Turn the image library into a file library, with a per-blog upload limit

Bloggers want to attach PDFs, archives, audio and other files to posts,
not only images. The Images tab becomes Files: any type is accepted,
listed by kind with search, paging, rename and multi-file upload, and the
editor's paste/drop/"Insert file" takes anything (images are shown,
everything else becomes a link). The default limit goes from 5 to 10 MB
and the superadmin can override it per blog from /admin/.

Files stay in Postgres so one pg_dump is still the whole blog. The bytea
column is STORAGE EXTERNAL and /media streams it in substring() slices,
so serving never holds a whole file in memory whatever limit a blog gets.

Serving any type on the root domain, which carries the session cookie,
needs a policy: uploads are typed by sniffing (the extension may only
refine a generic sniff to an allowlisted type) and only images, PDF,
plain text, audio and video render inline; HTML, SVG, XML, scripts,
archives and binaries always go out as application/octet-stream with
Content-Disposition: attachment.

The body cap moves out of requireAuth into guardPOST, which runs after
withBlog has resolved the blog and so knows its limit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 6 insertions, 4 deletions

diff --git a/internal/web/routes.go b/internal/web/routes.go
index 36ae892..273a832 100644
--- a/internal/web/routes.go
+++ b/internal/web/routes.go
@@ -63,10 +63,11 @@ func (s *Server) rootRoutes() http.Handler {
 	m.HandleFunc("POST /b/{sub}/design", s.withBlog(s.handleDesign))
 	m.HandleFunc("POST /b/{sub}/design/preset", s.withBlog(s.handleDesignPreset))
 	m.HandleFunc("POST /b/{sub}/design/reset", s.withBlog(s.handleDesignReset))
-	m.HandleFunc("GET /b/{sub}/images", s.withBlog(s.handleImages))
-	m.HandleFunc("POST /b/{sub}/images/upload", s.withBlog(s.handleImageUpload))
-	m.HandleFunc("POST /b/{sub}/images/{id}/delete", s.withBlog(s.handleImageDelete))
-	// Images live in the blog's database, so dashboard previews on this host go through /b/.
+	m.HandleFunc("GET /b/{sub}/files", s.withBlog(s.handleFiles))
+	m.HandleFunc("POST /b/{sub}/files/upload", s.withBlogFiles(maxUploadFiles, s.handleFileUpload))
+	m.HandleFunc("POST /b/{sub}/files/{id}/rename", s.withBlog(s.handleFileRename))
+	m.HandleFunc("POST /b/{sub}/files/{id}/delete", s.withBlog(s.handleFileDelete))
+	// Files live in the blog's database, so dashboard previews on this host go through /b/.
 	m.HandleFunc("GET /b/{sub}/media/{id}", s.withBlog(s.handleMedia))
 
 	// superadmin
@@ -78,6 +79,7 @@ func (s *Server) rootRoutes() http.Handler {
 	m.HandleFunc("POST /admin/users/{id}/enable", s.requireAdmin(s.handleAdminSetDisabled(false)))
 	m.HandleFunc("GET /admin/users/{id}/delete", s.requireAdmin(s.handleAdminDeleteUserConfirm))
 	m.HandleFunc("POST /admin/users/{id}/delete", s.requireAdmin(s.handleAdminDeleteUser))
+	m.HandleFunc("POST /admin/blogs/{id}/upload-limit", s.requireAdmin(s.handleAdminUploadLimit))
 
 	m.HandleFunc("GET /media/{id}", s.hostBlog(s.handleMedia))
 	m.Handle("GET /static/{file}", s.staticHandler())