Secure file uploads with presigned URLs

import express from "express";
import { Dreep } from "dreep";

const dreep = new Dreep({ apiKey: process.env.DREEP_API_KEY });
const app = express();
app.use(express.json());

const ALLOWED = ["image/jpeg", "image/png", "image/webp", "application/pdf"];
const MAX_BYTES = 20 * 1024 * 1024; // your limit, below Dreep's 500 MB

// requireUser is your own auth middleware
app.post("/uploads", requireUser, async (req, res) => {
  const { filename, contentType, sizeBytes, contentHash } = req.body;

  if (!ALLOWED.includes(contentType) || sizeBytes > MAX_BYTES) {
    return res.status(400).json({ error: "File not allowed" });
  }

  const upload = await dreep.presignUpload({
    filename,
    contentType,
    sizeBytes,
    contentHash,
    folder: `users/${req.user.id}`,
  });

  await db.pendingUploads.insert({ id: upload.id, userId: req.user.id });

  res.json({
    id: upload.id,
    uploadUrl: upload.uploadUrl,
    alreadyExists: upload.alreadyExists,
  });
});

app.post("/uploads/:id/confirm", requireUser, async (req, res) => {
  const { id } = req.params;
  const pending = await db.pendingUploads.find({ id, userId: req.user.id });
  if (!pending) return res.status(404).end();

  const asset = await dreep.confirmUpload({ id });
  res.json({ id: asset.id, url: asset.url });
});

type presignRequest struct {
    Filename    string `json:"filename"`
    ContentType string `json:"contentType"`
    SizeBytes   int64  `json:"sizeBytes"`
    ContentHash string `json:"contentHash"`
}

func presignHandler(client *dreep.Client) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        user, ok := currentUser(r) // your own auth
        if !ok {
            http.Error(w, "unauthorised", http.StatusUnauthorized)
            return
        }

        var in presignRequest
        if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
            http.Error(w, "bad request", http.StatusBadRequest)
            return
        }
        if !allowedType(in.ContentType) || in.SizeBytes > maxBytes {
            http.Error(w, "file not allowed", http.StatusBadRequest)
            return
        }

        upload, err := client.PresignUpload(r.Context(), dreep.PresignOptions{
            Filename:    in.Filename,
            ContentType: in.ContentType,
            SizeBytes:   in.SizeBytes,
            ContentHash: in.ContentHash,
            Destination: dreep.Destination{Folder: "users/" + user.ID},
        })
        if err != nil {
            http.Error(w, "presign failed", http.StatusBadGateway)
            return
        }

        recordPendingUpload(r.Context(), upload.ID, user.ID)
        json.NewEncoder(w).Encode(upload) // id, uploadUrl, alreadyExists
    }
}

// Confirm handler: check the upload belongs to this user, then
// asset, err := client.ConfirmUpload(r.Context(), id, nil)

# 1. Presign (server-side, with your API key)
curl -X POST https://api.dreep.cloud/api/v1/upload/presign \
  -H "Authorization: Bearer $DREEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filename":"receipt.pdf","contentType":"application/pdf","sizeBytes":482113,"folder":"users/42"}'

# 2. PUT the bytes (no API key; headers must match step 1)
curl -X PUT "$UPLOAD_URL" \
  -H "Content-Type: application/pdf" \
  --data-binary @receipt.pdf

# 3. Confirm (server-side)
curl -X POST "https://api.dreep.cloud/api/v1/upload/$UPLOAD_ID/confirm" \
  -H "Authorization: Bearer $DREEP_API_KEY"

const sha256 = async (file) => {
  const digest = await crypto.subtle.digest("SHA-256", await file.arrayBuffer());
  return [...new Uint8Array(digest)]
    .map((byte) => byte.toString(16).padStart(2, "0"))
    .join("");
};

const uploadFile = async (file) => {
  const presign = await fetch("/uploads", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      filename: file.name,
      contentType: file.type,
      sizeBytes: file.size,
      contentHash: await sha256(file),
    }),
  });
  const { id, uploadUrl, alreadyExists } = await presign.json();

  if (!alreadyExists) {
    // Content-Length is set from the File by the browser
    const put = await fetch(uploadUrl, {
      method: "PUT",
      headers: { "Content-Type": file.type },
      body: file,
    });
    if (!put.ok) throw new Error(`Upload failed: ${put.status}`);
  }

  const confirm = await fetch(`/uploads/${id}/confirm`, { method: "POST" });
  return confirm.json(); // { id, url }
};