fix: chunked upload session collision + workspace name i18n (#263)

* fix: give each chunked upload attempt a unique server-side identifier

The upload session identifier was derived only from user+filename+size
(ChunkedAssetReceiver::receive), with no per-attempt nonce. Two genuinely
concurrent attempts of the same file (e.g. closing and reopening the media
picker mid-upload, then re-uploading the same file) collided on the same
Redis cache key / temp file, producing RuntimeException("Chunked cloud
upload session expired or missing.") on the multipart/cloud path and
silent byte corruption on the local-assemble path.

The frontend now mints a UUID per upload attempt (X-Upload-Id header) that
gets folded into the identifier. Falls back to the old formula when the
header is absent, so any already-loaded frontend bundle keeps working.

Also guards the media picker's dropzone against re-triggering an upload
while one is in flight, and aborts the in-flight fetch when the dialog
unmounts mid-upload.

Fixes Nightwatch issue #23.

* fix: explicitly type upload_id when passing to receive()

Matches the existing explicit (int) casts on the sibling validated()
calls in the same method — validated() returns mixed, so this keeps
the nullable-string contract explicit instead of relying on an
implicit runtime type.

* style: inline the upload_id null-safe cast

Drop the intermediate variable so all receive() arguments read as a
single expression each, matching the sibling validated() casts.

* fix: require X-Upload-Id instead of falling back to the legacy identifier

Nullable upload_id only preserved the old (collision-prone) formula for
clients that omit the header — it didn't actually protect them. Making it
required closes that gap outright: a request without the header now fails
loud (422) instead of silently falling back to the vulnerable identifier.

ChunkedAssetReceiver::receive() now takes a required $attemptId. Updated
every existing test hitting app.assets.store-chunked (ChunkedCloudUploadTest,
ChunkedAssetReceiverTest, ChunkedUploadFilenameEncodingTest, AssetControllerTest)
to send a real upload id, and added a regression test asserting the endpoint
rejects a request with no X-Upload-Id header.

* fix: localize hardcoded workspace name validation messages

StoreWorkspaceRequest had its custom messages() hardcoded in pt-BR
regardless of the user's locale; UpdateWorkspaceRequest had the same
bug hardcoded in English. Both now go through __('validation.required'
/ 'validation.max.string') with the already-localized
workspaces.create.name attribute label (present in all 16 lang/
directories), matching the pattern already used by
StoreWorkspaceInviteRequest.

Unrelated to the chunked upload fix, but caught while reviewing this
file's messages() convention.

* simplify: drop messages() override on workspace name validation

Laravel already localizes the generic required/max messages from
lang/{locale}/validation.php automatically — no need to hand-roll
messages() for standard rules with no custom copy.

* fix: localize StoreChunkedAssetRequest validation messages

Drop the hardcoded English messages for required/ends_with rules —
Laravel's own localized validation.php messages already cover them
adequately (ends_with's generic message is actually more useful, since
it lists the accepted extensions). total_size.max still needs a custom
message (the rule is in raw bytes, unreadable without MB conversion),
so it now goes through __('assets.upload.file_too_large') with the key
added to all 16 lang/ locales.

Also fixed test flakiness discovered while touching this file:
ChunkedCloudUploadTest used random_bytes() for the first mp4 chunk,
which occasionally collides with an unrelated magic number (MZ/PE,
SIMH tape, ...) and makes finfo misdetect the mime type. Replaced with
real mp4 header bytes padded with nulls, so detection is deterministic.

* fix: address final code review findings

- ChunkedAssetReceiver: use double-quoted interpolation instead of
  concatenation for the identifier hash, per project convention.
- AssetControllerTest: two chunked-upload rejection tests didn't send
  X-Upload-Id, so their 422 assertions could pass for the wrong reason
  (upload_id.required) instead of the field they claim to cover. Added
  the header and asserted the specific validation error field.
- GalleryBrowser: centralize the upload-in-progress guard as a single
  check at the top of uploadFiles() instead of three separate checks
  at each entry point (click/select/drop) — matches the single-source-
  of-truth pattern already used in PhotoUpload.vue.
- GalleryBrowser: show a toast when an in-flight upload is aborted
  (dialog closed mid-upload) instead of silently discarding it with no
  feedback. New assets.upload.cancelled key added to all 16 lang/
  locales.

Author: paulocastellano

app/Http/Controllers/App/AssetController.php

@@ -83,6 +83,7 @@ public function storeChunked(StoreChunkedAssetRequest $request, ChunkedAssetRece
             (int) $request->validated('range_start'),
             (int) $request->validated('range_end'),
             (int) $request->validated('total_size'),
+            (string) $request->validated('upload_id'),
         )->toResponse();
     }
 

app/Http/Requests/App/Asset/StoreChunkedAssetRequest.php

@@ -29,6 +29,7 @@ protected function prepareForValidation(): void
             'range_end' => $parsed[1] ?? null,
             'total_size' => $parsed[2] ?? null,
             'file_name' => strtolower(rawurldecode((string) $this->header('X-File-Name', 'upload'))),
+            'upload_id' => $this->header('X-Upload-Id'),
         ]);
     }
 
@@ -47,6 +48,7 @@ public function rules(): array
             'range_end' => ['required', 'integer', 'gte:range_start'],
             'total_size' => ['required', 'integer', 'min:1', 'max:'.MediaType::Video->maxSizeInBytes()],
             'file_name' => ['required', 'string', 'ends_with:'.implode(',', $allowedSuffixes)],
+            'upload_id' => ['required', 'string', 'uuid'],
         ];
     }
 
@@ -56,11 +58,7 @@ public function rules(): array
     public function messages(): array
     {
         return [
-            'range_start.required' => 'Invalid Content-Range header',
-            'range_end.required' => 'Invalid Content-Range header',
-            'total_size.required' => 'Invalid Content-Range header',
-            'total_size.max' => 'File size exceeds the maximum allowed ('.MediaType::Video->maxSizeInMb().' MB).',
-            'file_name.ends_with' => 'File type not supported.',
+            'total_size.max' => __('assets.upload.file_too_large', ['max' => MediaType::Video->maxSizeInMb()]),
         ];
     }
 }

app/Http/Requests/App/Workspace/StoreWorkspaceRequest.php

@@ -38,12 +38,4 @@ public function rules(): array
             'logo_url' => ['nullable', 'url', 'max:1024'],
         ];
     }
-
-    public function messages(): array
-    {
-        return [
-            'name.required' => 'O nome do workspace é obrigatório.',
-            'name.max' => 'O nome do workspace deve ter no máximo 255 caracteres.',
-        ];
-    }
 }

app/Http/Requests/App/Workspace/UpdateWorkspaceRequest.php

@@ -37,12 +37,4 @@ public function rules(): array
             'logo_url' => ['nullable', 'url', 'max:1024'],
         ];
     }
-
-    public function messages(): array
-    {
-        return [
-            'name.required' => 'The workspace name is required.',
-            'name.max' => 'The workspace name must be at most 255 characters.',
-        ];
-    }
 }

app/Services/Media/ChunkedAssetReceiver.php

@@ -21,8 +21,9 @@ public function receive(
         int $rangeStart,
         int $rangeEnd,
         int $totalSize,
+        string $attemptId,
     ): ChunkReceipt {
-        $identifier = md5($user->id.$fileName.$totalSize);
+        $identifier = md5("{$user->id}{$fileName}{$totalSize}{$attemptId}");
 
         return $this->cloud->shouldUseMultipart($fileName)
             ? $this->receiveViaMultipart($workspace, $identifier, $fileName, $chunk, $rangeStart, $rangeEnd, $totalSize)

lang/ar/assets.php

@@ -14,6 +14,8 @@
         'formats' => 'JPEG، PNG، GIF، WebP، MP4، PDF',
         'uploading' => 'جارٍ الرفع...',
         'failed' => 'تعذر رفع :file. يرجى المحاولة مرة أخرى.',
+        'file_too_large' => 'حجم الملف يتجاوز الحد الأقصى المسموح به (:max ميجابايت).',
+        'cancelled' => 'تم إلغاء الرفع.',
     ],
 
     'empty' => [

lang/de/assets.php

@@ -16,6 +16,8 @@
         'formats' => 'JPEG, PNG, GIF, WebP, MP4, PDF',
         'uploading' => 'Wird hochgeladen...',
         'failed' => ':file konnte nicht hochgeladen werden. Bitte versuche es erneut.',
+        'file_too_large' => 'Die Dateigröße überschreitet das zulässige Maximum (:max MB).',
+        'cancelled' => 'Upload abgebrochen.',
     ],
 
     'empty' => [

lang/el/assets.php

@@ -14,6 +14,8 @@
         'formats' => 'JPEG, PNG, GIF, WebP, MP4, PDF',
         'uploading' => 'Μεταφόρτωση...',
         'failed' => 'Δεν ήταν δυνατή η μεταφόρτωση του :file. Παρακαλούμε δοκιμάστε ξανά.',
+        'file_too_large' => 'Το μέγεθος του αρχείου υπερβαίνει το μέγιστο επιτρεπόμενο (:max MB).',
+        'cancelled' => 'Η μεταφόρτωση ακυρώθηκε.',
     ],
 
     'empty' => [

lang/en/assets.php

@@ -14,6 +14,8 @@
         'formats' => 'JPEG, PNG, GIF, WebP, MP4, PDF',
         'uploading' => 'Uploading...',
         'failed' => 'Could not upload :file. Please try again.',
+        'file_too_large' => 'File size exceeds the maximum allowed (:max MB).',
+        'cancelled' => 'Upload cancelled.',
     ],
 
     'empty' => [

lang/es/assets.php

@@ -16,6 +16,8 @@
         'formats' => 'JPEG, PNG, GIF, WebP, MP4, PDF',
         'uploading' => 'Subiendo...',
         'failed' => 'No se pudo subir :file. Inténtalo de nuevo.',
+        'file_too_large' => 'El tamaño del archivo supera el máximo permitido (:max MB).',
+        'cancelled' => 'Subida cancelada.',
     ],
 
     'empty' => [