A custom version of Busboy is currently used to handle file uploads. A Busboy instance is made available as FloraRequest.data if the request content type is neither application/json nor x-www-form-urlencoded.

The problem here is that the Busboy instance starts emitting events immediately, which only works when there is no asynchronous plugin in the chain. Authentication (among other things) may introduce asynchronous handling (tokens/permissions may need to be checked asynchronously), which leads to events being missed.

File upload handling using Busboy (via request.data) does not work when requests are authenticated.

As solution, Busboy will be completely removed from Flora. Resources that currently the Busboy instance in request.data can be modified to use Busboy directly:

Before:

myAction: function (request, response) {
    const busboy = request.data;
    if (!(busboy instanceof Writable)) throw RequestError('Missing payload');

    return new Promise((resolve, reject) => {
        busboy.on('file', (fieldName, file, filename, encoding, mimetype) => ...

After:

const Busboy = require('@godmodelabs/busboy');

myAction: function (request, response) {
    return new Promise((resolve, reject) => {
        const busboy = new Busboy({ headers: request._httpRequest.headers });

        busboy.on('error', (err) => reject(err));
        busboy.on('file', (fieldName, file, filename, encoding, mimetype) => ...

        request._httpRequest.pipe(busboy);

This is a breaking change and requires a new major version.