From f6a54610a60abcb1d1be0469e307123105147eee Mon Sep 17 00:00:00 2001
From: Abe Jellinek <1770299+AbeJellinek@users.noreply.github.com>
Date: Tue, 12 May 2026 13:48:04 -0400
Subject: [PATCH] Local API: Support write requests

---
 .../preferences/preferences_advanced.js       |   18 +
 .../preferences/preferences_advanced.xhtml    |    7 +
 chrome/content/zotero/xpcom/server/server.js  |   20 +-
 .../zotero/xpcom/server/server_localAPI.js    | 1561 ++++++++++++++++-
 chrome/locale/en-US/zotero/preferences.ftl    |    2 +
 chrome/locale/en-US/zotero/zotero.ftl         |    6 +
 test/tests/server_localAPITest.js             | 1524 ++++++++++++++++
 7 files changed, 3082 insertions(+), 56 deletions(-)

diff --git a/chrome/content/zotero/preferences/preferences_advanced.js b/chrome/content/zotero/preferences/preferences_advanced.js
index 7c831f471c..c6ad5e008e 100644
--- a/chrome/content/zotero/preferences/preferences_advanced.js
+++ b/chrome/content/zotero/preferences/preferences_advanced.js
@@ -485,24 +485,42 @@ Zotero_Preferences.Advanced = {
 		
 		let checkbox = document.getElementById('zotero-prefpane-advanced-enable-local-api');
 		let availableMessage = document.getElementById('zotero-prefpane-advanced-local-api-available');
+		let authorizationsSection = document.getElementById('zotero-prefpane-advanced-local-api-write-authorizations');
 		let serverDisabledSection = document.getElementById('zotero-prefpane-advanced-server-disabled');
 		
 		if (!serverEnabled) {
 			checkbox.disabled = true;
 			availableMessage.hidden = true;
+			authorizationsSection.hidden = true;
 			serverDisabledSection.hidden = false;
 			return;
 		}
 		
 		checkbox.disabled = false;
 		availableMessage.hidden = !localAPIEnabled;
+		authorizationsSection.hidden = !localAPIEnabled;
 		serverDisabledSection.hidden = true;
 		
 		document.l10n.setArgs(availableMessage, {
 			url: `http://localhost:${Zotero.Server.port}/api/`
 		});
+		
+		if (localAPIEnabled) {
+			this.updateLocalAPIClearAuthorizationsButton();
+		}
 	},
 	
+	async updateLocalAPIClearAuthorizationsButton() {
+		let clearButton = document.getElementById('zotero-prefpane-advanced-local-api-clear');
+		let count = await Zotero.Server.LocalAPI.getAuthorizationCount();
+		clearButton.disabled = count === 0;
+	},
+
+	async clearLocalAPIAuthorizations() {
+		await Zotero.Server.LocalAPI.clearAuthorizations();
+		await this.updateLocalAPIClearAuthorizationsButton();
+	},
+
 	enableServerForLocalAPI() {
 		Zotero.Prefs.set('httpServer.enabled', true);
 		Zotero.Utilities.Internal.quit(true);
diff --git a/chrome/content/zotero/preferences/preferences_advanced.xhtml b/chrome/content/zotero/preferences/preferences_advanced.xhtml
index cc0901cfcc..a701330838 100644
--- a/chrome/content/zotero/preferences/preferences_advanced.xhtml
+++ b/chrome/content/zotero/preferences/preferences_advanced.xhtml
@@ -49,6 +49,13 @@
 				>
 					<html:code class="local-api-url" data-l10n-name="url"/>
 				</label>
+				<hbox id="zotero-prefpane-advanced-local-api-write-authorizations" align="center" hidden="true">
+					<button
+						id="zotero-prefpane-advanced-local-api-clear"
+						data-l10n-id="preferences-advanced-local-api-clear-authorizations"
+						oncommand="Zotero_Preferences.Advanced.clearLocalAPIAuthorizations()"
+					/>
+				</hbox>
 				<hbox id="zotero-prefpane-advanced-server-disabled" align="center" hidden="true">
 					<label data-l10n-id="preferences-advanced-server-disabled"/>
 					<button
diff --git a/chrome/content/zotero/xpcom/server/server.js b/chrome/content/zotero/xpcom/server/server.js
index e7b0d5c5c5..2630ff37c6 100755
--- a/chrome/content/zotero/xpcom/server/server.js
+++ b/chrome/content/zotero/xpcom/server/server.js
@@ -260,7 +260,7 @@ Zotero.Server.RequestHandler.prototype._bodyData = function () {
 		}
 	}
 	// handle envelope
-	this._processEndpoint("POST", data); // async
+	this._processEndpoint(this.requestMethod || "POST", data); // async
 }
 
 
@@ -367,16 +367,23 @@ Zotero.Server.RequestHandler.prototype.handleRequest = async function () {
 	else if (request.method == "GET") {
 		this._processEndpoint("GET", null); // async
 	}
-	else if (request.method == "POST") {
+	else if (request.method == "POST" || request.method == "PUT"
+			|| request.method == "PATCH" || request.method == "DELETE") {
 		const contentLengthRe = /^([0-9]+)$/;
-		
+		this.requestMethod = request.method;
+
 		// parse content length
 		var m = contentLengthRe.exec(this.headers['content-length']);
-		if(!m) {
+		if (!m) {
+			// DELETE is allowed to have no body
+			if (request.method == "DELETE") {
+				this._processEndpoint("DELETE", null); // async
+				return;
+			}
 			this._requestFinished(this._generateResponse(400, "text/plain", "Content-length not provided\n"));
 			return;
 		}
-		
+
 		this.bodyLength = parseInt(m[1]);
 		this._bodyData();
 	} else {
@@ -420,7 +427,8 @@ Zotero.Server.RequestHandler.prototype._processEndpoint = async function (method
 		}
 		
 		var data = null;
-		if (method === 'POST' && this.contentType) {
+		if ((method === 'POST' || method === 'PUT' || method === 'PATCH' || method === 'DELETE')
+				&& this.contentType) {
 			// check that endpoint supports contentType
 			var supportedDataTypes = endpoint.supportedDataTypes;
 			if (supportedDataTypes && supportedDataTypes != '*'
diff --git a/chrome/content/zotero/xpcom/server/server_localAPI.js b/chrome/content/zotero/xpcom/server/server_localAPI.js
index 35935422ab..e6a202b503 100644
--- a/chrome/content/zotero/xpcom/server/server_localAPI.js
+++ b/chrome/content/zotero/xpcom/server/server_localAPI.js
@@ -1,9 +1,9 @@
 /*
 	***** BEGIN LICENSE BLOCK *****
 	
-	Copyright © 2022 Corporation for Digital Scholarship
+	Copyright © 2026 Corporation for Digital Scholarship
                      Vienna, Virginia, USA
-					http://zotero.org
+					 https://digitalscholar.org
 	
 	This file is part of Zotero.
 	
@@ -34,10 +34,23 @@ Limitations compared to api.zotero.org:
   one API version will ever be supported at a time. If a new API version is released and your
   client needs to maintain support for older versions, first query /api/ and read the
   Zotero-API-Version response header, then make requests conditionally.
-- Write access is not yet supported.
-- No authentication.
 - No access to user data for users other than the local logged-in user. Use user ID 0 or the user's
   actual API user ID (https://www.zotero.org/settings/keys).
+- Authentication works differently:
+    - Read requests (GET) require no authentication.
+    - Write requests (POST, PUT, PATCH, DELETE) must include a local API key, either using the
+      Zotero-API-Key header (recommended) or the ?key= query parameter. A 401 is returned if
+      the key is missing or unrecognized.
+
+      Local API keys are unrelated to zotero.org API keys. They are obtained by POSTing to
+      /api/authorize-local (a local-only endpoint with no web API analog) with a JSON body
+      of the form { "appName": "<caller's display name>" }. This shows a modal with three
+      buttons: "Allow" (one-time access), "Always Allow" (persistent access), and "Deny".
+      On allow, the response is of the form:
+        { "key": "<key>", "remember": <bool> }
+      When the user picks "Allow" rather than "Always Allow", the key is single-use: the first
+      write that successfully validates it consumes it. Local API consumers should always be
+      prepared to handle a 401 response by reauthenticating.
 - Minimal access to metadata about groups.
 - Atom is not supported.
 - Item type/field endpoints (https://www.zotero.org/support/dev/web_api/v3/types_and_fields) will
@@ -50,6 +63,8 @@ Limitations compared to api.zotero.org:
   but it does not make any attempt to replicate implementation details that your code might rely on.
   Sort orders might differ, quicksearch results will probably differ, and JSON you get from the
   local API is never going to be exactly identical to what you would get from the web API.
+- PATCH-style partial (binary diff) uploads are not implemented; clients should fall back to a
+  full upload.
 
 That said, there are benefits:
 
@@ -65,6 +80,134 @@ That said, there are benefits:
 
 const LOCAL_API_VERSION = 3;
 
+// Maximum number of objects in a single write batch (mirrors dataserver $maxWriteItems, etc.)
+const MAX_WRITE_OBJECTS = 50;
+
+// Maximum number of keys in a multi-delete query parameter
+const MAX_DELETE_OBJECTS = 50;
+
+/**
+ * @type {Map<string, number>} token -> expiryEpochMs
+ */
+const WRITE_TOKEN_CACHE = new Map();
+const WRITE_TOKEN_CACHE_SECONDS = 12 * 60 * 60;
+
+/**
+ * In-progress file uploads.
+ * @type {Map<any, {
+ *     libraryID: number;
+ *     itemKey: string;
+ *     md5: string;
+ *     filename: string;
+ *     filesize: string;
+ *     mtime: number;
+ *     contentType: string;
+ *     charset: string | null;
+ *     uploaded: boolean;
+ *     expires: number;
+ * }>}
+ */
+const PENDING_UPLOADS = new Map();
+const UPLOAD_KEY_TTL_SECONDS = 60 * 60;
+
+// Rate-limiting state for /api/authorize-local. Each entry is a timestamp (ms)
+// for a request that resulted in (or would result in) a confirmation prompt.
+// When the window holds AUTHORIZE_RATE_LIMIT_MAX entries that are all less
+// than AUTHORIZE_RATE_LIMIT_WINDOW_MS old, further requests are rejected with
+// 429 + Retry-After until the oldest entry ages out.
+const AUTHORIZE_RATE_LIMIT_MAX = 5;
+const AUTHORIZE_RATE_LIMIT_WINDOW_MS = 60 * 1000;
+
+let _localAPIKeysCache = null;
+
+function _localAPIKeysPath() {
+	return PathUtils.join(Zotero.Profile.dir, 'localAPIKeys.json');
+}
+
+async function _loadLocalAPIKeys() {
+	if (_localAPIKeysCache) return _localAPIKeysCache;
+	let path = _localAPIKeysPath();
+	try {
+		if (!(await IOUtils.exists(path))) {
+			_localAPIKeysCache = [];
+			return _localAPIKeysCache;
+		}
+		let text = await IOUtils.readUTF8(path);
+		let data = JSON.parse(text);
+		_localAPIKeysCache = Array.isArray(data.keys) ? data.keys : [];
+	}
+	catch (e) {
+		Zotero.logError(e);
+		_localAPIKeysCache = [];
+	}
+	return _localAPIKeysCache;
+}
+
+async function _saveLocalAPIKeys() {
+	if (!_localAPIKeysCache) return;
+	let path = _localAPIKeysPath();
+	let json = JSON.stringify({ keys: _localAPIKeysCache }, null, 4);
+	await IOUtils.writeUTF8(path, json);
+}
+
+/**
+ * Register a new local API key. If remember is true, the key persists and can
+ * be reused indefinitely; otherwise the next successful use will consume it.
+ *
+ * @returns {Promise<string>} The newly generated key
+ */
+async function addLocalAPIKey(appName, remember) {
+	let keys = await _loadLocalAPIKeys();
+	let key = Zotero.Utilities.randomString(32);
+	keys.push({
+		key,
+		appName: typeof appName === 'string' ? appName : '',
+		remember: !!remember,
+		createdAt: new Date().toISOString(),
+	});
+	await _saveLocalAPIKeys();
+	return key;
+}
+
+/**
+ * Look up a candidate API key. If valid, single-use keys (non-"remember") are deleted
+ * before being returned.
+ * Returns null if the key isn't registered.
+ */
+async function consumeLocalAPIKey(key) {
+	if (!key) return null;
+	let keys = await _loadLocalAPIKeys();
+	let idx = keys.findIndex(k => k.key === key);
+	if (idx === -1) return null;
+	let entry = keys[idx];
+	if (entry.remember) {
+		return entry;
+	}
+	// Mark used immediately to prevent race conditions
+	keys.splice(idx, 1);
+	await _saveLocalAPIKeys();
+	return entry;
+}
+
+let _authorizeTimestamps = [];
+
+/**
+ * Record a confirmation-requiring request and check whether the rate limit has
+ * been exceeded. Returns the number of seconds until the next slot is available
+ * when the caller should be rejected with 429, or 0 when the request may proceed.
+ */
+function checkAuthorizeRateLimit() {
+	let now = Date.now();
+	_authorizeTimestamps = _authorizeTimestamps.filter(t => now - t < AUTHORIZE_RATE_LIMIT_WINDOW_MS);
+	if (_authorizeTimestamps.length >= AUTHORIZE_RATE_LIMIT_MAX) {
+		let oldest = _authorizeTimestamps[0];
+		let waitMS = AUTHORIZE_RATE_LIMIT_WINDOW_MS - (now - oldest);
+		return Math.max(1, Math.ceil(waitMS / 1000));
+	}
+	_authorizeTimestamps.push(now);
+	return 0;
+}
+
 const exportFormats = new Map([
 	['bibtex', '9cb70025-a888-4a29-a210-93ec52da40d4'],
 	['biblatex', 'b6e39b57-8942-4d11-8259-342c46ce395f'],
@@ -87,24 +230,22 @@ const exportFormats = new Map([
  */
 class LocalAPIEndpoint {
 	async init(requestData) {
+		if (!Zotero.Prefs.get('httpServer.localAPI.enabled')) {
+			return this.makeResponse(403, 'text/plain', 'Local API is not enabled');
+		}
+		requestData.headers = new Headers(requestData.headers);
 		try {
 			return await this._initInternal(requestData);
 		}
 		catch (e) {
-			if (!(e instanceof BadRequestError)) {
-				throw e;
+			if (e instanceof HTTPError) {
+				return this.makeResponse(e.status, 'text/plain', e.message);
 			}
-			return this.makeResponse(400, 'text/plain', e.message);
+			throw e;
 		}
 	}
-	
+
 	async _initInternal(requestData) {
-		if (!Zotero.Prefs.get('httpServer.localAPI.enabled')) {
-			return this.makeResponse(403, 'text/plain', 'Local API is not enabled');
-		}
-		
-		requestData.headers = new Headers(requestData.headers);
-		
 		let apiVersion = parseInt(
 			requestData.headers.get('Zotero-API-Version')
 				|| requestData.searchParams.get('v')
@@ -145,6 +286,22 @@ class LocalAPIEndpoint {
 			await library.waitForDataLoad('item');
 		}
 		
+		let isWriteMethod = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(requestData.method);
+		if (isWriteMethod) {
+			let authResponse = await this._authenticateWriteRequest(requestData);
+			if (authResponse) return authResponse;
+
+			if (!library.editable) {
+				return this.makeResponse(403, 'text/plain', 'Write access denied');
+			}
+
+			let response = await this.run(requestData);
+			if (Array.isArray(response)) {
+				return this.makeResponse(...response);
+			}
+			throw new Error("Write endpoint did not return an HTTP response array");
+		}
+
 		let response = await this.run(requestData);
 		if (response.data) {
 			let dataIsArray = Array.isArray(response.data);
@@ -223,7 +380,7 @@ class LocalAPIEndpoint {
 			
 			let headers = {
 				'Total-Results': totalResults,
-				'Link': Object.entries(links).map(([rel, url]) => `<${url}>; rel="${rel}"`).join(', ')
+				Link: Object.entries(links).map(([rel, url]) => `<${url}>; rel="${rel}"`).join(', ')
 			};
 			let lastModifiedVersion = dataIsArray
 				? Zotero.Libraries.get(requestData.libraryID).clientVersion
@@ -375,9 +532,9 @@ class LocalAPIEndpoint {
 	 * Make an HTTP response array with API headers.
 	 *
 	 * @param {Number} status
-	 * @param {String | Object} contentTypeOrHeaders
-	 * @param {String} body
-	 * @returns {[Number, Object, String]}
+	 * @param {string | Object} contentTypeOrHeaders
+	 * @param {string} body
+	 * @returns {number | string | object}
 	 */
 	makeResponse(status, contentTypeOrHeaders, body) {
 		if (typeof contentTypeOrHeaders == 'string') {
@@ -402,6 +559,117 @@ class LocalAPIEndpoint {
 	run(requestData) {
 		throw new Error("run() must be implemented");
 	}
+
+	/**
+	 * Validate the caller's local API key. The key may be provided either via
+	 * the Zotero-API-Key header or the ?key= query parameter.
+	 *
+	 * Returns null when the request is authorized to proceed, or an HTTP
+	 * response array when it should be rejected. Keys are obtained by callers
+	 * via POST /api/authorize-local; single-use keys are consumed (deleted
+	 * from the persistent store) here.
+	 *
+	 * @param {Object} requestData
+	 * @returns {Promise<null | [Number, (String | Object), String]>}
+	 */
+	async _authenticateWriteRequest(requestData) {
+		let key = requestData.headers.get('Zotero-API-Key')
+			|| requestData.searchParams.get('key')
+			|| '';
+		if (!key) {
+			return [
+				401,
+				{
+					'Content-Type': 'text/plain',
+					'WWW-Authenticate': 'Zotero-API-Key realm="Zotero Local API"',
+				},
+				'API key required -- POST /api/authorize-local to obtain one'
+			];
+		}
+		let entry = await consumeLocalAPIKey(key);
+		if (!entry) {
+			return [401, 'text/plain', 'Invalid or expired API key'];
+		}
+		requestData.apiKey = entry;
+		return null;
+	}
+
+	/**
+	 * Validate the Zotero-Write-Token header (5-32 chars). If present, check that it
+	 * hasn't been used for a successful write within the last 12 hours; otherwise,
+	 * return a 412 response. The caller must invoke {@link _recordWriteToken()}
+	 * after the write succeeds.
+	 *
+	 * @param {object} requestData
+	 * @returns {string | null} The validated token, or null if not provided
+	 * @throws HTTPError on invalid or duplicate token
+	 */
+	_checkWriteToken(requestData) {
+		let token = requestData.headers.get('Zotero-Write-Token');
+		if (!token) return null;
+		if (token.length < 5 || token.length > 32) {
+			throw new HTTPError(400, "Write token must be 5-32 characters in length");
+		}
+		pruneExpired(WRITE_TOKEN_CACHE);
+		if (WRITE_TOKEN_CACHE.has(token)) {
+			throw new HTTPError(412, "Write token already used");
+		}
+		return token;
+	}
+
+	_recordWriteToken(token) {
+		if (!token) return;
+		WRITE_TOKEN_CACHE.set(token, Date.now() + WRITE_TOKEN_CACHE_SECONDS * 1000);
+	}
+
+	/**
+	 * Parse and validate If-Unmodified-Since-Version against the library's clientVersion.
+	 *
+	 * @param {Object} requestData
+	 * @param {Object} options
+	 * @param {Boolean} [options.required] If true and the header is missing, throw 428
+	 * @throws HTTPError on missing/invalid/out-of-date version
+	 */
+	_checkLibraryIfUnmodifiedSinceVersion(requestData, { required = false } = {}) {
+		let header = requestData.headers.get('If-Unmodified-Since-Version');
+		if (header === null) {
+			if (required) {
+				throw new HTTPError(428, "If-Unmodified-Since-Version not provided");
+			}
+			return;
+		}
+		let value = parseInt(header);
+		if (Number.isNaN(value) || value < 0) {
+			throw new HTTPError(400, "Invalid If-Unmodified-Since-Version value");
+		}
+		let library = Zotero.Libraries.get(requestData.libraryID);
+		if (library.clientVersion > value) {
+			throw new HTTPError(412, `Library has been modified since specified version (expected ${value}, found ${library.clientVersion})`);
+		}
+	}
+
+	/**
+	 * Parse a JSON body. Accepts either an already-parsed object (when content-type
+	 * was application/json) or a string. Throws HTTPError(400) on parse failure.
+	 */
+	_parseJSONBody(data) {
+		if (data === null || data === undefined || data === '') {
+			throw new HTTPError(400, "Empty request body");
+		}
+		// Reject binary bodies on JSON endpoints
+		if (data instanceof Ci.nsIInputStream) {
+			throw new HTTPError(400, "Content-Type must be application/json");
+		}
+		if (typeof data === 'object') {
+			return data;
+		}
+		try {
+			return JSON.parse(data);
+		}
+		catch (e) {
+			throw new HTTPError(400, "Invalid JSON: " + e.message);
+		}
+	}
 }
 
 const _404 = [404, 'text/plain', 'Not found'];
@@ -417,6 +685,62 @@ Zotero.Server.LocalAPI.Root = class extends LocalAPIEndpoint {
 };
 Zotero.Server.Endpoints["/api/"] = Zotero.Server.LocalAPI.Root;
 
+/**
+ * Local-only authorization endpoint. Has no analog in the web API. Callers
+ * that receive a 401 from a write endpoint should POST here with their app
+ * name; the user is shown a dialog and can grant or deny access. On grant,
+ * the response includes a 32-character key the caller must pass on subsequent
+ * write requests via the Zotero-API-Key header (or ?key= query parameter).
+ *
+ * If the user picked "Allow" rather than "Always Allow", the returned key
+ * will be invalidated after its first successful use.
+ */
+Zotero.Server.LocalAPI.AuthorizeLocal = class extends LocalAPIEndpoint {
+	supportedMethods = ['POST'];
+	
+	supportedDataTypes = ['application/json'];
+
+	async _initInternal(requestData) {
+		let body = requestData.data;
+		if (!body
+				|| typeof body !== 'object'
+				|| Array.isArray(body)
+				|| typeof body.appName !== 'string'
+				|| !body.appName.trim()) {
+			return this.makeResponse(400, 'text/plain', 'appName is required');
+		}
+		let appName = body.appName.trim();
+
+		let retryAfter = checkAuthorizeRateLimit();
+		if (retryAfter > 0) {
+			return this.makeResponse(
+				429,
+				{
+					'Content-Type': 'text/plain',
+					'Retry-After': String(retryAfter),
+				},
+				'Too many authorization requests'
+			);
+		}
+
+		let { allow, remember } = await Zotero.Server.LocalAPI._promptForAuthorization(appName);
+		if (!allow) {
+			return this.makeResponse(
+				403,
+				'application/json',
+				JSON.stringify({ denied: true })
+			);
+		}
+
+		let key = await addLocalAPIKey(appName, remember);
+		return this.makeResponse(
+			200,
+			'application/json',
+			JSON.stringify({ key, remember: !!remember })
+		);
+	}
+};
+Zotero.Server.Endpoints["/api/authorize-local"] = Zotero.Server.LocalAPI.AuthorizeLocal;
 
 Zotero.Server.LocalAPI.Schema = class extends LocalAPIEndpoint {
 	supportedMethods = ['GET'];
@@ -523,9 +847,23 @@ Zotero.Server.Endpoints["/api/users/:userID/settings"] = Zotero.Server.LocalAPI.
 
 
 Zotero.Server.LocalAPI.Collections = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
-	
-	run({ pathname, pathParams, libraryID }) {
+	supportedMethods = ['GET', 'POST', 'DELETE'];
+
+	async run(requestData) {
+		const WRITE_PATH_RE = /^\/api\/(?:users|groups)\/[^/]+\/collections\/?$/;
+		if (requestData.method === 'POST') {
+			if (!WRITE_PATH_RE.test(requestData.pathname)) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			return writeMultipleObjects(this, requestData, 'collection');
+		}
+		if (requestData.method === 'DELETE') {
+			if (!WRITE_PATH_RE.test(requestData.pathname)) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			return deleteMultipleObjects(this, requestData, 'collection', 'collectionKey');
+		}
+		let { pathname, pathParams, libraryID } = requestData;
 		let top = pathname.endsWith('/top');
 		let collections = pathParams.collectionKey
 			? Zotero.Collections.getByParent(Zotero.Collections.getIDFromLibraryAndKey(libraryID, pathParams.collectionKey))
@@ -541,9 +879,16 @@ Zotero.Server.Endpoints["/api/users/:userID/collections/:collectionKey/collectio
 Zotero.Server.Endpoints["/api/groups/:groupID/collections/:collectionKey/collections"] = Zotero.Server.LocalAPI.Collections;
 
 Zotero.Server.LocalAPI.Collection = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'PUT', 'PATCH', 'DELETE'];
 
-	run({ pathParams, libraryID }) {
+	async run(requestData) {
+		if (requestData.method === 'PUT' || requestData.method === 'PATCH') {
+			return writeSingleObject(this, requestData, 'collection', requestData.method === 'PATCH');
+		}
+		if (requestData.method === 'DELETE') {
+			return deleteSingleObject(this, requestData, 'collection');
+		}
+		let { pathParams, libraryID } = requestData;
 		let collection = Zotero.Collections.getByLibraryAndKey(libraryID, pathParams.collectionKey);
 		if (!collection) return _404;
 		return { data: collection };
@@ -577,9 +922,26 @@ Zotero.Server.Endpoints["/api/users/:userID/groups/:groupID"] = Zotero.Server.Lo
 
 
 Zotero.Server.LocalAPI.Items = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'POST', 'DELETE'];
 
-	async run({ pathname, pathParams, searchParams, libraryID }) {
+	async run(requestData) {
+		const WRITE_PATH_RE = /^\/api\/(?:users|groups)\/[^/]+\/items\/?$/;
+		if (requestData.method === 'POST') {
+			if (!WRITE_PATH_RE.test(requestData.pathname)) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			return writeMultipleObjects(this, requestData, 'item');
+		}
+		if (requestData.method === 'DELETE') {
+			if (!WRITE_PATH_RE.test(requestData.pathname)) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			return deleteMultipleObjects(this, requestData, 'item', 'itemKey');
+		}
+		return this._runGet(requestData);
+	}
+
+	async _runGet({ pathname, pathParams, searchParams, libraryID }) {
 		let isTags = pathname.endsWith('/tags');
 		if (isTags) {
 			// Cut it off so other .endsWith() checks work
@@ -732,9 +1094,16 @@ Zotero.Server.Endpoints["/api/users/:userID/searches/:searchKey/items"] = Zotero
 Zotero.Server.Endpoints["/api/groups/:groupID/searches/:searchKey/items"] = Zotero.Server.LocalAPI.Items;
 
 Zotero.Server.LocalAPI.Item = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'PUT', 'PATCH', 'DELETE'];
 
-	async run({ pathParams, libraryID }) {
+	async run(requestData) {
+		if (requestData.method === 'PUT' || requestData.method === 'PATCH') {
+			return writeSingleObject(this, requestData, 'item', requestData.method === 'PATCH');
+		}
+		if (requestData.method === 'DELETE') {
+			return deleteSingleObject(this, requestData, 'item');
+		}
+		let { pathParams, libraryID } = requestData;
 		let item = await Zotero.Items.getByLibraryAndKeyAsync(libraryID, pathParams.itemKey);
 		if (!item) return _404;
 		return { data: item };
@@ -745,9 +1114,24 @@ Zotero.Server.Endpoints["/api/groups/:groupID/items/:itemKey"] = Zotero.Server.L
 
 
 Zotero.Server.LocalAPI.ItemFile = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'POST', 'PATCH'];
 
-	async run({ pathname, pathParams, libraryID }) {
+	async run(requestData) {
+		let { method, pathname, pathParams, libraryID } = requestData;
+		if (method === 'POST') {
+			if (pathname.endsWith('/view') || pathname.endsWith('/url')) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			return handleFileWrite(this, requestData);
+		}
+		if (method === 'PATCH') {
+			if (pathname.endsWith('/view') || pathname.endsWith('/url')) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			// Partial uploads (binary diffs) aren't supported locally; the
+			// client should fall back to a full upload (per dataserver docs).
+			return [405, 'text/plain', 'Partial uploads are not supported by the local API'];
+		}
 		let item = await Zotero.Items.getByLibraryAndKeyAsync(libraryID, pathParams.itemKey);
 		if (!item) return _404;
 		if (!item.isFileAttachment()) {
@@ -756,7 +1140,7 @@ Zotero.Server.LocalAPI.ItemFile = class extends LocalAPIEndpoint {
 		if (pathname.endsWith('/url')) {
 			return [200, 'text/plain', item.getLocalFileURL()];
 		}
-		return [302, { 'Location': item.getLocalFileURL() }, ''];
+		return [302, { Location: item.getLocalFileURL() }, ''];
 	}
 };
 Zotero.Server.Endpoints["/api/users/:userID/items/:itemKey/file"] = Zotero.Server.LocalAPI.ItemFile;
@@ -766,11 +1150,135 @@ Zotero.Server.Endpoints["/api/groups/:groupID/items/:itemKey/file/view"] = Zoter
 Zotero.Server.Endpoints["/api/users/:userID/items/:itemKey/file/view/url"] = Zotero.Server.LocalAPI.ItemFile;
 Zotero.Server.Endpoints["/api/groups/:groupID/items/:itemKey/file/view/url"] = Zotero.Server.LocalAPI.ItemFile;
 
+/**
+ * Local-only endpoint that receives the raw bytes for a previously authorized
+ * upload (the URL returned in the authorize phase). Writes the file directly
+ * into the attachment's storage directory.
+ */
+Zotero.Server.LocalAPI.UploadReceiver = class extends LocalAPIEndpoint {
+	supportedMethods = ['POST'];
+
+	// Required so the post-write block doesn't insist on a library write check
+	async _initInternal(requestData) {
+		try {
+			if (!Zotero.Prefs.get('httpServer.localAPI.enabled')) {
+				return this.makeResponse(403, 'text/plain', 'Local API is not enabled');
+			}
+			requestData.headers = new Headers(requestData.headers);
+
+			let uploadKey = requestData.pathParams.uploadKey;
+			pruneExpired(PENDING_UPLOADS);
+			let upload = PENDING_UPLOADS.get(uploadKey);
+			if (!upload) {
+				return this.makeResponse(404, 'text/plain', 'Unknown or expired upload key');
+			}
+
+			let data = requestData.data;
+			let bytes;
+			if (data instanceof Ci.nsIInputStream) {
+				let binaryStream = Cc["@mozilla.org/binaryinputstream;1"]
+					.createInstance(Ci.nsIBinaryInputStream);
+				binaryStream.setInputStream(data);
+				let available = binaryStream.available();
+				bytes = new Uint8Array(binaryStream.readByteArray(available));
+			}
+			else if (typeof data === 'string') {
+				// Best effort: text-decoded body. Will produce a corrupted file
+				// for true binary content -- the client should send a binary
+				// content-type so the server hands us the raw stream.
+				let encoder = new TextEncoder();
+				bytes = encoder.encode(data);
+			}
+			else {
+				return this.makeResponse(400, 'text/plain', 'No file content provided');
+			}
+
+			let item = await Zotero.Items.getByLibraryAndKeyAsync(upload.libraryID, upload.itemKey);
+			if (!item || !item.isFileAttachment()) {
+				PENDING_UPLOADS.delete(uploadKey);
+				return this.makeResponse(404, 'text/plain', 'Attachment item no longer exists');
+			}
+
+			let dir = Zotero.Attachments.getStorageDirectory(item);
+			await IOUtils.makeDirectory(dir.path, { ignoreExisting: true });
+			let destPath = PathUtils.join(dir.path, upload.filename);
+			await IOUtils.write(destPath, bytes);
+
+			// Verify the actual md5 matches what was claimed in the authorize phase.
+			let actualMD5 = await Zotero.Utilities.Internal.md5Async(destPath);
+			if (actualMD5 !== upload.md5) {
+				await IOUtils.remove(destPath, { ignoreAbsent: true });
+				PENDING_UPLOADS.delete(uploadKey);
+				return this.makeResponse(400, 'text/plain',
+					`File MD5 does not match expected (got ${actualMD5}, expected ${upload.md5})`);
+			}
+
+			upload.uploaded = true;
+			return this.makeResponse(201, 'text/plain', '');
+		}
+		catch (e) {
+			Zotero.logError(e);
+			return this.makeResponse(500, 'text/plain', 'Upload failed: ' + e.message);
+		}
+	}
+};
+Zotero.Server.Endpoints["/api/local/uploads/:uploadKey"] = Zotero.Server.LocalAPI.UploadReceiver;
+
+
+// Mirrors dataserver's Zotero_API::$maxWriteFullText
+const MAX_WRITE_FULLTEXT = 10;
+
+/**
+ * Validate a single fulltext write payload. Throws HTTPError(400) on failure.
+ */
+function validateFullTextItemBody(body) {
+	if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+		throw new HTTPError(400, 'Body must be a JSON object');
+	}
+	if (typeof body.content !== 'string') {
+		throw new HTTPError(400, "'content' must be a string");
+	}
+	for (let stat of ['indexedChars', 'totalChars', 'indexedPages', 'totalPages']) {
+		if (body[stat] !== undefined && body[stat] !== null && !Number.isInteger(body[stat])) {
+			throw new HTTPError(400, `'${stat}' must be an integer`);
+		}
+	}
+}
 
 Zotero.Server.LocalAPI.ItemFullText = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'PUT'];
+
+	supportedDataTypes = ['application/json'];
+
+	async run(requestData) {
+		let { pathParams, libraryID, data } = requestData;
+		if (requestData.method === 'PUT') {
+			let body;
+			try {
+				body = this._parseJSONBody(data);
+				validateFullTextItemBody(body);
+			}
+			catch (e) {
+				if (e instanceof HTTPError) return [e.status, 'text/plain', e.message];
+				throw e;
+			}
+
+			let newVersion;
+			try {
+				newVersion = await storeItemFullText(libraryID, pathParams.itemKey, body);
+			}
+			catch (e) {
+				if (e instanceof HTTPError) return [e.status, 'text/plain', e.message];
+				throw e;
+			}
+
+			return [
+				204,
+				{ 'Last-Modified-Version': newVersion },
+				''
+			];
+		}
 
-	async run({ pathParams, libraryID }) {
 		let item = await Zotero.Items.getByLibraryAndKeyAsync(libraryID, pathParams.itemKey);
 		if (!item || !item.isFileAttachment() || !Zotero.Fulltext.isCachedMIMEType(item.attachmentContentType)) {
 			return _404;
@@ -808,9 +1316,15 @@ Zotero.Server.Endpoints["/api/groups/:groupID/items/:itemKey/fulltext"] = Zotero
 
 
 Zotero.Server.LocalAPI.FullText = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'POST'];
 
-	async run({ searchParams, libraryID }) {
+	supportedDataTypes = ['application/json'];
+
+	async run(requestData) {
+		if (requestData.method === 'POST') {
+			return writeBulkFullText(this, requestData);
+		}
+		let { searchParams, libraryID } = requestData;
 		let since = parseInt(searchParams.get('since'));
 		if (Number.isNaN(since)) {
 			return [400, 'text/plain', `Invalid 'since' value '${searchParams.get('since')}'`];
@@ -832,10 +1346,90 @@ Zotero.Server.Endpoints["/api/users/:userID/fulltext"] = Zotero.Server.LocalAPI.
 Zotero.Server.Endpoints["/api/groups/:groupID/fulltext"] = Zotero.Server.LocalAPI.FullText;
 
 
-Zotero.Server.LocalAPI.Searches = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+async function writeBulkFullText(endpoint, requestData) {
+	let { libraryID, data } = requestData;
 
-	async run({ libraryID }) {
+	let body;
+	try {
+		endpoint._checkLibraryIfUnmodifiedSinceVersion(requestData, { required: true });
+		body = endpoint._parseJSONBody(data);
+	}
+	catch (e) {
+		if (e instanceof HTTPError) return [e.status, 'text/plain', e.message];
+		throw e;
+	}
+
+	if (!Array.isArray(body)) {
+		return [400, 'text/plain', 'Uploaded data must be a JSON array'];
+	}
+	if (body.length === 0) {
+		return [400, 'text/plain', 'No full-text entries provided'];
+	}
+	if (body.length > MAX_WRITE_FULLTEXT) {
+		return [
+			413,
+			'text/plain',
+			`Cannot write more than ${MAX_WRITE_FULLTEXT} full-text entries at a time`
+		];
+	}
+
+	let results = new MultiWriteResults();
+	for (let i = 0; i < body.length; i++) {
+		let entry = body[i];
+		let providedKey = '';
+		try {
+			if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+				throw new HTTPError(400, `Invalid value for index ${i}; expected JSON object`);
+			}
+			if (typeof entry.key !== 'string' || !entry.key) {
+				throw new HTTPError(400, "'key' is required");
+			}
+			providedKey = entry.key;
+			validateObjectKey(providedKey);
+			validateFullTextItemBody(entry);
+
+			await storeItemFullText(libraryID, providedKey, entry);
+			// Mirrors dataserver: successful fulltext entries return only the key, no full JSON
+			results.addSuccess(i, { key: providedKey });
+		}
+		catch (e) {
+			Zotero.debug(`Local API: fulltext write index ${i} failed: ${e.message || e}`, 2);
+			if (!(e instanceof HTTPError)) {
+				Zotero.logError(e);
+			}
+			results.addFailure(i, providedKey, e);
+		}
+	}
+
+	return [
+		200,
+		{
+			'Content-Type': 'application/json',
+			'Last-Modified-Version': Zotero.Libraries.get(libraryID).clientVersion,
+		},
+		JSON.stringify(results.toJSON(), null, 4)
+	];
+}
+
+
+Zotero.Server.LocalAPI.Searches = class extends LocalAPIEndpoint {
+	supportedMethods = ['GET', 'POST', 'DELETE'];
+
+	async run(requestData) {
+		const WRITE_PATH_RE = /^\/api\/(?:users|groups)\/[^/]+\/searches\/?$/;
+		if (requestData.method === 'POST') {
+			if (!WRITE_PATH_RE.test(requestData.pathname)) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			return writeMultipleObjects(this, requestData, 'search');
+		}
+		if (requestData.method === 'DELETE') {
+			if (!WRITE_PATH_RE.test(requestData.pathname)) {
+				return [405, 'text/plain', 'Method not allowed for this path'];
+			}
+			return deleteMultipleObjects(this, requestData, 'search', 'searchKey');
+		}
+		let { libraryID } = requestData;
 		let searches = await Zotero.Searches.getAll(libraryID);
 		return { data: searches };
 	}
@@ -844,9 +1438,16 @@ Zotero.Server.Endpoints["/api/users/:userID/searches"] = Zotero.Server.LocalAPI.
 Zotero.Server.Endpoints["/api/groups/:groupID/searches"] = Zotero.Server.LocalAPI.Searches;
 
 Zotero.Server.LocalAPI.Search = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'PUT', 'PATCH', 'DELETE'];
 
-	async run({ pathParams, libraryID }) {
+	async run(requestData) {
+		if (requestData.method === 'PUT' || requestData.method === 'PATCH') {
+			return writeSingleObject(this, requestData, 'search', requestData.method === 'PATCH');
+		}
+		if (requestData.method === 'DELETE') {
+			return deleteSingleObject(this, requestData, 'search');
+		}
+		let { pathParams, libraryID } = requestData;
 		let search = Zotero.Searches.getByLibraryAndKey(libraryID, pathParams.searchKey);
 		if (!search) return _404;
 		return { data: search };
@@ -857,12 +1458,42 @@ Zotero.Server.Endpoints["/api/groups/:groupID/searches/:searchKey"] = Zotero.Ser
 
 
 Zotero.Server.LocalAPI.Tags = class extends LocalAPIEndpoint {
-	supportedMethods = ['GET'];
+	supportedMethods = ['GET', 'DELETE'];
 
-	async run({ libraryID }) {
-		let tags = await Zotero.Tags.getAll(libraryID);
-		let json = await Zotero.Tags.toResponseJSON(libraryID, tags);
-		return { data: json };
+	async run(requestData) {
+		let { libraryID, searchParams } = requestData;
+		if (requestData.method === 'DELETE') {
+			this._checkLibraryIfUnmodifiedSinceVersion(requestData, { required: true });
+
+			let raw = searchParams.get('tag');
+			if (!raw) {
+				return [400, 'text/plain', "'tag' not provided"];
+			}
+			// '||' separates tag names; values are already URL-decoded at this point.
+			let names = raw.split('||').map(t => t.trim()).filter(Boolean);
+			if (!names.length) {
+				return [400, 'text/plain', "'tag' not provided"];
+			}
+			if (names.length > MAX_DELETE_OBJECTS) {
+				return [413, 'text/plain', `Cannot delete more than ${MAX_DELETE_OBJECTS} tags at a time`];
+			}
+
+			let tagIDs = names.map(name => Zotero.Tags.getID(name)).filter(id => !!id);
+			if (tagIDs.length) {
+				await Zotero.Tags.removeFromLibrary(libraryID, tagIDs);
+			}
+
+			return [
+				204,
+				{ 'Last-Modified-Version': Zotero.Libraries.get(libraryID).clientVersion },
+				''
+			];
+		}
+		else {
+			let tags = await Zotero.Tags.getAll(libraryID);
+			let json = await Zotero.Tags.toResponseJSON(libraryID, tags);
+			return { data: json };
+		}
 	}
 };
 Zotero.Server.Endpoints["/api/users/:userID/tags"] = Zotero.Server.LocalAPI.Tags;
@@ -882,9 +1513,55 @@ Zotero.Server.Endpoints["/api/users/:userID/tags/:tag"] = Zotero.Server.LocalAPI
 Zotero.Server.Endpoints["/api/groups/:groupID/tags/:tag"] = Zotero.Server.LocalAPI.Tag;
 
 
+/**
+ * Show the local API authorization dialog. Stubbable in tests.
+ * @returns {Promise<{ allow: boolean, remember: boolean }>}
+ */
+Zotero.Server.LocalAPI._promptForAuthorization = async function (appName) {
+	let title = Zotero.ftl.formatValueSync('local-api-authorize-title');
+	let text = Zotero.ftl.formatValueSync('local-api-authorize-text', { appName });
+	let allowLabel = Zotero.ftl.formatValueSync('local-api-authorize-allow');
+	let alwaysAllowLabel = Zotero.ftl.formatValueSync('local-api-authorize-always-allow');
+	let denyLabel = Zotero.ftl.formatValueSync('local-api-authorize-deny');
+
+	let index = Zotero.Prompt.confirm({
+		title,
+		text,
+		button0: allowLabel,
+		button1: alwaysAllowLabel,
+		button2: denyLabel,
+		defaultButton: 2,
+	});
+	return { allow: index === 0 || index === 1, remember: index === 1 };
+};
+
+/**
+ * Number of remembered (persistent) local API authorizations.
+ */
+Zotero.Server.LocalAPI.getAuthorizationCount = async function () {
+	let keys = await _loadLocalAPIKeys();
+	return keys.filter(k => k.remember).length;
+};
+
+/**
+ * Discard every stored local API authorization. Subsequent write requests will
+ * have to reauthorize.
+ */
+Zotero.Server.LocalAPI.clearAuthorizations = async function () {
+	_localAPIKeysCache = [];
+	let path = _localAPIKeysPath();
+	if (await IOUtils.exists(path)) {
+		await IOUtils.remove(path);
+	}
+};
+
+Zotero.Server.LocalAPI._resetAuthorizeRateLimit = function () {
+	_authorizeTimestamps = [];
+};
+
 /**
  * Convert a {@link Zotero.DataObject}, or an array of DataObjects, to response JSON
- * 		with appropriate included data based on the 'include' query parameter.
+ * with appropriate included data based on the 'include' query parameter.
  *
  * @param {Zotero.DataObject | Zotero.DataObject[]} dataObjectOrObjects
  * @param {URLSearchParams} searchParams
@@ -972,7 +1649,7 @@ async function citeprocToHTML(itemOrItems, searchParams, asCitationList) {
 			style = Zotero.Styles.get(styleID);
 		}
 		catch (e) {
-			throw new BadRequestError(`Invalid style: ${styleIDOrURL} (${e.message})`);
+			throw new HTTPError(400, `Invalid style: ${styleIDOrURL} (${e.message})`);
 		}
 	}
 	if (!style) {
@@ -980,6 +1657,7 @@ async function citeprocToHTML(itemOrItems, searchParams, asCitationList) {
 	}
 	
 	let cslEngine = style.getCiteProc(locale, 'html', { cache: true });
+	// eslint-disable-next-line camelcase
 	cslEngine.opt.development_extensions.wrap_url_and_doi = linkWrap;
 	return Zotero.Cite.makeFormattedBibliographyOrCitationList(cslEngine, items, 'html', asCitationList);
 }
@@ -988,7 +1666,7 @@ async function citeprocToHTML(itemOrItems, searchParams, asCitationList) {
  * Export items to a string with the given translator.
  *
  * @param {Zotero.Item|Zotero.Item[]} itemOrItems
- * @param {String} translatorID
+ * @param {string} translatorID
  * @returns {Promise<String>}
  */
 function exportItems(itemOrItems, translatorID) {
@@ -1015,8 +1693,8 @@ function exportItems(itemOrItems, translatorID) {
  * Evaluate the API's search syntax: https://www.zotero.org/support/dev/web_api/v3/basics#search_syntax
  *
  * @param {Zotero.Search} parentSearch
- * @param {String[]} searchStrings The search strings provided by the client as query parameters
- * @param {String} condition The search condition name
+ * @param {string[]} searchStrings The search strings provided by the client as query parameters
+ * @param {string} condition The search condition name
  */
 function buildSearchFromSearchSyntax(parentSearch, searchStrings, condition) {
 	for (let searchString of searchStrings) {
@@ -1056,4 +1734,787 @@ function searchToDebugJSON(search) {
 	};
 }
 
-class BadRequestError extends Error {}
+/**
+ * Validate an object key from a query parameter or JSON body. Throws HTTPError(400) if invalid.
+ */
+function validateObjectKey(key) {
+	if (typeof key !== 'string' || !Zotero.Utilities.isValidObjectKey(key)) {
+		throw new HTTPError(400, `Invalid key: '${key}'`);
+	}
+	return key;
+}
+
+/**
+ * Parse a comma-separated list of keys from a query parameter, validating each.
+ * Throws HTTPError if missing, malformed, or exceeds the max-delete limit.
+ */
+function parseKeyList(searchParams, paramName) {
+	let raw = searchParams.get(paramName);
+	if (!raw) {
+		throw new HTTPError(400, `'${paramName}' not provided`);
+	}
+	let keys = raw.split(',').map(k => k.trim()).filter(Boolean);
+	if (!keys.length) {
+		throw new HTTPError(400, `'${paramName}' not provided`);
+	}
+	if (keys.length > MAX_DELETE_OBJECTS) {
+		throw new HTTPError(413, `Cannot delete more than ${MAX_DELETE_OBJECTS} objects at a time`);
+	}
+	for (let key of keys) {
+		validateObjectKey(key);
+	}
+	return keys;
+}
+
+/**
+ * Return the response JSON for a successfully written data object, using the
+ * same options used elsewhere in the local API.
+ */
+async function dataObjectToResponseJSON(dataObject) {
+	return dataObject.toResponseJSONAsync({
+		apiURL: `http://localhost:${Zotero.Server.port}/api/`,
+		includeGroupDetails: true,
+		syncedStorageProperties: false,
+		syncedVersionProperty: false,
+	});
+}
+
+/**
+ * Look up an existing object by library + key, returning null if not found.
+ * `kind` is one of 'item', 'collection', 'search'.
+ */
+async function getExistingObjectByKey(libraryID, key, kind) {
+	switch (kind) {
+		case 'item':
+			return Zotero.Items.getByLibraryAndKeyAsync(libraryID, key);
+		case 'collection':
+			return Zotero.Collections.getByLibraryAndKey(libraryID, key);
+		case 'search':
+			return Zotero.Searches.getByLibraryAndKey(libraryID, key);
+		default:
+			throw new Error(`Unknown object kind: ${kind}`);
+	}
+}
+
+/**
+ * Construct a new object of the given kind in the given library, ready
+ * for fromJSON(). For items, the itemType must be passed.
+ */
+function makeNewObject(libraryID, kind, itemType) {
+	let obj;
+	switch (kind) {
+		case 'item':
+			if (!itemType) {
+				throw new HTTPError(400, "itemType property not provided");
+			}
+			if (!Zotero.ItemTypes.getID(itemType)) {
+				throw new HTTPError(400, `Unknown itemType '${itemType}'`);
+			}
+			obj = new Zotero.Item(itemType);
+			break;
+		case 'collection':
+			obj = new Zotero.Collection();
+			break;
+		case 'search':
+			obj = new Zotero.Search();
+			break;
+		default:
+			throw new Error(`Unknown object kind: ${kind}`);
+	}
+	obj.libraryID = libraryID;
+	return obj;
+}
+
+/**
+ * Apply JSON to an existing or new data object. Throws HTTPError on validation
+ * failure. Caller is responsible for calling saveTx().
+ */
+function applyJSONToObject(obj, json, kind) {
+	try {
+		obj.fromJSON(json, { strict: false });
+	}
+	catch (e) {
+		if (e && e.name === 'ZoteroInvalidDataError') {
+			throw new HTTPError(400, e.message);
+		}
+		throw e;
+	}
+	if (kind === 'item' && obj.isNote() && typeof json.note === 'string') {
+		// fromJSON already sets the note for note/attachment items
+	}
+}
+
+/**
+ * Merge a PATCH JSON object onto the current item/collection/search JSON
+ * representation. Keys present in `patchJSON` (even if empty) take precedence;
+ * keys absent from `patchJSON` keep their existing values.
+ */
+function mergePatchJSON(existingJSON, patchJSON) {
+	let merged = { ...existingJSON };
+	for (let k of Object.keys(patchJSON)) {
+		merged[k] = patchJSON[k];
+	}
+	return merged;
+}
+
+/**
+ * Multi-object write (POST). Handles items, collections, searches uniformly.
+ */
+async function writeMultipleObjects(endpoint, requestData, kind) {
+	let { libraryID, data } = requestData;
+
+	let token;
+	let body;
+	try {
+		token = endpoint._checkWriteToken(requestData);
+		endpoint._checkLibraryIfUnmodifiedSinceVersion(requestData);
+		body = endpoint._parseJSONBody(data);
+	}
+	catch (e) {
+		if (e instanceof HTTPError) {
+			return [e.status, 'text/plain', e.message];
+		}
+		throw e;
+	}
+
+	if (!Array.isArray(body)) {
+		return [400, 'text/plain', `Uploaded data must be a JSON array`];
+	}
+	if (body.length === 0) {
+		return [400, 'text/plain', `No ${kind}s provided`];
+	}
+	if (body.length > MAX_WRITE_OBJECTS) {
+		return [
+			413,
+			'text/plain',
+			`Cannot add more than ${MAX_WRITE_OBJECTS} ${kind}s at a time`
+		];
+	}
+
+	let results = new MultiWriteResults();
+
+	for (let i = 0; i < body.length; i++) {
+		let entry = body[i];
+		let providedKey = '';
+		try {
+			if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+				throw new HTTPError(400, `Invalid value for index ${i} in uploaded data; expected JSON ${kind} object`);
+			}
+			providedKey = typeof entry.key === 'string' ? entry.key : '';
+
+			let obj;
+			let isUpdate = false;
+			if (providedKey) {
+				validateObjectKey(providedKey);
+				obj = await getExistingObjectByKey(libraryID, providedKey, kind);
+				if (obj) {
+					isUpdate = true;
+					if (entry.version !== undefined && entry.version !== null) {
+						let expectedVersion = parseInt(entry.version);
+						if (Number.isNaN(expectedVersion)) {
+							throw new HTTPError(400, "Invalid version value");
+						}
+						if (expectedVersion !== obj.clientVersion) {
+							throw new HTTPError(412, `${kind} version mismatch: expected ${expectedVersion}, found ${obj.clientVersion}`);
+						}
+					}
+					// POST follows PATCH semantics: merge patch with existing
+					let existingJSON = obj.toJSON();
+					entry = mergePatchJSON(existingJSON, entry);
+				}
+				else {
+					obj = makeNewObject(libraryID, kind, entry.itemType);
+					obj.key = providedKey;
+				}
+			}
+			else {
+				obj = makeNewObject(libraryID, kind, entry.itemType);
+			}
+
+			applyJSONToObject(obj, entry, kind);
+
+			if (obj.hasChanged()) {
+				await obj.saveTx();
+				let json = await dataObjectToResponseJSON(obj);
+				results.addSuccess(i, json);
+			}
+			else if (isUpdate) {
+				results.addUnchanged(i, obj.key);
+			}
+			else {
+				// New object with nothing to set -- treat as success
+				await obj.saveTx();
+				let json = await dataObjectToResponseJSON(obj);
+				results.addSuccess(i, json);
+			}
+		}
+		catch (e) {
+			Zotero.debug(`Local API: ${kind} write index ${i} failed: ${e.message || e}`, 2);
+			if (!(e instanceof HTTPError)) {
+				Zotero.logError(e);
+			}
+			results.addFailure(i, providedKey, e);
+		}
+	}
+
+	endpoint._recordWriteToken(token);
+
+	let headers = {
+		'Content-Type': 'application/json',
+		'Last-Modified-Version': Zotero.Libraries.get(libraryID).clientVersion,
+	};
+	return [200, headers, JSON.stringify(results.toJSON(), null, 4)];
+}
+
+/**
+ * Single-object write (PUT or PATCH).
+ */
+async function writeSingleObject(endpoint, requestData, kind, isPatch) {
+	let { libraryID, pathParams, data } = requestData;
+	let key;
+	switch (kind) {
+		case 'item':
+			key = pathParams.itemKey;
+			break;
+		case 'collection':
+			key = pathParams.collectionKey;
+			break;
+		case 'search':
+			key = pathParams.searchKey;
+			break;
+		default:
+			throw new Error(`Unknown kind: ${kind}`);
+	}
+
+	let body;
+	try {
+		validateObjectKey(key);
+		endpoint._checkLibraryIfUnmodifiedSinceVersion(requestData);
+		body = endpoint._parseJSONBody(data);
+	}
+	catch (e) {
+		if (e instanceof HTTPError) {
+			return [e.status, 'text/plain', e.message];
+		}
+		throw e;
+	}
+	if (!body || typeof body !== 'object' || Array.isArray(body)) {
+		return [400, 'text/plain', 'Uploaded data must be a JSON object'];
+	}
+
+	let obj = await getExistingObjectByKey(libraryID, key, kind);
+	let isUpdate = !!obj;
+
+	if (isUpdate) {
+		// Per-object version check
+		if (body.version !== undefined && body.version !== null) {
+			let expectedVersion = parseInt(body.version);
+			if (Number.isNaN(expectedVersion)) {
+				return [400, 'text/plain', 'Invalid version value'];
+			}
+			if (expectedVersion !== obj.clientVersion) {
+				return [
+					412,
+					'text/plain',
+					`${kind} version mismatch: expected ${expectedVersion}, found ${obj.clientVersion}`
+				];
+			}
+		}
+		else if (!requestData.headers.get('If-Unmodified-Since-Version')) {
+			return [428, 'text/plain', 'If-Unmodified-Since-Version not provided'];
+		}
+
+		if (isPatch) {
+			let existingJSON = obj.toJSON();
+			body = mergePatchJSON(existingJSON, body);
+		}
+	}
+	else {
+		if (!body.itemType && kind === 'item') {
+			return [400, 'text/plain', 'itemType property not provided'];
+		}
+		try {
+			obj = makeNewObject(libraryID, kind, body.itemType);
+			obj.key = key;
+		}
+		catch (e) {
+			if (e instanceof HTTPError) {
+				return [e.status, 'text/plain', e.message];
+			}
+			throw e;
+		}
+	}
+
+	try {
+		applyJSONToObject(obj, body, kind);
+	}
+	catch (e) {
+		if (e instanceof HTTPError) {
+			return [e.status, 'text/plain', e.message];
+		}
+		throw e;
+	}
+
+	if (obj.hasChanged()) {
+		await obj.saveTx();
+	}
+
+	return [
+		204,
+		{ 'Last-Modified-Version': Zotero.Libraries.get(libraryID).clientVersion },
+		''
+	];
+}
+
+/**
+ * Multi-object DELETE (e.g. ?itemKey=KEY1,KEY2,...).
+ *
+ * `paramName` is the query parameter name ('itemKey', 'collectionKey', 'searchKey').
+ */
+async function deleteMultipleObjects(endpoint, requestData, kind, paramName) {
+	let { libraryID, searchParams } = requestData;
+
+	try {
+		endpoint._checkLibraryIfUnmodifiedSinceVersion(requestData, { required: true });
+	}
+	catch (e) {
+		if (e instanceof HTTPError) {
+			return [e.status, 'text/plain', e.message];
+		}
+		throw e;
+	}
+
+	let keys;
+	try {
+		keys = parseKeyList(searchParams, paramName);
+	}
+	catch (e) {
+		if (e instanceof HTTPError) {
+			return [e.status, 'text/plain', e.message];
+		}
+		throw e;
+	}
+
+	for (let key of keys) {
+		let obj = await getExistingObjectByKey(libraryID, key, kind);
+		if (obj) {
+			await obj.eraseTx();
+		}
+	}
+
+	return [
+		204,
+		{ 'Last-Modified-Version': Zotero.Libraries.get(libraryID).clientVersion },
+		''
+	];
+}
+
+/**
+ * Single-object DELETE.
+ */
+async function deleteSingleObject(endpoint, requestData, kind) {
+	let { libraryID, pathParams } = requestData;
+	let key;
+	switch (kind) {
+		case 'item':
+			key = pathParams.itemKey;
+			break;
+		case 'collection':
+			key = pathParams.collectionKey;
+			break;
+		case 'search':
+			key = pathParams.searchKey;
+			break;
+		default:
+			throw new Error(`Unknown kind: ${kind}`);
+	}
+
+	try {
+		validateObjectKey(key);
+	}
+	catch (e) {
+		if (e instanceof HTTPError) {
+			return [e.status, 'text/plain', e.message];
+		}
+		throw e;
+	}
+
+	let obj = await getExistingObjectByKey(libraryID, key, kind);
+	if (!obj) {
+		return _404;
+	}
+
+	// Per-object version check: prefer If-Unmodified-Since-Version against the
+	// object's own clientVersion, falling back to library-level when checking
+	// the bare header against library version (which the base helper does).
+	let header = requestData.headers.get('If-Unmodified-Since-Version');
+	if (header === null) {
+		return [428, 'text/plain', 'If-Unmodified-Since-Version not provided'];
+	}
+	let expectedVersion = parseInt(header);
+	if (Number.isNaN(expectedVersion) || expectedVersion < 0) {
+		return [400, 'text/plain', 'Invalid If-Unmodified-Since-Version value'];
+	}
+	if (obj.clientVersion > expectedVersion) {
+		return [
+			412,
+			'text/plain',
+			`${kind} has been modified since specified version `
+			+ `(expected ${expectedVersion}, found ${obj.clientVersion})`
+		];
+	}
+
+	await obj.eraseTx();
+
+	return [
+		204,
+		{ 'Last-Modified-Version': Zotero.Libraries.get(libraryID).clientVersion },
+		''
+	];
+}
+
+/**
+ * Handle POST /items/:itemKey/file: either an authorize call (no `upload=`)
+ * or a register call (`upload=<uploadKey>`).
+ *
+ * Content-Type must be application/x-www-form-urlencoded per the web API spec.
+ */
+async function handleFileWrite(endpoint, requestData) {
+	let { libraryID, pathParams, data, headers } = requestData;
+
+	if (!data || typeof data !== 'object') {
+		return [400, 'text/plain', 'Content-Type must be application/x-www-form-urlencoded'];
+	}
+
+	let item = await Zotero.Items.getByLibraryAndKeyAsync(libraryID, pathParams.itemKey);
+	if (!item) return _404;
+	if (!item.isFileAttachment()) {
+		return [400, 'text/plain', `Not a file attachment: ${item.key}`];
+	}
+	let linkMode = item.attachmentLinkMode;
+	if (linkMode !== Zotero.Attachments.LINK_MODE_IMPORTED_FILE
+			&& linkMode !== Zotero.Attachments.LINK_MODE_IMPORTED_URL) {
+		return [400, 'text/plain', 'Cannot upload files for non-imported attachments'];
+	}
+	if (!Zotero.Libraries.get(libraryID).filesEditable) {
+		return [403, 'text/plain', 'File editing denied'];
+	}
+
+	// Register phase
+	if (data.upload !== undefined) {
+		return registerUpload(item, data, headers);
+	}
+
+	// Authorize phase
+	return authorizeUpload(item, data, headers, requestData);
+}
+
+/**
+ * Authorize a new file upload. Validates the request, then returns either
+ * {exists: 1} if the file already matches locally, or upload details with an
+ * uploadKey that the client uses to actually transmit the file bytes.
+ */
+async function authorizeUpload(item, params, headers, requestData) {
+	// Validate If-Match / If-None-Match
+	let ifMatch = headers.get('If-Match');
+	let ifNoneMatch = headers.get('If-None-Match');
+	if (!ifMatch && !ifNoneMatch) {
+		return [428, 'text/plain', 'If-Match/If-None-Match header not provided'];
+	}
+
+	// Current synced hash for this attachment, if any
+	let currentSyncedMD5 = item.attachmentSyncedHash || null;
+
+	if (ifMatch) {
+		let match = /^"?([a-f0-9]{32})"?$/.exec(ifMatch);
+		if (!match) {
+			return [400, 'text/plain', 'Invalid If-Match header'];
+		}
+		let expected = match[1];
+		if (!currentSyncedMD5) {
+			return [412, 'text/plain', 'If-Match set but file does not exist'];
+		}
+		if (currentSyncedMD5 !== expected) {
+			return [412, 'text/plain', 'ETag does not match current version of file'];
+		}
+	}
+	if (ifNoneMatch !== null) {
+		if (ifNoneMatch !== '*') {
+			return [400, 'text/plain', 'Invalid value for If-None-Match header'];
+		}
+		if (currentSyncedMD5) {
+			return [412, 'text/plain', 'If-None-Match: * set but file exists'];
+		}
+	}
+
+	// Validate form params
+	let md5 = params.md5;
+	if (!md5 || !/^[a-f0-9]{32}$/i.test(md5)) {
+		return [400, 'text/plain', 'MD5 hash not provided'];
+	}
+	md5 = md5.toLowerCase();
+	let filename = params.filename;
+	if (!filename) {
+		return [400, 'text/plain', 'File name not provided'];
+	}
+	let filesize = params.filesize;
+	if (filesize === undefined || filesize === null || filesize === '') {
+		return [400, 'text/plain', 'File size not provided'];
+	}
+	filesize = parseInt(filesize);
+	if (Number.isNaN(filesize) || filesize < 0) {
+		return [400, 'text/plain', 'Invalid file size value'];
+	}
+	if (filesize > 4 * 1024 * 1024 * 1024) {
+		return [400, 'text/plain', 'Files above 4 GB are not currently supported'];
+	}
+	let mtime = params.mtime;
+	if (mtime === undefined || mtime === null || mtime === '') {
+		return [400, 'text/plain', 'File modification time not provided'];
+	}
+	mtime = parseInt(mtime);
+	if (Number.isNaN(mtime) || mtime < 0) {
+		return [400, 'text/plain', 'Invalid mtime value'];
+	}
+	// Per the spec, mtime is in milliseconds; reject values that look like seconds.
+	if (mtime > 0 && mtime < 10000000000) {
+		return [400, 'text/plain', 'mtime must be provided in milliseconds, not seconds'];
+	}
+
+	// If the local file already matches the requested MD5, no upload is needed.
+	try {
+		let existingPath = await item.getFilePathAsync();
+		if (existingPath) {
+			let existingMD5 = await Zotero.Utilities.Internal.md5Async(existingPath);
+			if (existingMD5 === md5) {
+				// Persist the requested mtime so subsequent reads agree
+				item.attachmentSyncedHash = md5;
+				item.attachmentSyncedModificationTime = mtime;
+				await item.saveTx();
+				return [
+					200,
+					{ 'Content-Type': 'application/json' },
+					JSON.stringify({ exists: 1 })
+				];
+			}
+		}
+	}
+	catch (e) {
+		Zotero.debug(`File exists check failed: ${e.message}`, 2);
+	}
+
+	let contentType = params.contentType || item.attachmentContentType || 'application/octet-stream';
+
+	// Generate an uploadKey, remember the pending upload, return URL
+	pruneExpired(PENDING_UPLOADS);
+	let uploadKey = Zotero.Utilities.randomString(32);
+	PENDING_UPLOADS.set(uploadKey, {
+		libraryID: item.libraryID,
+		itemKey: item.key,
+		md5,
+		filename,
+		filesize,
+		mtime,
+		contentType,
+		charset: params.charset || item.attachmentCharset || null,
+		uploaded: false,
+		expires: Date.now() + UPLOAD_KEY_TTL_SECONDS * 1000,
+	});
+
+	let host = requestData.headers.get('Host') || `localhost:${Zotero.Server.port}`;
+	let url = `http://${host}/api/local/uploads/${uploadKey}`;
+
+	if (requestData.searchParams.get('params') === '1') {
+		return [
+			200,
+			{ 'Content-Type': 'application/json' },
+			JSON.stringify({
+				url,
+				uploadKey,
+				contentType,
+				params: {
+					// Local uploads don't need S3-style form fields, but emit
+					// the field so clients expecting a 'params' array can
+					// iterate. They can be sent and will be ignored.
+					key: uploadKey,
+				},
+			})
+		];
+	}
+
+	return [
+		200,
+		{ 'Content-Type': 'application/json' },
+		JSON.stringify({
+			url,
+			uploadKey,
+			contentType,
+			prefix: '',
+			suffix: '',
+		})
+	];
+}
+
+/**
+ * Register a previously-uploaded file (phase 3 of the upload flow).
+ * Updates the attachment item with the new filename, md5, and mtime, then
+ * returns 204 with the new library version.
+ */
+async function registerUpload(item, params, headers) {
+	pruneExpired(PENDING_UPLOADS);
+	let uploadKey = params.upload;
+	let upload = PENDING_UPLOADS.get(uploadKey);
+	if (!upload) {
+		return [400, 'text/plain', 'Invalid or expired upload key'];
+	}
+	if (upload.libraryID !== item.libraryID || upload.itemKey !== item.key) {
+		return [400, 'text/plain', 'Upload key does not match item'];
+	}
+	if (!upload.uploaded) {
+		return [400, 'text/plain', 'File contents were not uploaded'];
+	}
+
+	// Re-check If-Match / If-None-Match (the client repeats these in register)
+	let ifMatch = headers.get('If-Match');
+	let ifNoneMatch = headers.get('If-None-Match');
+	let currentSyncedMD5 = item.attachmentSyncedHash || null;
+	if (ifMatch) {
+		let m = /^"?([a-f0-9]{32})"?$/.exec(ifMatch);
+		if (!m || !currentSyncedMD5 || currentSyncedMD5 !== m[1]) {
+			PENDING_UPLOADS.delete(uploadKey);
+			return [412, 'text/plain', 'ETag does not match current version of file'];
+		}
+	}
+	if (ifNoneMatch === '*' && currentSyncedMD5) {
+		PENDING_UPLOADS.delete(uploadKey);
+		return [412, 'text/plain', 'If-None-Match: * set but file exists'];
+	}
+
+	item.attachmentFilename = upload.filename;
+	item.attachmentSyncedHash = upload.md5;
+	item.attachmentSyncedModificationTime = upload.mtime;
+	if (upload.contentType) {
+		item.attachmentContentType = upload.contentType;
+	}
+	if (upload.charset) {
+		item.attachmentCharset = upload.charset;
+	}
+	await item.saveTx();
+
+	PENDING_UPLOADS.delete(uploadKey);
+
+	return [
+		204,
+		{ 'Last-Modified-Version': Zotero.Libraries.get(item.libraryID).clientVersion },
+		''
+	];
+}
+
+/**
+ * Apply a validated fulltext write to a single item. Returns the new library
+ * client version. Throws HTTPError(404) if the item is missing or isn't a file
+ * attachment, and HTTPError(400) if it isn't an indexable MIME type.
+ */
+async function storeItemFullText(libraryID, itemKey, body) {
+	let item = await Zotero.Items.getByLibraryAndKeyAsync(libraryID, itemKey);
+	if (!item || !item.isFileAttachment()) {
+		throw new HTTPError(404, 'Not found');
+	}
+	if (!Zotero.Fulltext.isCachedMIMEType(item.attachmentContentType)) {
+		throw new HTTPError(400, 'Full-text content is not supported for this item type');
+	}
+
+	let library = Zotero.Libraries.get(libraryID);
+	let newVersion = await Zotero.DB.executeTransaction(async () => library.incrementClientVersion());
+
+	await Zotero.Fulltext.setItemContent(libraryID, itemKey, {
+		content: body.content,
+		indexedChars: body.indexedChars,
+		totalChars: body.totalChars,
+		indexedPages: body.indexedPages,
+		totalPages: body.totalPages,
+	}, newVersion);
+	// setItemContent() queues the write via the background processor. Flush it now so the
+	// content is immediately visible to subsequent GETs.
+	await Zotero.Fulltext.indexFromProcessorCache(item.id);
+
+	return newVersion;
+}
+
+function pruneExpired(map) {
+	let now = Date.now();
+	for (let [k, v] of map) {
+		let expiry = typeof v === 'number' ? v : v.expires;
+		if (expiry && expiry < now) {
+			map.delete(k);
+		}
+	}
+}
+
+class HTTPError extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+}
+
+/**
+ * Builder for the canonical multi-object write response shape.
+ *
+ * Implements dataserver's Zotero_Results (model/Results.inc.php):
+ *   {
+ *     "successful": { "<index>": <full response JSON object> },
+ *     "success":    { "<index>": "<objectKey>" },
+ *     "unchanged":  { "<index>": "<objectKey>" },
+ *     "failed":     { "<index>": { "key": "<objectKey>", "code": <int>, "message": "<str>" } }
+ *   }
+ */
+class MultiWriteResults {
+	constructor() {
+		this.successful = {};
+		this.success = {};
+		this.unchanged = {};
+		this.failed = {};
+	}
+
+	addSuccess(index, responseJSON) {
+		let i = String(index);
+		this.successful[i] = responseJSON;
+		this.success[i] = responseJSON.key;
+	}
+
+	addUnchanged(index, key) {
+		this.unchanged[String(index)] = key;
+	}
+
+	addFailure(index, key, codeOrError, message) {
+		let code;
+		let msg;
+		if (codeOrError instanceof HTTPError) {
+			code = codeOrError.status;
+			msg = codeOrError.message;
+		}
+		else if (codeOrError instanceof Error) {
+			code = 400;
+			msg = codeOrError.message;
+		}
+		else {
+			code = codeOrError;
+			msg = message;
+		}
+		this.failed[String(index)] = {
+			key: key || "",
+			code,
+			message: msg
+		};
+	}
+
+	toJSON() {
+		return {
+			successful: this.successful,
+			success: this.success,
+			unchanged: this.unchanged,
+			failed: this.failed,
+		};
+	}
+}
diff --git a/chrome/locale/en-US/zotero/preferences.ftl b/chrome/locale/en-US/zotero/preferences.ftl
index bb4d619697..3d75920124 100644
--- a/chrome/locale/en-US/zotero/preferences.ftl
+++ b/chrome/locale/en-US/zotero/preferences.ftl
@@ -77,6 +77,8 @@ preferences-citation-dialog-mode-library =
 preferences-advanced-enable-local-api =
     .label = Allow other applications on this computer to communicate with { -app-name }
 preferences-advanced-local-api-available = Available at <code data-l10n-name="url">{ $url }</span>
+preferences-advanced-local-api-clear-authorizations =
+    .label = Clear Write Authorizations
 preferences-advanced-server-disabled = The { -app-name } HTTP server is disabled.
 preferences-advanced-server-enable-and-restart =
     .label = Enable and Restart
diff --git a/chrome/locale/en-US/zotero/zotero.ftl b/chrome/locale/en-US/zotero/zotero.ftl
index df65a30cbf..4a43eea89c 100644
--- a/chrome/locale/en-US/zotero/zotero.ftl
+++ b/chrome/locale/en-US/zotero/zotero.ftl
@@ -900,3 +900,9 @@ plugins-blocked-plugin =
     .message = This plugin has been disabled by { -app-name }.
 
 data-dir-unsupported-storage = This can happen if the { -app-name } data directory is in a cloud storage folder (OneDrive, Dropbox, etc.) or on a network share.
+
+local-api-authorize-title = Local API Authorization
+local-api-authorize-text = “{ $appName }”, an application running on your computer, wants to modify your { -app-name } library.
+local-api-authorize-allow = Allow
+local-api-authorize-always-allow = Always Allow
+local-api-authorize-deny = Deny
diff --git a/test/tests/server_localAPITest.js b/test/tests/server_localAPITest.js
index 76b385f4b7..1bdc341357 100644
--- a/test/tests/server_localAPITest.js
+++ b/test/tests/server_localAPITest.js
@@ -23,6 +23,85 @@ describe("Local API Server", function () {
 		});
 	}
 
+	// API key used by write tests; set up in the Write requests before() hook.
+	let writeAPIKey;
+
+	function apiRequest(method, endpoint, options = {}) {
+		let { body, headers, skipAPIKey, ...rest } = options;
+		let requestHeaders = {
+			'Zotero-Allowed-Request': '1',
+			...(headers || {})
+		};
+		if (!skipAPIKey && writeAPIKey
+				&& !requestHeaders['Zotero-API-Key']
+				&& !endpoint.includes('key=')) {
+			requestHeaders['Zotero-API-Key'] = writeAPIKey;
+		}
+		let requestBody = body;
+		if (body !== undefined && typeof body !== 'string'
+				&& !(body instanceof ArrayBuffer)
+				&& !ArrayBuffer.isView(body)) {
+			requestBody = JSON.stringify(body);
+			if (!requestHeaders['Content-Type']) {
+				requestHeaders['Content-Type'] = 'application/json';
+			}
+		}
+		return Zotero.HTTP.request(method, apiRoot + endpoint, {
+			headers: requestHeaders,
+			body: requestBody,
+			responseType: 'json',
+			...rest
+		});
+	}
+
+	function apiPost(endpoint, options = {}) {
+		return apiRequest('POST', endpoint, options);
+	}
+
+	function apiPut(endpoint, options = {}) {
+		return apiRequest('PUT', endpoint, options);
+	}
+
+	function apiPatch(endpoint, options = {}) {
+		return apiRequest('PATCH', endpoint, options);
+	}
+
+	function apiDelete(endpoint, options = {}) {
+		return apiRequest('DELETE', endpoint, options);
+	}
+
+	// Counter so each test generates a fresh write token (server caches them for 12h)
+	let writeTokenCounter = 0;
+	function newWriteToken() {
+		writeTokenCounter++;
+		return ('writeToken' + writeTokenCounter + 'x'.repeat(32))
+			.substring(0, 32);
+	}
+
+	// Stub the dialog and obtain a remembered API key directly via the endpoint
+	async function setupRememberedAPIKey(appName = 'Test Suite') {
+		let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+			.resolves({ allow: true, remember: true });
+		try {
+			let { response } = await Zotero.HTTP.request(
+				'POST',
+				apiRoot + '/authorize-local',
+				{
+					headers: {
+						'Zotero-Allowed-Request': '1',
+						'Content-Type': 'application/json',
+					},
+					body: JSON.stringify({ appName }),
+					responseType: 'json'
+				}
+			);
+			return response.key;
+		}
+		finally {
+			stub.restore();
+		}
+	}
+
 	before(async function () {
 		apiRoot = 'http://127.0.0.1:' + Zotero.Server.port + '/api';
 
@@ -390,4 +469,1449 @@ describe("Local API Server", function () {
 			assert.equal(response, "Not found");
 		});
 	});
+
+	// ===================================================================
+	// Write request tests
+	// ===================================================================
+
+	describe("Write requests", function () {
+		before(async function () {
+			Zotero.Server.LocalAPI._resetAuthorizeRateLimit();
+			writeAPIKey = await setupRememberedAPIKey();
+		});
+
+		// Reset the authorize-local rate limit between tests so a long sequence of
+		// stubbed prompts can run without tripping the per-minute 429 throttle.
+		beforeEach(function () {
+			Zotero.Server.LocalAPI._resetAuthorizeRateLimit();
+		});
+
+		describe("POST /api/authorize-local", function () {
+			it("should return a key on allow", async function () {
+				let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+					.resolves({ allow: true, remember: false });
+				try {
+					let { response, status } = await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({ appName: 'AllowApp' }),
+							responseType: 'json'
+						}
+					);
+					assert.equal(status, 200);
+					assert.isString(response.key);
+					assert.lengthOf(response.key, 32);
+					assert.isFalse(response.remember);
+				}
+				finally {
+					stub.restore();
+				}
+			});
+
+			it("should mark a key as remembered when Always Allow is chosen", async function () {
+				let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+					.resolves({ allow: true, remember: true });
+				try {
+					let { response } = await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({ appName: 'RememberApp' }),
+							responseType: 'json'
+						}
+					);
+					assert.isTrue(response.remember);
+				}
+				finally {
+					stub.restore();
+				}
+			});
+
+			it("should return 403 on deny", async function () {
+				let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+					.resolves({ allow: false, remember: false });
+				try {
+					let { response, status } = await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({ appName: 'DeniedApp' }),
+							responseType: 'json',
+							successCodes: [403]
+						}
+					);
+					assert.equal(status, 403);
+					assert.isTrue(response.denied);
+				}
+				finally {
+					stub.restore();
+				}
+			});
+
+			it("should require appName", async function () {
+				let { status } = await Zotero.HTTP.request(
+					'POST', apiRoot + '/authorize-local',
+					{
+						headers: {
+							'Zotero-Allowed-Request': '1',
+							'Content-Type': 'application/json',
+						},
+						body: JSON.stringify({}),
+						responseType: 'text',
+						successCodes: [400]
+					}
+				);
+				assert.equal(status, 400);
+			});
+
+			it("should pass appName into the prompt", async function () {
+				let captured;
+				let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+					.callsFake(async (appName) => {
+						captured = appName;
+						return { allow: false };
+					});
+				try {
+					await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({ appName: 'MyTestApp 1.0' }),
+							responseType: 'text',
+							successCodes: [403]
+						}
+					);
+				}
+				finally {
+					stub.restore();
+				}
+				assert.equal(captured, 'MyTestApp 1.0');
+			});
+
+			it("should rate-limit after 5 confirmation-requiring requests in a minute", async function () {
+				let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+					.resolves({ allow: false, remember: false });
+				try {
+					for (let i = 0; i < 5; i++) {
+						await Zotero.HTTP.request(
+							'POST', apiRoot + '/authorize-local',
+							{
+								headers: {
+									'Zotero-Allowed-Request': '1',
+									'Content-Type': 'application/json',
+								},
+								body: JSON.stringify({ appName: 'Throttle ' + i }),
+								responseType: 'text',
+								successCodes: [403]
+							}
+						);
+					}
+					let xhr = await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({ appName: 'Throttle 6' }),
+							responseType: 'text',
+							successCodes: [429]
+						}
+					);
+					assert.equal(xhr.status, 429);
+					let retryAfter = parseInt(xhr.getResponseHeader('Retry-After'));
+					assert.isAbove(retryAfter, 0);
+					assert.isAtMost(retryAfter, 60);
+				}
+				finally {
+					stub.restore();
+				}
+			});
+
+			it("should not count rejected (pre-prompt) requests against the rate limit", async function () {
+				// 5 bad-appName requests fail before the prompt and don't consume slots
+				for (let i = 0; i < 5; i++) {
+					await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({}),
+							responseType: 'text',
+							successCodes: [400]
+						}
+					);
+				}
+				// A subsequent valid request still goes through
+				let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+					.resolves({ allow: false, remember: false });
+				try {
+					let { status } = await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({ appName: 'AfterBadReqs' }),
+							responseType: 'json',
+							successCodes: [403]
+						}
+					);
+					assert.equal(status, 403);
+				}
+				finally {
+					stub.restore();
+				}
+			});
+		});
+
+		describe("Authorization management", function () {
+			it("should report a count of remembered authorizations", async function () {
+				let before = await Zotero.Server.LocalAPI.getAuthorizationCount();
+				await setupRememberedAPIKey('CountedApp');
+				let after = await Zotero.Server.LocalAPI.getAuthorizationCount();
+				assert.equal(after, before + 1);
+			});
+
+			it("should drop every stored key when cleared", async function () {
+				await setupRememberedAPIKey('ToClearApp');
+				assert.isAbove(await Zotero.Server.LocalAPI.getAuthorizationCount(), 0);
+				await Zotero.Server.LocalAPI.clearAuthorizations();
+				assert.equal(await Zotero.Server.LocalAPI.getAuthorizationCount(), 0);
+
+				// Previously-issued keys must no longer authenticate writes
+				let { status } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: {
+						'Zotero-Write-Token': newWriteToken(),
+						'Zotero-API-Key': writeAPIKey,
+					},
+					skipAPIKey: true,
+					successCodes: [401],
+					responseType: 'text'
+				});
+				assert.equal(status, 401);
+
+				// Restore the suite-wide key so later tests still work
+				writeAPIKey = await setupRememberedAPIKey('Test Suite');
+			});
+		});
+
+		describe("Authentication", function () {
+			it("should reject write requests with no API key (401)", async function () {
+				let { status } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: { 'Zotero-Write-Token': newWriteToken() },
+					skipAPIKey: true,
+					successCodes: [401],
+					responseType: 'text'
+				});
+				assert.equal(status, 401);
+			});
+
+			it("should reject write requests with an unknown API key (401)", async function () {
+				let { status } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: {
+						'Zotero-Write-Token': newWriteToken(),
+						'Zotero-API-Key': 'not-a-real-key-at-all',
+					},
+					skipAPIKey: true,
+					successCodes: [401],
+					responseType: 'text'
+				});
+				assert.equal(status, 401);
+			});
+
+			it("should accept the API key via ?key= query parameter", async function () {
+				let { status, response } = await apiPost(
+					`/users/0/items?key=${encodeURIComponent(writeAPIKey)}`,
+					{
+						body: [{ itemType: 'book', title: 'QueryKey Item' }],
+						headers: { 'Zotero-Write-Token': newWriteToken() },
+						skipAPIKey: true,
+					}
+				);
+				assert.equal(status, 200);
+				let key = response.successful['0'].key;
+				let item = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, key);
+				if (item) await item.eraseTx();
+			});
+
+			it("should consume a single-use API key after one write", async function () {
+				let oneShot;
+				let stub = sinon.stub(Zotero.Server.LocalAPI, '_promptForAuthorization')
+					.resolves({ allow: true, remember: false });
+				try {
+					let { response } = await Zotero.HTTP.request(
+						'POST', apiRoot + '/authorize-local',
+						{
+							headers: {
+								'Zotero-Allowed-Request': '1',
+								'Content-Type': 'application/json',
+							},
+							body: JSON.stringify({ appName: 'OneShotApp' }),
+							responseType: 'json'
+						}
+					);
+					oneShot = response.key;
+				}
+				finally {
+					stub.restore();
+				}
+
+				let { status, response } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: {
+						'Zotero-Write-Token': newWriteToken(),
+						'Zotero-API-Key': oneShot,
+					},
+					skipAPIKey: true,
+				});
+				assert.equal(status, 200);
+				let key = response.successful['0'].key;
+				let item = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, key);
+				if (item) await item.eraseTx();
+
+				// Second use must be rejected
+				let { status: status2 } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: {
+						'Zotero-Write-Token': newWriteToken(),
+						'Zotero-API-Key': oneShot,
+					},
+					skipAPIKey: true,
+					successCodes: [401],
+					responseType: 'text'
+				});
+				assert.equal(status2, 401);
+			});
+
+			it("should allow remembered keys to be reused", async function () {
+				// Use the suite key twice -- it's marked remember:true
+				let first = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				let second = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.equal(first.status, 200);
+				assert.equal(second.status, 200);
+				for (let resp of [first, second]) {
+					let key = resp.response.successful['0'].key;
+					let item = await Zotero.Items.getByLibraryAndKeyAsync(
+						Zotero.Libraries.userLibraryID, key);
+					if (item) await item.eraseTx();
+				}
+			});
+
+			it("should not require API key for GET requests", async function () {
+				let { status } = await apiGet('/users/0/items');
+				assert.equal(status, 200);
+			});
+
+			it("should persist remembered keys to <profileDir>/localAPIKeys.json", async function () {
+				let path = PathUtils.join(Zotero.Profile.dir, 'localAPIKeys.json');
+				assert.isTrue(await IOUtils.exists(path));
+				let text = await IOUtils.readUTF8(path);
+				let json = JSON.parse(text);
+				assert.isArray(json.keys);
+				assert.isTrue(json.keys.some(k => k.key === writeAPIKey && k.remember));
+			});
+		});
+
+		describe("POST <userOrGroupPrefix>/items", function () {
+			it("should create a single item", async function () {
+				let { response } = await apiPost('/users/0/items', {
+					body: [{
+						itemType: 'book',
+						title: 'New Book From API',
+					}],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.isObject(response);
+				assert.isObject(response.successful);
+				assert.isObject(response.success);
+				assert.isObject(response.unchanged);
+				assert.isObject(response.failed);
+				assert.isEmpty(Object.keys(response.failed));
+				assert.lengthOf(Object.keys(response.successful), 1);
+				let entry = response.successful['0'];
+				assert.equal(entry.data.itemType, 'book');
+				assert.equal(entry.data.title, 'New Book From API');
+				assert.match(entry.key, /^[23456789ABCDEFGHIJKLMNPQRSTUVWXYZ]{8}$/);
+				assert.equal(response.success['0'], entry.key);
+				// Cleanup
+				let item = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, entry.key);
+				if (item) await item.eraseTx();
+			});
+
+			it("should create multiple items in one request", async function () {
+				let { response } = await apiPost('/users/0/items', {
+					body: [
+						{ itemType: 'book', title: 'Book A' },
+						{ itemType: 'journalArticle', title: 'Article B' }
+					],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.lengthOf(Object.keys(response.successful), 2);
+				assert.equal(response.successful['0'].data.title, 'Book A');
+				assert.equal(response.successful['1'].data.itemType, 'journalArticle');
+				// Cleanup
+				for (let i of ['0', '1']) {
+					let key = response.successful[i].key;
+					let item = await Zotero.Items.getByLibraryAndKeyAsync(
+						Zotero.Libraries.userLibraryID, key);
+					if (item) await item.eraseTx();
+				}
+			});
+
+			it("should report failed items in 'failed'", async function () {
+				let { response } = await apiPost('/users/0/items', {
+					body: [
+						{ itemType: 'book', title: 'Valid Book' },
+						{ itemType: 'noSuchType', title: 'Invalid' },
+					],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.lengthOf(Object.keys(response.successful), 1);
+				assert.lengthOf(Object.keys(response.failed), 1);
+				let failure = response.failed['1'];
+				assert.equal(failure.code, 400);
+				assert.include(failure.message.toLowerCase(), 'itemtype');
+				// Cleanup
+				let key = response.successful['0'].key;
+				let item = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, key);
+				if (item) await item.eraseTx();
+			});
+
+			it("should reject non-array body", async function () {
+				let { status } = await apiPost('/users/0/items', {
+					body: { itemType: 'book' },
+					headers: { 'Zotero-Write-Token': newWriteToken() },
+					successCodes: [400],
+					responseType: 'text'
+				});
+				assert.equal(status, 400);
+			});
+
+			it("should reject batches over 50 items with 413", async function () {
+				let body = [];
+				for (let i = 0; i < 51; i++) {
+					body.push({ itemType: 'book', title: 'Book ' + i });
+				}
+				let { status } = await apiPost('/users/0/items', {
+					body,
+					headers: { 'Zotero-Write-Token': newWriteToken() },
+					successCodes: [413],
+					responseType: 'text'
+				});
+				assert.equal(status, 413);
+			});
+
+			it("should reject duplicate write tokens with 412", async function () {
+				let token = newWriteToken();
+				await apiPost('/users/0/items', {
+					body: [{ itemType: 'book', title: 'First with token' }],
+					headers: { 'Zotero-Write-Token': token }
+				});
+				let { status } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book', title: 'Second with token' }],
+					headers: { 'Zotero-Write-Token': token },
+					successCodes: [412],
+					responseType: 'text'
+				});
+				assert.equal(status, 412);
+			});
+
+			it("should accept write tokens of 5-32 chars", async function () {
+				let { status } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book', title: 'Short token' }],
+					headers: { 'Zotero-Write-Token': 'short' }
+				});
+				assert.equal(status, 200);
+			});
+
+			it("should reject write tokens shorter than 5 chars with 400", async function () {
+				let { status } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: { 'Zotero-Write-Token': 'abcd' },
+					successCodes: [400],
+					responseType: 'text'
+				});
+				assert.equal(status, 400);
+			});
+
+			it("should update an existing item with key+version", async function () {
+				let item = await createDataObject('item', { itemType: 'book', setTitle: true });
+				let { response } = await apiPost('/users/0/items', {
+					body: [{
+						key: item.key,
+						version: item.clientVersion,
+						itemType: 'book',
+						title: 'Updated Title',
+					}],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.lengthOf(Object.keys(response.successful), 1);
+				assert.equal(response.successful['0'].data.title, 'Updated Title');
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item.key);
+				assert.equal(reloaded.getField('title'), 'Updated Title');
+				await item.eraseTx();
+			});
+
+			it("should fail an object with stale version", async function () {
+				let item = await createDataObject('item', { itemType: 'book', setTitle: true });
+				let { response } = await apiPost('/users/0/items', {
+					body: [{
+						key: item.key,
+						version: item.clientVersion - 5,
+						itemType: 'book',
+						title: 'Stale Update',
+					}],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.lengthOf(Object.keys(response.failed), 1);
+				assert.equal(response.failed['0'].code, 412);
+				await item.eraseTx();
+			});
+
+			it("should return 412 on stale If-Unmodified-Since-Version", async function () {
+				let staleVersion = Zotero.Libraries.userLibrary.clientVersion;
+				// Bump the library by creating a sentinel item
+				let sentinel = await createDataObject('item');
+				let { status } = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: {
+						'Zotero-Write-Token': newWriteToken(),
+						'If-Unmodified-Since-Version': String(staleVersion)
+					},
+					successCodes: [412],
+					responseType: 'text'
+				});
+				assert.equal(status, 412);
+				await sentinel.eraseTx();
+			});
+
+			it("should include Last-Modified-Version response header", async function () {
+				let xhr = await apiPost('/users/0/items', {
+					body: [{ itemType: 'book' }],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				let header = xhr.getResponseHeader('Last-Modified-Version');
+				assert.isNotEmpty(header);
+				assert.equal(
+					parseInt(header),
+					Zotero.Libraries.userLibrary.clientVersion);
+				let key = xhr.response.successful['0'].key;
+				let item = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, key);
+				if (item) await item.eraseTx();
+			});
+		});
+
+		describe("PUT <userOrGroupPrefix>/items/<key>", function () {
+			it("should fully replace an item's fields", async function () {
+				let item = await createDataObject('item', {
+					itemType: 'book',
+					setTitle: true,
+				});
+				item.setField('publisher', 'Original Pub');
+				await item.saveTx();
+
+				let { status } = await apiPut(`/users/0/items/${item.key}`, {
+					body: {
+						key: item.key,
+						version: item.clientVersion,
+						itemType: 'book',
+						title: 'New Title After PUT',
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item.key);
+				assert.equal(reloaded.getField('title'), 'New Title After PUT');
+				// PUT should clear unspecified fields
+				assert.equal(reloaded.getField('publisher'), '');
+				await item.eraseTx();
+			});
+
+			it("should reject without version or If-Unmodified-Since-Version", async function () {
+				let item = await createDataObject('item');
+				let { status } = await apiPut(`/users/0/items/${item.key}`, {
+					body: { itemType: 'book', title: 'x' },
+					successCodes: [428],
+					responseType: 'text'
+				});
+				assert.equal(status, 428);
+				await item.eraseTx();
+			});
+
+			it("should return 412 on stale version", async function () {
+				let item = await createDataObject('item');
+				let { status } = await apiPut(`/users/0/items/${item.key}`, {
+					body: {
+						itemType: 'book',
+						title: 'x',
+						version: item.clientVersion - 1,
+					},
+					successCodes: [412],
+					responseType: 'text'
+				});
+				assert.equal(status, 412);
+				await item.eraseTx();
+			});
+
+			it("should reject invalid key with 400", async function () {
+				let { status } = await apiPut('/users/0/items/badkey!!', {
+					body: { itemType: 'book' },
+					successCodes: [400],
+					responseType: 'text'
+				});
+				assert.equal(status, 400);
+			});
+		});
+
+		describe("PATCH <userOrGroupPrefix>/items/<key>", function () {
+			it("should leave unspecified fields untouched", async function () {
+				let item = await createDataObject('item', {
+					itemType: 'book',
+					setTitle: true,
+				});
+				item.setField('publisher', 'Keep Me');
+				await item.saveTx();
+				let savedTitle = item.getField('title');
+
+				let { status } = await apiPatch(`/users/0/items/${item.key}`, {
+					body: {
+						publisher: 'New Publisher',
+						version: item.clientVersion,
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item.key);
+				assert.equal(reloaded.getField('title'), savedTitle);
+				assert.equal(reloaded.getField('publisher'), 'New Publisher');
+				await item.eraseTx();
+			});
+
+			it("should clear a field when explicitly set to ''", async function () {
+				let item = await createDataObject('item', { itemType: 'book' });
+				item.setField('publisher', 'Will Be Cleared');
+				await item.saveTx();
+				let { status } = await apiPatch(`/users/0/items/${item.key}`, {
+					body: { publisher: '', version: item.clientVersion },
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item.key);
+				assert.equal(reloaded.getField('publisher'), '');
+				await item.eraseTx();
+			});
+		});
+
+		describe("DELETE <userOrGroupPrefix>/items/<key>", function () {
+			it("should delete a single item", async function () {
+				let item = await createDataObject('item');
+				let { status } = await apiDelete(`/users/0/items/${item.key}`, {
+					headers: {
+						'If-Unmodified-Since-Version': String(item.clientVersion),
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item.key);
+				assert.isFalse(!!reloaded);
+			});
+
+			it("should require If-Unmodified-Since-Version (428)", async function () {
+				let item = await createDataObject('item');
+				let { status } = await apiDelete(`/users/0/items/${item.key}`, {
+					successCodes: [428],
+					responseType: 'text'
+				});
+				assert.equal(status, 428);
+				await item.eraseTx();
+			});
+
+			it("should return 412 on stale If-Unmodified-Since-Version", async function () {
+				let item = await createDataObject('item');
+				let { status } = await apiDelete(`/users/0/items/${item.key}`, {
+					headers: {
+						'If-Unmodified-Since-Version': String(item.clientVersion - 1),
+					},
+					successCodes: [412],
+					responseType: 'text'
+				});
+				assert.equal(status, 412);
+				await item.eraseTx();
+			});
+
+			it("should return 404 for unknown key", async function () {
+				let { status } = await apiDelete('/users/0/items/ABCDEFGH', {
+					headers: { 'If-Unmodified-Since-Version': '999' },
+					successCodes: [404],
+					responseType: 'text'
+				});
+				assert.equal(status, 404);
+			});
+		});
+
+		describe("DELETE <userOrGroupPrefix>/items?itemKey=", function () {
+			it("should delete multiple items", async function () {
+				let item1 = await createDataObject('item');
+				let item2 = await createDataObject('item');
+				let { status } = await apiDelete(
+					`/users/0/items?itemKey=${item1.key},${item2.key}`,
+					{
+						headers: {
+							'If-Unmodified-Since-Version':
+								String(Zotero.Libraries.userLibrary.clientVersion),
+						},
+						successCodes: [204]
+					}
+				);
+				assert.equal(status, 204);
+				assert.isFalse(!!(await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item1.key)));
+				assert.isFalse(!!(await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item2.key)));
+			});
+
+			it("should ignore unknown keys mixed in", async function () {
+				let item = await createDataObject('item');
+				let { status } = await apiDelete(
+					`/users/0/items?itemKey=${item.key},ZZZZZZZZ`,
+					{
+						headers: {
+							'If-Unmodified-Since-Version':
+								String(Zotero.Libraries.userLibrary.clientVersion),
+						},
+						successCodes: [204]
+					}
+				);
+				assert.equal(status, 204);
+			});
+
+			it("should reject batches over 50 keys with 413", async function () {
+				let keys = [];
+				for (let i = 0; i < 51; i++) {
+					keys.push("AAAAAAA" + (i % 9 + 1));
+				}
+				let { status } = await apiDelete(
+					'/users/0/items?itemKey=' + keys.join(','),
+					{
+						headers: {
+							'If-Unmodified-Since-Version':
+								String(Zotero.Libraries.userLibrary.clientVersion),
+						},
+						successCodes: [413],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 413);
+			});
+		});
+
+		describe("POST <userOrGroupPrefix>/collections", function () {
+			it("should create a collection", async function () {
+				let { response } = await apiPost('/users/0/collections', {
+					body: [{ name: 'New Test Collection' }],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.lengthOf(Object.keys(response.successful), 1);
+				let key = response.successful['0'].key;
+				let col = Zotero.Collections.getByLibraryAndKey(
+					Zotero.Libraries.userLibraryID, key);
+				assert.equal(col.name, 'New Test Collection');
+				await col.eraseTx();
+			});
+
+			it("should set parentCollection when provided", async function () {
+				let parent = await createDataObject('collection');
+				let { response } = await apiPost('/users/0/collections', {
+					body: [{ name: 'Child', parentCollection: parent.key }],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				let key = response.successful['0'].key;
+				let child = Zotero.Collections.getByLibraryAndKey(
+					Zotero.Libraries.userLibraryID, key);
+				assert.equal(child.parentKey, parent.key);
+				await child.eraseTx();
+				await parent.eraseTx();
+			});
+		});
+
+		describe("PUT/PATCH/DELETE <userOrGroupPrefix>/collections/<key>", function () {
+			it("should update a collection via PUT", async function () {
+				let col = await createDataObject('collection', { name: 'Before' });
+				let { status } = await apiPut(`/users/0/collections/${col.key}`, {
+					body: {
+						version: col.clientVersion,
+						name: 'After PUT',
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = Zotero.Collections.getByLibraryAndKey(
+					Zotero.Libraries.userLibraryID, col.key);
+				assert.equal(reloaded.name, 'After PUT');
+				await col.eraseTx();
+			});
+
+			it("should patch a collection's name", async function () {
+				let col = await createDataObject('collection', { name: 'Before' });
+				let { status } = await apiPatch(`/users/0/collections/${col.key}`, {
+					body: { name: 'After PATCH', version: col.clientVersion },
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = Zotero.Collections.getByLibraryAndKey(
+					Zotero.Libraries.userLibraryID, col.key);
+				assert.equal(reloaded.name, 'After PATCH');
+				await col.eraseTx();
+			});
+
+			it("should delete a collection", async function () {
+				let col = await createDataObject('collection');
+				let { status } = await apiDelete(`/users/0/collections/${col.key}`, {
+					headers: {
+						'If-Unmodified-Since-Version': String(col.clientVersion),
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = Zotero.Collections.getByLibraryAndKey(
+					Zotero.Libraries.userLibraryID, col.key);
+				assert.isFalse(!!reloaded);
+			});
+		});
+
+		describe("POST/PUT/DELETE <userOrGroupPrefix>/searches", function () {
+			it("should create a saved search", async function () {
+				let { response } = await apiPost('/users/0/searches', {
+					body: [{
+						name: 'My Saved Search',
+						conditions: [
+							{ condition: 'title', operator: 'contains', value: 'foo' }
+						]
+					}],
+					headers: { 'Zotero-Write-Token': newWriteToken() }
+				});
+				assert.lengthOf(Object.keys(response.successful), 1);
+				let key = response.successful['0'].key;
+				let search = Zotero.Searches.getByLibraryAndKey(
+					Zotero.Libraries.userLibraryID, key);
+				assert.equal(search.name, 'My Saved Search');
+				await search.eraseTx();
+			});
+
+			it("should delete a search", async function () {
+				let search = await createDataObject('search', { name: 'To Delete' });
+				let { status } = await apiDelete(`/users/0/searches/${search.key}`, {
+					headers: {
+						'If-Unmodified-Since-Version': String(search.clientVersion),
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = Zotero.Searches.getByLibraryAndKey(
+					Zotero.Libraries.userLibraryID, search.key);
+				assert.isFalse(!!reloaded);
+			});
+		});
+
+		describe("DELETE <userOrGroupPrefix>/tags", function () {
+			it("should remove tags from the library", async function () {
+				let item = await createDataObject('item');
+				item.setTags(['tagToDelete', 'tagToKeep']);
+				await item.saveTx();
+				assert.isAtLeast(Zotero.Tags.getID('tagToDelete'), 1);
+
+				let { status } = await apiDelete('/users/0/tags?tag=tagToDelete', {
+					headers: {
+						'If-Unmodified-Since-Version':
+							String(Zotero.Libraries.userLibrary.clientVersion),
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item.key);
+				assert.notInclude(reloaded.getTags().map(t => t.tag), 'tagToDelete');
+				assert.include(reloaded.getTags().map(t => t.tag), 'tagToKeep');
+				await item.eraseTx();
+			});
+
+			it("should split tag names on ||", async function () {
+				let item = await createDataObject('item');
+				item.setTags(['multi1', 'multi2', 'keep']);
+				await item.saveTx();
+				let { status } = await apiDelete('/users/0/tags?tag=multi1||multi2', {
+					headers: {
+						'If-Unmodified-Since-Version':
+							String(Zotero.Libraries.userLibrary.clientVersion),
+					},
+					successCodes: [204]
+				});
+				assert.equal(status, 204);
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, item.key);
+				let tags = reloaded.getTags().map(t => t.tag);
+				assert.notInclude(tags, 'multi1');
+				assert.notInclude(tags, 'multi2');
+				assert.include(tags, 'keep');
+				await item.eraseTx();
+			});
+
+			it("should require If-Unmodified-Since-Version", async function () {
+				let { status } = await apiDelete('/users/0/tags?tag=anything', {
+					successCodes: [428],
+					responseType: 'text'
+				});
+				assert.equal(status, 428);
+			});
+		});
+
+		describe("PUT <userOrGroupPrefix>/items/<key>/fulltext", function () {
+			let parent;
+			let attachment;
+
+			beforeEach(async function () {
+				parent = await createDataObject('item');
+				attachment = await importPDFAttachment(parent);
+			});
+
+			afterEach(async function () {
+				if (attachment) await attachment.eraseTx();
+				if (parent) await parent.eraseTx();
+			});
+
+			it("should set fulltext content for an attachment", async function () {
+				let beforeVersion = Zotero.Libraries.userLibrary.clientVersion;
+				let xhr = await apiPut(
+					`/users/0/items/${attachment.key}/fulltext`,
+					{
+						body: {
+							content: 'Hello, fulltext.',
+							indexedPages: 1,
+							totalPages: 1,
+						}
+					}
+				);
+				assert.equal(xhr.status, 204);
+				let lastModified = parseInt(xhr.getResponseHeader('Last-Modified-Version'));
+				assert.isAbove(lastModified, beforeVersion);
+
+				let { response } = await apiGet(`/users/0/items/${attachment.key}/fulltext`);
+				assert.equal(response.content, 'Hello, fulltext.');
+				assert.equal(response.indexedPages, 1);
+				assert.equal(response.totalPages, 1);
+			});
+
+			it("should accept char-based stats", async function () {
+				let { status } = await apiPut(
+					`/users/0/items/${attachment.key}/fulltext`,
+					{
+						body: {
+							content: 'Char-counted content.',
+							indexedChars: 21,
+							totalChars: 21,
+						}
+					}
+				);
+				assert.equal(status, 204);
+				let { response } = await apiGet(`/users/0/items/${attachment.key}/fulltext`);
+				assert.equal(response.content, 'Char-counted content.');
+				assert.equal(response.indexedChars, 21);
+				assert.equal(response.totalChars, 21);
+			});
+
+			it("should reject a body without 'content'", async function () {
+				let { status } = await apiPut(
+					`/users/0/items/${attachment.key}/fulltext`,
+					{
+						body: { indexedPages: 1, totalPages: 1 },
+						successCodes: [400],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 400);
+			});
+
+			it("should reject non-integer stats", async function () {
+				let { status } = await apiPut(
+					`/users/0/items/${attachment.key}/fulltext`,
+					{
+						body: { content: 'x', indexedPages: '1' },
+						successCodes: [400],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 400);
+			});
+
+			it("should return 404 for unknown item key", async function () {
+				let { status } = await apiPut(
+					`/users/0/items/AAAAAAAA/fulltext`,
+					{
+						body: { content: 'x' },
+						successCodes: [404],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 404);
+			});
+
+			it("should reject a non-attachment item", async function () {
+				let regularItem = await createDataObject('item');
+				try {
+					let { status } = await apiPut(
+						`/users/0/items/${regularItem.key}/fulltext`,
+						{
+							body: { content: 'x' },
+							successCodes: [404],
+							responseType: 'text'
+						}
+					);
+					assert.equal(status, 404);
+				}
+				finally {
+					await regularItem.eraseTx();
+				}
+			});
+		});
+
+		describe("POST <userOrGroupPrefix>/fulltext", function () {
+			let parent;
+			let a1;
+			let a2;
+
+			beforeEach(async function () {
+				parent = await createDataObject('item');
+				a1 = await importPDFAttachment(parent);
+				a2 = await importPDFAttachment(parent);
+			});
+
+			afterEach(async function () {
+				for (let item of [a1, a2, parent]) {
+					if (item) await item.eraseTx();
+				}
+			});
+
+			function iusvHeader() {
+				return { 'If-Unmodified-Since-Version': String(Zotero.Libraries.userLibrary.clientVersion) };
+			}
+
+			it("should write multiple items and return a write report", async function () {
+				let { status, response } = await apiPost('/users/0/fulltext', {
+					headers: iusvHeader(),
+					body: [
+						{ key: a1.key, content: 'one', indexedPages: 1, totalPages: 1 },
+						{ key: a2.key, content: 'two', indexedPages: 1, totalPages: 1 },
+					]
+				});
+				assert.equal(status, 200);
+				assert.deepEqual(response.successful['0'], { key: a1.key });
+				assert.deepEqual(response.successful['1'], { key: a2.key });
+				assert.equal(response.success['0'], a1.key);
+				assert.equal(response.success['1'], a2.key);
+				assert.isEmpty(Object.keys(response.failed));
+
+				let { response: r1 } = await apiGet(`/users/0/items/${a1.key}/fulltext`);
+				assert.equal(r1.content, 'one');
+				let { response: r2 } = await apiGet(`/users/0/items/${a2.key}/fulltext`);
+				assert.equal(r2.content, 'two');
+			});
+
+			it("should report per-item failures while applying the rest", async function () {
+				let regularItem = await createDataObject('item');
+				try {
+					let { status, response } = await apiPost('/users/0/fulltext', {
+						headers: iusvHeader(),
+						body: [
+							{ key: a1.key, content: 'ok' },
+							{ key: 'AAAAAAAA', content: 'missing' },
+							{ key: regularItem.key, content: 'not-attach' },
+						]
+					});
+					assert.equal(status, 200);
+					assert.property(response.successful, '0');
+					assert.notProperty(response.successful, '1');
+					assert.notProperty(response.successful, '2');
+					assert.equal(response.failed['1'].code, 404);
+					assert.equal(response.failed['2'].code, 404);
+				}
+				finally {
+					await regularItem.eraseTx();
+				}
+			});
+
+			it("should require If-Unmodified-Since-Version (428)", async function () {
+				let { status } = await apiPost('/users/0/fulltext', {
+					body: [{ key: a1.key, content: 'x' }],
+					successCodes: [428],
+					responseType: 'text'
+				});
+				assert.equal(status, 428);
+			});
+
+			it("should reject non-array body with 400", async function () {
+				let { status } = await apiPost('/users/0/fulltext', {
+					headers: iusvHeader(),
+					body: { key: a1.key, content: 'x' },
+					successCodes: [400],
+					responseType: 'text'
+				});
+				assert.equal(status, 400);
+			});
+
+			it("should reject batches over 10 with 413", async function () {
+				let big = [];
+				for (let i = 0; i < 11; i++) {
+					big.push({ key: a1.key, content: 'x' });
+				}
+				let { status } = await apiPost('/users/0/fulltext', {
+					headers: iusvHeader(),
+					body: big,
+					successCodes: [413],
+					responseType: 'text'
+				});
+				assert.equal(status, 413);
+			});
+
+			it("should reject an entry missing 'key'", async function () {
+				let { status, response } = await apiPost('/users/0/fulltext', {
+					headers: iusvHeader(),
+					body: [{ content: 'x' }]
+				});
+				assert.equal(status, 200);
+				assert.equal(response.failed['0'].code, 400);
+			});
+		});
+
+		describe("File uploads", function () {
+			let attachment;
+
+			beforeEach(async function () {
+				let parent = await createDataObject('item');
+				attachment = await Zotero.Attachments.importFromFile({
+					file: OS.Path.join(getTestDataDirectory().path, 'test.pdf'),
+					parentItemID: parent.id,
+				});
+			});
+
+			afterEach(async function () {
+				if (attachment) {
+					let parent = Zotero.Items.get(attachment.parentItemID);
+					await attachment.eraseTx();
+					if (parent) await parent.eraseTx();
+				}
+			});
+
+			it("should return {exists:1} when MD5 matches local file", async function () {
+				let path = await attachment.getFilePathAsync();
+				let md5 = await Zotero.Utilities.Internal.md5Async(path);
+				let stat = await IOUtils.stat(path);
+
+				let { response } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=${md5}&filename=${encodeURIComponent(attachment.attachmentFilename)}&filesize=${stat.size}&mtime=${stat.lastModified}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						}
+					}
+				);
+				assert.equal(response.exists, 1);
+			});
+
+			it("should authorize a new upload when MD5 differs", async function () {
+				let newMD5 = 'a'.repeat(32);
+				let { response } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=${newMD5}&filename=newfile.pdf&filesize=10&mtime=${Date.now()}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						}
+					}
+				);
+				assert.isString(response.url);
+				assert.isString(response.uploadKey);
+				assert.include(response.url, '/api/local/uploads/');
+				assert.property(response, 'prefix');
+				assert.property(response, 'suffix');
+			});
+
+			it("should return params object when ?params=1", async function () {
+				let { response } = await apiPost(
+					`/users/0/items/${attachment.key}/file?params=1`,
+					{
+						body: `md5=${'b'.repeat(32)}&filename=x.pdf&filesize=10&mtime=${Date.now()}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						}
+					}
+				);
+				assert.isObject(response.params);
+				assert.isString(response.uploadKey);
+			});
+
+			it("should reject mtime in seconds with 400", async function () {
+				let { status } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=${'c'.repeat(32)}&filename=x.pdf&filesize=10&mtime=1000`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						},
+						successCodes: [400],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 400);
+			});
+
+			it("should require If-Match or If-None-Match with 428", async function () {
+				let { status } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=${'d'.repeat(32)}&filename=x.pdf&filesize=10&mtime=${Date.now()}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+						},
+						successCodes: [428],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 428);
+			});
+
+			it("should reject bad MD5 with 400", async function () {
+				let { status } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=not-a-real-md5&filename=x.pdf&filesize=10&mtime=${Date.now()}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						},
+						successCodes: [400],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 400);
+			});
+
+			it("should perform a full upload + register flow", async function () {
+				// Generate new file content with a known MD5
+				let content = "Local API upload test content " + Date.now();
+				let encoder = new TextEncoder();
+				let bytes = encoder.encode(content);
+				// Compute the MD5 we will claim
+				let tmpDir = Zotero.getTempDirectory().path;
+				let tmpPath = PathUtils.join(tmpDir, 'localapi-upload-test.bin');
+				await IOUtils.write(tmpPath, bytes);
+				let md5 = await Zotero.Utilities.Internal.md5Async(tmpPath);
+				await IOUtils.remove(tmpPath);
+
+				let mtime = Date.now();
+
+				// Phase 1: authorize
+				let { response: authResp } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=${md5}&filename=uploaded.bin&filesize=${bytes.length}&mtime=${mtime}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						}
+					}
+				);
+				assert.isString(authResp.uploadKey);
+				let uploadKey = authResp.uploadKey;
+
+				// Phase 2: upload bytes to local receiver
+				let uploadXhr = await Zotero.HTTP.request(
+					'POST', authResp.url,
+					{
+						headers: {
+							'Zotero-Allowed-Request': '1',
+							'Content-Type': 'application/octet-stream',
+						},
+						body: content,
+						successCodes: [201],
+						responseType: 'text'
+					}
+				);
+				assert.equal(uploadXhr.status, 201);
+
+				// Phase 3: register
+				let { status } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `upload=${uploadKey}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						},
+						successCodes: [204]
+					}
+				);
+				assert.equal(status, 204);
+
+				// Verify attachment metadata was updated
+				let reloaded = await Zotero.Items.getByLibraryAndKeyAsync(
+					Zotero.Libraries.userLibraryID, attachment.key);
+				assert.equal(reloaded.attachmentSyncedHash, md5);
+				assert.equal(reloaded.attachmentSyncedModificationTime, mtime);
+				assert.equal(reloaded.attachmentFilename, 'uploaded.bin');
+			});
+
+			it("should reject registration without prior upload", async function () {
+				// Authorize but never upload, then try to register
+				let { response: authResp } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=${'e'.repeat(32)}&filename=x.bin&filesize=5&mtime=${Date.now()}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						}
+					}
+				);
+				let { status } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `upload=${authResp.uploadKey}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						},
+						successCodes: [400],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 400);
+			});
+
+			it("should reject upload-receiver with mismatched MD5", async function () {
+				// Authorize with one MD5, then upload different content
+				let claimedMD5 = 'a'.repeat(32);
+				let { response: authResp } = await apiPost(
+					`/users/0/items/${attachment.key}/file`,
+					{
+						body: `md5=${claimedMD5}&filename=mm.bin&filesize=10&mtime=${Date.now()}`,
+						headers: {
+							'Content-Type': 'application/x-www-form-urlencoded',
+							'If-None-Match': '*',
+						}
+					}
+				);
+				let { status } = await Zotero.HTTP.request(
+					'POST', authResp.url,
+					{
+						headers: {
+							'Zotero-Allowed-Request': '1',
+							'Content-Type': 'application/octet-stream',
+						},
+						body: 'wrong content',
+						successCodes: [400],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 400);
+			});
+
+			it("should return 404 when upload key is unknown", async function () {
+				let { status } = await Zotero.HTTP.request(
+					'POST', apiRoot + '/local/uploads/badkey999',
+					{
+						headers: {
+							'Zotero-Allowed-Request': '1',
+							'Content-Type': 'application/octet-stream',
+						},
+						body: 'whatever',
+						successCodes: [404],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 404);
+			});
+
+			it("should reject PATCH partial upload with 405", async function () {
+				let { status } = await apiPatch(
+					`/users/0/items/${attachment.key}/file?algorithm=xdelta&upload=foo`,
+					{
+						headers: {
+							'Content-Type': 'application/octet-stream',
+						},
+						body: 'diff',
+						successCodes: [405],
+						responseType: 'text'
+					}
+				);
+				assert.equal(status, 405);
+			});
+		});
+
+		describe("Method restrictions", function () {
+			it("should reject POST to /items/top with 400 or 405", async function () {
+				let { status } = await apiPost('/users/0/items/top', {
+					body: [{ itemType: 'book' }],
+					headers: { 'Zotero-Write-Token': newWriteToken() },
+					successCodes: [400, 405],
+					responseType: 'text'
+				});
+				assert.oneOf(status, [400, 405]);
+			});
+
+			it("should reject DELETE to /items/trash with 400 or 405", async function () {
+				let { status } = await apiDelete(
+					'/users/0/items/trash?itemKey=ABCDEFGH',
+					{
+						headers: { 'If-Unmodified-Since-Version': '0' },
+						successCodes: [400, 405],
+						responseType: 'text'
+					}
+				);
+				assert.oneOf(status, [400, 405]);
+			});
+		});
+	});
 });