Function post

pages/api/files/upload-chunk.ts:44–171

({ request, user }: RequestHandlerParams)

}

async function post({ request, user }: RequestHandlerParams) {
  if (
    !(await AppConfig.isAppEnabled('files')) && !(await AppConfig.isAppEnabled('photos')) &&
    !(await AppConfig.isAppEnabled('notes'))
  ) {
    return new Response('Forbidden', { status: 403 });
  }

  const requestBody = await request.clone().formData();

  const uploadId = requestBody.get('upload_id') as string;
  const chunkIndexStr = requestBody.get('chunk_index') as string;
  const totalChunksStr = requestBody.get('total_chunks') as string;
  const pathInView = requestBody.get('path_in_view') as string;
  const parentPath = requestBody.get('parent_path') as string;
  const name = requestBody.get('name') as string;
  const chunk = requestBody.get('chunk') as File | null;

  const chunkIndex = parseInt(chunkIndexStr, 10);
  const totalChunks = parseInt(totalChunksStr, 10);

  if (
    !uploadId ||
    !/^[a-zA-Z0-9-]+$/.test(uploadId) ||
    isNaN(chunkIndex) || chunkIndex < 0 ||
    isNaN(totalChunks) || totalChunks < 1 ||
    chunkIndex >= totalChunks ||
    !parentPath ||
    !pathInView ||
    !name?.trim() ||
    !chunk ||
    !parentPath.startsWith('/') ||
    parentPath.includes('../') ||
    !pathInView.startsWith('/') ||
    pathInView.includes('../')
  ) {
    return new Response('Bad Request', { status: 400 });
  }

  try {
    await ensureUserPathIsValidAndSecurelyAccessible(user!.id, join(parentPath, name.trim()));
  } catch {
    return new Response('Bad Request', { status: 400 });
  }

  const filesRootPath = await AppConfig.getFilesRootPath();
  const userUploadDir = join(filesRootPath, user!.id, '.chunk-uploads');
  const uploadDir = join(userUploadDir, uploadId);

  // On the first chunk of a new upload, evict any stale sessions from this user.
  if (chunkIndex === 0) {
    await cleanStaleUploads(userUploadDir);
  }

  try {
    await Deno.mkdir(uploadDir, { recursive: true });

    const chunkData = await chunk.arrayBuffer();