"cpufeatures 0.2.17",

name = "block-buffer"

version = "0.12.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"

dependencies = [

 "hybrid-array",

]

[[package]]

 "crypto-common 0.1.7",

name = "cmov"

version = "0.5.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"

[[package]]

[[package]]

name = "const-oid"

version = "0.10.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"

name = "cpufeatures"

version = "0.3.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"

dependencies = [

 "libc",

]

[[package]]

name = "crypto-common"

version = "0.2.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"

dependencies = [

 "hybrid-array",

]

[[package]]

name = "ctutils"

version = "0.4.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"

dependencies = [

 "cmov",

]

[[package]]

 "block-buffer 0.10.4",

 "crypto-common 0.1.7",

]

[[package]]

name = "digest"

version = "0.11.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"

dependencies = [

 "block-buffer 0.12.0",

 "const-oid",

 "crypto-common 0.2.1",

 "ctutils",

 "digest 0.10.7",

]

[[package]]

name = "hmac"

version = "0.13.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"

dependencies = [

 "digest 0.11.3",

]

[[package]]

name = "hybrid-array"

version = "0.4.11"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"

dependencies = [

 "typenum",

name = "jiff"

version = "0.2.24"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "f00b5dbd620d61dfdcb6007c9c1f6054ebd75319f163d886a9055cec1155073d"

dependencies = [

 "jiff-static",

 "log",

 "portable-atomic",

 "portable-atomic-util",

 "serde_core",

]

[[package]]

name = "jiff-static"

version = "0.2.24"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "e000de030ff8022ea1da3f466fbb0f3a809f5e51ed31f6dd931c35181ad8e6d7"

dependencies = [

 "proc-macro2",

 "quote",

 "syn 2.0.117",

]

[[package]]

]

[[package]]

name = "md-5"

version = "0.11.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"

dependencies = [

 "cfg-if",

 "digest 0.11.3",

 "digest 0.10.7",

 "hmac 0.12.1",

 "sha2 0.10.9",

name = "portable-atomic-util"

version = "0.2.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"

dependencies = [

 "portable-atomic",

]

[[package]]

 "reqwest 0.12.28",

 "rusty-s3",

 "url",

]

[[package]]

name = "quick-xml"

version = "0.39.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "958f21e8e7ceb5a1aa7fa87fab28e7c75976e0bfe7e23ff069e0a260f894067d"

dependencies = [

 "memchr",

 "serde",

 "sha2 0.10.9",

[[package]]

name = "rusty-s3"

version = "0.9.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "15ec4851cde7bd44c6b1dbd7e68f70ac50f9dec29bb1f1ffd69426578af02d6b"

dependencies = [

 "base64",

 "hmac 0.13.0",

 "jiff",

 "md-5",

 "percent-encoding",

 "quick-xml 0.39.2",

 "serde",

 "serde_json",

 "sha2 0.11.0",

 "url",

 "zeroize",

]

 "cpufeatures 0.2.17",

 "digest 0.10.7",

 "cpufeatures 0.2.17",

 "digest 0.10.7",

]

[[package]]

name = "sha2"

version = "0.11.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"

dependencies = [

 "cfg-if",

 "cpufeatures 0.3.0",

 "digest 0.11.3",

 "sha2 0.10.9",

version = "1.20.0"

checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"

 "sha2 0.10.9",

 "hmac 0.12.1",

# Optional: Cloudflare R2 (set ALL to enable; otherwise local filesystem is used)

# R2_ACCOUNT_ID=

# R2_ACCESS_KEY_ID=

# R2_SECRET_ACCESS_KEY=

# R2_BUCKET=

# R2_PUBLIC_URL=https://pub-xxxx.r2.dev

rusty-s3 = "0.9"

reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"] }

url = "2"

    pub storage_backend: String,

        id              INTEGER PRIMARY KEY AUTOINCREMENT,

        short_id        TEXT NOT NULL UNIQUE,

        filename        TEXT NOT NULL UNIQUE,

        original_name   TEXT NOT NULL,

        content_type    TEXT NOT NULL DEFAULT 'application/octet-stream',

        size            INTEGER NOT NULL,

        created_at      TEXT NOT NULL DEFAULT (datetime('now')),

        storage_backend TEXT NOT NULL DEFAULT 'local'

    migrate_files_storage_backend(&conn).expect("Failed to migrate files.storage_backend");

fn migrate_files_storage_backend(conn: &Connection) -> rusqlite::Result<()> {

    let exists: i64 = conn

        .query_row(

            "SELECT COUNT(*) FROM pragma_table_info('files') WHERE name = 'storage_backend'",

            [],

            |row| row.get(0),

        )

        .unwrap_or(0);

    if exists > 0 {

        return Ok(());

    }

    conn.execute(

        "ALTER TABLE files ADD COLUMN storage_backend TEXT NOT NULL DEFAULT 'local'",

        [],

    )?;

    Ok(())

}

const FILE_COLS: &str = "id, short_id, filename, original_name, content_type, size, created_at, storage_backend";

    storage_backend: &str,

        "INSERT INTO files (short_id, filename, original_name, content_type, size, storage_backend) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",

        params![short_id, filename, original_name, content_type, size, storage_backend],

pub fn get_file_by_filename(db: &Db, filename: &str) -> Result<Option<UploadedFile>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let file = conn

        .query_row(

            &format!("SELECT {} FROM files WHERE filename = ?1", FILE_COLS),

            params![filename],

            from_row,

        )

        .optional()?;

    Ok(file)

}

        let file = create_file(&db, "abc123.jpg", "photo.jpg", "image/jpeg", 1024, "local").unwrap();

        let file = create_file(&db, "f.txt", "f.txt", "text/plain", 10, "local").unwrap();

mod storage;

    let backend = if let Some(r2) = &state.r2 {

        if let Err(e) = r2.put_object(&stored_name, &content_type, bytes.clone()).await {

            tracing::error!("Failed to upload to R2: {}", e);

            return Redirect::to("/admin/files?error=Failed+to+save+file").into_response();

        }

        "r2"

    } else {

        let path = std::path::PathBuf::from(&state.uploads_dir).join(&stored_name);

        if let Err(e) = tokio::fs::write(&path, &bytes).await {

            tracing::error!("Failed to write file: {}", e);

            return Redirect::to("/admin/files?error=Failed+to+save+file").into_response();

        }

        "local"

    };

    match db::create_file(&state.db, &stored_name, &original_name, &content_type, bytes.len() as i64, backend) {

            if backend == "r2" {

                if let Some(r2) = &state.r2 {

                    if let Err(e) = r2.delete_object(&stored_name).await {

                        tracing::warn!("Failed to roll back R2 upload: {}", e);

                    }

                }

            } else {

                let path = std::path::PathBuf::from(&state.uploads_dir).join(&stored_name);

                let _ = tokio::fs::remove_file(&path).await;

            }

            if file.storage_backend == "r2" {

                if let Some(r2) = &state.r2 {

                    if let Err(e) = r2.delete_object(&file.filename).await {

                        tracing::warn!("Failed to delete file from R2: {}", e);

                    }

                } else {

                    tracing::warn!(

                        "File {} stored in R2 but R2 not configured; skipping remote delete",

                        file.filename

                    );

                }

            } else {

                let path = std::path::PathBuf::from(&state.uploads_dir).join(&file.filename);

                if let Err(e) = tokio::fs::remove_file(&path).await {

                    tracing::warn!("Failed to delete file from disk: {}", e);

                }

    if let Ok(Some(file)) = db::get_file_by_filename(&state.db, &filename) {

        if file.storage_backend == "r2" {

            if let Some(r2) = &state.r2 {

                return Redirect::temporary(&r2.public_url_for(&filename)).into_response();

            }

            tracing::warn!(

                "File {} stored in R2 but R2 not configured; cannot serve",

                filename

            );

            return StatusCode::NOT_FOUND.into_response();

        }

    }

use crate::storage::R2Config;

    pub r2: Option<R2Config>,

    let r2 = R2Config::from_env();

    if r2.is_some() {

        tracing::info!("Cloudflare R2 storage enabled for new uploads");

    } else {

        tracing::info!("R2 not configured, using local filesystem for uploads");

    }

        r2,

use std::time::Duration;

use rusty_s3::actions::S3Action;

use rusty_s3::{Bucket, Credentials, UrlStyle, actions};

#[derive(Clone)]

pub struct R2Config {

    bucket: Bucket,

    creds: Credentials,

    public_url: String,

    http: reqwest::Client,

}

#[derive(Debug)]

pub enum R2Error {

    Http(reqwest::Error),

    Status(u16, String),

}

impl std::fmt::Display for R2Error {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        match self {

            R2Error::Http(e) => write!(f, "http error: {}", e),

            R2Error::Status(code, body) => write!(f, "R2 returned {}: {}", code, body),

        }

    }

}

impl std::error::Error for R2Error {}

impl From<reqwest::Error> for R2Error {

    fn from(e: reqwest::Error) -> Self {

        R2Error::Http(e)

    }

}

const SIGN_TTL: Duration = Duration::from_secs(60);

impl R2Config {

    pub fn from_env() -> Option<Self> {

        let account_id = std::env::var("R2_ACCOUNT_ID").ok()?;

        let access_key = std::env::var("R2_ACCESS_KEY_ID").ok()?;

        let secret_key = std::env::var("R2_SECRET_ACCESS_KEY").ok()?;

        let bucket_name = std::env::var("R2_BUCKET").ok()?;

        let public_url = std::env::var("R2_PUBLIC_URL").ok()?;

        let endpoint_str = format!("https://{}.r2.cloudflarestorage.com", account_id);

        let endpoint = match endpoint_str.parse() {

            Ok(u) => u,

            Err(e) => {

                tracing::error!("Invalid R2 endpoint URL: {}", e);

                return None;

            }

        };

        let bucket = match Bucket::new(endpoint, UrlStyle::Path, bucket_name, "auto") {

            Ok(b) => b,

            Err(e) => {

                tracing::error!("Failed to construct R2 bucket: {:?}", e);

                return None;

            }

        };

        let creds = Credentials::new(access_key, secret_key);

        let http = reqwest::Client::builder()

            .timeout(Duration::from_secs(30))

            .build()

            .ok()?;

        Some(Self {

            bucket,

            creds,

            public_url: public_url.trim_end_matches('/').to_string(),

            http,

        })

    }

    pub async fn put_object(

        &self,

        key: &str,

        content_type: &str,

        bytes: Vec<u8>,

    ) -> Result<(), R2Error> {

        let mut action = actions::PutObject::new(&self.bucket, Some(&self.creds), key);

        action.headers_mut().insert("content-type", content_type);

        let url = action.sign(SIGN_TTL);

        let resp = self

            .http

            .put(url)

            .header("content-type", content_type)

            .body(bytes)

            .send()

            .await?;

        if !resp.status().is_success() {

            let code = resp.status().as_u16();

            let body = resp.text().await.unwrap_or_default();

            return Err(R2Error::Status(code, body));

        }

        Ok(())

    }

    pub async fn delete_object(&self, key: &str) -> Result<(), R2Error> {

        let action = actions::DeleteObject::new(&self.bucket, Some(&self.creds), key);

        let url = action.sign(SIGN_TTL);

        let resp = self.http.delete(url).send().await?;

        let status = resp.status();

        if status.is_success() || status.as_u16() == 404 {

            return Ok(());

        }

        let body = resp.text().await.unwrap_or_default();

        Err(R2Error::Status(status.as_u16(), body))

    }

    pub fn public_url_for(&self, key: &str) -> String {

        format!("{}/{}", self.public_url, key)

    }

}