feat: file/screenshot attachments on support tickets (v0.49.1)

Support form now accepts up to 5 attachments (images, PDF, text, JSON,
zip; 10MB each) via the existing S3/MinIO presigned-upload flow. New
support_ticket_attachments table; attachment links get folded into the
Gitea issue body and shown as thumbnails in both the user's ticket
history and the admin support view.

New presign endpoint (/api/v1/support/attachments/presign, rate-limited
20/hr) scoped to the uploading user rather than a ticket id, since the
ticket doesn't exist yet at upload time.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/support/route.ts

@@ -1,28 +1,44 @@
 import { NextRequest, NextResponse } from "next/server";
 import crypto from "node:crypto";
 import { z } from "zod";
-import { db, supportTickets, eq, desc } from "@epicure/db";
+import { db, supportTickets, supportTicketAttachments, eq, desc } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { sendEmail, supportTicketReceivedHtml } from "@/lib/email";
 import { createGiteaIssue } from "@/lib/gitea";
+import { getPublicUrl, isOwnedSupportAttachmentKey } from "@/lib/storage";
+
+const MAX_ATTACHMENTS = 5;
 
 const CreateTicketBody = z.object({
   type: z.enum(["bug", "suggestion", "question"]),
   title: z.string().trim().min(3).max(200),
   description: z.string().trim().min(10).max(5000),
+  attachments: z
+    .array(z.object({
+      key: z.string().min(1).max(500),
+      contentType: z.string().min(1).max(100),
+      sizeBytes: z.number().int().positive(),
+    }))
+    .max(MAX_ATTACHMENTS)
+    .default([]),
 });
 
 export async function GET() {
   const { session, response } = await requireSession();
   if (response) return response;
 
-  const rows = await db
-    .select()
-    .from(supportTickets)
-    .where(eq(supportTickets.userId, session!.user.id))
-    .orderBy(desc(supportTickets.createdAt));
+  const rows = await db.query.supportTickets.findMany({
+    where: eq(supportTickets.userId, session!.user.id),
+    orderBy: desc(supportTickets.createdAt),
+    with: { attachments: true },
+  });
 
-  return NextResponse.json(rows);
+  return NextResponse.json(
+    rows.map((r) => ({
+      ...r,
+      attachments: r.attachments.map((a) => ({ ...a, url: getPublicUrl(a.storageKey) })),
+    }))
+  );
 }
 
 export async function POST(req: NextRequest) {
@@ -38,14 +54,28 @@ export async function POST(req: NextRequest) {
     );
   }
 
-  const { type, title, description } = parsed.data;
+  const { type, title, description, attachments } = parsed.data;
+
+  for (const a of attachments) {
+    if (!isOwnedSupportAttachmentKey(a.key, session!.user.id)) {
+      return NextResponse.json({ error: "Invalid attachment" }, { status: 400 });
+    }
+  }
+
   const id = crypto.randomUUID();
   const now = new Date();
 
+  const attachmentLinks = attachments.map((a) => getPublicUrl(a.key));
+  const giteaBody = [
+    description,
+    attachmentLinks.length > 0 ? `\n**Attachments:**\n${attachmentLinks.map((u) => `- ${u}`).join("\n")}` : "",
+    `\n---\nReported via Epicure support form by user \`${session!.user.id}\`.`,
+  ].join("\n");
+
   const { url: giteaIssueUrl, error: giteaError } = await createGiteaIssue({
     type,
     title,
-    body: `${description}\n\n---\nReported via Epicure support form by user \`${session!.user.id}\`.`,
+    body: giteaBody,
   });
 
   await db.insert(supportTickets).values({
@@ -61,6 +91,19 @@ export async function POST(req: NextRequest) {
     updatedAt: now,
   });
 
+  if (attachments.length > 0) {
+    await db.insert(supportTicketAttachments).values(
+      attachments.map((a) => ({
+        id: crypto.randomUUID(),
+        ticketId: id,
+        storageKey: a.key,
+        contentType: a.contentType,
+        sizeBytes: a.sizeBytes,
+        createdAt: now,
+      }))
+    );
+  }
+
   const baseUrl = process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000";
   const ticketUrl = `${baseUrl}/support`;
   if (session!.user.email) {
@@ -87,6 +130,13 @@ export async function POST(req: NextRequest) {
       giteaError,
       createdAt: now.toISOString(),
       updatedAt: now.toISOString(),
+      attachments: attachments.map((a) => ({
+        id: "",
+        storageKey: a.key,
+        contentType: a.contentType,
+        sizeBytes: a.sizeBytes,
+        url: getPublicUrl(a.key),
+      })),
     },
     { status: 201 }
   );