overridable upload limit

Author: ericls

config/config.go

@@ -144,32 +144,33 @@ func ConfigFromFile(filePath string) (*ConfigDef, error) {
 			LOG_QUERIES:       dbConfig.LOG_QUERIES,
 		},
 		HttpServer: httpserver.HttpServerConfigDef{
-			Bind:                   httpServerConfig.BIND,
-			WriteTimeout:           httpServerConfig.WRITE_TIMEOUT,
-			ReadTimeout:            httpServerConfig.READ_TIMEOUT,
-			SessionKey:             httpServerConfig.SESSION_KEY,
-			RedisURIForSession:     redisConfig.GetSessionRedisURI(),
-			RedisURI:               redisConfig.REDIS_URI,
-			SiteName:               httpServerConfig.SITE_NAME,
-			SiteTitle:              httpServerConfig.SITE_TITLE,
-			ImageDomain:            httpServerConfig.IMAGE_DOMAIN,
-			DefaultURLFormat:       defaultURLFormat,
-			EnableSafeImageCheck:   utils.IsStrTruthy(httpServerConfig.ENABLE_SAFE_IMAGE_CHECK),
-			SafeImageCheckEndpoint: httpServerConfig.SAFE_IMAGE_CHECK_ENDPOINT,
-			CaptchaProvider:        captchaProvider,
-			RecaptchaClientKey:     httpServerConfig.RECAPTCHA_CLIENT_KEY,
-			TurnstileSiteKey:       httpServerConfig.TURNSTILE_SITE_KEY,
-			RecaptchaServerKey:     httpServerConfig.RECAPTCHA_SERVER_KEY,
-			TurnstileSecretKey:     httpServerConfig.TURNSTILE_SECRET_KEY,
-			CustomCSS:              httpServerConfig.CUSTOM_CSS,
-			CustomJS:               httpServerConfig.CUSTOM_JS,
-			GoogleAnalyticsID:      httpServerConfig.GOOGLE_ANALYTICS_ID,
-			AllowUpload:            utils.IsStrTruthy(httpServerConfig.ALLOW_UPLOAD),
-			AllowNewUser:           utils.IsStrTruthy(httpServerConfig.ALLOW_NEW_USER),
-			ImageCacheMaxBytes:     httpServerConfig.IMAGE_CACHE_MAX_BYTES,
-			ImageCacheMaxFileBytes: httpServerConfig.IMAGE_CACHE_MAX_FILE_BYTES,
-			ImageMaxUploadBytes:    httpServerConfig.IMAGE_MAX_UPLOAD_BYTES,
-			WebUIOrigins:           httpserver.ParseOriginList(httpServerConfig.WEB_UI_ORIGINS),
+			Bind:                     httpServerConfig.BIND,
+			WriteTimeout:             httpServerConfig.WRITE_TIMEOUT,
+			ReadTimeout:              httpServerConfig.READ_TIMEOUT,
+			SessionKey:               httpServerConfig.SESSION_KEY,
+			RedisURIForSession:       redisConfig.GetSessionRedisURI(),
+			RedisURI:                 redisConfig.REDIS_URI,
+			SiteName:                 httpServerConfig.SITE_NAME,
+			SiteTitle:                httpServerConfig.SITE_TITLE,
+			ImageDomain:              httpServerConfig.IMAGE_DOMAIN,
+			DefaultURLFormat:         defaultURLFormat,
+			EnableSafeImageCheck:     utils.IsStrTruthy(httpServerConfig.ENABLE_SAFE_IMAGE_CHECK),
+			SafeImageCheckEndpoint:   httpServerConfig.SAFE_IMAGE_CHECK_ENDPOINT,
+			CaptchaProvider:          captchaProvider,
+			RecaptchaClientKey:       httpServerConfig.RECAPTCHA_CLIENT_KEY,
+			TurnstileSiteKey:         httpServerConfig.TURNSTILE_SITE_KEY,
+			RecaptchaServerKey:       httpServerConfig.RECAPTCHA_SERVER_KEY,
+			TurnstileSecretKey:       httpServerConfig.TURNSTILE_SECRET_KEY,
+			CustomCSS:                httpServerConfig.CUSTOM_CSS,
+			CustomJS:                 httpServerConfig.CUSTOM_JS,
+			GoogleAnalyticsID:        httpServerConfig.GOOGLE_ANALYTICS_ID,
+			AllowUpload:              utils.IsStrTruthy(httpServerConfig.ALLOW_UPLOAD),
+			AllowNewUser:             utils.IsStrTruthy(httpServerConfig.ALLOW_NEW_USER),
+			ImageCacheMaxBytes:       httpServerConfig.IMAGE_CACHE_MAX_BYTES,
+			ImageCacheMaxFileBytes:   httpServerConfig.IMAGE_CACHE_MAX_FILE_BYTES,
+			ImageMaxUploadBytes:      httpServerConfig.IMAGE_MAX_UPLOAD_BYTES,
+			GuestImageMaxUploadBytes: httpServerConfig.GUEST_IMAGE_MAX_UPLOAD_BYTES,
+			WebUIOrigins:             httpserver.ParseOriginList(httpServerConfig.WEB_UI_ORIGINS),
 		},
 		Storage: storage.StorageConfigDef{
 			StorageDefSource: storageDefSource,
@@ -297,6 +298,9 @@ func mergeConfigs(configs ...*ConfigDef) *ConfigDef {
 		if config.HttpServer.ImageMaxUploadBytes > 0 {
 			merged.HttpServer.ImageMaxUploadBytes = config.HttpServer.ImageMaxUploadBytes
 		}
+		if config.HttpServer.GuestImageMaxUploadBytes > 0 {
+			merged.HttpServer.GuestImageMaxUploadBytes = config.HttpServer.GuestImageMaxUploadBytes
+		}
 		if len(config.HttpServer.WebUIOrigins) > 0 {
 			merged.HttpServer.WebUIOrigins = config.HttpServer.WebUIOrigins
 		}

config/config_file.go

@@ -38,30 +38,31 @@ func (r *RedisConfigFileDef) GetCacheRedisURI() string {
 }
 
 type HTTPServerConfigFileDef struct {
-	BIND                       string `toml:"BIND" comment:"HTTP server bind address"`
-	WRITE_TIMEOUT              int    `toml:"WRITE_TIMEOUT" comment:"HTTP server write timeout"`
-	READ_TIMEOUT               int    `toml:"READ_TIMEOUT" comment:"HTTP server read timeout"`
-	SESSION_KEY                string `toml:"SESSION_KEY" comment:"Session key"`
-	SITE_NAME                  string `toml:"SITE_NAME" comment:"Site name"`
-	SITE_TITLE                 string `toml:"SITE_TITLE" comment:"Site title"`
-	IMAGE_DOMAIN               string `toml:"IMAGE_DOMAIN" comment:"Image domain"`
-	DEFAULT_URL_FORMAT         string `toml:"DEFAULT_URL_FORMAT" comment:"Default URL format. Choices are \n1. 'canonical' - Chooses best backend, and proxies content from that backend. \n2. 'direct' - A backend identifier is included in the URL and directly proxies that storage backend. \n3. 'backend_direct' - URL directly links to the backend (not supported yet)"`
-	ENABLE_SAFE_IMAGE_CHECK    string `toml:"ENABLE_SAFE_IMAGE_CHECK" comment:"Enable safe image check. 'true', '1' or 'yes' to enable"`
-	SAFE_IMAGE_CHECK_ENDPOINT  string `toml:"SAFE_IMAGE_CHECK_ENDPOINT" comment:"Safe image check endpoint. Used if ENABLE_SAFE_IMAGE_CHECK is true"`
-	CAPTCHA_PROVIDER           string `toml:"CAPTCHA_PROVIDER" comment:"Captcha provider. Choices are 'off', 'recaptcha', 'turnstile'"`
-	RECAPTCHA_CLIENT_KEY       string `toml:"RECAPTCHA_CLIENT_KEY" comment:"Recaptcha client key. Used if CAPTCHA_PROVIDER is 'recaptcha'"`
-	TURNSTILE_SITE_KEY         string `toml:"TURNSTILE_SITE_KEY" comment:"Turnstile site key. Used if CAPTCHA_PROVIDER is 'turnstile'"`
-	RECAPTCHA_SERVER_KEY       string `toml:"RECAPTCHA_SERVER_KEY" comment:"Recaptcha server key. Used if CAPTCHA_PROVIDER is 'recaptcha'"`
-	TURNSTILE_SECRET_KEY       string `toml:"TURNSTILE_SECRET_KEY" comment:"Turnstile secret key. Used if CAPTCHA_PROVIDER is 'turnstile'"`
-	CUSTOM_CSS                 string `toml:"CUSTOM_CSS" comment:"Custom CSS"`
-	CUSTOM_JS                  string `toml:"CUSTOM_JS" comment:"Custom JS"`
-	GOOGLE_ANALYTICS_ID        string `toml:"GOOGLE_ANALYTICS_ID" comment:"Google Analytics measurement ID (e.g. G-XXXXXXX). When set, injects gtag.js and exposes window.GAID."`
-	ALLOW_UPLOAD               string `toml:"ALLOW_UPLOAD" comment:"Allow uploading new images. 'true', '1' or 'yes' to enable"`
-	ALLOW_NEW_USER             string `toml:"ALLOW_NEW_USER" comment:"Allow new user creation. 'true', '1' or 'yes' to enable"`
-	IMAGE_CACHE_MAX_BYTES      int64  `toml:"IMAGE_CACHE_MAX_BYTES" comment:"Optional in-memory HTTP image response cache byte budget. Leave unset or 0 to disable. Useful when a tiny set of immutable image URLs receives most traffic and the app server proxies storage bytes."`
-	IMAGE_CACHE_MAX_FILE_BYTES int64  `toml:"IMAGE_CACHE_MAX_FILE_BYTES" comment:"Optional maximum single image size for the HTTP image response cache. Defaults to IMAGE_CACHE_MAX_BYTES when unset."`
-	IMAGE_MAX_UPLOAD_BYTES     int64  `toml:"IMAGE_MAX_UPLOAD_BYTES" comment:"Maximum image upload size in bytes. Defaults to 10485760 (10 MB)."`
-	WEB_UI_ORIGINS             string `toml:"WEB_UI_ORIGINS" comment:"Comma-separated list of origins (scheme://host[:port]) allowed to make CORS requests to the image endpoints."`
+	BIND                         string `toml:"BIND" comment:"HTTP server bind address"`
+	WRITE_TIMEOUT                int    `toml:"WRITE_TIMEOUT" comment:"HTTP server write timeout"`
+	READ_TIMEOUT                 int    `toml:"READ_TIMEOUT" comment:"HTTP server read timeout"`
+	SESSION_KEY                  string `toml:"SESSION_KEY" comment:"Session key"`
+	SITE_NAME                    string `toml:"SITE_NAME" comment:"Site name"`
+	SITE_TITLE                   string `toml:"SITE_TITLE" comment:"Site title"`
+	IMAGE_DOMAIN                 string `toml:"IMAGE_DOMAIN" comment:"Image domain"`
+	DEFAULT_URL_FORMAT           string `toml:"DEFAULT_URL_FORMAT" comment:"Default URL format. Choices are \n1. 'canonical' - Chooses best backend, and proxies content from that backend. \n2. 'direct' - A backend identifier is included in the URL and directly proxies that storage backend. \n3. 'backend_direct' - URL directly links to the backend (not supported yet)"`
+	ENABLE_SAFE_IMAGE_CHECK      string `toml:"ENABLE_SAFE_IMAGE_CHECK" comment:"Enable safe image check. 'true', '1' or 'yes' to enable"`
+	SAFE_IMAGE_CHECK_ENDPOINT    string `toml:"SAFE_IMAGE_CHECK_ENDPOINT" comment:"Safe image check endpoint. Used if ENABLE_SAFE_IMAGE_CHECK is true"`
+	CAPTCHA_PROVIDER             string `toml:"CAPTCHA_PROVIDER" comment:"Captcha provider. Choices are 'off', 'recaptcha', 'turnstile'"`
+	RECAPTCHA_CLIENT_KEY         string `toml:"RECAPTCHA_CLIENT_KEY" comment:"Recaptcha client key. Used if CAPTCHA_PROVIDER is 'recaptcha'"`
+	TURNSTILE_SITE_KEY           string `toml:"TURNSTILE_SITE_KEY" comment:"Turnstile site key. Used if CAPTCHA_PROVIDER is 'turnstile'"`
+	RECAPTCHA_SERVER_KEY         string `toml:"RECAPTCHA_SERVER_KEY" comment:"Recaptcha server key. Used if CAPTCHA_PROVIDER is 'recaptcha'"`
+	TURNSTILE_SECRET_KEY         string `toml:"TURNSTILE_SECRET_KEY" comment:"Turnstile secret key. Used if CAPTCHA_PROVIDER is 'turnstile'"`
+	CUSTOM_CSS                   string `toml:"CUSTOM_CSS" comment:"Custom CSS"`
+	CUSTOM_JS                    string `toml:"CUSTOM_JS" comment:"Custom JS"`
+	GOOGLE_ANALYTICS_ID          string `toml:"GOOGLE_ANALYTICS_ID" comment:"Google Analytics measurement ID (e.g. G-XXXXXXX). When set, injects gtag.js and exposes window.GAID."`
+	ALLOW_UPLOAD                 string `toml:"ALLOW_UPLOAD" comment:"Allow uploading new images. 'true', '1' or 'yes' to enable"`
+	ALLOW_NEW_USER               string `toml:"ALLOW_NEW_USER" comment:"Allow new user creation. 'true', '1' or 'yes' to enable"`
+	IMAGE_CACHE_MAX_BYTES        int64  `toml:"IMAGE_CACHE_MAX_BYTES" comment:"Optional in-memory HTTP image response cache byte budget. Leave unset or 0 to disable. Useful when a tiny set of immutable image URLs receives most traffic and the app server proxies storage bytes."`
+	IMAGE_CACHE_MAX_FILE_BYTES   int64  `toml:"IMAGE_CACHE_MAX_FILE_BYTES" comment:"Optional maximum single image size for the HTTP image response cache. Defaults to IMAGE_CACHE_MAX_BYTES when unset."`
+	IMAGE_MAX_UPLOAD_BYTES       int64  `toml:"IMAGE_MAX_UPLOAD_BYTES" comment:"Maximum image upload size in bytes. Defaults to 10485760 (10 MB)."`
+	GUEST_IMAGE_MAX_UPLOAD_BYTES int64  `toml:"GUEST_IMAGE_MAX_UPLOAD_BYTES" comment:"Maximum image upload size for unauthenticated users in bytes. Defaults to IMAGE_MAX_UPLOAD_BYTES when unset or 0."`
+	WEB_UI_ORIGINS               string `toml:"WEB_UI_ORIGINS" comment:"Comma-separated list of origins (scheme://host[:port]) allowed to make CORS requests to the image endpoints."`
 }
 
 type StorageBackendItem struct {

db/.gen/imgdd/public/model/organization_user_table.go

@@ -0,0 +1,2 @@
+ALTER TABLE organization_user_table
+  DROP COLUMN upload_limit_bytes;

db/.gen/imgdd/public/table/organization_user_table.go

@@ -0,0 +1,2 @@
+ALTER TABLE organization_user_table
+  ADD COLUMN upload_limit_bytes BIGINT NULL;

db/migrations/000007_add_org_user_upload_limit.down.sql

@@ -1,10 +1,11 @@
 package domainmodels
 
 type OrganizationUser struct {
-	Id           string
-	Organization *Organization
-	User         *User
-	Roles        []*Role
+	Id               string
+	Organization     *Organization
+	User             *User
+	Roles            []*Role
+	UploadLimitBytes *int64
 }
 
 func (ou *OrganizationUser) IsSiteOwner() bool {