feat: attach screenshots to pull comments (Closes #515)

src/gitea_proxy.py

@@ -920,6 +920,33 @@ async def upload_assigned_issue_attachment(
     return {"name": name, "url": url, "size": size}
 
 
+async def upload_assigned_pull_attachment(
+    repository: str,
+    number: int,
+    filename: str,
+    content_type: str,
+    content: bytes,
+) -> dict:
+    if not await is_assigned_pull(repository, number):
+        raise IssueNotAvailableError("Assigned pull request not found")
+    response = await _get_client().post(
+        f"/api/v1/repos/{repository}/issues/{number}/assets",
+        headers=_auth(),
+        params={"name": filename},
+        files={"attachment": (filename, content, content_type)},
+    )
+    response.raise_for_status()
+    attachment = response.json()
+    if not isinstance(attachment, dict):
+        raise ValueError("Gitea attachment response was not an object")
+    name = attachment.get("name")
+    url = _safe_web_url(attachment.get("browser_download_url"))
+    size = attachment.get("size")
+    if not isinstance(name, str) or not name or not url or not isinstance(size, int):
+        raise ValueError("Gitea did not confirm the attachment")
+    return {"name": name, "url": url, "size": size}
+
+
 async def repo_labels(repository: str) -> list[dict]:
     response = await _get_client().get(
         f"/api/v1/repos/{repository}/labels",

src/main.py

@@ -3468,6 +3468,67 @@ async def attach_to_assigned_issue(
     return JSONResponse(result, status_code=201)
 
 
+@app.post("/api/v1/repos/{owner}/{repo}/pulls/{number}/attachments", status_code=201)
+async def attach_to_assigned_pull(
+    request: Request,
+    owner: str,
+    repo: str,
+    number: int = PathParam(gt=0),
+    idempotency_key: str | None = Header(default=None, max_length=128),
+):
+    repository = f"{owner}/{repo}"
+    try:
+        if request.headers.get("content-type", "").lower().startswith("multipart/form-data"):
+            form = await request.form()
+            uploaded = form.get("file")
+            if not isinstance(uploaded, UploadFile):
+                raise ValueError("screenshot file is required")
+            filename = str(uploaded.filename or "")
+            content_type = str(uploaded.content_type or "")
+            content = _validate_binary_attachment(filename, content_type, await uploaded.read())
+        else:
+            attachment = IssueAttachment.model_validate(await request.json())
+            filename = attachment.filename
+            content_type = attachment.content_type
+            content = attachment.content()
+    except (ValueError, ValidationError) as exc:
+        raise HTTPException(status_code=422, detail=str(exc)) from exc
+
+    async def upload_attachment():
+        result = await gitea_proxy.upload_assigned_pull_attachment(
+            repository, number, filename, content_type, content
+        )
+        safe_name = (
+            result["name"].replace("\\", "\\\\").replace("[", "\\[").replace("]", "\\]")
+            .replace("\r", " ").replace("\n", " ")
+        )
+        safe_url = result["url"].replace("<", "%3C").replace(">", "%3E")
+        result["markdown"] = f"![{safe_name}](<{safe_url}>)"
+        return result
+
+    try:
+        result = await _run_idempotent_authored_action(
+            upload_attachment(),
+            idempotency_key=idempotency_key,
+            fingerprint=(
+                "pull-attachment", repository, number, filename, content_type,
+                hashlib.sha256(content).hexdigest(),
+            ),
+            timeout=ISSUE_ACTION_TIMEOUT_SECONDS,
+        )
+    except gitea_proxy.IssueNotAvailableError as exc:
+        raise HTTPException(status_code=404, detail="Assigned pull request not found") from exc
+    except HTTPException:
+        raise
+    except Exception:
+        return JSONResponse(
+            {"error": "The screenshot could not be uploaded. Your draft is safe; please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    return JSONResponse(result, status_code=201)
+
+
 @app.patch("/api/v1/repos/{owner}/{repo}/issues/{number}/close")
 async def close_assigned_issue(
     request: Request,

src/request_boundary.py

@@ -18,7 +18,7 @@ def request_body_limit(method: str, path: str) -> int | None:
     if (
         normalized_method == "POST"
         and path.startswith("/api/v1/repos/")
-        and "/issues/" in path
+        and ("/issues/" in path or "/pulls/" in path)
         and path.endswith("/attachments")
     ):
         return ISSUE_ATTACHMENT_BODY_LIMIT