MINIMALIST Uploads for WPVibe

Description

MINIMALIST Uploads for WPVibe adds document upload endpoints for administrators using an existing WordPress REST connection. It is an independent extension, not an official WPVibe product. It can be called through WPVibe’s REST API tool or another authenticated REST client; WPVibe is not required to activate it.

• Upload PDF, Office, OpenDocument, RTF, TXT, CSV and ZIP files, subject to the site’s WordPress MIME policy.
• Maximum file size: the current WordPress upload limit, normally derived from PHP upload_max_filesize and post_max_size and any WordPress/multisite restrictions. Maximum chunk size: 1 MiB (1048576 decoded bytes); single-request upload: up to 2 MiB.
• HTTPS, an authenticated user and both manage_options and upload_files capabilities are required on every endpoint.
• SHA-256 transfer verification, user-bound upload sessions, sequential chunks and retry support.
• Temporary chunks are stored outside the known public website directories and expire after one hour. Cleanup runs hourly through WP-Cron and before a new upload.
• WordPress handles MIME validation and final Media Library import. Identical existing media of the same MIME type can be reused even after a filename change, without overwriting files.

The plugin does not publish posts, compress documents, extract ZIP archives, change application password or firewall policies, install software, or provide malware scanning. Optimize and review documents before sending them. HTTPS and an existing authorized WordPress authentication mechanism are required; the plugin creates no credentials.

Privacy and external services

The plugin itself makes no outbound requests, sends no telemetry and embeds no external assets. Upload bytes are sent by your chosen client to your WordPress site. Temporary session records contain the administrator’s user ID, filename, title, size, checksum, expiration time and, after completion, the attachment ID. Published Media Library files are normally publicly accessible; upload only documents intended for that audience.

If you choose to use WPVibe or another service to call the API, that service’s connection, privacy policy and terms apply separately. It is not required by this plugin and no third-party service is contacted automatically.

REST API

The compatibility namespace is /wpvibe-documents/v1. Send JSON and authenticate using the site’s existing authorized REST connection.

1. POST /start: filename (plain filename), size (integer bytes), sha256 (64 lowercase hexadecimal characters). Optionally send the first chunk_base64 and boolean auto_finish=true. The response returns upload_id, offset and chunk_bytes, or an existing attachment with complete=true.
2. POST /chunk: upload_id, offset (integer), chunk_base64 (canonical base64, at most chunk_bytes before encoding; currently 1 MiB). Use chunk_bytes from /start or /status to choose the chunk length; send a shorter final chunk when needed. Resume using the returned offset. Identical chunk retransmissions are accepted without duplicating bytes. With boolean auto_finish=true, the last chunk verifies and imports the document in the same request; retries return the completed attachment.
3. GET /status?upload_id=…: retrieve the current offset or completed attachment.
4. POST /finish: upload_id. Returns complete=true and attachment.id, url, title and mime_type after WordPress validation.
5. POST /cancel: upload_id. Cancels an unfinished session only; it never deletes completed media.

Files of at most 2 MiB can use POST /upload with filename, sha256 and content_base64 in one request. Do not include base64 data or authentication secrets in published posts.