API reference

All API routes under app/api/** use dynamic = "force-dynamic". Auth is enforced inside handlers.

Upload APIs

POST /api/upload

Auth: portal access (canAccessUploadPortal) — valid portal cookie with usable link, or valid admin cookie.

Body: multipart/form-data

• file — video file
• dateRecorded — YYYY-MM-DD

Use when file size ≤ maxSimpleFileSizeBytes (default 4 MB).

Success 200: { id, name, webUrl, size }

POST /api/upload/session

Auth: same portal access gate.

Body (JSON): { filename, fileSize, dateRecorded }

Creates a Graph upload session. Client then uploads chunks with PUT directly to Microsoft uploadUrl using Content-Range headers (default chunk 10 MB).

Use when file is larger than the simple-upload threshold (up to maxFileSizeBytes, default 4 GB).

POST /api/upload/complete

Auth: same portal access gate.

Body (JSON): { webUrl?, name? }

Server steps:

1. If portal token + webUrl present → send notification email
2. Consume link (usedAt)
3. Clear portal upload_access cookie

Email failures are logged and do not fail the response.

GET /api/upload/context

Returns { childName, edc, availableAt, expiresAt, fromLink } for the upload UI.

End-to-end client upload sequence

1. Parent selects video + date recorded
2. If size ≤ simple limit → POST /api/upload
   Else → POST /api/upload/session, then chunked PUTs to Microsoft
3. POST /api/upload/complete with { webUrl, name }
4. UI shows success; link is single-use thereafter

Mobile Safari notes: use a native full-size transparent <input type="file">. Empty MIME types are accepted when the file looks like video. Do not clear input.value in the same turn as reading the File.

Config and link management

OneDrive browse (admin)

• GET /api/onedrive/browse — folders & workbooks
• GET /api/onedrive/child-names — children from reference Excel

Authentication APIs

Non-API route

GET /portalaccess/[token] activates a parent session when the link is usable, sets the signed portal cookie, and redirects to /.