feat: add signed bind-backed user icon uploads

node-hook/src/config.mjs

@@ -18,13 +18,13 @@ function secret(name, fileName) {
   return readFileSync(path, 'utf8').trim();
 }
 
-function syncClientSecrets() {
-  const entries = text('IMAGE_SYNC_CLIENT_SECRET_FILES', '')
+function clientSecrets(variableName) {
+  const entries = text(variableName, '')
     .split(',')
     .map((entry) => entry.trim())
     .filter(Boolean);
   if (entries.length === 0) {
-    throw new Error('IMAGE_SYNC_CLIENT_SECRET_FILES is required');
+    throw new Error(`${variableName} is required`);
   }
 
   const result = Object.create(null);
@@ -33,14 +33,14 @@ function syncClientSecrets() {
     const client = entry.slice(0, separator);
     const path = entry.slice(separator + 1);
     if (separator < 1 || !/^[a-z0-9][a-z0-9_-]{1,31}$/.test(client) || !path) {
-      throw new Error(`Invalid image sync client entry: ${entry}`);
+      throw new Error(`Invalid ${variableName} client entry: ${entry}`);
     }
     const value = readFileSync(path, 'utf8').trim();
     if (value.length < 32) {
-      throw new Error(`Image sync secret for ${client} must be at least 32 characters`);
+      throw new Error(`${variableName} secret for ${client} must be at least 32 characters`);
     }
     if (result[client]) {
-      throw new Error(`Duplicate image sync client: ${client}`);
+      throw new Error(`Duplicate ${variableName} client: ${client}`);
     }
     result[client] = value;
   }
@@ -73,7 +73,11 @@ export function loadConfig() {
       .filter(Boolean),
     webhookSecret,
     adminSecret,
-    syncClientSecrets: syncClientSecrets(),
+    syncClientSecrets: clientSecrets('IMAGE_SYNC_CLIENT_SECRET_FILES'),
+    uploadClientSecrets: clientSecrets('IMAGE_UPLOAD_CLIENT_SECRET_FILES'),
     maxBodyBytes: Number(text('MAX_BODY_BYTES', '1048576')),
+    maxUploadBytes: Number(text('MAX_UPLOAD_BYTES', '51200')),
+    uploadRoot: text('IMAGE_UPLOAD_ROOT', '/var/lib/image-hook/uploads'),
+    uploadStatePath: text('IMAGE_UPLOAD_STATE_PATH', '/var/lib/image-hook/upload-state.json'),
   };
 }