emdash 0.31.1 → 0.32.0

package/src/astro/routes/api/media/[id]/confirm.ts

@@ -8,14 +8,16 @@
  */
 
 import type { APIRoute } from "astro";
-import { MediaRepository } from "emdash";
+import type { DownloadResult } from "emdash";
 
 import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { mediaConfirmBody } from "#api/schemas.js";
+import { MediaRepository } from "#db/repositories/media.js";
 import { enrichImageMetadata } from "#media/enrich.js";
 import type { MediaItem } from "#types";
+import { computeContentHash, MAX_CONTENT_HASH_BYTES } from "#utils/hash.js";
 
 export const prerender = false;
 
@@ -26,7 +28,7 @@ export const prerender = false;
  * on the very uploads that flow was designed for. LQIP is progressive
  * enhancement: large images simply ship without a server-generated placeholder.
  */
-const MAX_PLACEHOLDER_DOWNLOAD_BYTES = 8 * 1024 * 1024;
+const MAX_PLACEHOLDER_DOWNLOAD_BYTES = MAX_CONTENT_HASH_BYTES;
 
 /**
  * Add URL to media item (relative URL for portability)
@@ -38,6 +40,67 @@ function addUrlToMedia(item: MediaItem): MediaItem & { url: string } {
 	};
 }
 
+async function cancelDownload(download: DownloadResult): Promise<void> {
+	try {
+		await download.body.cancel();
+	} catch (error) {
+		console.error("[media] confirm download cancellation failed:", error);
+	}
+}
+
+async function forgetUploadAttempt(repo: MediaRepository, storageKey: string): Promise<void> {
+	try {
+		await repo.deleteUploadAttempt(storageKey);
+	} catch (error) {
+		console.error("[media] confirm upload attempt cleanup failed:", error);
+	}
+}
+
+async function confirmationConflict(repo: MediaRepository, id: string): Promise<Response> {
+	const current = await repo.findById(id);
+	if (!current) {
+		return apiError("NOT_FOUND", `Media item not found: ${id}`, 404);
+	}
+	if (current.status === "ready") {
+		await forgetUploadAttempt(repo, current.storageKey);
+		return apiSuccess({ item: addUrlToMedia(current) });
+	}
+	if (current.status === "pending") {
+		return apiError("INVALID_STATE", "Media item changed during confirmation", 409);
+	}
+	return apiError("INVALID_STATE", `Media item is not pending: ${current.status}`, 400);
+}
+
+async function consumeDownload(download: DownloadResult): Promise<Uint8Array> {
+	const reader = download.body.getReader();
+	try {
+		const bytes = new Uint8Array(download.size);
+		let receivedSize = 0;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (receivedSize + value.byteLength > bytes.byteLength) {
+				throw new Error("Stored file exceeds its reported size");
+			}
+			bytes.set(value, receivedSize);
+			receivedSize += value.byteLength;
+		}
+		if (receivedSize !== download.size) {
+			throw new Error("Stored file size does not match its reported size");
+		}
+		return bytes;
+	} catch (error) {
+		try {
+			await reader.cancel(error);
+		} catch (cancelError) {
+			console.error("[media] confirm download cancellation failed:", cancelError);
+		}
+		throw error;
+	} finally {
+		reader.releaseLock();
+	}
+}
+
 /**
  * Confirm upload completion
  */
@@ -68,90 +131,116 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			return apiError("NOT_FOUND", `Media item not found: ${id}`, 404);
 		}
 
-		if (existing.status !== "pending") {
-			return apiError("INVALID_STATE", `Media item is not pending: ${existing.status}`, 400);
-		}
-
 		// Only the uploader or a user with media:edit_any can confirm/fail a pending upload
 		const ownerDenied = requireOwnerPerm(
 			user,
 			existing.authorId ?? "",
-			"media:edit_own",
+			"media:upload",
 			"media:edit_any",
 		);
 		if (ownerDenied) return ownerDenied;
 
-		// Optionally verify the file exists in storage
+		if (existing.status === "ready") {
+			await forgetUploadAttempt(repo, existing.storageKey);
+			return apiSuccess({ item: addUrlToMedia(existing) });
+		}
+		if (existing.status !== "pending") {
+			return apiError("INVALID_STATE", `Media item is not pending: ${existing.status}`, 400);
+		}
+
+		if (body.size !== undefined && existing.size !== null && body.size !== existing.size) {
+			return apiError(
+				"UPLOAD_SIZE_MISMATCH",
+				"Confirmed size does not match the pending media item",
+				400,
+			);
+		}
+
+		let confirmedSize = existing.size ?? body.size;
+		let contentHash = existing.contentHash;
+		let imageBytes: Uint8Array | undefined;
+
 		if (emdash.storage) {
 			const exists = await emdash.storage.exists(existing.storageKey);
 			if (!exists) {
-				// Mark as failed
-				await repo.markFailed(id);
+				const failed = await repo.markFailed(id, existing.storageKey);
+				if (!failed) return await confirmationConflict(repo, id);
 				return apiError("FILE_NOT_FOUND", "File was not uploaded to storage", 400);
 			}
+
+			const storedFile = await emdash.storage.download(existing.storageKey);
+			if (confirmedSize !== undefined && storedFile.size !== confirmedSize) {
+				await cancelDownload(storedFile);
+				return apiError(
+					"UPLOAD_SIZE_MISMATCH",
+					"Stored file size does not match the pending media item",
+					400,
+				);
+			}
+			confirmedSize = storedFile.size;
+
+			const isImage = existing.mimeType.startsWith("image/");
+			const canBuffer = storedFile.size <= MAX_PLACEHOLDER_DOWNLOAD_BYTES;
+			const hasServerHash =
+				contentHash !== null && (await repo.hasUploadAttempt(existing.storageKey));
+			if (canBuffer && (isImage || !hasServerHash)) {
+				const bytes = await consumeDownload(storedFile);
+				contentHash = bytes.byteLength > 0 ? await computeContentHash(bytes) : null;
+				if (isImage && bytes.byteLength > 0) imageBytes = bytes;
+			} else {
+				if (!hasServerHash) contentHash = null;
+				await cancelDownload(storedFile);
+			}
+
+			if (isImage && !canBuffer) {
+				console.warn(
+					`[media] confirm skipping placeholder: object ${existing.storageKey} reported size ${storedFile.size} bytes (> ${MAX_PLACEHOLDER_DOWNLOAD_BYTES})`,
+				);
+			}
 		}
 
-		// For images, read the just-uploaded bytes back from storage once to
-		// generate LQIP placeholders (and server-side dimensions as a fallback).
-		// The signed-URL flow uploads directly to storage, so this confirm is the
-		// only point at which the server sees the bytes. Best-effort: a decode
-		// failure must not block the upload from being marked ready. We also cap
-		// the download size — buffering a large original into a Worker heap to
-		// compute a 32px blurhash would OOM on the uploads the signed-URL path
-		// exists to support, so oversized files skip the server-side placeholder.
+		// LQIP is best-effort; oversized images skip server-side placeholders.
 		let blurhash: string | undefined;
 		let dominantColor: string | undefined;
 		let width = body.width;
 		let height = body.height;
-		if (emdash.storage && existing.mimeType.startsWith("image/")) {
-			const knownSize = body.size ?? existing.size ?? undefined;
-			const tooLarge = knownSize != null && knownSize > MAX_PLACEHOLDER_DOWNLOAD_BYTES;
-			if (!tooLarge) {
-				try {
-					const { body: stream } = await emdash.storage.download(existing.storageKey);
-					const bytes = new Uint8Array(await new Response(stream).arrayBuffer());
-					// Defense-in-depth for the unknown-size case: even though we
-					// already buffered it, refuse the decode so we don't also pay
-					// the (larger) RGBA allocation.
-					if (bytes.byteLength > MAX_PLACEHOLDER_DOWNLOAD_BYTES) {
-						console.warn(
-							`[media] confirm skipping placeholder: object ${existing.storageKey} is ${bytes.byteLength} bytes (> ${MAX_PLACEHOLDER_DOWNLOAD_BYTES})`,
-						);
-					} else {
-						const enriched = await enrichImageMetadata(bytes, existing.mimeType, {
-							knownDimensions:
-								body.width != null && body.height != null
-									? { width: body.width, height: body.height }
-									: undefined,
-						});
-						blurhash = enriched.blurhash;
-						dominantColor = enriched.dominantColor;
-						width = width ?? enriched.width;
-						height = height ?? enriched.height;
-					}
-				} catch (error) {
-					console.error("[media] confirm placeholder generation failed:", error);
-				}
-			} else {
-				console.warn(
-					`[media] confirm skipping placeholder: object ${existing.storageKey} reported size ${knownSize} bytes (> ${MAX_PLACEHOLDER_DOWNLOAD_BYTES})`,
-				);
+		if (imageBytes) {
+			try {
+				const enriched = await enrichImageMetadata(imageBytes, existing.mimeType, {
+					knownDimensions:
+						body.width != null && body.height != null
+							? { width: body.width, height: body.height }
+							: undefined,
+				});
+				blurhash = enriched.blurhash;
+				dominantColor = enriched.dominantColor;
+				width = width ?? enriched.width;
+				height = height ?? enriched.height;
+			} catch (error) {
+				console.error("[media] confirm placeholder generation failed:", error);
 			}
 		}
 
 		// Confirm the upload
-		const item = await repo.confirmUpload(id, {
-			size: body.size,
-			width,
-			height,
-			blurhash,
-			dominantColor,
-		});
+		const item = await repo.confirmUpload(
+			id,
+			{
+				size: confirmedSize,
+				width,
+				height,
+				blurhash,
+				dominantColor,
+				contentHash,
+			},
+			existing.storageKey,
+		);
 
 		if (!item) {
-			return apiError("CONFIRM_FAILED", "Failed to confirm upload", 500);
+			return await confirmationConflict(repo, id);
 		}
 
+		await forgetUploadAttempt(repo, item.storageKey);
+
 		// Add URL to the response (relative URL for portability)
 		const itemWithUrl = addUrlToMedia(item);
 

package/src/astro/routes/api/media/[id]/upload.ts

@@ -0,0 +1,262 @@
+import type { APIRoute } from "astro";
+import type { Storage } from "emdash";
+import { ulid } from "ulidx";
+
+import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { MediaRepository } from "#db/repositories/media.js";
+import { normalizeMime } from "#media/mime.js";
+import { removeUploadAttempt } from "#media/upload-attempts.js";
+import { computeContentHash, MAX_CONTENT_HASH_BYTES } from "#utils/hash.js";
+
+export const prerender = false;
+
+const INITIAL_HASH_BUFFER_BYTES = 64 * 1024;
+
+type FixedLengthStreamConstructor = new (
+	expectedLength: number | bigint,
+) => TransformStream<ArrayBuffer | ArrayBufferView, Uint8Array>;
+
+declare const FixedLengthStream: FixedLengthStreamConstructor | undefined;
+
+class UploadBodyError extends Error {
+	readonly code: "PAYLOAD_TOO_LARGE" | "UPLOAD_SIZE_MISMATCH";
+
+	constructor(code: "PAYLOAD_TOO_LARGE" | "UPLOAD_SIZE_MISMATCH") {
+		super(code);
+		this.code = code;
+	}
+}
+
+function findUploadBodyError(error: unknown): UploadBodyError | null {
+	let current = error;
+	for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
+		if (current instanceof UploadBodyError) return current;
+		current = current.cause;
+	}
+	return null;
+}
+
+function preserveKnownLength(
+	body: ReadableStream<Uint8Array>,
+	expectedLength: number,
+): ReadableStream<Uint8Array> {
+	if (typeof FixedLengthStream === "undefined") return body;
+	return body.pipeThrough(new FixedLengthStream(expectedLength));
+}
+
+function createUploadAttemptKey(key: string): string {
+	const pathSeparator = key.lastIndexOf("/");
+	const extensionSeparator = key.lastIndexOf(".");
+	if (extensionSeparator > pathSeparator) {
+		return `${key.slice(0, extensionSeparator)}.${ulid()}${key.slice(extensionSeparator)}`;
+	}
+	return `${key}.${ulid()}`;
+}
+
+async function getStoredSize(storage: Storage, key: string): Promise<number | null> {
+	if (!(await storage.exists(key))) return null;
+	const download = await storage.download(key);
+	try {
+		return download.size;
+	} finally {
+		try {
+			await download.body.cancel();
+		} catch (error) {
+			console.error("[media] upload download cancellation failed:", error);
+		}
+	}
+}
+
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	const denied = requirePerm(user, "media:upload");
+	if (denied) return denied;
+
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Media ID is required", 400);
+	}
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!emdash.storage) {
+		return apiError("NO_STORAGE", "Storage not configured", 500);
+	}
+
+	try {
+		const repo = new MediaRepository(emdash.db);
+		const media = await repo.findById(id);
+		if (!media) {
+			return apiError("NOT_FOUND", `Media item not found: ${id}`, 404);
+		}
+
+		if (media.status !== "pending") {
+			return apiError("INVALID_STATE", `Media item is not pending: ${media.status}`, 400);
+		}
+
+		const ownerDenied = requireOwnerPerm(
+			user,
+			media.authorId ?? "",
+			"media:upload",
+			"media:edit_any",
+		);
+		if (ownerDenied) return ownerDenied;
+
+		if (!Number.isSafeInteger(media.size) || media.size === null || media.size < 0) {
+			return apiError("INVALID_STATE", "Pending media item has no valid upload size", 400);
+		}
+		const expectedSize = media.size;
+
+		const contentType = request.headers.get("Content-Type");
+		if (!contentType || normalizeMime(contentType) !== media.mimeType) {
+			return apiError("INVALID_TYPE", "Upload content type does not match the media item", 400);
+		}
+
+		const requestBody =
+			request.body ??
+			(expectedSize === 0
+				? new ReadableStream<Uint8Array>({
+						start(controller) {
+							controller.close();
+						},
+					})
+				: null);
+		if (!requestBody) {
+			return apiError("NO_FILE", "No file provided", 400);
+		}
+
+		const contentLength = request.headers.get("Content-Length");
+		if (contentLength !== null) {
+			const declaredSize = Number(contentLength);
+			if (!Number.isSafeInteger(declaredSize) || declaredSize < 0) {
+				return apiError("INVALID_REQUEST", "Invalid Content-Length header", 400);
+			}
+			if (declaredSize > expectedSize) {
+				return apiError("PAYLOAD_TOO_LARGE", "Upload exceeds the expected size", 413);
+			}
+			if (declaredSize !== expectedSize) {
+				return apiError("UPLOAD_SIZE_MISMATCH", "Upload size does not match the media item", 400);
+			}
+		}
+
+		let receivedSize = 0;
+		const shouldHash = expectedSize > 0 && expectedSize <= MAX_CONTENT_HASH_BYTES;
+		let hashBytes: Uint8Array | null = null;
+		const checkedBody = requestBody.pipeThrough(
+			new TransformStream<Uint8Array, Uint8Array>({
+				transform(chunk, controller) {
+					const offset = receivedSize;
+					receivedSize += chunk.byteLength;
+					if (receivedSize > expectedSize) {
+						controller.error(new UploadBodyError("PAYLOAD_TOO_LARGE"));
+						return;
+					}
+					if (shouldHash && chunk.byteLength > 0) {
+						if (!hashBytes) {
+							hashBytes = new Uint8Array(
+								Math.min(expectedSize, Math.max(INITIAL_HASH_BUFFER_BYTES, receivedSize)),
+							);
+						} else if (receivedSize > hashBytes.byteLength) {
+							const grown = new Uint8Array(
+								Math.min(expectedSize, Math.max(receivedSize, hashBytes.byteLength * 2)),
+							);
+							grown.set(hashBytes);
+							hashBytes = grown;
+						}
+						hashBytes.set(chunk, offset);
+					}
+					controller.enqueue(chunk);
+				},
+				flush(controller) {
+					if (receivedSize !== expectedSize) {
+						controller.error(new UploadBodyError("UPLOAD_SIZE_MISMATCH"));
+					}
+				},
+			}),
+		);
+		const body = preserveKnownLength(checkedBody, expectedSize);
+
+		const attemptKey = createUploadAttemptKey(media.storageKey);
+		await repo.createUploadAttempt(id, attemptKey);
+
+		let attemptSize: number;
+		try {
+			const result = await emdash.storage.upload({
+				key: attemptKey,
+				body,
+				contentType: media.mimeType,
+			});
+			attemptSize = result.size;
+		} catch (error) {
+			await removeUploadAttempt(emdash.storage, repo, attemptKey);
+			const bodyError = findUploadBodyError(error);
+			if (bodyError?.code === "PAYLOAD_TOO_LARGE") {
+				return apiError("PAYLOAD_TOO_LARGE", "Upload exceeds the expected size", 413);
+			}
+			if (bodyError?.code === "UPLOAD_SIZE_MISMATCH") {
+				return apiError("UPLOAD_SIZE_MISMATCH", "Upload size does not match the media item", 400);
+			}
+			return handleError(error, "Upload failed", "UPLOAD_ERROR");
+		}
+
+		if (receivedSize !== expectedSize || attemptSize !== expectedSize) {
+			await removeUploadAttempt(emdash.storage, repo, attemptKey);
+			return apiError("UPLOAD_SIZE_MISMATCH", "Upload size does not match the media item", 400);
+		}
+		const contentHash = hashBytes ? await computeContentHash(hashBytes) : undefined;
+
+		let published: boolean;
+		try {
+			published = await repo.publishPendingStorageKey(
+				id,
+				media.storageKey,
+				attemptKey,
+				contentHash,
+			);
+		} catch (error) {
+			try {
+				const current = await repo.findById(id);
+				if (
+					current?.storageKey === attemptKey &&
+					(current.status === "pending" || current.status === "ready") &&
+					current.size === expectedSize &&
+					(await getStoredSize(emdash.storage, attemptKey)) === expectedSize
+				) {
+					return apiSuccess({ uploaded: true, size: expectedSize });
+				}
+			} catch (verificationError) {
+				console.error("[media] upload publication verification failed:", verificationError);
+			}
+			return handleError(error, "Upload failed", "UPLOAD_ERROR");
+		}
+
+		if (!published) {
+			const current = await repo.findById(id);
+			if (
+				current &&
+				(current.status === "pending" || current.status === "ready") &&
+				current.size === expectedSize &&
+				(current.storageKey === attemptKey ||
+					expectedSize === 0 ||
+					(contentHash !== undefined && current.contentHash === contentHash)) &&
+				(await getStoredSize(emdash.storage, current.storageKey)) === expectedSize
+			) {
+				if (current.storageKey !== attemptKey) {
+					await removeUploadAttempt(emdash.storage, repo, attemptKey);
+				}
+				return apiSuccess({ uploaded: true, size: expectedSize });
+			}
+			await removeUploadAttempt(emdash.storage, repo, attemptKey);
+			return apiError("INVALID_STATE", "Media item is no longer pending", 400);
+		}
+
+		await removeUploadAttempt(emdash.storage, repo, media.storageKey);
+		return apiSuccess({ uploaded: true, size: receivedSize });
+	} catch (error) {
+		return handleError(error, "Upload failed", "UPLOAD_ERROR");
+	}
+};

package/src/astro/routes/api/media/[id].ts

@@ -13,6 +13,8 @@ import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
 import { handleMediaUsageSummaries } from "#api/handlers/media-usage.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { mediaGetQuery, mediaUpdateBody } from "#api/schemas.js";
+import { MediaRepository } from "#db/repositories/media.js";
+import { removeUploadAttempt } from "#media/upload-attempts.js";
 
 export const prerender = false;
 
@@ -137,20 +139,27 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 		);
 		if (ownerDenied) return ownerDenied;
 
-		// Delete file from storage via the storage adapter
-		if (emdash.storage) {
-			try {
-				await emdash.storage.delete(media.storageKey);
-			} catch {
-				// Best-effort — continue with database deletion
-			}
-		}
-
 		// Delete from database — site-settings cache invalidation happens
 		// in `EmDashRuntime.handleMediaDelete` so MCP/plugin paths inherit it.
 		const result = await emdash.handleMediaDelete(id);
+		if (!result.success) return unwrapResult(result);
+		if (
+			typeof result.data !== "object" ||
+			result.data === null ||
+			!("storageKey" in result.data) ||
+			typeof result.data.storageKey !== "string"
+		) {
+			return apiError("MEDIA_DELETE_ERROR", "Failed to delete media", 500);
+		}
 
-		return unwrapResult(result);
+		if (emdash.storage) {
+			const repo = new MediaRepository(emdash.db);
+			await removeUploadAttempt(emdash.storage, repo, result.data.storageKey, {
+				allowUntracked: true,
+			});
+		}
+
+		return apiSuccess({ deleted: true });
 	} catch (error) {
 		return handleError(error, "Failed to delete media", "MEDIA_DELETE_ERROR");
 	}

package/src/astro/routes/api/media/upload-url.ts

@@ -39,6 +39,10 @@ interface ExistingMediaResponse {
 	url: string;
 }
 
+function isUnsupportedSignedUpload(error: unknown): boolean {
+	return error instanceof Error && "code" in error && error.code === "NOT_SUPPORTED";
+}
+
 /**
  * Get a signed upload URL for direct-to-storage upload
  */
@@ -71,6 +75,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		}
 		const body = await parseBody(request, mediaUploadUrlBody(maxSize));
 		if (isParseError(body)) return body;
+		const normalizedContentType = normalizeMime(body.contentType);
 
 		// Validate content type (field-aware widening)
 		const fieldAllowlist = body.fieldId
@@ -85,9 +90,9 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const repo = new MediaRepository(emdash.db);
 
 		// Check for existing content with same hash (deduplication)
-		if (body.contentHash) {
+		if (body.contentHash && body.size > 0) {
 			const existing = await repo.findByContentHash(body.contentHash);
-			if (existing) {
+			if (existing && existing.mimeType === normalizedContentType && existing.size === body.size) {
 				const response: ExistingMediaResponse = {
 					existing: true,
 					mediaId: existing.id,
@@ -103,49 +108,41 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const ext = path.extname(body.filename) || "";
 		const storageKey = `${id}${ext}`;
 
-		// Create pending media record with content hash
+		let signedUrl: Awaited<ReturnType<typeof emdash.storage.getSignedUploadUrl>> | null;
+		try {
+			signedUrl = await emdash.storage.getSignedUploadUrl({
+				key: storageKey,
+				contentType: body.contentType,
+				size: body.size,
+				expiresIn: 3600,
+			});
+		} catch (error) {
+			if (!isUnsupportedSignedUpload(error)) throw error;
+			signedUrl = null;
+		}
+
 		const mediaItem = await repo.createPending({
 			filename: body.filename,
-			mimeType: normalizeMime(body.contentType),
+			mimeType: normalizedContentType,
 			size: body.size,
 			storageKey,
-			contentHash: body.contentHash,
 			authorId: user?.id,
 		});
 
-		// Get signed upload URL from storage
-		const signedUrl = await emdash.storage.getSignedUploadUrl({
-			key: storageKey,
-			contentType: body.contentType,
-			size: body.size,
-			expiresIn: 3600, // 1 hour
-		});
-
 		const response: UploadUrlResponse = {
-			uploadUrl: signedUrl.url,
-			method: signedUrl.method,
-			headers: signedUrl.headers,
+			uploadUrl: signedUrl?.url ?? `/_emdash/api/media/${mediaItem.id}/upload`,
+			method: signedUrl?.method ?? "PUT",
+			headers: signedUrl?.headers ?? {
+				"Content-Type": normalizedContentType,
+				"X-EmDash-Request": "1",
+			},
 			mediaId: mediaItem.id,
 			storageKey,
-			expiresAt: signedUrl.expiresAt,
+			expiresAt: signedUrl?.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString(),
 		};
 
 		return apiSuccess(response);
 	} catch (error) {
-		// Check if storage doesn't support signed URLs (e.g., local storage)
-		if (
-			error instanceof Error &&
-			"code" in error &&
-			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowing error to check custom code property after "code" in error guard
-			(error as { code: string }).code === "NOT_SUPPORTED"
-		) {
-			return apiError(
-				"NOT_SUPPORTED",
-				"Storage does not support signed upload URLs. Use direct upload.",
-				501,
-			);
-		}
-
 		return handleError(error, "Failed to generate upload URL", "UPLOAD_URL_ERROR");
 	}
 };