feat(api): redirect artifact downloads to presigned storage URLs (#1703)

packages/config/src/ConfigLoader.ts

@@ -93,6 +93,7 @@ function defaultConfig(): MasterConfig {
 				port: 8080,
 				ip_ban_exempt_ips: [],
 				presigned_attachment_uploads_enabled: false,
+				presigned_downloads_enabled: false,
 				unfurl_ignored_hosts: [],
 				embeds: {
 					oembed_html_enabled: false,

packages/config/src/MasterConfig.ts

@@ -84,6 +84,7 @@ export interface MasterConfig {
 			port: number;
 			ip_ban_exempt_ips: Array<string>;
 			presigned_attachment_uploads_enabled: boolean;
+			presigned_downloads_enabled: boolean;
 			unfurl_ignored_hosts: Array<string>;
 			embeds: {
 				oembed_html_enabled: boolean;

packages/config/src/config_loader/EnvironmentOverrides.ts

@@ -75,6 +75,10 @@ const NAMED_FLUXER_ENV_OVERRIDES: Record<string, NamedEnvOverride> = {
 		path: ['services', 'api', 'presigned_attachment_uploads_enabled'],
 		parse: parseEnvValue,
 	},
+	FLUXER_API_PRESIGNED_DOWNLOADS_ENABLED: {
+		path: ['services', 'api', 'presigned_downloads_enabled'],
+		parse: parseEnvValue,
+	},
 	FLUXER_API_WORKER_MODE: {path: ['services', 'api', 'worker', 'mode']},
 	FLUXER_API_WORKER_LANE: {path: ['services', 'api', 'worker', 'lane']},
 	FLUXER_API_WORKER_TASK: {path: ['services', 'api', 'worker', 'task']},