@jant/core 0.3.35 → 0.3.37

package/src/routes/api/upload-multipart.ts

@@ -0,0 +1,245 @@
+/**
+ * Multipart Upload API Routes
+ *
+ * Handles chunked file uploads for files that exceed the Cloudflare Workers
+ * 100MB request body limit. Uses R2's native multipart upload API.
+ *
+ * Protocol:
+ *   1. POST /            — Initiate: validate metadata, start R2 multipart upload
+ *   2. PUT /:id/part     — Upload a single chunk (raw body, not FormData)
+ *   3. POST /:id/complete — Finalize: combine parts in R2, create DB record
+ *   4. POST /:id/abort   — Cancel: discard uploaded parts
+ *   5. PUT /:id/poster   — Upload poster frame (video thumbnails, small FormData)
+ */
+
+import { Hono } from "hono";
+import { z } from "zod";
+import type { Bindings } from "../../types.js";
+import type { AppVariables } from "../../types/app-context.js";
+import { requireAuthApi } from "../../middleware/auth.js";
+import { getMediaUrl, getPublicUrlForProvider } from "../../lib/image.js";
+import {
+  validateUploadFileMetadata,
+  generateStorageKey,
+} from "../../lib/upload.js";
+import { supportsMultipart } from "../../lib/storage.js";
+import { ValidationError } from "../../lib/errors.js";
+import { parseValidated } from "../../lib/schemas.js";
+
+type Env = { Bindings: Bindings; Variables: AppVariables };
+
+// ── Schemas ──────────────────────────────────────────────────────────
+
+const InitiateSchema = z.object({
+  filename: z.string().min(1),
+  contentType: z.string().min(1),
+  size: z.number().int().positive(),
+});
+
+const UploadPartSchema = z.object({
+  storageKey: z.string().min(1),
+  uploadId: z.string().min(1),
+});
+
+const CompleteSchema = z.object({
+  storageKey: z.string().min(1),
+  uploadId: z.string().min(1),
+  parts: z.array(
+    z.object({
+      partNumber: z.number().int().positive(),
+      etag: z.string().min(1),
+    }),
+  ),
+  filename: z.string().min(1),
+  originalName: z.string().min(1),
+  contentType: z.string().min(1),
+  size: z.number().int().positive(),
+  width: z.number().int().positive().optional(),
+  height: z.number().int().positive().optional(),
+  blurhash: z.string().max(200).optional(),
+  waveform: z.string().max(2000).optional(),
+  posterKey: z.string().optional(),
+});
+
+const AbortSchema = z.object({
+  storageKey: z.string().min(1),
+  uploadId: z.string().min(1),
+});
+
+// ── Routes ───────────────────────────────────────────────────────────
+
+export const multipartUploadApiRoutes = new Hono<Env>();
+
+// Require auth for all multipart routes
+multipartUploadApiRoutes.use("*", requireAuthApi());
+
+// POST / — Initiate a multipart upload
+multipartUploadApiRoutes.post("/", async (c) => {
+  const storage = c.var.storage;
+  if (!storage || !supportsMultipart(storage)) {
+    return c.json({ error: "Storage doesn't support multipart uploads." }, 500);
+  }
+
+  const body = await c.req.json();
+  const data = parseValidated(InitiateSchema, body);
+
+  // Validate file type and size
+  const error = validateUploadFileMetadata(data.contentType, data.size, {
+    maxFileSizeMB: c.var.appConfig.uploadMaxFileSize,
+  });
+  if (error) {
+    throw new ValidationError(error);
+  }
+
+  const { id, filename, storageKey } = generateStorageKey(data.filename);
+
+  const upload = await storage.createMultipartUpload(storageKey, {
+    contentType: data.contentType,
+  });
+
+  return c.json({
+    id,
+    uploadId: upload.uploadId,
+    storageKey,
+    filename,
+    originalName: data.filename,
+  });
+});
+
+// PUT /:id/part?partNumber=N&storageKey=...&uploadId=... — Upload a single part
+multipartUploadApiRoutes.put("/:id/part", async (c) => {
+  const storage = c.var.storage;
+  if (!storage || !supportsMultipart(storage)) {
+    return c.json({ error: "Storage doesn't support multipart uploads." }, 500);
+  }
+
+  const storageKey = c.req.query("storageKey");
+  const uploadId = c.req.query("uploadId");
+  if (!storageKey || !uploadId) {
+    throw new ValidationError(
+      "storageKey and uploadId query parameters are required",
+    );
+  }
+  parseValidated(UploadPartSchema, { storageKey, uploadId });
+
+  const partNumberRaw = c.req.query("partNumber");
+  if (!partNumberRaw) {
+    throw new ValidationError("partNumber query parameter is required");
+  }
+  const partNumber = parseInt(partNumberRaw, 10);
+  if (isNaN(partNumber) || partNumber < 1) {
+    throw new ValidationError("partNumber must be a positive integer");
+  }
+
+  const body = await c.req.arrayBuffer();
+  const part = await storage.uploadPart(storageKey, uploadId, partNumber, body);
+
+  return c.json({ partNumber: part.partNumber, etag: part.etag });
+});
+
+// POST /:id/complete — Finalize the upload
+multipartUploadApiRoutes.post("/:id/complete", async (c) => {
+  const storage = c.var.storage;
+  if (!storage || !supportsMultipart(storage)) {
+    return c.json({ error: "Storage doesn't support multipart uploads." }, 500);
+  }
+
+  const id = c.req.param("id");
+  const body = await c.req.json();
+  const data = parseValidated(CompleteSchema, body);
+
+  // Validate file type and size
+  const validationError = validateUploadFileMetadata(
+    data.contentType,
+    data.size,
+    { maxFileSizeMB: c.var.appConfig.uploadMaxFileSize },
+  );
+  if (validationError) {
+    throw new ValidationError(validationError);
+  }
+
+  // Complete the R2 multipart upload
+  await storage.completeMultipartUpload(
+    data.storageKey,
+    data.uploadId,
+    data.parts,
+  );
+
+  // Create the DB record
+  const media = await c.var.services.media.create({
+    id,
+    filename: data.filename,
+    originalName: data.originalName,
+    mimeType: data.contentType,
+    size: data.size,
+    storageKey: data.storageKey,
+    provider: c.var.appConfig.storageDriver,
+    width: data.width && data.width > 0 ? data.width : undefined,
+    height: data.height && data.height > 0 ? data.height : undefined,
+    blurhash: data.blurhash,
+    waveform: data.waveform,
+    posterKey: data.posterKey,
+  });
+
+  const mediaPublicUrl = getPublicUrlForProvider(
+    c.var.appConfig.storageDriver,
+    c.var.appConfig.r2PublicUrl,
+    c.var.appConfig.s3PublicUrl,
+  );
+  const publicUrl = getMediaUrl(data.storageKey, mediaPublicUrl);
+
+  return c.json({
+    id: media.id,
+    filename: media.filename,
+    url: publicUrl,
+    mimeType: media.mimeType,
+    size: media.size,
+  });
+});
+
+// POST /:id/abort — Cancel the upload
+multipartUploadApiRoutes.post("/:id/abort", async (c) => {
+  const storage = c.var.storage;
+  if (!storage || !supportsMultipart(storage)) {
+    return c.json({ error: "Storage doesn't support multipart uploads." }, 500);
+  }
+
+  const body = await c.req.json();
+  const data = parseValidated(AbortSchema, body);
+
+  await storage.abortMultipartUpload(data.storageKey, data.uploadId);
+
+  return c.json({ success: true });
+});
+
+// PUT /:id/poster — Upload poster frame (video thumbnails)
+multipartUploadApiRoutes.put("/:id/poster", async (c) => {
+  const storage = c.var.storage;
+  if (!storage) {
+    return c.json({ error: "Storage not configured." }, 500);
+  }
+
+  const id = c.req.param("id");
+  const formData = await c.req.formData();
+  const posterFile = formData.get("poster") as File | null;
+  if (!posterFile) {
+    throw new ValidationError("No poster file provided");
+  }
+
+  if (!posterFile.type.startsWith("image/")) {
+    throw new ValidationError(
+      `Invalid file type "${posterFile.type}". Only image files are accepted for poster frames.`,
+    );
+  }
+
+  const date = new Date();
+  const year = date.getUTCFullYear();
+  const month = String(date.getUTCMonth() + 1).padStart(2, "0");
+  const posterKey = `media/${year}/${month}/${id}-poster.webp`;
+
+  await storage.put(posterKey, posterFile.stream(), {
+    contentType: "image/webp",
+  });
+
+  return c.json({ posterKey });
+});

package/src/routes/api/upload.ts

@@ -60,7 +60,7 @@ function renderMediaCard(
         <button
           type="button"
           class="block w-full aspect-square bg-muted rounded-lg overflow-hidden border hover:border-primary cursor-pointer"
-          onclick="document.getElementById('lightbox-img').src = '${fullUrl}'; document.getElementById('lightbox').showModal()"
+          data-on:click="document.getElementById('lightbox-img').src = '${fullUrl}'; document.getElementById('lightbox').showModal()"
         >
           <img
             src="${thumbnailUrl}"
@@ -69,13 +69,9 @@ function renderMediaCard(
             loading="lazy"
           />
         </button>
-        <a
-          href="/dash/media/${media.id}"
-          class="block mt-2 text-xs truncate hover:underline"
-          title="${media.originalName}"
-        >
+        <span class="block mt-2 text-xs truncate" title="${media.originalName}">
           ${media.originalName}
-        </a>
+        </span>
         <div class="text-xs text-muted-foreground">${sizeStr}</div>
       </div>
     `.toString();
@@ -83,23 +79,18 @@ function renderMediaCard(
 
   return html`
     <div class="group relative" data-media-id="${media.id}">
-      <a
-        href="/dash/media/${media.id}"
-        class="block aspect-square bg-muted rounded-lg overflow-hidden border hover:border-primary"
+      <div
+        class="block aspect-square bg-muted rounded-lg overflow-hidden border"
       >
         <div
           class="w-full h-full flex items-center justify-center text-muted-foreground"
         >
           <span class="text-xs">${media.mimeType}</span>
         </div>
-      </a>
-      <a
-        href="/dash/media/${media.id}"
-        class="block mt-2 text-xs truncate hover:underline"
-        title="${media.originalName}"
-      >
+      </div>
+      <span class="block mt-2 text-xs truncate" title="${media.originalName}">
         ${media.originalName}
-      </a>
+      </span>
       <div class="text-xs text-muted-foreground">${sizeStr}</div>
     </div>
   `.toString();
@@ -138,7 +129,7 @@ uploadApiRoutes.post("/", async (c) => {
   if (!storage) {
     const errorText = i18n._(
       msg({
-        message: "Storage not configured",
+        message: "File storage isn't set up. Check your server config.",
         comment: "@context: Error when file storage is not set up",
       }),
     );
@@ -154,7 +145,7 @@ uploadApiRoutes.post("/", async (c) => {
   if (!file) {
     const errorText = i18n._(
       msg({
-        message: "No file provided",
+        message: "No file selected. Choose a file to upload.",
         comment: "@context: Error when no file was selected for upload",
       }),
     );
@@ -165,7 +156,9 @@ uploadApiRoutes.post("/", async (c) => {
   }
 
   // Validate file type and size
-  const uploadError = validateUploadFile(file);
+  const uploadError = validateUploadFile(file, {
+    maxFileSizeMB: c.var.appConfig.uploadMaxFileSize,
+  });
   if (uploadError) {
     if (wantsSSE(c)) {
       return sseUploadError(c, uploadError);
@@ -177,11 +170,77 @@ uploadApiRoutes.post("/", async (c) => {
   const { id, filename, storageKey } = generateStorageKey(file.name);
 
   try {
-    // Upload to storage
-    await storage.put(storageKey, file.stream(), {
+    // Read optional summary (provided for text attachments)
+    let summary = (formData.get("summary") as string) || undefined;
+    let chars: number | undefined;
+    // Buffer for text files — file.stream() may not work after file.text()
+    let textBuffer: Uint8Array | undefined;
+
+    // Extract summary and char count BEFORE consuming the stream for storage,
+    // because file.text() may not work after file.stream() is consumed.
+    if (
+      file.type === "text/plain" ||
+      file.type === "text/markdown" ||
+      file.type === "text/csv"
+    ) {
+      try {
+        const textContent = await file.text();
+        textBuffer = new TextEncoder().encode(textContent);
+        chars = textContent.length;
+        if (!summary) {
+          summary = textContent.slice(0, 100).trim() || undefined;
+        }
+      } catch {
+        // Ignore — summary and chars are optional
+      }
+    } else if (file.type === "text/x-tiptap+json") {
+      try {
+        const raw = await file.text();
+        textBuffer = new TextEncoder().encode(raw);
+        const envelope = JSON.parse(raw) as {
+          json?: { content?: unknown[] };
+          html?: string;
+        };
+        // Walk the TipTap JSON tree to extract plain text
+        if (envelope.json) {
+          let text = "";
+          const walk = (node: Record<string, unknown>) => {
+            if (typeof node.text === "string") text += node.text;
+            if (Array.isArray(node.content))
+              (node.content as Record<string, unknown>[]).forEach(walk);
+          };
+          walk(envelope.json as Record<string, unknown>);
+          chars = text.length;
+        }
+      } catch {
+        // Ignore — chars is optional
+      }
+    }
+
+    // Upload to storage — use buffered bytes for text files (stream may be consumed)
+    await storage.put(storageKey, textBuffer ?? file.stream(), {
       contentType: file.type,
     });
 
+    // Read optional client-side metadata
+    const widthRaw = parseInt(formData.get("width") as string) || undefined;
+    const heightRaw = parseInt(formData.get("height") as string) || undefined;
+    const blurhashRaw = (formData.get("blurhash") as string) || undefined;
+    const waveformRaw = (formData.get("waveform") as string) || undefined;
+
+    // Upload poster frame for videos (if provided by client)
+    let posterKey: string | undefined;
+    const posterFile = formData.get("poster") as File | null;
+    if (posterFile && file.type.startsWith("video/")) {
+      const date = new Date();
+      const year = date.getUTCFullYear();
+      const month = String(date.getUTCMonth() + 1).padStart(2, "0");
+      posterKey = `media/${year}/${month}/${id}-poster.webp`;
+      await storage.put(posterKey, posterFile.stream(), {
+        contentType: "image/webp",
+      });
+    }
+
     // Save to database
     const media = await c.var.services.media.create({
       id,
@@ -191,6 +250,15 @@ uploadApiRoutes.post("/", async (c) => {
       size: file.size,
       storageKey,
       provider: c.var.appConfig.storageDriver,
+      width: widthRaw && widthRaw > 0 ? widthRaw : undefined,
+      height: heightRaw && heightRaw > 0 ? heightRaw : undefined,
+      blurhash:
+        blurhashRaw && blurhashRaw.length < 200 ? blurhashRaw : undefined,
+      waveform:
+        waveformRaw && waveformRaw.length < 2000 ? waveformRaw : undefined,
+      posterKey,
+      summary,
+      chars,
     });
 
     // SSE response for Datastar
@@ -215,7 +283,7 @@ uploadApiRoutes.post("/", async (c) => {
         await stream.toast(
           i18n._(
             msg({
-              message: "Upload successful!",
+              message: "File uploaded.",
               comment: "@context: Toast after successful file upload",
             }),
           ),
@@ -243,7 +311,7 @@ uploadApiRoutes.post("/", async (c) => {
 
     const errorText = i18n._(
       msg({
-        message: "Upload failed. Please try again.",
+        message: "Upload didn't go through. Try again in a moment.",
         comment: "@context: Error when file upload fails",
       }),
     );

package/src/routes/auth/__tests__/setup.test.ts

@@ -1,20 +1,16 @@
 import { describe, it, expect, beforeEach } from "vitest";
 import { createTestDatabase } from "../../../__tests__/helpers/db.js";
-import { createPageService } from "../../../services/page.js";
 import { createSettingsService } from "../../../services/settings.js";
 import { createNavItemService } from "../../../services/navigation.js";
-import { createPathRegistryService } from "../../../services/path-registry.js";
 import type { Database } from "../../../db/index.js";
-import type { PageService } from "../../../services/page.js";
 import type { SettingsService } from "../../../services/settings.js";
 import type { NavItemService } from "../../../services/navigation.js";
 
 /**
- * Reproduces the seed logic from POST /setup to verify the default About page
- * and navigation items are created correctly.
+ * Reproduces the seed logic from POST /setup to verify the default
+ * navigation items are created correctly.
  */
 async function runSetupSeed(services: {
-  pages: PageService;
   settings: SettingsService;
   navItems: NavItemService;
 }) {
@@ -30,31 +26,20 @@ async function runSetupSeed(services: {
     label: "Archive",
     url: "/archive",
   });
-
-  const aboutPage = await services.pages.create({
-    slug: "about",
-    title: "About",
-    body: [
-      "Welcome to my corner of the internet.",
-      "",
-      "This is a place where I share my thoughts, ideas, and things I find interesting. Feel free to look around and get to know what this site is all about.",
-      "",
-      "If you'd like to get in touch, don't hesitate to reach out.",
-    ].join("\n"),
-    status: "published",
+  await services.navItems.create({
+    type: "system",
+    label: "RSS",
+    url: "/feed",
   });
-
   await services.navItems.create({
-    type: "page",
-    label: "About",
-    url: "/about",
-    pageId: aboutPage.id,
+    type: "system",
+    label: "Settings",
+    url: "/settings",
   });
 }
 
 describe("Setup seed logic", () => {
   let services: {
-    pages: PageService;
     settings: SettingsService;
     navItems: NavItemService;
   };
@@ -63,57 +48,32 @@ describe("Setup seed logic", () => {
     const testDb = createTestDatabase();
     const db = testDb.db as unknown as Database;
     services = {
-      pages: createPageService(db, createPathRegistryService(db)),
       settings: createSettingsService(db),
       navItems: createNavItemService(db),
     };
   });
 
-  it("creates a default About page with correct content", async () => {
-    await runSetupSeed(services);
-
-    const aboutPage = await services.pages.getBySlug("about");
-    expect(aboutPage).not.toBeNull();
-    expect(aboutPage?.title).toBe("About");
-    expect(aboutPage?.status).toBe("published");
-    expect(aboutPage?.body).toContain("Welcome to my corner of the internet");
-    expect(aboutPage?.bodyHtml).toBeTruthy();
-  });
-
-  it("adds About page to navigation as a page-type nav item", async () => {
+  it("creates four nav items: Collections, Archive, RSS, Settings", async () => {
     await runSetupSeed(services);
 
-    const aboutPage = await services.pages.getBySlug("about");
     const navItemsList = await services.navItems.list();
-
-    const aboutNavItem = navItemsList.find(
-      (item) => item.pageId === aboutPage?.id,
-    );
-    expect(aboutNavItem).toBeDefined();
-    expect(aboutNavItem?.type).toBe("page");
-    expect(aboutNavItem?.label).toBe("About");
-    expect(aboutNavItem?.url).toBe("/about");
-  });
-
-  it("creates three nav items total: Collections, Archive, About", async () => {
-    await runSetupSeed(services);
-
-    const navItemsList = await services.navItems.list();
-    expect(navItemsList).toHaveLength(3);
+    expect(navItemsList).toHaveLength(4);
 
     const labels = navItemsList.map((item) => item.label);
     expect(labels).toContain("Collections");
     expect(labels).toContain("Archive");
-    expect(labels).toContain("About");
+    expect(labels).toContain("RSS");
+    expect(labels).toContain("Settings");
   });
 
-  it("renders About page body as HTML", async () => {
+  it("creates link and system type nav items", async () => {
     await runSetupSeed(services);
 
-    const aboutPage = await services.pages.getBySlug("about");
-    expect(aboutPage?.bodyHtml).toContain("<p>");
-    expect(aboutPage?.bodyHtml).toContain(
-      "Welcome to my corner of the internet",
-    );
+    const navItemsList = await services.navItems.list();
+    const linkItems = navItemsList.filter((item) => item.type === "link");
+    const systemItems = navItemsList.filter((item) => item.type === "system");
+
+    expect(linkItems).toHaveLength(2);
+    expect(systemItems).toHaveLength(2);
   });
 });

package/src/routes/auth/reset.tsx

@@ -37,7 +37,7 @@ const ResetContent: FC<{ token: string }> = ({ token }) => {
           </h2>
           <p>
             {t({
-              message: "Enter your new password.",
+              message: "Choose a new password.",
               comment: "@context: Password reset page description",
             })}
           </p>
@@ -118,7 +118,7 @@ const ResetErrorContent: FC = () => {
         <header>
           <h2>
             {t({
-              message: "Invalid or Expired Link",
+              message: "This Link Has Expired",
               comment: "@context: Password reset error heading",
             })}
           </h2>
@@ -127,7 +127,7 @@ const ResetErrorContent: FC = () => {
           <p class="text-muted-foreground">
             {t({
               message:
-                "This password reset link is invalid or has expired. Please generate a new one.",
+                "This reset link is no longer valid. Request a new one to continue.",
               comment: "@context: Password reset error description",
             })}
           </p>
@@ -175,7 +175,8 @@ resetRoutes.post("/reset", async (c) => {
       parsed.error.issues[0]?.message ??
       i18n._(
         msg({
-          message: "Invalid input",
+          message:
+            "Something doesn't look right. Check the form and try again.",
           comment:
             "@context: Fallback validation error for password reset form",
         }),