/a-image/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-image",
-  "version": "5.0.5",
+  "version": "5.0.6",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-image/modules/a-image/src/.metadata/index.ts

@@ -220,7 +220,6 @@ export * from '../bean/meta.index.ts';
 export * from '../bean/meta.redlock.ts';
 export * from '../bean/meta.version.ts';
 import type { IMetaOptionsIndex } from 'vona-module-a-index';
-
 import 'vona-module-a-meta';
 declare module 'vona-module-a-meta' {
 
@@ -268,8 +267,6 @@ declare module 'vona-module-a-image' {
           }
 }
 /** meta: end */
-/** meta index: begin */
-/** meta index: end */
 /** meta redlock: begin */
 import type { MetaRedlock } from '../bean/meta.redlock.ts';
 /** meta redlock: end */
@@ -346,9 +343,9 @@ export * from '../dto/imageDirectUploadFinalizeResponse.ts';
 export * from '../dto/imageDirectUploadRequest.ts';
 export * from '../dto/imageDirectUploadResponse.ts';
 export * from '../dto/imageTransformOptions.tsx';
+export * from '../dto/imageUploadPolicyRequest.ts';
+export * from '../dto/imageUploadPolicyResponse.ts';
 export * from '../dto/imageUploadResponse.ts';
-export * from '../dto/imageUploadTokenRequest.ts';
-export * from '../dto/imageUploadTokenResponse.ts';
 export * from '../dto/imageUploadUrlRequest.ts';
 export * from '../dto/imageView.ts';
 import type { IDtoOptionsImageDeliveryRequest } from '../dto/imageDeliveryRequest.ts';
@@ -357,9 +354,9 @@ import type { IDtoOptionsImageDirectUploadFinalizeResponse } from '../dto/imageD
 import type { IDtoOptionsImageDirectUploadRequest } from '../dto/imageDirectUploadRequest.ts';
 import type { IDtoOptionsImageDirectUploadResponse } from '../dto/imageDirectUploadResponse.ts';
 import type { IDtoOptionsImageTransformOptions } from '../dto/imageTransformOptions.tsx';
+import type { IDtoOptionsImageUploadPolicyRequest } from '../dto/imageUploadPolicyRequest.ts';
+import type { IDtoOptionsImageUploadPolicyResponse } from '../dto/imageUploadPolicyResponse.ts';
 import type { IDtoOptionsImageUploadResponse } from '../dto/imageUploadResponse.ts';
-import type { IDtoOptionsImageUploadTokenRequest } from '../dto/imageUploadTokenRequest.ts';
-import type { IDtoOptionsImageUploadTokenResponse } from '../dto/imageUploadTokenResponse.ts';
 import type { IDtoOptionsImageUploadUrlRequest } from '../dto/imageUploadUrlRequest.ts';
 import type { IDtoOptionsImageView } from '../dto/imageView.ts';
 import 'vona-module-a-web';
@@ -372,9 +369,9 @@ declare module 'vona-module-a-web' {
 'a-image:imageDirectUploadRequest': IDtoOptionsImageDirectUploadRequest;
 'a-image:imageDirectUploadResponse': IDtoOptionsImageDirectUploadResponse;
 'a-image:imageTransformOptions': IDtoOptionsImageTransformOptions;
+'a-image:imageUploadPolicyRequest': IDtoOptionsImageUploadPolicyRequest;
+'a-image:imageUploadPolicyResponse': IDtoOptionsImageUploadPolicyResponse;
 'a-image:imageUploadResponse': IDtoOptionsImageUploadResponse;
-'a-image:imageUploadTokenRequest': IDtoOptionsImageUploadTokenRequest;
-'a-image:imageUploadTokenResponse': IDtoOptionsImageUploadTokenResponse;
 'a-image:imageUploadUrlRequest': IDtoOptionsImageUploadUrlRequest;
 'a-image:imageView': IDtoOptionsImageView;
     }
@@ -392,9 +389,9 @@ import type { DtoImageDirectUploadFinalizeResponse } from '../dto/imageDirectUpl
 import type { DtoImageDirectUploadRequest } from '../dto/imageDirectUploadRequest.ts';
 import type { DtoImageDirectUploadResponse } from '../dto/imageDirectUploadResponse.ts';
 import type { DtoImageTransformOptions } from '../dto/imageTransformOptions.tsx';
+import type { DtoImageUploadPolicyRequest } from '../dto/imageUploadPolicyRequest.ts';
+import type { DtoImageUploadPolicyResponse } from '../dto/imageUploadPolicyResponse.ts';
 import type { DtoImageUploadResponse } from '../dto/imageUploadResponse.ts';
-import type { DtoImageUploadTokenRequest } from '../dto/imageUploadTokenRequest.ts';
-import type { DtoImageUploadTokenResponse } from '../dto/imageUploadTokenResponse.ts';
 import type { DtoImageUploadUrlRequest } from '../dto/imageUploadUrlRequest.ts';
 import type { DtoImageView } from '../dto/imageView.ts';
 declare module 'vona-module-a-image' {
@@ -423,16 +420,16 @@ declare module 'vona-module-a-image' {
       fields?: TypeEntityOptionsFields<DtoImageTransformOptions, IDtoOptionsImageTransformOptions[TypeSymbolKeyFieldsMore]>;
     }
 
-    export interface IDtoOptionsImageUploadResponse {
-      fields?: TypeEntityOptionsFields<DtoImageUploadResponse, IDtoOptionsImageUploadResponse[TypeSymbolKeyFieldsMore]>;
+    export interface IDtoOptionsImageUploadPolicyRequest {
+      fields?: TypeEntityOptionsFields<DtoImageUploadPolicyRequest, IDtoOptionsImageUploadPolicyRequest[TypeSymbolKeyFieldsMore]>;
     }
 
-    export interface IDtoOptionsImageUploadTokenRequest {
-      fields?: TypeEntityOptionsFields<DtoImageUploadTokenRequest, IDtoOptionsImageUploadTokenRequest[TypeSymbolKeyFieldsMore]>;
+    export interface IDtoOptionsImageUploadPolicyResponse {
+      fields?: TypeEntityOptionsFields<DtoImageUploadPolicyResponse, IDtoOptionsImageUploadPolicyResponse[TypeSymbolKeyFieldsMore]>;
     }
 
-    export interface IDtoOptionsImageUploadTokenResponse {
-      fields?: TypeEntityOptionsFields<DtoImageUploadTokenResponse, IDtoOptionsImageUploadTokenResponse[TypeSymbolKeyFieldsMore]>;
+    export interface IDtoOptionsImageUploadResponse {
+      fields?: TypeEntityOptionsFields<DtoImageUploadResponse, IDtoOptionsImageUploadResponse[TypeSymbolKeyFieldsMore]>;
     }
 
     export interface IDtoOptionsImageUploadUrlRequest {
@@ -481,14 +478,14 @@ declare module 'vona-module-a-image' {
 }
 declare module 'vona-module-a-web' {
   export interface IApiPathPostRecord{
-        '/image/upload-token': undefined;
+        '/image/upload-policy': undefined;
 '/image/upload': undefined;
 '/image/direct-upload': undefined;
 '/image/direct-upload/finalize': undefined;
 '/image/upload-url': undefined;
     }
 export interface IApiPathGetRecord{
-        '/image/delivery/:imageId': undefined;
+        '/image/delivery': undefined;
     }
 
 }

package/vona/src/suite-vendor/a-image/modules/a-image/src/bean/bean.image.ts

@@ -5,10 +5,12 @@ import { Bean } from 'vona-module-a-bean';
 
 import type { EntityImage } from '../entity/image.ts';
 import type {
+  IImageActionResponse,
   IImageDeliveryOptions,
   IImageDirectUploadInput,
-  IImageDirectUploadResult,
+  IImageDirectUploadResponse,
   IImageFinalizeDirectUploadResult,
+  IImageProviderDeliveryOptions,
   IImageProviderDirectUploadResource,
   IImageProviderResource,
   IImageResource,
@@ -35,11 +37,15 @@ interface IImageProviderContext<N extends keyof IImageProviderRecord = keyof IIm
   onionOptions: TypeImageProviderOptionsByName<N>;
 }
 
+interface IImageDeliveryOptionsResolved extends IImageProviderDeliveryOptions {
+  audience: boolean;
+}
+
 interface IImageDeliveryContext {
   image: EntityImage | IImageResource;
   providerImage: EntityImage;
   requestNormalized: IImageVariantRequest;
-  deliveryOptionsResolved: IImageDeliveryOptions;
+  deliveryOptionsResolved: IImageDeliveryOptionsResolved;
   providerContext: IImageProviderContext;
 }
 
@@ -105,10 +111,11 @@ export class BeanImage extends BeanBase {
     providerName: N,
     input: IImageDirectUploadInput,
     options?: IImageUploadOptions<TypeImageProviderClientOptionsByName<N>>,
-  ): Promise<IImageDirectUploadResult> {
+  ): Promise<IImageDirectUploadResponse> {
     const providerContext = await this._getProviderContextByInput(providerName, options);
     if (!providerContext.beanImageProvider.createDirectUpload) {
-      throw new Error(
+      return this.app.throw(
+        403,
         `Image provider does not support createDirectUpload: ${String(providerName)}`,
       );
     }
@@ -132,10 +139,11 @@ export class BeanImage extends BeanBase {
       },
     );
     return {
-      ...this._combineImageResource(image, imageProviderResource),
+      id: image.id,
       uploadUrl: imageProviderResource.uploadUrl,
-      draft: imageProviderResource.draft ?? true,
-    };
+      filename: imageProviderResource.filename,
+      public: imageProviderResource.public ?? image.public,
+    } satisfies IImageDirectUploadResponse;
   }
 
   async finalizeDirectUpload(imageId: TableIdentity): Promise<IImageFinalizeDirectUploadResult> {
@@ -154,7 +162,8 @@ export class BeanImage extends BeanBase {
       }
       const providerContext = await this._getProviderContext(image);
       if (!providerContext.beanImageProvider.finalizeDirectUpload) {
-        throw new Error(
+        return this.app.throw(
+          403,
           `Image provider does not support finalizeDirectUpload: ${String(image.providerName)}`,
         );
       }
@@ -240,28 +249,23 @@ export class BeanImage extends BeanBase {
         signed: true,
       };
     }
-    if (context.providerContext.beanImageProvider.download) {
-      return await context.providerContext.beanImageProvider.download(
-        context.providerImage,
-        context.requestNormalized,
-        context.providerContext.clientOptions,
-        context.providerContext.onionOptions,
-        context.deliveryOptionsResolved,
-      );
-    }
-    return {
-      kind: 'url' as const,
-      url: await context.providerContext.beanImageProvider.getVariantUrl(
-        context.providerImage,
-        context.requestNormalized,
-        context.providerContext.clientOptions,
-        context.providerContext.onionOptions,
-        context.deliveryOptionsResolved,
-      ),
-      filename: context.image.filename,
-      contentType: context.image.contentType,
-      signed: !!context.deliveryOptionsResolved.signed,
-    };
+    return await this._downloadFromProvider(context);
+  }
+
+  async downloadForDelivery(
+    imageId: TableIdentity,
+    request?: TypeImageVariantInput,
+    options?: { protected?: boolean },
+  ) {
+    const context = await this._getDeliveryContext(imageId, request, { responseMode: 'buffer' });
+    return await this._downloadFromProvider({
+      ...context,
+      deliveryOptionsResolved: {
+        protected: options?.protected ?? !context.image.public,
+        audience: false,
+        responseMode: 'buffer',
+      },
+    });
   }
 
   async resolveView(
@@ -369,13 +373,19 @@ export class BeanImage extends BeanBase {
     image: IImageResource,
     request?: TypeImageVariantInput,
     deliveryOptions?: IImageDeliveryOptions,
-  ) {
+  ): Promise<IImageActionResponse> {
     const context = await this._createDeliveryContext(image, request, deliveryOptions);
     return {
-      ...image,
+      id: image.id,
+      filename: image.filename,
+      contentType: image.contentType,
+      size: image.size,
+      width: image.width,
+      height: image.height,
+      public: image.public,
       url: await this._getVariantUrlByContext(context),
-      signed: !!context.deliveryOptionsResolved.signed,
-    };
+      signed: context.deliveryOptionsResolved.protected,
+    } satisfies IImageActionResponse;
   }
 
   private _resolveDirectUploadDraftExpiresAt(expiry?: IImageDirectUploadInput['expiry']) {
@@ -427,6 +437,31 @@ export class BeanImage extends BeanBase {
     };
   }
 
+  private async _downloadFromProvider(context: IImageDeliveryContext) {
+    if (context.providerContext.beanImageProvider.download) {
+      return await context.providerContext.beanImageProvider.download(
+        context.providerImage,
+        context.requestNormalized,
+        context.providerContext.clientOptions,
+        context.providerContext.onionOptions,
+        context.deliveryOptionsResolved,
+      );
+    }
+    return {
+      kind: 'url' as const,
+      url: await context.providerContext.beanImageProvider.getVariantUrl(
+        context.providerImage,
+        context.requestNormalized,
+        context.providerContext.clientOptions,
+        context.providerContext.onionOptions,
+        context.deliveryOptionsResolved,
+      ),
+      filename: context.image.filename,
+      contentType: context.image.contentType,
+      signed: context.deliveryOptionsResolved.protected,
+    };
+  }
+
   private async _getVariantUrlByContext(context: IImageDeliveryContext) {
     if (this._shouldUseProxySignedDelivery(context)) {
       return await this._createSignedDeliveryUrl(context);
@@ -447,22 +482,17 @@ export class BeanImage extends BeanBase {
       filename: image.filename,
       width: image.width,
       height: image.height,
-      provider: image.provider,
-      clientName: image.clientName,
-      imageScene: image.imageScene,
-      status: image.status,
-      draftExpiresAt: image.draftExpiresAt,
-      finalizedAt: image.finalizedAt,
-      uploadedAt: image.uploadedAt,
-      variants: image.variants,
-      signed: !!context.deliveryOptionsResolved.signed,
+      public: image.public,
+      signed: context.deliveryOptionsResolved.protected,
     } satisfies IImageView;
   }
 
   private _shouldUseProxySignedDelivery(context: IImageDeliveryContext) {
+    const { deliveryOptionsResolved, providerContext } = context;
     return (
-      context.deliveryOptionsResolved.signed &&
-      (context.providerContext.clientOptions.signedDeliveryKind ?? 'proxy') === 'proxy'
+      deliveryOptionsResolved.protected &&
+      (deliveryOptionsResolved.audience ||
+        (providerContext.clientOptions.signedDeliveryKind ?? 'proxy') === 'proxy')
     );
   }
 
@@ -486,50 +516,45 @@ export class BeanImage extends BeanBase {
   }
 
   private _mergeDeliveryOptions(
-    image: Pick<IImageResource, 'requireSignedURLs'>,
+    image: Pick<IImageResource, 'public'>,
     request: IImageVariantRequest,
     deliveryOptions?: IImageDeliveryOptions,
-  ): IImageDeliveryOptions {
-    const signed = deliveryOptions?.signed ?? request.signed ?? image.requireSignedURLs ?? false;
-    const expiresIn = deliveryOptions?.expiresIn ?? request.expiresIn;
-    const expiresAt = deliveryOptions?.expiresAt ?? request.expiresAt;
-    const responseMode = deliveryOptions?.responseMode ?? request.responseMode;
+  ): IImageDeliveryOptionsResolved {
+    const audience = deliveryOptions?.audience ?? request.audience ?? false;
     return {
-      signed,
-      expiresIn,
-      expiresAt,
-      responseMode,
+      protected: audience || !image.public,
+      expiresIn:
+        deliveryOptions?.expiresIn ??
+        request.expiresIn ??
+        (audience ? this.scope.config.image.delivery.audienceExpiresIn : undefined),
+      audience,
+      responseMode: deliveryOptions?.responseMode ?? request.responseMode,
     };
   }
 
   private async _createSignedDeliveryUrl(context: IImageDeliveryContext) {
-    const targetUrl = await context.providerContext.beanImageProvider.getVariantUrl(
-      context.providerImage,
-      context.requestNormalized,
-      context.providerContext.clientOptions,
-      context.providerContext.onionOptions,
-      {
-        signed: false,
-        responseMode: 'url',
-      },
-    );
-    const routePath = this.scope.util.combineApiPath(
-      `image/delivery/${context.image.id}`,
-      false,
-      true,
-    );
+    const routePath = this.scope.util.combineApiPath('image/delivery', false, true);
+    const audienceUserId = this._resolveAudienceUserId(context.deliveryOptionsResolved);
     const tokenPayload = await this.bean.imageUploadPolicy.createDeliveryToken({
       imageId: context.image.id,
       request: context.requestNormalized,
-      targetUrl,
       expiresIn: context.deliveryOptionsResolved.expiresIn,
+      audienceUserId,
     });
     const routeUrl = this.app.util.getAbsoluteUrlByApiPath(routePath);
     const url = new URL(routeUrl);
+    url.searchParams.set('imageId', String(context.image.id));
     url.searchParams.set('token', tokenPayload.token);
     return url.toString();
   }
 
+  private _resolveAudienceUserId(deliveryOptions: IImageDeliveryOptionsResolved) {
+    if (!deliveryOptions.audience) return;
+    const user = this.bean.passport.currentUser;
+    if (!user || user.anonymous) return this.app.throw(401);
+    return user.id;
+  }
+
   private _getProviderImage(image: EntityImage | IImageResource): EntityImage {
     if ('providerName' in image) return image;
     return {
@@ -542,7 +567,7 @@ export class BeanImage extends BeanBase {
       size: image.size,
       width: image.width,
       height: image.height,
-      requireSignedURLs: image.requireSignedURLs,
+      public: image.public,
       variants: image.variants,
       meta: image.meta,
       storagePath: image.storagePath,
@@ -572,7 +597,7 @@ export class BeanImage extends BeanBase {
       size: imageProviderResource.size,
       width: imageProviderResource.width,
       height: imageProviderResource.height,
-      requireSignedURLs: imageProviderResource.requireSignedURLs,
+      public: imageProviderResource.public,
       variants: imageProviderResource.variants,
       meta: imageProviderResource.meta,
       storagePath: imageProviderResource.storagePath,
@@ -615,7 +640,7 @@ export class BeanImage extends BeanBase {
       size: imageProviderResource?.size ?? image.size,
       width: imageProviderResource?.width ?? image.width,
       height: imageProviderResource?.height ?? image.height,
-      requireSignedURLs: imageProviderResource?.requireSignedURLs ?? image.requireSignedURLs,
+      public: imageProviderResource?.public ?? image.public,
       variants: imageProviderResource?.variants ?? image.variants,
       meta: imageProviderResource?.meta ?? image.meta,
       storagePath: imageProviderResource?.storagePath ?? image.storagePath,

package/vona/src/suite-vendor/a-image/modules/a-image/src/bean/bean.imageUploadPolicy.ts

@@ -4,11 +4,10 @@ import { Bean } from 'vona-module-a-bean';
 
 import type {
   IImageDeliveryTokenPayload,
-  IImageDirectUploadTokenPayload,
   IImageUploadContextResolved,
   IImageUploadPolicyResolved,
-  IImageUploadTokenPayload,
 } from '../types/image.ts';
+import type { IImageProviderExecute } from '../types/imageProvider.ts';
 import type {
   IDecoratorImageSceneOptions,
   IDecoratorImageSceneOptionsProvider,
@@ -19,55 +18,19 @@ import { getImageExtension, matchesImageMimeType } from '../lib/imageUploadValid
 
 @Bean()
 export class BeanImageUploadPolicy extends BeanBase {
-  async createUploadToken(data: {
-    imageScene: keyof IImageSceneRecord;
-    size: number;
-    mimeType: string;
-    expiresIn?: number;
-  }) {
-    const payload = await this.resolveUploadPolicy(data);
-    const path = this.scope.util.combineApiPath('image/upload', false, true);
-    const token = await this.bean.jwt.createTempAuthToken(
-      {
-        kind: 'imageUpload',
-        ...payload,
-      } as IImageUploadTokenPayload,
-      {
-        path,
-        expiresIn: data.expiresIn,
-      },
-    );
-    return { token, expiresIn: data.expiresIn };
-  }
-
-  async createDirectUploadToken(data: { resourceId: string; path: string; expiresIn?: number }) {
-    const path = data.path;
-    const token = await this.bean.jwt.createTempAuthToken(
-      {
-        kind: 'imageDirectUpload',
-        resourceId: data.resourceId,
-      } as IImageDirectUploadTokenPayload,
-      {
-        path,
-        expiresIn: data.expiresIn,
-      },
-    );
-    return { token, expiresIn: data.expiresIn };
-  }
-
   async createDeliveryToken(data: {
     imageId: number | string;
     request: IImageDeliveryTokenPayload['request'];
-    targetUrl: string;
     expiresIn?: number;
+    audienceUserId?: IImageDeliveryTokenPayload['audienceUserId'];
   }) {
-    const path = this.scope.util.combineApiPath(`image/delivery/${data.imageId}`, false, true);
+    const path = this.scope.util.combineApiPath('image/delivery', false, true);
     const token = await this.bean.jwt.createTempAuthToken(
       {
         kind: 'imageDelivery',
         imageId: data.imageId,
         request: data.request,
-        targetUrl: data.targetUrl,
+        audienceUserId: data.audienceUserId,
       } as IImageDeliveryTokenPayload,
       {
         path,
@@ -77,26 +40,6 @@ export class BeanImageUploadPolicy extends BeanBase {
     return { token, expiresIn: data.expiresIn };
   }
 
-  async verifyUploadToken(token: string | undefined, routePathRaw: string) {
-    const payload = (await this.bean.jwt.get('access').verify(token, {
-      path: routePathRaw,
-    })) as IImageUploadTokenPayload | undefined;
-    if (!payload || payload.kind !== 'imageUpload') {
-      return this.app.throw(401);
-    }
-    return payload;
-  }
-
-  async verifyDirectUploadToken(token: string | undefined, routePathRaw: string) {
-    const payload = (await this.bean.jwt.get('access').verify(token, {
-      path: routePathRaw,
-    })) as IImageDirectUploadTokenPayload | undefined;
-    if (!payload || payload.kind !== 'imageDirectUpload') {
-      return this.app.throw(401);
-    }
-    return payload;
-  }
-
   async verifyDeliveryToken(token: string | undefined, routePathRaw: string) {
     const payload = (await this.bean.jwt.get('access').verify(token, {
       path: routePathRaw,
@@ -113,10 +56,15 @@ export class BeanImageUploadPolicy extends BeanBase {
     const imageScene = data.imageScene;
     const sceneOptions = this._getSceneOptions(imageScene);
     const { providerName, clientName } = await this._resolveProvider(sceneOptions);
+    const { clientOptions } = await this.bean.imageProvider.getClientOptions({
+      providerName,
+      clientName,
+    });
     return {
       imageScene,
       providerName,
       clientName,
+      public: this._resolvePublic(clientOptions, sceneOptions),
       meta: await this._resolveSceneMeta(sceneOptions),
     };
   }
@@ -126,13 +74,22 @@ export class BeanImageUploadPolicy extends BeanBase {
     const imageScene = data.imageScene;
     const sceneOptions = this._getSceneOptions(imageScene);
     const { providerName, clientName } = await this._resolveProvider(sceneOptions);
-    const { entityImageProvider, disabled } = await this.bean.imageProvider.getClientOptions({
+    const {
+      entityImageProvider,
+      disabled,
+      beanFullName,
+      clientOptions: _clientOptions,
+    } = await this.bean.imageProvider.getClientOptions({
       providerName,
       clientName,
     });
     if (!entityImageProvider || disabled) {
       return this.app.throw(403, `Image provider unavailable: ${providerName}.${clientName}`);
     }
+    const imageProvider = this.app.bean._getBean<IImageProviderExecute>(beanFullName as never);
+    const directUpload =
+      typeof imageProvider.createDirectUpload === 'function' &&
+      typeof imageProvider.finalizeDirectUpload === 'function';
     const uploadOptions = {
       ...(imageConfig.upload ?? {}),
       ...(sceneOptions.upload ?? {}),
@@ -145,6 +102,8 @@ export class BeanImageUploadPolicy extends BeanBase {
       mimeTypes: mimeTypes.length > 0 ? mimeTypes : undefined,
       extensions: extensions.length > 0 ? extensions : undefined,
       multiple: uploadOptions.multiple,
+      public: this._resolvePublic(_clientOptions, sceneOptions),
+      directUpload,
     };
   }
 
@@ -201,16 +160,10 @@ export class BeanImageUploadPolicy extends BeanBase {
   ) {
     const stat = await fse.stat(file.file);
     const fileSize = Number(stat.size);
-    if (fileSize !== payload.fileSize) {
-      return this.app.throw(403, `image size mismatch: size=${fileSize}`);
-    }
     if (payload.maxSize && fileSize > payload.maxSize) {
       return this.app.throw(403, `image too large: maxSize=${payload.maxSize}`);
     }
     const mimeType = file.mimeType.toLowerCase();
-    if (mimeType !== payload.mimeType) {
-      return this.app.throw(403, `image mimeType mismatch: mimeType=${mimeType}`);
-    }
     if (payload.mimeTypes?.length && !matchesImageMimeType(mimeType, payload.mimeTypes)) {
       return this.app.throw(403, `unsupported image mimeType: ${mimeType}`);
     }
@@ -246,4 +199,11 @@ export class BeanImageUploadPolicy extends BeanBase {
     }
     return meta;
   }
+
+  private _resolvePublic(
+    clientOptions: { public?: boolean } | undefined,
+    sceneOptions: IDecoratorImageSceneOptions,
+  ) {
+    return sceneOptions.public ?? clientOptions?.public ?? this.scope.config.image.public ?? false;
+  }
 }