Secure browser video uploads

curl --fail-with-body -X POST \
  'https://api.stackshift.cloud/api/v1/assets/upload-capabilities' \
  -H "Authorization: Bearer $STACKSHIFT_ASSETS_TOKEN" \
  -H "X-Asset-Space-ID: $STACKSHIFT_ASSET_SPACE_ID" \
  -H 'Content-Type: application/json' \
  --data '{
    "bucket": "customer-videos",
    "key_prefix": "users/user_123",
    "allowed_mime_types": ["video/mp4", "video/webm"],
    "allowed_origins": ["https://app.example.com"],
    "max_bytes": 104857600,
    "allow_remote_url": false,
    "expires_in": "15m"
  }'

async function uploadVideo(file, token, key) {
  const base = 'https://api.stackshift.cloud/assets/widget';
  async function call(path, init = {}) {
    const response = await fetch(base + path, {
      ...init,
      headers: { Authorization: `Bearer ${token}`, ...init.headers },
    });
    const body = await response.json();
    if (!response.ok || body.success === false) {
      throw new Error(`Upload failed: HTTP ${response.status}`);
    }
    return body.data;
  }
  const session = await call('/sessions', {
    method: 'POST', headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      key, file_name: file.name, file_size: file.size,
      mime_type: file.type, part_size: 5 * 1024 * 1024,
    }),
  });
  for (let offset = 0, part = 1; offset < file.size;
       offset += session.part_size, part++) {
    const chunk = file.slice(offset, offset + session.part_size);
    const digest = await crypto.subtle.digest('SHA-256', await chunk.arrayBuffer());
    const checksum = Array.from(new Uint8Array(digest),
      byte => byte.toString(16).padStart(2, '0')).join('');
    await call(`/uploads/${encodeURIComponent(session.upload_session_id)}/parts/${part}`, {
      method: 'PUT', headers: { 'X-Content-SHA256': checksum }, body: chunk,
    });
  }
  return call('/sessions/current/complete', { method: 'POST' });
}