Gallery Uploads V1

A deliberately small WordPress plugin for distributing a client's original photo-gallery ZIP.

What V1 does

• Adds Media → Gallery Uploads for administrators only.
• Normalizes the gallery name into a page slug.
• Uses WordPress to create short-lived S3 multipart URLs.
• Sends File.slice() blobs from the browser directly to private S3 with at most four requests in flight.
• Never opens, lists, reads, or extracts the ZIP.
• Completes the upload, verifies its byte size, and creates a published password-protected page.
• Gives an unlocked client a fresh 15-minute S3 download redirect.

V2—extracting photos and rendering a gallery—is intentionally absent.

Local setup

Prerequisites: Docker Desktop, Node/pnpm, Composer (or Docker), and the manual AWS setup in docs/AWS-SETUP.md.

Copy-Item config/gallery-uploads-local-secrets.example.php .local/gallery-uploads-local-secrets.php
Copy-Item .wp-env.override.example.json .wp-env.override.json
composer install
pnpm install
pnpm dev

Enter the bucket, region, prefix, and replacement access key in the ignored .local/gallery-uploads-local-secrets.php. Do not put deployment configuration or secrets in .wp-env.json, source code, chat, screenshots, or Git.

Open http://localhost:8890/wp-admin/upload.php?page=gallery-uploads and sign in with wp-env's admin / password.

Fast iteration loop

1. Keep pnpm dev running.
2. Ask the AI session for one small behavior or presentation change and name the acceptance check.
3. Refresh the Gallery Uploads admin page. PHP, JS, and CSS are mounted live; asset file timestamps bust the browser cache.
4. Run pwsh -File scripts/check-fast.ps1.
5. For changes to upload, completion, password, or download behavior, do the tiny remote-S3 smoke in DOGFOOD.md.
6. Review git diff before keeping the change.

The fast checks must not write S3. The remote smoke is a milestone check because completed objects are intentionally not deletable by this IAM principal.

Deployment boundary

pwsh -File scripts/package-plugin.ps1 creates build/gallery-uploads.zip with production Composer dependencies. Install that ZIP on WordPress, then define the five server constants in wp-config.php (or a host-managed secret include):

define('GALLERY_UPLOADS_S3_BUCKET', 'YOUR_BUCKET_NAME');
define('GALLERY_UPLOADS_AWS_REGION', 'YOUR_AWS_REGION');
define('GALLERY_UPLOADS_S3_PREFIX', 'live/galleries/');
define('GALLERY_UPLOADS_AWS_ACCESS_KEY_ID', '...');
define('GALLERY_UPLOADS_AWS_SECRET_ACCESS_KEY', '...');

Add the production site's exact HTTPS origin to S3 CORS before the first production upload. Deployment to the live WordPress host is not automatic because this repository has no host credentials or deployment target.

Publish a new GitHub repository

Create an empty GitHub repository without adding a README, .gitignore, or license, then run from this checkout:

git remote add origin https://github.com/YOUR-ACCOUNT/YOUR-REPOSITORY.git
git push -u origin HEAD:main

HEAD:main intentionally publishes the tested feature branch as the new repository's main branch. Do not push the older local master branch.