style: rustfmt upload endpoint + imports

Cargo.lock

···
 ]
 
 [[package]]
+name = "actix-multipart"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d974dd6c4f78d102d057c672dcf6faa618fafa9df91d44f9c466688fc1275a3a"
+dependencies = [
+ "actix-multipart-derive",
+ "actix-utils",
+ "actix-web",
+ "bytes",
+ "derive_more 0.99.19",
+ "futures-core",
+ "futures-util",
+ "httparse",
+ "local-waker",
+ "log",
+ "memchr",
+ "mime",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "serde_plain",
+ "tempfile",
+ "tokio",
+]
+
+[[package]]
+name = "actix-multipart-derive"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a0a77f836d869f700e5b47ac7c3c8b9c8bc82e4aec861954c6198abee3ebd4d"
+dependencies = [
+ "darling",
+ "parse-size",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
 name = "actix-router"
 version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "0.1.0"
 dependencies = [
  "actix-files",
+ "actix-multipart",
  "actix-session",
  "actix-web",
  "anyhow",
···
  "chrono",
  "dotenv",
  "env_logger",
+ "futures-util",
  "hickory-resolver",
  "log",
  "rand 0.8.5",
···
  "smallvec",
  "windows-targets 0.52.6",
 ]
+
+[[package]]
+name = "parse-size"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "487f2ccd1e17ce8c1bfab3a65c89525af41cfad4c8659021a1e9a2aacd73b89b"
 
 [[package]]
 name = "paste"
···
  "itoa",
  "memchr",
  "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_plain"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1fc6db65a611022b23a0dec6975d63fb80a302cb3388835ff02c097258d50"
+dependencies = [
  "serde",
 ]
 

Cargo.toml

···
 actix-files = "0.6.6"
 actix-session = { version = "0.10", features = ["cookie-session"] }
 actix-web = "4.10.2"
+actix-multipart = "0.6"
 anyhow = "1.0.97"
 askama = "0.13"
 atrium-common = "0.1.1"
···
 serde_json = "1.0.140"
 rocketman = "0.2.0"
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+futures-util = "0.3"
 dotenv = "0.15.0"
 thiserror = "1.0.69"
 async-sqlite = "0.5.0"

README.md

···
 
 The app serves them at `/emojis/<filename>` and lists them via `/api/custom-emojis`.
 
+### admin upload endpoint
+
+When logged in as the admin DID, you can upload PNG or GIF emojis without SSH via a simple endpoint:
+
+- Endpoint: `POST /admin/upload-emoji`
+- Auth: session-based; only the admin DID is allowed
+- Form fields (multipart/form-data):
+  - `file`: the image file (PNG or GIF), max 5MB
+  - `name` (optional): base filename (letters, numbers, `-`, `_`) without extension
+
+Example with curl:
+
+```bash
+curl -i -X POST \
+  -F "file=@./static/emojis/sample.png" \
+  -F "name=my_sample" \
+  http://localhost:8080/admin/upload-emoji
+```
+
+Response will include the public URL (e.g., `/emojis/my_sample.png`).
+
 ### available commands
 
 we use [just](https://github.com/casey/just) for common tasks:

src/api/mod.rs

···
         // Emoji API routes
         .service(status::get_frequent_emojis)
         .service(status::get_custom_emojis)
+        .service(status::upload_emoji)
         .service(status::get_following)
         // Status management routes
         .service(status::status)

src/api/status.rs

···
     rate_limiter::RateLimiter,
     templates::{ErrorTemplate, FeedTemplate, Profile, StatusTemplate},
 };
+use actix_multipart::Multipart;
 use actix_session::Session;
 use actix_web::{
     HttpRequest, HttpResponse, Responder, Result, get, post,
···
     handle::{AtprotoHandleResolver, AtprotoHandleResolverConfig},
 };
 use atrium_oauth::DefaultHttpClient;
+use futures_util::TryStreamExt as _;
 use serde::{Deserialize, Serialize};
 use std::{collections::HashMap, sync::Arc};
 
···
     emojis.sort_by(|a, b| a.name.cmp(&b.name));
 
     Ok(HttpResponse::Ok().json(emojis))
+}
+
+/// Admin-only upload of a custom emoji (PNG or GIF)
+#[post("/admin/upload-emoji")]
+pub async fn upload_emoji(
+    session: Session,
+    app_config: web::Data<Config>,
+    mut payload: Multipart,
+) -> Result<impl Responder> {
+    // Require admin
+    let did = match session.get::<String>("did").unwrap_or(None) {
+        Some(d) => d,
+        None => {
+            return Ok(HttpResponse::Unauthorized().json(serde_json::json!({
+                "error": "Not authenticated"
+            })));
+        }
+    };
+    if !is_admin(&did) {
+        return Ok(HttpResponse::Forbidden().json(serde_json::json!({
+            "error": "Admin access required"
+        })));
+    }
+
+    // Parse multipart for optional name and the file
+    let mut desired_name: Option<String> = None;
+    let mut file_bytes: Option<Vec<u8>> = None;
+    let mut file_ext: Option<&'static str> = None; // "png" | "gif"
+
+    const MAX_SIZE: usize = 5 * 1024 * 1024; // 5MB cap
+
+    loop {
+        let mut field = match payload.try_next().await {
+            Ok(Some(f)) => f,
+            Ok(None) => break,
+            Err(e) => {
+                log::warn!("multipart error: {}", e);
+                return Ok(HttpResponse::BadRequest()
+                    .json(serde_json::json!({"error":"Invalid multipart data"})));
+            }
+        };
+        let name = field.name().to_string();
+
+        if name == "name" {
+            // Collect small text field
+            let mut buf = Vec::new();
+            loop {
+                match field.try_next().await {
+                    Ok(Some(chunk)) => {
+                        buf.extend_from_slice(&chunk);
+                        if buf.len() > 1024 {
+                            break;
+                        }
+                    }
+                    Ok(None) => break,
+                    Err(e) => {
+                        log::warn!("multipart read error: {}", e);
+                        return Ok(HttpResponse::BadRequest()
+                            .json(serde_json::json!({"error":"Invalid multipart data"})));
+                    }
+                }
+            }
+            if let Ok(s) = String::from_utf8(buf) {
+                desired_name = Some(s.trim().to_string());
+            }
+            continue;
+        }
+
+        if name == "file" {
+            let ct = field.content_type().cloned();
+            let mut ext_guess: Option<&'static str> = match ct.as_ref().map(|m| m.essence_str()) {
+                Some("image/png") => Some("png"),
+                Some("image/gif") => Some("gif"),
+                _ => None,
+            };
+
+            // Read file bytes with size cap
+            let mut data = Vec::new();
+            loop {
+                match field.try_next().await {
+                    Ok(Some(chunk)) => {
+                        data.extend_from_slice(&chunk);
+                        if data.len() > MAX_SIZE {
+                            return Ok(HttpResponse::BadRequest().json(serde_json::json!({
+                                "error": "File too large (max 5MB)"
+                            })));
+                        }
+                    }
+                    Ok(None) => break,
+                    Err(e) => {
+                        log::warn!("file read error: {}", e);
+                        return Ok(HttpResponse::BadRequest()
+                            .json(serde_json::json!({"error":"Invalid file upload"})));
+                    }
+                }
+            }
+
+            // If content-type was ambiguous, try to infer from magic bytes
+            if ext_guess.is_none() && data.len() >= 4 {
+                if data.starts_with(&[0x89, b'P', b'N', b'G']) {
+                    ext_guess = Some("png");
+                } else if data.starts_with(b"GIF87a") || data.starts_with(b"GIF89a") {
+                    ext_guess = Some("gif");
+                }
+            }
+
+            if ext_guess.is_none() {
+                return Ok(HttpResponse::BadRequest().json(serde_json::json!({
+                    "error": "Unsupported file type (only PNG or GIF)"
+                })));
+            }
+
+            file_ext = ext_guess;
+            file_bytes = Some(data);
+        }
+    }
+
+    let data = match file_bytes {
+        Some(d) => d,
+        None => {
+            return Ok(HttpResponse::BadRequest().json(serde_json::json!({
+                "error": "Missing file field"
+            })));
+        }
+    };
+    let ext = file_ext.unwrap_or("png");
+
+    // Sanitize/derive filename
+    let base = desired_name.unwrap_or_else(|| format!("emoji_{}", chrono::Utc::now().timestamp()));
+    let mut safe: String = base
+        .chars()
+        .filter(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '-')
+        .collect();
+    if safe.is_empty() {
+        safe = "emoji".to_string();
+    }
+    let mut filename = format!("{}.{}", safe.to_lowercase(), ext);
+
+    // Ensure directory exists and avoid overwrite
+    let dir = std::path::Path::new(&app_config.emoji_dir);
+    if let Err(e) = std::fs::create_dir_all(dir) {
+        log::error!("Failed to create emoji dir {}: {}", app_config.emoji_dir, e);
+        return Ok(HttpResponse::InternalServerError().json(serde_json::json!({
+            "error": "Filesystem error"
+        })));
+    }
+
+    let mut path = dir.join(&filename);
+    if path.exists() {
+        for i in 1..1000 {
+            filename = format!("{}-{}.{}", safe.to_lowercase(), i, ext);
+            path = dir.join(&filename);
+            if !path.exists() {
+                break;
+            }
+        }
+    }
+
+    if let Err(e) = std::fs::write(&path, &data) {
+        log::error!("Failed to save emoji to {:?}: {}", path, e);
+        return Ok(HttpResponse::InternalServerError().json(serde_json::json!({
+            "error": "Write failed"
+        })));
+    }
+
+    let url = format!("/emojis/{}", filename);
+    Ok(HttpResponse::Ok().json(serde_json::json!({
+        "success": true,
+        "filename": filename,
+        "url": url
+    })))
 }
 
 /// Get the DIDs of accounts the logged-in user follows