Move upload permissions check to middleware

functions/api/uploads/_middleware.ts

@@ -0,0 +1,13 @@
+export async function onRequest(context: RequestContext) {
+  const { current_user: currentUser } = context.data;
+
+  if (!(currentUser?.permissions & (1 << 5)))
+    return new Response('{"error":"Forbidden"}', {
+      headers: {
+        "content-type": "application/json",
+      },
+      status: 403,
+    });
+
+  return await context.next();
+}