Multiple files per transfer
- The UI accepted several files but only files[0] was ever uploaded, so
recipients saw a list and received one file. Chunks now carry a
fileIndex, the upload session tracks each file separately, and finalize
assembles one encrypted payload and one File row per file.
- The download page lists real files with per-file download buttons; the
previously unused isFileDownloading/isFileDownloaded helpers now drive
that state. /api/file/[id] accepts a fileId, scoped to the transfer so
an id from another transfer cannot be fetched.
Large downloads
- Replace res.blob() with a helper that streams the response body to disk
via the File System Access API where available, keeping peak memory at
roughly one chunk instead of the whole file. Falls back to the blob
path elsewhere.
Password brute force
- Rate limit /api/verify and /api/file/[id] to 10 attempts per transfer,
per client, per 15 minutes; a correct password clears the counter.
Per-process state, matching the existing local-disk storage model.
Disk reclamation
- Nothing ever deleted payloads, so every transfer stayed on disk
regardless of expiresAt. Add a cleanup routine that marks lapsed
transfers EXPIRED, deletes payloads for expired and soft-deleted
transfers, and sweeps abandoned chunk directories. It refuses to unlink
anything outside UPLOAD_DIR. Exposed as POST /api/cron/cleanup behind
CRON_SECRET, failing closed when that is unset.
Build hygiene
- Stop ignoring ESLint during builds and fix all 70 resulting violations:
unused imports and state, unescaped JSX entities, explicit any, and a
missing useEffect dependency. Seven catch blocks discarded their error
silently and now log it.
- Delete dead code: two unused send components, the two legacy upload
endpoints they called, the unused whole-file WebCrypto helpers, and a
duplicate separator component differing only by a typo.
Add .env.example documenting configuration, including CRON_SECRET.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
twotalesanimation
0b56ec31ed