[yangshun]

Issue

OAuth upload validation currently scans every approved asset for each requested asset while holding the project lock. At the allowed 5,000-asset batch size, this can require millions of comparisons.

Fix

This reduces validation from O(approved × requested) to expected O(approved + requested).

Build a Set of approved (blake3, md5, size) tuples, using a local assetApprovalKey() helper with JSON.stringify for both indexing and lookup. Project matching and exact matching of all three fields are preserved.

Benchmark results

12 paired runs on Apple M2 Pro, Node v24.21.0. Validation timings include Set construction and JSON encoding; database, presigning, and network I/O are excluded.

Approved assets	Requested assets	Before	After	% reduction
100	100	0.084 ms	0.051 ms	39.1%
5,000	100	4.721 ms	2.082 ms	55.9%
5,000	1,000	40.969 ms	2.317 ms	94.3%
5,000	5,000	227.016 ms	3.340 ms	98.5%
20,000	5,000	808.418 ms	10.352 ms	98.7%

The 5,000/5,000 case is about 68× faster.

Why the tests changed

Expanded coverage verifies multiple approved assets, reordered batches, duplicates, mismatched fields, mixed valid/invalid batches, and strict field types ("3" versus 3). All 19 tests pass against both the original and optimized implementations.

Verification

Typechecking passed; 4,447 affected tests and 14,496 full-suite tests passed.

[cpojer]

This is ridiculous. Sorry for the slop, and thanks for the fix!