Files in.
Links out.

import { open } from "node:fs/promises";
import { basename } from "node:path";

const origin = (process.env.STASHBAY_ORIGIN ?? "https://stashbay.net").replace(/\/$/, "");
const key = process.env.STASHBAY_API_KEY;
const path = process.argv[2];
if (!key || !path) throw new Error("Set STASHBAY_API_KEY and run: node upload.mjs FILE");

async function api(path, body) {
  const response = await fetch(`${origin}/api/v1${path}`, {
    method: "POST",
    headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
    body: JSON.stringify(body),
    redirect: "error",
  });
  if (!response.ok) throw new Error(`HTTP ${response.status}: ${await response.text()}`);
  return response.json();
}

const file = await open(path, "r");
try {
  const { size } = await file.stat();
  const plan = await api("/uploads/init", { filename: basename(path), sizeBytes: size });
  console.error(`Upload ID: ${plan.fileId}`);
  if (!Number.isSafeInteger(plan.partSize) || plan.partSize < 1 || plan.partSize > 64 * 1024 * 1024) {
    throw new Error("Unexpected part size");
  }
  const parts = [];
  for (let number = 1; number <= plan.partCount; number++) {
    const offset = (number - 1) * plan.partSize;
    const bytes = Buffer.alloc(Math.min(plan.partSize, size - offset));
    let filled = 0;
    while (filled < bytes.length) {
      const { bytesRead } = await file.read(bytes, filled, bytes.length - filled, offset + filled);
      if (!bytesRead) throw new Error("File changed during upload");
      filled += bytesRead;
    }
    const address = plan.single ? plan.uploadUrl :
      (await api("/uploads/parts", { fileId: plan.fileId, from: number, count: 1 })).parts[0].url;
    const url = new URL(address, origin);
    if (url.origin !== new URL(origin).origin || !url.pathname.startsWith("/api/v1/uploads/")) {
      throw new Error("Unexpected upload URL");
    }
    const response = await fetch(url, { method: "PUT", headers: { Authorization: `Bearer ${key}` }, body: bytes, redirect: "error" });
    if (!response.ok) throw new Error(`PUT ${response.status}: ${await response.text()}`);
    if (!plan.single) {
      const { etag } = await response.json();
      if (!etag) throw new Error("Missing part ETag");
      parts.push({ partNumber: number, etag: etag.replace(/^"|"$/g, "") });
    }
  }
  const result = await api("/uploads/complete", { fileId: plan.fileId, parts });
  console.log(result.shareUrl ?? JSON.stringify(result));
} finally {
  await file.close();
}

import json
import os
import sys
from pathlib import Path
from urllib.request import Request, HTTPRedirectHandler, build_opener
from urllib.parse import urljoin, urlsplit


class NoRedirect(HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None


origin = os.environ.get("STASHBAY_ORIGIN", "https://stashbay.net").rstrip("/")
key = os.environ["STASHBAY_API_KEY"]
path = Path(sys.argv[1])
client = build_opener(NoRedirect)


def api(route, body):
    request = Request(origin + "/api/v1" + route, method="POST",
                      data=json.dumps(body).encode(),
                      headers={"Authorization": "Bearer " + key,
                               "Content-Type": "application/json"})
    with client.open(request, timeout=300) as response:
        return json.load(response)


size = path.stat().st_size
with path.open("rb") as file:
    plan = api("/uploads/init", {"filename": path.name, "sizeBytes": size})
    print("Upload ID:", plan["fileId"], file=sys.stderr)
    if not 1 <= plan["partSize"] <= 64 * 1024 * 1024:
        raise ValueError("Unexpected part size")
    parts = []
    for number in range(1, plan["partCount"] + 1):
        length = min(plan["partSize"], size - (number - 1) * plan["partSize"])
        data = file.read(length)
        if len(data) != length:
            raise ValueError("File changed during upload")
        address = plan["uploadUrl"] if plan["single"] else api(
            "/uploads/parts", {"fileId": plan["fileId"], "from": number, "count": 1}
        )["parts"][0]["url"]
        url = urljoin(origin, address)
        target, base = urlsplit(url), urlsplit(origin)
        if (target.scheme, target.netloc) != (base.scheme, base.netloc) or not target.path.startswith("/api/v1/uploads/"):
            raise ValueError("Unexpected upload URL")
        headers = {"Content-Type": "application/octet-stream", "Authorization": "Bearer " + key}
        with client.open(Request(url, data=data, headers=headers, method="PUT"), timeout=300) as response:
            if not plan["single"]:
                etag = json.load(response)["etag"]
                if not etag:
                    raise ValueError("Missing part ETag")
                parts.append({"partNumber": number, "etag": etag.strip('"')})
    result = api("/uploads/complete", {"fileId": plan["fileId"], "parts": parts})
    print(result.get("shareUrl") or json.dumps(result))

#include <curl/curl.h>
#include <nlohmann/json.hpp>
#include <algorithm>
#include <cstdlib>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <stdexcept>
#include <string>
using Json = nlohmann::json;

size_t receive(char* bytes, size_t size, size_t count, void* target) {
    static_cast<std::string*>(target)->append(bytes, size * count);
    return size * count;
}

std::string request(const std::string& url, const char* method, const std::string& body,
                    const std::string& key, bool json) {
    CURL* curl = curl_easy_init();
    if (!curl) throw std::runtime_error("Cannot initialize HTTP client");
    std::string response;
    curl_slist* headers = curl_slist_append(nullptr, ("Authorization: Bearer " + key).c_str());
    headers = curl_slist_append(headers, json ? "Content-Type: application/json" : "Content-Type: application/octet-stream");
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, method);
    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, body.data());
    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, static_cast<curl_off_t>(body.size()));
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);
    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 300L);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, receive);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response);
    auto error = curl_easy_perform(curl);
    long status = 0;
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &status);
    curl_slist_free_all(headers);
    curl_easy_cleanup(curl);
    if (error != CURLE_OK) throw std::runtime_error(curl_easy_strerror(error));
    if (status < 200 || status >= 300) throw std::runtime_error("HTTP " + std::to_string(status) + ": " + response);
    return response;
}

int main(int argc, char** argv) {
    if (curl_global_init(CURL_GLOBAL_DEFAULT) != CURLE_OK) return 1;
    int result = 0;
    try {
        const char* token = std::getenv("STASHBAY_API_KEY");
        if (!token || argc < 2) throw std::runtime_error("Set STASHBAY_API_KEY and run: ./upload FILE");
        std::string key(token), origin = std::getenv("STASHBAY_ORIGIN") ? std::getenv("STASHBAY_ORIGIN") : "https://stashbay.net";
        if (!origin.empty() && origin.back() == '/') origin.pop_back();
        auto api = [&](const std::string& route, const Json& body) {
            return Json::parse(request(origin + "/api/v1" + route, "POST", body.dump(), key, true));
        };
        std::filesystem::path path(argv[1]);
        auto size = std::filesystem::file_size(path);
        std::ifstream file(path, std::ios::binary);
        if (!file) throw std::runtime_error("Cannot open file");
        auto plan = api("/uploads/init", {{"filename", path.filename().string()}, {"sizeBytes", size}});
        std::string fileId = plan.at("fileId");
        std::cerr << "Upload ID: " << fileId << '\n';
        auto partSize = plan.at("partSize").get<uint64_t>();
        if (partSize < 1 || partSize > 64 * 1024 * 1024) throw std::runtime_error("Unexpected part size");
        bool single = plan.at("single");
        Json parts = Json::array();
        for (int number = 1; number <= plan.at("partCount").get<int>(); number++) {
            auto length = std::min<uint64_t>(partSize, size - (number - 1) * partSize);
            std::string bytes(length, '\0');
            file.read(bytes.data(), static_cast<std::streamsize>(length));
            if (static_cast<uint64_t>(file.gcount()) != length) throw std::runtime_error("File changed during upload");
            std::string address = single ? plan.at("uploadUrl").get<std::string>() :
                api("/uploads/parts", {{"fileId", fileId}, {"from", number}, {"count", 1}}).at("parts").at(0).at("url").get<std::string>();
            if (address.rfind("/api/v1/uploads/", 0) != 0) throw std::runtime_error("Unexpected upload URL");
            auto response = request(origin + address, "PUT", bytes, key, false);
            if (!single) {
                std::string etag = Json::parse(response).at("etag").get<std::string>();
                if (etag.empty()) throw std::runtime_error("Missing part ETag");
                etag.erase(std::remove(etag.begin(), etag.end(), '"'), etag.end());
                parts.push_back({{"partNumber", number}, {"etag", etag}});
            }
        }
        auto complete = api("/uploads/complete", {{"fileId", fileId}, {"parts", parts}});
        std::cout << (complete.at("shareUrl").is_string() ? complete.at("shareUrl").get<std::string>() : complete.dump()) << '\n';
    } catch (const std::exception& error) {
        std::cerr << error.what() << '\n';
        result = 1;
    }
    curl_global_cleanup();
    return result;
}

<?php
declare(strict_types=1);

$origin = rtrim(getenv('STASHBAY_ORIGIN') ?: 'https://stashbay.net', '/');
$key = getenv('STASHBAY_API_KEY');
$path = $argv[1] ?? '';
if (!$key || !is_file($path)) {
    throw new RuntimeException('Set STASHBAY_API_KEY and run: php upload.php FILE');
}

function request(string $url, string $method, string $body, array $headers): string {
    $curl = curl_init($url);
    curl_setopt_array($curl, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_POSTFIELDS => $body,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_FOLLOWLOCATION => false,
        CURLOPT_TIMEOUT => 300,
    ]);
    $data = curl_exec($curl);
    $status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
    $error = curl_error($curl);
    curl_close($curl);
    if ($data === false || $status < 200 || $status >= 300) {
        throw new RuntimeException("HTTP $status: " . ($error ?: $data));
    }
    return $data;
}

function api(string $route, array $body): array {
    global $origin, $key;
    $data = request($origin . '/api/v1' . $route, 'POST', json_encode($body, JSON_THROW_ON_ERROR),
        ['Authorization: Bearer ' . $key, 'Content-Type: application/json']);
    return json_decode($data, true, 512, JSON_THROW_ON_ERROR);
}

$size = filesize($path);
$file = fopen($path, 'rb');
if ($file === false) throw new RuntimeException('Cannot open file');
try {
    $plan = api('/uploads/init', ['filename' => basename($path), 'sizeBytes' => $size]);
    fwrite(STDERR, 'Upload ID: ' . $plan['fileId'] . PHP_EOL);
    if ($plan['partSize'] < 1 || $plan['partSize'] > 64 * 1024 * 1024) throw new RuntimeException('Unexpected part size');
    $parts = [];
    for ($number = 1; $number <= $plan['partCount']; $number++) {
        $length = min($plan['partSize'], $size - ($number - 1) * $plan['partSize']);
        $bytes = stream_get_contents($file, $length);
        if ($bytes === false || strlen($bytes) !== $length) throw new RuntimeException('File changed during upload');
        $address = $plan['single'] ? $plan['uploadUrl'] : api('/uploads/parts',
            ['fileId' => $plan['fileId'], 'from' => $number, 'count' => 1])['parts'][0]['url'];
        if (!str_starts_with($address, '/api/v1/uploads/')) throw new RuntimeException('Unexpected upload URL');
        $data = request($origin . $address, 'PUT', $bytes,
            ['Authorization: Bearer ' . $key, 'Content-Type: application/octet-stream']);
        if (!$plan['single']) {
            $etag = json_decode($data, true, 512, JSON_THROW_ON_ERROR)['etag'] ?? '';
            if (!$etag) throw new RuntimeException('Missing part ETag');
            $parts[] = ['partNumber' => $number, 'etag' => trim($etag, '"')];
        }
    }
    $result = api('/uploads/complete', ['fileId' => $plan['fileId'], 'parts' => $parts]);
    echo ($result['shareUrl'] ?? json_encode($result, JSON_THROW_ON_ERROR)) . PHP_EOL;
} finally {
    fclose($file);
}

using System;
using System.IO;
using System.Collections.Generic;
using System.Threading.Tasks;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Text.Json.Nodes;

var origin = (Environment.GetEnvironmentVariable("STASHBAY_ORIGIN") ?? "https://stashbay.net").TrimEnd('/');
var key = Environment.GetEnvironmentVariable("STASHBAY_API_KEY") ?? throw new Exception("Set STASHBAY_API_KEY");
if (args.Length == 0) throw new Exception("Pass the file path as an argument");
using var client = new HttpClient(new HttpClientHandler { AllowAutoRedirect = false }) { Timeout = TimeSpan.FromMinutes(5) };

async Task<JsonNode> Api(string route, object body)
{
    using var request = new HttpRequestMessage(HttpMethod.Post, origin + "/api/v1" + route);
    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", key);
    request.Content = new StringContent(System.Text.Json.JsonSerializer.Serialize(body), Encoding.UTF8, "application/json");
    using var response = await client.SendAsync(request);
    var text = await response.Content.ReadAsStringAsync();
    if (!response.IsSuccessStatusCode) throw new Exception($"HTTP {(int)response.StatusCode}: {text}");
    return JsonNode.Parse(text)!;
}

await using var file = File.OpenRead(args[0]);
var size = file.Length;
var plan = await Api("/uploads/init", new { filename = Path.GetFileName(args[0]), sizeBytes = size });
var fileId = plan["fileId"]!.GetValue<string>();
Console.Error.WriteLine($"Upload ID: {fileId}");
var partSize = plan["partSize"]!.GetValue<int>();
if (partSize < 1 || partSize > 64 * 1024 * 1024) throw new Exception("Unexpected part size");
var single = plan["single"]!.GetValue<bool>();
var parts = new List<object>();
for (var number = 1; number <= plan["partCount"]!.GetValue<int>(); number++)
{
    var bytes = new byte[(int)Math.Min(partSize, size - (long)(number - 1) * partSize)];
    await file.ReadExactlyAsync(bytes);
    var address = single ? plan["uploadUrl"]!.GetValue<string>() :
        (await Api("/uploads/parts", new { fileId, from = number, count = 1 }))["parts"]![0]!["url"]!.GetValue<string>();
    var url = new Uri(new Uri(origin), address);
    if (url.GetLeftPart(UriPartial.Authority) != origin || !url.AbsolutePath.StartsWith("/api/v1/uploads/"))
        throw new Exception("Unexpected upload URL");
    using var request = new HttpRequestMessage(HttpMethod.Put, url);
    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", key);
    request.Content = new ByteArrayContent(bytes);
    using var response = await client.SendAsync(request);
    var text = await response.Content.ReadAsStringAsync();
    if (!response.IsSuccessStatusCode) throw new Exception($"PUT {(int)response.StatusCode}: {text}");
    if (!single)
    {
        var etag = JsonNode.Parse(text)?["etag"]?.GetValue<string>();
        if (string.IsNullOrEmpty(etag)) throw new Exception("Missing part ETag");
        parts.Add(new { partNumber = number, etag = etag.Trim('"') });
    }
}
var result = await Api("/uploads/complete", new { fileId, parts });
Console.WriteLine(result["shareUrl"]?.GetValue<string>() ?? result.ToJsonString());

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.io.InputStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.file.Files;
import java.nio.file.Path;
import java.time.Duration;
import java.util.ArrayList;
import java.util.Map;
import java.util.Objects;

public class Upload {
    static final String ORIGIN = System.getenv().getOrDefault("STASHBAY_ORIGIN", "https://stashbay.net").replaceAll("/$", "");
    static final String KEY = Objects.requireNonNull(System.getenv("STASHBAY_API_KEY"), "Set STASHBAY_API_KEY");
    static final ObjectMapper JSON = new ObjectMapper();
    static final HttpClient CLIENT = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build();

    static JsonNode api(String route, Object body) throws Exception {
        var request = HttpRequest.newBuilder(URI.create(ORIGIN + "/api/v1" + route))
            .timeout(Duration.ofMinutes(5))
            .header("Authorization", "Bearer " + KEY)
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(JSON.writeValueAsString(body))).build();
        var response = CLIENT.send(request, HttpResponse.BodyHandlers.ofString());
        check(response);
        return JSON.readTree(response.body());
    }

    static void check(HttpResponse<String> response) {
        if (response.statusCode() < 200 || response.statusCode() >= 300)
            throw new IllegalStateException("HTTP " + response.statusCode() + ": " + response.body());
    }

    public static void main(String[] args) throws Exception {
        if (args.length == 0) throw new IllegalArgumentException("Pass the file path as an argument");
        var path = Path.of(args[0]);
        long size = Files.size(path);
        try (InputStream file = Files.newInputStream(path)) {
            var plan = api("/uploads/init", Map.of("filename", path.getFileName().toString(), "sizeBytes", size));
            var fileId = plan.get("fileId").asText();
            System.err.println("Upload ID: " + fileId);
            int partSize = plan.get("partSize").asInt();
            if (partSize < 1 || partSize > 64 * 1024 * 1024) throw new IllegalStateException("Unexpected part size");
            boolean single = plan.get("single").asBoolean();
            var parts = new ArrayList<Map<String, Object>>();
            for (int number = 1; number <= plan.get("partCount").asInt(); number++) {
                int length = (int) Math.min(partSize, size - (long) (number - 1) * partSize);
                byte[] bytes = file.readNBytes(length);
                if (bytes.length != length) throw new IllegalStateException("File changed during upload");
                String address = single ? plan.get("uploadUrl").asText() :
                    api("/uploads/parts", Map.of("fileId", fileId, "from", number, "count", 1))
                        .get("parts").get(0).get("url").asText();
                URI base = URI.create(ORIGIN), url = base.resolve(address);
                if (!Objects.equals(url.getScheme(), base.getScheme()) || !Objects.equals(url.getRawAuthority(), base.getRawAuthority())
                    || url.getPath() == null || !url.getPath().startsWith("/api/v1/uploads/"))
                    throw new IllegalStateException("Unexpected upload URL");
                var request = HttpRequest.newBuilder(url).timeout(Duration.ofMinutes(5))
                    .header("Authorization", "Bearer " + KEY)
                    .PUT(HttpRequest.BodyPublishers.ofByteArray(bytes)).build();
                var response = CLIENT.send(request, HttpResponse.BodyHandlers.ofString());
                check(response);
                if (!single) {
                    String etag = JSON.readTree(response.body()).path("etag").asText("");
                    if (etag.isEmpty()) throw new IllegalStateException("Missing part ETag");
                    parts.add(Map.of("partNumber", number, "etag", etag.replace("\"", "")));
                }
            }
            var result = api("/uploads/complete", Map.of("fileId", fileId, "parts", parts));
            System.out.println(result.path("shareUrl").isTextual() ? result.get("shareUrl").asText() : result.toString());
        }
    }
}