AutoCore Media Storage Architecture
Documents local and R2 media storage, presigned upload boundaries, processing, and lifecycle.
Media is accessed through a storage abstraction. Local storage is protected by path and symlink checks; Cloudflare R2 uses short-lived presigned PUT URLs and a configured public base URL. Credentials remain server-side.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| Upload | Validate listing ownership, media type, size, and file magic before processing. |
| Processing | Sharp creates approved original and variant outputs; checksums and audit data support integrity review. |
| Limits | The reviewed defaults are 10 MB per file and 30 images per listing. |
| Orphans | Failed processing and deleted listing paths require orphan review and safe cleanup. |
| CDN | A public CDN base URL is configuration; it is not proof that an object is public or immutable. |
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.