feat(downloads): local file upload ingest — media library backend (E7 S5a)

Add the non-yt-dlp ingest path so a user-uploaded file joins the same download library and inherits its function set. Any file type is accepted: media (video/audio) gets the full set (metadata, share, play/edit), a generic file (pdf/zip/docx/…) is download-only. - MediaAsset.media_kind ("video"|"audio"|"file") — the stored discriminator that gates library actions. Set at every finalize (download probe, editor carries the source's kind, upload probe); consolidates the ad-hoc audio-detect that lived only in links.py into one invariant (downloads.mediakind.derive). Migration 0076 adds the column + backfills existing rows. - downloads/upload.py: ingest_upload probes the file (ffprobe → codecs/dims/duration), places it in a per-user .uploads tree, and creates an already-ready asset + done job (the same cache-hit shortcut enqueue uses). Uploads never expire (irreplaceable). - POST /api/downloads/upload: streaming multipart with the per-file cap (download_upload_max_bytes, default 500 MiB) enforced on actual bytes read; quota charges the known size up front (quota.check_upload). - Security: a generic file is always served force-download (attachment + application/octet-stream) on both the in-app and public endpoints, so uploaded HTML/SVG can't execute inline. Edit + redownload reject non-media / upload sources. - python-multipart added (first multipart endpoint in the app).
2026-08-29 08:02:11 +02:00
parent 9eaa01617c
commit fe0b34cd00
17 changed files with 578 additions and 19 deletions
@@ -6,11 +6,14 @@ worker is a separate process); this module never downloads — it enqueues, mana
 serves finished files (range-aware, with the user's custom display name), and shares them.
 """

+import os
 import re
+import tempfile
 from datetime import datetime, timedelta, timezone
+from pathlib import Path
 from urllib.parse import parse_qs, urlparse

-from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi import APIRouter, Depends, File, Form, HTTPException, Request, UploadFile
 from fastapi.responses import FileResponse
 from pydantic import BaseModel
 from sqlalchemy import func, select
@@ -23,7 +26,9 @@ from app.db import get_db
 from app.downloads import credentials as dlcreds
 from app.downloads import edit as editmod
 from app.downloads import links as linksmod
+from app.downloads import mediakind
 from app.downloads import quota, service, storage
+from app.downloads import upload as uploadmod
 from app.models import (
    DownloadJob,
    DownloadLink,
@@ -123,6 +128,9 @@ def _serialize(job: DownloadJob, asset: MediaAsset | None) -> dict:
            "width": asset.width,
            "height": asset.height,
            "container": asset.container,
+            # "video" | "audio" | "file" — the library gates play/edit on this (media only); a
+            # generic uploaded file is download-only. Null while still in flight (set at finalize).
+            "media_kind": asset.media_kind,
            "uploader_url": asset.uploader_url,
            "thumbnail_url": asset.thumbnail_url,
            "expires_at": iso(asset.expires_at),
@@ -354,6 +362,61 @@ def enqueue_download(
    return _serialize_job(db, job)


+# Read the upload in 1 MiB chunks so a large file never sits fully in memory, and the size cap is
+# enforced on the ACTUAL bytes read (a client-set Content-Length can't be trusted to gate it).
+_UPLOAD_CHUNK = 1024 * 1024
+
+
+@router.post("/upload")
+def upload_download(
+    file: UploadFile = File(...),
+    display_name: str | None = Form(None),
+    user: User = Depends(require_human),
+    db: Session = Depends(get_db),
+) -> dict:
+    """Ingest a local file into the caller's library (E7 S5). Any file type is accepted; media
+    (video/audio) gets the full function set, a generic file is download-only. The file is streamed
+    to a temp path under the download volume (enforcing the per-file cap as it goes), then handed to
+    the non-yt-dlp ingest which probes + places it and returns an already-`done` job.
+
+    A sync (threadpool) handler on purpose: the ingest does blocking work — an ffprobe of up to 30s
+    plus sync DB writes — so it must NOT run on the event loop. `file.file` is the sync file object
+    Starlette spools the multipart body into."""
+    cap = sysconfig.get_int(db, "download_upload_max_bytes")
+    staging = Path(settings.download_root) / ".staging" / "uploads"
+    staging.mkdir(parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=str(staging))
+    tmp_path = Path(tmp)
+    try:
+        size = 0
+        with os.fdopen(fd, "wb") as out:
+            while chunk := file.file.read(_UPLOAD_CHUNK):
+                size += len(chunk)
+                if cap and size > cap:
+                    raise HTTPException(
+                        status_code=422, detail={"code": "upload_too_large", "limit": cap}
+                    )
+                out.write(chunk)
+        if size == 0:
+            raise HTTPException(status_code=400, detail={"code": "upload_empty"})
+        try:
+            job = uploadmod.ingest_upload(
+                db,
+                user.id,
+                filename=file.filename or "upload",
+                src_path=tmp_path,
+                size=size,
+                display_name=(display_name or "").strip() or None,
+            )
+        except quota.QuotaExceeded as e:
+            raise HTTPException(status_code=422, detail=_quota_detail(e))
+        return _serialize_job(db, job)
+    finally:
+        # Ingest MOVES the temp file into place on success (unlink is then a no-op); on any early exit
+        # — cap hit, empty, quota, probe/move error — this removes the abandoned staging file.
+        tmp_path.unlink(missing_ok=True)
+
+
 class EnqueueEditIn(BaseModel):
    source_job_id: int = 0
    edit_spec: dict
@@ -544,8 +607,10 @@ def redownload_download(
    never deletes a file another job/user still shares: the old asset is only removed if THIS job
    was its last holder."""
    job = _own_job(db, user, job_id)
-    if job.job_kind == "edit":
-        raise HTTPException(status_code=409, detail="Editor clips can't be re-downloaded.")
+    if job.job_kind in ("edit", "upload"):
+        # Neither has a re-fetchable source: an editor clip is derived locally, an upload IS the
+        # source. Re-running yt-dlp against source_kind='upload'/'edit' would just fail.
+        raise HTTPException(status_code=409, detail="This item can't be re-downloaded.")
    if job.status in ("queued", "running", "paused"):
        raise HTTPException(status_code=409, detail="This download is still in progress.")
    service.redownload(db, job)
@@ -610,7 +675,16 @@ def download_file(

    asset.last_access_at = datetime.now(timezone.utc)
    db.commit()
-    # Starlette's FileResponse honours the Range header (206 partial content) for seek/resume.
+    # A generic uploaded file is served as a neutral, force-download attachment — never with a
+    # sniffable content-type — so uploaded HTML/SVG can't execute inline on this origin. Media keeps
+    # its guessed type so the in-app player streams it. Both are range-aware (FileResponse → 206).
+    if asset.media_kind == mediakind.FILE:
+        return FileResponse(
+            path,
+            filename=filename,
+            media_type="application/octet-stream",
+            content_disposition_type="attachment",
+        )
    return FileResponse(path, filename=filename)


@@ -15,7 +15,7 @@ from sqlalchemy.orm import Session
 from app.config import settings
 from app.db import get_db
 from app.downloads import links as linksmod
-from app.downloads import storage
+from app.downloads import mediakind, storage
 from app.models import DownloadJob, DownloadLink, MediaAsset
 from app.ratelimit import RateLimiter
 from app.security import verify_password
@@ -122,8 +122,18 @@ def watch_file(token: str, g: str | None = None, db: Session = Depends(get_db)):
        raise HTTPException(status_code=404, detail="This video is no longer available.")

    filename = storage.download_filename(asset.title or "video", asset.container, path)
+    # A generic uploaded file (media_kind='file') is ALWAYS a force-download attachment with a
+    # neutral type — never served inline — so arbitrary uploaded HTML/SVG can't execute on this
+    # login-free public origin. Media follows the link's own inline/attachment choice so it can play
+    # in the watch page. Both are range-aware (FileResponse → 206) for seeking/resume.
+    if asset.media_kind == mediakind.FILE:
+        return FileResponse(
+            path,
+            filename=filename,
+            media_type="application/octet-stream",
+            content_disposition_type="attachment",
+        )
    disposition = "attachment" if link.allow_download else "inline"
-    # Starlette's FileResponse honours the Range header (206) for seeking/scrubbing.
    return FileResponse(path, filename=filename, content_disposition_type=disposition)