Upload AI Builder Content to a Proposal

# Pre-build the multipart body with a fixed boundary so the same boundary
# is used for signing and on the wire.

BASE_URL="https://api.portal.io"
APP_ID="YOUR_APP_ID"
SECRET_KEY="YOUR_SECRET_KEY"
USER_KEY="YOUR_USER_KEY"
PROPOSAL_ID="12345"
FILE_PATH="./spec-bom.txt"
FILE_NAME="spec-bom.txt"
CONTENT_NAME="Project BOM"

URL_PATH="/public/api/proposals/${PROPOSAL_ID}/ai/content"
URL="${BASE_URL}${URL_PATH}"
BOUNDARY="PortalBoundary$(date +%s%N)"
CONTENT_TYPE="multipart/form-data; boundary=${BOUNDARY}"
DATE_HEADER="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S GMT')"

# Canonical message: METHOD + base URL (no query) + content type + date + user key
MESSAGE="POST${URL}${CONTENT_TYPE}${DATE_HEADER}${USER_KEY}"
SIGNATURE=$(printf '%s' "$MESSAGE" \
  | openssl dgst -sha256 -hmac "$SECRET_KEY" -binary \
  | base64)

# Build multipart body. Note: the file part's field name equals the filename.
BODY_FILE=$(mktemp)
{
  printf -- '--%s\r\n' "$BOUNDARY"
  printf 'Content-Disposition: form-data; name="name"\r\n\r\n'
  printf '%s\r\n' "$CONTENT_NAME"

  printf -- '--%s\r\n' "$BOUNDARY"
  printf 'Content-Disposition: form-data; name="isMultiChunkUpload"\r\n\r\n'
  printf 'false\r\n'

  printf -- '--%s\r\n' "$BOUNDARY"
  printf 'Content-Disposition: form-data; name="%s"; filename="%s"\r\n' "$FILE_NAME" "$FILE_NAME"
  printf 'Content-Type: text/plain\r\n\r\n'
  cat "$FILE_PATH"
  printf '\r\n'

  printf -- '--%s--\r\n' "$BOUNDARY"
} > "$BODY_FILE"

curl -i -X POST "$URL" \
  -H "Accept: application/json" \
  -H "Content-Type: ${CONTENT_TYPE}" \
  -H "X-MSS-API-APPID: ${APP_ID}" \
  -H "X-MSS-API-USERKEY: ${USER_KEY}" \
  -H "X-MSS-CUSTOM-DATE: ${DATE_HEADER}" \
  -H "X-MSS-SIGNATURE: ${SIGNATURE}" \
  --data-binary "@${BODY_FILE}"

rm "$BODY_FILE"

import time
from email.utils import formatdate

import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

from portal_auth import sign_request

base_url = "https://api.portal.io"
proposal_id = 12345
file_path = "./spec-bom.txt"
file_name = "spec-bom.txt"
content_name = "Project BOM"

url = f"{base_url}/public/api/proposals/{proposal_id}/ai/content"

with open(file_path, "rb") as fh:
    file_bytes = fh.read()

# requests_toolbelt's MultipartEncoder lets us fix the boundary at construction
# time so we can sign the exact Content-Type value sent on the wire.
encoder = MultipartEncoder(
    fields={
        "name": content_name,
        "isMultiChunkUpload": "false",
        # Field name == filename. The server reads the file type from this name.
        file_name: (file_name, file_bytes, "text/plain"),
    },
    boundary=f"PortalBoundary{int(time.time() * 1000)}",
)

content_type = encoder.content_type  # includes "; boundary=..."
timestamp = formatdate(timeval=None, localtime=False, usegmt=True)
signature = sign_request("POST", url, content_type, timestamp, "YOUR_USER_KEY", "YOUR_SECRET_KEY")

response = requests.post(
    url,
    data=encoder,
    headers={
        "Accept": "application/json",
        "Content-Type": content_type,
        "X-MSS-API-APPID": "YOUR_APP_ID",
        "X-MSS-API-USERKEY": "YOUR_USER_KEY",
        "X-MSS-CUSTOM-DATE": timestamp,
        "X-MSS-SIGNATURE": signature,
    },
)
print(response.json())

const fs = require('node:fs');
const { request } = require('node:https');
const { URL } = require('node:url');
const { signRequest } = require('./portalAuth');

const baseUrl = 'https://api.portal.io';
const proposalId = 12345;
const filePath = './spec-bom.txt';
const fileName = 'spec-bom.txt';
const contentName = 'Project BOM';

const url = `${baseUrl}/public/api/proposals/${proposalId}/ai/content`;

function buildMultipartBody({ boundary, fields, fileFieldName, fileName, fileContent }) {
  const chunks = [];
  for (const [name, value] of Object.entries(fields)) {
    chunks.push(Buffer.from(
      `--${boundary}\r\n` +
      `Content-Disposition: form-data; name="${name}"\r\n\r\n` +
      `${value}\r\n`
    ));
  }
  chunks.push(Buffer.from(
    `--${boundary}\r\n` +
    `Content-Disposition: form-data; name="${fileFieldName}"; filename="${fileName}"\r\n` +
    `Content-Type: text/plain\r\n\r\n`
  ));
  chunks.push(fileContent);
  chunks.push(Buffer.from(`\r\n--${boundary}--\r\n`));
  return Buffer.concat(chunks);
}

async function uploadAiContent() {
  const boundary = `PortalBoundary${Date.now()}`;
  const fileContent = fs.readFileSync(filePath);

  const body = buildMultipartBody({
    boundary,
    fields: { name: contentName, isMultiChunkUpload: 'false' },
    // Field name == filename. The server reads the file type from this name.
    fileFieldName: fileName,
    fileName,
    fileContent,
  });

  const contentType = `multipart/form-data; boundary=${boundary}`;
  const timestamp = new Date().toUTCString();
  const signature = signRequest('POST', url, contentType, timestamp, 'YOUR_USER_KEY', 'YOUR_SECRET_KEY');

  const parsed = new URL(url);
  return new Promise((resolve, reject) => {
    const req = request(
      {
        method: 'POST',
        hostname: parsed.hostname,
        path: parsed.pathname,
        headers: {
          'Accept': 'application/json',
          'Content-Type': contentType,
          'Content-Length': body.length,
          'X-MSS-API-APPID': 'YOUR_APP_ID',
          'X-MSS-API-USERKEY': 'YOUR_USER_KEY',
          'X-MSS-CUSTOM-DATE': timestamp,
          'X-MSS-SIGNATURE': signature,
        },
      },
      (res) => {
        const parts = [];
        res.on('data', (c) => parts.push(c));
        res.on('end', () => {
          const text = Buffer.concat(parts).toString('utf8');
          if (res.statusCode >= 200 && res.statusCode < 300) resolve(JSON.parse(text));
          else reject(new Error(`HTTP ${res.statusCode}: ${text}`));
        });
      },
    );
    req.on('error', reject);
    req.write(body);
    req.end();
  });
}

uploadAiContent().then(console.log).catch(console.error);