[daum110715]

What

Enable cloud file storage on R2 for registered users (replaces 410 GONE stubs).

Worker

• /files/upload|list|quota|get|rename|delete backed by SCP_FILES (R2)
• /api/sync/data GET/PUT + /api/sync/quota for full JSON sync blob
• requiredRegisteredUser() — guests get 403; banned registered get 403
• 512MB quota per user prefix users/{userId}/…
• wrangler: SCP_FILES R2 binding (prod + dev)

App

• File manager dual-write: local VFS always, R2 when authStore.canUseCloudSync
• Sync from Cloud toolbar action (download R2 → local VFS)
• useCloudQuota composable (quota API helper)
• i18n: fm.syncCloud

Depends on

#15 (email auth / guest vs registered / JWT accountType).
This branch is stacked on #15 so CI stays green; after #15 merges, rebase to shrink the diff to storage-only.

Ops

1. Create R2 buckets (e.g. scp-os-files, scp-os-files-dev)
2. Ensure wrangler SCP_FILES bindings point at them
3. Registered users only (email login from feat(auth): guest login, email registration/login, verification codes #15)

Out of scope

• Settings UI for quota display wiring
• Admin panel changes
• Notification auto-create side effects

Verification

• pnpm typecheck ✅
• worker tests 145 ✅
• app tests 1161 ✅

[LemonStudio-hub]

🔍 Code Review — Request Changes

Summary

Replaces 410 GONE stubs with full R2-backed cloud file storage for registered users, adds JSON sync blob endpoint, and email/password auth. Large diff (~173KB) because stacked on PR #15.

Critical Issues

1. cloudUsage() capped at 1000 objects — quota silently wrong for >1000 files

• bucket.list({ prefix, limit: 1000 }) without pagination
• Users can massively exceed 512MB limit
• Fix: Paginate (loop while truncated is true) or maintain D1 counter

2. PUT /files/:key rename does not check quota

• Re-uploads object body without quota validation
• No check if destination key already exists — silent data loss
• Fix: Validate quota before rename; check for existing destination

3. No tests for /files/* or /api/sync/* routes

• Zero test files for file upload, list, download, rename, delete, quota enforcement, sync
• Fix: Add tests for all endpoints, especially security-sensitive operations

Warning Issues

4. Manual Access-Control-Allow-Origin: * in sync.ts — conflicts with CORS middleware; remove it
5. Upload path strips only one leading / — //etc/passwd passes through; use path.replace(/^\/+/, '')
6. syncFromCloud relies on Content-Type for text/binary sniffing — R2 metadata may be inaccurate
7. PUT /files/:key reads entire body into memory — use streaming for large files
8. Race condition on quota check — two concurrent uploads could both pass
9. cloudUsage called on every upload — O(n) list operation; use D1 counter instead
10. Duplicate CLOUD_QUOTA_BYTES and cloudUsage — extract to shared module

Recommendation: Request changes — fix quota pagination (exploit vector), add route tests, fix rename handler.

[daum110715]

Addressed review feedback

Critical

1. Quota pagination — listAllObjects / cloudUsage paginate while truncated (shared r2-usage.ts).
2. Rename handler — rejects existing destination with 409; quota checked before rename.
3. Route tests — __tests__/routes-files-sync.test.ts covers quota, list, rename (ok + conflict), delete, sync get/put, over-quota.

Warnings

4. Removed manual Access-Control-Allow-Origin: * from sync GET (global CORS middleware).
5. Path normalization already strips all leading / and .. segments.
6. Content update uses request stream when Content-Length is present.
7. Deduplicated CLOUD_QUOTA_BYTES + cloudUsage.

Residual

• True race-free quota still needs a D1 counter under concurrent uploads (修复了一些问题 #8/Codex rewrite worker hono #9) — follow-up.

Ready for re-review.

[daum110715]

Status

• CI: Lint / Test / Build all green on latest tip (Security Scan skip is expected).
• Review feedback addressed on this tip; ready for re-review / merge when convenient.

No further code changes planned on this PR unless requested.