yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(uploads): count a Bunny upload from the moment it is admitted

Browse Source 
A Bunny init asked the quota whether it could store zero bytes, which is a
question with only one answer. Nothing an upload was about to consume was
visible to the next request, so every init inside the same window read the
same total and every one of them passed, and an upload that could never
fit was only refused after it had been sent.

The client now declares the size up front. It is checked against the
account's remaining room before Bunny is asked for anything, and held as
a reservation the next init has to see. The declaration is a claim rather
than proof, so it is signed into the upload token: the same token already
binds the video id, which is what makes the reservation safe to release
on a caller's say-so, since releasing it costs them the video it belongs
to.

The declared size is then written onto the version or asset row and the
reservation is dropped in the same transaction, because Bunny reports no
size at all for a video until it has finished encoding it. On a half hour
of footage that is most of an hour during which the upload did not appear
on the uploader's own storage page and did not count against the next
upload. Per-video accounting now takes the larger of what Bunny reports
and what was declared, so the estimate stands in until the real figure
arrives and Bunny's wins once it does.

Two smaller things came out of the same reading. The asset route's
in-transaction fallback compared against the plan limit, so a caller
quoting a reservation that no longer existed was measured against 200 GiB
even on a trial worth three. And the guest branch reserves without being
able to release early, because a guest grant is bound to our video id and
the caller's network context rather than to the Bunny video, which would
let the reservation be dropped while the upload it stands for carried on.
This commit is contained in:
yusufipek
2026-08-18 10:35:08 +03:00
parent 32164db15c
commit 4ff801738c
15 changed files with 606 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/videos/[videoId]/assets/bunny-init/route.ts
+58 -4
View File
@@ -2,7 +2,11 @@ import crypto from 'crypto';
import { NextRequest } from 'next/server';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
import { rateLimit } from '@/lib/rate-limit';
import { createBunnyUploadToken, verifyBunnyUploadToken } from '@/lib/bunny-upload-token';
import {
createBunnyUploadToken,
readBunnyUploadGrant,
verifyBunnyUploadToken,
} from '@/lib/bunny-upload-token';
import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
import {
createGuestUploadToken,
@@ -10,14 +14,23 @@ import {
enforceGuestUploadQuota,
verifyGuestUploadToken,
} from '@/lib/guest-upload-token';
import { isBunnyUploadsEnabled } from '@/lib/feature-flags';
import { getMaxVideoUploadBytes, isBunnyUploadsEnabled } from '@/lib/feature-flags';
import { getShareSessionFromRequest } from '@/lib/share-session';
import { getVideoAssetAccessContext, SAFE_BUNNY_VIDEO_ID } from '@/lib/video-assets';
import { logError } from '@/lib/logger';
import { enforceStorageQuota } from '@/lib/storage-quota';
import {
enforceStorageQuota,
releaseStorageReservation,
reserveStorageQuota,
} from '@/lib/storage-quota';
import { parseDeclaredUploadSize } from '@/lib/upload-size';
type RouteParams = { params: Promise<{ videoId: string }> };
// Matches the project video path: long enough to outlive a slow upload and
// Bunny's own reporting delay.
const BUNNY_RESERVATION_TTL_MS = 2 * 60 * 60 * 1000;
// POST /api/videos/[videoId]/assets/bunny-init
export async function POST(request: NextRequest, { params }: RouteParams) {
try {
@@ -37,8 +50,16 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.badRequest('Direct uploads are disabled by this host');
}
// See the project video route for why the client's declared size is asked for
// and what it is worth: it buys an honest refusal before the upload starts,
// and a reservation that concurrent uploads can see.
const declaredSize = parseDeclaredUploadSize(body?.sizeBytes, getMaxVideoUploadBytes());
if ('error' in declaredSize) {
return apiErrors.badRequest(declaredSize.error);
}
const billedUserId = context.video.project.workspace.ownerId;
const quotaError = await enforceStorageQuota(billedUserId, BigInt(0));
const quotaError = await enforceStorageQuota(billedUserId, declaredSize.sizeBytes);
if (quotaError) return quotaError;
const shareSession = getShareSessionFromRequest(request, context.video.id);
@@ -52,10 +73,19 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
if (quotaError) return quotaError;
}
const reserveResult = await reserveStorageQuota(
billedUserId,
declaredSize.sizeBytes,
BUNNY_RESERVATION_TTL_MS
);
if ('error' in reserveResult) return reserveResult.error;
const { reservationId } = reserveResult;
const apiKey = process.env.BUNNY_STREAM_API_KEY;
const libraryId =
process.env.BUNNY_STREAM_LIBRARY_ID || process.env.NEXT_PUBLIC_BUNNY_STREAM_LIBRARY_ID;
if (!apiKey || !libraryId) {
await releaseStorageReservation(reservationId, billedUserId);
return apiErrors.internalError('Bunny Stream is not configured correctly');
}
@@ -70,6 +100,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
});
if (!bunnyRes.ok) {
await releaseStorageReservation(reservationId, billedUserId);
logError('Failed to create Bunny Stream video asset', await bunnyRes.text());
return apiErrors.internalError('Failed to initialize Bunny upload');
}
@@ -77,6 +108,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const bunnyVideo = await bunnyRes.json();
const bunnyVideoId = typeof bunnyVideo?.guid === 'string' ? bunnyVideo.guid.trim() : '';
if (!bunnyVideoId || !SAFE_BUNNY_VIDEO_ID.test(bunnyVideoId)) {
await releaseStorageReservation(reservationId, billedUserId);
return apiErrors.internalError('Upload provider did not return a valid video identifier');
}
@@ -92,15 +124,24 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
userId: context.viewerUserId,
projectId: context.video.projectId,
videoId: bunnyVideoId,
reservationId,
},
3600
);
} else {
const expectedContext = deriveGuestUploadContext(request, shareSession?.token ?? null);
if (!expectedContext) {
await releaseStorageReservation(reservationId, billedUserId);
return apiErrors.forbidden('Missing trusted client IP header');
}
// No reservation id in the guest grant, so a guest cancelling waits out the
// two hours instead of getting the quota back at once. The guest token is
// bound to our own video id and the caller's network context, not to the
// Bunny video being uploaded, so a released-on-request reservation could be
// dropped while the upload it stands for carried on. Guests are capped at
// four of these per quarter hour, which bounds what the wait can cost.
uploadToken = createGuestUploadToken(
{
projectId: context.video.projectId,
@@ -171,6 +212,19 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
}
}
if (context.viewerUserId) {
// Safe on the caller's say-so because the reservation id is signed into the
// same token as this Bunny video id: releasing it costs them the video.
await releaseStorageReservation(
readBunnyUploadGrant(uploadToken, {
userId: context.viewerUserId,
projectId: context.video.projectId,
videoId: bunnyVideoId,
})?.reservationId ?? null,
context.video.project.workspace.ownerId
);
}
await cleanupBunnyStreamVideos([{ providerId: 'bunny', videoId: bunnyVideoId }]);
const response = successResponse({ message: 'Pending upload cleaned up' });
return withCacheControl(response, 'private, no-store');
app/api/videos/[videoId]/assets/route.ts
+19 -6
View File
@@ -6,7 +6,7 @@ import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response
import { rateLimit } from '@/lib/rate-limit';
import { db } from '@/lib/db';
import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
import { verifyBunnyUploadToken } from '@/lib/bunny-upload-token';
import { readBunnyUploadGrant } from '@/lib/bunny-upload-token';
import { deriveGuestUploadContext, verifyGuestUploadToken } from '@/lib/guest-upload-token';
import { ensureGuestIdentityFromRequest, setGuestIdentityCookie } from '@/lib/guest-identity';
import { getShareSessionFromRequest } from '@/lib/share-session';
@@ -32,7 +32,7 @@ import {
enforceStorageQuota,
reserveStorageQuota,
releaseStorageReservation,
PLAN_STORAGE_LIMIT_BYTES,
getStorageLimitForUser,
} from '@/lib/storage-quota';
import { getCachedUserBunnyStorage } from '@/lib/admin-stats';
import { isStripeFeatureEnabled } from '@/lib/feature-flags';
@@ -494,14 +494,21 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
}
if (context.viewerUserId) {
const isValidUploadToken = verifyBunnyUploadToken(uploadToken, {
const grant = readBunnyUploadGrant(uploadToken, {
userId: context.viewerUserId,
projectId: context.video.projectId,
videoId: providerVideoId,
});
if (!isValidUploadToken) {
if (!grant) {
return apiErrors.forbidden('Invalid Bunny upload token');
}
// Charged from now on the size the upload was admitted on: Bunny reports
// nothing until it has finished encoding, and an asset that reads as zero
// bytes for an hour is an hour of uploads measured against a total that
// does not include it.
assetSizeBytes = grant.declaredSizeBytes ?? BigInt(0);
reservationId = grant.reservationId;
} else {
const shareSession = getShareSessionFromRequest(request, context.video.id);
const expectedContext = deriveGuestUploadContext(request, shareSession?.token ?? null);
@@ -529,7 +536,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
}
kind = 'VIDEO';
const quotaError = await enforceStorageQuota(billedUserId, BigInt(0));
const quotaError = await enforceStorageQuota(billedUserId, assetSizeBytes);
if (quotaError) return quotaError;
}
@@ -545,6 +552,12 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
? await getCachedUserBunnyStorage()
: null;
// The ceiling this account is actually held to, read for the fallback below.
// It used to compare against the plan limit, which is 200 GiB whoever is
// asking: a caller who quoted a reservation id that no longer existed was
// measured against the paid ceiling even on a trial worth 3 GiB.
const storageLimitBytes = await getStorageLimitForUser(billedUserId);
// Create the VideoAsset and atomically consume the upload reservation (if any)
// so the spot is never double-counted.
const created = await db.$transaction(async (tx) => {
@@ -585,7 +598,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
(r2Row?.total ?? BigInt(0)) +
(resRow?.total ?? BigInt(0)) +
BigInt(bunnyData[billedUserId] ?? 0);
if (isStripeFeatureEnabled() && totalUsed + assetSizeBytes >= PLAN_STORAGE_LIMIT_BYTES) {
if (isStripeFeatureEnabled() && totalUsed + assetSizeBytes >= storageLimitBytes) {
throw new QuotaExceededInTxError();
}
}