Arthur Hovhannisyan

Axum multipart chunks are written from the network buffer straight to a file inside a per-request TempDir, removed on drop whether the request succeeds or fails. The filename is reduced with Path::file_name so a crafted name cannot escape the directory, the body limit comes from configuration, and empty payloads are rejected.

Memory stays flat regardless of video size, and there is no cleanup branch to forget: when the handler returns or errors, the temporary directory goes with it.

The first version piped request chunks directly into ffprobe's stdin to skip the disk entirely. It lost context: container metadata often needs seeking, which a pipe cannot offer. Arthur went back to file-based inspection rather than forcing the streaming design.

ffprobe's JSON output is deserialized and mapped into a typed response, so the frontend receives a stable contract instead of raw tool output.

ffmpeg runs through tokio::process with kill_on_drop(true), -nostdin, and -progress pipe:2. Stderr is parsed for frame and fps progress, and wait() is wrapped in a Tokio timeout, so a hung encode or a dropped client request never leaves an orphaned process.

The compression preset is fixed in code: libx264 at CRF 23 with AAC audio at 128k. The output streams back through ReaderStream as an attachment carrying the original filename.

Routes are annotated with utoipa, and a dedicated openapi_generator binary emits the spec the frontend TypeScript types are generated from. A pre-push hook and CI fail on drift. Errors are layered: DomainError, ServerError, and an ApplicationError that maps onto HTTP responses.

Rate limiting through tower_governor keys on the real client IP behind nginx with SmartIpKeyExtractor, and is enabled only in production.