Next.js API Route for Private PDF Export with Signed Object-Storage URLs (5 Rules)

Creating private PDF export signed download URLs via a Next.js API route requires careful design to ensure tenant isolation and maintainable security. The key steps are:

1. Derive the tenantID from the authenticated session on the server, never from the query string. Load the requested snapshot using both tenantID and snapshotID. Return appropriate errors for missing identifiers, unavailable snapshots, or policy denials.

2. Generate a signed GET URL with a short expiry (e.g. 5 minutes) and appropriate content type. Store an audit event with the tenant, snapshot, actor and decision, but not the signed query parameters.

3. Bind every identifier in the request to the authenticated tenant, and make the decision observable without logging sensitive data. A valid URL can still point to the wrong file.

4. Keep responsibilities separate between the API route (identity, tenant membership, snapshot state, audit context) and the object store (bytes and integrity checks). The API route owns authorization, while storage owns the object.

5. Perform the checks in order: validate session, load snapshot, generate signed URL, record audit event. Make the export decision idempotent with a correlation ID to avoid retries and ensure consistent policy enforcement across components.

In summary, the API route should own the policy boundary, issue the signed URL only after validating tenant, snapshot and object state, and ensure clear ownership and audit without compromising security or performance.