From 38f91818f876c51dcd7eb7911b65fc7bf5154c83 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 14 Aug 2026 22:01:51 +0200 Subject: feat(files): one uploads/ directory, for files and chat alike MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Correction to the previous commit. Uploads went wherever the member happened to be looking, which spreads chat attachments through the tree and makes the destination a client-supplied path — surface that had to be defended. Everything a member sends now lands in `uploads/` at the root of the shared directory: visible, one place, easy for the operator to look into or empty. Chat attachments go there too, so the separate out-of-tree thumbs directory is not needed and is not built. They were already ordinary uploads; now they are ordinary uploads that land somewhere sensible. The destination is chosen by the node, so a client naming somewhere else changes nothing — the traversal surface simply is not there on this path. safe_subdir() remains for dir_create, where the path genuinely does come from the client, and keeps its tests. One shared directory means name collisions are ordinary rather than adversarial: every camera produces IMG_1234.jpg. The node finds a free name — "IMG_1234 (2).jpg" — and reports it in the ack, because a chat message has to point at the file that was actually written and not at someone else's. Nothing is ever replaced, which is the property the per-user quarantine existed for (C5a) and the one the tests assert; they fail if the free-name search is removed. Co-Authored-By: Claude Opus 5 --- packages/meshbay-hub/src/meshbay_hub/static/app.js | 12 ++++++++---- packages/meshbay-hub/src/meshbay_hub/static/transport.js | 7 +++---- 2 files changed, 11 insertions(+), 8 deletions(-) (limited to 'packages/meshbay-hub') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js index def6c5b..d8b83ed 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/app.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js @@ -1032,7 +1032,7 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth }) { for (let i = 0; i < totalChunks; i++) { const slice = file.slice(i * UPLOAD_CHUNK_SIZE, (i + 1) * UPLOAD_CHUNK_SIZE); const buf = new Uint8Array(await slice.arrayBuffer()); - await transport.uploadChunk(file.name, i, totalChunks, buf, currentPath); + await transport.uploadChunk(file.name, i, totalChunks, buf); // Bytes actually acknowledged by the node, not bytes read locally. setUlState(prev => prev && { ...prev, sent: Math.min(file.size, (i + 1) * UPLOAD_CHUNK_SIZE) }); @@ -1050,7 +1050,7 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth }) { setUploading(false); setUlState(null); } - }, [currentPath]); + }, []); const makeDirectory = useCallback(async () => { const transport = transportRef.current; @@ -1760,10 +1760,14 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, on setAttaching(true); try { const totalChunks = Math.ceil(file.size / UPLOAD_CHUNK_SIZE); + let storedAs = file.name; for (let i = 0; i < totalChunks; i++) { const slice = file.slice(i * UPLOAD_CHUNK_SIZE, (i + 1) * UPLOAD_CHUNK_SIZE); const buf = new Uint8Array(await slice.arrayBuffer()); - await transport.uploadChunk(file.name, i, totalChunks, buf); + const ack = await transport.uploadChunk(file.name, i, totalChunks, buf); + // Two people sending IMG_1234.jpg both succeed; the node picks a free + // name and the message has to point at the one it chose. + if (ack && ack.stored_as) storedAs = ack.stored_as; } await new Promise(r => setTimeout(r, 2500)); if (onRefreshIndex) await onRefreshIndex(); @@ -1771,7 +1775,7 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, on const ftype = ['jpg','jpeg','png','gif','webp','svg'].includes(ext) ? 'image' : ['mp4','webm','mkv','mov','avi'].includes(ext) ? 'video' : 'file'; const structured = JSON.stringify({ - text: '', attachment: { filename: file.name, size: file.size, type: ftype }, + text: '', attachment: { filename: storedAs, size: file.size, type: ftype }, }); await transport.sendChat(structured, 0, null, username); setMessages(prev => [...prev, { diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js index d2b24a3..0306a5c 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js @@ -488,14 +488,13 @@ class MeshBayTransport { this._send({ type: 'stream_req', v: '0.1', file_id: fileId }); } - async uploadChunk(filename, chunkIndex, totalChunks, data, dir) { + async uploadChunk(filename, chunkIndex, totalChunks, data) { + // The node decides where this lands (uploads/) and under what name — it + // finds a free one rather than replacing anything. The ack says which. const msg = await this._sendAndWait({ type: 'file_upload', v: '0.1', filename, - // Where the member is looking. The node confines it under the shared root - // and refuses to overwrite, so this is a destination, not a licence. - dir: dir || '', chunk_index: chunkIndex, total_chunks: totalChunks, data: data, -- cgit v1.2.3