* test(api): cover public table form access, uploads and submissions
Run the public form routes and the owner form settings routes on SQLite
with every migration and filesystem storage: unknown, closed and
deleted-note tokens, password unlock and its rate limit, the fields a
form publishes, stale pending upload cleanup, field validation, and
which uploads a submission may attach.
* fix(api): accept file uploads on public table forms
Public form routes run without a signed-in user, but storing an upload read
the workspace from the auth context, so every valid upload to
POST /api/public/forms/:token/resources failed with a TypeError (HTTP 500).
In the form page the visitor's row was then saved without its file.
- Resource creation accepts the note's workspace explicitly, and the form
upload passes the form's workspace.
- A form accepts uploads only when it publishes an attachment field, and
holds at most 50 uploads that were not submitted yet (stale ones are
still retired after an hour). The limit is checked again after storing,
so concurrent uploads cannot exceed it.
- A submission marks as used only the files its new row references; a file
sent in another cell stays pending and is retired like other stale
uploads instead of being kept forever.
Dariusz Koryto
fc98dd6720