From 778cb72c8a0902bd0b8159ebd3bb7eff93f28c83 Mon Sep 17 00:00:00 2001 From: grm Date: Mon, 14 Sep 2026 23:51:55 +0300 Subject: Turn the image library into a file library, with a per-blog upload limit Bloggers want to attach PDFs, archives, audio and other files to posts, not only images. The Images tab becomes Files: any type is accepted, listed by kind with search, paging, rename and multi-file upload, and the editor's paste/drop/"Insert file" takes anything (images are shown, everything else becomes a link). The default limit goes from 5 to 10 MB and the superadmin can override it per blog from /admin/. Files stay in Postgres so one pg_dump is still the whole blog. The bytea column is STORAGE EXTERNAL and /media streams it in substring() slices, so serving never holds a whole file in memory whatever limit a blog gets. Serving any type on the root domain, which carries the session cookie, needs a policy: uploads are typed by sniffing (the extension may only refine a generic sniff to an allowlisted type) and only images, PDF, plain text, audio and video render inline; HTML, SVG, XML, scripts, archives and binaries always go out as application/octet-stream with Content-Disposition: attachment. The body cap moves out of requireAuth into guardPOST, which runs after withBlog has resolved the blog and so knows its limit. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- cmd/blogspace/seed.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'cmd') diff --git a/cmd/blogspace/seed.go b/cmd/blogspace/seed.go index f69a774..05c54f8 100644 --- a/cmd/blogspace/seed.go +++ b/cmd/blogspace/seed.go @@ -77,7 +77,12 @@ func seed(ctx context.Context, cfg *config.Config, st *store.Store) error { if err := png.Encode(&buf, img); err != nil { return err } - bg, err := bs.CreateImage(ctx, "gradient.png", "image/png", buf.Bytes()) + bg, err := bs.CreateFile(ctx, "gradient.png", "image/png", "image", buf.Bytes()) + if err != nil { + return err + } + // and a plain text file, so the Files tab shows more than images + notes, err := bs.CreateFile(ctx, "notes.txt", "text/plain", "document", []byte("Reading list:\n- The Go Programming Language\n- Practical Vim\n")) if err != nil { return err } @@ -107,7 +112,7 @@ func seed(ctx context.Context, cfg *config.Config, st *store.Store) error { } } posts := []struct{ page, title, body string }{ - {"home", "Welcome to my corner of the web", "This is the **first post**. It lives on the home page.\n\nThings I plan to write about:\n\n- tomatoes\n- Go\n- the occasional recipe\n\n![gradient](/media/" + bg.ID.String() + ")\n\nThat image above was uploaded through the dashboard."}, + {"home", "Welcome to my corner of the web", "This is the **first post**. It lives on the home page.\n\nThings I plan to write about:\n\n- tomatoes\n- Go\n- the occasional recipe\n\n![gradient](/media/" + bg.ID.String() + ")\n\nThat image above was uploaded through the dashboard, and here is a file to download: [notes.txt](/media/" + notes.ID.String() + ")."}, {"home", "Why I still like plain HTML", "No frameworks, no build step. Just `

` tags and a stylesheet.\n\n> Simplicity is prerequisite for reliability. — Dijkstra\n\n```go\nfunc main() {\n\tfmt.Println(\"hello\")\n}\n```"}, {"news", "Site is up", "The blog is live. Expect sporadic updates."}, {"news", "Tomato season", "First ripe tomato of the year! Table for the record:\n\n| Variety | Days |\n|---|---|\n| Cherry | 62 |\n| Beefsteak | 85 |"}, -- cgit v1.2.3