feat: update file handling to redirect to Telegram CDN and adjust Swagger documentation

test/files.test.ts

@@ -120,7 +120,7 @@ describe('File Route Handlers', () => {
       expect(body.error).toBe('File not found');
     });
 
-    it('should proxy download (200 stream) instead of 302 redirect', async () => {
+    it('should redirect to telegram file url with 302', async () => {
       mockSelect.mockImplementationOnce(() => ({
         from: () => ({
           where: () => ({
@@ -142,19 +142,10 @@ describe('File Route Handlers', () => {
       const req = requestWithPublicId('http://localhost:3000/f/test-id', 'test-id');
       const res = await handleFileRedirect(req);
 
-      // No longer 302 redirect
-      expect(res.status).toBe(200);
-
-      // No Location header with token
-      expect(res.headers.get('Location')).toBeNull();
-
-      // Should have Content-Disposition
-      const disposition = res.headers.get('Content-Disposition');
-      expect(disposition).toBeTruthy();
-      expect(disposition).toContain('test.jpg');
-
-      // fetch should have been called for the proxy
-      expect(mockGlobalFetch).toHaveBeenCalled();
+      expect(res.status).toBe(302);
+      expect(res.headers.get('Location')).toBe(
+        'https://api.telegram.org/file/bot123456:ABC-DEF/photos/file_0.jpg',
+      );
     });
 
     it('should return 500 on database or external errors', async () => {

test/rateLimit.test.ts

@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it } from 'bun:test';
+import { config } from '../src/env';
 import { checkRateLimit, cleanupRateLimitCache, clearRateLimitCache } from '../src/utils/rateLimit';
 
 describe('Rate Limiter', () => {
@@ -8,38 +9,23 @@ describe('Rate Limiter', () => {
 
   it('should allow requests up to the configured limit then block', () => {
     const key = 'user-1';
+    const limit = config.rateLimitMaxRequests;
 
-    // Default config maxRequests is 30; all 20 should pass
-    for (let i = 0; i < 20; i++) {
+    for (let i = 0; i < limit; i++) {
       expect(checkRateLimit(key)).toBe(true);
     }
-  });
-
-  it('should block requests when limit exceeded', () => {
-    const key = 'user-2';
-
-    // Exhaust the limit (30 by default)
-    for (let i = 0; i < 30; i++) {
-      checkRateLimit(key);
-    }
 
     expect(checkRateLimit(key)).toBe(false);
   });
 
-  it('should reset window after cleanup on expired entries', async () => {
-    const key = 'user-3';
-
-    // Use one request then wait past the window
-    expect(checkRateLimit(key)).toBe(true);
-
-    // Simulate expiry by advancing past the window
-    // We can only test cleanup of non-expired entries (no-op)
-    expect(() => cleanupRateLimitCache()).not.toThrow();
-  });
-
   it('should track different IPs independently', () => {
     expect(checkRateLimit('10.0.0.1')).toBe(true);
     expect(checkRateLimit('10.0.0.1')).toBe(true);
     expect(checkRateLimit('10.0.0.2')).toBe(true);
   });
+
+  it('should no-op on cleanup of active entries', () => {
+    checkRateLimit('user-3');
+    expect(() => cleanupRateLimitCache()).not.toThrow();
+  });
 });

test/swagger.test.ts

@@ -30,10 +30,10 @@ describe('Swagger Documentation Endpoints', () => {
     const uploadResponses = uploadPath.post.responses;
     expect(uploadResponses).toHaveProperty('429');
 
-    // Verify download is no longer documented as 302 redirect
+    // Verify download is 302 redirect to Telegram CDN
     const downloadResponses = downloadPath.get.responses;
-    expect(downloadResponses['200'].description).toContain('stream');
-    expect(downloadResponses).not.toHaveProperty('302');
+    expect(downloadResponses).toHaveProperty('302');
+    expect(downloadResponses['302'].description).toContain('Redirect');
   });
 
   it('returns Swagger UI HTML page', async () => {