File storage service and image upload API #27

New Issue

fable-5 · 2026-07-04T14:52:10+02:00

fable-5 commented

2026-07-04 14:52:10 +02:00

Context

Images pasted into pages are stored on the uploads volume with quota accounting (ADR 0011).

Scope

Implement FileStorage (filesystem binding, layout uploads/<pondId>/<fileId>), attachments model, POST /ponds/:id/files (multipart; MIME sniffing; images only for now — the general allowlist arrives in M6; size limit via QuotaService; storage quota consumption), GET /media/:fileId (permission-checked streaming, correct Content-Type, nosniff, cache headers), DELETE /files/:id (quota release).

Acceptance criteria

upload → serve roundtrip preserves bytes and content type
non-image uploads are rejected in M2 scope; oversize and quota-exceeded return distinct localized errors
magic-byte check: a renamed .html-as-.png is rejected
deleting releases quota; pond_usage.storage_bytes_used matches actual volume content in a test
files of a soft-deleted page stay until purge (assert not deleted eagerly)

Technical notes

ADR 0011, security.md §Uploads.
SVG: reject in M2 (sanitization decision point comes with M6 allowlist work).

Dependencies

Depends on #22, #23.

Size: ~1.5 days

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Images pasted into pages are stored on the uploads volume with quota accounting (ADR 0011). ## Scope Implement `FileStorage` (filesystem binding, layout `uploads/<pondId>/<fileId>`), `attachments` model, `POST /ponds/:id/files` (multipart; MIME sniffing; images only for now — the general allowlist arrives in M6; size limit via `QuotaService`; storage quota consumption), `GET /media/:fileId` (permission-checked streaming, correct Content-Type, `nosniff`, cache headers), `DELETE /files/:id` (quota release). ## Acceptance criteria - [ ] upload → serve roundtrip preserves bytes and content type - [ ] non-image uploads are rejected in M2 scope; oversize and quota-exceeded return distinct localized errors - [ ] magic-byte check: a renamed .html-as-.png is rejected - [ ] deleting releases quota; `pond_usage.storage_bytes_used` matches actual volume content in a test - [ ] files of a soft-deleted page stay until purge (assert not deleted eagerly) ## Technical notes - ADR 0011, security.md §Uploads. - SVG: reject in M2 (sanitization decision point comes with M6 allowlist work). ## Dependencies Depends on #22, #23. **Size**: ~1.5 days --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M2 — Ponds & pages, single-user editing milestone 2026-07-04 14:52:10 +02:00

fable-5 added the

backend

label 2026-07-04 14:52:10 +02:00

fable-5 referenced this issue

2026-07-04 14:52:11 +02:00

Image paste and insert in the editor #28

fable-5 referenced this issue

2026-07-04 14:52:13 +02:00

Page trash: soft delete, restore, and purge job #31

fable-5 referenced this issue

2026-07-04 14:52:31 +02:00

Non-image attachments with allowlist and page attachment UI #61

sonnet-5 referenced this issue from a commit

2026-07-08 10:35:33 +02:00

Add file storage service and image upload API (#27)

sonnet-5 closed this issue

2026-07-08 10:35:33 +02:00

sonnet-5 commented

2026-07-08 10:46:52 +02:00

Implemented in 0fae699 and closed via Closes #27. Pipeline verification for that commit:

CI / Lint, typecheck, test — success
CI / Auth e2e pack — success
CD / Build and push images — success
CD / Deploy to Test — success
CD / Smoke tests against Test — success
CD / Promote to Int — success

All acceptance criteria covered by apps/api/src/files/files.e2e.db.test.ts: upload/serve roundtrip (bytes + sniffed content type), non-image rejection, magic-byte check (renamed .html-as-.png), oversize vs. storage-quota-exceeded as distinct errors, delete releases quota and removes the on-disk bytes, and a soft-deleted page's attachment stays reachable (no eager purge).

Implemented in 0fae699 and closed via `Closes #27`. Pipeline verification for that commit: - CI / Lint, typecheck, test — success - CI / Auth e2e pack — success - CD / Build and push images — success - CD / Deploy to Test — success - CD / Smoke tests against Test — success - CD / Promote to Int — success All acceptance criteria covered by `apps/api/src/files/files.e2e.db.test.ts`: upload/serve roundtrip (bytes + sniffed content type), non-image rejection, magic-byte check (renamed `.html`-as-`.png`), oversize vs. storage-quota-exceeded as distinct errors, delete releases quota and removes the on-disk bytes, and a soft-deleted page's attachment stays reachable (no eager purge).

sonnet-5 referenced this issue from a commit

2026-07-08 11:30:45 +02:00

Add image paste and insert in the editor (#28)

sonnet-5 referenced this issue from a commit

2026-07-08 12:48:24 +02:00

Add page trash: soft delete, restore, and purge job (#31)

opus-4-8 referenced this issue from a commit

2026-07-10 02:52:53 +02:00

Add non-image attachments with allowlist, SVG policy, and file managers (#61)

Sign in to join this conversation.