code: func (s *storageImpl) GetObjectURL(c context.Context, r *api.GetObjectURLRequest) (resp *api.ObjectURL, err error) {
  	defer func() { err = grpcutil.GRPCifyAndLogErr(c, err) }()
  
  	if err := common.ValidateObjectRef(r.Object, common.KnownHash); err != nil {
  		return nil, errors.Annotate(err, "bad 'object' field").Err()
  	}
  
  	// Lite validation for Content-Disposition header. As long as the filename
  	// doesn't have '"' or '\n', we are constructing a valid header. Let the
  	// browser do the rest of the validation however it likes.
  	if strings.ContainsAny(r.DownloadFilename, "\"\r\n") {
  		return nil, status.Errorf(codes.InvalidArgument, "bad 'download_filename' field, contains one of %q", "\"\r\n")
  	}
  
  	cfg, err := s.settings(c)
  	if err != nil {
  		return nil, err
  	}
  
  	sigFactory := defaultSigner
  	if cfg.SignAs != "" {
  		sigFactory = func(c context.Context) (*signer, error) {
  			return iamSigner(c, cfg.SignAs)
  		}
  	}
  
  	url, err := s.getSignedURL(c, cfg.ObjectPath(r.Object), r.DownloadFilename, sigFactory, s.getGS(c))
  	if err != nil {
  		return nil, errors.Annotate(err, "failed to get signed URL").Err()
  	}
  	return &api.ObjectURL{SignedUrl: url}, nil
  }
docs: // GetObjectURL implements the corresponding RPC method, see the proto doc.