feat(uploads): size one upload against the account's own quota

The per-file ceiling was a flat 5 GiB from the environment, which is both
too small for a paying account with 200 GB of storage and unaware of what
an upload actually costs. The provider derives its own renditions from the
file (1080p, 720p and down) and bills them to the same account, so a file
allowed to fill the quota exactly is over it by the time it finishes
processing.

The ceiling is now 80% of whatever limit the account is held to: 160 GB on
the plan, 2.4 GB on a cardless trial, and it moves on its own when either
number changes. OPENFRAME_MAX_VIDEO_UPLOAD_BYTES keeps working as an
absolute cap for a host that wants one, where the lower of the two applies,
and an instance running without billing has no quota to divide and falls
back to the flat 5 GiB. The refusal now names the ceiling, which the old
one left the client to guess.

Finalize re-checks only the host cap. Re-deriving the account's ceiling
there would delete a finished upload over a plan that lapsed while the
bytes were in flight, and an upload larger than what was declared is
already caught by the declared-size check beside it.

lib/feature-flags.ts

@@ -77,20 +77,31 @@ export function isDirectFileUploadEnabled() {
   return isS3VideoUploadsEnabled() || isBunnyUploadsEnabled();
 }
 
-export function getMaxVideoUploadBytes(): bigint {
+/**
+ * The per-file ceiling for a host that has no billing, and therefore no per
+ * account quota to derive one from.
+ */
+export const DEFAULT_MAX_VIDEO_UPLOAD_BYTES =
+  BigInt(5) * BigInt(1024) * BigInt(1024) * BigInt(1024);
+
+/**
+ * A flat per-file ceiling this host has pinned, or null when it has not.
+ *
+ * Null is the ordinary case. The ceiling that applies to a paying account is a
+ * share of that account's own storage quota, which one number in the
+ * environment cannot express (see `getMaxVideoUploadBytesForUser`). A host that
+ * wants an absolute cap on top of that still sets this, and the lower of the
+ * two wins.
+ */
+export function getConfiguredMaxVideoUploadBytes(): bigint | null {
   const raw = process.env.OPENFRAME_MAX_VIDEO_UPLOAD_BYTES?.trim();
-  if (!raw) {
-    return BigInt(5) * BigInt(1024) * BigInt(1024) * BigInt(1024);
-  }
+  if (!raw) return null;
 
   try {
     const parsed = BigInt(raw);
-    if (parsed <= BigInt(0)) {
-      return BigInt(5) * BigInt(1024) * BigInt(1024) * BigInt(1024);
-    }
-    return parsed;
+    return parsed > BigInt(0) ? parsed : null;
   } catch {
-    return BigInt(5) * BigInt(1024) * BigInt(1024) * BigInt(1024);
+    return null;
   }
 }
 

lib/r2-video-finalize.ts

@@ -1,5 +1,5 @@
 import { db } from '@/lib/db';
-import { getMaxVideoUploadBytes } from '@/lib/feature-flags';
+import { getConfiguredMaxVideoUploadBytes } from '@/lib/feature-flags';
 import { deleteR2Object, deleteVideoObject, headVideoObject, readVideoObjectBytes } from '@/lib/r2';
 import { parseR2UploadToken, verifyR2UploadToken } from '@/lib/r2-upload-token';
 import {
@@ -154,7 +154,12 @@ export async function finalizeR2VideoUpload(
     return cancelPendingUpload('Uploaded video was not found in storage');
   }
 
-  if (head.contentLength > getMaxVideoUploadBytes()) {
+  // Only the host's absolute cap is re-checked here. The account's own ceiling
+  // was applied when the upload was initiated, and re-deriving it now would
+  // delete a finished upload over a plan that lapsed while the bytes were in
+  // flight. Anything larger than what was declared is caught on the next line.
+  const hostCeiling = getConfiguredMaxVideoUploadBytes();
+  if (hostCeiling !== null && head.contentLength > hostCeiling) {
     return cancelPendingUpload('Uploaded video exceeds the maximum allowed upload size');
   }
 

lib/storage-quota.ts

@@ -1,10 +1,15 @@
 import type { NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { apiErrors } from '@/lib/api-response';
-import { isStripeFeatureEnabled } from '@/lib/feature-flags';
+import {
+  DEFAULT_MAX_VIDEO_UPLOAD_BYTES,
+  getConfiguredMaxVideoUploadBytes,
+  isStripeFeatureEnabled,
+} from '@/lib/feature-flags';
 import { getUserBunnyStorageBytes } from '@/lib/admin-stats';
 import { isPaidTier } from '@/lib/billing';
 import { getStorageLimitBytes } from '@/lib/trial-limits';
+import { formatSizeLimit } from '@/lib/upload-size';
 
 // 200 GB expressed in bytes
 export const PLAN_STORAGE_LIMIT_BYTES = BigInt(200) * BigInt(1024) * BigInt(1024) * BigInt(1024);
@@ -46,12 +51,41 @@ export async function getStorageContextForUser(userId: string): Promise<StorageC
 }
 
 /**
- * Whole gigabytes where the number is whole, which every ceiling we ship is.
- * A host that sets an odd one gets a decimal rather than a rounded lie.
+ * The share of an account's storage ceiling one single upload may take.
+ *
+ * A video costs more than the file that was handed to us: the provider derives
+ * its own renditions from it (1080p, 720p and down) and those land in the same
+ * account's usage. A file allowed to fill the whole quota would therefore be
+ * over the quota by the time it finished processing, so a fifth of the ceiling
+ * is left free for what the upload turns into.
  */
-function formatStorageLimit(bytes: bigint): string {
-  const gigabytes = Number(bytes) / 1024 ** 3;
-  return `${Number.isInteger(gigabytes) ? gigabytes : gigabytes.toFixed(1)} GB`;
+export const MAX_UPLOAD_SHARE_PERCENT = BigInt(80);
+
+/** The largest single file that fits under `limitBytes` with room to transcode. */
+export function getMaxUploadBytesForLimit(limitBytes: bigint): bigint {
+  return (limitBytes * MAX_UPLOAD_SHARE_PERCENT) / BigInt(100);
+}
+
+/**
+ * The largest single file this account may upload.
+ *
+ * Derived from the account's own ceiling rather than fixed, so the answer moves
+ * with the plan: 200 GB of storage allows a 160 GB file, and a cardless trial's
+ * 3 GB allows 2.4 GB. A host that has pinned an absolute cap still wins where
+ * it is the lower of the two, and a host running without billing has no quota
+ * to divide, so it falls back to the flat default.
+ */
+export async function getMaxVideoUploadBytesForUser(userId: string): Promise<bigint> {
+  const hostCeiling = getConfiguredMaxVideoUploadBytes();
+
+  if (!isStripeFeatureEnabled()) {
+    return hostCeiling ?? DEFAULT_MAX_VIDEO_UPLOAD_BYTES;
+  }
+
+  const { limitBytes } = await getStorageContextForUser(userId);
+  const quotaCeiling = getMaxUploadBytesForLimit(limitBytes);
+
+  return hostCeiling !== null && hostCeiling < quotaCeiling ? hostCeiling : quotaCeiling;
 }
 
 /**
@@ -68,8 +102,8 @@ export function storageExceededResponse(context: StorageContext): NextResponse {
   }
 
   return apiErrors.trialStorageExceeded(
-    `Your free trial includes ${formatStorageLimit(context.limitBytes)} of storage. ` +
-      `Upgrade to get ${formatStorageLimit(PLAN_STORAGE_LIMIT_BYTES)}.`
+    `Your free trial includes ${formatSizeLimit(context.limitBytes)} of storage. ` +
+      `Upgrade to get ${formatSizeLimit(PLAN_STORAGE_LIMIT_BYTES)}.`
   ) as NextResponse;
 }
 

lib/trial-limits.ts

@@ -26,10 +26,10 @@ export const TRIAL_PROJECT_LIMIT = 1;
  */
 export const TRIAL_STORAGE_LIMIT_BYTES = BigInt(3) * BigInt(1024) * BigInt(1024) * BigInt(1024);
 
-// There is deliberately no separate per-file ceiling for trials. The default
-// per-file limit is 5 GiB and the trial's total is 3 GiB, so the quota check
-// already refuses anything bigger, and a second limit would only add a second
-// way to be told no.
+// There is deliberately no separate per-file ceiling for trials. The per-file
+// ceiling is a share of whatever limit applies to the account (see
+// `getMaxVideoUploadBytesForUser`), so a trial is already held to 80% of these
+// 3 GiB without a second number to keep in step with this one.
 
 export function getStorageLimitBytes(isPaid: boolean, planLimitBytes: bigint): bigint {
   if (isPaid) return planLimitBytes;

lib/upload-size.ts

@@ -6,9 +6,28 @@
 
 export type DeclaredUploadSize = { sizeBytes: bigint } | { error: string };
 
+/**
+ * A byte count in the unit a person reading a limit expects.
+ *
+ * Whole gigabytes where the number is whole, which most ceilings we ship are,
+ * and one decimal otherwise so a share of a small quota is not rounded into a
+ * lie. Lives here rather than next to the quota because the upload routes need
+ * it too, and this module imports nothing.
+ */
+export function formatSizeLimit(bytes: bigint): string {
+  const gigabytes = Number(bytes) / 1024 ** 3;
+  if (gigabytes < 1) return `${Math.round(Number(bytes) / 1024 ** 2)} MB`;
+  return `${Number.isInteger(gigabytes) ? gigabytes : gigabytes.toFixed(1)} GB`;
+}
+
+/** The refusal, with the ceiling in it, so the client knows what would fit. */
+export function uploadTooLargeMessage(maxBytes: bigint): string {
+  return `File exceeds the maximum allowed upload size (${formatSizeLimit(maxBytes)})`;
+}
+
 /**
  * Reads a declared upload size, refusing anything that is not a whole positive
- * number of bytes within the host's per-file ceiling.
+ * number of bytes within the ceiling this account is held to.
  *
  * The number is the client's word and is treated as such. Overstating it only
  * spends the caller's own quota, and understating it is caught where the bytes
@@ -34,7 +53,7 @@ export function parseDeclaredUploadSize(raw: unknown, maxBytes: bigint): Declare
   }
 
   if (sizeBytes > maxBytes) {
-    return { error: 'File exceeds the maximum allowed upload size' };
+    return { error: uploadTooLargeMessage(maxBytes) };
   }
 
   return { sizeBytes };