From 732e93f1bcefdf72efb8466dedbf4c8ccc41f9b8 Mon Sep 17 00:00:00 2001
From: mohammad <mohammadbanilohi7@gmail.com>
Date: Thu, 13 Aug 2026 12:11:34 +0330
Subject: [PATCH] Raise upload limits for video files in API and nginx.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 api/src/index.js             | 30 +++++++++++++++++++++++++++++-
 deploy/nginx/studionoro.conf | 11 ++++++++---
 2 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/api/src/index.js b/api/src/index.js
index 61fddd7..9bdf381 100644
--- a/api/src/index.js
+++ b/api/src/index.js
@@ -22,7 +22,20 @@ const storage = multer.diskStorage({
     cb(null, `${randomUUID()}${ext}`)
   },
 })
-const upload = multer({ storage })
+const MAX_UPLOAD_BYTES = Number(process.env.MAX_UPLOAD_MB || 200) * 1024 * 1024
+const upload = multer({
+  storage,
+  limits: { fileSize: MAX_UPLOAD_BYTES },
+  fileFilter: (_req, file, cb) => {
+    const allowed =
+      file.mimetype.startsWith('image/') ||
+      file.mimetype.startsWith('video/') ||
+      file.mimetype === 'application/pdf' ||
+      file.mimetype === 'image/svg+xml'
+    if (allowed) return cb(null, true)
+    cb(new Error('فقط تصویر، ویدیو یا PDF مجاز است'))
+  },
+})
 
 const app = express()
 const corsOrigin = process.env.CORS_ORIGIN?.split(',').map((o) => o.trim()) || [
@@ -327,6 +340,21 @@ app.delete('/api/media/:id', authMiddleware, (req, res) => {
   res.status(204).end()
 })
 
+app.use((err, _req, res, next) => {
+  if (err instanceof multer.MulterError) {
+    if (err.code === 'LIMIT_FILE_SIZE') {
+      return res.status(400).json({
+        error: `حجم فایل بیش از حد مجاز است (حداکثر ${Number(process.env.MAX_UPLOAD_MB || 200)} مگابایت)`,
+      })
+    }
+    return res.status(400).json({ error: err.message })
+  }
+  if (err) {
+    return res.status(400).json({ error: err.message || 'خطای آپلود' })
+  }
+  next()
+})
+
 app.listen(PORT, '127.0.0.1', () => {
   console.log(`Studio Noro API running at http://127.0.0.1:${PORT}`)
 })
diff --git a/deploy/nginx/studionoro.conf b/deploy/nginx/studionoro.conf
index e6481d6..00aa636 100644
--- a/deploy/nginx/studionoro.conf
+++ b/deploy/nginx/studionoro.conf
@@ -18,7 +18,7 @@ server {
     listen [::]:80;
     server_name studionoro.ir www.studionoro.ir;
 
-    client_max_body_size 20M;
+    client_max_body_size 200M;
 
     location / {
         proxy_pass http://studionoro_web;
@@ -41,7 +41,7 @@ server {
 
     root /var/www/studionoro/admin/dist;
     index index.html;
-    client_max_body_size 20M;
+    client_max_body_size 200M;
 
     location /api/ {
         proxy_pass http://studionoro_api;
@@ -50,6 +50,9 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+        client_max_body_size 200M;
     }
 
     location /uploads/ {
@@ -71,7 +74,7 @@ server {
     listen [::]:80;
     server_name api.studionoro.ir;
 
-    client_max_body_size 20M;
+    client_max_body_size 200M;
 
     location / {
         proxy_pass http://studionoro_api;
@@ -80,5 +83,7 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
     }
 }