Upload a file via multipart form.

Request

POST /api/upload

Parameters

• file (required): The file to upload (multipart/form-data)
• user_uuid (optional): Override user UUID (admin only)

Response

Success (200):

{
  "file_uuid": "uuidv7-string",
  "original_filename": "photo.jpg",
  "file_type": "image",
  "mime_type": "image/jpeg",
  "size": 1234567,
  "status": "processing",
  "message": "Upload successful, processing variants..."
}

Error (400):

{
  "error": "INVALID_FILE_TYPE",
  "message": "File type not allowed"
}

Error (413):

{
  "error": "FILE_TOO_LARGE",
  "message": "File size exceeds maximum allowed (100MB)"
}

@spec resolve_upload_user(term(), map()) :: {:ok, binary()} | {:error, :no_user}

Resolves the account an upload is attributed to, failing closed.

Requires an authenticated user (the first argument is conn.assigns[:phoenix_kit_current_user]). The user_uuid request parameter — attributing the upload to a different account — is honored ONLY when the authenticated user holds the Owner or Admin system role; for everyone else (including a user who merely holds some module permission) it is ignored and the upload is attributed to the uploader.

An unauthenticated request is refused with {:error, :no_user}. The previous behavior took the owner straight from params["user_uuid"] with the check never written, so an anonymous client could attribute a 100 MB upload — and the variant-processing job it enqueues — to any account (the #687 class, but a write).