feat: Phase 1 video upload support (Blossom-compliant-ish)#285

Merged

tlongwell-block merged 33 commits into

mainfrom

feat/video-support

Apr 10, 2026

Commits on Apr 9, 2026

fix: image hash cross-check, moov scanner hardening, upload descriptor tests
tlongwell-block
committed
fix: reject zero-duration in imeta validation (defense-in-depth)
tlongwell-block
committed
feat: add get_range() and put_file() to MediaStorage for video support
tlongwell-block
committed
feat: wire max_video_bytes into relay config and body limit
tlongwell-block
committed
fix(media): use S3-native range GET for 206 responses
tlongwell-block
committed
fix: moov scanner fails closed on atom budget exceeded
tlongwell-block
committed
fix: remove semantically wrong image hash cross-check against x
tlongwell-block
committed
fix: reject video/mp4 in image upload path (Content-Type spoofing)
tlongwell-block
committed
fix: reject zero-duration videos in validate_video_file()
tlongwell-block
committed
feat: add get_stream() for streaming S3 downloads
tlongwell-block
committed
fix: map body-limit stream errors to FileTooLarge (413) not Io (500)
tlongwell-block
committed
test: add 5 video E2E tests (upload, spoofing, range, 416, auth)
tlongwell-block
committed
feat(media): streaming upload + streaming download
tlongwell-block
committed
fix: verify poster frame blob exists in verify_imeta_blobs
tlongwell-block
committed
fix(media): support suffix byte ranges (bytes=-N) per RFC 9110
tlongwell-block
committed
fix: buffer leading bytes for MIME sniffing instead of using first chunk
tlongwell-block
committed
fix: bump MIME sniff buffer from 64 to 4096 bytes
tlongwell-block
committed
test: add live video upload validation script
tlongwell-block
committed
feat: video support infrastructure (deps, error variants, config, types)
tlongwell-block
committed
fix: use std::io::Error::other() to satisfy clippy io_other_error lint
tlongwell-block
committed
fix: remove needless Ok wrapper to satisfy clippy
tlongwell-block
committed
fix: poster frame sidecar verification + E2E test X-SHA-256 headers
tlongwell-block
committed
fix: add Authorization header and remove stray tokens in E2E video tests
tlongwell-block
committed
fix: poster extension mismatch + duration cross-check in verify_imeta_blobs
tlongwell-block
committed
fix: reject thumbnail URLs in imeta image field (poster frames must be standalone blobs)
tlongwell-block
committed
style: rustfmt formatting fixes
tlongwell-block
committed
fix: crossfire follow-ups — imeta field gating, multi-range fallback, poster defense-in-depth
tlongwell-block
committed

Commits on Apr 10, 2026