clean up auth, some storage improvements

apps/api/src/http.ts

@@ -9,15 +9,7 @@ import type { App } from './context'
  * the token is invalid, or the `sub` claim isn't an integer.
  */
 export async function authedId(c: Context<App>): Promise<number | null> {
-	const authHeader = c.req.header('Authorization') ?? ''
-	if (!authHeader.toLowerCase().startsWith('bearer ')) return null
-
-	const token = authHeader.slice('Bearer '.length)
-	const accountId = await validateAndGetAccountId(token, await c.env.JWT_SECRET.get())
-	if (!accountId) return null
-
-	const id = Number.parseInt(accountId, 10)
-	return Number.isNaN(id) ? null : id
+	return validateAndGetAccountId(c.req.raw, await c.env.JWT_SECRET.get())
 }
 
 /** Results.Unauthorized() equivalent — 401 with empty body. */

apps/api/src/routes/images.ts

@@ -59,9 +59,12 @@ export const imageRoutes = new Hono<App>({ strict: false })
 		const ext = dot >= 0 ? file.name.slice(dot).toLowerCase() : ''
 		const extension = valid.includes(ext) ? ext : '.jpg'
 
-		// Store the upload in the shared image bucket under a random key. The `img`
-		// worker serves it back by that key, which is the returned ImageName.
-		const name = crypto.randomUUID().replace(/-/g, '') + extension
+		// Store the upload in the shared image bucket under a random key, foldered by
+		// the upload date (e.g. `2026-06-15/`) so the bucket stays browsable over time.
+		// The `img` worker serves it back by that key (slashes and all), which is the
+		// returned ImageName.
+		const datePrefix = new Date().toISOString().slice(0, 10) + '/'
+		const name = datePrefix + crypto.randomUUID().replace(/-/g, '') + extension
 		await c.env.IMAGES.put(name, await file.arrayBuffer(), {
 			httpMetadata: { contentType: file.type || 'image/jpeg' },
 		})

apps/api/src/test/integration/api.test.ts

@@ -325,7 +325,7 @@ describe('images', () => {
 		})
 		expect(res.status).toBe(200)
 		const { ImageName } = (await res.json()) as { ImageName: string }
-		expect(ImageName).toMatch(/^[0-9a-f]+\.png$/)
+		expect(ImageName).toMatch(/^\d{4}-\d{2}-\d{2}\/[0-9a-f]+\.png$/)
 
 		// The object is in the shared bucket under that key.
 		const stored = await env.IMAGES.get(ImageName)
@@ -470,7 +470,7 @@ describe('images', () => {
 		})
 		expect(res.status).toBe(200)
 		const { ImageName } = (await res.json()) as { ImageName: string }
-		expect(ImageName).toMatch(/^[0-9a-f]+\.jpg$/)
+		expect(ImageName).toMatch(/^\d{4}-\d{2}-\d{2}\/[0-9a-f]+\.jpg$/)
 
 		// The account row now points its profileImage at the uploaded key.
 		const row = await env.DB.prepare('SELECT data FROM accounts WHERE account_id = 42').first<{