eptaadmin-sdk 0.1.6 → 0.1.10

package/README.md

@@ -76,11 +76,11 @@ If your project needs row-aligned records, build them yourself from the columns
 
 ## Image values
 
-A column of type "image" stores each value as a URL. The SDK automatically rewrites these to absolute, API-key-authenticated URLs (`{baseUrl}/api/v1/workspaces/{slug}/uploads/{file}`) before returning them, so they're directly usable outside a browser session — you never see or depend on the internal browser-app route these are stored against:
+A column of type "image" stores each value as a URL. The server rewrites these to absolute, **signed** URLs before returning them (`{baseUrl}/api/v1/workspaces/{slug}/uploads/{file}?sig=...`) — safe to drop straight into an `<img>`/`<video>` src, since the signature (not your personal API key) is what authorizes the request. A leaked link only ever exposes that one file, never your account's broader read access — but unlike a short-lived token, it doesn't expire on its own (revoking it means rotating the server's signing secret, which invalidates every signed link at once):
 
 ```js
 const avatars = await client.getValue("acme/clients/avatar");
-// ["https://your-eptaadmin-instance.example.com/api/v1/workspaces/acme/uploads/6f2dff985af5d290.png"]
+// ["https://your-eptaadmin-instance.example.com/api/v1/workspaces/acme/uploads/6f2dff985af5d290.png?sig=..."]
 ```
 
 ## Build-time prefetch (for static/SPA builds)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eptaadmin-sdk",
-  "version": "0.1.6",
+  "version": "0.1.10",
   "description": "Client SDK for reading your EptaAdmin workspace data from your own project.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -11,20 +11,14 @@ export class EptaAdminError extends Error {
   }
 }
 
-// Image column values are stored as the same URL the browser UI uses
-// (/workspaces/{slug}/uploads/{file}), which only accepts a session
-// cookie — useless to an external caller like this SDK, which has none.
-// Rewrite matching values to the API-key-authenticated equivalent instead
-// of just prefixing baseUrl onto the internal route, so callers get a
-// working absolute URL without depending on (or seeing) that internal
-// browser-route shape.
-const uploadUrlPattern = /^\/workspaces\/([^/]+)\/uploads\/(.+)$/;
-
+// Image column values arrive from the API already rewritten server-side
+// into a self-contained, signed public path (see upload_signing.go) — a
+// personal API key is never embedded in it, so it stays safe to drop
+// straight into an <img>/<video> src, unlike the account's actual API key.
+// This just needs to turn that relative path into an absolute URL.
 function resolveImageURL(value, baseUrl) {
-  if (typeof value !== "string") return value;
-  const match = value.match(uploadUrlPattern);
-  if (!match) return value;
-  return `${baseUrl}/api/v1/workspaces/${match[1]}/uploads/${match[2]}`;
+  if (typeof value !== "string" || !value.startsWith("/")) return value;
+  return baseUrl + value;
 }
 
 function resolveImageURLs(value, baseUrl) {