FileUpload

@using Microsoft.AspNetCore.Http

<Form Model="Model" FormName="file-upload-photo" Multipart OnValidSubmit="Save" MaxWidth="26.Rem" Grow>
    <FileUpload Name="Avatar" Label="Profile photo" Accept="image/png,image/jpeg" MaxFileSize="MaxSize"
                Hint="Square images work best." OnChange="Chosen" />
    <Row><Button Submit StartIcon="Lucide.Upload">Upload</Button></Row>
    @if (_result is not null)
    {
        <Alert Status="_status">@_result</Alert>
    }
</Form>

@code {
    private const long MaxSize = 2_000_000;

    [SupplyParameterFromForm(FormName = "file-upload-photo")]
    private Upload? Model { get; set; }

    // Static pages: the file posts with the form, bound by its Name.
    [SupplyParameterFromForm(FormName = "file-upload-photo")]
    private IFormFile? Avatar { get; set; }

    // Interactive pages: OnChange gets the file as it's chosen.
    private IBrowserFile? _chosen;
    private string? _result;
    private Status _status;

    protected override void OnInitialized() => Model ??= new();

    private void Chosen(IReadOnlyList<IBrowserFile> files) => _chosen = files.FirstOrDefault();

    // Accept and MaxFileSize only guide the browser, and the name and type come from it too:
    // check the size, then the file's first bytes.
    private async Task Save()
    {
        var (name, size) = Avatar is { Length: > 0 } posted ? (posted.FileName, posted.Length)
            : _chosen is { } chosen ? (chosen.Name, chosen.Size)
            : (null, 0L);
        if (name is null) (_status, _result) = (Status.Warning, "Choose a photo first.");
        else if (size > MaxSize) (_status, _result) = (Status.Danger, $"{name} is larger than 2 MB.");
        else
        {
            await using var stream = Avatar is { Length: > 0 } ? Avatar.OpenReadStream() : _chosen!.OpenReadStream(MaxSize);
            var head = new byte[4];
            var read = await stream.ReadAtLeastAsync(head, head.Length, throwOnEndOfStream: false);
            (_status, _result) = IsPngOrJpeg(head.AsSpan(0, read))
                ? (Status.Success, $"Uploaded {name} ({size:N0} bytes).")
                : (Status.Danger, $"{name} isn't a PNG or JPEG.");
        }
    }

    // PNG files start with 89 50 4E 47, JPEG files with FF D8 FF.
    private static bool IsPngOrJpeg(ReadOnlySpan<byte> head) =>
        head.StartsWith((byte[])[0x89, 0x50, 0x4E, 0x47]) || head.StartsWith((byte[])[0xFF, 0xD8, 0xFF]);

    // The form's model; the file itself binds to Avatar above.
    public sealed class Upload;
}

@using Microsoft.AspNetCore.Http

<Form Model="Model" FormName="file-upload-multiple" Multipart OnValidSubmit="Send" MaxWidth="26.Rem" Grow>
    <FileUpload Name="Attachments" Label="Attachments" Multiple Accept=".pdf,.docx" MaxFileSize="MaxSize"
                Hint="Contracts and statements of work." OnChange="Chosen" />
    <Row><Button Submit StartIcon="Lucide.Paperclip">Attach</Button></Row>
    @if (_result is not null)
    {
        <Alert Status="_status">@_result</Alert>
    }
</Form>

@code {
    private const long MaxSize = 10_000_000;

    [SupplyParameterFromForm(FormName = "file-upload-multiple")]
    private Message? Model { get; set; }

    // Static pages: every chosen file posts under the same name.
    [SupplyParameterFromForm(FormName = "file-upload-multiple")]
    private IReadOnlyList<IFormFile>? Attachments { get; set; }

    // Interactive pages: OnChange gets the files as they're chosen.
    private IReadOnlyList<IBrowserFile> _chosen = [];
    private string? _result;
    private Status _status;

    protected override void OnInitialized() => Model ??= new();

    private void Chosen(IReadOnlyList<IBrowserFile> files) => _chosen = files;

    private void Send()
    {
        var files = Attachments is { Count: > 0 } posted
            ? posted.Where(f => f.Length > 0).Select(f => (f.FileName, f.Length)).ToList()
            : _chosen.Select(f => (FileName: f.Name, Length: f.Size)).ToList();
        // The picker's "All files" and a crafted post get past Accept: check here too.
        var wrong = files.FirstOrDefault(f => !f.FileName.EndsWith(".pdf", StringComparison.OrdinalIgnoreCase)
                                             && !f.FileName.EndsWith(".docx", StringComparison.OrdinalIgnoreCase));
        (_status, _result) = files.Count == 0 ? (Status.Warning, "Choose a file first.")
            : wrong.FileName is { } name ? (Status.Danger, $"{name} isn't a PDF or Word file.")
            : files.Any(f => f.Length > MaxSize) ? (Status.Danger, "Each file must be 10 MB or less.")
            : (Status.Success, $"Attached {string.Join(", ", files.Select(f => f.FileName))}.");
    }

    // The form's model; the files themselves bind to Attachments above.
    public sealed class Message;
}

@using Microsoft.AspNetCore.Http

<Form Model="Model" FormName="file-upload-states" Multipart OnValidSubmit="Apply" MaxWidth="26.Rem" Grow>
    <FileUpload Name="Resume" Label="Résumé" Required Accept=".pdf" MaxFileSize="5_000_000" OnChange="Chosen" />
    <FileUpload Name="Logo" Label="Company logo" Accept="image/svg+xml" Disabled
                Hint="Disabled: only the workspace owner can change it." />
    <Row><Button Submit>Apply</Button></Row>
    @if (_result is not null)
    {
        <Alert Status="_status">@_result</Alert>
    }
</Form>

@code {
    [SupplyParameterFromForm(FormName = "file-upload-states")]
    private Application? Model { get; set; }

    [SupplyParameterFromForm(FormName = "file-upload-states")]
    private IFormFile? Resume { get; set; }

    private IBrowserFile? _chosen;
    private string? _result;
    private Status _status;

    protected override void OnInitialized() => Model ??= new();

    private void Chosen(IReadOnlyList<IBrowserFile> files) => _chosen = files.FirstOrDefault();

    // Required and Accept are the browser's checks: a crafted post can leave the file out or send
    // another type. A disabled field posts nothing, so Logo never arrives.
    private void Apply() => (_status, _result) = (Resume is { Length: > 0 } ? Resume.FileName : _chosen?.Name) switch
    {
        null => (Status.Warning, "Choose a résumé first."),
        var name when !name.EndsWith(".pdf", StringComparison.OrdinalIgnoreCase) => (Status.Danger, $"{name} isn't a PDF."),
        var name => (Status.Success, $"Sent {name}."),
    };

    public sealed class Application;
}