feat: cap image uploads (5MB + 30/hour per creator); document no-expiry retention

- Lower the size cap 15MB → 5MB (server + client pre-check).
- Per-creator Redis rate limit (30/hour) on POST /api/v1/uploads → 429 over cap;
  fails open on a Redis error so a blip never blocks a legit upload.
- Retention: deliberately NO S3 expiry (would break images on older carts);
  control growth at intake. Runbook updated with the decision + optional
  multipart-abort hygiene rule + note that the role has PutObject only.

Author: mayur-tolexo

cmd/shoplit-api/main.go

@@ -143,7 +143,7 @@ func run() error {
 		r.Use(sm.RequireUser())
 		r.Post("/extension/token", exttoken.MintHandler(q))
 		r.Get("/feedback", fb.ListHandler())
-		r.Post("/uploads", uploads.Handler(imageStore))
+		r.Post("/uploads", uploads.Handler(imageStore, uploads.NewRedisLimiter(rc, 30, time.Hour)))
 		carts.RegisterRoutes(r, svc, fetcher)
 	})
 

docs/superpowers/runbooks/s3-image-uploads-setup.md

@@ -61,6 +61,21 @@ When `SHOPLIT_S3_BUCKET` is set, the upload handler uses S3; otherwise it falls
 to local disk (dev). URLs returned look like
 `https://shoplit-uploads-prod.s3.ap-southeast-2.amazonaws.com/<random>.jpg`.
 
+## Retention & upload limits (decided 2026-05-25)
+- **No expiry lifecycle.** Product/cover images must live as long as their cart,
+  so we deliberately do NOT auto-delete by age (a flat 30-day rule would break
+  images on older carts). Storage growth is controlled at intake instead.
+- **Upload limits (enforced server-side in `internal/uploads`):**
+  - **5 MB** max per image (`maxUploadBytes`), JPEG/PNG/WebP/GIF only.
+  - **30 uploads/hour per creator** (Redis fixed-window, `NewRedisLimiter`);
+    over the cap → HTTP 429. The web picker also pre-checks 5 MB client-side.
+- **Optional S3 hygiene rule** (no data loss, safe to add in the console):
+  Bucket → Management → Lifecycle rule → "Delete incomplete multipart uploads
+  after 7 days". Our uploads are single-part PutObject, so this is effectively a
+  no-op today — add it only as a best-practice belt.
+- The EC2 instance role has **`s3:PutObject` only** (no `DeleteObject`/lifecycle),
+  so neither the app nor a stray script can delete bucket objects.
+
 ## 5. (Optional) verify the role works, from the EC2 box
 ```
 aws sts get-caller-identity                 # shows the assumed role

internal/uploads/ratelimit.go

@@ -0,0 +1,41 @@
+package uploads
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	goredis "github.com/redis/go-redis/v9"
+)
+
+// Limiter decides whether a user may upload again right now.
+type Limiter interface {
+	Allow(ctx context.Context, userID int64) (bool, error)
+}
+
+// RedisLimiter is a fixed-window per-user counter: at most `max` uploads per
+// `window`. Survives API restarts (unlike an in-memory map) and is shared if
+// the API ever runs more than one instance.
+type RedisLimiter struct {
+	rc     *goredis.Client
+	max    int
+	window time.Duration
+}
+
+func NewRedisLimiter(rc *goredis.Client, max int, window time.Duration) *RedisLimiter {
+	return &RedisLimiter{rc: rc, max: max, window: window}
+}
+
+func (l *RedisLimiter) Allow(ctx context.Context, userID int64) (bool, error) {
+	key := fmt.Sprintf("upload_rate:%d", userID)
+	n, err := l.rc.Incr(ctx, key).Result()
+	if err != nil {
+		// Fail open: a Redis hiccup shouldn't block creators from uploading.
+		return true, err
+	}
+	if n == 1 {
+		// First hit in this window — start the TTL.
+		_ = l.rc.Expire(ctx, key, l.window).Err()
+	}
+	return n <= int64(l.max), nil
+}

internal/uploads/uploads.go

@@ -8,13 +8,16 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"io"
+	"log/slog"
 	"net/http"
 	"os"
+
+	"github.com/mayur-tolexo/shoplit/internal/auth"
 )
 
 const (
-	maxUploadBytes = 15 << 20 // 15 MiB — generous for a full-res phone photo.
-	sniffLen       = 512      // bytes http.DetectContentType needs.
+	maxUploadBytes = 5 << 20 // 5 MiB cap per image.
+	sniffLen       = 512     // bytes http.DetectContentType needs.
 )
 
 // extByType maps the sniffed content type to a safe, server-chosen extension.
@@ -29,13 +32,27 @@ var extByType = map[string]string{
 
 // Handler returns an http.HandlerFunc that accepts a multipart "file" field,
 // validates it is an allowed image, hands it to the Store with a random name,
-// and responds {"url":"<public url>"}. Mount it behind auth.
-func Handler(store Store) http.HandlerFunc {
+// and responds {"url":"<public url>"}. Mount it behind auth. When limiter is
+// non-nil, each creator is capped to its per-window allowance.
+func Handler(store Store, limiter Limiter) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		// Per-creator rate limit (anti-abuse / S3 cost control). Fail open if
+		// the limiter errors so a Redis blip never blocks a legit upload.
+		if limiter != nil {
+			uid, _ := auth.UserIDFromContext(r.Context())
+			allowed, err := limiter.Allow(r.Context(), uid)
+			if err != nil {
+				slog.Warn("upload rate limiter error; allowing", "uid", uid, "err", err)
+			} else if !allowed {
+				http.Error(w, "upload limit reached — please try again later", http.StatusTooManyRequests)
+				return
+			}
+		}
+
 		// Cap the whole request body before reading anything.
 		r.Body = http.MaxBytesReader(w, r.Body, maxUploadBytes+1024)
 		if err := r.ParseMultipartForm(maxUploadBytes + 1024); err != nil {
-			http.Error(w, "file too large or malformed (max 15MB)", http.StatusRequestEntityTooLarge)
+			http.Error(w, "file too large or malformed (max 5MB)", http.StatusRequestEntityTooLarge)
 			return
 		}
 		file, _, err := r.FormFile("file")
@@ -51,7 +68,7 @@ func Handler(store Store) http.HandlerFunc {
 			return
 		}
 		if len(data) > maxUploadBytes {
-			http.Error(w, "image too large (max 15MB)", http.StatusRequestEntityTooLarge)
+			http.Error(w, "image too large (max 5MB)", http.StatusRequestEntityTooLarge)
 			return
 		}
 

internal/uploads/uploads_test.go

@@ -46,7 +46,7 @@ func TestUpload_StoresImageAndReturnsURL(t *testing.T) {
 	req.Header.Set("Content-Type", ct)
 	rr := httptest.NewRecorder()
 
-	uploads.Handler(uploads.NewDiskStore(dir)).ServeHTTP(rr, req)
+	uploads.Handler(uploads.NewDiskStore(dir), nil).ServeHTTP(rr, req)
 
 	if rr.Code != http.StatusOK {
 		t.Fatalf("want 200, got %d (%s)", rr.Code, rr.Body.String())
@@ -72,7 +72,7 @@ func TestUpload_RejectsNonImage(t *testing.T) {
 	req.Header.Set("Content-Type", ct)
 	rr := httptest.NewRecorder()
 
-	uploads.Handler(uploads.NewDiskStore(dir)).ServeHTTP(rr, req)
+	uploads.Handler(uploads.NewDiskStore(dir), nil).ServeHTTP(rr, req)
 
 	if rr.Code != http.StatusUnsupportedMediaType {
 		t.Fatalf("want 415 for non-image, got %d", rr.Code)
@@ -88,7 +88,7 @@ func TestUpload_MissingFile(t *testing.T) {
 	req.Header.Set("Content-Type", w.FormDataContentType())
 	rr := httptest.NewRecorder()
 
-	uploads.Handler(uploads.NewDiskStore(dir)).ServeHTTP(rr, req)
+	uploads.Handler(uploads.NewDiskStore(dir), nil).ServeHTTP(rr, req)
 
 	if rr.Code != http.StatusBadRequest {
 		t.Fatalf("want 400 for missing file, got %d", rr.Code)

web/components/image-upload-button.tsx

@@ -18,10 +18,16 @@ export function ImageUploadButton({
 }) {
   const [uploading, setUploading] = useState(false);
 
+  const MAX_BYTES = 5 * 1024 * 1024; // mirrors the server's 5MB cap
+
   const onPick = async (e: React.ChangeEvent<HTMLInputElement>) => {
     const file = e.target.files?.[0];
     e.target.value = ""; // allow re-picking the same file
     if (!file) return;
+    if (file.size > MAX_BYTES) {
+      toast.error("That photo is over 5MB — pick a smaller one.");
+      return;
+    }
     setUploading(true);
     try {
       onUploaded(await uploadImage(file));