# File Upload — {{provider}}

## Overview
Secure file upload system using {{provider}} bucket `{{bucket_name}}` with presigned URLs, a maximum file size of {{max_size_mb}} MB, and allowed types: {{allowed_types}}.

## Acceptance Criteria

### AC-1: Presigned URL Generation
- Generate a presigned upload URL valid for 15 minutes
- URL is scoped to the authenticated user's namespace
- Enforce `Content-Type` matching one of: {{allowed_types}}

### AC-2: File Validation
- Reject uploads exceeding {{max_size_mb}} MB with a clear error
- Validate MIME type against the Content-Type header
- Scan file content for malicious patterns before confirming upload

### AC-3: Upload Confirmation
- Client calls confirm endpoint after direct upload to {{provider}}
- Server verifies the object exists in `{{bucket_name}}` before saving metadata
- Store file metadata (name, size, type, owner, uploadedAt) in the database

### AC-4: Download and Deletion
- Generate presigned download URLs valid for 1 hour
- Delete the object from `{{bucket_name}}` and metadata on user request
- Restrict access so users can only download/delete their own files

## Technical Notes
- Never expose {{provider}} credentials to the client
- Use server-side encryption at rest in `{{bucket_name}}`
- Log all upload attempts (success and failure) with user ID and file metadata
