Marketplace SaaS Exports: Object Storage Signed URL Expiration After User Authorization

The optimal design for short-lived signed URLs in object storage for SaaS applications is to issue the link only after a successful user authorization. This temporary delivery credential should not be mistaken for the retention policy, user session, or audit record. The process involves authenticating the requester, verifying tenant and document access against current application state, confirming that the export is ready and within its retention window, and then creating the shortest-lived signed download URL. The generation, persistence, and deletion of the URL should all be handled on the server side.

The expiration of the signed URL should be determined based on factors such as transfer telemetry, retry behavior, and the acceptable exposure window of the object. The application should evaluate the requester identity, marketplace account, document ownership or delegated role, export readiness, and delete_at in a single policy decision before generating the signed URL.

Once the URL is created, it should be recorded in a database transaction with an immutable issuance event containing the application request ID, actor ID, document ID, object key, decision, and credential expiration. The URL itself should not be stored in the database, as query strings can contain sensitive information.

To ensure exactly-once processing, each download request should have an idempotency key, and a uniqueness constraint should be placed on (tenant_id, idempotency_key). When the same request is retried, the application should return the already-recorded result from the database. If regenerating an equivalent link is acceptable, the policy inputs and issuance result should be stored. If a single credential is required, issuance should be serialized through the database.

A compact Go client can be used to make the storage boundary explicit. The client should set INFRAI_BASE_URL to the documented API base and use a request object conforming to the public storage.object.presign discovery schema. The program should call the verified presign route, retry only on rate limits, and print the successful response for the application adapter to decode.