Add /import?src=<url>: a hand-off point for scanning apps

[alxbouchard]

What

A new /import?src=<https-url>[&name=<scene name>] page: an external tool — in our case an iOS LiDAR scanning app — hosts a build JSON at a URL and opens this page; the visitor reviews what the file contains and imports it as a new scene with one click.

Until now the only way to get a generated scene into the editor was dragging a file onto Load Build, which does not exist on mobile. With this page, any scan app can end its export flow with "Open in Pascal Editor".

How it works

• The fetch happens client-side in the visitor's browser — the same trust model as dropping a file on Load Build. The host must allow CORS; no server ever fetches the URL, so there is no SSRF surface.
• The file runs through the same validateBuildJson pre-flight as Load Build, and the page shows the node counts, floor area, warnings and errors before anything happens.
• Only an explicit click creates the scene, through the regular POST /api/scenes route — so auth, origin checks and apiGraphSchema validation (including the AssetUrl allowlist) all apply unchanged.
• src accepts https only (http for localhost during development), rejects embedded credentials, and caps the document at 25 MB. URL validation lives in lib/import-src.ts with unit tests.

Tested

• bun test lib: 41 pass (6 new)
• bun run check-types, biome check: clean
• End to end against a real scan: a RoomPlan-captured apartment (31 walls, 27 items, slab, scene materials) served from a CORS-enabled URL → review page → one click → scene opens in the editor with furniture and per-item slot materials rendering correctly.

Why we built it

We build A3 Atlas Scanner, an iOS field tool that captures homes with RoomPlan and already exports your {nodes, rootNodeIds, materials} graph (catalog items scaled to measured dimensions, measured colors as scene materials, IFC alongside). This page is the missing link that turns every scan into a one-tap Pascal scene. Happy to adjust anything to fit the project's conventions.

🤖 Generated with Claude Code

---

Note

Medium Risk
Introduces a new user-facing import surface and changes how build JSON is normalized (materials), though URL fetch stays client-side and scene creation still goes through the existing authenticated API.

Overview
Adds /import?src=<https-url>[&name=…] so external tools (e.g. scan apps) can hand off a CORS-hosted build JSON: the browser fetches it, runs validateBuildJson like Load Build, shows stats/warnings/errors, and only on confirm creates a scene via POST /api/scenes (auth and existing graph validation unchanged). parseImportSrc in lib/import-src.ts restricts src to https (http on localhost only), blocks credentials and bad schemes, and enforces a 25 MB cap, with unit tests.

validateBuildJson now parses a top-level materials map into ParsedBuildJson, skipping invalid entries with invalid_materials warnings instead of failing the import. The settings panel Load Build path passes those materials into setScene so scene:<id> slot refs keep custom finishes instead of reverting to defaults.

^{Reviewed by Cursor Bugbot for commit 1ced72b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alxbouchard]

Follow-up commit: while testing the import end to end I found that validateBuildJson drops the top-level materials table, so every scene:<id> slot ref in an imported file pointed at a material that no longer existed — custom finishes silently reverted to defaults on the existing Load Build path too, not just on this new page. The second commit carries materials through ParsedBuildJson (each entry validated individually, invalid ones skipped with a warning) and hands them to setScene, which already supported them. Covered by unit tests; verified visually with a scan whose furniture uses per-item scene materials.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 81715bc. Configure here.}

[cursor]

Import cap exceeds scene store

Medium Severity

MAX_IMPORT_BYTES is 25 MB while the SQLite scene store defaults to 10 MB (DEFAULT_MAX_SCENE_BYTES). A build that passes review can still fail on POST /api/scenes with 413, and the UI only shows a generic create failure instead of a size explanation.

Additional Locations (2)

• apps/editor/app/import/import-client.tsx#L50-L59
• apps/editor/app/import/import-client.tsx#L84-L92

 

^{Reviewed by Cursor Bugbot for commit 81715bc. Configure here.}

[alxbouchard]

Addressed the Bugbot review (it ran against the first commit, 53b688c):

• Import drops scene materials — this was real, and deeper than the new page: validateBuildJson dropped the top-level materials table for the existing Load Build path too. Fixed in 81715bc (materials carried through ParsedBuildJson, entries validated individually, handed to setScene).
• Aborted fetch shown as CORS / stale review across src changes — both fixed in the latest commit: the effect resets to fetching on every src change, and a cancelled run can no longer overwrite newer state or surface its abort as an error.