Presigned URLs: Secure File Downloads from S3 and Cloudflare R2

[Browser] -- 1. GET /api/download-link?file=report.pdf --> [Node.js API Server]
                                                            | Generates Presigned URL
[Browser] <-- 2. Returns signed URL (expires in 15m) <-----+ (Zero bandwidth used!)

[Browser] -- 3. GET https://bucket.r2.cloudflarestorage.com/report.pdf?X-Amz-Signature=... --> [Cloudflare R2]
[Browser] <-- 4. Direct high-speed download at line rate ---------------------------------------+

import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const s3 = new S3Client({
  region: 'auto',
  endpoint: process.env.R2_ENDPOINT,
  credentials: {
    accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
  },
});

export async function createDownloadUrl(
  bucketName: string,
  objectKey: string,
  fileName: string,
  expiresInSeconds = 900 // 15 minutes
): Promise<string> {
  const command = new GetObjectCommand({
    Bucket: bucketName,
    Key: objectKey,
    // Force browser to download with proper filename instead of opening in tab
    ResponseContentDisposition: `attachment; filename="${encodeURIComponent(fileName)}"`,
  });

  const presignedUrl = await getSignedUrl(s3, command, { expiresIn: expiresInSeconds });
  return presignedUrl;
}