Repository navigation
Staged uploads: itglue_request_upload + upload_id (memory / Azure Blob) - #18
Merged
Merged
Conversation
…/ Azure Blob)
Tool arguments travel through the model, so content_base64 only works for
tiny files — a screenshot is megabytes of base64 the model has to reproduce
token by token, and file_path cannot reach a client's disk from a hosted
server. Staged uploads hand the client a place to PUT the real bytes:
itglue_request_upload → { upload_id, url, headers, curl }
client PUTs the file → itglue_create_document_image / itglue_create_attachment
with upload_id, and the server reads the bytes itself.
Two backends behind one UploadStore (src/uploads/), chosen by UPLOAD_STAGING:
memory PUT to this server's /upload/:id with the same auth as /mcp
(needs PUBLIC_BASE_URL). Default on http.
azure-blob PUT to a 15-minute single-blob SAS on Azure Blob Storage; the
server later downloads and deletes the blob with its own
credentials (connection string, or DefaultAzureCredential with a
user-delegation SAS). For servers behind a gateway. SDKs are
lazy-imported so other modes never load them.
Slots are bound to the principal (role|label|keyHash), expire after 15 min
and are consumed once; blob names are namespaced by a principal hash.
Verified live against ndrmcpstore: SAS PUT 201, server-side download, IT Glue
upload with the original file name, second use rejected, blob removed.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A client cannot get a real file into
itglue_create_document_image/itglue_create_attachment:content_base64travels through the model — megabytes of base64 typed token by token, usually truncated (yesterday'sNotIdentifiedByImageMagickError).file_pathreads the server's disk, which on a hosted deployment is not the client's.urlneeds somewhere Azure-reachable to host the file first.Design
itglue_request_uploadreturns a one-time slot:upload_id, aPUTURL, required headers and a ready-to-runcurl. The client PUTs the bytes from a shell; the model then passesupload_id(new fourth source inbinary-input.ts). Slots live 15 minutes, are bound to the requesting principal (role|label|keyHash), and are consumed once.Two
UploadStorebackends (src/uploads/), selected byUPLOAD_STAGING:memory(default on http)PUT /upload/:id, same auth headers as/mcp;PUBLIC_BASE_URLbuilds the URLazure-blobAZURE_STORAGE_CONNECTION_STRING, orAZURE_STORAGE_ACCOUNTviaDefaultAzureCredential→ user-delegation SAS)off(default on stdio)file_pathalready works locallyAzure SDKs are lazy-imported inside
createAzureBlobBackend, so stdio/memory deployments never load them. Blob names are<principal-hash>/<upload_id>; malformed ids never touch storage; an hourly-ish sweep removes orphans (plus a 1-day lifecycle rule on our container).Verified
/uploadroute on a real listener (401/403/404/409/400),upload_idresolution errors, the tool's curl output and tiering.ndrmcpstorefrom a local http server: SAS PUT → 201,itglue_create_document_image(upload_id)uploadedlogo.pngto doc 24183083 with the right name, second use rejected, blob gone, test image deleted.Also: server instructions rewritten for the image/attachment split, README section,
server.jsonenv vars, CLAUDE.md.🤖 Generated with Claude Code