Misc fixes and additions

backend/handlers/tus.go

@@ -90,7 +90,7 @@ func (h *TusHandler) Create(c *fiber.Ctx) error {
 	}
 
 	// Create temp file for the incomplete upload
-	tempDir := filepath.Join(h.Config.DataDir, "uploads")
+	tempDir := filepath.Join(h.Config.StorageDir, ".uploads")
 	os.MkdirAll(tempDir, 0755)
 	tempPath := filepath.Join(tempDir, uploadID)
 
@@ -196,7 +196,7 @@ func (h *TusHandler) Patch(c *fiber.Ctx) error {
 
 	// Check if upload is complete
 	if upload.Offset >= upload.FileSize {
-		go h.finalizeUpload(upload, c.IP())
+		h.finalizeUpload(upload, c.IP())
 	}
 
 	return c.SendStatus(fiber.StatusNoContent)

backend/main.go

@@ -88,11 +88,16 @@ func main() {
 		Format:     "${time} | ${status} | ${latency} | ${ip} | ${method} | ${path}\n",
 		TimeFormat: "2006-01-02 15:04:05",
 	}))
+	app.Use(func(c *fiber.Ctx) error {
+		c.Set("Cache-Control", "no-store, no-cache, must-revalidate")
+		return c.Next()
+	})
 	app.Use(helmet.New())
 	app.Use(cors.New(cors.Config{
 		AllowOrigins: "*",
-		AllowHeaders: "Origin, Content-Type, Accept, Authorization",
-		AllowMethods: "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+		AllowHeaders: "Origin, Content-Type, Accept, Authorization, Upload-Length, Upload-Offset, Upload-Metadata, Tus-Resumable",
+		AllowMethods: "GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD",
+		ExposeHeaders: "Location, Upload-Offset, Upload-Length, Tus-Resumable, Tus-Version, Tus-Extension, Tus-Max-Size",
 	}))
 
 	// === PUBLIC ROUTES (no auth) ===