fixes and functions

src/api/files.rs

@@ -16,7 +16,7 @@ pub async fn upload_pad_file(
     Path(slug): Path<String>,
     mut multipart: Multipart,
 ) -> Result<Json<serde_json::Value>, ApiError> {
-    require_upload_permission(&state, &headers).await?;
+    let upload_max_size_bytes = require_upload_permission(&state, &headers).await?;
     let mut password: Option<String> = None;
     let mut access_token: Option<String> = None;
     let mut file: Option<(String, Vec<u8>)> = None;
@@ -46,8 +46,8 @@ pub async fn upload_pad_file(
                 .bytes()
                 .await
                 .map_err(|_| ApiError::bad_request("Failed to read the file"))?;
-            if bytes.len() > state.upload_max_size_bytes {
-                return Err(ApiError::payload_too_large(state.upload_max_size_bytes));
+            if bytes.len() > upload_max_size_bytes {
+                return Err(ApiError::payload_too_large(upload_max_size_bytes));
             }
             file = Some((filename, bytes.to_vec()));
         }
@@ -255,7 +255,7 @@ pub async fn upload_note_file(
     Path((workspace_slug, note_slug)): Path<(String, String)>,
     mut multipart: Multipart,
 ) -> Result<Json<serde_json::Value>, ApiError> {
-    require_upload_permission(&state, &headers).await?;
+    let upload_max_size_bytes = require_upload_permission(&state, &headers).await?;
     let mut password: Option<String> = None;
     let mut access_token: Option<String> = None;
     let mut file: Option<(String, Vec<u8>)> = None;
@@ -285,8 +285,8 @@ pub async fn upload_note_file(
                 .bytes()
                 .await
                 .map_err(|_| ApiError::bad_request("Failed to read the file"))?;
-            if bytes.len() > state.upload_max_size_bytes {
-                return Err(ApiError::payload_too_large(state.upload_max_size_bytes));
+            if bytes.len() > upload_max_size_bytes {
+                return Err(ApiError::payload_too_large(upload_max_size_bytes));
             }
             file = Some((filename, bytes.to_vec()));
         }
@@ -507,17 +507,10 @@ pub async fn delete_note_file(
 async fn require_upload_permission(
     state: &SharedState,
     headers: &HeaderMap,
-) -> Result<(), ApiError> {
-    let user = crate::auth::optional_user(state, headers)
-        .await
-        .map_err(|error| ApiError::forbidden(&error.message))?;
-    if user.is_some() {
-        Ok(())
-    } else {
-        Err(ApiError::forbidden(
-            "Log in with read-write access to upload files.",
-        ))
-    }
+) -> Result<usize, ApiError> {
+    upload_limit_for_request(state, headers)
+        .await?
+        .ok_or_else(|| ApiError::forbidden("File uploads are disabled for guests."))
 }
 
 pub async fn download_file(

src/api/mod.rs

@@ -173,6 +173,32 @@ async fn has_write_permission(
     }
 }
 
+async fn upload_limit_for_request(
+    state: &SharedState,
+    headers: &HeaderMap,
+) -> Result<Option<usize>, ApiError> {
+    if session_user(state, headers).await?.is_some() {
+        return Ok(Some(state.upload_max_size_bytes));
+    }
+    Ok(state
+        .guest_upload_enabled
+        .then_some(state.guest_upload_max_size_bytes))
+}
+
+async fn resource_upload_limit(
+    state: &SharedState,
+    headers: &HeaderMap,
+    kind: &str,
+    slug: &str,
+) -> Result<Option<usize>, ApiError> {
+    let Some(limit) = upload_limit_for_request(state, headers).await? else {
+        return Ok(None);
+    };
+    Ok(has_write_permission(state, headers, kind, slug)
+        .await?
+        .then_some(limit))
+}
+
 #[derive(Debug, Serialize)]
 pub struct PublishResponse {
     url: Option<String>,
@@ -380,6 +406,7 @@ pub struct NoteInfo {
     updated_at: String,
     can_delete_files: bool,
     can_upload_files: bool,
+    upload_max_size_bytes: Option<usize>,
     global_color: Option<String>,
     note_color: Option<String>,
     authorship_mode: String,
@@ -996,8 +1023,9 @@ pub async fn note_info(
         has_password_write_access(&state, &headers, "workspace", &workspace_slug).await?;
     let can_manage_authorship = workspace_owner || note_owner || password_write_access;
     let can_delete_files = can_manage_authorship;
-    let can_upload_files = session_user(&state, &headers).await?.is_some()
-        && has_write_permission(&state, &headers, "workspace", &workspace_slug).await?;
+    let upload_max_size_bytes =
+        resource_upload_limit(&state, &headers, "workspace", &workspace_slug).await?;
+    let can_upload_files = upload_max_size_bytes.is_some();
     let can_save_editor_settings = (personal_editor_settings || can_manage_authorship)
         && has_write_permission(&state, &headers, "workspace", &workspace_slug).await?;
 
@@ -1024,6 +1052,7 @@ pub async fn note_info(
         updated_at: db::normalize_timestamp(&note.updated_at),
         can_delete_files,
         can_upload_files,
+        upload_max_size_bytes,
         global_color,
         note_color,
         authorship_mode: resource_editor_settings.authorship_mode,

src/api/pads_public.rs

@@ -43,6 +43,7 @@ pub struct PadInfo {
     updated_at: String,
     can_delete_files: bool,
     can_upload_files: bool,
+    upload_max_size_bytes: Option<usize>,
     global_color: Option<String>,
     note_color: Option<String>,
     authorship_mode: String,
@@ -135,8 +136,8 @@ pub async fn pad_info(
     let guest_owner = pad_creator_is_requester(&headers, &pad);
     let password_write_access = has_password_write_access(&state, &headers, "pad", &slug).await?;
     let can_manage_authorship = account_owner || guest_owner || password_write_access;
-    let can_upload_files = session_user(&state, &headers).await?.is_some()
-        && has_write_permission(&state, &headers, "pad", &slug).await?;
+    let upload_max_size_bytes = resource_upload_limit(&state, &headers, "pad", &slug).await?;
+    let can_upload_files = upload_max_size_bytes.is_some();
     let can_save_editor_settings = (personal_editor_settings || can_manage_authorship)
         && has_write_permission(&state, &headers, "pad", &slug).await?;
     if pad.is_private == 0
@@ -159,6 +160,7 @@ pub async fn pad_info(
         updated_at: db::normalize_timestamp(&pad.updated_at),
         can_delete_files: can_manage_authorship,
         can_upload_files,
+        upload_max_size_bytes,
         global_color,
         note_color,
         authorship_mode: resource_editor_settings.authorship_mode,