Media API

Media uses a private Supabase Storage bucket. The API issues signed URLs; file bytes are uploaded directly by the client.

All endpoints require a bearer token.

Method	Path	Description
POST	/media/upload-url	Create a signed upload URL
GET	/media/download-url?key=...	Create an own-object download URL
DELETE	/media?key=...	Delete an own object

POST /media/upload-url
{ "mime": "image/jpeg" }

The response is { key, signedUrl, token }. Keys are ownership-scoped as {userId}/{uuid}. Upload with the signed URL or Supabase uploadToSignedUrl, then attach the key to a profile photo, event cover, or message attachment. Supported MIME types are images, video, audio, and PDF; the maximum file size is 10 MB.

Download URLs are valid for one hour and are issued only for the caller's own objects. A malformed or missing object returns 400 or 404 respectively. Profile and event responses contain their own short-lived signed URLs.