Turn the image library into a file library, with a per-blog upload limit

Bloggers want to attach PDFs, archives, audio and other files to posts,
not only images. The Images tab becomes Files: any type is accepted,
listed by kind with search, paging, rename and multi-file upload, and the
editor's paste/drop/"Insert file" takes anything (images are shown,
everything else becomes a link). The default limit goes from 5 to 10 MB
and the superadmin can override it per blog from /admin/.

Files stay in Postgres so one pg_dump is still the whole blog. The bytea
column is STORAGE EXTERNAL and /media streams it in substring() slices,
so serving never holds a whole file in memory whatever limit a blog gets.

Serving any type on the root domain, which carries the session cookie,
needs a policy: uploads are typed by sniffing (the extension may only
refine a generic sniff to an allowlisted type) and only images, PDF,
plain text, audio and video render inline; HTML, SVG, XML, scripts,
archives and binaries always go out as application/octet-stream with
Content-Disposition: attachment.

The body cap moves out of requireAuth into guardPOST, which runs after
withBlog has resolved the blog and so knows its limit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 8 insertions, 5 deletions

diff --git a/internal/web/handlers_media.go b/internal/web/handlers_media.go
index 4e237fa..7c4b739 100644
--- a/internal/web/handlers_media.go
+++ b/internal/web/handlers_media.go
@@ -1,7 +1,6 @@
 package web
 
 import (
-	"bytes"
 	"errors"
 	"io/fs"
 	"net/http"
@@ -10,7 +9,9 @@ import (
 	"github.com/gramanas/blogspace/internal/store"
 )
 
-// handleMedia serves an uploaded image. Ids are immutable, so clients may cache forever.
+// handleMedia serves an uploaded file. Ids are immutable, so clients may cache
+// forever (a renamed file keeps its old download name in caches; acceptable).
+// What may render inline is decided by servedAs, see filetype.go.
 func (s *Server) handleMedia(w http.ResponseWriter, r *http.Request) {
 	id, err := uuid.Parse(r.PathValue("id"))
 	if err != nil {
@@ -22,7 +23,7 @@ func (s *Server) handleMedia(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusNotModified)
 		return
 	}
-	img, err := blogStore(r).ImageData(r.Context(), id)
+	f, err := blogStore(r).FileMeta(r.Context(), id)
 	if err != nil {
 		if errors.Is(err, store.ErrNotFound) {
 			http.NotFound(w, r)
@@ -31,11 +32,13 @@ func (s *Server) handleMedia(w http.ResponseWriter, r *http.Request) {
 		s.serverError(w, err)
 		return
 	}
-	w.Header().Set("Content-Type", img.ContentType)
+	ctype, disposition := servedAs(f.ContentType, r.URL.Query().Has("download"))
+	w.Header().Set("Content-Type", ctype)
+	w.Header().Set("Content-Disposition", contentDisposition(disposition, f.Filename))
 	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
 	w.Header().Set("ETag", etag)
 	w.Header().Set("X-Content-Type-Options", "nosniff")
-	http.ServeContent(w, r, img.Filename, img.CreatedAt, bytes.NewReader(img.Data))
+	http.ServeContent(w, r, f.Filename, f.CreatedAt, blogStore(r).FileReader(r.Context(), f))
 }
 
 // handleFavicon answers the browsers that ask for /favicon.ico regardless of