fix(backend): use public MinIO origin for browser uploads

Backend/routes/admin.ts

@@ -2,7 +2,13 @@ import type { NextFunction, Request, Response } from 'express';
 import { Router } from 'express';
 import { z } from 'zod';
 
-import { ensureMinioBucket, minioBucket, minioClient, minioPresignedExpirySeconds } from '../utils/minio';
+import {
+  ensureMinioBucket,
+  minioBucket,
+  minioClient,
+  minioPresignClient,
+  minioPresignedExpirySeconds,
+} from '../utils/minio';
 
 const adminUsername = process.env.ADMIN_USERNAME;
 const adminPassword = process.env.ADMIN_PASSWORD;
@@ -325,7 +331,7 @@ router.post('/upload-url', async (req, res) => {
   await ensureMinioBucket();
 
   const objectKey = buildObjectKey(parsed.data.fileName, parsed.data.prefix);
-  const uploadUrl = await minioClient.presignedPutObject(minioBucket, objectKey, minioPresignedExpirySeconds);
+  const uploadUrl = await minioPresignClient.presignedPutObject(minioBucket, objectKey, minioPresignedExpirySeconds);
   const expiresAt = new Date(Date.now() + minioPresignedExpirySeconds * 1000);
 
   res.status(201).json({

Backend/routes/recordings.ts

@@ -6,7 +6,13 @@ import { db } from '../db/client';
 import { recordings } from '../db/schema';
 import { requireDeviceAuth } from '../middleware/device-auth';
 import { writeAuditLog } from '../services/audit';
-import { ensureMinioBucket, minioBucket, minioClient, minioPresignedExpirySeconds } from '../utils/minio';
+import {
+  ensureMinioBucket,
+  minioBucket,
+  minioClient,
+  minioPresignClient,
+  minioPresignedExpirySeconds,
+} from '../utils/minio';
 
 const router = Router();
 
@@ -227,7 +233,7 @@ router.get('/:recordingId/download-url', requireDeviceAuth, async (req, res) =>
     throw error;
   }
 
-  const downloadUrl = await minioClient.presignedGetObject(
+  const downloadUrl = await minioPresignClient.presignedGetObject(
     recording.bucket,
     recording.objectKey,
     minioPresignedExpirySeconds,

Backend/routes/videos.ts

@@ -9,7 +9,9 @@ import {
   ensureMinioBucket,
   minioBucket,
   minioClient,
+  minioPresignClient,
   minioPresignedExpirySeconds,
+  minioPublicOrigin,
 } from '../utils/minio';
 
 const router = Router();
@@ -83,7 +85,7 @@ router.post('/upload-url', async (req, res) => {
     }
 
     const objectKey = buildObjectKey(authSession.user.id, parsed.data.fileName, parsed.data.prefix);
-    const uploadUrl = await minioClient.presignedPutObject(minioBucket, objectKey, minioPresignedExpirySeconds);
+    const uploadUrl = await minioPresignClient.presignedPutObject(minioBucket, objectKey, minioPresignedExpirySeconds);
     const now = new Date();
     const expiresAt = new Date(now.getTime() + minioPresignedExpirySeconds * 1000);
 
@@ -98,6 +100,7 @@ router.post('/upload-url', async (req, res) => {
       minioEndpoint: process.env.MINIO_ENDPOINT ?? 'localhost',
       minioPort: Number(process.env.MINIO_PORT ?? 9000),
       minioUseSSL: (process.env.MINIO_USE_SSL ?? 'false').toLowerCase() === 'true',
+      minioPublicOrigin,
     });
 
     let persistedRecording;
@@ -183,7 +186,7 @@ router.get('/download-url', async (req, res) => {
 
   await ensureMinioBucket();
 
-  const downloadUrl = await minioClient.presignedGetObject(
+  const downloadUrl = await minioPresignClient.presignedGetObject(
     minioBucket,
     parsed.data.objectKey,
     minioPresignedExpirySeconds,