Files and Uploads

Files and Uploads

Not in v1 product scope; pattern is decided for when attachments ship.

Upload flow

1. GraphQL mutation requestUpload(mimeType, byteSize, purpose) → presigned PUT URL + file_id.
2. Client uploads to object storage (S3-compatible) directly.
3. GraphQL mutation confirmUpload(file_id) → virus scan / moderation queue → linkable.
4. Entities (notes, messages, forum) reference file_id only.

Do not use GraphQL multipart for large binaries (mobile timeouts, scanning before commit).

Storage keys

• Content-addressed hash for deduplication (same bytes → one object).
• Stable file_id in API for permissions, deletion, and user quotas.

Moderation (when UGC attachments exist)

Run checks on confirmUpload before the file is attachable to shared content.

Quotas

Per-user storage limits (TBD at implementation); platform admin visibility in job UI (Deployment).