Andreas Reinhold / reiniandClaude Opus 5
40e35bab0e
A 6 GB upload kept a customer waiting long after its progress bar
reached 100%. The server wrote every upload three times: PHP's
temporary file, Livewire's copy of it ("Processing files...") and the
encrypted file ("Create Share Link"), each a full rewrite of a slow
disk. The unencrypted copy also stayed behind in livewire-tmp.
Now the uploader's browser encrypts each file in 16 MB chunks with
WebCrypto and PUTs them one at a time; the server checks each chunk in
memory and writes it once, already encrypted. Creating the share only
wraps its key and saves the options. A 200 MB upload through the
Docker image took 2.8 s, and its download matched byte for byte.
- SEALCHK2: a 19-byte header (chunk size, 7-byte nonce prefix), then
ciphertext and tag per chunk. Each nonce holds the chunk index and a
last-chunk flag (the STREAM construction), so cut or reordered files
fail to decrypt. SEALCHK1 and the single-block format still read.
- Envelope encryption: one random key per share. With a password it is
wrapped with Argon2id (sodium, libsodium's interactive limits) in
shares.wrapped_key, which names its parameters. Password shares from
before keep their PBKDF2-derived key.
- The upload page registers each selection with FileUploader into a
pending share of its own, lists the files with their progress, retries
a failed chunk after 1-16 s, then offers Retry; Remove and Cancel
abort. UploadChunkController only accepts chunks from the session that
started the share: a repeat is acknowledged, a skip gets 409 with the
count stored. Chunks go out as Blobs, which Chromium sends about eight
times faster than ArrayBuffers.
- Uploads need a secure context: over plain HTTP the page says HTTPS is
needed and takes no files. The Docker image gains AUTO_HTTPS, which
serves Let's Encrypt on 443 for SERVER_NAME and redirects 80; without
it the container stays on HTTP 80 behind a proxy. docker/Caddyfile was
never loaded and is gone; docker/healthcheck.sh covers both modes.
- "Download all" streams the ZIP with maennchen/zipstream-php (STORE,
ZIP64) instead of decrypting whole files into memory and writing the
archive unencrypted to /tmp.
- Pending shares count towards the quota, stay out of the admin
dashboard and 404 everywhere else. shares:cleanup deletes uploads idle
for 4 hours and Livewire temporary files older than that.
- PHP's upload limits no longer cap the admin's max file size and
default to 64M; LIVEWIRE_MAX_UPLOAD_TIME is gone and
UPLOAD_CHUNK_SIZE_MB is new.
- Tests cover the format, key wrapping, registration limits, the chunk
endpoint's answers, completing a share, the streamed ZIP, cleanup,
and in Chromium a real chunked upload and the HTTPS warning; the
selected-files overflow test runs again. README, website, CHANGELOG
and .ai/rules follow.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
118 lines
3.7 KiB
JSON
118 lines
3.7 KiB
JSON
{
|
|
"$schema": "https://getcomposer.org/schema.json",
|
|
"name": "laravel/livewire-starter-kit",
|
|
"type": "project",
|
|
"description": "The official Laravel starter kit for Livewire.",
|
|
"keywords": [
|
|
"laravel",
|
|
"framework"
|
|
],
|
|
"license": "MIT",
|
|
"require": {
|
|
"php": "^8.5",
|
|
"bacon/bacon-qr-code": "^3.0",
|
|
"laravel/fortify": "^1.30",
|
|
"laravel/framework": "^13.0",
|
|
"laravel/octane": "^2.13",
|
|
"laravel/tinker": "^3.0",
|
|
"livewire/livewire": "^4.0",
|
|
"maennchen/zipstream-php": "^3.2",
|
|
"nonameweb/livewire-material": "^2.0"
|
|
},
|
|
"require-dev": {
|
|
"fakerphp/faker": "^1.23",
|
|
"laravel/boost": "^2.0",
|
|
"laravel/pail": "^1.2.2",
|
|
"laravel/pint": "^1.24",
|
|
"laravel/sail": "^1.41",
|
|
"mockery/mockery": "^1.6",
|
|
"nunomaduro/collision": "^8.6",
|
|
"pestphp/pest": "^5.1",
|
|
"pestphp/pest-plugin-browser": "^5.0",
|
|
"pestphp/pest-plugin-laravel": "^5.0"
|
|
},
|
|
"autoload": {
|
|
"psr-4": {
|
|
"App\\": "app/",
|
|
"Database\\Factories\\": "database/factories/",
|
|
"Database\\Seeders\\": "database/seeders/"
|
|
}
|
|
},
|
|
"autoload-dev": {
|
|
"psr-4": {
|
|
"Tests\\": "tests/"
|
|
}
|
|
},
|
|
"scripts": {
|
|
"setup": [
|
|
"composer install",
|
|
"@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
|
|
"@php artisan key:generate",
|
|
"@php artisan migrate --force",
|
|
"npm install",
|
|
"npm run build"
|
|
],
|
|
"dev": [
|
|
"Composer\\Config::disableProcessTimeout",
|
|
"npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan octane:frankenphp --host=127.0.0.1 --port=8000 --watch\" \"php artisan queue:listen --tries=1 --timeout=0\" \"php artisan pail --timeout=0\" \"npm run dev\" --names=server,queue,logs,vite --kill-others"
|
|
],
|
|
"lint": [
|
|
"pint --parallel"
|
|
],
|
|
"test:lint": [
|
|
"pint --parallel --test"
|
|
],
|
|
"test": [
|
|
"@php artisan config:clear --ansi",
|
|
"@test:lint",
|
|
"@php artisan test"
|
|
],
|
|
"post-autoload-dump": [
|
|
"Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
|
|
"@php artisan package:discover --ansi"
|
|
],
|
|
"post-update-cmd": [
|
|
"@php artisan vendor:publish --tag=laravel-assets --ansi --force",
|
|
"@php artisan boost:update --ansi"
|
|
],
|
|
"post-root-package-install": [
|
|
"@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
|
|
],
|
|
"post-create-project-cmd": [
|
|
"@php artisan key:generate --ansi",
|
|
"@php -r \"file_exists('database/database.sqlite') || touch('database/database.sqlite');\"",
|
|
"@php artisan migrate --graceful --ansi"
|
|
],
|
|
"pre-package-uninstall": [
|
|
"Illuminate\\Foundation\\ComposerScripts::prePackageUninstall"
|
|
],
|
|
"screenshots": [
|
|
"Composer\\Config::disableProcessTimeout",
|
|
"npm run build",
|
|
"@php vendor/bin/pest tests/Screenshots"
|
|
]
|
|
},
|
|
"extra": {
|
|
"laravel": {
|
|
"dont-discover": []
|
|
}
|
|
},
|
|
"config": {
|
|
"optimize-autoloader": true,
|
|
"preferred-install": "dist",
|
|
"sort-packages": true,
|
|
"allow-plugins": {
|
|
"pestphp/pest-plugin": true,
|
|
"php-http/discovery": true
|
|
}
|
|
},
|
|
"minimum-stability": "stable",
|
|
"prefer-stable": true,
|
|
"repositories": {
|
|
"livewire-material": {
|
|
"type": "vcs",
|
|
"url": "https://gitea.nonameweb.ch/noNameWEB/livewire-material.git"
|
|
}
|
|
}
|
|
}
|