fix: stream FilePond uploads to S3 and proxy private file previews

Disk-based multer plus an authenticated content endpoint match the working Node.js uploader and avoid browser signed-URL failures on SeaweedFS.

components/files/fileController.js

@@ -5,18 +5,28 @@ const fileService = require('./fileService');
 const { successResponse } = require('../../utils/apiResponse');
 const AppError = require('../../utils/AppError');
 
+const pickUploadedFile = (req) => {
+  if (req.file) return req.file;
+  if (Array.isArray(req.files) && req.files.length) return req.files[0];
+  if (req.files && typeof req.files === 'object') {
+    return req.files.file?.[0]
+      || req.files['filepond-image']?.[0]
+      || Object.values(req.files).flat().find(Boolean)
+      || null;
+  }
+  return null;
+};
+
 exports.uploadTemp = catchAsync(async (req, res, next) => {
-  if (!req.file) {
+  const uploaded = pickUploadedFile(req);
+  if (!uploaded) {
     return next(new AppError('FILE_REQUIRED'));
   }
 
-  const result = await fileService.uploadTempFile(
-    req.file.buffer,
-    req.file.originalname,
-    req.file.mimetype
-  );
+  const result = await fileService.uploadTempFile(uploaded);
 
-  return successResponse(res, 201, 'File uploaded to temp bucket successfully', result);
+  // 200 matches the working FilePond Node.js uploader (2xx is required)
+  return successResponse(res, 200, 'File uploaded to temp bucket successfully', result);
 });
 
 exports.getSignedUrl = catchAsync(async (req, res, next) => {
@@ -27,6 +37,20 @@ exports.getSignedUrl = catchAsync(async (req, res, next) => {
   return successResponse(res, 200, 'Temporary presigned URL generated successfully', result);
 });
 
+exports.streamFile = catchAsync(async (req, res, next) => {
+  const key = req.query.key || req.params.filename;
+  const bucket = req.query.bucket;
+
+  if (!key) {
+    return next(new AppError('VALIDATION_FAILED', null, 'Filename is required'));
+  }
+
+  const { buffer, contentType } = await fileService.getFileContent(key, bucket);
+  res.set('Content-Type', contentType);
+  res.set('Cache-Control', 'private, max-age=60');
+  return res.status(200).send(buffer);
+});
+
 exports.deleteFile = catchAsync(async (req, res, next) => {
   const { filename } = req.params;
   const { bucket } = req.query;

components/files/fileRoutes.js

@@ -1,5 +1,7 @@
 // /components/files/fileRoutes.js
 
+const fs = require('fs');
+const path = require('path');
 const express = require('express');
 const multer = require('multer');
 const fileController = require('./fileController');
@@ -7,24 +9,52 @@ const { validateGetSignedUrl } = require('./fileValidator');
 const authMiddleware = require('../../middlewares/authMiddleware');
 const perm = require('../../middlewares/permissionMiddleware');
 const { PERMISSIONS } = require('../../constants/permissions');
+const AppError = require('../../utils/AppError');
 
 const router = express.Router();
 
-// Memory Storage for Multer to stream directly to S3 temp bucket
+const uploadDir = path.resolve(process.cwd(), 'uploads');
+fs.mkdirSync(uploadDir, { recursive: true });
+
+const ALLOWED_MIME = new Set([
+  'image/jpeg',
+  'image/png',
+  'image/webp',
+  'image/gif',
+  'application/pdf'
+]);
+
+const fileFilter = (req, file, cb) => {
+  if (ALLOWED_MIME.has(file.mimetype)) {
+    cb(null, true);
+    return;
+  }
+  cb(new AppError('UNSUPPORTED_FILE_TYPE'), false);
+};
+
+// Disk storage (same pattern as the working Node.js FilePond uploader), then stream to S3
 const upload = multer({
-  storage: multer.memoryStorage(),
-  limits: { fileSize: 25 * 1024 * 1024 } // 25MB limit
+  dest: uploadDir,
+  fileFilter,
+  limits: { fileSize: 25 * 1024 * 1024 }
 });
 
+const uploadFilepond = upload.fields([
+  { name: 'file', maxCount: 1 },
+  { name: 'filepond-image', maxCount: 1 }
+]);
+
 router.use(authMiddleware);
 
 // User Scope
-router.post('/user/upload-temp', perm.requires(PERMISSIONS.FILES_UPLOAD), upload.single('file'), fileController.uploadTemp);
+router.post('/user/upload-temp', perm.requires(PERMISSIONS.FILES_UPLOAD), uploadFilepond, fileController.uploadTemp);
 router.get('/user/signed-url/:filename', perm.requires(PERMISSIONS.FILES_READ), validateGetSignedUrl, fileController.getSignedUrl);
+router.get('/user/content', perm.requires(PERMISSIONS.FILES_READ), fileController.streamFile);
 
 // Admin Scope
-router.post('/admin/upload-temp', perm.requires(PERMISSIONS.FILES_UPLOAD), upload.single('file'), fileController.uploadTemp);
+router.post('/admin/upload-temp', perm.requires(PERMISSIONS.FILES_UPLOAD), uploadFilepond, fileController.uploadTemp);
 router.get('/admin/signed-url/:filename', perm.requires(PERMISSIONS.FILES_READ), validateGetSignedUrl, fileController.getSignedUrl);
+router.get('/admin/content', perm.requires(PERMISSIONS.FILES_READ), fileController.streamFile);
 router.delete('/admin/delete/:filename', perm.requires(PERMISSIONS.FILES_DELETE), fileController.deleteFile);
 
 module.exports = router;

components/files/fileService.js

@@ -1,17 +1,32 @@
 // /components/files/fileService.js
 
+const fs = require('fs/promises');
 const path = require('path');
 const config = require('../../config/config');
 const {
   uploadToTempBucket,
   commitTempFile,
   generatePresignedUrl,
+  getObjectBuffer,
   deleteFromBucket
 } = require('../../utils/s3Client');
 const AppError = require('../../utils/AppError');
 
-const uploadTempFile = async (fileBuffer, originalName, mimeType) => {
-  if (!fileBuffer || !originalName) {
+const unlinkQuietly = async (filePath) => {
+  if (!filePath) return;
+  try {
+    await fs.unlink(filePath);
+  } catch {
+    // temp disk file may already be gone
+  }
+};
+
+const uploadTempFile = async (file) => {
+  const originalName = file?.originalname || file?.originalName;
+  const mimeType = file?.mimetype || file?.mimeType || 'application/octet-stream';
+  const source = file?.path || file?.buffer;
+
+  if (!source || !originalName) {
     throw new AppError('FILE_REQUIRED');
   }
 
@@ -19,13 +34,17 @@ const uploadTempFile = async (fileBuffer, originalName, mimeType) => {
   const uniquePrefix = `${Date.now()}-${Math.round(Math.random() * 1E9)}`;
   const tempFileName = `temp-${uniquePrefix}${ext}`;
 
-  const result = await uploadToTempBucket(fileBuffer, tempFileName, mimeType);
-  return {
-    tempFileName: result.tempFileName,
-    originalName,
-    mimeType,
-    bucket: result.bucket
-  };
+  try {
+    const result = await uploadToTempBucket(source, tempFileName, mimeType);
+    return {
+      tempFileName: result.tempFileName,
+      originalName,
+      mimeType,
+      bucket: result.bucket
+    };
+  } finally {
+    await unlinkQuietly(file.path);
+  }
 };
 
 const getPresignedUrl = async (filename, bucket = null) => {
@@ -44,6 +63,13 @@ const getPresignedUrl = async (filename, bucket = null) => {
   };
 };
 
+const getFileContent = async (filename, bucket = null) => {
+  if (!filename) {
+    throw new AppError('VALIDATION_FAILED', null, 'Filename is required');
+  }
+  return getObjectBuffer(filename, bucket || config.S3_TEMP_BUCKET);
+};
+
 const commitFile = async (tempFileName, targetFileName = null, targetBucket = 'certificates') => {
   return commitTempFile(tempFileName, targetFileName, targetBucket);
 };
@@ -55,6 +81,7 @@ const deleteFile = async (filename, bucket = null) => {
 module.exports = {
   uploadTempFile,
   getPresignedUrl,
+  getFileContent,
   commitFile,
   deleteFile
 };