feat(submit): local + S3 backends for modpack upload contexts, installer-selectable

internal/api/api.go

@@ -369,6 +369,11 @@ func (a *API) externalAPIRoutes() []apiRoute {
 		// session is the correct gate (the admin verdict lives below, behind adminOnly).
 		{Method: "POST", Pattern: "/api/v1/me/submissions", h: a.handleCreateSubmission},
 		{Method: "GET", Pattern: "/api/v1/me/submissions", h: a.handleMySubmissions},
+		// The blob upload for a submission the caller owns: the request body is the
+		// raw gzip build context, streamed to the derived, id-namespaced location.
+		// App-tier and owner-scoped (the id must belong to the principal), exactly
+		// like the create/list routes above.
+		{Method: "POST", Pattern: "/api/v1/me/submissions/{id}/context", h: a.handleUploadSubmissionContext},
 		// Admin (Zero-Trust) tier: create / mutate spec / image admission. These gate
 		// on Principal.IsAdmin() inside the handler via the adminOnly wrapper, so the
 		// boundary is exercised even where the body is a later-phase stub.

internal/api/submissions.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	"errors"
+	"io"
 	"net/http"
 
 	"felis.lolicon.best/internal/submit"
@@ -27,6 +28,10 @@ type SubmissionService interface {
 	// Create records a pending_review submission. It starts NO build (the whole
 	// point of the lane — nothing is built until an admin approves).
 	Create(ctx context.Context, req submit.CreateRequest) (*submit.Submission, error)
+	// UploadContext stores the modpack blob for the caller's own pending
+	// submission at the platform-derived context ref. submittedBy is the principal,
+	// never the body, so a user can only upload to a submission they own.
+	UploadContext(ctx context.Context, id, submittedBy string, r io.Reader) (*submit.Submission, error)
 	// ListBy returns one user's submissions, newest first (the "my uploads" view).
 	ListBy(ctx context.Context, submittedBy string) ([]submit.Submission, error)
 	// List returns every submission, newest first (the admin review queue).
@@ -80,6 +85,32 @@ func (a *API) handleCreateSubmission(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusCreated, sub)
 }
 
+// handleUploadSubmissionContext stores the caller's modpack blob as the build
+// context for their own pending submission (app-tier). The request body IS the
+// raw gzip tarball (context.tar.gz) — not JSON, not multipart — streamed straight
+// to the transport; the submit layer sniffs the gzip magic and caps the size. The
+// submitter is the authenticated principal, never the body, and a submission the
+// caller does not own is reported as 404, so this endpoint cannot upload to — or
+// probe the existence of — another user's submission.
+//
+// Uploading does not change the submission row (there is no "uploaded" column):
+// the blob store is the presence source of truth, which admin approval consults.
+func (a *API) handleUploadSubmissionContext(w http.ResponseWriter, r *http.Request) {
+	if a.Submissions == nil {
+		writeError(w, r, errSubmissionsUnavailable)
+		return
+	}
+	p := principalFromContext(r.Context())
+	id := r.PathValue("id")
+	sub, err := a.Submissions.UploadContext(r.Context(), id, p.UserID, r.Body)
+	if err != nil {
+		writeSubmitError(w, r, err)
+		return
+	}
+	a.audit(r, p.Email, "submission.upload", sub.ID)
+	writeJSON(w, http.StatusOK, sub)
+}
+
 // handleMySubmissions lists the caller's own submissions (app-tier). It scopes
 // strictly to the principal's id; there is no parameter that could widen the
 // query to another user's uploads.
@@ -162,8 +193,10 @@ var errSubmissionsUnavailable = newError(http.StatusServiceUnavailable, "submiss
 	"modpack submission subsystem is not configured")
 
 // writeSubmitError maps submit-package errors onto HTTP status codes. Only the
-// three business sentinels are client-facing: a validation failure is 400, a
-// missing submission is 404, an already-reviewed submission is 409. Everything
+// business sentinels are client-facing: a validation failure is 400, a missing
+// submission is 404, an already-reviewed submission is 409, and an unconfigured
+// upload transport is 503 (the store this deployment set has no implemented
+// transport — an honest "not available here", not a client error). Everything
 // else — including a build.ErrInvalid raised by the pre-CAS build.Validate (a
 // platform registry/context MISCONFIGURATION, never client input, since every
 // build input is platform-derived) and a post-CAS Submit hand-off failure — is a
@@ -178,6 +211,9 @@ func writeSubmitError(w http.ResponseWriter, r *http.Request, err error) {
 	case errors.Is(err, submit.ErrAlreadyReviewed):
 		writeError(w, r, newError(http.StatusConflict, "already_reviewed",
 			"submission has already been reviewed"))
+	case errors.Is(err, submit.ErrUploadsUnavailable):
+		writeError(w, r, newError(http.StatusServiceUnavailable, "uploads_unavailable",
+			"modpack upload transport is not configured"))
 	default:
 		writeError(w, r, err)
 	}

internal/api/submissions_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"testing"
 
@@ -18,6 +19,10 @@ import (
 type fakeSubmissions struct {
 	created    *submit.CreateRequest
 	createErr  error
+	uploadedID string
+	uploadedBy string
+	uploadedN  int64
+	uploadErr  error
 	listedBy   string
 	byResult   []submit.Submission
 	byErr      error
@@ -42,6 +47,16 @@ func (f *fakeSubmissions) Create(_ context.Context, req submit.CreateRequest) (*
 		DisplayName: req.DisplayName, Status: submit.StatusPendingReview}, nil
 }
 
+func (f *fakeSubmissions) UploadContext(_ context.Context, id, submittedBy string, r io.Reader) (*submit.Submission, error) {
+	f.uploadedID, f.uploadedBy = id, submittedBy
+	if f.uploadErr != nil {
+		return nil, f.uploadErr
+	}
+	n, _ := io.Copy(io.Discard, r)
+	f.uploadedN = n
+	return &submit.Submission{ID: id, SubmittedBy: submittedBy, Status: submit.StatusPendingReview}, nil
+}
+
 func (f *fakeSubmissions) ListBy(_ context.Context, submittedBy string) ([]submit.Submission, error) {
 	f.listedBy = submittedBy
 	return f.byResult, f.byErr
@@ -135,6 +150,89 @@ func TestCreateSubmissionValidationIs400(t *testing.T) {
 	}
 }
 
+// The upload endpoint forwards the raw body to the transport and stamps the
+// submitter from the principal, never the body — a user can only upload to a
+// submission under their own identity.
+func TestUploadSubmissionContextStreamsBody(t *testing.T) {
+	fs := &fakeSubmissions{}
+	api := appSubAPI(fs)
+	// A tiny gzip-magic-prefixed body stands in for a real context.tar.gz.
+	body := "\x1f\x8b\x08\x00 the modpack bytes"
+	w := do(api.ExternalHandler(), "POST", "/api/v1/me/submissions/sub-9/context", body,
+		map[string]string{"Content-Type": "application/gzip"})
+	if w.Code != http.StatusOK {
+		t.Fatalf("code = %d, want 200 (%s)", w.Code, w.Body.String())
+	}
+	if fs.uploadedID != "sub-9" {
+		t.Errorf("uploaded id = %q, want sub-9", fs.uploadedID)
+	}
+	if fs.uploadedBy != "user-7" {
+		t.Errorf("submitter = %q, want the principal id user-7", fs.uploadedBy)
+	}
+	if fs.uploadedN != int64(len(body)) {
+		t.Errorf("streamed %d bytes, want %d", fs.uploadedN, len(body))
+	}
+}
+
+// A submission the caller does not own reads back as 404 (the transport reports
+// ErrNotFound), so the endpoint cannot probe another user's submission.
+func TestUploadSubmissionContextNotOwnedIs404(t *testing.T) {
+	fs := &fakeSubmissions{uploadErr: submit.ErrNotFound}
+	api := appSubAPI(fs)
+	w := do(api.ExternalHandler(), "POST", "/api/v1/me/submissions/sub-x/context", "\x1f\x8bdata", nil)
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("code = %d, want 404 (%s)", w.Code, w.Body.String())
+	}
+}
+
+// Uploading to an already-reviewed submission is a 409.
+func TestUploadSubmissionContextAlreadyReviewedIs409(t *testing.T) {
+	fs := &fakeSubmissions{uploadErr: submit.ErrAlreadyReviewed}
+	api := appSubAPI(fs)
+	w := do(api.ExternalHandler(), "POST", "/api/v1/me/submissions/sub-9/context", "\x1f\x8bdata", nil)
+	if w.Code != http.StatusConflict {
+		t.Fatalf("code = %d, want 409 (%s)", w.Code, w.Body.String())
+	}
+}
+
+// A wrong-format / oversize body surfaces as 400 (the transport wraps ErrInvalid).
+func TestUploadSubmissionContextBadFormatIs400(t *testing.T) {
+	fs := &fakeSubmissions{uploadErr: fmt.Errorf("%w: build context must be a gzip-compressed tarball (.tar.gz)", submit.ErrInvalid)}
+	api := appSubAPI(fs)
+	w := do(api.ExternalHandler(), "POST", "/api/v1/me/submissions/sub-9/context", "not gzip", nil)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("code = %d, want 400 (%s)", w.Code, w.Body.String())
+	}
+	if got := decodeErr(t, w); got != "bad_request" {
+		t.Errorf("error code = %q, want bad_request", got)
+	}
+}
+
+// When the deployment's store has no upload transport, the endpoint reports 503
+// (ErrUploadsUnavailable) — an honest "not available here", not a 500.
+func TestUploadSubmissionContextNoTransportIs503(t *testing.T) {
+	fs := &fakeSubmissions{uploadErr: submit.ErrUploadsUnavailable}
+	api := appSubAPI(fs)
+	w := do(api.ExternalHandler(), "POST", "/api/v1/me/submissions/sub-9/context", "\x1f\x8bdata", nil)
+	if w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("code = %d, want 503 (%s)", w.Code, w.Body.String())
+	}
+	if got := decodeErr(t, w); got != "uploads_unavailable" {
+		t.Errorf("error code = %q, want uploads_unavailable", got)
+	}
+}
+
+// The upload route is app-tier: with no service configured it is 503, exactly
+// like the other /me/submissions routes.
+func TestUploadSubmissionContextWithoutServiceIs503(t *testing.T) {
+	app := appSubAPI(nil)
+	app.Submissions = nil
+	w := do(app.ExternalHandler(), "POST", "/api/v1/me/submissions/sub-9/context", "\x1f\x8bdata", nil)
+	if w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("code = %d, want 503 (%s)", w.Code, w.Body.String())
+	}
+}
+
 // The "my uploads" list scopes strictly to the principal's id — there is no
 // parameter that could widen it to another user's submissions.
 func TestMySubmissionsScopesToPrincipal(t *testing.T) {