From 473531792ea3433899adb52632d00737e27e0a13 Mon Sep 17 00:00:00 2001
From: Carlos Santos <4a.santos@gmail.com>
Date: Tue, 29 Apr 2025 13:21:27 +0200
Subject: [PATCH] backend: Add API key validation to recording middleware and
 update routes for media retrieval

---
 backend/src/middlewares/recording.middleware.ts | 4 ++--
 backend/src/routes/recording.routes.ts          | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/src/middlewares/recording.middleware.ts b/backend/src/middlewares/recording.middleware.ts
index 9e9416d..f731757 100644
--- a/backend/src/middlewares/recording.middleware.ts
+++ b/backend/src/middlewares/recording.middleware.ts
@@ -4,7 +4,7 @@ import { container } from '../config/index.js';
 import { RecordingHelper } from '../helpers/index.js';
 import { OpenViduMeetError } from '../models/error.model.js';
 import { LoggerService, MeetStorageService, RoomService } from '../services/index.js';
-import { allowAnonymous, recordingTokenValidator, tokenAndRoleValidator, withAuth } from './auth.middleware.js';
+import { allowAnonymous, apiKeyValidator, recordingTokenValidator, tokenAndRoleValidator, withAuth } from './auth.middleware.js';
 
 export const withRecordingEnabled = async (req: Request, res: Response, next: NextFunction) => {
 	const logger = container.get(LoggerService);
@@ -130,7 +130,7 @@ export const configureRecordingMediaAuth = async (req: Request, res: Response, n
 		});
 	}
 
-	const authValidators = [tokenAndRoleValidator(UserRole.ADMIN), recordingTokenValidator];
+	const authValidators = [apiKeyValidator, tokenAndRoleValidator(UserRole.ADMIN), recordingTokenValidator];
 
 	if (recordingAccess === MeetRecordingAccess.PUBLIC) {
 		authValidators.push(allowAnonymous);
diff --git a/backend/src/routes/recording.routes.ts b/backend/src/routes/recording.routes.ts
index 99c0762..cac4f53 100644
--- a/backend/src/routes/recording.routes.ts
+++ b/backend/src/routes/recording.routes.ts
@@ -54,8 +54,8 @@ recordingRouter.delete(
 );
 recordingRouter.get(
 	'/:recordingId/media',
+	withValidGetMediaRequest,
 	configureRecordingMediaAuth,
-	withValidRecordingId,
 	withCanRetrieveRecordingsPermission,
 	recordingCtrl.getRecordingMedia
 );