[adamsoffer]

Addresses the two review comments Copilot left on #126 just before it merged. Both are about /api/notion-cover, the route that serves a blog post's cover when it was uploaded into Notion rather than taken from the stock library. No published post uses an uploaded cover today, so nothing on livepeer.org changes visibly.

Changes

• Signed cover addresses. The route used to take any well-formed page ID and ask Notion about it, so random IDs or made-up versions could use up the Notion rate limit that every Notion-backed page shares. Cover addresses now end in <version>.<signature>, an HMAC over the page ID and version (lib/media-signature.ts), and the route checks it before calling Notion. This is what /api/notion-media already does. The signature goes in the path rather than a query string because next/image refuses a local image address with a query string unless images.localPatterns allows it. An out-of-date version still redirects to the current, signed address.
• No draft covers on livepeer.org. The route served a draft post's uploaded cover to anyone who had its page ID. In production it now refuses drafts, as the blog does (isPublished in lib/blog.ts). Previews and local dev still show drafts for review.

Testing

Called the route directly with a counter on requests to Notion:

Request	Result	Notion calls
Unsigned	404	0
Forged signature	404	0
Correctly signed	Reaches Notion (404 here because that post's cover is from the stock library)	1

/blog, a post page and its share image still render. Typecheck and lint pass.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Oct 13, 2026 4:09pm UTC

[Copilot]

🟡 Changes recommended

URL parsing and publication-status validation remain fail-open in cases that can expose covers or consume Notion capacity.

2 open findings

• Reject cover URL signatures with trailing components · New
• Require explicit Published status in production · New

What changed in this PR

Adds signed Notion blog-cover URLs and production draft-cover protection.

Changes:

• Adds HMAC signing and verification for uploaded cover paths.
• Restricts production cover retrieval based on publication status.
• Redirects stale versions to newly signed URLs.

File	Description
lib/​notion.ts	Generates signed cover paths and filters unpublished covers.
lib/​media-signature.ts	Adds cover-specific HMAC helpers.
app/​api/​notion-cover/​[id]/​[version]/​route.ts	Validates signatures before accessing Notion.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Valid signed URLs still allow query-string and page-ID aliases that bypass cache canonicalization and amplify Notion requests.

1 open finding

• Reject query aliases and noncanonical page IDs before signing · New

2 resolved since last review

• Reject cover URL signatures with trailing components
• Require explicit Published status in production

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Percent-encoded path aliases can still bypass canonical cache-key enforcement and amplify Notion requests.

0 open findings

1 resolved since last review

• Reject query aliases and noncanonical page IDs before signing

Previously missed (2)

In code that hasn't changed since last review

Enforce canonical raw pathname to prevent cache-key aliases

app/​api/​notion-media/​[id]/​route.ts:46

This route has the same remaining cache-key alias through its path: route params are decoded, so a valid ID with one or more characters percent-encoded still passes BLOCK_ID and the signature while using a distinct URL that can trigger another Notion request. Reject requests whose raw pathname is not the single canonical path emitted by uploadedMediaPath.

  const signature = QUERY.exec(new URL(request.url).search)?.[1] ?? null;
  if (
    !BLOCK_ID.test(id) ||
    !hasNotionCredentials() ||
    !mediaSignatureMatches(id, signature)

Reject percent-encoded path aliases before Notion calls

app/​api/​notion-cover/​[id]/​[version]/​route.ts:62

The canonical checks only inspect decoded route params. Percent-encoded path aliases such as encoding any hex character (or the dot in the signed segment) decode to the same id/segment, pass the signature, but remain distinct request URLs and cache keys, so one valid cover URL can still be expanded into many Notion calls. Compare the raw URL pathname with the exact generated path before calling Notion, just as the query string is compared exactly.

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The signing, canonicalization, and draft-access changes consistently address the reported security and rate-limit concerns.

0 open findings

🧠 Review effort: Balanced

[rickstaa]

LGTM thanks