massive update to deprecate site_file/upload in favor of api/upload, improve dashboard. todo: webdav switchover, dashboard error/result messages

app/api.rb

@@ -42,23 +42,57 @@ get '/api/list' do
 end
 
 def extract_files(params, files = [])
-  params.each do |key, value|
-    # If the value is a Hash and contains a :tempfile key, it's considered an uploaded file.
-    if value.is_a?(Hash) && value.has_key?(:tempfile) && !value[:tempfile].nil?
-      files << {filename: value[:name], tempfile: value[:tempfile]}
-    elsif value.is_a?(Hash) || value.is_a?(Array)
-      # If the value is a Hash or Array, recursively search for more files.
-      extract_files(value, files)
+  # Check if the entire input is directly an array of files
+  if params.is_a?(Array)
+    params.each do |item|
+      # Call extract_files on each item if it's an Array or Hash to handle nested structures
+      if item.is_a?(Array) || item.is_a?(Hash)
+        extract_files(item, files)
+      end
+    end
+  elsif params.is_a?(Hash)
+    params.each do |key, value|
+      # If the value is a Hash and contains a :tempfile key, it's considered an uploaded file.
+      if value.is_a?(Hash) && value.has_key?(:tempfile) && !value[:tempfile].nil?
+        files << {filename: value[:name], tempfile: value[:tempfile]}
+      elsif value.is_a?(Array)
+        value.each do |val|
+          if val.is_a?(Hash) && val.has_key?(:tempfile) && !val[:tempfile].nil?
+            # Directly add the file info if it's an uploaded file within an array
+            files << {filename: val[:name], tempfile: val[:tempfile]}
+          elsif val.is_a?(Hash) || val.is_a?(Array)
+            # Recursively search for more files if the element is a Hash or Array
+            extract_files(val, files)
+          end
+        end
+      elsif value.is_a?(Hash)
+        # Recursively search for more files if the value is a Hash
+        extract_files(value, files)
+      end
     end
   end
   files
 end
 
+
 post '/api/upload' do
   require_api_credentials
-
   files = extract_files params
 
+  if !params[:username].blank?
+    site = Site[username: params[:username]]
+
+    if site.nil? || site.is_deleted
+      api_error 400, 'site_not_found', "could not find site"
+    end
+
+    if site.owned_by?(current_site)
+      @_site = site
+    else
+      api_error 400, 'site_not_allowed', "not allowed to change this site with your current logged in site"
+    end
+  end
+
   api_error 400, 'missing_files', 'you must provide files to upload' if files.empty?
 
   uploaded_size = files.collect {|f| f[:tempfile].size}.inject{|sum,x| sum + x }
@@ -73,11 +107,23 @@ post '/api/upload' do
 
   files.each do |file|
     if !current_site.okay_to_upload?(file)
-      api_error 400, 'invalid_file_type', "#{file[:filename]} is not a valid file type (or contains not allowed content) for this site, files have not been uploaded"
+      api_error 400, 'invalid_file_type', "#{file[:filename]} is not a valid file type (or contains not allowed content) for this site, please upgrade to a supporter account to upload this file type"
     end
 
     if File.directory? file[:filename]
-      api_error 400, 'directory_exists', 'this name is being used by a directory, cannot continue'
+      api_error 400, 'directory_exists', "#{file[:filename]} being used by a directory"
+    end
+
+    if current_site.file_size_too_large? file[:tempfile].size
+      api_error 400, 'file_too_large' "#{file[:filename]} is too large"
+    end
+
+    if SiteFile.path_too_long? file[:filename]
+      api_error 400, 'file_path_too_long', "#{file[:filename]} path is too long"
+    end
+
+    if SiteFile.name_too_long? file[:filename]
+      api_error 400, 'file_name_too_long', "#{file[:filename]} filename is too long"
     end
   end
 
@@ -191,7 +237,7 @@ post '/api/:name' do
 end
 
 def require_api_credentials
-  return true if current_site
+  return true if current_site && csrf_safe?
 
   if !request.env['HTTP_AUTHORIZATION'].nil?
     init_api_credentials