@nextsparkjs/core 0.1.0-beta.92 → 0.1.0-beta.94

package/dist/templates/app/api/v1/media/[id]/route.ts

@@ -0,0 +1,144 @@
+import { NextRequest } from 'next/server'
+import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
+import { updateMediaSchema } from '@nextsparkjs/core/lib/media/schemas'
+
+/**
+ * GET /api/v1/media/:id
+ *
+ * Get a single media item by ID.
+ *
+ * Authentication: Requires valid session or API key with media:read scope
+ * RLS: Returns only media from teams the user is a member of
+ */
+export const GET = withRateLimitTier(async (
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) => {
+  try {
+    // 1. Authenticate
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    // 2. Check permissions
+    if (!hasRequiredScope(authResult, 'media:read')) {
+      return createApiError('Insufficient permissions', 403)
+    }
+
+    // 3. Get media ID from params
+    const { id } = await params
+
+    // 4. Fetch media with RLS
+    const media = await MediaService.getById(id, authResult.user!.id)
+
+    if (!media) {
+      return createApiError('Media not found', 404)
+    }
+
+    return createApiResponse(media)
+  } catch (error) {
+    console.error('[Media API] Error fetching media:', error)
+    return createApiError('Failed to fetch media', 500)
+  }
+}, 'read')
+
+/**
+ * PATCH /api/v1/media/:id
+ *
+ * Update media metadata (alt text and caption).
+ * File properties (url, filename, size, dimensions) are immutable.
+ *
+ * Request Body:
+ * - alt: Alt text for accessibility (max 500 characters, optional)
+ * - caption: Caption or description (max 1000 characters, optional)
+ *
+ * Authentication: Requires valid session or API key with media:write scope
+ * RLS: Can only update media from teams the user is a member of
+ */
+export const PATCH = withRateLimitTier(async (
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) => {
+  try {
+    // 1. Authenticate
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    // 2. Check permissions
+    if (!hasRequiredScope(authResult, 'media:write')) {
+      return createApiError('Insufficient permissions', 403)
+    }
+
+    // 3. Get media ID from params
+    const { id } = await params
+
+    // 4. Parse and validate request body
+    const body = await request.json()
+    const parsed = updateMediaSchema.safeParse(body)
+
+    if (!parsed.success) {
+      return createApiError('Validation failed', 400, {
+        errors: parsed.error.issues,
+      })
+    }
+
+    // 5. Update media with RLS
+    const media = await MediaService.update(id, authResult.user!.id, parsed.data)
+
+    return createApiResponse(media)
+  } catch (error) {
+    console.error('[Media API] Error updating media:', error)
+    return createApiError(
+      error instanceof Error ? error.message : 'Failed to update media',
+      500
+    )
+  }
+}, 'write')
+
+/**
+ * DELETE /api/v1/media/:id
+ *
+ * Soft delete a media item (sets status to 'deleted').
+ * The file remains in storage but is hidden from queries.
+ *
+ * Authentication: Requires valid session or API key with media:delete scope
+ * RLS: Can only delete media from teams the user is a member of
+ */
+export const DELETE = withRateLimitTier(async (
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) => {
+  try {
+    // 1. Authenticate
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    // 2. Check permissions
+    if (!hasRequiredScope(authResult, 'media:delete')) {
+      return createApiError('Insufficient permissions', 403)
+    }
+
+    // 3. Get media ID from params
+    const { id } = await params
+
+    // 4. Soft delete media with RLS
+    const deleted = await MediaService.softDelete(id, authResult.user!.id)
+
+    if (!deleted) {
+      return createApiError('Media not found', 404)
+    }
+
+    return createApiResponse({ message: 'Media deleted successfully' })
+  } catch (error) {
+    console.error('[Media API] Error deleting media:', error)
+    return createApiError('Failed to delete media', 500)
+  }
+}, 'write')

package/dist/templates/app/api/v1/media/[id]/tags/route.ts

@@ -0,0 +1,154 @@
+import { NextRequest } from 'next/server'
+import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
+import { z } from 'zod'
+
+const addTagSchema = z.object({
+  tagId: z.string().min(1),
+})
+
+const setTagsSchema = z.object({
+  tagIds: z.array(z.string().min(1)),
+})
+
+/**
+ * GET /api/v1/media/{id}/tags
+ *
+ * Get all tags assigned to a media item.
+ */
+export const GET = withRateLimitTier(async (
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) => {
+  try {
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    if (!hasRequiredScope(authResult, 'media:read')) {
+      return createApiError('Insufficient permissions', 403)
+    }
+
+    const { id } = await params
+    const tags = await MediaService.getMediaTags(id, authResult.user!.id)
+    return createApiResponse(tags)
+  } catch (error) {
+    console.error('[Media Tags API] Error getting tags:', error)
+    return createApiError('Failed to get media tags', 500)
+  }
+}, 'read')
+
+/**
+ * POST /api/v1/media/{id}/tags
+ *
+ * Add a tag to a media item.
+ * Body: { tagId: string }
+ */
+export const POST = withRateLimitTier(async (
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) => {
+  try {
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    if (!hasRequiredScope(authResult, 'media:write')) {
+      return createApiError('Insufficient permissions', 403)
+    }
+
+    const { id } = await params
+    const body = await request.json()
+    const parsed = addTagSchema.safeParse(body)
+
+    if (!parsed.success) {
+      return createApiError('Invalid request body', 400, { errors: parsed.error.issues })
+    }
+
+    await MediaService.addTag(id, parsed.data.tagId, authResult.user!.id)
+    const tags = await MediaService.getMediaTags(id, authResult.user!.id)
+
+    return createApiResponse(tags, undefined, 201)
+  } catch (error) {
+    console.error('[Media Tags API] Error adding tag:', error)
+    return createApiError('Failed to add tag', 500)
+  }
+}, 'write')
+
+/**
+ * PUT /api/v1/media/{id}/tags
+ *
+ * Replace all tags for a media item.
+ * Body: { tagIds: string[] }
+ */
+export const PUT = withRateLimitTier(async (
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) => {
+  try {
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    if (!hasRequiredScope(authResult, 'media:write')) {
+      return createApiError('Insufficient permissions', 403)
+    }
+
+    const { id } = await params
+    const body = await request.json()
+    const parsed = setTagsSchema.safeParse(body)
+
+    if (!parsed.success) {
+      return createApiError('Invalid request body', 400, { errors: parsed.error.issues })
+    }
+
+    await MediaService.setTags(id, parsed.data.tagIds, authResult.user!.id)
+    const tags = await MediaService.getMediaTags(id, authResult.user!.id)
+
+    return createApiResponse(tags)
+  } catch (error) {
+    console.error('[Media Tags API] Error setting tags:', error)
+    return createApiError('Failed to set tags', 500)
+  }
+}, 'write')
+
+/**
+ * DELETE /api/v1/media/{id}/tags
+ *
+ * Remove a tag from a media item.
+ * Query parameter: tagId
+ */
+export const DELETE = withRateLimitTier(async (
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) => {
+  try {
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    if (!hasRequiredScope(authResult, 'media:delete')) {
+      return createApiError('Insufficient permissions', 403)
+    }
+
+    const { id } = await params
+    const { searchParams } = new URL(request.url)
+    const tagId = searchParams.get('tagId')
+
+    if (!tagId) {
+      return createApiError('tagId query parameter is required', 400)
+    }
+
+    await MediaService.removeTag(id, tagId, authResult.user!.id)
+    return createApiResponse({ success: true })
+  } catch (error) {
+    console.error('[Media Tags API] Error removing tag:', error)
+    return createApiError('Failed to remove tag', 500)
+  }
+}, 'write')

package/dist/templates/app/api/v1/media/check-duplicates/route.ts

@@ -0,0 +1,56 @@
+import { NextRequest } from 'next/server'
+import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
+
+/**
+ * POST /api/v1/media/check-duplicates
+ *
+ * Check if files with the same name+size already exist in the media library.
+ * Used by the upload zone to warn users before uploading duplicates.
+ *
+ * Body: { files: [{ filename: string, fileSize: number }] }
+ * Returns: { duplicates: [{ filename, fileSize, existing: Media[] }] }
+ */
+export const POST = withRateLimitTier(async (request: NextRequest) => {
+  try {
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    if (!hasRequiredScope(authResult, 'media:read')) {
+      return createApiError('Insufficient permissions - media:read scope required', 403)
+    }
+
+    const body = await request.json()
+    const files = body.files as { filename: string; fileSize: number }[]
+
+    if (!files || !Array.isArray(files) || files.length === 0) {
+      return createApiError('files array is required', 400)
+    }
+
+    const duplicates: { filename: string; fileSize: number; existing: { id: string; url: string; createdAt: string }[] }[] = []
+
+    for (const file of files) {
+      const existing = await MediaService.findDuplicates(
+        authResult.user!.id,
+        file.filename,
+        file.fileSize
+      )
+      if (existing.length > 0) {
+        duplicates.push({
+          filename: file.filename,
+          fileSize: file.fileSize,
+          existing: existing.map(m => ({ id: m.id, url: m.url, createdAt: m.createdAt })),
+        })
+      }
+    }
+
+    return createApiResponse({ duplicates })
+  } catch (error) {
+    console.error('Error checking duplicates:', error)
+    return createApiError('Failed to check duplicates', 500)
+  }
+}, 'read')

package/dist/templates/app/api/v1/media/route.ts

@@ -0,0 +1,56 @@
+import { NextRequest } from 'next/server'
+import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
+import { mediaListQuerySchema } from '@nextsparkjs/core/lib/media/schemas'
+
+/**
+ * GET /api/v1/media
+ *
+ * List media files with pagination, filtering, and search.
+ * Supports filtering by type (image/video), searching by filename, and sorting.
+ *
+ * Query Parameters:
+ * - limit: Number of items per page (default: 20, max: 100)
+ * - offset: Number of items to skip (default: 0)
+ * - orderBy: Sort field (createdAt|filename|fileSize, default: createdAt)
+ * - orderDir: Sort direction (asc|desc, default: desc)
+ * - type: Filter by type (image|video|all, default: all)
+ * - search: Search by filename (case-insensitive)
+ *
+ * Authentication: Requires valid session or API key with media:read scope
+ * RLS: Returns only media from teams the user is a member of
+ */
+export const GET = withRateLimitTier(async (request: NextRequest) => {
+  try {
+    // 1. Authenticate
+    const authResult = await authenticateRequest(request)
+    if (!authResult.success) {
+      return createApiError('Unauthorized', 401)
+    }
+
+    // 2. Check permissions
+    if (!hasRequiredScope(authResult, 'media:read')) {
+      return createApiError('Insufficient permissions - media:read scope required', 403)
+    }
+
+    // 3. Parse and validate query parameters
+    const { searchParams } = new URL(request.url)
+    const parsed = mediaListQuerySchema.safeParse(Object.fromEntries(searchParams))
+
+    if (!parsed.success) {
+      return createApiError('Invalid query parameters', 400, {
+        errors: parsed.error.issues,
+      })
+    }
+
+    // 4. Query media list with RLS
+    const result = await MediaService.list(authResult.user!.id, parsed.data)
+
+    return createApiResponse(result)
+  } catch (error) {
+    console.error('[Media API] Error listing media:', error)
+    return createApiError('Failed to list media', 500)
+  }
+}, 'read')

package/dist/templates/app/api/v1/media/upload/route.ts

@@ -2,8 +2,56 @@ import { NextRequest } from 'next/server'
 import { put } from '@vercel/blob'
 import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { createApiResponse, createApiError } from '@nextsparkjs/core/lib/api/helpers'
+import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
+import { MEDIA_CONFIG } from '@nextsparkjs/core/lib/config/config-sync'
+import { MediaService } from '@nextsparkjs/core/lib/services/media.service'
+import { extractImageDimensions } from '@nextsparkjs/core/lib/media/utils'
+import type { Media } from '@nextsparkjs/core/lib/media/types'
+import { writeFile, mkdir } from 'fs/promises'
+import { join } from 'path'
+import { existsSync } from 'fs'
 
-export async function POST(request: NextRequest) {
+// Check if Vercel Blob is configured
+// NOTE: We use Vercel Blob even in development when available because some external APIs
+// (like social media platforms) cannot access localhost URLs - they need publicly accessible URLs
+const isVercelBlobConfigured = () => {
+  const token = process.env.BLOB_READ_WRITE_TOKEN
+  return !!token && token.startsWith('vercel_blob_')
+}
+
+// Local storage fallback - accepts buffer directly
+// Used when Vercel Blob is not configured or fails
+async function uploadToLocalStorageBuffer(buffer: Buffer, fileName: string): Promise<string> {
+  const uploadDir = join(process.cwd(), 'public', 'uploads', 'temp')
+
+  // Create directory if it doesn't exist
+  if (!existsSync(uploadDir)) {
+    await mkdir(uploadDir, { recursive: true })
+  }
+
+  const filePath = join(uploadDir, fileName)
+  await writeFile(filePath, buffer)
+
+  // Return relative URL that can be served from public folder
+  return `/uploads/temp/${fileName}`
+}
+
+/**
+ * POST /api/v1/media/upload
+ *
+ * Upload media files (images and videos).
+ * Enhanced version that creates database records for uploaded files.
+ *
+ * Features:
+ * - Uploads files to Vercel Blob (production) or local storage (development)
+ * - Creates media records in database for tracking
+ * - Extracts image dimensions automatically
+ * - Returns both legacy URLs array and new media records array
+ *
+ * Authentication: Requires valid session or API key with media:write scope
+ * RLS: Media records are associated with user's active team
+ */
+export const POST = withRateLimitTier(async (request: NextRequest) => {
   try {
     // 1. Dual Authentication (API Key OR Session)
     const authResult = await authenticateRequest(request)
@@ -19,6 +67,16 @@ export async function POST(request: NextRequest) {
       return createApiError('Insufficient permissions - media:write scope required', 403)
     }
 
+    // 3. Get team context (x-team-id header or default team)
+    const teamId = request.headers.get('x-team-id') || authResult.user!.defaultTeamId
+
+    if (!teamId) {
+      return createApiError(
+        'No team context available. Please provide x-team-id header or have a default team.',
+        400
+      )
+    }
+
     const formData = await request.formData()
     const files = formData.getAll('files') as File[]
 
@@ -27,23 +85,21 @@ export async function POST(request: NextRequest) {
     }
 
     const uploadedUrls: string[] = []
+    const uploadedMedia: Media[] = []
+    const useVercelBlob = isVercelBlobConfigured()
+
+    console.log(`📤 [Media Upload] Storage mode: ${useVercelBlob ? 'Vercel Blob' : 'Local Storage'}`)
+    console.log(`📤 [Media Upload] Team context: ${teamId}`)
 
     for (const file of files) {
       if (!file.size) {
         continue // Skip empty files
       }
 
-      // Validate file type (images and videos)
-      const allowedTypes = [
-        'image/jpeg',
-        'image/jpg',
-        'image/png',
-        'image/gif',
-        'image/webp',
-        'video/mp4',
-        'video/mpeg',
-        'video/quicktime',
-        'video/webm'
+      // Validate file type using config (theme-overridable)
+      const allowedTypes = MEDIA_CONFIG?.allowedMimeTypes ?? [
+        'image/jpeg', 'image/jpg', 'image/png', 'image/gif', 'image/webp',
+        'video/mp4', 'video/mpeg', 'video/quicktime', 'video/webm',
       ]
 
       if (!allowedTypes.includes(file.type)) {
@@ -54,32 +110,88 @@ export async function POST(request: NextRequest) {
         )
       }
 
-      // Validate file size (max 10MB)
-      const maxSize = 10 * 1024 * 1024 // 10MB
+      // Determine max size based on file type category (theme-overridable)
+      const defaultMaxSizeMB = MEDIA_CONFIG?.maxSizeMB ?? 10
+      let maxSizeMB = defaultMaxSizeMB
+      if (file.type.startsWith('image/') && MEDIA_CONFIG?.maxSizeImageMB != null) {
+        maxSizeMB = MEDIA_CONFIG.maxSizeImageMB
+      } else if (file.type.startsWith('video/') && MEDIA_CONFIG?.maxSizeVideoMB != null) {
+        maxSizeMB = MEDIA_CONFIG.maxSizeVideoMB
+      }
+      const maxSize = maxSizeMB * 1024 * 1024
       if (file.size > maxSize) {
         return createApiError(
-          `File ${file.name} is too large. Maximum size is 10MB.`,
+          `File ${file.name} is too large. Maximum size is ${maxSizeMB}MB.`,
           400,
-          { maxSize: '10MB', fileSize: `${(file.size / 1024 / 1024).toFixed(2)}MB` }
+          { maxSize: `${maxSizeMB}MB`, fileSize: `${(file.size / 1024 / 1024).toFixed(2)}MB` }
         )
       }
 
       // Generate unique filename
       const timestamp = Date.now()
       const randomString = Math.random().toString(36).substring(2, 15)
-      const extension = file.name.split('.').pop()
+      const extension = file.name.split('.').pop() || 'bin'
       const fileName = `${timestamp}_${randomString}.${extension}`
 
       try {
-        // Upload to Vercel Blob
-        const blob = await put(`uploads/temp/${fileName}`, file, {
-          access: 'public',
-          addRandomSuffix: false
-        })
+        let uploadedUrl: string
+
+        // Read file buffer once - needed for both Vercel Blob and local storage
+        // Important: File stream can only be read once, so we buffer it first
+        const fileBuffer = Buffer.from(await file.arrayBuffer())
+
+        if (useVercelBlob) {
+          // Try Vercel Blob first - use buffer with content type
+          try {
+            const blob = await put(`uploads/temp/${fileName}`, fileBuffer, {
+              access: 'public',
+              addRandomSuffix: false,
+              contentType: file.type
+            })
+            uploadedUrl = blob.url
+            console.log(`✅ [Media Upload] Uploaded to Vercel Blob: ${uploadedUrl}`)
+          } catch (blobError) {
+            // Fallback to local storage if Vercel Blob fails
+            console.warn(`⚠️ [Media Upload] Vercel Blob failed, falling back to local storage:`, blobError)
+            uploadedUrl = await uploadToLocalStorageBuffer(fileBuffer, fileName)
+            console.log(`✅ [Media Upload] Uploaded to local storage (fallback): ${uploadedUrl}`)
+          }
+        } else {
+          // Use local storage directly
+          uploadedUrl = await uploadToLocalStorageBuffer(fileBuffer, fileName)
+          console.log(`✅ [Media Upload] Uploaded to local storage: ${uploadedUrl}`)
+        }
+
+        uploadedUrls.push(uploadedUrl)
+
+        // NEW: Create media record in database
+        try {
+          // Extract image dimensions if it's an image
+          const dimensions = await extractImageDimensions(fileBuffer, file.type)
+
+          const mediaRecord = await MediaService.create(
+            authResult.user!.id,
+            teamId,
+            {
+              url: uploadedUrl,
+              filename: file.name,
+              fileSize: file.size,
+              mimeType: file.type,
+              width: dimensions?.width ?? null,
+              height: dimensions?.height ?? null,
+            }
+          )
+
+          uploadedMedia.push(mediaRecord)
+          console.log(`✅ [Media Upload] Created media record: ${mediaRecord.id}`)
+        } catch (dbError) {
+          // Graceful degradation: If DB insert fails, still return the URL
+          console.warn(`⚠️ [Media Upload] Failed to create media record:`, dbError)
+          // Continue - upload succeeded even if DB insert failed
+        }
 
-        uploadedUrls.push(blob.url)
       } catch (fileError) {
-        console.error(`❌ Failed to upload ${file.name} to Vercel Blob:`)
+        console.error(`❌ Failed to upload ${file.name}:`)
         console.error(`❌ Error details:`, fileError)
 
         const errorMessage = fileError instanceof Error ? fileError.message : String(fileError)
@@ -97,10 +209,13 @@ export async function POST(request: NextRequest) {
       }
     }
 
+    // Return both legacy URLs array AND new media records array (backward compatible)
     return createApiResponse({
       message: 'Files uploaded successfully',
-      urls: uploadedUrls,
-      count: uploadedUrls.length
+      urls: uploadedUrls,          // LEGACY: backward compatible
+      media: uploadedMedia,        // NEW: full media records
+      count: uploadedUrls.length,
+      storage: useVercelBlob ? 'vercel-blob' : 'local'
     })
 
   } catch (error) {
@@ -111,10 +226,14 @@ export async function POST(request: NextRequest) {
       { error: error instanceof Error ? error.message : String(error) }
     )
   }
-}
+}, 'write');
 
-// Optional: Add a GET endpoint to get upload info
-export async function GET(request: NextRequest) {
+/**
+ * GET /api/v1/media/upload
+ *
+ * Get upload endpoint information.
+ */
+export const GET = withRateLimitTier(async (request: NextRequest) => {
   try {
     // 1. Dual Authentication (API Key OR Session)
     const authResult = await authenticateRequest(request)
@@ -130,13 +249,18 @@ export async function GET(request: NextRequest) {
       return createApiError('Insufficient permissions - media:read scope required', 403)
     }
 
+    const useVercelBlob = isVercelBlobConfigured()
+
     // This could be used for cleanup or management
+    const maxSizeMB = MEDIA_CONFIG?.maxSizeMB ?? 10
     return createApiResponse({
       message: 'Media upload endpoint is active',
-      storage: 'Vercel Blob',
+      storage: useVercelBlob ? 'Vercel Blob' : 'Local Storage',
       uploadPath: 'uploads/temp/',
-      supportedTypes: ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'video/mp4', 'video/webm'],
-      maxFileSize: '10MB'
+      supportedTypes: MEDIA_CONFIG?.allowedMimeTypes ?? ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'video/mp4', 'video/webm'],
+      maxFileSize: `${maxSizeMB}MB`,
+      ...(MEDIA_CONFIG?.maxSizeImageMB != null && { maxImageSize: `${MEDIA_CONFIG.maxSizeImageMB}MB` }),
+      ...(MEDIA_CONFIG?.maxSizeVideoMB != null && { maxVideoSize: `${MEDIA_CONFIG.maxSizeVideoMB}MB` }),
     })
 
   } catch (error) {
@@ -147,4 +271,4 @@ export async function GET(request: NextRequest) {
       { error: error instanceof Error ? error.message : String(error) }
     )
   }
-}
+}, 'read');