Checklist attachments storage

attachments-storage

Generated by pnpm gen:checklist-status from docs/qa/platform-checklist/areas/*.json. ⛔ Do not edit this page — edits go to the area JSON and this page follows on the next run. This page is Checklist-attachments-storage.

Attachments & storage — presigned/chunked upload, signed-URL downloads, parent-derived access, sys_file lifecycle

12 active · 0 planned

Active (12)

id	title	priority	status	personas
attachments-storage.presigned-upload-roundtrip	Authenticated presigned upload → committed sys_file → signed-URL download round-trip; anonymous upload is 401	P1	active	seeded admin (admin@objectos.ai), anonymous (no bearer token)
attachments-storage.download-authz-both-sides	Gated downloads: 401 anonymous, 403 parent-invisible, signed URL for the entitled — per gating class (attachments-scope / field-owned / public_read opt-out / ungated)	P1	active	admin (uploader/owner), signed-up member who cannot read the parent record (qa-scratch-authz persona B: the API deny clauses), qa-scratch-authz persona A, entitled on qa_shared and then de-granted (the browser clause), anonymous
attachments-storage.read-inherits-parent-rls	sys_attachment reads inherit parent visibility: a restricted member sees neither rows nor counts for invisible parents	P1	active	member who can read the parent record, member who cannot read the parent record
attachments-storage.attach-requires-parent-edit	Attaching requires EDIT on the parent record; deleting requires uploader-or-parent-editor; unscoped multi-delete is refused outright	P1	active	member with EDIT on the parent, member with READ but not EDIT on the parent, member who uploaded the attachment, member who is neither uploader nor parent editor, admin (isolates clause 5's FILES_DISABLED refusal from ATTACHMENT_PARENT_ACCESS by holding EDIT on both the original and target parent)
attachments-storage.sys-file-status-pipeline	sys_file status pipeline: pending → committed → deleted (tombstone) with un-tombstone on re-attach; shared files never tombstone early	P2	active	seeded admin (admin@objectos.ai)
attachments-storage.orphan-tombstone-reap	The platform lifecycle sweep reaps expired tombstones and abandoned pending uploads WITH byte reclaim; sweep-time re-verification vetoes rather than losing data	P2	active	admin (setup access, drives the sweep)
attachments-storage.upload-session-abort	Chunked uploads are resumable; abandoned sessions are reaped and their backend multipart uploads ABORTED before the row (the only pointer) is deleted	P2	active	seeded admin (admin@objectos.ai)
attachments-storage.inline-grid-receipt-cells	Per-line Receipt upload cells in the invoice inline grid: auto-derived file column, real upload control, opaque sys_file reference in the atomic batch	P1	active	seeded admin (admin@objectos.ai)
attachments-storage.field-accept-maxsize-server-enforced	A field's declared accept/maxSize is re-enforced SERVER-SIDE on record write — the control the client widget check explicitly is not — with the declared missing-metadata and dotless-extension holes scored as documented boundaries	P1	active	seeded admin (admin@objectos.ai) — the check is a declaration constraint, not an authz gate: it binds every caller identically, so no restricted persona is needed
attachments-storage.upload-limits-scope-and-ownership	Upload contract on v18: a declared size over the limit (100 MiB default, moved live by the max_upload_mb setting) is 413 with nothing written, an unknown scope is 400 naming the allowed values (public is retired), only the uploader may complete or poll an upload, an unclaimed private file is 401 to anonymous, and a file id copied from another record hydrates as {id, metadataRefused:true}	P1	active	seeded admin (admin@objectos.ai / admin123) — the Default Organization owner and platform admin on a fresh boot, org member — created by the admin with POST /api/v1/auth/admin/create-user (stock showcase self-registration is closed: audience posture invite_only answers sign-up 403 SELF_REGISTRATION_CLOSED); joins the Default Organization as member, not platform admin, and lands mustChangePassword:true, i.e. a HELD session until it changes its password (POST /api/v1/auth/change-password), anonymous caller (no cookie, no bearer, no x-api-key)
attachments-storage.chunked-upload-integrity	Chunked upload integrity on v18: complete with a missing chunk is 409 with details.missingChunks and the session stays in_progress, a re-sent chunk counts once, parallel chunks all record, and an org switch mid-upload answers 409 on chunk and complete, and on progress only once the session's expiry stamp is due	P2	active	seeded admin (admin@objectos.ai / admin123) — the Default Organization owner and platform admin on a fresh boot
attachments-storage.multi-replica-local-root-refusal	A declared multi-replica boot on Redis refuses the local file-storage adapter unless the root is declared shared, and a settings change to the local adapter is not applied	P1	active	seeded admin (admin@objectos.ai / admin123): the settings leg, an operator booting the replicas