Private media and avatars

Business constraint

Avatars are often public; identity docs and private albums are not. Same storage backend.

Naive v0

One public bucket. Or API streams every private byte. Or long-lived unsigned CDN URLs.

Failure drill

Data leaks via guessed keys. API becomes bottleneck. Expired permissions still fetchable.

Evolution path

Iteration 1

Separate public vs private prefixes. Private gets short-lived signed URLs minted after authz.

Iteration 2

CDN in front with signed cookies/URLs; cache private responses carefully (or not at all).

Iteration 3

Audit access mint events. Rotate keys. Soft-TTL caches of authz decisions with explicit invalidate on revoke.

Implementation cut

Authz check before mint. Default deny. Log minting, not only storage access.

Numbers

Max URL lifetime. Revocation effectiveness within TTL. Proxy bandwidth ≈ 0 for steady state.

Pattern tags

• signed-urls
• soft-ttl

Self-check

1. Why short-lived signatures?
2. What must happen before mint?
3. When can CDN cache private media?
4. How do you revoke quickly?
5. What do you audit?

Walkthrough

Recordings will appear here when published. Until then, work the failure drill and lab locally — pause after each iteration and write the metric that moved.