App portal/feature/upload url endpoint

[mehanana]

POST /api/v1/uploads/sign returns a real signed GCS URL. The frontend component can now PUT files directly to GCS.

🎫 Issue #484

🎨 Figma Link :

▶ Changelist:

• create gcs singleton & export the getBucket function, which returns the prod or test bucket
• Validate the upload request & sanitize file name
• POST -> create signed upload url
• PUT -> puts the url into GCS

🧪 Testing:

• End-to-end through curl
• Tested on http://localhost:3000/uploads-demo to see if frontend to backend was working
• Tested bad pathways as well to make sure errors were showing up

🎥 Screenshots & Screencasts:

POST response contains a uploadUrl, uploadId, and expiresAt:

PUT a real file to the prev uploadUrl -> 200 response:

In the GCS console:

PUT bad MIME type -> 400 response:

PUT oversize file -> 400 response:

PUT malicious filename -> sanitizer strips the path components and the request succeeds with a safe filename:

Go through frontend & upload file -> 200 response & file in GCS:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
core-live	Ready	Preview, Comment	Jul 8, 2026 5:57pm
core-main	Ready	Preview, Comment	Jul 8, 2026 5:57pm