Add service API for Ladill Mail large attachment uploads.

Webmail can POST /api/v1/transfers with a mailbox address to create share links for files above 25 MB.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/TransferController.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Services\Identity\MailboxUserResolver;
+use App\Services\Transfer\TransferService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use RuntimeException;
+
+class TransferController extends Controller
+{
+    public function __construct(
+        private TransferService $transfers,
+        private MailboxUserResolver $users,
+    ) {}
+
+    /** Service-to-service upload (e.g. Ladill Mail for attachments above 25 MB). */
+    public function store(Request $request): JsonResponse
+    {
+        if ($request->attributes->get('service_caller') !== 'webmail') {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $maxKb = (int) ceil(((int) config('transfer.max_file_bytes', 524288000)) / 1024);
+        $maxFiles = (int) config('transfer.max_files_per_transfer', 20);
+
+        $data = $request->validate([
+            'mailbox' => ['required', 'email', 'max:255'],
+            'title' => ['nullable', 'string', 'max:120'],
+            'message' => ['nullable', 'string', 'max:2000'],
+            'retention_days' => ['nullable', 'integer', 'min:1', 'max:365'],
+            'files' => ['required', 'array', 'min:1', 'max:'.$maxFiles],
+            'files.*' => ['required', 'file', 'max:'.$maxKb],
+        ]);
+
+        try {
+            $user = $this->users->resolve((string) $data['mailbox']);
+        } catch (RuntimeException $e) {
+            return response()->json(['message' => $e->getMessage()], 422);
+        }
+
+        $title = trim((string) ($data['title'] ?? ''));
+        if ($title === '') {
+            $title = 'Email attachment';
+        }
+
+        $retentionDays = (int) ($data['retention_days'] ?? config('transfer.mail_retention_days', config('transfer.default_retention_days', 30)));
+
+        try {
+            $transfer = $this->transfers->create($user, [
+                'title' => $title,
+                'message' => $data['message'] ?? null,
+                'retention_days' => $retentionDays,
+            ], $request->file('files', []));
+        } catch (RuntimeException $e) {
+            return response()->json(['message' => $e->getMessage()], 422);
+        }
+
+        $transfer->load(['files', 'qrCode']);
+
+        return response()->json([
+            'data' => [
+                'id' => $transfer->id,
+                'title' => $transfer->title,
+                'public_url' => $transfer->qrCode?->publicUrl(),
+                'expires_at' => $transfer->expires_at?->toIso8601String(),
+                'files' => $transfer->files->map(fn ($file) => [
+                    'name' => $file->original_name,
+                    'size_bytes' => $file->size_bytes,
+                ])->values(),
+            ],
+        ], 201);
+    }
+}

app/Http/Middleware/AuthenticateService.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Service-to-service auth for internal APIs. Validates the bearer token against
+ * per-consumer keys in config("{namespace}.service_api_keys").
+ */
+class AuthenticateService
+{
+    public function handle(Request $request, Closure $next, string $namespace = 'transfer'): Response
+    {
+        $token = (string) $request->bearerToken();
+        $caller = null;
+
+        if ($token !== '') {
+            foreach ((array) config("{$namespace}.service_api_keys", []) as $name => $key) {
+                if (is_string($key) && $key !== '' && hash_equals($key, $token)) {
+                    $caller = $name;
+                    break;
+                }
+            }
+        }
+
+        if ($caller === null) {
+            return response()->json(['error' => 'Unauthorized.'], 401);
+        }
+
+        $request->attributes->set('service_caller', $caller);
+
+        return $next($request);
+    }
+}