feat: Add Token Binding/Fingerprinting on Podcast Streaming Endpoints

[anushkagupta200615-jpg]

Description

This PR resolves the security vulnerability where podcast streaming URLs could be intercepted, scraped, and shared publicly without origin validation.

Fixes issue: SB2318/UltimateHealth#1181

Changes Made

• Dynamic Signed URLs Middleware: Added podcastSignMiddleware.js which globally intercepts API responses containing audio_url fields. It replaces the static, unprotected AWS/Vultr file paths with a dynamically generated secure endpoint.
• Token Binding & Client Fingerprinting: Implemented a robust custom HMAC-SHA256 signature algorithm. The signed URL includes a 1-hour expiration timestamp and is strictly bound to the requesting user's IP Address and User-Agent.
• Secure Playback Endpoint: Introduced podcastStreamController.js and the GET /api/podcast/stream/:key route. This handler verifies the expires parameter and decrypts the fingerprint. If the signature matches the server's secret hash and hasn't expired, it seamlessly streams the file from Object Storage.
• Strict CORS Enforcement: Added strict access-control headers inside the secure streaming response to deter unauthorized embedded playback.

Testing/Validation

• Validated server functionality without regressions on standard endpoints.
• Network requests are seamlessly piped to bypass heavy memory allocation.
• Successfully verified that attempting to access a streaming URL from a mismatched IP address or differing browser User-Agent immediately returns a 403 Unauthorized client fingerprint block.
• URL expiration successfully tested and handled.

[github-actions]

Thank you @, for creating the PR and contributing to our UltimateHealth project 💗.
Our team will review the PR and will reach out to you soon! 😇
Make sure that you have marked all the tasks that you are done with ✅.
Thank you for your patience! 😀