fix

src/routes/download.ts

@@ -3,7 +3,7 @@ import { hasValidAuth, renderPasswordForm } from "../auth";
 import { notFound } from "../http";
 import { log } from "../log";
 import { contentDisposition, fileIdFromKey, KEY_PATTERN, secretMatches } from "../security";
-import type { Storage } from "../storage";
+import { isExpired, type Storage } from "../storage";
 
 export async function handleDownload(
   req: Request,
@@ -17,6 +17,11 @@ export async function handleDownload(
 
   const meta = await storage.readMetadata(id);
   if (!meta) return notFound();
+  if (isExpired(meta)) {
+    await storage.delete(id);
+    log("info", `download rejected id=${id} expired`);
+    return notFound();
+  }
   if (!secretMatches(meta.downloadKeyHash, rawKey)) return notFound();
 
   if (!hasValidAuth(req, secret, rawKey)) {

src/routes/upload.ts

@@ -25,6 +25,7 @@ export async function handleUpload(
   req: Request,
   storage: Storage,
   maxFileSize: number,
+  ttlMs: number,
 ): Promise<Response> {
   const contentType = req.headers.get("content-type");
   const boundary = contentType ? getBoundary(contentType) : null;
@@ -73,6 +74,7 @@ export async function handleUpload(
       downloadKeyHash: hashSecret(key),
       passwordHash: hashPassword(password),
       createdAt: new Date().toISOString(),
+      expiresAt: new Date(Date.now() + ttlMs).toISOString(),
     });
 
     log("info", `upload ok id=${id} size=${size} name=${JSON.stringify(originalName)}`);