Upload 36 files

src/controllers/content.controller.js

@@ -161,32 +161,48 @@ async function uploadLesson(req, res, next) {
       filenameHint: title,
     });
 
-    section.lessons.push({
-      title,
-      description: description || "",
-      type: lessonType,
-      order: order !== undefined ? Number(order) : section.lessons.length,
-      isPreview: isPreview === "true" || isPreview === true,
-      cloudinaryPublicId: result.public_id,
-      cloudinaryResourceType: result.resource_type,
-      format: result.format || "",
-      bytes: result.bytes || 0,
-      durationSeconds: result.duration ? Math.round(result.duration) : 0,
-    });
-    await course.save();
-
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "admin.lesson_uploaded",
-      targetType: "Course",
-      targetId: course._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-      metadata: { sectionId: section._id.toString(), title },
-    });
-
-    res.status(201).json({ curriculum: course.toCurriculumJSON() });
+    // From here on, the asset exists in Cloudinary. If anything below
+    // fails (DB validation, a save error, etc.), we must delete it —
+    // otherwise a failed attempt leaves an orphaned file in storage
+    // forever, since nothing in the database ever references it to
+    // clean it up later.
+    try {
+      section.lessons.push({
+        title,
+        description: description || "",
+        type: lessonType,
+        order: order !== undefined ? Number(order) : section.lessons.length,
+        isPreview: isPreview === "true" || isPreview === true,
+        cloudinaryPublicId: result.public_id,
+        cloudinaryResourceType: result.resource_type,
+        format: result.format || "",
+        bytes: result.bytes || 0,
+        durationSeconds: result.duration ? Math.round(result.duration) : 0,
+      });
+      await course.save();
+
+      await AuditLog.create({
+        actor: req.user._id,
+        actorEmail: req.user.email,
+        action: "admin.lesson_uploaded",
+        targetType: "Course",
+        targetId: course._id,
+        ip: req.ip,
+        userAgent: req.headers["user-agent"],
+        metadata: { sectionId: section._id.toString(), title },
+      });
+
+      res.status(201).json({ curriculum: course.toCurriculumJSON() });
+    } catch (err) {
+      await deleteAsset(result.public_id, result.resource_type).catch((cleanupErr) =>
+        logger.error("Failed to clean up orphaned Cloudinary asset after failed save", {
+          error: cleanupErr.message,
+          publicId: result.public_id,
+          resourceType: result.resource_type,
+        })
+      );
+      throw err;
+    }
   } catch (err) {
     next(err);
   } finally {

src/utils/cloudinaryUpload.js

@@ -1,19 +1,26 @@
+const fs = require("fs");
 const cloudinary = require("../config/cloudinary");
 
 const FOLDER = "aynwerd-courses";
 
+// Cloudinary's chunked `upload_large` is meant for genuinely large
+// files (their own docs point to it for anything that risks a single
+// request timing out or exceeding size limits — 100MB+ in practice).
+// Using it unconditionally for every video was a bug: for small files
+// its resolved result can come back missing fields (public_id,
+// resource_type) that the plain, non-chunked upload always includes,
+// which surfaced as a confusing Mongoose "required" validation error
+// rather than a clear upload error. Only use it above this threshold.
+const LARGE_UPLOAD_THRESHOLD_BYTES = 100 * 1024 * 1024; // 100MB
+
 /**
  * Uploads a file from a local temp path to Cloudinary under private,
  * signed-only access. `type: "authenticated"` means the asset can
  * NEVER be fetched by its plain URL or by guessing the public ID —
  * every request must carry a valid signature that we only ever mint
  * for a verified, paying learner (see getSignedPlaybackUrl below).
- *
- * Videos use `upload_large`, which chunks the upload — required for
- * anything beyond a small size and generally more reliable for video
- * regardless of size. Everything else uses a normal upload.
  */
-function uploadFromPath(filePath, { resourceType, filenameHint }) {
+async function uploadFromPath(filePath, { resourceType, filenameHint }) {
   const options = {
     folder: FOLDER,
     resource_type: resourceType, // "video" | "image" | "raw"
@@ -23,10 +30,25 @@ function uploadFromPath(filePath, { resourceType, filenameHint }) {
     filename_override: filenameHint,
   };
 
-  if (resourceType === "video") {
-    return cloudinary.uploader.upload_large(filePath, { ...options, chunk_size: 6 * 1024 * 1024 });
+  const { size } = fs.statSync(filePath);
+  const useLargeUpload = resourceType === "video" && size > LARGE_UPLOAD_THRESHOLD_BYTES;
+
+  const result = useLargeUpload
+    ? await cloudinary.uploader.upload_large(filePath, { ...options, chunk_size: 20 * 1024 * 1024 })
+    : await cloudinary.uploader.upload(filePath, options);
+
+  // Fail loudly and specifically here rather than letting an
+  // incomplete result silently reach the database, where it would
+  // otherwise surface as an opaque Mongoose validation error instead
+  // of a clear "the upload didn't actually succeed" message.
+  if (!result || !result.public_id || !result.resource_type) {
+    throw new Error(
+      `Cloudinary upload did not return the expected result (got: ${JSON.stringify(result)}). ` +
+        "The file was not saved — please try again."
+    );
   }
-  return cloudinary.uploader.upload(filePath, options);
+
+  return result;
 }
 
 function deleteAsset(publicId, resourceType) {