Via the built-in creation module we can POST to get a URL to start sending PATCH requests.

In the initial POST we check that the size of file is not larger than :max-upload-size, but we fail to check the accumulated size on the following PATCH requests.

According to the tus 1.0.0 specification, the HEAD method (https://tus.io/protocols/resumable-upload.html#head) states that:

The Server MUST prevent the client and/or proxies from caching the response by adding the Cache-Control: no-store header to the response.

But the code currently only sets the "Upload-Offset", "Upload-Length" and "Upload-Metadata" headers if the uploading file is found, or none if not.

We try to build a correct location after a POST request to start the PATCH process. If you're running the app server behind a reverse proxy (e.g. nginx) there are some complexities regarding how to proper build the correct Location: for the PATCH requests.

Depending of the browser Origin or Host requests are sent (e.g. Firefox doesn't send the Origin one)

We need to take into account the presence or not of:

• X-Forwarded-Host
• X-Forwarded-Proto
• Origin
• Host (it may include port, e.g. host:port)
• Fallback to :server-name, :server-port and :scheme

As of released version 1.27.7406c5e5be3ccd6d9e1f99d29f05ab1251682de7 the visible problem in a local development setup was that the server was returning the wrong server port and not the one present in Host header.

Getting java.lang.IndexOutOfBoundsException when trying to use (org.akvo.resumed-test/res-to-byte-array [path off len]) function
https://github.com/akvo/resumed/blob/master/test/org/akvo/resumed_test.clj#L12-L21

(res-to-byte-array "resources/pg11.txt" 10 10)

1. Unhandled java.lang.IndexOutOfBoundsException
   (No message)

  BufferedInputStream.java:  338  java.io.BufferedInputStream/read
          resumed_test.clj:   20  org.akvo.resumed-test/res-to-byte-array
          resumed_test.clj:   13  org.akvo.resumed-test/res-to-byte-array
                      REPL:   31  org.akvo.resumed-test/eval9202
                      REPL:   31  org.akvo.resumed-test/eval9202
             Compiler.java: 6927  clojure.lang.Compiler/eval
             Compiler.java: 6890  clojure.lang.Compiler/eval
                  core.clj: 3105  clojure.core/eval
                  core.clj: 3101  clojure.core/eval
                  main.clj:  240  clojure.main/repl/read-eval-print/fn
                  main.clj:  240  clojure.main/repl/read-eval-print
                  main.clj:  258  clojure.main/repl/fn
                  main.clj:  258  clojure.main/repl
                  main.clj:  174  clojure.main/repl
               RestFn.java: 1523  clojure.lang.RestFn/invoke
    interruptible_eval.clj:   79  nrepl.middleware.interruptible-eval/evaluate
    interruptible_eval.clj:   55  nrepl.middleware.interruptible-eval/evaluate
    interruptible_eval.clj:  142  nrepl.middleware.interruptible-eval/interruptible-eval/fn/fn
                  AFn.java:   22  clojure.lang.AFn/run
               session.clj:  171  nrepl.middleware.session/session-exec/main-loop/fn
               session.clj:  170  nrepl.middleware.session/session-exec/main-loop
                  AFn.java:   22  clojure.lang.AFn/run
               Thread.java:  748  java.lang.Thread/run

So far solved using skip in the implementation

(defn res-to-byte-array
  "Reads a resource file to a byte array
  Attribution: http://stackoverflow.com/a/26791567"
  ([path off len]
   (let [f (io/file (io/resource path))
         ba (byte-array len)
         is (io/input-stream f)]
     (.skip is off)
     (.read is ba 0 len)
     (.close is)
     ba))
  ([path]
   (let [f (io/file (io/resource path))
         ba (byte-array (.length f))
         is (io/input-stream f)]
     (.read is ba)
     (.close is)
     ba)))

The file upload on akvo-lumen is broken since we enabled tls. The reason is that org.akvo.resumed/get-location returns http://... instead of https://.... I.e., the heuristics to derive the correct location does not work on GKE currently.

The google load balancer sets the headers x-forwarded-proto and x-forwarded-for but not x-forwarded-host. It does however include a host header that we can fall back to if x-forwarded-host is missing.