feat(media-proxy): sign attachment URLs and gate origins (#2830)

fluxer_app/src/features/messaging/components/markdown/renderers/LinkRenderer.tsx

@@ -28,6 +28,7 @@ import {
 	type RendererProps,
 } from '@app/features/messaging/components/markdown/renderers/RendererTypes';
 import {ExternalLinkWarningModal} from '@app/features/messaging/components/modals/ExternalLinkWarningModal';
+import AttachmentUrlRefresher from '@app/features/messaging/state/AttachmentUrlRefresher';
 import {openExternalUrlWithWarning} from '@app/features/messaging/utils/ExternalLinkUtils';
 import {goToMessage} from '@app/features/messaging/utils/MessageNavigator';
 import type {LinkNode} from '@app/features/messaging/utils/markdown/parser/Nodes';
@@ -889,12 +890,16 @@ export const LinkRenderer = observer(function LinkRenderer({
 			logger.warn('Invalid URL in link:', url);
 		}
 	}
+	const href = AttachmentUrlRefresher.fresh(url);
+	const warmAttachmentUrl = () => AttachmentUrlRefresher.warm(url);
 	return (
 		<FocusRing key={id} offset={-2} data-flx="messaging.markdown.renderers.link-renderer.focus-ring--2">
 			<a
-				href={url}
+				href={href}
 				target={isInternal ? undefined : '_blank'}
 				rel={isInternal ? undefined : 'noopener noreferrer'}
+				onPointerEnter={warmAttachmentUrl}
+				onFocus={warmAttachmentUrl}
 				onClick={(e) => {
 					e.stopPropagation();
 					if (handleClick) {