Added file upload support

backends/mizan-fastapi/pyproject.toml

@@ -8,6 +8,7 @@ dependencies = [
     "mizan-core",
     "fastapi>=0.110",
     "pydantic>=2.0",
+    "python-multipart>=0.0.9",
 ]
 
 [project.optional-dependencies]

backends/mizan-fastapi/src/mizan_fastapi/__init__.py

@@ -35,8 +35,12 @@ from .executor import (
     execute_function,
 )
 from .router import router, mizan_exception_handler, mizan_validation_handler
+from mizan_core.upload import File, Upload, UploadedFile
 
 __all__ = [
+    "Upload",
+    "File",
+    "UploadedFile",
     "router",
     "mizan_exception_handler",
     "mizan_validation_handler",

backends/mizan-fastapi/src/mizan_fastapi/router.py

@@ -14,16 +14,20 @@ FastAPI router exposing Mizan's HTTP endpoints:
 
 from __future__ import annotations
 
+import json
 from typing import Any
 
 from fastapi import APIRouter, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, ValidationError
+from starlette.datastructures import UploadFile
 
 from mizan_core.registry import get_context_groups, get_function
+from mizan_core.upload import UploadedFile, bind_uploads
 
 from .executor import (
+    BadRequest,
     ErrorCode,
     MizanError,
     NotFound,
@@ -59,13 +63,58 @@ class CallBody(BaseModel):
     args: dict[str, Any] = Field(default_factory=dict)
 
 
+async def _parse_call(request: Request) -> tuple[str, dict[str, Any]]:
+    """Read a call request, JSON or multipart. Returns `(fn, args)`.
+
+    Multipart carries the non-file fields in a JSON `args` part and each file as
+    its own part; the file parts bind into the Input's Upload fields with the
+    declarative `File(...)` constraints enforced.
+    """
+    content_type = request.headers.get("content-type", "")
+    if content_type.startswith("multipart/form-data"):
+        form = await request.form()
+        fn = form.get("fn")
+        if not isinstance(fn, str) or not fn:
+            raise BadRequest("Missing 'fn' field")
+        raw_args = form.get("args")
+        try:
+            args: dict[str, Any] = json.loads(raw_args) if raw_args else {}
+        except (TypeError, ValueError):
+            raise BadRequest("Invalid JSON in 'args' field")
+
+        fn_class = get_function(fn)
+        input_cls = getattr(fn_class, "Input", None) if fn_class else None
+        if input_cls is not None and hasattr(input_cls, "model_fields"):
+            files: dict[str, list[UploadedFile]] = {}
+            for key in set(form.keys()):
+                wrapped = [
+                    UploadedFile(p.filename, p.content_type, await p.read())
+                    for p in form.getlist(key)
+                    if isinstance(p, UploadFile)
+                ]
+                if wrapped:
+                    files[key] = wrapped
+            err = bind_uploads(input_cls, args, files)
+            if err is not None:
+                raise BadRequest(err)
+        return fn, args
+
+    try:
+        body = CallBody(**(await request.json()))
+    except (ValueError, ValidationError):
+        raise BadRequest("Invalid request body")
+    return body.fn, body.args
+
+
 @router.post("/call/")
-async def function_call(body: CallBody, request: Request) -> JSONResponse:
-    """RPC dispatch — `{"fn": "...", "args": {...}}` → `{"result": ..., "invalidate": [...], "merge"?: [...]}`."""
-    fn_class = get_function(body.fn)
-    result = await execute_function(request, body.fn, body.args)
-    invalidate = compute_invalidation(fn_class, body.args)
-    merges = compute_merges(fn_class, body.args, result)
+async def function_call(request: Request) -> JSONResponse:
+    """RPC dispatch — `{"fn": "...", "args": {...}}` (JSON) or multipart with file
+    parts → `{"result": ..., "invalidate": [...], "merge"?: [...]}`."""
+    fn, args = await _parse_call(request)
+    fn_class = get_function(fn)
+    result = await execute_function(request, fn, args)
+    invalidate = compute_invalidation(fn_class, args)
+    merges = compute_merges(fn_class, args, result)
     payload: dict[str, Any] = {"result": result, "invalidate": invalidate}
     if merges:
         payload["merge"] = merges

backends/mizan-fastapi/tests/test_upload.py

@@ -0,0 +1,71 @@
+"""Upload dispatch over FastAPI multipart — files bind into Upload fields and
+the declarative `File(...)` constraints are enforced."""
+
+from __future__ import annotations
+
+import json
+from typing import Annotated
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+from pydantic import BaseModel
+
+from mizan_core.client.function import client
+from mizan_core.registry import clear_registry, register
+from mizan_fastapi import File, MizanError, Upload, mizan_exception_handler, router as mizan_router
+
+
+class AvatarOut(BaseModel):
+    ok: bool
+    size: int
+    name: str | None = None
+
+
+@pytest.fixture
+def app():
+    clear_registry()
+
+    @client
+    def set_avatar(
+        request,
+        user_id: int,
+        avatar: Annotated[Upload, File(max_size="1MB", content_types=["image/png"])],
+    ) -> AvatarOut:
+        return AvatarOut(ok=True, size=avatar.size, name=avatar.filename)
+
+    register(set_avatar, "set_avatar")
+
+    fastapi_app = FastAPI()
+    fastapi_app.include_router(mizan_router, prefix="/api/mizan")
+    fastapi_app.add_exception_handler(MizanError, mizan_exception_handler)
+    return fastapi_app
+
+
+def _post(test_client: TestClient, args: dict, file_tuple: tuple):
+    return test_client.post(
+        "/api/mizan/call/",
+        data={"fn": "set_avatar", "args": json.dumps(args)},
+        files={"avatar": file_tuple},
+    )
+
+
+def test_upload_binds_and_executes(app):
+    resp = _post(TestClient(app), {"user_id": 5}, ("a.png", b"\x89PNG" + b"x" * 100, "image/png"))
+    assert resp.status_code == 200, resp.text
+    result = resp.json()["result"]
+    assert result["ok"] is True
+    assert result["name"] == "a.png"
+    assert result["size"] == 104
+
+
+def test_max_size_rejected(app):
+    resp = _post(TestClient(app), {"user_id": 5}, ("b.png", b"x" * (2 * 1024 * 1024), "image/png"))
+    assert resp.status_code == 400
+    assert "max size" in resp.text
+
+
+def test_content_type_rejected(app):
+    resp = _post(TestClient(app), {"user_id": 5}, ("c.gif", b"GIF89a", "image/gif"))
+    assert resp.status_code == 400
+    assert "content-type" in resp.text