Recent uploads

The projects that most recently received a document the caller may read, newest first. Backs eagle-public's homepage "Recent Uploads" panel (Jira PUBLIC-152). Route: src/http/routes.js. Controller: src/controllers/nosql/document.js (getRecentUploads, rankRecentUploads). Repository: src/repositories/documents.js (projectUploadMaxima, newestUploads).

Route

GET /api/documents/recent-uploads — passive auth: works anonymously or with a credential, registered ahead of /documents/:id in the route table so the literal path is not read as a document id.

Parameter	Required	Notes
limit	no	Plain integer 1-10, default 5. Padded, signed, decimal, exponent, hex spellings (05, +5, 5.0, 5e0, 0x5) and a repeated query key are refused with 400, not normalised

Response

{
  "items": [
    {
      "projectId": "…",
      "eagleProjectId": "…",
      "projectName": "…",
      "dateUploaded": "2026-09-10T12:00:00.000Z",
      "documents": [
        { "id": "…", "eagleId": "…", "displayName": "…", "documentFileName": "…", "type": "…", "dateUploaded": "…" }
      ]
    }
  ]
}

Each item is one project, expanded to up to five of its newest readable documents. Fewer than limit items is a normal answer — the list is never padded, and a project with fewer than five documents lists what it has. Projects tie-break by id and documents tie-break by id, so the same data renders the same way on every call. The project's dateUploaded is that of its first listed document.

Ranking

Two steps, so a bulk import of hundreds of documents into one project still takes one place in the list:

1. projectUploadMaxima groups the documents container by projectId and takes MAX(dateUploaded) — one row per project, ranked newest first in JS (Cosmos allows GROUP BY only without ORDER BY).
2. For each candidate project in that order, newestUploads runs a single-partition TOP 5 … ORDER BY dateUploaded DESC read scoped to that one project.

A project the caller cannot read, or whose row the redactor withholds, is skipped and the walk continues rather than shortening the list.

Both projectUploadMaxima and newestUploads exclude documents with documentSource: 'UPDATE' — images uploaded through an Update's gallery or featured-image field. They show on their Update only, never in this list.

Visibility

Both the aggregate query and the per-project reads carry the normal ACL predicate (access-sql.js), and every project and document row is passed through redactForAccess before any field is read off it — the same redaction used everywhere else, not a second implementation.

Caching

Anonymous requests (no credential of any kind) are memoised in process for 60 seconds, keyed on limit, and the response carries Cache-Control: public, max-age=300 plus Vary: Authorization, X-Api-Key, so a downstream cache can hold it longer than the in-process copy. A request that presents any credential is never memoised and carries Cache-Control: private, no-store, because the ranking can differ per caller.

Deploy note

The ranking query depends on /dateUploaded/? being in the documents container's indexing policy (azure/modules/cosmos-nosql.bicep). Run scripts/deploy-infra.sh test to apply it before relying on this route being fast against a real container. An index-only change can use scripts/apply-cosmos-index.sh instead; see Operating-DEMI-in-Azure.