mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 09:36:08 +00:00
feat: enable S3 video uploads and update related configurations
- Added support for self-hosted S3 video uploads with new environment variables: OPENFRAME_ENABLE_S3_VIDEO_UPLOADS and OPENFRAME_MAX_VIDEO_UPLOAD_BYTES. - Updated .env.example and .env.docker.example to reflect new configuration options. - Enhanced Content Security Policy to include origins for S3-compatible storage. - Updated dependencies for AWS SDK to support new features. - Refactored upload logic to accommodate both Bunny and S3 upload providers. - Updated documentation to clarify the usage of direct uploads and S3 configurations. - Closes #11
This commit is contained in:
yusufipk
@@ -0,0 +1,298 @@
|
||||
import { NextRequest } from 'next/server';
|
||||
import { randomUUID } from 'crypto';
|
||||
import { db } from '@/lib/db';
|
||||
import { auth, checkProjectAccess } from '@/lib/auth';
|
||||
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
|
||||
import { rateLimit } from '@/lib/rate-limit';
|
||||
import {
|
||||
createR2UploadToken,
|
||||
parseR2UploadToken,
|
||||
verifyR2UploadToken,
|
||||
} from '@/lib/r2-upload-token';
|
||||
import {
|
||||
createPresignedImagePutUrl,
|
||||
createPresignedVideoPutUrl,
|
||||
deleteR2Object,
|
||||
deleteVideoObject,
|
||||
} from '@/lib/r2';
|
||||
import { getMaxVideoUploadBytes, isS3VideoUploadsEnabled } from '@/lib/feature-flags';
|
||||
import {
|
||||
buildVideoObjectKey,
|
||||
getVideoExtensionFromMime,
|
||||
resolveVideoContentType,
|
||||
videoProxyPathFromFilename,
|
||||
} from '@/lib/video-upload-validation';
|
||||
import { logError } from '@/lib/logger';
|
||||
import {
|
||||
enforceStorageQuota,
|
||||
releaseStorageReservation,
|
||||
reserveStorageQuota,
|
||||
} from '@/lib/storage-quota';
|
||||
import { createR2UploadSession } from '@/lib/r2-upload-session';
|
||||
|
||||
type RouteParams = { params: Promise<{ projectId: string }> };
|
||||
|
||||
const VIDEO_RESERVATION_TTL_MS = 2 * 60 * 60 * 1000;
|
||||
const THUMBNAIL_RESERVE_BYTES = BigInt(512 * 1024);
|
||||
|
||||
async function getProjectWithEditAccess(projectId: string, userId: string) {
|
||||
const project = await db.project.findUnique({
|
||||
where: { id: projectId },
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
ownerId: true,
|
||||
workspaceId: true,
|
||||
visibility: true,
|
||||
workspace: { select: { ownerId: true } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!project) return null;
|
||||
|
||||
const access = await checkProjectAccess(project, userId, { intent: 'manage' });
|
||||
if (!access.canEdit) return null;
|
||||
|
||||
return project;
|
||||
}
|
||||
|
||||
// POST /api/projects/[projectId]/videos/r2-init
|
||||
export async function POST(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const limited = await rateLimit(request, 'mutate');
|
||||
if (limited) return limited;
|
||||
|
||||
const session = await auth();
|
||||
const { projectId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
if (!isS3VideoUploadsEnabled()) {
|
||||
return apiErrors.badRequest('S3 video uploads are disabled by this host');
|
||||
}
|
||||
|
||||
const project = await getProjectWithEditAccess(projectId, session.user.id);
|
||||
if (!project) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
const body = await request.json().catch(() => null);
|
||||
const fileName = typeof body?.fileName === 'string' ? body.fileName.trim() : '';
|
||||
const contentTypeInput = typeof body?.contentType === 'string' ? body.contentType.trim() : '';
|
||||
const sizeBytesRaw = body?.sizeBytes;
|
||||
|
||||
if (!fileName) {
|
||||
return apiErrors.badRequest('fileName is required');
|
||||
}
|
||||
|
||||
let sizeBytes: bigint;
|
||||
try {
|
||||
sizeBytes = BigInt(sizeBytesRaw);
|
||||
if (sizeBytes <= BigInt(0)) {
|
||||
return apiErrors.badRequest('sizeBytes must be a positive integer');
|
||||
}
|
||||
} catch {
|
||||
return apiErrors.badRequest('sizeBytes must be a positive integer');
|
||||
}
|
||||
|
||||
const maxBytes = getMaxVideoUploadBytes();
|
||||
if (sizeBytes > maxBytes) {
|
||||
return apiErrors.badRequest('Video file exceeds the maximum allowed upload size');
|
||||
}
|
||||
|
||||
const contentType = resolveVideoContentType(fileName, contentTypeInput);
|
||||
if (!contentType) {
|
||||
return apiErrors.badRequest('Unsupported video format');
|
||||
}
|
||||
|
||||
const ext = getVideoExtensionFromMime(contentType);
|
||||
if (!ext) {
|
||||
return apiErrors.badRequest('Unsupported video format');
|
||||
}
|
||||
|
||||
const quotaError = await enforceStorageQuota(
|
||||
project.workspace.ownerId,
|
||||
sizeBytes + THUMBNAIL_RESERVE_BYTES
|
||||
);
|
||||
if (quotaError) return quotaError;
|
||||
|
||||
const reserveResult = await reserveStorageQuota(
|
||||
project.workspace.ownerId,
|
||||
sizeBytes + THUMBNAIL_RESERVE_BYTES,
|
||||
VIDEO_RESERVATION_TTL_MS
|
||||
);
|
||||
if ('error' in reserveResult) return reserveResult.error;
|
||||
|
||||
const fileId = randomUUID();
|
||||
const filename = `${fileId}.${ext}`;
|
||||
const objectKey = buildVideoObjectKey(filename);
|
||||
const proxyUrl = videoProxyPathFromFilename(filename);
|
||||
const thumbnailFilename = `${fileId}.jpg`;
|
||||
const thumbnailObjectKey = `images/${thumbnailFilename}`;
|
||||
const thumbnailProxyUrl = `/api/upload/image/${thumbnailFilename}`;
|
||||
|
||||
let presignedPutUrl: string;
|
||||
let thumbnailPresignedPutUrl: string;
|
||||
try {
|
||||
[presignedPutUrl, thumbnailPresignedPutUrl] = await Promise.all([
|
||||
createPresignedVideoPutUrl(objectKey, contentType, sizeBytes),
|
||||
createPresignedImagePutUrl(thumbnailObjectKey, 'image/jpeg'),
|
||||
]);
|
||||
} catch (error) {
|
||||
await releaseStorageReservation(reserveResult.reservationId, project.workspace.ownerId);
|
||||
logError('Failed to create presigned video upload URL:', error);
|
||||
return apiErrors.internalError('Failed to initialize video upload');
|
||||
}
|
||||
|
||||
const uploadJti = randomUUID();
|
||||
const expiresAt = new Date(Date.now() + VIDEO_RESERVATION_TTL_MS);
|
||||
const uploadSession = await createR2UploadSession({
|
||||
userId: session.user.id,
|
||||
projectId,
|
||||
billedUserId: project.workspace.ownerId,
|
||||
objectKey,
|
||||
thumbnailObjectKey,
|
||||
declaredSizeBytes: sizeBytes,
|
||||
contentType,
|
||||
reservationId: reserveResult.reservationId,
|
||||
uploadJti,
|
||||
expiresAt,
|
||||
});
|
||||
|
||||
const uploadToken = createR2UploadToken({
|
||||
userId: session.user.id,
|
||||
projectId,
|
||||
objectKey,
|
||||
sessionId: uploadSession.id,
|
||||
tokenId: uploadJti,
|
||||
thumbnailObjectKey,
|
||||
});
|
||||
|
||||
const response = successResponse({
|
||||
presignedPutUrl,
|
||||
objectKey,
|
||||
proxyUrl,
|
||||
uploadToken,
|
||||
reservationId: reserveResult.reservationId,
|
||||
contentType,
|
||||
thumbnailPresignedPutUrl,
|
||||
thumbnailObjectKey,
|
||||
thumbnailProxyUrl,
|
||||
});
|
||||
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error initializing R2 video upload:', error);
|
||||
return apiErrors.internalError('Failed to initialize upload');
|
||||
}
|
||||
}
|
||||
|
||||
// DELETE /api/projects/[projectId]/videos/r2-init
|
||||
export async function DELETE(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const limited = await rateLimit(request, 'mutate');
|
||||
if (limited) return limited;
|
||||
|
||||
const session = await auth();
|
||||
const { projectId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
if (!isS3VideoUploadsEnabled()) {
|
||||
return apiErrors.badRequest('S3 video uploads are disabled by this host');
|
||||
}
|
||||
|
||||
const project = await getProjectWithEditAccess(projectId, session.user.id);
|
||||
if (!project) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
const body = await request.json().catch(() => null);
|
||||
const objectKey = typeof body?.objectKey === 'string' ? body.objectKey.trim() : '';
|
||||
const uploadToken = typeof body?.uploadToken === 'string' ? body.uploadToken.trim() : '';
|
||||
const thumbnailObjectKey =
|
||||
typeof body?.thumbnailObjectKey === 'string' ? body.thumbnailObjectKey.trim() : '';
|
||||
|
||||
if (!objectKey || !uploadToken) {
|
||||
return apiErrors.badRequest('objectKey and uploadToken are required');
|
||||
}
|
||||
|
||||
const tokenPayload = parseR2UploadToken(uploadToken);
|
||||
if (!tokenPayload) {
|
||||
return apiErrors.forbidden('Invalid upload token');
|
||||
}
|
||||
|
||||
const isValidUploadToken = verifyR2UploadToken(uploadToken, {
|
||||
userId: session.user.id,
|
||||
projectId,
|
||||
objectKey,
|
||||
sessionId: tokenPayload.sid,
|
||||
tokenId: tokenPayload.jti,
|
||||
});
|
||||
if (!isValidUploadToken) {
|
||||
return apiErrors.forbidden('Invalid upload token');
|
||||
}
|
||||
|
||||
const uploadSession = await db.videoUploadSession.findFirst({
|
||||
where: {
|
||||
id: tokenPayload.sid,
|
||||
status: 'INITIATED',
|
||||
userId: session.user.id,
|
||||
projectId,
|
||||
objectKey,
|
||||
uploadJti: tokenPayload.jti,
|
||||
expiresAt: { gt: new Date() },
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
reservationId: true,
|
||||
billedUserId: true,
|
||||
thumbnailObjectKey: true,
|
||||
},
|
||||
});
|
||||
if (!uploadSession) {
|
||||
return apiErrors.forbidden('Invalid upload token');
|
||||
}
|
||||
|
||||
if (thumbnailObjectKey && thumbnailObjectKey !== uploadSession.thumbnailObjectKey) {
|
||||
return apiErrors.badRequest('Invalid thumbnail object key');
|
||||
}
|
||||
|
||||
const cancelled = await db.videoUploadSession.updateMany({
|
||||
where: {
|
||||
id: uploadSession.id,
|
||||
status: 'INITIATED',
|
||||
},
|
||||
data: {
|
||||
status: 'CANCELLED',
|
||||
consumedAt: new Date(),
|
||||
},
|
||||
});
|
||||
if (cancelled.count !== 1) {
|
||||
return apiErrors.forbidden('Invalid upload token');
|
||||
}
|
||||
|
||||
try {
|
||||
await Promise.all([
|
||||
deleteVideoObject(objectKey),
|
||||
uploadSession.thumbnailObjectKey.startsWith('images/')
|
||||
? deleteR2Object(uploadSession.thumbnailObjectKey)
|
||||
: Promise.resolve(),
|
||||
]);
|
||||
} catch (error) {
|
||||
logError('Failed to delete pending R2 video object:', error);
|
||||
}
|
||||
|
||||
await releaseStorageReservation(uploadSession.reservationId, uploadSession.billedUserId);
|
||||
|
||||
const response = successResponse({ message: 'Pending upload cleaned up' });
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error cleaning up pending R2 video upload:', error);
|
||||
return apiErrors.internalError('Failed to cleanup pending upload');
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user