fix(web): render private GitLab uploads in merge request descriptions

apps/server/src/assets/AssetAccess.test.ts

@@ -1303,6 +1303,26 @@ describe("AssetAccess", () => {
     }).pipe(Effect.provide(layerTest)),
   );
 
+  it.effect("signs an exact GitLab upload and rejects expired or altered grants", () =>
+    Effect.gen(function* () {
+      const reference = {
+        origin: "http://gl.here",
+        project: "42",
+        secret: "66dbcd21ec5d24ed6ea225176098d52b",
+        fileName: "my image.png",
+      };
+      const signed = yield* issueAssetUrl({ resource: { _tag: "gitlab-upload", reference } });
+      const suffix = signed.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length);
+      const separator = suffix.indexOf("/");
+      const token = suffix.slice(0, separator);
+      const name = suffix.slice(separator + 1);
+      expect(yield* resolveAsset(token, name)).toEqual({ kind: "gitlab-upload", reference });
+      expect(yield* resolveAsset(`x${token}`, name)).toBeNull();
+      yield* TestClock.adjust("61 minutes");
+      expect(yield* resolveAsset(token, name)).toBeNull();
+    }).pipe(Effect.provide(layerTest)),
+  );
+
   it.effect("serves GitHub-hosted pull request media through the repository's credential", () =>
     Effect.gen(function* () {
       const resolve = (relativeUrl: string) => {

apps/server/src/assets/AssetAccess.ts

@@ -1,6 +1,7 @@
 import type { AssetResource } from "@t3tools/contracts";
 import {
   AssetAttachmentNotFoundError,
+  GitLabUploadReference,
   AssetGitHubMediaUrlValidationError,
   AssetPreviewTypeValidationError,
   AssetProjectFaviconInspectionError,
@@ -89,6 +90,12 @@ const PREVIEW_ASSET_EXTENSIONS = new Set([
 ]);
 
 const AssetClaimsSchema = Schema.Union([
+  Schema.Struct({
+    version: Schema.Literal(1),
+    kind: Schema.Literal("gitlab-upload"),
+    reference: GitLabUploadReference,
+    expiresAt: Schema.Number,
+  }),
   Schema.Struct({
     version: Schema.Literal(1),
     kind: Schema.Literal("workspace-file"),
@@ -167,6 +174,7 @@ const decodeAssetClaims = Schema.decodeUnknownOption(AssetClaimsJson);
 const encodeAssetClaims = Schema.encodeSync(AssetClaimsJson);
 
 export type ResolvedAsset =
+  | { readonly kind: "gitlab-upload"; readonly reference: GitLabUploadReference }
   | {
       readonly kind: "file";
       readonly path: string;
@@ -740,6 +748,16 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
       fileName = "native-app-icon.png";
       break;
     }
+    case "gitlab-upload": {
+      claims = {
+        version: 1,
+        kind: "gitlab-upload",
+        reference: input.resource.reference,
+        expiresAt,
+      };
+      fileName = input.resource.reference.fileName;
+      break;
+    }
     case "github-media": {
       const fetchUrl = githubMediaFetchUrl(input.resource.url);
       if (fetchUrl === null) {
@@ -855,6 +873,10 @@ export const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (
       : null;
   }
 
+  if (claims.kind === "gitlab-upload") {
+    return { kind: "gitlab-upload", reference: claims.reference } satisfies ResolvedAsset;
+  }
+
   if (claims.kind === "github-media") {
     return {
       kind: "github-media",