Encrypt uploads in the browser and send them in chunks

A 6 GB upload kept a customer waiting long after its progress bar
reached 100%. The server wrote every upload three times: PHP's
temporary file, Livewire's copy of it ("Processing files...") and the
encrypted file ("Create Share Link"), each a full rewrite of a slow
disk. The unencrypted copy also stayed behind in livewire-tmp.

Now the uploader's browser encrypts each file in 16 MB chunks with
WebCrypto and PUTs them one at a time; the server checks each chunk in
memory and writes it once, already encrypted. Creating the share only
wraps its key and saves the options. A 200 MB upload through the
Docker image took 2.8 s, and its download matched byte for byte.

- SEALCHK2: a 19-byte header (chunk size, 7-byte nonce prefix), then
  ciphertext and tag per chunk. Each nonce holds the chunk index and a
  last-chunk flag (the STREAM construction), so cut or reordered files
  fail to decrypt. SEALCHK1 and the single-block format still read.
- Envelope encryption: one random key per share. With a password it is
  wrapped with Argon2id (sodium, libsodium's interactive limits) in
  shares.wrapped_key, which names its parameters. Password shares from
  before keep their PBKDF2-derived key.
- The upload page registers each selection with FileUploader into a
  pending share of its own, lists the files with their progress, retries
  a failed chunk after 1-16 s, then offers Retry; Remove and Cancel
  abort. UploadChunkController only accepts chunks from the session that
  started the share: a repeat is acknowledged, a skip gets 409 with the
  count stored. Chunks go out as Blobs, which Chromium sends about eight
  times faster than ArrayBuffers.
- Uploads need a secure context: over plain HTTP the page says HTTPS is
  needed and takes no files. The Docker image gains AUTO_HTTPS, which
  serves Let's Encrypt on 443 for SERVER_NAME and redirects 80; without
  it the container stays on HTTP 80 behind a proxy. docker/Caddyfile was
  never loaded and is gone; docker/healthcheck.sh covers both modes.
- "Download all" streams the ZIP with maennchen/zipstream-php (STORE,
  ZIP64) instead of decrypting whole files into memory and writing the
  archive unencrypted to /tmp.
- Pending shares count towards the quota, stay out of the admin
  dashboard and 404 everywhere else. shares:cleanup deletes uploads idle
  for 4 hours and Livewire temporary files older than that.
- PHP's upload limits no longer cap the admin's max file size and
  default to 64M; LIVEWIRE_MAX_UPLOAD_TIME is gone and
  UPLOAD_CHUNK_SIZE_MB is new.
- Tests cover the format, key wrapping, registration limits, the chunk
  endpoint's answers, completing a share, the streamed ZIP, cleanup,
  and in Chromium a real chunked upload and the HTTPS warning; the
  selected-files overflow test runs again. README, website, CHANGELOG
  and .ai/rules follow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/Http/Controllers/DownloadController.php

@@ -6,11 +6,12 @@ use App\Models\Share;
 use App\Models\ShareFile;
 use App\Services\FileEncryptionService;
 use App\Services\ShareService;
+use GuzzleHttp\Psr7\PumpStream;
 use Illuminate\Support\Facades\Storage;
-use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\HeaderUtils;
 use Symfony\Component\HttpFoundation\StreamedResponse;
-use ZipArchive;
+use ZipStream\CompressionMethod;
+use ZipStream\ZipStream;
 
 class DownloadController extends Controller
 {
@@ -20,41 +21,53 @@ class DownloadController extends Controller
     ) {}
 
     /**
-     * Download all files as a ZIP archive.
+     * Download all files as a ZIP archive, streamed file by file as it is decrypted: stored without
+     * compression, with ZIP64 for files over 4 GB, and never held in memory or written to disk.
      */
-    public function download(Share $share): BinaryFileResponse
+    public function download(Share $share): StreamedResponse
     {
-        abort_if($share->isExpired() || $share->hasReachedDownloadLimit(), 404);
+        abort_if(! $share->isCompleted() || $share->isExpired() || $share->hasReachedDownloadLimit(), 404);
 
         $share->load('files');
         $key = $this->resolveDecryptionKey($share);
 
-        $tempPath = tempnam(sys_get_temp_dir(), 'sealshare_');
+        return new StreamedResponse(function () use ($share, $key): void {
+            $zip = new ZipStream(
+                defaultCompressionMethod: CompressionMethod::STORE,
+                defaultEnableZeroHeader: true,
+                sendHttpHeaders: false,
+                flushOutput: true,
+            );
 
-        $zip = new ZipArchive;
-        $zip->open($tempPath, ZipArchive::CREATE | ZipArchive::OVERWRITE);
+            foreach ($share->files as $file) {
+                $chunks = $this->encryptionService->decryptedChunks(
+                    Storage::disk('shares')->path($share->token.'/'.basename($file->stored_path)),
+                    $key,
+                );
 
-        foreach ($share->files as $file) {
-            $encryptedPath = Storage::disk('shares')->path($share->token.'/'.basename($file->stored_path));
-            $content = $this->encryptionService->decryptFile($encryptedPath, $key);
+                $zip->addFileFromPsr7Stream(fileName: $this->archiveName($file), stream: new PumpStream(function () use ($chunks): string|false {
+                    while ($chunks->valid() && $chunks->current() === '') {
+                        $chunks->next();
+                    }
 
-            $filename = $file->relative_path ?: $file->original_name;
-            $filename = str_replace('\\', '/', $filename);
+                    if (! $chunks->valid()) {
+                        return false;
+                    }
 
-            if (str_starts_with($filename, '/') || str_contains($filename, '..')) {
-                $filename = basename($filename);
+                    $chunk = $chunks->current();
+                    $chunks->next();
+
+                    return $chunk;
+                }));
             }
 
-            $zip->addFromString($filename, $content);
-        }
+            $zip->finish();
 
-        $zip->close();
-
-        $this->shareService->recordDownload($share);
-
-        return response()->download($tempPath, 'share-'.$share->token.'.zip', [
+            $this->shareService->recordDownload($share);
+        }, 200, [
             'Content-Type' => 'application/zip',
-        ])->deleteFileAfterSend(true);
+            'Content-Disposition' => HeaderUtils::makeDisposition('attachment', 'share-'.$share->token.'.zip'),
+        ]);
     }
 
     /**
@@ -62,7 +75,7 @@ class DownloadController extends Controller
      */
     public function downloadFile(Share $share, ShareFile $shareFile): StreamedResponse
     {
-        abort_if($share->isExpired() || $share->hasReachedDownloadLimit(), 404);
+        abort_if(! $share->isCompleted() || $share->isExpired() || $share->hasReachedDownloadLimit(), 404);
         abort_if($shareFile->share_id !== $share->id, 404);
 
         $key = $this->resolveDecryptionKey($share);
@@ -90,6 +103,21 @@ class DownloadController extends Controller
         }, 200, $headers);
     }
 
+    /**
+     * A file's path inside the archive: its folder path when it came from a dropped folder, never
+     * one that could reach outside the archive.
+     */
+    private function archiveName(ShareFile $file): string
+    {
+        $filename = str_replace('\\', '/', $file->relative_path ?: $file->original_name);
+
+        if (str_starts_with($filename, '/') || str_contains($filename, '..')) {
+            return basename($filename);
+        }
+
+        return $filename;
+    }
+
     /**
      * Resolve the decryption key from session or share.
      */