Hello :3

src/routes/upload.ts

@@ -4,7 +4,6 @@ import { getBoundary, MultipartError, multipartParts, type MultipartPart } from
 import {
   hashPassword,
   hashSecret,
-  newDownloadKey,
   newFileId,
   sanitizeMime,
   sanitizeOriginalName,
@@ -32,7 +31,7 @@ export async function handleUpload(
   if (!boundary || !req.body) return jsonError(400, "expected a multipart/form-data upload");
 
   const id = newFileId();
-  const key = id + newDownloadKey();
+  const key = id;
 
   try {
     let filename = "";

src/security.ts

@@ -1,22 +1,17 @@
 import { createHash, createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 
-export const ID_BYTES = 16;
-export const KEY_BYTES = 32;
-export const ID_LENGTH = 22;
-export const KEY_LENGTH = 65;
+export const KEY_BYTES = 9; // 9 bytes base64url -> 12 chars
+export const KEY_LENGTH = 12;
 
-export const ID_PATTERN = /^[A-Za-z0-9_-]{22}$/;
-export const KEY_PATTERN = /^[A-Za-z0-9_-]{65}$/;
+export const KEY_PATTERN = /^[A-Za-z0-9_-]{12}$/;
+// The id and the download key are the same 12-char token.
+export const ID_PATTERN = KEY_PATTERN;
 
 export function randomToken(byteCount: number): string {
   return randomBytes(byteCount).toString("base64url");
 }
 
 export function newFileId(): string {
-  return randomToken(ID_BYTES);
-}
-
-export function newDownloadKey(): string {
   return randomToken(KEY_BYTES);
 }
 
@@ -33,7 +28,7 @@ export function secretMatches(storedHash: string, candidate: string): boolean {
 
 export function fileIdFromKey(key: string): string | null {
   if (key.length !== KEY_LENGTH) return null;
-  return key.slice(0, ID_LENGTH);
+  return key;
 }
 
 export function sanitizeOriginalName(name: string): string {