Enhance upload handling: add db-backed upload rate limiting and lease management, enforce stricter validation for deployment configurations, optimize test suite and retired functionality, and improve input handling and error recovery.

src/services/attachmentService.js

@@ -29,6 +29,15 @@ export function parseVisionAnalysis(text) {
 
 export function createAttachmentService(db, config, modelService, visionDebugService = null) {
     const storage = new LocalFileStorage(config.uploadDir);
+    const acquireUploadLease = (username) => db.transaction(() => {
+        db.prepare("DELETE FROM upload_leases WHERE created_at < datetime('now', '-15 minutes')").run();
+        const active = db.prepare("SELECT COUNT(*) AS count FROM upload_leases WHERE username=?").get(username).count;
+        if (active >= config.uploadMaxFiles) return null;
+        const token = randomUUID();
+        db.prepare("INSERT INTO upload_leases(token, username) VALUES(?, ?)").run(token, username);
+        return token;
+    })();
+    const releaseUploadLease = token => { if (token) db.prepare("DELETE FROM upload_leases WHERE token=?").run(token); };
     const log = (event, fields) => { if (config.structuredRequestLoggingEnabled) console.log(JSON.stringify({event, ...fields})); };
     const get = id => db.prepare("SELECT * FROM attachments WHERE id = ?").get(id);
     const rows = messageId => db.prepare("SELECT a.*, m.position FROM attachments a JOIN message_attachments m ON m.attachment_id=a.id WHERE m.message_id=? ORDER BY m.position").all(messageId);
@@ -148,7 +157,7 @@ export function createAttachmentService(db, config, modelService, visionDebugSer
     timer.unref();
     void cleanup();
     return {
-        storage, cleanup,
+        storage, cleanup, acquireUploadLease, releaseUploadLease,
         async close() { clearInterval(timer); await cleanup(); closed = true; },
         list(messageId) { return rows(messageId).map(attachmentMetadata); },
         owned(id, user) {