Turn the image library into a file library, with a per-blog upload limit

Bloggers want to attach PDFs, archives, audio and other files to posts,
not only images. The Images tab becomes Files: any type is accepted,
listed by kind with search, paging, rename and multi-file upload, and the
editor's paste/drop/"Insert file" takes anything (images are shown,
everything else becomes a link). The default limit goes from 5 to 10 MB
and the superadmin can override it per blog from /admin/.

Files stay in Postgres so one pg_dump is still the whole blog. The bytea
column is STORAGE EXTERNAL and /media streams it in substring() slices,
so serving never holds a whole file in memory whatever limit a blog gets.

Serving any type on the root domain, which carries the session cookie,
needs a policy: uploads are typed by sniffing (the extension may only
refine a generic sniff to an allowlisted type) and only images, PDF,
plain text, audio and video render inline; HTML, SVG, XML, scripts,
archives and binaries always go out as application/octet-stream with
Content-Disposition: attachment.

The body cap moves out of requireAuth into guardPOST, which runs after
withBlog has resolved the blog and so knows its limit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 33 insertions, 1 deletions

diff --git a/internal/web/handlers_admin.go b/internal/web/handlers_admin.go
index eb040c1..bc28fd8 100644
--- a/internal/web/handlers_admin.go
+++ b/internal/web/handlers_admin.go
@@ -24,7 +24,7 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 		s.serverError(w, err)
 		return
 	}
-	s.render(w, r, "admin/index.html", map[string]any{"users": users, "cfg": s.cfg})
+	s.render(w, r, "admin/index.html", map[string]any{"users": users, "cfg": s.cfg, "defaultLimit": s.cfg.MaxUploadBytes})
 }
 
 func (s *Server) handleAdminNewUserForm(w http.ResponseWriter, r *http.Request) {
@@ -142,6 +142,38 @@ func (s *Server) handleAdminSetDisabled(disabled bool) http.HandlerFunc {
 	}
 }
 
+// handleAdminUploadLimit sets a blog's per-file upload limit; blank restores the default.
+func (s *Server) handleAdminUploadLimit(w http.ResponseWriter, r *http.Request) {
+	id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	b, err := s.st.BlogByID(r.Context(), id)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			http.NotFound(w, r)
+		} else {
+			s.serverError(w, err)
+		}
+		return
+	}
+	field := strings.TrimSpace(r.FormValue("mb"))
+	mb := 0
+	if field != "" {
+		mb, err = strconv.Atoi(field)
+		if err != nil || mb < 1 || mb > maxUploadMB {
+			s.plainError(w, http.StatusBadRequest, s.trf(r, "Enter a whole number of MB (1-%d), or leave blank for the default.", maxUploadMB))
+			return
+		}
+	}
+	if err := s.st.SetBlogUploadLimit(r.Context(), b.ID, int64(mb)<<20); err != nil {
+		s.serverError(w, err)
+		return
+	}
+	if mb == 0 {
+		redirectOK(w, r, "/admin/", s.trf(r, "Upload limit for %s reset to the default.", b.Subdomain))
+		return
+	}
+	redirectOK(w, r, "/admin/", s.trf(r, "Upload limit for %s set to %d MB.", b.Subdomain, mb))
+}
+
 func (s *Server) handleAdminDeleteUserConfirm(w http.ResponseWriter, r *http.Request) {
 	u := s.adminTargetUser(w, r)
 	if u == nil {