Documents & Storage

S3-compatible asset pipeline, metadata indexing, and access-controlled streaming.

The Documents module unifies binary asset management across cloud storage providers (S3, Cloudflare R2, MinIO) with deterministic access verification, automated thumbnailing, and document version history.

Capabilities

Core Functional Capabilities

✓ Direct-to-S3 signed URL uploads with checksum validation

✓ Tenant-scoped storage drivers and encryption at rest

✓ Asynchronous processing pipeline (PDF rendering, resizing, text extraction)

✓ Document versioning, soft deletion, and retention policy enforcement

✓ Content-type verification and anti-malware scan hooks

✓ Time-limited ephemeral download links with rate limiting

Contracts

Public Interface Contracts

Other modules and domain action classes interact exclusively via these typed PHP contracts.

interface DocumentStorageInterface

interface DocumentProcessorInterface

interface SignedUrlGeneratorInterface

interface DocumentValidatorInterface

Reactivity

Dispatched Domain Events

Dispatched upon state mutation for downstream audit recording, webhook firing, and asynchronous notifications.

⚡ DocumentUploaded

⚡ DocumentProcessed

⚡ DocumentVersionCreated

⚡ DocumentDeleted

⚡ MaliciousContentDetected

Customization

Extension Points

• Custom file transformation processors (e.g. CAD, Audio, Video, DICOM)
• Custom anti-virus / sandboxing integrations
• Storage adapter drivers for specialized on-premise SAN/NAS

🛡 Security & Isolation

• MIME sniffing and extension mismatch rejection
• Strict tenant directory prefixes preventing path traversal
• Pre-signed short-lived token expiration (default 15 minutes)

Core Entities & Models

Document (UUID, filename, mime, size, checksum, disk, path, tenant_id)
DocumentVersion (Document_id, version_num, path, created_by)
DocumentMetadata (Key-value tags, indexed attributes)

Related Technical Knowledge

Architecture of a Modern Business-Critical Application

3 min read • Architecture

Designing Software That Can Evolve for Ten Years

3 min read • Engineering

What Makes Software Business-Critical?

3 min read • Engineering

Explore Other Platform Modules

Identity & Tenancy

Multi-tenant identity boundaries, user lifecycle, and authentication.

Permissions & Authorization

Hierarchical RBAC, contextual ABAC, and explicit resource policies.

Audit & Compliance Logging

Append-only immutable event streams for compliance and forensic analysis.

Workflows & State Machines

Deterministic state machine engine with visual transitions and guard conditions.

Notifications & Messaging

Omni-channel delivery engine across Email, SMS, Webhooks, Push, and In-App.

Integrations & Webhooks

Bi-directional webhook engine, REST API gateway, and external sync pipeline.

Reporting & Aggregation

High-performance analytical queries, export queues, and scheduled summaries.