Files
File routes manage uploaded files and file folders. Uploads should always be saved safely on the file server and linked back to account records.
Upload Safety
- Use FormData for file uploads and include the route-required owner record id, such as customer_id, project_id, or folder_id.
- The server should block dangerous file types, oversized files, and unsafe filenames.
- The user-facing filename can be saved in data, but physical storage should use a safe generated filename.
File Folders
- File folder routes manage folder organization for uploaded files.
- Folder actions should check the user can see or manage that file area.
Returned Paths
- Upload/add responses should return the file id and file-server path for later display or download.
- Use file ids for edit/delete/remove actions instead of trusting client paths.
Common Flow
- Load file permissions and file folders from User.Basic.
- Use list/folder routes to show existing files.
- Upload files with FormData and a bearer token.
- Store returned file ids and safe paths.