Lightweight concurrent file server with one-time authentication codes.

go get github.com/go-chi/chi/v5
go run main.go

Server runs on :8080. Creates ./uploads on startup.

Pass codes via X-Upload-Code header. Each code works once - any request (even failed ones) burns it.

Default codes: 123, 456, 789

POST /upload
Body: multipart/form-data with file field
Response: {"body": "file successfully uploaded"}

GET /files
Response: Plain text list of filenames (one per line)

GET /files/{filename}
Response: File download (binary)

Limits: 50MB max upload, 30s timeout per request

# Upload
curl -H "X-Upload-Code: 123" \
     -F "[email protected]" \
     http://localhost:8080/upload

# List files
curl -H "X-Upload-Code: 456" \
     http://localhost:8080/files

# Download
curl -H "X-Upload-Code: 789" \
     -O http://localhost:8080/files/data.json

Middleware chain:

1. OneTimeCodeAuth - validates and consumes code (mutex-protected, runs on ALL routes)
2. RequestID - traces each request
3. Timeout - enforces 30s deadline
4. LogWithRequestID - logs latency and request ID to stdout

Codes stored in-memory. No persistence between restarts.

Security notes:

• Middleware applies globally - every endpoint requires a valid code
• filepath.Base() sanitization prevents path traversal attacks
• MaxBytesReader enforces size limits before parsing

MIT