feat: attach screenshots to update replies (Closes #527)

src/gitea_proxy.py

@@ -892,6 +892,43 @@ async def reply_to_notification(thread_id: int, body: str) -> dict:
     return _normalize_issue_comment(comment)
 
 
+async def upload_notification_attachment(
+    thread_id: int, filename: str, content_type: str, content: bytes
+) -> dict:
+    """Upload to the exact issue or pull identified by a trusted notification."""
+    thread = await fetch(f"notifications/threads/{thread_id}")
+    if not isinstance(thread, dict):
+        raise ValueError("Gitea notification thread response was not an object")
+    repository = thread.get("repository")
+    subject = thread.get("subject")
+    if not isinstance(repository, dict) or not isinstance(subject, dict):
+        raise ValueError("Notification does not identify a conversation")
+    subject_path = _gitea_api_path(subject.get("url"))
+    match = re.fullmatch(r"repos/([^/]+/[^/]+)/(issues|pulls)/(\d+)", subject_path)
+    if (
+        not match
+        or match.group(1) != repository.get("full_name")
+        or subject.get("type") not in {"Issue", "Pull"}
+    ):
+        raise ValueError("Notification subject is not a supported conversation")
+    # Gitea stores pull-request assets on its shared issue asset endpoint.
+    response = await _get_client().post(
+        f"/api/v1/repos/{match.group(1)}/issues/{match.group(3)}/assets",
+        headers=_auth(), params={"name": filename},
+        files={"attachment": (filename, content, content_type)},
+    )
+    response.raise_for_status()
+    attachment = response.json()
+    if not isinstance(attachment, dict):
+        raise ValueError("Gitea attachment response was not an object")
+    name = attachment.get("name")
+    url = _safe_web_url(attachment.get("browser_download_url"))
+    size = attachment.get("size")
+    if not isinstance(name, str) or not name or not url or not isinstance(size, int):
+        raise ValueError("Gitea did not confirm the attachment")
+    return {"name": name, "url": url, "size": size}
+
+
 async def close_issue(repository: str, number: int) -> dict:
     response = await _get_client().patch(
         f"/api/v1/repos/{repository}/issues/{number}",

src/main.py

@@ -2991,6 +2991,60 @@ async def reply_to_notification(
     return JSONResponse(result, status_code=201)
 
 
+@app.post("/api/v1/notifications/{thread_id}/attachments", status_code=201)
+async def attach_to_notification(
+    request: Request,
+    thread_id: int = PathParam(gt=0),
+    idempotency_key: str | None = Header(default=None, max_length=128),
+) -> JSONResponse:
+    try:
+        if request.headers.get("content-type", "").lower().startswith("multipart/form-data"):
+            form = await request.form()
+            uploaded = form.get("file")
+            if not isinstance(uploaded, UploadFile):
+                raise ValueError("screenshot file is required")
+            filename = str(uploaded.filename or "")
+            content_type = str(uploaded.content_type or "")
+            content = _validate_binary_attachment(filename, content_type, await uploaded.read())
+        else:
+            attachment = IssueAttachment.model_validate(await request.json())
+            filename = attachment.filename
+            content_type = attachment.content_type
+            content = attachment.content()
+    except (ValueError, ValidationError) as exc:
+        raise HTTPException(status_code=422, detail=str(exc)) from exc
+
+    async def upload_attachment():
+        result = await gitea_proxy.upload_notification_attachment(
+            thread_id, filename, content_type, content
+        )
+        safe_name = (
+            result["name"].replace("\\", "\\\\").replace("[", "\\[").replace("]", "\\]")
+            .replace("\r", " ").replace("\n", " ")
+        )
+        safe_url = result["url"].replace("<", "%3C").replace(">", "%3E")
+        result["markdown"] = f"![{safe_name}](<{safe_url}>)"
+        return result
+
+    try:
+        result = await _run_idempotent_authored_action(
+            upload_attachment(), idempotency_key=idempotency_key,
+            fingerprint=("notification-attachment", thread_id, filename, content_type,
+                         hashlib.sha256(content).hexdigest()),
+            timeout=NOTIFICATION_MUTATION_TIMEOUT_SECONDS,
+        )
+    except HTTPException:
+        raise
+    except ValueError as exc:
+        raise HTTPException(status_code=422, detail=str(exc)) from exc
+    except Exception:
+        return JSONResponse(
+            {"error": "The screenshot could not be uploaded. Your draft is safe; please retry."},
+            status_code=503, headers={"Retry-After": "1"},
+        )
+    return JSONResponse(result, status_code=201)
+
+
 @app.patch("/api/v1/repos/{owner}/{repo}/issues/{number}/claim")
 async def claim_available_issue(
     owner: str, repo: str, number: int = PathParam(gt=0)

src/request_boundary.py

@@ -17,8 +17,10 @@ def request_body_limit(method: str, path: str) -> int | None:
         return SESSION_BODY_LIMIT
     if (
         normalized_method == "POST"
-        and path.startswith("/api/v1/repos/")
-        and ("/issues/" in path or "/pulls/" in path)
+        and (
+            (path.startswith("/api/v1/repos/") and ("/issues/" in path or "/pulls/" in path))
+            or path.startswith("/api/v1/notifications/")
+        )
         and path.endswith("/attachments")
     ):
         return ISSUE_ATTACHMENT_BODY_LIMIT