@balena/pinejs 21.4.0-build-add-odata-actions-57ea3eb16fe9ec8e28ea12b969da062ec4374a2d-1 → 21.4.0-build-add-actions-example-6e3f5d12bf1644c266f898558c5a1a25ef595f2b-1

package/out/webresource-handler/webresource.d.ts

@@ -0,0 +1,42 @@
+import type { Types } from '@balena/abstract-sql-to-typescript';
+export interface MultipartUpload {
+    Read: {
+        created_at: Types['Date Time']['Read'];
+        modified_at: Types['Date Time']['Read'];
+        id: Types['Serial']['Read'];
+        uuid: Types['Short Text']['Read'];
+        resource_name: Types['Short Text']['Read'];
+        field_name: Types['Short Text']['Read'];
+        resource_id: Types['Integer']['Read'];
+        upload_id: Types['Short Text']['Read'];
+        file_key: Types['Short Text']['Read'];
+        status: 'pending' | 'completed' | 'cancelled';
+        filename: Types['Short Text']['Read'];
+        content_type: Types['Short Text']['Read'];
+        size: Types['Integer']['Read'];
+        chunk_size: Types['Integer']['Read'];
+        expiry_date: Types['Date Time']['Read'];
+        is_created_by__actor: Types['Integer']['Read'] | null;
+    };
+    Write: {
+        created_at: Types['Date Time']['Write'];
+        modified_at: Types['Date Time']['Write'];
+        id: Types['Serial']['Write'];
+        uuid: Types['Short Text']['Write'];
+        resource_name: Types['Short Text']['Write'];
+        field_name: Types['Short Text']['Write'];
+        resource_id: Types['Integer']['Write'];
+        upload_id: Types['Short Text']['Write'];
+        file_key: Types['Short Text']['Write'];
+        status: 'pending' | 'completed' | 'cancelled';
+        filename: Types['Short Text']['Write'];
+        content_type: Types['Short Text']['Write'];
+        size: Types['Integer']['Write'];
+        chunk_size: Types['Integer']['Write'];
+        expiry_date: Types['Date Time']['Write'];
+        is_created_by__actor: Types['Integer']['Write'] | null;
+    };
+}
+export default interface $Model {
+    multipart_upload: MultipartUpload;
+}

package/out/webresource-handler/webresource.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webresource.js.map

package/out/webresource-handler/webresource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webresource.js","sourceRoot":"","sources":["../../src/webresource-handler/webresource.ts"],"names":[],"mappings":""}

package/out/webresource-handler/webresource.sbvr

@@ -0,0 +1,60 @@
+Vocabulary: webresource
+
+Term: actor
+	Concept Type: Integer (Type)
+Term: expiry date
+	Concept Type: Date Time (Type)
+Term: uuid
+	Concept Type: Short Text (Type)
+Term: resource name
+	Concept Type: Short Text (Type)
+Term: field name
+	Concept Type: Short Text (Type)
+Term: resource id
+	Concept Type: Integer (Type)
+Term: upload id
+	Concept Type: Short Text (Type)
+Term: file key
+	Concept Type: Short Text (Type)
+Term: status
+	Concept Type: Short Text (Type)
+Term: filename
+	Concept Type: Short Text (Type)
+Term: content type
+	Concept Type: Short Text (Type)
+Term: size
+	Concept Type: Integer (Type)
+Term: chunk size
+	Concept Type: Integer (Type)
+Term: valid until date
+	Concept Type: Date Time (Type)
+
+Term: multipart upload
+Fact type: multipart upload has uuid
+	Necessity: each multipart upload has exactly one uuid
+	Necessity: each uuid is of exactly one multipart upload
+Fact type: multipart upload has resource name
+	Necessity: each multipart upload has exactly one resource name
+Fact type: multipart upload has field name
+	Necessity: each multipart upload has exactly one field name
+Fact type: multipart upload has resource id
+	Necessity: each multipart upload has exactly one resource id
+Fact type: multipart upload has upload id
+	Necessity: each multipart upload has exactly one upload id
+Fact type: multipart upload has file key
+	Necessity: each multipart upload has exactly one file key
+Fact type: multipart upload has status
+	Necessity: each multipart upload has exactly one status
+	Definition: "pending" or "completed" or "cancelled"
+Fact type: multipart upload has filename
+	Necessity: each multipart upload has exactly one filename
+Fact type: multipart upload has content type
+	Necessity: each multipart upload has exactly one content type
+Fact type: multipart upload has size
+	Necessity: each multipart upload has exactly one size
+Fact type: multipart upload has chunk size
+	Necessity: each multipart upload has exactly one chunk size
+Fact type: multipart upload has expiry date
+	Necessity: each multipart upload has exactly one expiry date
+Fact type: multipart upload is created by actor
+	Necessity: each multipart upload is created by at most one actor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@balena/pinejs",
-  "version": "21.4.0-build-add-odata-actions-57ea3eb16fe9ec8e28ea12b969da062ec4374a2d-1",
+  "version": "21.4.0-build-add-actions-example-6e3f5d12bf1644c266f898558c5a1a25ef595f2b-1",
   "main": "out/server-glue/module.js",
   "type": "module",
   "repository": "git@github.com:balena-io/pinejs.git",
@@ -20,10 +20,10 @@
     "webpack-build": "npm run webpack-browser && npm run webpack-module && npm run webpack-server",
     "lint": "balena-lint -t tsconfig.dev.json -e js -e ts src test build typings Gruntfile.cts && npx tsc --project tsconfig.dev.json --noEmit",
     "test": "npm run build && npm run lint && npm run webpack-build && npm run test:compose && npm run test:generated-types",
-    "test:compose": "trap 'docker compose -f docker-compose.npm-test.yml down ; echo Stopped ; exit 0' INT; docker compose -f docker-compose.npm-test.yml up -d && sleep 2 && DATABASE_URL=postgres://docker:docker@localhost:5431/postgres PINEJS_WEBRESOURCE_MAXFILESIZE=1000000000 S3_ENDPOINT=http://localhost:43680 S3_ACCESS_KEY=USERNAME S3_SECRET_KEY=PASSWORD S3_STORAGE_ADAPTER_BUCKET=balena-pine-web-resources S3_REGION=us-east-1 PINEJS_QUEUE_CONCURRENCY=1 TZ=UTC npx mocha",
+    "test:compose": "trap 'docker compose -f docker-compose.npm-test.yml down ; echo Stopped ; exit 0' INT; docker compose -f docker-compose.npm-test.yml up -d && sleep 2 && DATABASE_URL=postgres://docker:docker@localhost:5431/postgres PINEJS_WEBRESOURCE_MAXFILESIZE=1000000000 S3_ENDPOINT=http://localhost:43680 S3_ACCESS_KEY=USERNAME S3_SECRET_KEY=PASSWORD S3_STORAGE_ADAPTER_BUCKET=balena-pine-web-resources S3_REGION=us-east-1 PINEJS_QUEUE_CONCURRENCY=1 TZ=UTC PINEJS_WEBRESOURCE_MULTIPART_ENABLED=true npx mocha",
     "test:generated-types": "npm run generate-types && git diff --exit-code ./src/sbvr-api/user.ts ./src/migrator/migrations.ts ./src/sbvr-api/dev.ts",
     "lint-fix": "balena-lint -t tsconfig.dev.json -e js -e ts --fix src test build typings Gruntfile.cts",
-    "generate-types": "node ./bin/sbvr-compiler.js generate-types ./src/sbvr-api/user.sbvr ./src/sbvr-api/user.ts && node ./bin/sbvr-compiler.js generate-types ./src/migrator/migrations.sbvr ./src/migrator/migrations.ts && node ./bin/sbvr-compiler.js generate-types ./src/sbvr-api/dev.sbvr ./src/sbvr-api/dev.ts && node ./bin/sbvr-compiler.js generate-types ./src/tasks/tasks.sbvr ./src/tasks/tasks.ts && balena-lint -t tsconfig.dev.json --fix ./src/sbvr-api/user.ts ./src/migrator/migrations.ts ./src/sbvr-api/dev.ts"
+    "generate-types": "node ./bin/sbvr-compiler.js generate-types ./src/sbvr-api/user.sbvr ./src/sbvr-api/user.ts && node ./bin/sbvr-compiler.js generate-types ./src/migrator/migrations.sbvr ./src/migrator/migrations.ts && node ./bin/sbvr-compiler.js generate-types ./src/sbvr-api/dev.sbvr ./src/sbvr-api/dev.ts && node ./bin/sbvr-compiler.js generate-types ./src/tasks/tasks.sbvr ./src/tasks/tasks.ts && node ./bin/sbvr-compiler.js generate-types ./src/webresource-handler/webresource.sbvr ./src/webresource-handler/webresource.ts && balena-lint -t tsconfig.dev.json --fix ./src/sbvr-api/user.ts ./src/migrator/migrations.ts ./src/sbvr-api/dev.ts"
   },
   "dependencies": {
     "@balena/abstract-sql-compiler": "^10.2.3",
@@ -70,7 +70,7 @@
   "devDependencies": {
     "@balena/lint": "^9.1.6",
     "@balena/pinejs": "file:./",
-    "@balena/pinejs-webresource-s3": "^1.0.4",
+    "@balena/pinejs-webresource-s3": "2.0.0-build-new-multiparthandle-interface-946a8ca8f89769da46d151f4fc5ba9480e81a2be-3",
     "@faker-js/faker": "^9.6.0",
     "@types/busboy": "^1.5.4",
     "@types/chai": "^5.2.1",
@@ -149,6 +149,6 @@
     "recursive": true
   },
   "versionist": {
-    "publishedAt": "2025-05-01T13:11:08.425Z"
+    "publishedAt": "2025-05-01T13:16:36.421Z"
   }
 }

package/src/config-loader/config-loader.ts

@@ -33,6 +33,7 @@ import {
 	type WebResourceHandler,
 	setupUploadHooks,
 	setupWebresourceHandler,
+	setupUploadActions,
 } from '../webresource-handler/index.js';
 import type { AliasValidNodeType } from '../sbvr-api/translations.js';
 
@@ -221,18 +222,17 @@ export const setup = (app: Express.Application) => {
 							.delete(sbvrUtils.handleODataRequest);
 
 						const loadedModel = sbvrUtils.getModel(model.apiRoot!);
-						if (translateTo == null) {
-							const resourceNames = Object.values(
-								loadedModel.abstractSql.tables,
+						const resourceNames = Object.values(loadedModel.abstractSql.tables)
+							.filter((table) =>
+								table.fields.some((f) => f.dataType === 'WebResource'),
 							)
-								.filter((table) =>
-									table.fields.some((f) => f.dataType === 'WebResource'),
-								)
-								.map((table) => table.name);
+							.map((table) => table.name);
 
-							for (const resource of new Set(resourceNames)) {
+						for (const resource of new Set(resourceNames)) {
+							if (translateTo == null) {
 								setupUploadHooks(webResourceHandler, model.apiRoot!, resource);
 							}
+							setupUploadActions(webResourceHandler, model.apiRoot!, resource);
 						}
 
 						console.info(

package/src/config-loader/env.ts

@@ -159,6 +159,17 @@ export const tasks = {
 	queueIntervalMS: intVar('PINEJS_QUEUE_INTERVAL_MS', 1000),
 };
 
+export const webResource = {
+	multipartUploadEnabled: boolVar(
+		'PINEJS_WEBRESOURCE_MULTIPART_ENABLED',
+		false,
+	),
+	singleUploadMaxFilesize: intVar(
+		'PINEJS_WEBRESOURCE_MAXFILESIZE',
+		299 * 1024 * 1024,
+	),
+};
+
 export const guardTestMockOnly = () => {
 	if (process.env.DEPLOYMENT !== 'TEST') {
 		throw new Error('Attempting to use TEST_MOCK_ONLY outside of tests');

package/src/server-glue/module.ts

@@ -8,6 +8,7 @@ import * as migrator from '../migrator/sync.js';
 import type * as migratorUtils from '../migrator/utils.js';
 import * as tasks from '../tasks/index.js';
 export * as actions from '../sbvr-api/actions.js';
+import * as webresource from '../webresource-handler/index.js';
 
 import * as sbvrUtils from '../sbvr-api/sbvr-utils.js';
 import { PINEJS_ADVISORY_LOCK } from '../config-loader/env.js';
@@ -67,6 +68,7 @@ export const init = async <T extends string>(
 		const cfgLoader = configLoader.setup(app);
 		await cfgLoader.loadConfig(migrator.config);
 		await cfgLoader.loadConfig(tasks.config);
+		await cfgLoader.loadConfig(webresource.config);
 
 		if (!process.env.CONFIG_LOADER_DISABLED) {
 			await cfgLoader.loadApplicationConfig(config);

package/src/webresource-handler/actions/beginUpload.ts

@@ -0,0 +1,160 @@
+import type { AnyObject } from 'pinejs-client-core';
+
+import { api, type Response } from '../../sbvr-api/sbvr-utils.js';
+import type { MultipartUploadHandler } from '../multiparUpload.js';
+import { getMultipartUploadHandler } from '../multiparUpload.js';
+import type { BeginMultipartUploadPayload } from '../index.js';
+import { getWebResourceFields } from '../index.js';
+import { BadRequestError, NotImplementedError } from '../../sbvr-api/errors.js';
+import { permissions, sbvrUtils } from '../../server-glue/module.js';
+import { TransactionClosedError } from '../../database-layer/db.js';
+import { randomUUID } from 'crypto';
+import type { WebResourceType as WebResource } from '@balena/sbvr-types';
+import type {
+	ODataActionArgs,
+	ODataActionRequest,
+} from '../../sbvr-api/actions.js';
+
+type FakeWebResourcePatch = {
+	[key: string]: Omit<WebResource, 'href'> & {
+		href: 'fake_patch';
+	};
+};
+
+export const beginUploadAction = async ({
+	request,
+	tx,
+	id,
+	req,
+}: ODataActionArgs): Promise<Response> => {
+	if (typeof id !== 'number') {
+		throw new NotImplementedError(
+			'multipart upload do not yet support non-numeric ids',
+		);
+	}
+
+	const handler = getMultipartUploadHandler();
+	const { fieldName, beginUploadPayload } = parseBeginUpload(request, handler);
+
+	await runFakeDbPatch(request, {
+		[fieldName]: { ...beginUploadPayload, href: 'fake_patch' },
+	});
+
+	const { fileKey, uploadId, uploadParts } =
+		await handler.multipartUpload.begin(fieldName, beginUploadPayload);
+	const uuid = randomUUID();
+	await api.webresource.post({
+		resource: 'multipart_upload',
+		body: {
+			uuid,
+			resource_name: request.resourceName,
+			field_name: fieldName,
+			resource_id: id,
+			upload_id: uploadId,
+			file_key: fileKey,
+			status: 'pending',
+			...beginUploadPayload,
+			expiry_date: Date.now() + 7 * 24 * 60 * 60 * 1000, // 7 days in ms
+			is_created_by__actor: req.user?.actor,
+		},
+		passthrough: {
+			req: permissions.root,
+			tx,
+		},
+	});
+
+	return {
+		body: { [fieldName]: { uuid, uploadParts } },
+		statusCode: 200,
+	};
+};
+
+const parseBeginUpload = (
+	request: ODataActionRequest,
+	webResourceHandler: MultipartUploadHandler,
+) => {
+	const fieldNames = Object.keys(request.values);
+	if (fieldNames.length !== 1) {
+		throw new BadRequestError(
+			'You can only get upload url for one field at a time',
+		);
+	}
+
+	const [fieldName] = fieldNames;
+	const webResourceFields = getWebResourceFields(request, false);
+	if (!webResourceFields.includes(fieldName)) {
+		throw new BadRequestError(
+			`The provided field '${fieldName}' is not a valid webresource`,
+		);
+	}
+
+	const beginUploadPayload = parseBeginUploadPayload(
+		request.values[fieldName],
+		webResourceHandler,
+	);
+	if (beginUploadPayload == null) {
+		throw new BadRequestError('Invalid file metadata');
+	}
+
+	return {
+		beginUploadPayload,
+		fieldName,
+	};
+};
+
+const parseBeginUploadPayload = (
+	payload: AnyObject,
+	webResourceHandler: MultipartUploadHandler,
+): BeginMultipartUploadPayload | null => {
+	if (payload == null || typeof payload !== 'object') {
+		return null;
+	}
+
+	let { filename, content_type, size, chunk_size } = payload;
+	if (
+		typeof filename !== 'string' ||
+		typeof content_type !== 'string' ||
+		typeof size !== 'number' ||
+		(chunk_size != null && typeof chunk_size !== 'number') ||
+		(chunk_size != null &&
+			chunk_size < webResourceHandler.multipartUpload.getMinimumPartSize())
+	) {
+		return null;
+	}
+
+	chunk_size ??= webResourceHandler.multipartUpload.getDefaultPartSize();
+
+	return { filename, content_type, size, chunk_size };
+};
+
+// TODO: comment explaining why run this fake transaction is important
+const runFakeDbPatch = async (
+	request: ODataActionRequest,
+	fakeDbPatch: FakeWebResourcePatch,
+) => {
+	try {
+		await sbvrUtils.db.transaction(async (fakeTx) => {
+			const newUrl = request.url.slice(1).replace(/\/beginUpload$/, '');
+			await api[request.vocabulary].request({
+				method: 'PATCH',
+				url: newUrl,
+				body: fakeDbPatch,
+				// TODO: comment explaining why root is necessary
+				passthrough: { tx: fakeTx, req: permissions.root },
+			});
+
+			await fakeTx.rollback();
+		});
+	} catch (e) {
+		if (
+			// calling rollback() always makes it throw, so we capture and move on in case
+			// the error was just because the tx was (on purpose) rolledback
+			!(
+				e instanceof TransactionClosedError &&
+				e.message === 'Transaction has been rolled back.'
+			)
+		) {
+			throw e;
+		}
+	}
+};

package/src/webresource-handler/actions/canceUpload.ts

@@ -0,0 +1,92 @@
+import type {
+	ODataActionArgs,
+	ODataActionRequest,
+} from '../../sbvr-api/actions.js';
+import type { Tx } from '../../database-layer/db.js';
+import {
+	BadRequestError,
+	NotImplementedError,
+	UnauthorizedError,
+} from '../../sbvr-api/errors.js';
+import { api, type Response } from '../../sbvr-api/sbvr-utils.js';
+import { permissions } from '../../server-glue/module.js';
+import { getMultipartUploadHandler } from '../multiparUpload.js';
+
+export const cancelUploadAction = async ({
+	request,
+	tx,
+	id: resourceId,
+}: ODataActionArgs): Promise<Response> => {
+	if (typeof resourceId !== 'number') {
+		throw new NotImplementedError(
+			'multipart upload do not yet support non-numeric ids',
+		);
+	}
+	const { id, fileKey, uploadId } = await getOngoingUpload(
+		request,
+		resourceId,
+		tx,
+	);
+	const handler = getMultipartUploadHandler();
+
+	await api.webresource.patch({
+		resource: 'multipart_upload',
+		body: {
+			status: 'cancelled',
+		},
+		id,
+		passthrough: {
+			tx: tx,
+			req: permissions.root,
+		},
+	});
+
+	// Note that different then beginUpload/commitUpload where we first do the action on the external service
+	// and then reflect it on the DB, for cancel upload it is the other way around
+	// as the worst case scenario is having a canceled upload which is marked on the DB as something else
+	await handler.multipartUpload.cancel({ fileKey, uploadId });
+
+	return {
+		statusCode: 204,
+	};
+};
+
+const getOngoingUpload = async (
+	request: ODataActionRequest,
+	affectedId: number,
+	tx: Tx,
+) => {
+	const { uuid } = request.values;
+	if (!uuid || typeof uuid !== 'string') {
+		throw new BadRequestError('Invalid uuid type');
+	}
+
+	const [multipartUpload] = await api.webresource.get({
+		resource: 'multipart_upload',
+		options: {
+			$select: ['id', 'file_key', 'upload_id'],
+			$filter: {
+				// TODO: swap this into the ID to see if it works
+				uuid,
+				status: 'pending',
+				expiry_date: { $gt: { $now: {} } },
+				resource_name: request.resourceName,
+				resource_id: affectedId,
+			},
+		},
+		passthrough: {
+			tx,
+			req: permissions.rootRead,
+		},
+	});
+
+	if (multipartUpload == null) {
+		throw new UnauthorizedError();
+	}
+
+	return {
+		id: multipartUpload.id,
+		fileKey: multipartUpload.file_key,
+		uploadId: multipartUpload.upload_id,
+	};
+};

package/src/webresource-handler/actions/commitUpload.ts

@@ -0,0 +1,117 @@
+import type { Tx } from '../../database-layer/db.js';
+import type {
+	ODataActionArgs,
+	ODataActionRequest,
+} from '../../sbvr-api/actions.js';
+import {
+	BadRequestError,
+	NotImplementedError,
+	UnauthorizedError,
+} from '../../sbvr-api/errors.js';
+import type { Response } from '../../sbvr-api/sbvr-utils.js';
+import { api } from '../../sbvr-api/sbvr-utils.js';
+import { permissions } from '../../server-glue/module.js';
+import { getMultipartUploadHandler } from '../multiparUpload.js';
+
+export const commitUploadAction = async ({
+	request,
+	tx,
+	id,
+	api: applicationApi,
+}: ODataActionArgs): Promise<Response> => {
+	if (typeof id !== 'number') {
+		throw new NotImplementedError(
+			'multipart upload do not yet support non-numeric ids',
+		);
+	}
+
+	const multipartUpload = await getOngoingUpload(request, id, tx);
+	const handler = getMultipartUploadHandler();
+
+	const webresource = await handler.multipartUpload.commit({
+		fileKey: multipartUpload.fileKey,
+		uploadId: multipartUpload.uploadId,
+		filename: multipartUpload.filename,
+		providerCommitData: multipartUpload.providerCommitData,
+	});
+
+	await Promise.all([
+		api.webresource.patch({
+			resource: 'multipart_upload',
+			body: {
+				status: 'completed',
+			},
+			options: {
+				$filter: {
+					uuid: multipartUpload.uuid,
+				},
+			},
+			passthrough: {
+				tx: tx,
+				req: permissions.root,
+			},
+		}),
+		applicationApi.patch({
+			resource: request.resourceName,
+			id,
+			body: {
+				[multipartUpload.fieldName]: webresource,
+			},
+			passthrough: {
+				tx: tx,
+				// Root is needed as, if you are not root, you are not allowed to directly modify the actual metadata
+				req: permissions.root,
+			},
+		}),
+	]);
+
+	const body = await handler.onPreRespond(webresource);
+
+	return {
+		body,
+		statusCode: 200,
+	};
+};
+
+const getOngoingUpload = async (
+	request: ODataActionRequest,
+	affectedId: number,
+	tx: Tx,
+) => {
+	const { uuid, providerCommitData } = request.values;
+	if (!uuid || typeof uuid !== 'string') {
+		throw new BadRequestError('Invalid uuid type');
+	}
+
+	const [multipartUpload] = await api.webresource.get({
+		resource: 'multipart_upload',
+		options: {
+			$select: ['id', 'file_key', 'upload_id', 'field_name', 'filename'],
+			$filter: {
+				// TODO: swap this into the ID to see if it works
+				uuid,
+				status: 'pending',
+				expiry_date: { $gt: { $now: {} } },
+				resource_name: request.resourceName,
+				resource_id: affectedId,
+			},
+		},
+		passthrough: {
+			tx,
+			req: permissions.rootRead,
+		},
+	});
+
+	if (multipartUpload == null) {
+		throw new UnauthorizedError();
+	}
+
+	return {
+		uuid,
+		providerCommitData,
+		fileKey: multipartUpload.file_key,
+		uploadId: multipartUpload.upload_id,
+		filename: multipartUpload.filename,
+		fieldName: multipartUpload.field_name,
+	};
+};

package/src/webresource-handler/index.ts

@@ -11,10 +11,18 @@ import {
 	odataNameToSqlName,
 	sqlNameToODataName,
 } from '@balena/odata-to-abstract-sql';
+import type { ConfigLoader } from '../server-glue/module.js';
 import { errors, permissions } from '../server-glue/module.js';
 import type { WebResourceType as WebResource } from '@balena/sbvr-types';
 import { TypedError } from 'typed-error';
 import type { Resolvable } from '../sbvr-api/common-types.js';
+import type WebresourceModel from './webresource.js';
+import { importSBVR } from '../server-glue/sbvr-loader.js';
+import { beginUploadAction } from './actions/beginUpload.js';
+import { isMultipartUploadAvailable } from './multiparUpload.js';
+import { commitUploadAction } from './actions/commitUpload.js';
+import { cancelUploadAction } from './actions/canceUpload.js';
+import { addAction } from '../sbvr-api/actions.js';
 
 export * from './handlers/index.js';
 
@@ -329,6 +337,7 @@ const throwIfWebresourceNotInMultipart = (
 	{ req, request }: HookArgs,
 ) => {
 	if (
+		req.user !== permissions.root.user &&
 		!req.is?.('multipart') &&
 		webResourceFields.some((field) => request.values[field] != null)
 	) {
@@ -526,3 +535,42 @@ export const setupUploadHooks = (
 		getCreateWebResourceHooks(handler),
 	);
 };
+
+export const setupUploadActions = (
+	handler: WebResourceHandler,
+	apiRoot: string,
+	resourceName: string,
+) => {
+	const resource = sqlNameToODataName(resourceName);
+	if (isMultipartUploadAvailable(handler)) {
+		addAction(apiRoot, resource, 'beginUpload', beginUploadAction);
+
+		addAction(apiRoot, resource, 'commitUpload', commitUploadAction);
+
+		addAction(apiRoot, resource, 'cancelUpload', cancelUploadAction);
+	}
+};
+
+const initSql = `
+CREATE INDEX IF NOT EXISTS idx_multipart_upload_uuid ON "multipart upload" (uuid);
+CREATE INDEX IF NOT EXISTS idx_multipart_upload_status ON "multipart upload" (status);
+`;
+
+const modelText = await importSBVR('./webresource.sbvr', import.meta);
+
+declare module '../sbvr-api/sbvr-utils.js' {
+	export interface API {
+		webresource: PinejsClient<WebresourceModel>;
+	}
+}
+
+export const config: ConfigLoader.Config = {
+	models: [
+		{
+			modelName: 'webresource',
+			apiRoot: 'webresource',
+			modelText,
+			initSql,
+		},
+	],
+};

package/src/webresource-handler/multiparUpload.ts

@@ -0,0 +1,23 @@
+import { webResource as webResourceEnv } from '../config-loader/env.js';
+import { NotImplementedError } from '../sbvr-api/errors.js';
+import type { WebResourceHandler } from './index.js';
+import { getWebresourceHandler } from './index.js';
+
+export type MultipartUploadHandler = WebResourceHandler &
+	Required<Pick<WebResourceHandler, 'multipartUpload'>>;
+
+export const isMultipartUploadAvailable = (
+	handler: WebResourceHandler | undefined,
+): handler is MultipartUploadHandler => {
+	return (
+		webResourceEnv.multipartUploadEnabled && handler?.multipartUpload != null
+	);
+};
+
+export const getMultipartUploadHandler = () => {
+	const handler = getWebresourceHandler();
+	if (!isMultipartUploadAvailable(handler)) {
+		throw new NotImplementedError('Multipart uploads not available');
+	}
+	return handler;
+};