FiloraFS-Pro storage

Provider behavior

LOCAL storage

LOCAL is the zero-configuration active provider under ./uploads. ROLE_ADMIN can save and test a different relative path through /api/storage.

• The resolved path must remain inside the project directory.
• UUID storage keys prevent client filenames from becoming storage paths.
• Path-containment checks protect reads, writes, deletes, and thumbnails.
• Use a persistent mount where files must survive deployments, and back up files with database metadata.

AWS S3 and MinIO

ROLE_ADMIN saves the endpoint, bucket, region, access key, and secret key through the runtime API or workbench. The database persists this configuration, while AES-256-GCM protects credentials with the external FILORAFS_STORAGE_MASTER_KEY. Omit the endpoint for AWS or provide an HTTP(S) endpoint for MinIO and other compatible services.

• Keep the external storage master key stable anywhere encrypted credentials must remain usable.
• The API returns credential-presence flags, never stored access or secret values.
• Testing verifies bucket access and a short write/delete probe without activating S3.
• Selecting S3 is a separate explicit operation that tests availability before saving the active provider.

Provider switching and existing files

The active provider controls only new uploads. Every file metadata row retains LOCAL or S3, so later reads, downloads, thumbnails, temporary access, and deletion route to the original provider.

• Existing LOCAL files stay LOCAL after switching to S3.
• Existing S3 files stay S3 after switching back to LOCAL.
• Switching does not migrate objects or rewrite metadata.
• Configuration updates and provider switches are recorded in storage audit history.

No silent fallback

When S3 is active and unavailable, upload, read, or delete operations fail with a sanitized storage-unavailable response. FiloraFS-Pro does not write the file to LOCAL, change the active provider, or create misleading metadata.

File lifecycle and ownership

• Upload validates maximum size, extension, declared MIME type, and lightweight PNG, JPEG, PDF, or MP4 signatures.
• The authenticated uploader becomes the required owner before physical storage begins.
• Metadata records safe UUID key, original filename, content type, size, provider, uploader, owner, and upload time.
• Normal users list and access only their own files; ROLE_ADMIN can operate across users.
• Delete removes the provider object, thumbnail, metadata, and related temporary-link rows.

Temporary access

An owner or administrator can request access for up to 604800 seconds. LOCAL returns an application URL with an expiring random token. S3 returns a provider-signed GET URL when native signing succeeds; the implementation retains the application-token path if signing is unavailable.

Thumbnails

PNG and JPEG uploads are eligible for JPEG thumbnail generation. LOCAL generation runs asynchronously; S3 generation downloads an unpredictable temporary local copy and removes it afterward.

• Unsupported formats and failed generation use the bundled fallback SVG.
• Thumbnail responses require owner/admin authorization.
• Responses use Cache-Control: private, no-store.

Security and scale limits

• The application performs lightweight signature checks, not antivirus or malware scanning.
• Existing S3 reads materialize the complete object in memory; review this path for large files.
• Add quotas, retention, cleanup scheduling, observability, and deployment-specific controls as required.