fix

src/routes/download.ts

@@ -3,7 +3,7 @@ import { hasValidAuth, renderPasswordForm } from "../auth";
 import { notFound } from "../http";
 import { log } from "../log";
 import { contentDisposition, fileIdFromKey, KEY_PATTERN, secretMatches } from "../security";
-import type { Storage } from "../storage";
+import { isExpired, type Storage } from "../storage";
 
 export async function handleDownload(
   req: Request,
@@ -17,6 +17,11 @@ export async function handleDownload(
 
   const meta = await storage.readMetadata(id);
   if (!meta) return notFound();
+  if (isExpired(meta)) {
+    await storage.delete(id);
+    log("info", `download rejected id=${id} expired`);
+    return notFound();
+  }
   if (!secretMatches(meta.downloadKeyHash, rawKey)) return notFound();
 
   if (!hasValidAuth(req, secret, rawKey)) {