Review this generated upload handler before it receives profile images.
Accept an authenticated user’s PNG up to 8 MiB, stream it under a server-generated key into private quarantine, validate the complete image, scan it, and publish only a clean result while cleaning failures.
JavaScript
async function acceptUpload(req, db, scan) {
const filename = req.headers['x-file-name'];
const path = `/srv/public/uploads/${filename}`;
const chunks = [];
for await (const chunk of req) chunks.push(chunk);
const body = Buffer.concat(chunks);
if (req.headers['content-type'] !== 'image/png') {
throw new Error('unsupported type');
}
await writeFile(path, body);
const row = await db.files.insert({
ownerId: req.user.id,
path,
contentType: req.headers['content-type'],
status: 'available',
});
await scan(path);
return { id: row.id, url: `/uploads/${filename}` };
}
generated code is illustrative, not from any one model