Media access and usage

From the library to an article

Administration supports uploads, image preview, details and URL copying, and the editor inserts registered images. Uploads default to private; explicitly select public access for images intended for public articles.

The default local adapter stores files in the persistent media directory. Image URLs serve actual bytes through platform file endpoints. Deletion of files referenced by articles or settings is refused until references are removed.

Upload from a business server

PlatformClient upload requires the initiating user’s clientAccessToken and resource permission, not an arbitrary service token. Keep this SDK server-side; browser uploads go through the application’s controlled endpoint.

import { PlatformClient } from '@mosaic-base/platform-client';

export async function uploadImage(apiBaseUrl: string, userToken: string, buffer: Buffer, uploadId: string) {
  const platform = new PlatformClient({ baseUrl: apiBaseUrl });
  return platform.uploadFile(
    { buffer, mimetype: 'image/png', originalname: 'diagram.png' },
    { token: userToken, uploadId, business: 'user-media', needThumbnail: true },
  );
}
// Node server only. Reuse uploadId for an explicit retry of the same bytes.
// Client uploads stay private; use contentUrl or platform.downloadFile(id, { token }).

Connections and upload purposes

In Storage, administrators add a connection, save a candidate, test and explicitly apply it, then choose default or purpose rules. Media, article images, site branding and private client media can use different connections. Historical images keep their original connection when the default changes. Applications send no provider, bucket or physical object key and need no cloud browser SDK.

Keep one UUID uploadId per user operation and reuse it for an explicit retry. Confirmed results include storageId/storageName, ready status and authenticated contentUrl; downloadFile reads private bytes with the current user session. Cleanup, conflict and unknown outcomes remain explicit, without automatic storage fallback or write replay.

Verify access after publishing

Check that the public URL returns the expected image bytes and content type and renders in an anonymous article. Private media files require authorization; copying a path or referencing it in content does not elevate access.