From b138efa8176e120d55d2ab6ebe63f2c58ca10deb Mon Sep 17 00:00:00 2001
From: Ricardo <rick@rmendes.net>
Date: Sun, 29 Mar 2026 16:28:23 +0200
Subject: [PATCH] fix: skip body parsers for multipart/form-data requests

express.json() and express.urlencoded() consume the request stream before
multer can read it, causing "Unexpected end of form" on media upload.
Skip these parsers when content-type is multipart/form-data.
---
 lib/mastodon/router.js | 15 ++++++++++++---
 package-lock.json      |  4 ++--
 package.json           |  2 +-
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/lib/mastodon/router.js b/lib/mastodon/router.js
index bd498a9..9cb25ca 100644
--- a/lib/mastodon/router.js
+++ b/lib/mastodon/router.js
@@ -67,9 +67,18 @@ export function createMastodonRouter({ collections, pluginOptions = {} }) {
 
   // ─── Body parsers ───────────────────────────────────────────────────────
   // Mastodon clients send JSON, form-urlencoded, and occasionally text/plain.
-  // These must be applied before route handlers.
-  router.use("/api", express.json());
-  router.use("/api", express.urlencoded({ extended: true }));
+  // Skip multipart/form-data requests — multer handles those in media routes.
+  // If express.json/urlencoded consume the stream first, multer gets nothing.
+  const jsonParser = express.json();
+  const urlencodedParser = express.urlencoded({ extended: true });
+  router.use("/api", (req, res, next) => {
+    if (req.is("multipart/form-data")) return next();
+    jsonParser(req, res, next);
+  });
+  router.use("/api", (req, res, next) => {
+    if (req.is("multipart/form-data")) return next();
+    urlencodedParser(req, res, next);
+  });
   router.use("/oauth", express.json());
   router.use("/oauth", express.urlencoded({ extended: true }));
 
diff --git a/package-lock.json b/package-lock.json
index 07704b3..b2262e5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@rmdes/indiekit-endpoint-activitypub",
-      "version": "3.11.1",
+      "version": "3.11.2",
       "license": "MIT",
       "dependencies": {
         "@fedify/debugger": "^2.1.0",
diff --git a/package.json b/package.json
index c146009..95fd27f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",