Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave

Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workIn progress Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureTo do Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APIIn progress Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionIn progress Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone

Wave

Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.

TacTile › Launch TacTile › Backend & Infrastructure › Backend API

27/33 done6 open1 open blocker

Selected taskclear

Add upload size limits and file validation

DoneOwner · Vivt_e08859cf

Waiting on 1 · all clearImplement /api/upload

Unlocks 1Approve: Backend API

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Add upload size limits and file validation** · done

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## Waiting on 1

- Implement /api/upload — done

## Unlocks 1

- Approve: Backend API

## The brief on file

BUILT 2026-08-03 (Viv) — PR #196, branch exec/upload-size-limits, commit 2a0a524e. Ready for review, NOT merged, NOT deployed. Status stays `doing` until it is live, because the exposure this closes is a production one and code on a branch closes nothing.

WHAT WAS WRONG. Six of eight upload paths had no size ceiling at all — videos, audio, documents, contact, profile and menu each checked only `file.size > 0`, which is a non-empty test, not a limit. Anyone with a valid session could stream an arbitrarily large file straight into R2 through six separate routes. Only lib/uploadAsset (5 MB, settings only) and brand.ts bounded anything. Root cause was duplication: every route had hand-rolled the same parse-then-put dance, so there was no single place a limit could have been written once.

WHAT LANDED. New apps/api/tactile-api/src/lib/uploadLimits.ts — one ceiling table plus a leading-byte sniffer. Ceilings, confirmed by Matthew on 2026-08-03: image 5 MB, audio 25 MB, document 25 MB, video 500 MB. These are a cost/product call, not a derived number; video's also has to stay inside whatever the transcoder accepts, which is worth re-checking when that path is next touched.

IT ALSO CLOSED A VALIDATION HOLE, not just a size one. uploadAsset validated type with `file.type.startsWith("image/")`. File.type is copied from the client's own multipart Content-Type header, so a forged request defeated it entirely. The sniffer reads real magic bytes against a narrow per-kind allowlist. Documents additionally accept unsigned content when it is plausibly text, since .txt/.csv/.md have no signature and rejecting them would break real uploads; a NUL byte disqualifies.

Two call shapes because the routes genuinely differ:
  - checkUpload() → {ok,status,message} for routes that can return early.
  - assertUpload() throws UploadRejected for profile.ts, whose uploads sit inside an
    existing try/catch that cleans up half-written R2 objects. Both catch blocks now
    surface the real status instead of flattening a 413 into a generic 500.
  - contact.ts validates all three images ONCE before the first of its six bucket.put
    sites, so a rejection cannot leave one or two objects already written.

VERIFIED
  - 14 new tests in tests/lib/uploadLimits.test.ts: the boundary at exactly the limit,
    per-kind ceiling divergence (20 MB video passes, 20 MB image does not), every
    accepted signature, the forged image/jpeg case that used to pass and now 415s, and
    the text-document allowance including its binary counter-case.
  - Full API suite 476/476 pass. tsc --noEmit clean across the package (note a fresh
    worktree needs `pnpm --filter @tactile/mcp-server build` first or you get 12
    unrelated module-resolution errors).

NOT VERIFIED, and this is what remains: an authenticated multipart upload against a
deployed worker. No deploy happened this session. CI cannot vouch for it either — the
GitHub Actions billing wall (t_412e17f7) means PR #196 will show no checks at all.

NEXT: merge #196, deploy tactile-api, then exercise one real oversized upload per kind
against staging or prod and confirm 413. Only then is this done.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend API

Add upload size limits and file validation