TX/artifacts/api-server/src/routes/storage-local-upload.ts

import { Router, type IRouter, type Request, type Response } from "express";
import { verifyLocalUploadToken, writeLocalObject, ACTIVE_STORAGE_DRIVER } from "../lib/objectStorage";

const router: IRouter = Router();

/**
 * PUT /storage/_local/upload?token=<HMAC>
 *
 * Receives the body of a presigned upload issued by the local-FS storage
 * driver. The token is HMAC-signed with LOCAL_STORAGE_SIGNING_SECRET (or
 * SESSION_SECRET as fallback) and carries the bucket+object key + expiry.
 * Only mounted when STORAGE_DRIVER=local (or unset and S3 not configured);
 * when S3 is the active driver, this endpoint refuses to run.
 */
router.put("/storage/_local/upload", async (req: Request, res: Response) => {
  if (ACTIVE_STORAGE_DRIVER() !== "local") {
    res.status(404).json({ error: "Not found" });
    return;
  }
  const token = typeof req.query.token === "string" ? req.query.token : null;
  if (!token) {
    res.status(400).json({ error: "Missing token" });
    return;
  }
  const verified = verifyLocalUploadToken(token);
  if (!verified) {
    res.status(403).json({ error: "Invalid or expired upload token" });
    return;
  }
  try {
    const contentType = typeof req.headers["content-type"] === "string"
      ? req.headers["content-type"]
      : undefined;
    await writeLocalObject(verified.b, verified.o, req, contentType);
    res.status(200).json({ ok: true });
  } catch (err) {
    req.log.error({ err }, "local storage upload failed");
    res.status(500).json({ error: "Upload failed" });
  }
});

export default router;