Package com.iizix.server.upload


package com.iizix.server.upload
  • Class
    Description
    The server side of one client session's upload channel, and the file upload API of that client session (IClientUploadAPI, obtained from IClientSessionGyro.getFileUploadAPI()): links the UploadChannelProps the client created under $env to the application session's AppGyroFileUploaderService (CC-UPLOAD-A step A1, FILE-UPLOAD-DESIGN.md section 1.2 amended 2026-09-25; the API and the gate by CC-UPLOAD-U1, UPLOAD-UI-DESIGN.md edition 2 section 2).
    The on-disk record of one file of an upload reservation, <fid>.json beside <fid>.part.
    The server module of the upload service: owns the staging store, the server-global registry, the chunk servlet and the sweeps, and routes the registry's events to the application session that owns each reservation.
    The server-global registry of live upload reservations: mints them, enforces the quotas at reservation time, holds the per-reservation locks, arms the start and idle timeouts, records accepted chunks, and cancels.
    What the registry reports to its owner (the application-session service), on the thread the change happened on; the owner hands it to the app worker.
    The seam through which the upload registry arms its start and idle timeouts, so that the production implementation can be the server's TimerEngine and a test can be a fake clock that fires on demand.
    A scheduled timeout that can be cancelled.
    The server's view of one client of the application session for what the upload service must push to it: the App's pause and resume of a file (ruling row 12 of 2026-09-24).
    What the upload service needs from the application session it belongs to, as a small interface so the service can be driven in a test without an AppSessionGyro.
    The on-disk record of one upload reservation, reservation.json in the reservation's staging directory.
    The production ITimeouts: one-shot timeouts on the server's ITimerEngine (the system instance, disposed with the server).
    A verified upload as handed to the listener: reads the staged part transparently decompressed, and transfers or ends the server's ownership through UploadedFile.take() / UploadedFile.delete().
    The in-memory side of one file of a reservation: its sidecar record, its secret (memory only, never on disk, never logged) and the flags the registry keeps per file.
    A snapshot of the upload settings in force when a reservation is made: quotas, counts, sizes, timeouts and the permitted media types.
    One live upload reservation as the registry holds it: the sidecar record, the file entries, the limits it was granted under, its per-reservation listener, and the one lock that serializes every chunk of every one of its files.
    The staging directory of the upload service: <root>/xfer/<rid>/ holds one reservation.json, and per file <fid>.part (the bytes as received, compressed if the transfer uses gzip) beside <fid>.json.
    Verifies a completely received upload: decodes it in full (transparently through gzip), sniffs the media type from the first bytes, and checks the decoded byte count against the declared size as it streams - the loop aborts on the first buffer that crosses the declared size, so a gzip bomb costs at most the declared size plus one buffer of decoding, never a full expansion followed by a comparison.
    The outcome of a verification.