File Upload Contract Repair

The problem

File upload logic often drifts across routes, storage adapters, and background workers, leading to insecure behaviors like trusting client-side MIME types or using sensitive filenames as storage keys. These inconsistencies create race conditions in scan callbacks, orphaned objects, and unauthorized access to quarantined files.

What it does

• Generates opaque, server-controlled object keys to prevent path collisions and metadata leaks.
• Implements atomic, idempotent finalization for direct and multipart uploads to stop duplicate row creation.
• Introduces typed lifecycle states including quarantine, ready, and superseded to gate downloads and derivative processing.
• Verifies final stored object size and integrity against the original session contract.
• Standardizes versioned callback handling to prevent stale scan results from overwriting newer file states.

Frameworks & tools

Works with repository patterns using S3-compatible storage, Node.js, Python/Django, PostgreSQL, and background workers like BullMQ or Celery.

Why this beats prompting it yourself

This skill handles the complex state transitions between storage adapters, database models, and async workers that a simple prompt misses. It builds a deterministic local test matrix to verify edge cases like cross-session part reuse and cleanup races without touching production data.

Use cases

• Repairing inconsistent file type validation across multiple API endpoints.
• Fixing race conditions where files become downloadable before malware scanning finishes.
• Transitioning from filename-based storage to opaque internal identities.
• Standardizing cleanup jobs to safely identify orphaned multipart uploads.

Known limitations

Cannot access live storage, inspect customer files, or perform production migrations. Local verification relies on the repository's existing fake storage or mocks.