Skip to main content

R2 Attachments

Last reviewed: 2026-05-13
Maintained by: Engineering

Issue attachment storage is currently built around Cloudflare R2-compatible object storage.

Current flow​

  • the API creates signed upload and read URLs
  • the mobile client uploads attachment binaries directly to object storage
  • metadata and attachment records stay tracked in the application database
  • the API validates actual file signatures, not only MIME type or filename metadata
  • issue attachments are validated at finalize time using the first FILE_SIGNATURE_PREFIX_BYTES bytes of the uploaded object
  • document uploads are validated from the raw request body before storage

Key implementation areas​

  • API storage adapter: apps/api/src/lib/r2.ts
  • issue attachment orchestration: apps/api/src/features/issues/issues.service.ts
  • mobile upload client: apps/zgrid-mobile/src/lib/issue-image-attachments.ts

Required configuration​

The API expects environment-managed R2 settings:

  • R2_ACCOUNT_ID
  • R2_ACCESS_KEY_ID
  • R2_SECRET_ACCESS_KEY
  • R2_ATTACHMENTS_BUCKET

Do not commit real storage credentials. Keep them in environment-managed secrets only.