Add chunked uploads and raise storage rate to GHS 0.30/GB/month.

Large files upload in 5 MB chunks (hosting file manager pattern) for the
transfer UI and Ladill Mail S2S API, with no app-level file size cap when
TRANSFER_MAX_FILE_BYTES=0.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/ChunkedUploadController.php

@@ -0,0 +1,156 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Services\Identity\MailboxUserResolver;
+use App\Services\Transfer\TransferService;
+use App\Services\Upload\ChunkedUploadService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use RuntimeException;
+
+class ChunkedUploadController extends Controller
+{
+    public function __construct(
+        private ChunkedUploadService $uploads,
+        private TransferService $transfers,
+        private MailboxUserResolver $users,
+    ) {}
+
+    public function init(Request $request): JsonResponse
+    {
+        if ($request->attributes->get('service_caller') !== 'webmail') {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $validated = $request->validate([
+            'mailbox' => ['required', 'email', 'max:255'],
+            'filename' => ['required', 'string', 'max:255'],
+            'filesize' => ['required', 'integer', 'min:1'],
+        ]);
+
+        $mailbox = strtolower(trim((string) $validated['mailbox']));
+
+        try {
+            $this->users->resolve($mailbox);
+        } catch (RuntimeException $e) {
+            return response()->json(['message' => $e->getMessage()], 422);
+        }
+
+        $uploadId = $this->uploads->init($this->ownerKey($mailbox), [
+            'filename' => $validated['filename'],
+            'filesize' => (int) $validated['filesize'],
+            'mailbox' => $mailbox,
+        ]);
+
+        return response()->json([
+            'success' => true,
+            'upload_id' => $uploadId,
+        ]);
+    }
+
+    public function chunk(Request $request): JsonResponse
+    {
+        if ($request->attributes->get('service_caller') !== 'webmail') {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $validated = $request->validate([
+            'mailbox' => ['required', 'email', 'max:255'],
+            'upload_id' => ['required', 'string', 'uuid'],
+            'chunk_index' => ['required', 'integer', 'min:0'],
+            'chunk_size' => ['required', 'integer', 'min:1'],
+            'chunk' => ['required', 'file', 'max:10240'],
+        ]);
+
+        $mailbox = strtolower(trim((string) $validated['mailbox']));
+        $chunk = $request->file('chunk');
+        if ($chunk === null) {
+            return response()->json(['success' => false, 'error' => 'Chunk missing.'], 422);
+        }
+
+        try {
+            $received = $this->uploads->receiveChunk(
+                $validated['upload_id'],
+                $this->ownerKey($mailbox),
+                (int) $validated['chunk_index'],
+                $chunk,
+                (int) $validated['chunk_size'],
+            );
+        } catch (RuntimeException $e) {
+            return response()->json(['success' => false, 'error' => $e->getMessage()], 400);
+        }
+
+        return response()->json([
+            'success' => true,
+            'chunk_index' => (int) $validated['chunk_index'],
+            'chunks_received' => $received,
+        ]);
+    }
+
+    public function finalize(Request $request): JsonResponse
+    {
+        if ($request->attributes->get('service_caller') !== 'webmail') {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $validated = $request->validate([
+            'mailbox' => ['required', 'email', 'max:255'],
+            'upload_id' => ['required', 'string', 'uuid'],
+            'total_chunks' => ['required', 'integer', 'min:1'],
+            'title' => ['nullable', 'string', 'max:120'],
+            'retention_days' => ['nullable', 'integer', 'min:1', 'max:365'],
+        ]);
+
+        $mailbox = strtolower(trim((string) $validated['mailbox']));
+        $ownerKey = $this->ownerKey($mailbox);
+
+        try {
+            $user = $this->users->resolve($mailbox);
+            $assembled = $this->uploads->finalize(
+                $validated['upload_id'],
+                $ownerKey,
+                (int) $validated['total_chunks'],
+            );
+            $uploadedFile = $this->uploads->toUploadedFile($validated['upload_id'], $ownerKey);
+
+            $title = trim((string) ($validated['title'] ?? ''));
+            if ($title === '') {
+                $title = Str::limit('Email attachment: '.$assembled['filename'], 120, '');
+            }
+
+            $retentionDays = (int) ($validated['retention_days'] ?? config('transfer.mail_retention_days', config('transfer.default_retention_days', 30)));
+
+            $transfer = $this->transfers->create($user, [
+                'title' => $title,
+                'retention_days' => $retentionDays,
+            ], [$uploadedFile]);
+        } catch (RuntimeException $e) {
+            return response()->json(['message' => $e->getMessage()], 422);
+        } finally {
+            $this->uploads->cleanup($validated['upload_id']);
+        }
+
+        $transfer->load(['files', 'qrCode']);
+
+        return response()->json([
+            'data' => [
+                'id' => $transfer->id,
+                'title' => $transfer->title,
+                'public_url' => $transfer->qrCode?->publicUrl(),
+                'expires_at' => $transfer->expires_at?->toIso8601String(),
+                'files' => $transfer->files->map(fn ($file) => [
+                    'name' => $file->original_name,
+                    'size_bytes' => $file->size_bytes,
+                ])->values(),
+            ],
+        ], 201);
+    }
+
+    private function ownerKey(string $mailbox): string
+    {
+        return 'webmail:'.strtolower(trim($mailbox));
+    }
+}

app/Http/Controllers/Api/TransferController.php

@@ -23,8 +23,12 @@ class TransferController extends Controller
             return response()->json(['message' => 'Forbidden.'], 403);
         }
 
-        $maxKb = (int) ceil(((int) config('transfer.max_file_bytes', 524288000)) / 1024);
+        $maxBytes = (int) config('transfer.max_file_bytes', 0);
         $maxFiles = (int) config('transfer.max_files_per_transfer', 20);
+        $fileRules = ['required', 'file'];
+        if ($maxBytes > 0) {
+            $fileRules[] = 'max:'.(int) ceil($maxBytes / 1024);
+        }
 
         $data = $request->validate([
             'mailbox' => ['required', 'email', 'max:255'],
@@ -32,7 +36,7 @@ class TransferController extends Controller
             'message' => ['nullable', 'string', 'max:2000'],
             'retention_days' => ['nullable', 'integer', 'min:1', 'max:365'],
             'files' => ['required', 'array', 'min:1', 'max:'.$maxFiles],
-            'files.*' => ['required', 'file', 'max:'.$maxKb],
+            'files.*' => $fileRules,
         ]);
 
         try {

app/Http/Controllers/Qr/AccountController.php

@@ -61,7 +61,7 @@ class AccountController extends Controller
 
         $storageBytes = (int) $activeTransfers->sum('storage_bytes');
         $storageGb = round($storageBytes / (1024 * 1024 * 1024), 2);
-        $pricePerGb = (float) config('transfer.price_per_gb_month', 0.15);
+        $pricePerGb = (float) config('transfer.price_per_gb_month', 0.30);
         $monthlyTotalGhs = round($activeTransfers->sum(fn (Transfer $transfer) => $transfer->monthlyCostGhs()), 2);
 
         return view('qr.account.billing', [

app/Http/Controllers/Qr/AfiaController.php

@@ -70,7 +70,7 @@ class AfiaController extends Controller
                 ->whereNotNull('expires_at')
                 ->whereBetween('expires_at', [now(), now()->addDays(7)])
                 ->count(),
-            'storage_price_per_gb_month_ghs' => number_format((float) config('transfer.price_per_gb_month', 0.15), 2),
+            'storage_price_per_gb_month_ghs' => number_format((float) config('transfer.price_per_gb_month', 0.30), 2),
         ];
 
         if ($account->public_id) {

app/Http/Controllers/Transfer/ChunkedUploadController.php

@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Http\Controllers\Transfer;
+
+use App\Http\Controllers\Controller;
+use App\Services\Upload\ChunkedUploadService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use RuntimeException;
+
+class ChunkedUploadController extends Controller
+{
+    public function __construct(
+        private ChunkedUploadService $uploads,
+    ) {}
+
+    public function init(Request $request): JsonResponse
+    {
+        $account = ladill_account();
+
+        $validated = $request->validate([
+            'filename' => 'required|string|max:255',
+            'filesize' => 'required|integer|min:1',
+        ]);
+
+        $uploadId = $this->uploads->init($this->ownerKey($account->id), [
+            'filename' => $validated['filename'],
+            'filesize' => (int) $validated['filesize'],
+        ]);
+
+        return response()->json([
+            'success' => true,
+            'upload_id' => $uploadId,
+        ]);
+    }
+
+    public function chunk(Request $request): JsonResponse
+    {
+        $account = ladill_account();
+        $ownerKey = $this->ownerKey($account->id);
+
+        $validated = $request->validate([
+            'upload_id' => 'required|string|uuid',
+            'chunk_index' => 'required|integer|min:0',
+            'chunk_size' => 'required|integer|min:1',
+            'chunk' => 'required|file|max:10240',
+        ]);
+
+        $chunk = $request->file('chunk');
+        if ($chunk === null) {
+            return response()->json(['success' => false, 'error' => 'Chunk missing.'], 422);
+        }
+
+        try {
+            $received = $this->uploads->receiveChunk(
+                $validated['upload_id'],
+                $ownerKey,
+                (int) $validated['chunk_index'],
+                $chunk,
+                (int) $validated['chunk_size'],
+            );
+        } catch (RuntimeException $e) {
+            return response()->json(['success' => false, 'error' => $e->getMessage()], 400);
+        }
+
+        return response()->json([
+            'success' => true,
+            'chunk_index' => (int) $validated['chunk_index'],
+            'chunks_received' => $received,
+        ]);
+    }
+
+    public function finalize(Request $request): JsonResponse
+    {
+        $account = ladill_account();
+        $ownerKey = $this->ownerKey($account->id);
+
+        $validated = $request->validate([
+            'upload_id' => 'required|string|uuid',
+            'total_chunks' => 'required|integer|min:1',
+        ]);
+
+        try {
+            $this->uploads->finalize(
+                $validated['upload_id'],
+                $ownerKey,
+                (int) $validated['total_chunks'],
+            );
+        } catch (RuntimeException $e) {
+            return response()->json(['success' => false, 'error' => $e->getMessage()], 400);
+        }
+
+        return response()->json([
+            'success' => true,
+            'upload_id' => $validated['upload_id'],
+        ]);
+    }
+
+    private function ownerKey(int $userId): string
+    {
+        return 'user:'.$userId;
+    }
+}

app/Http/Controllers/Transfer/FilesController.php

@@ -31,7 +31,7 @@ class FilesController extends Controller
             'files' => $files,
             'storageBytes' => (int) $storageBytes,
             'storageGb' => round($storageBytes / (1024 * 1024 * 1024), 2),
-            'pricePerGb' => (float) config('transfer.price_per_gb_month', 0.15),
+            'pricePerGb' => (float) config('transfer.price_per_gb_month', 0.30),
         ]);
     }
 }

app/Http/Controllers/Transfer/OverviewController.php

@@ -61,7 +61,7 @@ class OverviewController extends Controller
         }
 
         $storageGb = round($storageBytes / (1024 * 1024 * 1024), 2);
-        $monthlyEstimateGhs = round($storageGb * (float) config('transfer.price_per_gb_month', 0.15), 2);
+        $monthlyEstimateGhs = round($storageGb * (float) config('transfer.price_per_gb_month', 0.30), 2);
 
         return view('transfer.dashboard', [
             'activeCount' => $activeCount,

app/Http/Controllers/Transfer/TransferController.php

@@ -7,6 +7,7 @@ use App\Models\Transfer;
 use App\Services\Qr\QrImageGeneratorService;
 use App\Services\Qr\QrPdfExporter;
 use App\Services\Transfer\TransferService;
+use App\Services\Upload\ChunkedUploadService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -19,6 +20,7 @@ class TransferController extends Controller
 {
     public function __construct(
         private TransferService $transfers,
+        private ChunkedUploadService $chunkedUploads,
         private QrImageGeneratorService $imageGenerator,
         private QrPdfExporter $pdfExporter,
     ) {}
@@ -42,7 +44,7 @@ class TransferController extends Controller
         return view('transfer.transfers.create', [
             'defaultRetentionDays' => (int) config('transfer.default_retention_days', 30),
             'maxFiles' => (int) config('transfer.max_files_per_transfer', 20),
-            'pricePerGb' => (float) config('transfer.price_per_gb_month', 0.15),
+            'pricePerGb' => (float) config('transfer.price_per_gb_month', 0.30),
         ]);
     }
 
@@ -50,19 +52,47 @@ class TransferController extends Controller
     {
         $account = ladill_account();
 
+        $maxBytes = (int) config('transfer.max_file_bytes', 0);
+        $fileRules = ['nullable', 'file'];
+        if ($maxBytes > 0) {
+            $fileRules[] = 'max:'.(int) ceil($maxBytes / 1024);
+        }
+
         $data = $request->validate([
             'title' => 'required|string|max:120',
             'message' => 'nullable|string|max:2000',
             'password' => 'nullable|string|min:4|max:64',
             'retention_days' => 'nullable|integer|min:1|max:365',
-            'files' => 'required|array|min:1',
-            'files.*' => 'required|file|max:'.((int) config('transfer.max_file_bytes', 524288000) / 1024),
+            'files' => 'nullable|array',
+            'files.*' => $fileRules,
+            'upload_ids' => 'nullable|array',
+            'upload_ids.*' => 'required|string|uuid',
         ]);
 
+        $ownerKey = 'user:'.$account->id;
+        $files = array_values($request->file('files', []) ?? []);
+        $uploadIds = array_values($data['upload_ids'] ?? []);
+
+        if ($files === [] && $uploadIds === []) {
+            return back()->withInput()->with('error', 'Add at least one file to share.');
+        }
+
+        foreach ($uploadIds as $uploadId) {
+            try {
+                $files[] = $this->chunkedUploads->toUploadedFile($uploadId, $ownerKey);
+            } catch (RuntimeException $e) {
+                return back()->withInput()->with('error', $e->getMessage());
+            }
+        }
+
         try {
-            $transfer = $this->transfers->create($account, $data, $request->file('files', []));
+            $transfer = $this->transfers->create($account, $data, $files);
         } catch (RuntimeException $e) {
             return back()->withInput()->with('error', $e->getMessage());
+        } finally {
+            foreach ($uploadIds as $uploadId) {
+                $this->chunkedUploads->cleanup($uploadId);
+            }
         }
 
         return redirect()

app/Models/Transfer.php

@@ -79,6 +79,6 @@ class Transfer extends Model
 
     public function monthlyCostGhs(): float
     {
-        return round($this->storageGb() * (float) config('transfer.price_per_gb_month', 0.15), 2);
+        return round($this->storageGb() * (float) config('transfer.price_per_gb_month', 0.30), 2);
     }
 }

app/Services/Afia/AfiaService.php

@@ -96,7 +96,7 @@ class AfiaService
 
     private function transferSystemPrompt(string $ctx): string
     {
-        $pricePerGb = number_format((float) config('transfer.price_per_gb_month', 0.15), 2);
+        $pricePerGb = number_format((float) config('transfer.price_per_gb_month', 0.30), 2);
 
         return <<<PROMPT
         You are Afia, the assistant inside Ladill Transfer (transfer.ladill.com).

app/Services/Transfer/TransferService.php

@@ -38,7 +38,7 @@ class TransferService
             throw new RuntimeException("You can upload up to {$maxFiles} files per transfer.");
         }
 
-        $maxBytes = (int) config('transfer.max_file_bytes', 524288000);
+        $maxBytes = (int) config('transfer.max_file_bytes', 0);
         $retentionDays = (int) ($data['retention_days'] ?? config('transfer.default_retention_days', 30));
         $retentionDays = max(1, min(365, $retentionDays));
 
@@ -64,7 +64,7 @@ class TransferService
                     continue;
                 }
 
-                if ($file->getSize() > $maxBytes) {
+                if ($maxBytes > 0 && $file->getSize() > $maxBytes) {
                     throw new RuntimeException($file->getClientOriginalName().' exceeds the maximum file size.');
                 }
 

app/Services/Upload/ChunkedUploadService.php

@@ -0,0 +1,192 @@
+<?php
+
+namespace App\Services\Upload;
+
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Str;
+use RuntimeException;
+
+/** Bit-sized upload sessions (init → chunks → finalize), matching hosting file manager. */
+class ChunkedUploadService
+{
+    public function baseDir(): string
+    {
+        $dir = (string) config('transfer.chunk_upload.path', storage_path('app/chunked_uploads'));
+
+        if (! is_dir($dir)) {
+            mkdir($dir, 0755, true);
+        }
+
+        return $dir;
+    }
+
+    /** @param  array<string, mixed>  $metadata */
+    public function init(string $ownerKey, array $metadata): string
+    {
+        $uploadId = (string) Str::uuid();
+        $tempDir = $this->sessionDir($uploadId);
+
+        if (! is_dir($tempDir)) {
+            mkdir($tempDir, 0755, true);
+        }
+
+        $payload = array_merge($metadata, [
+            'owner_key' => $ownerKey,
+            'chunks_received' => [],
+            'created_at' => now()->toIso8601String(),
+        ]);
+
+        $this->writeMetadata($uploadId, $payload);
+
+        return $uploadId;
+    }
+
+    public function receiveChunk(string $uploadId, string $ownerKey, int $chunkIndex, UploadedFile $chunk, int $expectedSize): int
+    {
+        $metadata = $this->metadata($uploadId, $ownerKey);
+        $tempDir = $this->sessionDir($uploadId);
+
+        $actualSize = (int) $chunk->getSize();
+        if ($expectedSize > 0 && $actualSize !== $expectedSize) {
+            throw new RuntimeException("Chunk size mismatch: expected {$expectedSize}, got {$actualSize}.");
+        }
+
+        $chunkPath = "{$tempDir}/chunk_{$chunkIndex}";
+        $chunk->move($tempDir, "chunk_{$chunkIndex}");
+
+        if (! file_exists($chunkPath) || filesize($chunkPath) !== $actualSize) {
+            throw new RuntimeException('Chunk save failed.');
+        }
+
+        $metadata['chunks_received'][] = $chunkIndex;
+        $metadata['chunks_received'] = array_values(array_unique($metadata['chunks_received']));
+        sort($metadata['chunks_received']);
+        $this->writeMetadata($uploadId, $metadata);
+
+        return count($metadata['chunks_received']);
+    }
+
+    /** @return array{path: string, filename: string, size: int, metadata: array<string, mixed>} */
+    public function finalize(string $uploadId, string $ownerKey, int $totalChunks): array
+    {
+        $metadata = $this->metadata($uploadId, $ownerKey);
+        $tempDir = $this->sessionDir($uploadId);
+
+        if (count($metadata['chunks_received']) !== $totalChunks) {
+            throw new RuntimeException(
+                'Missing chunks. Expected '.$totalChunks.', received '.count($metadata['chunks_received']).'.',
+            );
+        }
+
+        $finalPath = "{$tempDir}/final_".Str::random(8);
+        $finalFile = fopen($finalPath, 'wb');
+        if ($finalFile === false) {
+            throw new RuntimeException('Could not create assembled file.');
+        }
+
+        for ($i = 0; $i < $totalChunks; $i++) {
+            $chunkPath = "{$tempDir}/chunk_{$i}";
+            if (! file_exists($chunkPath)) {
+                fclose($finalFile);
+                throw new RuntimeException("Chunk {$i} is missing.");
+            }
+
+            $chunkHandle = fopen($chunkPath, 'rb');
+            if ($chunkHandle === false) {
+                fclose($finalFile);
+                throw new RuntimeException("Could not read chunk {$i}.");
+            }
+
+            while (! feof($chunkHandle)) {
+                $buffer = fread($chunkHandle, 8192);
+                if ($buffer === false) {
+                    break;
+                }
+                fwrite($finalFile, $buffer);
+            }
+            fclose($chunkHandle);
+        }
+        fclose($finalFile);
+
+        $combinedSize = (int) filesize($finalPath);
+        $expectedSize = (int) ($metadata['filesize'] ?? 0);
+        if ($expectedSize > 0 && abs($combinedSize - $expectedSize) > 1024) {
+            @unlink($finalPath);
+            throw new RuntimeException("File size mismatch. Expected {$expectedSize} bytes, got {$combinedSize} bytes.");
+        }
+
+        $metadata['assembled_path'] = $finalPath;
+        $metadata['assembled_size'] = $combinedSize;
+        $this->writeMetadata($uploadId, $metadata);
+
+        return [
+            'path' => $finalPath,
+            'filename' => basename((string) ($metadata['filename'] ?? 'upload.bin')),
+            'size' => $combinedSize,
+            'metadata' => $metadata,
+        ];
+    }
+
+    public function toUploadedFile(string $uploadId, string $ownerKey): UploadedFile
+    {
+        $metadata = $this->metadata($uploadId, $ownerKey);
+        $path = (string) ($metadata['assembled_path'] ?? '');
+
+        if ($path === '' || ! is_file($path)) {
+            throw new RuntimeException('Assembled upload is not ready.');
+        }
+
+        return new UploadedFile(
+            $path,
+            basename((string) ($metadata['filename'] ?? 'upload.bin')),
+            null,
+            null,
+            true,
+        );
+    }
+
+    public function cleanup(string $uploadId): void
+    {
+        $tempDir = $this->sessionDir($uploadId);
+        if (! is_dir($tempDir)) {
+            return;
+        }
+
+        foreach (glob("{$tempDir}/*") ?: [] as $file) {
+            @unlink($file);
+        }
+        @rmdir($tempDir);
+    }
+
+    /** @return array<string, mixed> */
+    public function metadata(string $uploadId, string $ownerKey): array
+    {
+        $path = $this->metadataPath($uploadId);
+        if (! file_exists($path)) {
+            throw new RuntimeException('Upload session not found or expired.');
+        }
+
+        $metadata = json_decode((string) file_get_contents($path), true);
+        if (! is_array($metadata) || ($metadata['owner_key'] ?? '') !== $ownerKey) {
+            throw new RuntimeException('Upload session not found or unauthorized.');
+        }
+
+        return $metadata;
+    }
+
+    private function sessionDir(string $uploadId): string
+    {
+        return $this->baseDir().'/'.$uploadId;
+    }
+
+    private function metadataPath(string $uploadId): string
+    {
+        return $this->sessionDir($uploadId).'/metadata.json';
+    }
+
+    /** @param  array<string, mixed>  $metadata */
+    private function writeMetadata(string $uploadId, array $metadata): void
+    {
+        file_put_contents($this->metadataPath($uploadId), json_encode($metadata));
+    }
+}