Add check for max file size in all scenarios

Author: RadoRado

config/settings/files_and_storages.py

@@ -14,6 +14,8 @@
     env("FILE_UPLOAD_STORAGE", default="local")
 )
 
+FILE_MAX_SIZE = env.int("FILE_MAX_SIZE", default=10485760)  # 10 MiB
+
 if FILE_UPLOAD_STORAGE == FileUploadStorage.LOCAL:
     MEDIA_ROOT_NAME = "media"
     MEDIA_ROOT = os.path.join(BASE_DIR, MEDIA_ROOT_NAME)

styleguide_example/files/apis.py

@@ -43,10 +43,10 @@ class FileDirectUploadLocalApi(ApiAuthMixin, APIView):
     def post(self, request, file_id):
         file = get_object_or_404(File, id=file_id)
 
-        file_object = request.FILES["file"]
+        file_obj = request.FILES["file"]
 
         service = FileDirectUploadService(request.user)
-        file = service.upload_local(file=file, file_object=file_object)
+        file = service.upload_local(file=file, file_obj=file_obj)
 
         return Response({"id": file.id})
 

styleguide_example/files/services.py

@@ -5,12 +5,14 @@
 from django.conf import settings
 from django.db import transaction
 from django.utils import timezone
+from django.core.exceptions import ValidationError
 
 from styleguide_example.files.models import File
 from styleguide_example.files.utils import (
     file_generate_upload_path,
     file_generate_local_upload_url,
-    file_generate_name
+    file_generate_name,
+    bytes_to_mib
 )
 from styleguide_example.files.enums import FileUploadStorage
 
@@ -19,6 +21,13 @@
 from styleguide_example.users.models import BaseUser
 
 
+def _validate_file_size(file_obj):
+    max_size = settings.FILE_MAX_SIZE
+
+    if file_obj.size > max_size:
+        raise ValidationError(f"File is too large. It should not exceed {bytes_to_mib(max_size)} MiB")
+
+
 class FileStandardUploadService:
     """
     This also serves as an example of a service class,
@@ -49,6 +58,8 @@ def _infer_file_name_and_type(self, file_name: str = "", file_type: str = "") ->
 
     @transaction.atomic
     def create(self, file_name: str = "", file_type: str = "") -> File:
+        _validate_file_size(self.file_obj)
+
         file_name, file_type = self._infer_file_name_and_type(file_name, file_type)
 
         obj = File(
@@ -67,6 +78,8 @@ def create(self, file_name: str = "", file_type: str = "") -> File:
 
     @transaction.atomic
     def update(self, file: File, file_name: str = "", file_type: str = "") -> File:
+        _validate_file_size(self.file_obj)
+
         file_name, file_type = self._infer_file_name_and_type(file_name, file_type)
 
         file.file = self.file_obj
@@ -138,9 +151,11 @@ def finish(self, *, file: File) -> File:
         return file
 
     @transaction.atomic
-    def upload_local(self, *, file: File, file_object) -> File:
+    def upload_local(self, *, file: File, file_obj) -> File:
+        _validate_file_size(file_obj)
+
         # Potentially, check against user
-        file.file = file_object
+        file.file = file_obj
         file.full_clean()
         file.save()
 

styleguide_example/files/utils.py

@@ -23,3 +23,8 @@ def file_generate_local_upload_url(*, file_id: str):
     )
 
     return f"{settings.APP_DOMAIN}{url}"
+
+
+def bytes_to_mib(value: int) -> float:
+    # 1 bytes = 9.5367431640625E-7 mebibytes
+    return value * 9.5367431640625E-7

styleguide_example/integrations/aws/client.py

@@ -17,6 +17,7 @@ class S3Credentials:
     bucket_name: str
     default_acl: str
     presigned_expiry: int
+    max_size: int
 
 
 @lru_cache
@@ -28,7 +29,8 @@ def s3_get_credentials() -> S3Credentials:
             "AWS_S3_REGION_NAME",
             "AWS_STORAGE_BUCKET_NAME",
             "AWS_DEFAULT_ACL",
-            "AWS_PRESIGNED_EXPIRY"
+            "AWS_PRESIGNED_EXPIRY",
+            "FILE_MAX_SIZE"
         ],
         "S3 credentials not found."
     )
@@ -39,7 +41,8 @@ def s3_get_credentials() -> S3Credentials:
         region_name=required_config["AWS_S3_REGION_NAME"],
         bucket_name=required_config["AWS_STORAGE_BUCKET_NAME"],
         default_acl=required_config["AWS_DEFAULT_ACL"],
-        presigned_expiry=required_config["AWS_PRESIGNED_EXPIRY"]
+        presigned_expiry=required_config["AWS_PRESIGNED_EXPIRY"],
+        max_size=required_config["FILE_MAX_SIZE"]
     )
 
 
@@ -92,7 +95,7 @@ def s3_generate_presigned_post(*, file_path: str, file_type: str) -> Dict[str, A
             # As an example, allow file size up to 10 MiB
             # More on conditions, here:
             # https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-HTTPPOSTConstructPolicy.html
-            ["content-length-range", 1, 10485760]
+            ["content-length-range", 1, credentials.max_size]
         ],
         ExpiresIn=expires_in,
     )