Next

[bctzl]

感谢你为 Forumlify 提交贡献！/ Thank you for contributing to Forumlify!

目标分支 / Target branch

你提交的代码是基于哪个分支？/ Which branch is your code based on?

• Lite（原生单文件版 / Original single-file version）
• next（Next.js 16 版 / Next.js 16 version）

⚠️ 请确保 PR 的 base 分支与你的代码来源分支一致。/ Please make sure the PR's base branch matches the branch your code comes from.

版本信息 / Version info

后台版本号 / Backend version (admin only):

（在此粘贴后台显示的版本号 / Paste the version shown in the admin panel here）

变更内容 / What does this PR do?

动机 / Motivation

测试 / Testing

• 本地构建通过 / Local build passes (npm run build，仅 next 分支 / next branch only)
• 相关功能已手动测试 / Related features manually tested
• 测试用例已更新 / Tests updated

截图 / Screenshots

检查清单 / Checklist

• 我已阅读并遵循了贡献指南 / I have read and followed the contributing guidelines
• 我的代码遵循现有代码风格 / My code follows the existing code style
• 我已同步最新的上游分支 / I have synced with the latest upstream branch
• 本 PR 只包含必要的改动 / This PR contains only the necessary changes

[forumlify]

Automated review has started. I am checking this pull request now.

⚙️ Runtime environment

• Mode: GitHub Actions (pull_request_target / opened)
• Runner: Linux / x64 · Node.js v24.20.0
• goose: v1.46.0 · model deepseek-v4-flash-0731 · thinking effort medium
• Review policy: allow · strictness normal · max patch 120000 chars
• Automation: auto-merge off · conflict repair on
• Cache: R2 enabled · repository knowledge enabled

🤖 Created By GHBot

[forumlify]

Automated review could not complete for commit 8db6e772b514. A maintainer can inspect the failed Actions run or comment /recheck after the problem is corrected.

⚙️ Runtime environment

• Mode: GitHub Actions (pull_request_target / synchronize)
• Runner: Linux / x64 · Node.js v24.20.0
• goose: v1.46.0 · model deepseek-v4-flash-0731 · thinking effort medium
• Review policy: allow · strictness normal · max patch 120000 chars
• Automation: auto-merge off · conflict repair on
• Cache: R2 enabled · repository knowledge enabled

🤖 Created By GHBot

[lezi-fun]

Request changes

Please address the following storage regressions before merging:

1. Blocking — Cloudflare uploads may fall back to non-persistent local storage. Removing FORUMLIFY_BUCKET and NEXT_INC_CACHE_R2_BUCKET from wrangler.jsonc leaves lib/storage.js with a silent fallback to local when IMGBED_API and IMGBED_AUTH are not configured. On Cloudflare Workers, process.cwd()/uploads is not durable storage, so uploads can fail or disappear after a restart or rescheduling. Please keep and configure the R2 bindings, or fail explicitly when a supported external storage backend is not configured.

2. Blocking — External upload and read paths are inconsistent. Uploads return the src supplied by ImgBed, but getObject(name) reconstructs a URL from IMGBED_BASE + name. If ImgBed rewrites the path or filename, /api/uploads/[name] cannot reliably read the object that was just uploaded. Please persist the returned URL or storage path, or make the read path use the actual returned URL.

3. High — External deletion is silently skipped. deleteObject does nothing in external mode, leaving orphaned files on the image host after users delete attachments. Please persist the path/sha needed by ImgBed and implement deletion, or explicitly document and model this lifecycle limitation.

Also, placing authCode in the query string can expose it to proxy and access logs. Use an authentication header if ImgBed supports one, and add integration tests for each storage mode.