bitvid/VALIDATION_REPORT.md

Validation Report

This report documents the verification of user-facing documentation in /content against the codebase.

1. Storage Configuration (CORS)

Claim: Users must configure CORS with specific headers to allow browser uploads. Source: content/docs/guides/upload-content.md Code: js/storage/s3-multipart.js (function ensureBucketCors)

Verification: The ensureBucketCors function hardcodes the following CORS rules:

• AllowedHeaders: ["*"] (Matches docs)
• AllowedMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "OPTIONS"] (Matches docs, order irrelevant)
• ExposeHeaders: ["ETag", "Content-Length", "Content-Range", "Accept-Ranges"] (Matches docs)
• MaxAgeSeconds: 3600 (Matches docs)

The AllowedOrigins in code is dynamic (allowedOrigins variable), while the docs provide a concrete example (["http://localhost:5500", "https://bitvid.network"]) which is correct for users.

2. File Type Limits

Claim: Accepted file types are .mp4, .webm, .mov, .mkv, .ts, .m3u8, .mpg, .mpeg. Source: content/docs/guides/upload-content.md Code: components/upload-modal.html

Verification: The input element is defined as:

<input id="input-file" type="file" class="hidden" accept="video/*,.m3u8,.ts,.mp4,.webm,.mov,.mkv,.mpg,.mpeg" />

The documentation matches the specific extensions listed in the code. The docs now also clarify that "other standard video formats" are accepted via video/*.

3. File Size Limit

Claim: Recommended limit is 2GB due to browser memory. Source: content/docs/guides/upload-content.md Code: js/utils/torrentHash.js

Verification: The client-side hashing logic uses FileReader.readAsArrayBuffer(file). This loads the entire file into memory. Browser implementations (especially Chrome) typically crash or fail when allocating ArrayBuffers larger than ~2GB. This technical constraint confirms the documentation's warning.

4. Moderation (Whitelist Mode)

Claim: "Whitelist Mode" restricts visibility to approved accounts. Source: content/docs/guides/upload-content.md & getting-started.md Code: js/accessControl.js

Verification: The AccessControl class implements canAccess(candidate):

if (this.whitelistEnabled && !this.whitelistPubkeys.has(hex)) {
    return false;
}

If whitelistEnabled is true (Whitelist Mode), non-whitelisted pubkeys return false, blocking their content from being displayed in feeds that use this check. This confirms the documentation.

5. Upload Lifecycle

Claim: Direct upload to bucket -> Client-side hashing -> NIP-71/Nostr publication. Source: content/docs/guides/upload-content.md Code: js/ui/components/UploadModal.js

Verification: handleVideoSelection in UploadModal.js:

1. Calls service.uploadFile (Direct upload to R2/S3).
2. Calls generateTorrentMetadata (Client-side hashing).
3. Calls publish -> publishVideoNote (Nostr publication).

This flow matches the documentation exactly.