Storefront endpoint where SPs can request CAR files for each segment of an aggregate

[vasco-santos]

we need to work on a proposal to have an endpoint by Storefront where SPs can request CAR files of each segment of the aggregate

• this behind the scenes will redirect to roundabout presigned URLs
• previously we were considering to just compute presigned URLs for each SP storefront signs the deal proposal. However, this means that we would need to move JSON files around with potentially 100.000s entries of presigned URLs.
• we will be providing a base URI instead and a auth token that SPs can use. WIth that, we validate auth token (with expiration) and redirect to presigned URL

Plan

• we plan to give a stable URI per tenant, something like segment.web3.storage/bag… where SP can get each piece for an aggregate
• we will give a token that SPs can use to get that data (with expiration)
  • that token will be a UCAN encoded as a JWT that they can simply give us as an header
  • the token will either contain aggregate information so that we can validate that requested piece is really from that aggregate, or perhaps a bloom filter that we could optimistically verify without DB lookups