@rubytech/create-maxy-code 0.1.489 → 0.1.491

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/upload.ts

@@ -1,7 +1,8 @@
 import type { Handler, Logger, PortalEnv } from './_lib/types'
 import { readSessionCookie, resolveSession } from './_lib/session'
 import { q } from './_lib/log'
-import { authorizeKey, ownerPrefix } from './_lib/authorize'
+import { authorizeKey } from './_lib/authorize'
+import { checkTarget, uploadKey } from './_lib/target'
 
 const MAX_FILENAME = 200
 
@@ -14,9 +15,28 @@ const MAX_FILENAME = 200
 // isolate, and the two must move independently.
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024
 
+/**
+ * The per-part ceiling (Task 1910).
+ *
+ * Identical to MAX_UPLOAD_BYTES and for exactly the same reason: a part is read
+ * wholly into the Function's memory just as a single-shot body is. Parts do not
+ * relax the isolate bound, they let a large file respect it repeatedly.
+ */
+export const MAX_PART_BYTES = 25 * 1024 * 1024
+
+/**
+ * The whole-file ceiling.
+ *
+ * Not an isolate limit — no single request ever carries this much. It bounds
+ * what one client may push through one portal in one go, so a mistaken drag of
+ * a disk image is refused before it consumes an account's storage.
+ */
+export const MAX_TOTAL_BYTES = 1024 * 1024 * 1024
+
 export async function processUpload(
   sessionId: string,
   filename: string,
+  targetPath: string,
   bytes: Uint8Array,
   env: PortalEnv,
   log: Logger,
@@ -41,7 +61,22 @@ export async function processUpload(
     return { status: 400, payload: { ok: false, error: 'filename required' } }
   }
 
-  const key = `${ownerPrefix(owner)}${filename}`
+  // The target is resolved BEFORE any R2 call, the same ordering rule the owner
+  // gate follows: a denied caller must never be able to cause a store write.
+  const target = await checkTarget(env.DB, session.accountId, session.folders, targetPath)
+  if (!target.ok) {
+    log(
+      `[data-portal] op=target-check uploadId=${uploadId} owner=${q(owner)} ` +
+        `targetPath=${q(targetPath)} result=denied-${target.reason}`,
+    )
+    return { status: 403, payload: { ok: false, error: 'target not allowed' } }
+  }
+  log(
+    `[data-portal] op=target-check uploadId=${uploadId} owner=${q(owner)} ` +
+      `targetPath=${q(targetPath)} result=allowed`,
+  )
+
+  const key = uploadKey(owner, targetPath, filename)
   // The key is derived from the session owner, then re-checked through the same
   // gate the other routes use — a filename carrying '..' must not escape.
   if (!authorizeKey(owner, key)) {
@@ -63,7 +98,8 @@ export async function processUpload(
   }
 
   log(
-    `[data-portal] op=request uploadId=${uploadId} owner=${q(owner)} filename=${q(filename)} bytes=${bytes.byteLength}`,
+    `[data-portal] op=request uploadId=${uploadId} owner=${q(owner)} filename=${q(filename)} ` +
+      `targetPath=${q(targetPath)} bytes=${bytes.byteLength}`,
   )
 
   try {
@@ -85,17 +121,15 @@ export async function processUpload(
     // person their upload failed. Resetting `ingested` is the load-bearing
     // part: without it a replacement of an already-swept file would never be
     // ingested, and nothing would ever say so.
-    await env.DB.prepare(
-      `INSERT INTO manifest (fileId, ownerId, filename, objectKey, size, uploadedAt, ingested)
-         VALUES (?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (objectKey) DO UPDATE SET
-           fileId = excluded.fileId,
-           size = excluded.size,
-           uploadedAt = excluded.uploadedAt,
-           ingested = 0`,
-    )
-      .bind(fileId, owner, filename, key, bytes.byteLength, new Date(startedMs).toISOString(), 0)
-      .run()
+    await writeManifestRow(env, {
+      fileId,
+      owner,
+      filename,
+      key,
+      size: bytes.byteLength,
+      at: new Date(startedMs).toISOString(),
+      targetPath,
+    })
     log(`[data-portal] op=manifest-write uploadId=${uploadId} rowId=${fileId} result=ok`)
   } catch (err) {
     log(
@@ -118,29 +152,337 @@ export async function processUpload(
   return { status: 200, payload: { ok: true, fileId, objectPresent, rowPresent } }
 }
 
+/** The manifest upsert, shared by the single-shot and multipart paths so the
+ *  two can never drift on what a stored row means. */
+async function writeManifestRow(
+  env: PortalEnv,
+  row: { fileId: string; owner: string; filename: string; key: string; size: number; at: string; targetPath: string },
+): Promise<void> {
+  await env.DB.prepare(
+    `INSERT INTO manifest (fileId, ownerId, filename, objectKey, size, uploadedAt, ingested, targetPath)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (objectKey) DO UPDATE SET
+         fileId = excluded.fileId,
+         size = excluded.size,
+         uploadedAt = excluded.uploadedAt,
+         targetPath = excluded.targetPath,
+         ingested = 0,
+         devicePath = '',
+         deleted = 0`,
+  )
+    .bind(row.fileId, row.owner, row.filename, row.key, row.size, row.at, 0, row.targetPath)
+    .run()
+}
+
+/**
+ * Open a multipart session.
+ *
+ * The declared size is checked BEFORE the session is opened, so an over-cap
+ * declaration never leaves an orphan multipart upload accruing storage that
+ * nothing would ever clean up.
+ */
+export async function processMultipartCreate(
+  sessionId: string,
+  filename: string,
+  targetPath: string,
+  declaredSize: number,
+  env: PortalEnv,
+  log: Logger,
+  newId: () => string,
+  now: () => number,
+): Promise<Handler> {
+  const startedMs = now()
+  const session = await resolveSession(env.DB, sessionId, startedMs)
+  if (!session) {
+    log('[data-portal] op=mp-create owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  const owner = session.ownerId
+  const uploadId = newId()
+
+  if (!filename || filename.length > MAX_FILENAME) {
+    log(`[data-portal] op=mp-create uploadId=${uploadId} owner=${q(owner)} result=bad-filename`)
+    return { status: 400, payload: { ok: false, error: 'filename required' } }
+  }
+  if (!Number.isFinite(declaredSize) || declaredSize < 0 || declaredSize > MAX_TOTAL_BYTES) {
+    log(
+      `[data-portal] op=mp-create uploadId=${uploadId} owner=${q(owner)} ` +
+        `declared=${declaredSize} result=too-large limit=${MAX_TOTAL_BYTES}`,
+    )
+    return {
+      status: 413,
+      payload: { ok: false, error: `file is over the ${MAX_TOTAL_BYTES}-byte limit` },
+    }
+  }
+
+  const target = await checkTarget(env.DB, session.accountId, session.folders, targetPath)
+  if (!target.ok) {
+    log(
+      `[data-portal] op=target-check uploadId=${uploadId} owner=${q(owner)} ` +
+        `targetPath=${q(targetPath)} result=denied-${target.reason}`,
+    )
+    return { status: 403, payload: { ok: false, error: 'target not allowed' } }
+  }
+
+  const key = uploadKey(owner, targetPath, filename)
+  if (!authorizeKey(owner, key)) {
+    log(`[data-portal] op=mp-create uploadId=${uploadId} owner=${q(owner)} result=bad-filename`)
+    return { status: 400, payload: { ok: false, error: 'invalid filename' } }
+  }
+
+  const mp = await env.BUCKET.createMultipartUpload(key)
+  log(
+    `[data-portal] op=mp-create uploadId=${uploadId} owner=${q(owner)} key=${q(key)} ` +
+      `declared=${declaredSize} parts=${Math.ceil(declaredSize / MAX_PART_BYTES)} result=ok`,
+  )
+  return { status: 200, payload: { ok: true, uploadId, key, r2UploadId: mp.uploadId } }
+}
+
+/** One part. The key arrives from the client on every request, so it is
+ *  re-authorized on every request — a session that may write `alice/` must not
+ *  be able to append a part to `bob/`. */
+export async function processMultipartPart(
+  sessionId: string,
+  key: string,
+  r2UploadId: string,
+  partNumber: number,
+  bytes: Uint8Array,
+  env: PortalEnv,
+  log: Logger,
+): Promise<Handler> {
+  const session = await resolveSession(env.DB, sessionId, Date.now())
+  if (!session) {
+    log('[data-portal] op=r2-put owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  if (!authorizeKey(session.ownerId, key)) {
+    log(`[data-portal] op=r2-put owner=${q(session.ownerId)} result=denied reason=not-owner`)
+    return { status: 403, payload: { ok: false, error: 'denied' } }
+  }
+  if (bytes.byteLength > MAX_PART_BYTES) {
+    log(
+      `[data-portal] op=r2-put owner=${q(session.ownerId)} part=${partNumber} ` +
+        `bytes=${bytes.byteLength} result=too-large limit=${MAX_PART_BYTES}`,
+    )
+    return { status: 413, payload: { ok: false, error: 'part too large' } }
+  }
+
+  try {
+    const mp = env.BUCKET.resumeMultipartUpload(key, r2UploadId)
+    const part = await mp.uploadPart(partNumber, bytes)
+    log(
+      `[data-portal] op=r2-put owner=${q(session.ownerId)} key=${q(key)} ` +
+        `part=${partNumber} bytes=${bytes.byteLength} result=ok`,
+    )
+    return { status: 200, payload: { ok: true, partNumber, etag: part.etag } }
+  } catch (err) {
+    log(
+      `[data-portal] op=r2-put owner=${q(session.ownerId)} key=${q(key)} part=${partNumber} ` +
+        `result=failed err="${(err as Error).message}"`,
+    )
+    return { status: 502, payload: { ok: false, error: 'store failed' } }
+  }
+}
+
+export interface CompletedPart {
+  partNumber: number
+  etag: string
+  size?: number
+}
+
+/**
+ * Assemble the parts and record the row.
+ *
+ * The declared size at create time is a claim; the summed part sizes are the
+ * measurement, so the cap is enforced again here. Over the cap the session is
+ * ABORTED rather than completed: assembling first and deleting after would
+ * store the oversized object, however briefly, and a failure between the two
+ * would leave it there permanently.
+ */
+export async function processMultipartComplete(
+  sessionId: string,
+  key: string,
+  r2UploadId: string,
+  targetPath: string,
+  parts: CompletedPart[],
+  env: PortalEnv,
+  log: Logger,
+  newId: () => string,
+  now: () => number,
+): Promise<Handler> {
+  const startedMs = now()
+  const session = await resolveSession(env.DB, sessionId, startedMs)
+  if (!session) {
+    log('[data-portal] op=mp-complete owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  const owner = session.ownerId
+  const uploadId = newId()
+  if (!authorizeKey(owner, key)) {
+    log(`[data-portal] op=mp-complete uploadId=${uploadId} owner=${q(owner)} result=denied reason=not-owner`)
+    return { status: 403, payload: { ok: false, error: 'denied' } }
+  }
+
+  const mp = env.BUCKET.resumeMultipartUpload(key, r2UploadId)
+  const declaredTotal = parts.reduce((n, p) => n + (p.size ?? 0), 0)
+  if (declaredTotal > MAX_TOTAL_BYTES) {
+    await mp.abort().catch(() => {})
+    log(
+      `[data-portal] op=mp-complete uploadId=${uploadId} owner=${q(owner)} ` +
+        `bytes=${declaredTotal} result=too-large limit=${MAX_TOTAL_BYTES} aborted=true`,
+    )
+    return { status: 413, payload: { ok: false, error: 'file too large' } }
+  }
+
+  let size = declaredTotal
+  try {
+    const done = await mp.complete(parts.map((p) => ({ partNumber: p.partNumber, etag: p.etag })))
+    if (done && typeof done.size === 'number') size = done.size
+    log(`[data-portal] op=r2-put uploadId=${uploadId} key=${q(key)} parts=${parts.length} result=ok`)
+  } catch (err) {
+    log(
+      `[data-portal] op=r2-put uploadId=${uploadId} key=${q(key)} ` +
+        `result=failed err="${(err as Error).message}"`,
+    )
+    return { status: 502, payload: { ok: false, error: 'store failed' } }
+  }
+
+  const fileId = newId()
+  const filename = key.split('/').pop() ?? ''
+  try {
+    await writeManifestRow(env, {
+      fileId, owner, filename, key, size,
+      at: new Date(startedMs).toISOString(),
+      targetPath,
+    })
+    log(`[data-portal] op=manifest-write uploadId=${uploadId} rowId=${fileId} result=ok`)
+  } catch (err) {
+    log(
+      `[data-portal] op=manifest-write uploadId=${uploadId} rowId=${fileId} ` +
+        `result=failed err="${(err as Error).message}"`,
+    )
+    return { status: 502, payload: { ok: false, error: 'manifest failed' } }
+  }
+
+  const objectPresent = (await env.BUCKET.head(key)) !== null
+  const rowPresent =
+    (await env.DB.prepare('SELECT fileId FROM manifest WHERE objectKey = ?').bind(key).first()) !==
+    null
+  log(
+    `[data-portal] op=complete uploadId=${uploadId} ms=${now() - startedMs} ` +
+      `objectPresent=${objectPresent} rowPresent=${rowPresent}`,
+  )
+  return { status: 200, payload: { ok: true, fileId, objectPresent, rowPresent } }
+}
+
 interface PagesContext {
   request: Request
   env: PortalEnv
 }
 
+/**
+ * The multipart stages, routed off an `action` field.
+ *
+ * No action at all is today's single-shot upload, so the common case — a
+ * document well under one part — stays exactly one request. Only a file that
+ * needs slicing pays for three round trips.
+ */
+async function onMultipart(context: PagesContext, form: FormData, action: string): Promise<Response> {
+  const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
+  const log = (line: string) => console.log(line)
+  const newId = () => crypto.randomUUID()
+
+  if (action === 'create') {
+    const file = form.get('filename')
+    const { status, payload } = await processMultipartCreate(
+      sessionId,
+      typeof file === 'string' ? file : '',
+      String(form.get('targetPath') ?? ''),
+      Number(form.get('size') ?? NaN),
+      context.env,
+      log,
+      newId,
+      () => Date.now(),
+    )
+    return Response.json(payload, { status })
+  }
+
+  if (action === 'part') {
+    const part = form.get('part')
+    if (!(part instanceof File)) {
+      return Response.json({ ok: false, error: 'part required' }, { status: 400 })
+    }
+    const { status, payload } = await processMultipartPart(
+      sessionId,
+      String(form.get('key') ?? ''),
+      String(form.get('r2UploadId') ?? ''),
+      Number(form.get('partNumber') ?? NaN),
+      new Uint8Array(await part.arrayBuffer()),
+      context.env,
+      log,
+    )
+    return Response.json(payload, { status })
+  }
+
+  let parts: CompletedPart[]
+  try {
+    parts = JSON.parse(String(form.get('parts') ?? '[]')) as CompletedPart[]
+    if (!Array.isArray(parts)) throw new Error('parts must be an array')
+  } catch {
+    return Response.json({ ok: false, error: 'invalid parts' }, { status: 400 })
+  }
+  const { status, payload } = await processMultipartComplete(
+    sessionId,
+    String(form.get('key') ?? ''),
+    String(form.get('r2UploadId') ?? ''),
+    String(form.get('targetPath') ?? ''),
+    parts,
+    context.env,
+    log,
+    newId,
+    () => Date.now(),
+  )
+  return Response.json(payload, { status })
+}
+
 export async function onRequestPost(context: PagesContext): Promise<Response> {
   const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
   let filename = ''
+  let targetPath = ''
   let bytes: Uint8Array
+
+  // Parsing the form is the only thing this catch may cover. A multipart stage
+  // dispatched from inside it would report its own failures as "invalid form",
+  // which is the silent-failure shape: one message standing in for every cause.
+  let form: FormData
+  try {
+    form = await context.request.formData()
+  } catch {
+    return Response.json({ ok: false, error: 'invalid form' }, { status: 400 })
+  }
+
+  const action = String(form.get('action') ?? '')
+  if (action === 'create' || action === 'part' || action === 'complete') {
+    return onMultipart(context, form, action)
+  }
+
   try {
-    const form = await context.request.formData()
     const file = form.get('file')
     if (!(file instanceof File)) {
       return Response.json({ ok: false, error: 'file required' }, { status: 400 })
     }
     filename = file.name
+    // Absent means the default uploads area, which is always legal. An absent
+    // field and an empty one are the same request.
+    targetPath = String(form.get('targetPath') ?? '')
     bytes = new Uint8Array(await file.arrayBuffer())
   } catch {
-    return Response.json({ ok: false, error: 'invalid form' }, { status: 400 })
+    return Response.json({ ok: false, error: 'invalid file' }, { status: 400 })
   }
   const { status, payload } = await processUpload(
     sessionId,
     filename,
+    targetPath,
     bytes,
     context.env,
     (line) => console.log(line),

package/payload/platform/plugins/cloudflare/skills/data-portal/template/index.html

@@ -72,10 +72,18 @@
           <div class="dp-modal-panel" role="dialog" aria-modal="true" aria-label="Upload a file">
             <button class="dp-modal-close" id="dp-modal-close" type="button" aria-label="Close">&times;</button>
             <h2 class="dp-subtitle">Upload a file</h2>
+            <!-- `multiple`: a person dragging three invoices in expects three
+                 uploads, not the first one silently. -->
             <form id="dp-upload" class="dp-upload">
-              <input class="dp-file" id="dp-file" type="file" required />
+              <input class="dp-file" id="dp-file" type="file" multiple required />
               <button class="dp-btn" type="submit">Upload</button>
             </form>
+            <!-- Names the folder the upload will land in, so the destination is
+                 never a guess. Filled by portal.js from the open folder. -->
+            <p class="dp-upload-target" id="dp-upload-target"></p>
+            <div class="dp-progress" id="dp-progress" hidden>
+              <div class="dp-progress-bar" id="dp-progress-bar"></div>
+            </div>
           </div>
         </div>
       </section>

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.css

@@ -308,6 +308,51 @@ body {
   outline-offset: 3px;
 }
 
+/* The open listing while a file is dragged over it: this drop targets the
+   folder currently open. Same dashed treatment as the upload area, so one
+   visual language means "release here". */
+.dp-files.dp-dropping {
+  outline: 2px dashed var(--dp-accent);
+  outline-offset: 3px;
+  border-radius: 6px;
+}
+
+/* One folder row under the pointer. Filled rather than outlined, because the
+   question a client is asking mid-drag is "which of these rows will take it",
+   and an outline on a dense list is easy to misread by one row. */
+.dp-file-row.dp-drop-target {
+  background: color-mix(in srgb, var(--dp-accent) 12%, transparent);
+  outline: 2px solid var(--dp-accent);
+  outline-offset: -2px;
+  border-radius: 6px;
+}
+
+/* Which folder the modal will upload into. Stated rather than implied: an
+   upload whose destination the client has to infer is the defect the
+   folder-targeted exchange exists to remove. */
+.dp-upload-target {
+  margin: 0.5rem 0 0;
+  font-size: 0.85rem;
+  color: var(--dp-muted);
+}
+
+/* Per-file upload progress. Hidden between uploads via the `hidden` attribute,
+   which [hidden]{display:none!important} keeps authoritative. */
+.dp-progress {
+  margin-top: 0.6rem;
+  height: 4px;
+  background: var(--dp-rule);
+  border-radius: 2px;
+  overflow: hidden;
+}
+
+.dp-progress-bar {
+  height: 100%;
+  width: 0;
+  background: var(--dp-accent);
+  transition: width 120ms linear;
+}
+
 /* Pinned nav row. position:sticky keeps it in flow, so it reserves its own
    height and never overlaps the first file row (which position:fixed would). An
    opaque paper background hides the rows that scroll under it. Reuses existing