first

apps/attachments/delivery.py

@@ -0,0 +1,21 @@
+import base64
+import hashlib
+import time
+from urllib.parse import quote, urlencode
+
+from django.conf import settings
+from django.http import HttpResponseRedirect
+
+
+def signed_media_redirect(relative_path, *, download=False, lifetime=300):
+    """Create an Nginx secure_link URL after Django has authorized the request."""
+    safe_path = quote(str(relative_path).replace("\\", "/").lstrip("/"), safe="/")
+    uri = f"/protected-media/{safe_path}"
+    expires = int(time.time()) + lifetime
+    source = f"{expires}{uri} {settings.MEDIA_SIGNING_SECRET}".encode()
+    digest = hashlib.md5(source, usedforsecurity=False).digest()
+    signature = base64.urlsafe_b64encode(digest).rstrip(b"=").decode()
+    query = {"md5": signature, "expires": expires}
+    if download:
+        query["download"] = "1"
+    return HttpResponseRedirect(f"{uri}?{urlencode(query)}")