feat(storage): add URL upload/download support for local storage provider

modules/storage/src/Storage.ts

@@ -209,6 +209,14 @@ export default class Storage extends ManagedModule<Config> {
         config.aws.usePathStyle = false;
       }
     }
+    if (config.provider === 'local') {
+      const secret = config.local?.signingSecret?.trim() ?? '';
+      if (secret && !/^[0-9a-fA-F]{64}$/.test(secret)) {
+        throw new Error(
+          "local.signingSecret must be a 64-character hex string (32 bytes). Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"",
+        );
+      }
+    }
     return config;
   }
 
@@ -221,6 +229,9 @@ export default class Storage extends ManagedModule<Config> {
       this._storageAuthzResourceDispose?.();
       this._storageAuthzResourceDispose = null;
       this.disposeDeclaredPeerWatches();
+      if (this.storageProvider?.dispose) {
+        await this.storageProvider.dispose();
+      }
       this.updateHealth(HealthCheckStatus.NOT_SERVING);
     } else {
       this.registerDeclaredPeerWatches();
@@ -239,6 +250,9 @@ export default class Storage extends ManagedModule<Config> {
         this._storageAuthzResourceDispose?.();
         this._storageAuthzResourceDispose = null;
       }
+      if (this.storageProvider?.dispose) {
+        await this.storageProvider.dispose();
+      }
       this.storageProvider = createStorageProvider(provider, {
         local,
         google,

modules/storage/src/config/config.ts

@@ -77,6 +77,21 @@ export default {
       format: 'String',
       default: '/var/tmp',
     },
+    httpPort: {
+      format: 'Number',
+      default: 3100,
+      doc: 'Port for the local storage HTTP file server (serves uploads/downloads)',
+    },
+    httpBaseUrl: {
+      format: 'String',
+      default: '',
+      doc: 'External base URL for local storage file URLs. Leave empty to auto-derive from httpPort (http://localhost:{httpPort}). Override when the storage server is behind a reverse proxy or running in Docker.',
+    },
+    signingSecret: {
+      format: 'String',
+      default: '',
+      doc: 'Hex-encoded HMAC secret (64 hex chars / 32 bytes) for signing file URLs. Required for URLs to survive restarts — without it, a random secret is generated on startup and any public file URLs already stored in the database (sourceUrl/url) become invalid.',
+    },
   },
   suffixOnNameConflict: {
     format: 'Boolean',

modules/storage/src/interfaces/IStorageProvider.ts

@@ -58,4 +58,9 @@ export interface IStorageProvider {
   getPublicUrl(fileName: string, containerIsPublic?: boolean): Promise<string | Error>;
 
   getUploadUrl(fileName: string): Promise<string | Error>;
+
+  /**
+   * Releases provider resources (e.g. local HTTP file server).
+   */
+  dispose?(): Promise<void>;
 }

modules/storage/src/interfaces/StorageConfig.ts

@@ -24,5 +24,8 @@ export interface StorageConfig {
   };
   local: {
     storagePath: string;
+    httpPort: number;
+    httpBaseUrl: string;
+    signingSecret: string;
   };
 }