File Storage

UI Component (DropZoneUpload / StandardFileInput)
    |
    |--- Client-side validation (size, type, extension)
    |--- Shows upload progress
    |
    v
API Route (POST /api/upload)
    |--- 1. Rate limit check (withRateLimit('upload'))
    |--- 2. Zod schema validation (filename, filesize, filetype)
    |--- 3. Filename sanitization
    |--- 4. User authentication (Clerk)
    |
    v
Storage Service (vercel-blob.ts)
    |--- Generates unique file ID
    |--- Creates user-scoped path: users/{userId}/{fileId}/{filename}
    |--- Uploads to Vercel Blob (public access)
    |
    v
Database Record (Prisma File model)
    |--- Stores file metadata (url, size, contentType)
    |--- Links file to user (userId foreign key)
    |--- Returns file record to client

export const POST = withRateLimit('upload', async (request: NextRequest) => {
  let uploadResult: Awaited<ReturnType<typeof uploadToBlob>> | null = null
  let userId: string | null = null
  let clerkUserId: string | null = null
  let filename: string | null = null
  let filesize: string | null = null
  let filetype: string | null = null

  try {
    // Get and validate query params
    const { searchParams } = new URL(request.url)
    const rawFilename = searchParams.get('filename')
    const rawFilesize = searchParams.get('filesize')
    const rawFiletype = searchParams.get('filetype')

    // Validate upload parameters using centralized schema
    const validation = uploadFileSchema.safeParse({
      filename: rawFilename,
      filesize: rawFilesize,
      filetype: rawFiletype,
    })

    if (!validation.success) {
      console.error('Upload validation failed:', validation.error.flatten())
      return NextResponse.json(
        {
          error: 'Invalid upload parameters',
          details: validation.error.flatten().fieldErrors,
        },
        { status: 400 }
      )
    }

    // Extract validated and sanitized data
    const validatedData = validation.data
    filename = sanitizeFilename(validatedData.filename)
    filesize = validatedData.filesize.toString()
    filetype = validatedData.filetype

export async function uploadToBlob(
  userId: string,
  file: File | Blob | ReadableStream | ArrayBuffer,
  filename: string,
  fileSize?: number
): Promise<FileUploadResult> {
  const fileId = generateFileId()
  const pathname = generateFilePath(userId, fileId, filename)

  try {
    // Get file extension to determine content type
    const extension = filename.toLowerCase().split('.').pop()
    let contentType = 'application/octet-stream'

    if (extension) {
      const mimeTypes: Record<string, string> = {
        jpg: 'image/jpeg',
        jpeg: 'image/jpeg',
        png: 'image/png',
        gif: 'image/gif',
        webp: 'image/webp',
        pdf: 'application/pdf',
      }
      contentType = mimeTypes[extension] || contentType
    }

    // Upload to Vercel Blob
    const blob = await put(pathname, file, {
      access: 'public',
      contentType,
    })

    // Use provided size or default to 0
    // Note: Vercel Blob doesn't return size in response for streaming uploads
    const size = fileSize || 0

    return {
      id: fileId,
      url: blob.url,
      pathname,
      originalName: filename,
      size, // Size from parameter or 0
      contentType,
    }
  } catch (error) {
    console.error('Failed to upload to Vercel Blob:', error)
    throw new Error('Failed to upload file. Please try again.')
  }
}

import type { FileValidationOptions, FileValidationResult } from './types'

// Max file size: 4.5MB (Vercel Blob limit)
export const MAX_FILE_SIZE = 4.5 * 1024 * 1024

// Default allowed file types
export const DEFAULT_ALLOWED_TYPES = [
  'image/jpeg',
  'image/jpg',
  'image/png',
  'image/gif',
  'image/webp',
  'application/pdf',
]

/**
 * Validate a file before upload
 */
export function validateFile(
  file: File | Blob,
  options: FileValidationOptions = {}
): FileValidationResult {
  const { maxSize = MAX_FILE_SIZE, allowedTypes = DEFAULT_ALLOWED_TYPES } =
    options

  // Check file size
  if (file.size > maxSize) {
    const maxSizeMB = (maxSize / (1024 * 1024)).toFixed(1)
    return {
      valid: false,
      error: `File size exceeds maximum of ${maxSizeMB}MB`,
    }
  }

  // Check file type
  if (allowedTypes.length > 0 && !allowedTypes.includes(file.type)) {
    return {
      valid: false,
      error: `File type ${file.type} is not allowed. Allowed types: ${allowedTypes.join(', ')}`,
    }
  }

  // Additional validation for file names if it's a File object
  if ('name' in file) {
    const fileName = file.name

    // Check for suspicious file extensions
    const suspiciousExtensions = ['.exe', '.bat', '.cmd', '.sh', '.ps1', '.dll']
    const hasSupiciousExtension = suspiciousExtensions.some((ext) =>
      fileName.toLowerCase().endsWith(ext)
    )

    if (hasSupiciousExtension) {
      return {
        valid: false,
        error: 'This file type is not allowed for security reasons',
      }
    }
  }

  return { valid: true }
}

import { TierAwareUpload } from '@/components/upload/tier-aware-upload'

export default function SettingsPage() {
  return (
    <TierAwareUpload
      onUploadComplete={(file) => {
        console.log('Uploaded:', file.url)
      }}
    />
  )
}

export async function GET(request: NextRequest, { params }: Params) {
  try {
    const fileId = params.id

    // Get current user
    let userId: string | null = null

    if (shouldBypassClerk()) {
      userId = 'test-user-id'
    } else {
      const user = await currentUser()
      if (!user) {
        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
      }

      const dbUser = await prisma.user.findUnique({
        where: { clerkId: user.id },
      })

      if (!dbUser) {
        return NextResponse.json({ error: 'User not found' }, { status: 404 })
      }

      userId = dbUser.id
    }

    // Get file from database
    const file = await prisma.file.findFirst({
      where: {
        id: fileId,
        userId,
      },
    })

    if (!file) {
      return NextResponse.json({ error: 'File not found' }, { status: 404 })
    }

    return NextResponse.json({
      id: file.id,
      url: file.url,
      originalName: file.originalName,
      size: file.size,
      contentType: file.contentType,
      createdAt: file.createdAt,
      updatedAt: file.updatedAt,
    })
  } catch (error) {
    console.error('Get file error:', error)
    return NextResponse.json({ error: 'Failed to get file' }, { status: 500 })
  }
}

export async function DELETE(request: NextRequest, { params }: Params) {
  try {
    const fileId = params.id

    // Get current user
    let userId: string | null = null

    if (shouldBypassClerk()) {
      userId = 'test-user-id'
    } else {
      const user = await currentUser()
      if (!user) {
        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
      }

      const dbUser = await prisma.user.findUnique({
        where: { clerkId: user.id },
      })

      if (!dbUser) {
        return NextResponse.json({ error: 'User not found' }, { status: 404 })
      }

      userId = dbUser.id
    }

    // Get file from database
    const file = await prisma.file.findFirst({
      where: {
        id: fileId,
        userId,
      },
    })

    if (!file) {
      return NextResponse.json({ error: 'File not found' }, { status: 404 })
    }

    // Delete from Vercel Blob
    const deleteResult = await deleteFromBlob(file.url)

    if (!deleteResult.success) {
      console.error('Failed to delete from Vercel Blob:', deleteResult.error)
      // Continue with database deletion even if blob deletion fails
      // This prevents orphaned records
    }

    // Delete from database
    await prisma.file.delete({
      where: { id: fileId },
    })

    return NextResponse.json({
      success: true,
      message: 'File deleted successfully',
    })
  } catch (error) {
    console.error('Delete file error:', error)
    return NextResponse.json(
      { error: 'Failed to delete file' },
      { status: 500 }
    )
  }
}

File
├── id            # Auto-generated UUID
├── userId        # Foreign key to User (owner)
├── url           # Vercel Blob public URL
├── pathname      # Storage path: users/{userId}/{fileId}/{filename}
├── originalName  # Original filename (sanitized)
├── contentType   # MIME type (image/jpeg, application/pdf, etc.)
├── size          # File size in bytes
├── metadata      # JSON — extensible metadata field
├── createdAt     # Upload timestamp
└── updatedAt     # Last modification