Add /import?src=<url>: a hand-off point for scanning apps

[alxbouchard]

What

A new /import?src=<https-url>[&name=<scene name>] page: an external tool — in our case an iOS LiDAR scanning app — hosts a build JSON at a URL and opens this page; the visitor reviews what the file contains and imports it as a new scene with one click.

Until now the only way to get a generated scene into the editor was dragging a file onto Load Build, which does not exist on mobile. With this page, any scan app can end its export flow with "Open in Pascal Editor".

How it works

• The fetch happens client-side in the visitor's browser — the same trust model as dropping a file on Load Build. The host must allow CORS; no server ever fetches the URL, so there is no SSRF surface.
• The file runs through the same validateBuildJson pre-flight as Load Build, and the page shows the node counts, floor area, warnings and errors before anything happens.
• Only an explicit click creates the scene, through the regular POST /api/scenes route — so auth, origin checks and apiGraphSchema validation (including the AssetUrl allowlist) all apply unchanged.
• src accepts https only (http for localhost during development), rejects embedded credentials, and caps the document at 25 MB. URL validation lives in lib/import-src.ts with unit tests.

Tested

• bun test lib: 41 pass (6 new)
• bun run check-types, biome check: clean
• End to end against a real scan: a RoomPlan-captured apartment (31 walls, 27 items, slab, scene materials) served from a CORS-enabled URL → review page → one click → scene opens in the editor with furniture and per-item slot materials rendering correctly.

Why we built it

We build A3 Atlas Scanner, an iOS field tool that captures homes with RoomPlan and already exports your {nodes, rootNodeIds, materials} graph (catalog items scaled to measured dimensions, measured colors as scene materials, IFC alongside). This page is the missing link that turns every scan into a one-tap Pascal scene. Happy to adjust anything to fit the project's conventions.

🤖 Generated with Claude Code

---

Note

Medium Risk
New import surface and client-fetched third-party JSON, but no server-side URL fetch; scene persistence still goes through the authenticated scenes API and existing graph validation.

Overview
Adds /import?src=<url>[&name=…] so external tools (e.g. mobile scan apps) can hand off a CORS-hosted build JSON: the browser fetches and runs validateBuildJson, shows stats/warnings/errors and an editable scene name, then creates a scene only after Import as a new scene via existing POST /api/scenes (auth and server validation unchanged).

parseImportSrc in import-src.ts gates the src query param (https only, http on localhost, no credentials, 10 MB cap aligned with the scene store) with unit tests.

validateBuildJson now parses optional top-level materials into ParsedBuildJson (invalid entries warned and skipped). Load Build in the settings panel passes those materials into setScene so scene:<id> slot refs keep custom finishes on file import.

^{Reviewed by Cursor Bugbot for commit eae2ccc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alxbouchard]

Follow-up commit: while testing the import end to end I found that validateBuildJson drops the top-level materials table, so every scene:<id> slot ref in an imported file pointed at a material that no longer existed — custom finishes silently reverted to defaults on the existing Load Build path too, not just on this new page. The second commit carries materials through ParsedBuildJson (each entry validated individually, invalid ones skipped with a warning) and hands them to setScene, which already supported them. Covered by unit tests; verified visually with a scan whose furniture uses per-item scene materials.

[alxbouchard]

Addressed the Bugbot review (it ran against the first commit, 53b688c):

• Import drops scene materials — this was real, and deeper than the new page: validateBuildJson dropped the top-level materials table for the existing Load Build path too. Fixed in 81715bc (materials carried through ParsedBuildJson, entries validated individually, handed to setScene).
• Aborted fetch shown as CORS / stale review across src changes — both fixed in the latest commit: the effect resets to fetching on every src change, and a cancelled run can no longer overwrite newer state or surface its abort as an error.

[alxbouchard]

Third Bugbot point addressed: MAX_IMPORT_BYTES now matches the scene store's 10 MB limit (DEFAULT_MAX_SCENE_BYTES) so a file can't pass review and then 413 on create — and a 413 now gets its own message instead of the generic failure.

[alxbouchard]

Double-tap point addressed: a synchronous useRef guard now blocks re-entry into the create call (released in a finally so a failed create can be retried) — the state-based check alone could indeed race the re-render, especially on the mobile hand-off this page exists for.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eae2ccc. Configure here.}

[cursor]

Create errors discard the review

Medium Severity

A failed POST /api/scenes switches the page to the error phase, which unmounts the review UI and the already-validated graph. The creating ref is released so a retry can run, but nothing remains to click. On this mobile hand-off a refresh re-fetches src, and a short-lived scan URL may already be gone.

Additional Locations (1)

• apps/editor/app/import/import-client.tsx#L127-L131

 

^{Reviewed by Cursor Bugbot for commit eae2ccc. Configure here.}