Skip to content

feat(media): name video posters by hash in imeta - #8447

Closed
ngoodger-block wants to merge 1 commit into
block:mainfrom
ngoodger-block:feat/poster-image-x
Closed

ngoodger-block wants to merge 1 commit into
block:mainfrom
ngoodger-block:feat/poster-image-x

Conversation

@ngoodger-block

Copy link
Copy Markdown
Contributor

Why?

#8444 restricts media reads to the channels a file is attached in, but a video's poster is recorded only as a URL (image <url>), so the relay cannot find it by hash and a private video's poster stays readable to the whole community.

What?

Desktop and mobile add image-x <sha256> beside the image poster URL, taken from the poster's content-addressed /media/<sha>.<ext> path. Merge only after #8444 is deployed: relays without it reject unknown imeta keys, so video posts with posters would fail.

Related issue

Follow-up to #8444.

Testing

Desktop buildImetaTags and mobile toImetaTag unit tests.

Desktop and mobile now add `image-x <sha256>` next to a video's `image`
poster URL, so the relay can find the poster by hash and restrict who may
read it to the channels the video is attached in. Requires a relay that
accepts `image-x` (block#8444); older relays reject unknown imeta keys.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Nikolaj Goodger <ngoodger@squareup.com>
@github-actions

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3debf18f1448334aa7bc202d328d93bb9651e168...19b31fc060d306b196ebcd31682338f712fffee8.
A new review must complete for this exact range. When manual authorization
is required, a user with write access must comment exactly
@buzz-security-review 19b31fc060d306b196ebcd31682338f712fffee8 to authorize a new review.
Any previous review applies only to its recorded range.

@ngoodger-block

Copy link
Copy Markdown
Contributor Author

🤖 Closing: #8444 now derives poster shares from the existing image URL when it records media shares, so clients don't need to emit image-x.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant