Tiptapex.Upload.Controller (Tiptapex v0.1.2)

Copy Markdown View Source

Drop-in controller action for editor uploads.

defmodule MyAppWeb.EditorUploadController do
  use MyAppWeb, :controller

  use Tiptapex.Upload.Controller,
    handler: MyApp.EditorUploads,
    max_bytes: 25_000_000,
    allowed: ~w(image/png image/jpeg image/gif image/webp video/mp4 video/webm application/pdf),
    scope_param: "scope"
end

Then mount it inside an authenticated pipeline:

scope "/admin", MyAppWeb do
  pipe_through [:browser, :require_authenticated_user]
  post "/tiptapex/uploads", EditorUploadController, :create
end

The injected create/2:

  1. requires a "file" multipart part;
  2. validates it with Tiptapex.Upload.Validator (size + magic-byte content-type verification);
  3. builds the context via build_context/2 (overridable — default: %{scope: params[scope_param], params: params, conn_assigns: conn.assigns});
  4. calls handler.store/2 (your Tiptapex.Upload implementation);
  5. replies with the JSON contract the JS hook expects ({"url", "content_type", "filename"}) or a 422 with an error code.

CSRF: the JS hook sends the x-csrf-token header, which the standard :browser pipeline (protect_from_forgery) validates — no extra plumbing needed. Keep the route out of :api-style pipelines that skip CSRF unless you add your own protection.