@rubytech/create-maxy-code 0.1.459 → 0.1.460

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/session.ts

@@ -0,0 +1,85 @@
+import type { D1Database } from './types'
+
+// Server-side sessions in D1 rather than a signed stateless token: a signed
+// token needs a signing secret provisioned into the Pages env, a secret
+// lifecycle this plugin does not have. D1 needs no secret and is revocable.
+// The cost is one D1 read per request.
+//
+// "Revocable" is a claim this module has to actually honour, so revocation is
+// structural rather than procedural. Each session records `pcCheck`, a short
+// digest of the person's passcode hash at mint time, and resolveSession joins
+// `people` and requires it to still match. Rotating a passcode necessarily
+// changes the hash, so every session minted against the old one stops
+// resolving with no cleanup step to remember and no window to wait out.
+// Unenrolling a person kills their sessions by the same join.
+
+export const SESSION_TTL_MS = 43_200_000 // 12 hours
+
+// The __Host- prefix is the only thing a browser enforces against a cookie set
+// on a sibling subdomain with Domain=.example.com shadowing this one — which
+// would let an attacker fix a victim's session and receive their uploads. It
+// requires Secure, Path=/, and no Domain; the Set-Cookie in auth.ts meets all
+// three.
+export const SESSION_COOKIE = '__Host-__portal_session'
+
+/** The stored session-vs-passcode check. A prefix of an already-irreversible
+ *  hash, kept next to it in the same database — it exposes nothing new. */
+export function passcodeCheck(hash: string): string {
+  return hash.slice(0, 16)
+}
+
+export async function mintSession(
+  db: D1Database,
+  ownerId: string,
+  sessionId: string,
+  nowMs: number,
+  pcCheck: string,
+): Promise<string> {
+  await db
+    .prepare(
+      'INSERT INTO sessions (sessionId, ownerId, pcCheck, expiresAt, createdAt) VALUES (?, ?, ?, ?, ?)',
+    )
+    .bind(sessionId, ownerId, pcCheck, nowMs + SESSION_TTL_MS, new Date(nowMs).toISOString())
+    .run()
+  // Opportunistic GC: expired rows are dead weight and nothing else prunes
+  // them. Scoped to this owner so it stays a small, indexed delete.
+  await db
+    .prepare('DELETE FROM sessions WHERE ownerId = ? AND expiresAt <= ?')
+    .bind(ownerId, nowMs)
+    .run()
+  return sessionId
+}
+
+export async function resolveSession(
+  db: D1Database,
+  sessionId: string,
+  nowMs: number,
+): Promise<{ ownerId: string } | null> {
+  if (!sessionId) return null
+  const row = await db
+    .prepare(
+      `SELECT s.ownerId AS ownerId
+         FROM sessions s
+         JOIN people p ON p.ownerId = s.ownerId
+        WHERE s.sessionId = ?
+          AND s.expiresAt > ?
+          AND s.pcCheck = substr(p.hash, 1, 16)`,
+    )
+    .bind(sessionId, nowMs)
+    .first<{ ownerId: string }>()
+  return row && typeof row.ownerId === 'string' ? { ownerId: row.ownerId } : null
+}
+
+export function readSessionCookie(header: string | null): string | null {
+  if (!header) return null
+  for (const part of header.split(';')) {
+    const [name, ...rest] = part.trim().split('=')
+    if (name !== SESSION_COOKIE) continue
+    const value = rest.join('=')
+    // Keep scanning rather than returning on the first match: a planted
+    // valueless duplicate sorted first would otherwise blank the real session,
+    // which is a persistent logout denial-of-service.
+    if (value) return value
+  }
+  return null
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/types.ts

@@ -0,0 +1,44 @@
+// Structural interfaces for the Pages runtime bindings this portal uses.
+// Declared here rather than imported from @cloudflare/workers-types (not a
+// dependency in this repo) so every function below is testable with a
+// hand-rolled fake — the choice book.ts:12-24 already makes.
+
+export interface D1Result<T = Record<string, unknown>> {
+  results?: T[]
+  meta?: { changes?: number }
+}
+
+export interface D1PreparedStatement {
+  bind: (...values: unknown[]) => D1PreparedStatement
+  run: () => Promise<D1Result>
+  all: <T = Record<string, unknown>>() => Promise<D1Result<T>>
+  first: <T = Record<string, unknown>>() => Promise<T | null>
+}
+
+export interface D1Database {
+  prepare: (query: string) => D1PreparedStatement
+}
+
+export interface R2ObjectBody {
+  body: ReadableStream | null
+  size: number
+}
+
+export interface R2Bucket {
+  put: (key: string, value: ArrayBuffer | Uint8Array) => Promise<unknown>
+  get: (key: string) => Promise<R2ObjectBody | null>
+  delete: (key: string) => Promise<void>
+  head: (key: string) => Promise<{ size: number } | null>
+}
+
+export interface PortalEnv {
+  DB: D1Database
+  BUCKET: R2Bucket
+}
+
+export type Logger = (line: string) => void
+
+export interface Handler {
+  status: number
+  payload: Record<string, unknown>
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/auth.ts

@@ -0,0 +1,113 @@
+import type { Handler, Logger, PortalEnv } from './_lib/types'
+import { PBKDF2_ITERATIONS, verifyPasscode } from './_lib/passcode'
+import { checkAndRecordAttempt, clearAttempts, rateScope } from './_lib/ratelimit'
+import { SESSION_COOKIE, SESSION_TTL_MS, mintSession, passcodeCheck } from './_lib/session'
+import { q } from './_lib/log'
+
+export interface AuthBody {
+  ownerId?: unknown
+  passcode?: unknown
+}
+
+interface AuthResult extends Handler {
+  sessionId?: string
+}
+
+// Same denial payload for a wrong passcode and an unknown owner: distinguishing
+// them would enumerate who is enrolled.
+const DENIED: Handler = { status: 401, payload: { ok: false, error: 'denied' } }
+
+// A real-shaped salt and hash used only to burn the same PBKDF2 cost when the
+// owner does not exist. Without it, an unknown owner returns after one D1 read
+// (single-digit ms) while a known one spends ~250ms deriving — a timing oracle
+// three orders of magnitude wide, which enumerates the enrolled people outright
+// and makes the identical DENIED payload above cosmetic.
+const DUMMY_SALT = '00000000000000000000000000000000'
+const DUMMY_HASH = '0'.repeat(64)
+
+export async function processAuth(
+  body: AuthBody,
+  env: PortalEnv,
+  log: Logger,
+  newId: () => string,
+  nowMs: number,
+  clientIp: string,
+): Promise<AuthResult> {
+  const ownerId = typeof body?.ownerId === 'string' ? body.ownerId : ''
+  const passcode = typeof body?.passcode === 'string' ? body.passcode : ''
+  if (!ownerId || !passcode) {
+    log('[data-portal] op=auth owner=none result=malformed')
+    return { status: 400, payload: { ok: false, error: 'ownerId and passcode required' } }
+  }
+
+  // Rate-limit BEFORE any passcode comparison, so a guessing loop is throttled
+  // rather than merely logged. The scope carries the client IP as well as the
+  // owner: keyed on the owner alone, the counter is a weapon — six requests
+  // naming a person lock that person out of their own portal for the window,
+  // from anywhere, unauthenticated.
+  const scope = rateScope(ownerId, clientIp)
+  const rate = await checkAndRecordAttempt(env.DB, scope, nowMs)
+  if (!rate.allowed) {
+    log(`[data-portal] op=auth owner=${q(ownerId)} result=rate-limited attempts=${rate.count}`)
+    return { status: 429, payload: { ok: false, error: 'too many attempts' } }
+  }
+
+  const person = await env.DB.prepare(
+    'SELECT ownerId, salt, hash, iterations FROM people WHERE ownerId = ?',
+  )
+    .bind(ownerId)
+    .first<{ ownerId: string; salt: string; hash: string; iterations: number }>()
+
+  if (!person) {
+    // Burn the same work an enrolled owner would cost, then deny identically.
+    await verifyPasscode(passcode, DUMMY_SALT, DUMMY_HASH, PBKDF2_ITERATIONS)
+    log(`[data-portal] op=auth owner=${q(ownerId)} result=denied reason=no-such-owner`)
+    return DENIED
+  }
+
+  const ok = await verifyPasscode(passcode, person.salt, person.hash, person.iterations)
+  if (!ok) {
+    log(`[data-portal] op=auth owner=${q(ownerId)} result=denied reason=bad-passcode`)
+    return DENIED
+  }
+
+  // A successful sign-in clears the counter. Without this, six legitimate
+  // sign-ins inside one window lock the person out of their own files.
+  await clearAttempts(env.DB, scope)
+
+  const sessionId = newId()
+  await mintSession(env.DB, ownerId, sessionId, nowMs, passcodeCheck(person.hash))
+  log(`[data-portal] op=auth owner=${q(ownerId)} result=ok`)
+  return { status: 200, payload: { ok: true }, sessionId }
+}
+
+interface PagesContext {
+  request: Request
+  env: PortalEnv
+}
+
+export async function onRequestPost(context: PagesContext): Promise<Response> {
+  let body: AuthBody
+  try {
+    body = (await context.request.json()) as AuthBody
+  } catch {
+    return Response.json({ ok: false, error: 'invalid JSON' }, { status: 400 })
+  }
+  const { status, payload, sessionId } = await processAuth(
+    body,
+    context.env,
+    (line) => console.log(line),
+    () => crypto.randomUUID(),
+    Date.now(),
+    context.request.headers.get('cf-connecting-ip') ?? 'unknown',
+  )
+  const res = Response.json(payload, { status })
+  if (sessionId) {
+    // Secure + Path=/ + no Domain are the __Host- prefix's preconditions.
+    res.headers.append(
+      'Set-Cookie',
+      `${SESSION_COOKIE}=${sessionId}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${SESSION_TTL_MS / 1000}`,
+    )
+  }
+  return res
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/delete.ts

@@ -0,0 +1,89 @@
+import type { Handler, Logger, PortalEnv } from './_lib/types'
+import { readSessionCookie, resolveSession } from './_lib/session'
+import { q } from './_lib/log'
+import { authorizeKey } from './_lib/authorize'
+
+export async function processDelete(
+  sessionId: string,
+  key: string,
+  env: PortalEnv,
+  log: Logger,
+  now: () => number,
+): Promise<Handler> {
+  const startedMs = now()
+  const session = await resolveSession(env.DB, sessionId, startedMs)
+  if (!session) {
+    log('[data-portal] op=delete owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  if (!authorizeKey(session.ownerId, key)) {
+    log(`[data-portal] op=delete owner=${q(session.ownerId)} result=denied reason=not-owner`)
+    return { status: 403, payload: { ok: false, error: 'denied' } }
+  }
+  const owner = q(session.ownerId)
+
+  // Both writes are wrapped and each emits its own line, mirroring upload's
+  // steps 3-5. Unwrapped, a throw here escapes the handler, Pages returns a
+  // bare 500, and NOTHING is logged — and if the R2 delete succeeded before the
+  // D1 delete threw, that silently manufactures a phantom row, which is exactly
+  // the failure class the deferred reconcile audit exists to catch. The
+  // lifeline that should have caught it must not be the thing that goes quiet.
+  try {
+    await env.BUCKET.delete(key)
+    log(`[data-portal] op=r2-delete owner=${owner} key=${q(key)} result=ok`)
+  } catch (err) {
+    log(
+      `[data-portal] op=r2-delete owner=${owner} key=${q(key)} result=failed err="${(err as Error).message}"`,
+    )
+    return { status: 502, payload: { ok: false, error: 'delete failed' } }
+  }
+
+  try {
+    await env.DB.prepare('DELETE FROM manifest WHERE objectKey = ?').bind(key).run()
+    log(`[data-portal] op=manifest-delete owner=${owner} key=${q(key)} result=ok`)
+  } catch (err) {
+    log(
+      `[data-portal] op=manifest-delete owner=${owner} key=${q(key)} result=failed err="${(err as Error).message}"`,
+    )
+    return { status: 502, payload: { ok: false, error: 'manifest delete failed' } }
+  }
+
+  // The verified post-condition: both sides re-read, not "we called delete".
+  const objectPresent = (await env.BUCKET.head(key)) !== null
+  const rowPresent =
+    (await env.DB.prepare('SELECT fileId FROM manifest WHERE objectKey = ?').bind(key).first()) !==
+    null
+  // Derived, never hardcoded: a failed delete printing result=ok next to
+  // objectPresent=true is a self-contradicting line.
+  const result = !objectPresent && !rowPresent ? 'ok' : 'incomplete'
+  log(
+    `[data-portal] op=complete owner=${owner} key=${q(key)} op2=delete ms=${now() - startedMs} result=${result} objectPresent=${objectPresent} rowPresent=${rowPresent}`,
+  )
+  return {
+    status: result === 'ok' ? 200 : 500,
+    payload: { ok: result === 'ok', objectPresent, rowPresent },
+  }
+}
+
+interface PagesContext {
+  request: Request
+  env: PortalEnv
+}
+
+export async function onRequestPost(context: PagesContext): Promise<Response> {
+  const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
+  let key = ''
+  try {
+    key = String(((await context.request.json()) as { key?: unknown }).key ?? '')
+  } catch {
+    return Response.json({ ok: false, error: 'invalid JSON' }, { status: 400 })
+  }
+  const { status, payload } = await processDelete(
+    sessionId,
+    key,
+    context.env,
+    (line) => console.log(line),
+    () => Date.now(),
+  )
+  return Response.json(payload, { status })
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/download.ts

@@ -0,0 +1,70 @@
+import type { Handler, Logger, PortalEnv, R2ObjectBody } from './_lib/types'
+import { readSessionCookie, resolveSession } from './_lib/session'
+import { q } from './_lib/log'
+import { authorizeKey } from './_lib/authorize'
+
+interface DownloadResult extends Handler {
+  body?: R2ObjectBody | null
+}
+
+export async function processDownload(
+  sessionId: string,
+  key: string,
+  env: PortalEnv,
+  log: Logger,
+  nowMs: number,
+): Promise<DownloadResult> {
+  const session = await resolveSession(env.DB, sessionId, nowMs)
+  if (!session) {
+    log('[data-portal] op=download owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  // Authorize BEFORE any R2 call, so a denied caller cannot cause a fetch.
+  if (!authorizeKey(session.ownerId, key)) {
+    log(`[data-portal] op=download owner=${q(session.ownerId)} result=denied reason=not-owner`)
+    return { status: 403, payload: { ok: false, error: 'denied' } }
+  }
+  const obj = await env.BUCKET.get(key)
+  if (!obj) {
+    log(`[data-portal] op=download owner=${q(session.ownerId)} result=absent`)
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
+  log(`[data-portal] op=download owner=${q(session.ownerId)} result=ok bytes=${obj.size ?? 'na'}`)
+  return { status: 200, payload: { ok: true }, body: obj }
+}
+
+interface PagesContext {
+  request: Request
+  env: PortalEnv
+}
+
+export async function onRequestGet(context: PagesContext): Promise<Response> {
+  const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
+  const key = new URL(context.request.url).searchParams.get('key') ?? ''
+  const { status, payload, body } = await processDownload(
+    sessionId,
+    key,
+    context.env,
+    (line) => console.log(line),
+    Date.now(),
+  )
+  if (status === 200 && body) {
+    return new Response(body.body, {
+      status: 200,
+      headers: {
+        // RFC 6266 filename*: percent-encoded, so a name containing a quote
+        // cannot break out of the quoted form, and CR/LF cannot reach the
+        // Headers constructor (which would throw and 500 the download).
+        'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(key.split('/').pop() ?? 'file')}`,
+        // `attachment` already stops inline rendering; nosniff is the belt to
+        // that braces, so an uploaded .html can never be sniffed and executed
+        // on the portal's own origin.
+        'x-content-type-options': 'nosniff',
+        // These are private client documents. Without this a browser or an
+        // intermediary proxy may cache one person's invoice.
+        'cache-control': 'private, no-store',
+      },
+    })
+  }
+  return Response.json(payload, { status })
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/files.ts

@@ -0,0 +1,41 @@
+import type { Handler, Logger, PortalEnv } from './_lib/types'
+import { readSessionCookie, resolveSession } from './_lib/session'
+import { q } from './_lib/log'
+
+export async function processFiles(
+  sessionId: string,
+  env: PortalEnv,
+  log: Logger,
+  nowMs: number,
+): Promise<Handler> {
+  const session = await resolveSession(env.DB, sessionId, nowMs)
+  if (!session) {
+    log('[data-portal] op=list owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  // Scoped by ownerId, not by key prefix: the owner is the authority.
+  const rows = await env.DB.prepare(
+    'SELECT fileId, filename, objectKey, size, uploadedAt, ingested FROM manifest WHERE ownerId = ? ORDER BY uploadedAt DESC',
+  )
+    .bind(session.ownerId)
+    .all<Record<string, unknown>>()
+  const files = rows.results ?? []
+  log(`[data-portal] op=list owner=${q(session.ownerId)} result=ok files=${files.length}`)
+  return { status: 200, payload: { ok: true, files } }
+}
+
+interface PagesContext {
+  request: Request
+  env: PortalEnv
+}
+
+export async function onRequestGet(context: PagesContext): Promise<Response> {
+  const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
+  const { status, payload } = await processFiles(
+    sessionId,
+    context.env,
+    (line) => console.log(line),
+    Date.now(),
+  )
+  return Response.json(payload, { status })
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/upload.ts

@@ -0,0 +1,151 @@
+import type { Handler, Logger, PortalEnv } from './_lib/types'
+import { readSessionCookie, resolveSession } from './_lib/session'
+import { q } from './_lib/log'
+import { authorizeKey, ownerPrefix } from './_lib/authorize'
+
+const MAX_FILENAME = 200
+
+// An upload is read wholly into the Function's memory, so it needs a bound or a
+// large one OOMs the isolate — and an OOM emits no [data-portal] line at all,
+// making it exactly the unobservable failure this portal's lifeline exists to
+// prevent. 25 MiB is chosen for the documents this portal is for (invoices,
+// photos, spreadsheets) and is deliberately NOT the storage broker's 100 MiB
+// (task 1695): that one bounds a house-process spike, this one bounds an edge
+// isolate, and the two must move independently.
+const MAX_UPLOAD_BYTES = 25 * 1024 * 1024
+
+export async function processUpload(
+  sessionId: string,
+  filename: string,
+  bytes: Uint8Array,
+  env: PortalEnv,
+  log: Logger,
+  newId: () => string,
+  now: () => number,
+): Promise<Handler> {
+  // `now` is a clock, not a scalar: op=complete reports elapsed time, and a
+  // single injected instant cannot measure elapsed anything. It previously
+  // printed a hardcoded ms=0, which an operator reads as "took no time" rather
+  // than "was never measured".
+  const startedMs = now()
+  const session = await resolveSession(env.DB, sessionId, startedMs)
+  if (!session) {
+    log('[data-portal] op=upload owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  const owner = session.ownerId
+  const uploadId = newId()
+
+  if (!filename || filename.length > MAX_FILENAME) {
+    log(`[data-portal] op=request uploadId=${uploadId} owner=${q(owner)} result=bad-filename`)
+    return { status: 400, payload: { ok: false, error: 'filename required' } }
+  }
+
+  const key = `${ownerPrefix(owner)}${filename}`
+  // The key is derived from the session owner, then re-checked through the same
+  // gate the other routes use — a filename carrying '..' must not escape.
+  if (!authorizeKey(owner, key)) {
+    log(`[data-portal] op=request uploadId=${uploadId} owner=${q(owner)} result=bad-filename`)
+    return { status: 400, payload: { ok: false, error: 'invalid filename' } }
+  }
+
+  if (bytes.byteLength > MAX_UPLOAD_BYTES) {
+    log(
+      `[data-portal] op=request uploadId=${uploadId} owner=${q(owner)} filename=${q(filename)} bytes=${bytes.byteLength} result=too-large limit=${MAX_UPLOAD_BYTES}`,
+    )
+    return {
+      status: 413,
+      payload: {
+        ok: false,
+        error: `file is ${bytes.byteLength} bytes, over the ${MAX_UPLOAD_BYTES}-byte limit`,
+      },
+    }
+  }
+
+  log(
+    `[data-portal] op=request uploadId=${uploadId} owner=${q(owner)} filename=${q(filename)} bytes=${bytes.byteLength}`,
+  )
+
+  try {
+    await env.BUCKET.put(key, bytes)
+    log(`[data-portal] op=r2-put uploadId=${uploadId} key=${q(key)} result=ok`)
+  } catch (err) {
+    log(
+      `[data-portal] op=r2-put uploadId=${uploadId} key=${q(key)} result=failed err="${(err as Error).message}"`,
+    )
+    return { status: 502, payload: { ok: false, error: 'store failed' } }
+  }
+
+  const fileId = newId()
+  try {
+    // Upsert, not insert. R2 overwrote the object above unconditionally, so a
+    // re-upload of the same filename has already replaced the file whatever the
+    // manifest does; a plain INSERT would hit `objectKey UNIQUE`, throw, and
+    // leave the row describing bytes that no longer exist while telling the
+    // person their upload failed. Resetting `ingested` is the load-bearing
+    // part: without it a replacement of an already-swept file would never be
+    // ingested, and nothing would ever say so.
+    await env.DB.prepare(
+      `INSERT INTO manifest (fileId, ownerId, filename, objectKey, size, uploadedAt, ingested)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (objectKey) DO UPDATE SET
+           fileId = excluded.fileId,
+           size = excluded.size,
+           uploadedAt = excluded.uploadedAt,
+           ingested = 0`,
+    )
+      .bind(fileId, owner, filename, key, bytes.byteLength, new Date(startedMs).toISOString(), 0)
+      .run()
+    log(`[data-portal] op=manifest-write uploadId=${uploadId} rowId=${fileId} result=ok`)
+  } catch (err) {
+    log(
+      `[data-portal] op=manifest-write uploadId=${uploadId} rowId=${fileId} result=failed err="${(err as Error).message}"`,
+    )
+    return { status: 502, payload: { ok: false, error: 'manifest failed' } }
+  }
+
+  // The verified post-condition: re-read both sides rather than assume the
+  // writes above landed. An orphan object or a phantom row emits no error at
+  // request time, which is why this line exists.
+  const objectPresent = (await env.BUCKET.head(key)) !== null
+  const rowPresent =
+    (await env.DB.prepare('SELECT fileId FROM manifest WHERE objectKey = ?').bind(key).first()) !==
+    null
+  log(
+    `[data-portal] op=complete uploadId=${uploadId} ms=${now() - startedMs} objectPresent=${objectPresent} rowPresent=${rowPresent}`,
+  )
+
+  return { status: 200, payload: { ok: true, fileId, objectPresent, rowPresent } }
+}
+
+interface PagesContext {
+  request: Request
+  env: PortalEnv
+}
+
+export async function onRequestPost(context: PagesContext): Promise<Response> {
+  const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
+  let filename = ''
+  let bytes: Uint8Array
+  try {
+    const form = await context.request.formData()
+    const file = form.get('file')
+    if (!(file instanceof File)) {
+      return Response.json({ ok: false, error: 'file required' }, { status: 400 })
+    }
+    filename = file.name
+    bytes = new Uint8Array(await file.arrayBuffer())
+  } catch {
+    return Response.json({ ok: false, error: 'invalid form' }, { status: 400 })
+  }
+  const { status, payload } = await processUpload(
+    sessionId,
+    filename,
+    bytes,
+    context.env,
+    (line) => console.log(line),
+    () => crypto.randomUUID(),
+    () => Date.now(),
+  )
+  return Response.json(payload, { status })
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/public/index.html

@@ -0,0 +1,42 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>File drop</title>
+    <!-- Same-origin: the API is served by this project's own Pages Functions,
+         so api-base is deliberately empty (Task 1307's convention). -->
+    <meta name="api-base" content="" />
+    <link rel="stylesheet" href="/portal.css" />
+  </head>
+  <body>
+    <main class="dp-card">
+      <h1 class="dp-title">File drop</h1>
+      <p id="dp-status" class="dp-status" role="status"></p>
+
+      <form id="dp-login" class="dp-login">
+        <label class="dp-label" for="dp-owner">Your name</label>
+        <input class="dp-input" id="dp-owner" name="owner" autocomplete="username" required />
+        <label class="dp-label" for="dp-passcode">Passcode</label>
+        <input
+          class="dp-input"
+          id="dp-passcode"
+          name="passcode"
+          type="password"
+          autocomplete="current-password"
+          required
+        />
+        <button class="dp-btn" type="submit">Sign in</button>
+      </form>
+
+      <section id="dp-panel" class="dp-panel" hidden>
+        <form id="dp-upload" class="dp-upload">
+          <input class="dp-file" id="dp-file" type="file" required />
+          <button class="dp-btn" type="submit">Upload</button>
+        </form>
+        <ul id="dp-files" class="dp-files"></ul>
+      </section>
+    </main>
+    <script src="/portal.js"></script>
+  </body>
+</html>