foto-portfolio/admin/api.php

<?php
/**
 * Admin upload endpoint used by the browser-side uploader (assets/admin.js).
 *
 * One multipart POST per image (X-CSRF-Token header, fields below); the webhost
 * streams the file straight to S3 and appends it to the gallery's JSON file.
 * Keeping it to a single file per request means each PHP process only ever
 * handles one image, so a multi-gigabyte gallery upload never trips
 * post_max_size / max_execution_time — only the largest single image does.
 *
 * Fields:
 *   slug      gallery slug
 *   original  the full-resolution file (required; stored unmodified unless the
 *             gallery strips metadata — see app/exif.php)
 *   thumb     browser-generated JPEG thumbnail (optional; absent for RAW/video)
 *   batch     id of the selection this file came from (optional)
 *   seq       its position within that selection, so parallel uploads are
 *             stored in the order they were picked, not the order they land
 *   topic     id of the topic to upload into (optional; empty = no topic)
 *
 * The browser never receives an S3 URL or any credential for writing.
 */
require dirname(__DIR__) . '/app/bootstrap.php';

if (!auth_check()) {
    json_response(['error' => 'Not authenticated'], 401);
}
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    json_response(['error' => 'POST only'], 405);
}
csrf_verify();

// Release the session file before the slow S3 leg. PHP holds an exclusive lock
// on it for the whole request, so without this every parallel upload from the
// browser would queue behind the previous one and the uploader would be
// serial again no matter how many requests it starts.
session_write_close();

// One image per request; a single file may still be large, so lift the time cap.
@set_time_limit(0);

// When a request body exceeds post_max_size, PHP discards $_POST and $_FILES
// entirely — surface that as a clear 413 instead of a misleading "no file".
if ((int)($_SERVER['CONTENT_LENGTH'] ?? 0) > 0 && !$_POST && !$_FILES) {
    json_response(['error' => 'Upload exceeds the server post_max_size limit'], 413);
}

$gallery = gallery_load((string)($_POST['slug'] ?? ''));
if ($gallery === null) {
    json_response(['error' => 'Unknown gallery'], 404);
}

// The uploader may target a topic. Validate it here so a stale page cannot
// write a reference to a topic that has since been deleted; gallery_append_image
// re-checks under its lock for the same reason.
$topic = (string)($_POST['topic'] ?? '');
if ($topic !== '' && !isset(gallery_topic_map($gallery)[$topic])) {
    $topic = '';
}

// Trusted admin path: any file type is allowed (imagesOnly stays false).
[$status, $payload] = gallery_store_s3_upload(
    $gallery,
    $_FILES['original'] ?? null,
    $_FILES['thumb'] ?? null,
    false,
    $_POST,
    $topic !== '' ? $topic : null
);
json_response($payload, $status);