Harden analysis uploads and add video previews

.env.example

@@ -10,5 +10,7 @@ SUPABASE_SERVICE_ROLE_KEY=your-service-role-or-secret-key
 CORE_REPO_ID=your-account/sporalize-core
 STORAGE_REPO_ID=your-account/sporalize-application-storage
 HF_TOKEN=
+# Per-video upload ceiling; raise only if the Space has enough disk and memory.
+MAX_VIDEO_SIZE_MB=2048
 # CORE_REVISION=optional-pinned-revision
 # Internal Node/AI URLs are set automatically by start.py.

app.py

@@ -20,6 +20,7 @@ from zipfile import ZipFile
 
 import httpx
 import numpy as np
+import cv2
 from dotenv import load_dotenv
 from fastapi import FastAPI, File, Form, HTTPException, Request, UploadFile
 from fastapi.responses import FileResponse, JSONResponse
@@ -38,6 +39,9 @@ YOLO_MODEL_REPO_ID = "Ultralytics/YOLO11"
 YOLO_MODEL_HUB_FILE = "yolo11x.pt"
 YOLO_MODEL_REPO_TYPE = "model"
 YOLO_IMGSZ = 896
+MAX_VIDEO_SIZE_BYTES = int(os.environ.get("MAX_VIDEO_SIZE_MB", "2048")) * 1024 * 1024
+MAX_ACTIONS_SIZE_BYTES = 32 * 1024 * 1024
+MAX_CALIBRATION_SIZE_BYTES = 256 * 1024 * 1024
 
 
 def hub():
@@ -176,12 +180,37 @@ async def download_drive_file(link, destination):
             with destination.open("wb") as output:
                 async for chunk in response.aiter_bytes(1024 * 1024):
                     total += len(chunk)
+                    if total > MAX_VIDEO_SIZE_BYTES:
+                        raise HTTPException(413, "Video exceeds the configured per-file size limit")
                     output.write(chunk)
     if total == 0:
         raise ValueError("Google Drive returned an empty file")
     return file_id, total
 
 
+def create_video_poster(source, destination):
+    capture = cv2.VideoCapture(str(source))
+    try:
+        capture.set(cv2.CAP_PROP_POS_MSEC, 500)
+        ok, frame = capture.read()
+        if not ok:
+            capture.set(cv2.CAP_PROP_POS_FRAMES, 0)
+            ok, frame = capture.read()
+        if not ok:
+            logger.warning("Could not decode preview frame from %s", source.name)
+            return False
+        height, width = frame.shape[:2]
+        if width > 640:
+            frame = cv2.resize(frame, (640, round(height * 640 / width)), interpolation=cv2.INTER_AREA)
+        ok, encoded = cv2.imencode(".webp", frame, [cv2.IMWRITE_WEBP_QUALITY, 76])
+        if not ok:
+            return False
+        destination.write_bytes(encoded.tobytes())
+        return True
+    finally:
+        capture.release()
+
+
 def run_job(client_id, work, cameras):
     job = jobs[client_id]
     session_id = job["sessionId"]
@@ -204,7 +233,7 @@ def run_job(client_id, work, cameras):
         job.update(progress=95, phase="Saving")
         hub().upload_folder(repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset",
             folder_path=str(work), path_in_repo=f"sessions/{session_id}",
-            allow_patterns=["results.json", "videos/*"])
+            allow_patterns=["results.json", "videos/*", "posters/*.webp"])
         saved = True
         completion = {"status": "completed", "path": f"sessions/{session_id}", "actions": [
             {"index": index, **{key: json_value(report[key]) for key in ("action", "start_frame", "end_frame", "fps", "error") if key in report}}
@@ -267,6 +296,21 @@ async def analyze(request: Request, playerId: str = Form(...), clientId: UUID =
     if videos and videoDriveLinks or len(videos or videoDriveLinks) < 2 or len(videos or videoDriveLinks) != len(videoOrders) or len(set(videoOrders)) != len(videoOrders):
         raise HTTPException(422, "Provide at least two videos with unique camera orders")
     client_id, user_id = str(clientId), request.state.user_id
+    if any(video.size is not None and video.size > MAX_VIDEO_SIZE_BYTES for video in videos):
+        raise HTTPException(413, f"Each video must be smaller than {MAX_VIDEO_SIZE_BYTES // (1024 * 1024)} MB")
+    if actionsJson.size is not None and actionsJson.size > MAX_ACTIONS_SIZE_BYTES:
+        raise HTTPException(413, "The actions file must be 32 MB or smaller")
+    if calibration.size is not None and calibration.size > MAX_CALIBRATION_SIZE_BYTES:
+        raise HTTPException(413, "The calibration file must be 256 MB or smaller")
+    active_jobs = [job for job in jobs.values() if job["status"] in {"uploading", "queued", "running"}]
+    if any(job["userId"] == user_id for job in active_jobs):
+        raise HTTPException(429, "Finish or cancel your active analysis before starting another")
+    if len(active_jobs) >= 3:
+        raise HTTPException(429, "The analysis queue is full. Try again shortly")
+    cutoff = int(time.time() * 1000) - 24 * 60 * 60 * 1000
+    for key, job in list(jobs.items()):
+        if job["status"] in {"completed", "failed", "cancelled", "sync_failed"} and job["updatedAt"] < cutoff:
+            jobs.pop(key, None)
     if client_id in jobs:
         raise HTTPException(409, "Analysis already exists")
     reference = playerId.strip()
@@ -281,7 +325,8 @@ async def analyze(request: Request, playerId: str = Form(...), clientId: UUID =
     try:
         (work / "videos").mkdir()
         cameras = {}
-        uploads = [(actionsJson, work / "actions.json"), (calibration, work / "calibration.npz")]
+        uploads = [(actionsJson, work / "actions.json", MAX_ACTIONS_SIZE_BYTES),
+                   (calibration, work / "calibration.npz", MAX_CALIBRATION_SIZE_BYTES)]
         video_names = []
         sources = list(zip(videoOrders, videos)) if videos else list(zip(videoOrders, videoDriveLinks))
         for order, source in sources:
@@ -297,13 +342,21 @@ async def analyze(request: Request, playerId: str = Form(...), clientId: UUID =
             video_names.append(target.name)
             cameras[order] = str(target)
             if video is not None:
-                uploads.append((video, target))
+                uploads.append((video, target, MAX_VIDEO_SIZE_BYTES))
             else:
                 await download_drive_file(source, target)
-        for upload, target in uploads:
+        for upload, target, size_limit in uploads:
             with target.open("wb") as output:
+                total = 0
                 while chunk := await upload.read(1024 * 1024):
+                    total += len(chunk)
+                    if total > size_limit:
+                        raise HTTPException(413, f"{target.name} exceeds the allowed size")
                     output.write(chunk)
+        poster_dir = work / "posters"
+        poster_dir.mkdir()
+        for order, source in cameras.items():
+            create_video_poster(source, poster_dir / f"camera_{order}.webp")
         jobs[client_id].update(status="queued", phase="Queued")
         jobs[client_id]["videoNames"] = video_names
         executor.submit(run_job, client_id, work, cameras)
@@ -367,8 +420,10 @@ def results(session_id: UUID, request: Request):
         filename=f'{row["path"]}/results.json', token=os.environ["HF_TOKEN"])
     reports = json.loads(Path(path).read_text(encoding="utf-8"))
     prefix = f'{row["path"]}/videos/camera_'
+    video_extensions = {".mp4", ".mov", ".avi", ".mkv", ".webm", ".m4v"}
     camera_files = sorted({name[len(prefix):] for name in hub().list_repo_files(
-        repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset") if name.startswith(prefix)})
+        repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset")
+        if name.startswith(prefix) and Path(name).suffix.lower() in video_extensions})
     fps_values = [float(report.get("fps") or 30) for report in reports if report.get("fps")]
     actions, failed = [], []
     for index, report in enumerate(reports):
@@ -381,7 +436,10 @@ def results(session_id: UUID, request: Request):
             continue
         analytics = report.get("analytics") or {}
         metrics = [{"name": key.replace("_", " ").title(), "value": value, "unit": ""} for key, value in analytics.items() if isinstance(value, (int, float, str, bool)) or value is None]
-        clips = [{"cameraId": int(name.split("_", 1)[1].split(".", 1)[0]), "url": f"/storage/{session_id}/videos/{name}"} for name in camera_files]
+        clips = [{"cameraId": int(name.split("_", 1)[1].split(".", 1)[0]),
+            "url": f"/storage/{session_id}/videos/{name}",
+            "poster": f"/storage/{session_id}/posters/camera_{int(name.split('_', 1)[1].split('.', 1)[0])}.webp"}
+            for name in camera_files]
         digest = hashlib.sha256(f"{session_id}:{index}".encode()).hexdigest()
         action_id = f"{digest[:8]}-{digest[8:12]}-5{digest[13:16]}-8{digest[17:20]}-{digest[20:32]}"
         actions.append({"id": action_id, "label": label,
@@ -411,3 +469,13 @@ def video(session_id: UUID, filename: str, request: Request):
     path = hf_hub_download(repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset",
         filename=f'{row["path"]}/videos/{filename}', token=os.environ["HF_TOKEN"])
     return FileResponse(path)
+
+
+@app.api_route("/storage/{session_id}/posters/{filename}", methods=["GET", "HEAD"])
+def video_poster(session_id: UUID, filename: str, request: Request):
+    row = session_row(session_id, request.state.user_id)
+    if Path(filename).name != filename or "\\" in filename or not filename.endswith(".webp"):
+        raise HTTPException(404, "Preview not found")
+    path = hf_hub_download(repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset",
+        filename=f'{row["path"]}/posters/{filename}', token=os.environ["HF_TOKEN"])
+    return FileResponse(path, media_type="image/webp", headers={"Cache-Control": "private, max-age=86400"})

src/server.ts

@@ -46,6 +46,8 @@ app.use((req, res, next) => {
 });
 
 const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 25, standardHeaders: "draft-8", legacyHeaders: false });
+const apiLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 3000, standardHeaders: "draft-8", legacyHeaders: false });
+const analysisUploadLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 4, standardHeaders: "draft-8", legacyHeaders: false });
 const signupSchema = z.object({ fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100), email: z.string().trim().toLowerCase().email().max(255), password: z.string().min(8).max(128), academy: z.string().trim().max(150).optional() });
 const loginSchema = z.object({ email: z.string().trim().toLowerCase().email(), password: z.string().min(1).max(128) });
 const profileRoles = ["football_player", "coach", "club_manager", "academy_manager", "scout", "performance_analyst", "sports_director", "other"] as const;
@@ -489,9 +491,10 @@ const analysisProxy = (req: Request, res: Response, next: NextFunction) => {
 // gate. Auth and subscription status endpoints remain available without a plan.
 app.use("/api", (req, res, next) => {
   if (req.originalUrl.startsWith("/api/auth/") || req.originalUrl === "/api/subscriptions" || req.originalUrl === "/api/subscription/access" || req.originalUrl === "/api/public-config") return next();
-  return analysisProxy(req, res, next);
+  const limiter = req.method === "POST" && req.path === "/analyze" ? analysisUploadLimiter : apiLimiter;
+  return limiter(req, res, (error?: unknown) => error ? next(error) : analysisProxy(req, res, next));
 });
-app.use("/storage", analysisProxy);
+app.use("/storage", apiLimiter, analysisProxy);
 
 app.use((_req, res) => res.status(404).json({ error: "Route not found." }));
 app.use((error: unknown, _req: Request, res: Response, _next: NextFunction) => {