AUS-34: Document Upload for Provenance Submissions — Technical Implementation

Overview

AUS-34 adds document upload support for provenance submissions. Curators can now attach supporting files (certificates, auction catalogs, gallery receipts, condition reports) when submitting or updating provenance for exhibition piece products.

Files Created/Modified

  • includes/class-document-tracker.php — New class handling file uploads, validation, storage, and CRUD operations
  • includes/class-database-migration.php — Schema bumped to 0.2.0, added ausstell_documents table
  • includes/class-api-router.php — Added 3 REST endpoints for document operations
  • includes/class-product-type.php — Added upload UI in admin panel + document display on frontend
  • admin/class-curator-dashboard.php — Added 3 AJAX handlers for upload/get/delete
  • admin/js/admin.js — Added document upload/delete UI logic
  • ausstellungsstuecke.php — Added DocumentTracker require

New Database Table: ausstell_documents

  • id (BIGINT, PK, AUTO_INCREMENT)
  • product_id (BIGINT, FK to posts.ID) — links to WooCommerce product
  • filename (VARCHAR 255) — sanitized storage name on disk
  • original_name (VARCHAR 255) — original filename as uploaded
  • file_url (VARCHAR 500) — accessible URL
  • file_size (BIGINT) — file size in bytes
  • file_type (VARCHAR 100) — MIME type (application/pdf, image/jpeg, image/png)
  • uploaded_by (BIGINT) — WP user ID of uploader
  • created_at, updated_at (DATETIME)

REST API Endpoints

MethodEndpointPermissionDescription
POST/wp-json/ausstell/v1/documents/{product_id}edit_productsUpload document(s)
GET/wp-json/ausstell/v1/documents/{product_id}edit_productsList documents for product
DELETE/wp-json/ausstell/v1/documents/{id}edit_productsDelete document by ID

Security Measures

  • Server-side MIME type validation via finfo_file() (not trusting client-provided MIME)
  • Extension whitelist: pdf, jpg, jpeg, png only
  • Max file size: 10MB per file (enforced server-side)
  • Filename sanitization strips path traversal attempts
  • Files stored in /uploads/ausstell-documents/product_{id}/ (not web root)
  • Path validation ensures files stay within designated uploads directory
  • Capability check: edit_products required for all operations
  • Nonce verification on all AJAX endpoints

Admin UI

On the WooCommerce product edit screen (Provenance & Auth tab), curators see:

  • File input field accepting multiple PDF/JPG/PNG files
  • Upload button (disabled until files are selected)
  • Document list showing filename, type icon, size, and delete button
  • Auto-loads existing documents on page load
  • Upload status messages (success/error)

Frontend Display

On the product page (exhibition piece products with provenance data), supporting documents are listed below the provenance details section, with type icon, filename, type label, and file size. Links open in a new tab.

Schema Version

Database schema version bumped from 0.1.0 to 0.2.0. The migration runs automatically on plugin activation and adds the new ausstell_documents table alongside existing tables.