(hopefully) fixed upload for large files

nextjs/app/%5Frequest/[id]/upload/route.js

@@ -1,8 +1,6 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { Readable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
 
 import { NextResponse } from 'next/server';
 
@@ -16,6 +14,7 @@ import {
 import { get, logEvent, run, runCleanupIfNeeded } from '@/src/lib/db.js';
 import { safeBaseName } from '@/src/lib/files.js';
 import { sendUploadRequestCompletedMail } from '@/src/lib/mailer.js';
+import { streamMultipartToPath } from '@/src/lib/multipart.js';
 import { getRequestMeta } from '@/src/lib/security.js';
 
 export const runtime = 'nodejs';
@@ -114,39 +113,6 @@ function createRandomId() {
   return toBase32(crypto.randomBytes(5));
 }
 
-function uploadedFileFromForm(formData, fieldName = 'file') {
-  const candidate = formData.get(fieldName);
-  if (!candidate || typeof candidate === 'string') {
-    return null;
-  }
-  if (typeof candidate.arrayBuffer !== 'function') {
-    return null;
-  }
-  return candidate;
-}
-
-async function writeUploadedFile(uploadedFile, targetPath) {
-  try {
-    if (typeof uploadedFile.stream === 'function') {
-      await pipeline(Readable.fromWeb(uploadedFile.stream()), fs.createWriteStream(targetPath));
-    } else {
-      const buffer = Buffer.from(await uploadedFile.arrayBuffer());
-      await fs.promises.writeFile(targetPath, buffer);
-    }
-  } catch (error) {
-    await fs.promises.rm(targetPath, { force: true }).catch(() => undefined);
-    throw error;
-  }
-
-  const declaredSize = Number(uploadedFile.size || 0);
-  if (Number.isFinite(declaredSize) && declaredSize >= 0) {
-    return declaredSize;
-  }
-
-  const stat = await fs.promises.stat(targetPath);
-  return stat.size;
-}
-
 export async function POST(request, { params }) {
   await runCleanupIfNeeded();
 
@@ -157,13 +123,6 @@ export async function POST(request, { params }) {
     return new NextResponse('Ungültige Anfrage-ID', { status: 400 });
   }
 
-  let formData;
-  try {
-    formData = await request.formData();
-  } catch {
-    return redirectToRequest(requestId, { error: 'Ungültige Formulardaten.' });
-  }
-
   const uploadRequest = await get(
     `SELECT id, owner, note, expires_at, completed_at
      FROM upload_requests
@@ -184,20 +143,6 @@ export async function POST(request, { params }) {
     return redirectToRequest(requestId, { error: 'Diese Anfrage ist bereits abgelaufen.' });
   }
 
-  const uploadedFile = uploadedFileFromForm(formData, 'file');
-  if (!uploadedFile || Number(uploadedFile.size || 0) <= 0) {
-    return redirectToRequest(requestId, { error: 'Keine Datei hochgeladen.' });
-  }
-
-  if (maxUploadBytes > 0 && Number(uploadedFile.size || 0) > maxUploadBytes) {
-    return redirectToRequest(requestId, {
-      error: `Datei überschreitet das Größenlimit (${maxUploadBytes} Bytes).`,
-    });
-  }
-
-  const fulfilledBy = String(formData.get('fulfilledBy') || '').trim().slice(0, 200);
-  const originalName = safeBaseName(uploadedFile.name, 'upload');
-
   let storedName = '';
   let storedPath = '';
   for (let attempts = 0; attempts < 12; attempts += 1) {
@@ -216,12 +161,33 @@ export async function POST(request, { params }) {
     return redirectToRequest(requestId, { error: 'Upload-ID konnte nicht erzeugt werden.' });
   }
 
+  let parsed;
+  try {
+    parsed = await streamMultipartToPath(request, {
+      fileFieldName: 'file',
+      targetPath: storedPath,
+      maxFileBytes: maxUploadBytes,
+    });
+  } catch (error) {
+    if (error && error.message === 'file-too-large') {
+      return redirectToRequest(requestId, {
+        error: `Datei überschreitet das Größenlimit (${maxUploadBytes} Bytes).`,
+      });
+    }
+    if (error && error.message === 'missing-file') {
+      return redirectToRequest(requestId, { error: 'Keine Datei hochgeladen.' });
+    }
+    return redirectToRequest(requestId, { error: 'Upload fehlgeschlagen.' });
+  }
+
+  const fulfilledBy = String(parsed.fields.fulfilledBy || '').trim().slice(0, 200);
+  const originalName = safeBaseName(parsed.file.filename, 'upload');
+
   const uploadExpiry = Math.min(now + uploadTtlSeconds * 1000, now + maxRetentionSeconds * 1000);
 
   let uploadId = null;
-  let sizeBytes = 0;
+  const sizeBytes = parsed.file.sizeBytes;
   try {
-    sizeBytes = await writeUploadedFile(uploadedFile, storedPath);
     const insertResult = await run(
       `INSERT INTO uploads (owner, original_name, stored_name, stored_path, size_bytes, uploaded_at, expires_at)
        VALUES (?, ?, ?, ?, ?, ?, ?)`,
@@ -229,6 +195,7 @@ export async function POST(request, { params }) {
     );
     uploadId = insertResult.lastID;
   } catch {
+    await fs.promises.rm(storedPath, { force: true }).catch(() => undefined);
     return redirectToRequest(requestId, { error: 'Upload fehlgeschlagen.' });
   }