Best Object Storage for Private Image Thumbnails and Signed Links in Node.js

To store private originals, generate thumbnails, and issue signed download links, a SaaS app should follow a four-step ownership boundary process. First, the application authenticates the user. Second, the storage system persists the original image. Third, a worker generates thumbnail variants. Lastly, the application creates signed download links after verifying tenant access.

The worker should write a deterministic key and only mark the database row as ready after the storage system accepts the object. A client that sees a pending row should retry the application endpoint, not the bucket. This approach ensures that retries converge on the same result, preventing the creation of duplicate objects.

When implementing this in Node.js, the worker can use the Infrai plain REST surface, which requires only HTTP requests without needing a specific storage SDK or client library. The code should include an explicit method, bearer token, idempotency key, bounded retries, and surfacing the response body for troubleshooting purposes.

For example, the code snippet provided uses the sha256 hashing algorithm to create a deterministic key based on the bucket, key, and content digest. The API origin, API key, and content are obtained from environment variables. The code then creates the PUT object URL, sets the necessary headers, including the Authorization bearer token and Idempotency-Key, and sends the request using the requests library. The code includes retry logic for handling rate limiting (429) responses.