Daniel bf4f895f2c fix: article uploads are 10 MB, type-checked both ways, and sniffed ... The ceiling was 100 MB per file with ten files allowed at once, and every file is held whole in memory to be parsed — so the old limit let a single request ask for a gigabyte of heap. A source article that size is not a thing anyone uploads here. Now 10 MB, defined once and used by both the multer limit and the post-upload check. The filter accepted `allowed mime OR allowed extension`, so naming a file .pdf was enough on its own, whatever it declared — and the extension is chosen by whoever uploads. Both are required now. Neither of those sees any bytes: multer filters on the headers, before the file has arrived. verifySources() runs once the buffer exists and refuses a file whose contents are not what its type claims, using the same helper as documents, S3 uploads and assistant attachments. It runs before extraction, because an extractor handed a malformed file is where the damage would happen. The CMS screen said 100 MB and listed four of the ten accepted formats; it now says what the server actually does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU		2026-09-12 19:25:41 +02:00
..
account-boundary.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
admin-clinical-assistant-wiring.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
admin-docs-toc.test.js	test docs toc links	2026-05-09 01:33:06 +02:00
assistant-attachment-roundtrip.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-autosave.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-citation-modal.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-citations.test.js	feat: citation quality tracking, and the SSO settings fit a phone	2026-09-10 23:44:43 +02:00
assistant-component-css.test.js	refactor: drop the "Saved Chats" header and collapse arrow from the rail	2026-09-10 13:27:29 +02:00
assistant-enter-to-send.test.js	feat: Enter sends in the assistant, and the person chooses	2026-09-12 18:05:36 +02:00
assistant-export-owner.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-image-attachments.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-image-done.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-image-intent.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-math-mhchem.test.js	fix: reviewer findings — mhchem macro wrapping, regenerate history dedupe, strict safe image allowlist, stale docs	2026-09-08 19:25:31 +02:00
assistant-message-actions.test.js	fix: send button morphs into a clickable STOP icon while working (no more disabled spinner); grouped bottom-left tools; silent-recording message; completed images auto-join the library; transient image-status retries	2026-09-09 04:12:30 +02:00
assistant-mobile.test.js	fix: recordings that produced nothing, and the boxes that zoomed on iOS	2026-09-11 00:16:19 +02:00
assistant-saved-tables.test.js	feat: saved chats grouped by recency, a visible sidebar toggle, and acknowledgements answered cheaply	2026-09-09 18:59:45 +02:00
assistant-sharing-boundary.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-sources-cleaning.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
assistant-translate.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-user-markdown.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-voice-mode.test.js	fix: voice mode reads the answer that just arrived, and reads what the page shows	2026-09-11 21:10:50 +02:00
assistant-voice.test.js	fix: OWUI-style polish — fullscreen workspace replaces main menu, row-click saved chats (delete stays as hover), markdown-rendered patient handout, admin-only raw transcript, /api TTS URL, scrollable unclipped tables, action buttons hidden in exports, autosave-only copy	2026-09-08 22:41:08 +02:00
assistant-workspace-layout.test.js	revert: remove the signed-out assistant preview	2026-09-11 05:09:02 +02:00
attachment-magic-bytes.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
backend-hardening.test.js	fix: expired invitations can be cleared too, revoked ones still cannot	2026-09-11 20:41:18 +02:00
bedside-respiratory-ventilation.test.js	allow bedside respiratory without weight	2026-05-08 09:10:33 +02:00
build-id.test.js	feat: a deploy you can repeat, and prove afterwards	2026-09-11 00:41:11 +02:00
calc-math.test.js	feat: B — extract drug data to public/data/drugs.json (schema v1.0)	2026-04-20 04:23:24 +02:00
calculators-data.test.js	consolidate calculator growth helpers	2026-05-08 04:36:39 +02:00
clinical-assistant-prompt-pool.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-conversation.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
clinical-generation-options.test.js	Send reasoning options only to supported model	2026-08-27 21:25:38 +02:00
clinical-mcp-session-lifecycle.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-notes-entrypoints.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-release-integration.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
clinical-retrieval-title.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-table-preservation.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
deck-review.test.js	feat: modifying a deck can see it	2026-09-12 06:55:16 +02:00
doc-spec.test.js	feat: Word is built by python-docx from the same typed source as the deck	2026-09-11 21:58:53 +02:00
e2e-harness.test.js	test(e2e): repair the harness, taking the browser suite from 96 failures to 11	2026-09-11 18:54:03 +02:00
embeddings-provider.test.js	fix litellm metadata model discovery	2026-05-09 04:46:06 +02:00
empty-answer.test.js	fix: an empty answer from the model was the one failure never caught	2026-09-12 07:41:04 +02:00
extension-transfer.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
frontend-prompt-env.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
frontend-rendering-safety.test.js	feat: the announcement banner renders Markdown, safely	2026-09-10 19:08:12 +02:00
generated-image-cache.test.js	feat: an image library — every picture this account has made	2026-09-12 14:36:30 +02:00
generated-image-storage.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
generated-image-tools.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
generated-images-ui.test.js	fix: correct a false Settings claim; make every test child's stdout pure TAP	2026-09-10 15:41:44 +02:00
generated-images.integration.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
image-fallback-chain.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
image-key-collision.test.js	fix: a second deck reused the first deck's pictures	2026-09-12 08:26:09 +02:00
image-library.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
learning-hub-ai-category.test.js	extract learning hub cms controller	2026-05-08 16:23:01 +02:00
learning-hub-ai-panel-controller.test.js	extract learning hub ai panel controller	2026-05-08 16:54:48 +02:00
learning-hub-editor.test.js	extract learning hub ai panel controller	2026-05-08 16:54:48 +02:00
learning-hub-manual-category.test.js	fix: make manual CMS category creation visible and keyboard-accessible	2026-09-07 01:16:40 +02:00
learning-hub-quiz-controller.test.js	extract learning hub quiz controller	2026-05-08 16:38:51 +02:00
learning-hub-webdav-controller.test.js	extract learning hub webdav controller	2026-05-08 16:44:02 +02:00
learning-retrieval.test.js	feat: the Learning screen can ask for grounding, and says what it got	2026-09-11 14:39:49 +02:00
learning-upload-limits.test.js	fix: article uploads are 10 MB, type-checked both ways, and sniffed	2026-09-12 19:25:41 +02:00
login-codes.test.js	feat: sign in with a code emailed to you, offered beside the password	2026-09-11 20:12:03 +02:00
mcp-shutdown.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
metrics.test.js	fix metrics route normalization	2026-05-08 20:22:14 +02:00
model-defaults.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
models-changed-propagation.test.js	fix: a newly added model reaches every picker, including the user-facing ones	2026-09-12 17:46:18 +02:00
module-entrypoints.test.js	convert learning hub to module	2026-05-08 09:01:34 +02:00
my-resources-refine.test.js	feat: modifying a deck can see it	2026-09-12 06:55:16 +02:00
my-resources-stale-results.test.js	fix: the last run's illustration no longer sits under an empty form	2026-09-12 17:43:19 +02:00
my-resources.test.js	fix: a second deck reused the first deck's pictures	2026-09-12 08:26:09 +02:00
notes-sanitize.test.js	fix diagram delete confirmation	2026-05-08 06:28:12 +02:00
patient-takehome.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
pe-guide-data.test.js	move pe guide data to json	2026-05-08 08:56:21 +02:00
policy-flows.test.js	chore: Kitten and Supertonic retired; Kokoro is the local voice	2026-09-12 16:45:05 +02:00
policy-ui.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
prompt-administration.test.js	fix: mobile layout regression, workspace menu in the assistant rail, prompt as principles	2026-09-09 22:24:10 +02:00
release.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
review-model-vision-guard.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
session-quiz-ed-regressions.test.js	fix: correct a false Settings claim; make every test child's stdout pure TAP	2026-09-10 15:41:44 +02:00
slide-shapes.test.js	feat: record what a deck wanted and could not have	2026-09-11 22:51:15 +02:00
slide-spec.test.js	fix: a deck the model fumbles once is asked for again, not abandoned	2026-09-12 05:34:14 +02:00
stt-provider.test.js	simplify speech and embeddings through litellm	2026-05-09 05:09:02 +02:00
transcription-memory-policy.test.js	feat: a retried transcript goes back to the tab the audio came from	2026-09-11 12:39:50 +02:00
tts-provider.test.js	chore: Kitten and Supertonic retired; Kokoro is the local voice	2026-09-12 16:45:05 +02:00
vision-tool.test.js	fix: the active library view is unmistakable, and a leading question cannot mislead the vision model	2026-09-12 16:27:21 +02:00
web-search.test.js	feat: My Resources says what it is, offers its sources in one place, and Modify gets them too	2026-09-11 18:54:17 +02:00
well-visit-data.test.js	remove legacy well visit schedule data	2026-05-08 08:59:23 +02:00