Implement attachments module with direct S3 upload flow

Author: capcom6

go.mod

@@ -39,9 +39,11 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.10 // indirect
 	github.com/go-core-fx/fxutil v0.0.0-20251027105421-acea37162eb9 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.19.6 // indirect
 	github.com/go-openapi/spec v0.20.4 // indirect
@@ -56,6 +58,8 @@ require (
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
+	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/knadh/koanf/maps v0.1.2 // indirect
 	github.com/knadh/koanf/parsers/dotenv v1.1.0 // indirect
 	github.com/knadh/koanf/parsers/yaml v1.1.0 // indirect
@@ -68,16 +72,22 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.21 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
+	github.com/minio/crc64nvme v1.1.1 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
+	github.com/minio/minio-go/v7 v7.0.100 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
 	github.com/puzpuzpuz/xsync/v3 v3.5.1 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/sethvargo/go-retry v0.3.0 // indirect
 	github.com/swaggo/files/v2 v2.0.2 // indirect
+	github.com/tinylib/msgp v1.6.1 // indirect
 	github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasthttp v1.69.0 // indirect

go.sum

@@ -46,6 +46,8 @@ github.com/go-core-fx/sqlfx v0.1.0 h1:jWK4oUqvoJhcbLORWZXeRTzjstY6APter1fKsRYJbN
 github.com/go-core-fx/sqlfx v0.1.0/go.mod h1:D8fFoIeCUGthMN2nOeYIqs+yYH5CEDJBNJeMP4+Usk8=
 github.com/go-core-fx/validatorfx v0.0.2 h1:J+POBsdqyT2Hd3TZHgJ+0eBtCPHhHff8TJLcGowQ0Ew=
 github.com/go-core-fx/validatorfx v0.0.2/go.mod h1:1VtQoOEzBo3oapXgRFA65H+zSKvmCvb6yfAcdwpqSlE=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -96,6 +98,11 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
+github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
+github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
 github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
 github.com/knadh/koanf/parsers/dotenv v1.1.0 h1:dQaM0Jw54zRsqDcaJ27pciNExuKfOXagCJW3K1h0hj0=
@@ -131,6 +138,12 @@ github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEj
 github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
 github.com/mfridman/interpolate v0.0.2/go.mod h1:p+7uk6oE07mpE/Ik1b8EckO0O4ZXiGAfshKBWLUM9Xg=
+github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
+github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
+github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
+github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
+github.com/minio/minio-go/v7 v7.0.100 h1:ShkWi8Tyj9RtU57OQB2HIXKz4bFgtVib0bbT1sbtLI8=
+github.com/minio/minio-go/v7 v7.0.100/go.mod h1:EtGNKtlX20iL2yaYnxEigaIvj0G0GwSDnifnG8ClIdw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -140,6 +153,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8m
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pressly/goose/v3 v3.27.0 h1:/D30gVTuQhu0WsNZYbJi4DMOsx1lNq+6SkLe+Wp59BM=
@@ -158,6 +173,8 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
 github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
@@ -171,6 +188,8 @@ github.com/swaggo/files/v2 v2.0.2 h1:Bq4tgS/yxLB/3nwOMcul5oLEUKa877Ykgz3CJMVbQKU
 github.com/swaggo/files/v2 v2.0.2/go.mod h1:TVqetIzZsO9OhHX1Am9sRf9LdrFZqoK49N37KON/jr0=
 github.com/swaggo/swag v1.16.6 h1:qBNcx53ZaX+M5dxVyTrgQ0PJ/ACK+NzhwcbieTt+9yI=
 github.com/swaggo/swag v1.16.6/go.mod h1:ngP2etMK5a0P3QBizic5MEwpRmluJZPHjXcMoj4Xesg=
+github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
+github.com/tinylib/msgp v1.6.1/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc h1:9lRDQMhESg+zvGYmW5DyG0UqvY96Bu5QYsTLvCHdrgo=
 github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc/go.mod h1:bciPuU6GHm1iF1pBvUfxfsH0Wmnc2VbpgvbI9ZWuIRs=
 github.com/uptrace/bun v1.2.18 h1:3HnRcMfS6OBPMG1eSOzlbFJ/X/AyMEJb7rMxE6VQvDU=

internal/app.go

@@ -3,11 +3,13 @@ package internal
 import (
 	"context"
 
+	"github.com/bit-issues/backend/internal/attachments"
 	"github.com/bit-issues/backend/internal/comments"
 	"github.com/bit-issues/backend/internal/config"
 	"github.com/bit-issues/backend/internal/db"
 	"github.com/bit-issues/backend/internal/jwt"
 	"github.com/bit-issues/backend/internal/projects"
+	"github.com/bit-issues/backend/internal/s3"
 	"github.com/bit-issues/backend/internal/server"
 	"github.com/bit-issues/backend/internal/tasks"
 	"github.com/bit-issues/backend/internal/users"
@@ -55,6 +57,8 @@ func Run(version healthfx.Version) {
 		users.Module(),
 		projects.Module(),
 		tasks.Module(),
+		s3.Module(),
+		attachments.Module(),
 		comments.Module(),
 		//
 		fx.Invoke(func(lc fx.Lifecycle, logger *zap.Logger) {

internal/attachments/doc.go

@@ -0,0 +1,2 @@
+// Package attachments provides domain, repository and service logic for task attachments.
+package attachments

internal/attachments/domain.go

@@ -0,0 +1,80 @@
+package attachments
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const DefaultMaxFileSizeBytes uint64 = 104857600
+
+type AttachmentStatus string
+
+const (
+	StatusPending  AttachmentStatus = "pending"
+	StatusUploaded AttachmentStatus = "uploaded"
+)
+
+type Attachment struct {
+	ID           int64
+	TaskID       int64
+	FileName     string
+	StorageKey   string
+	SizeBytes    uint64
+	Status       AttachmentStatus
+	UploadedBy   int64
+	UploadedAt   time.Time
+	DeletedAt    *time.Time
+	TaskAuthorID int64
+}
+
+type AttachmentInput struct {
+	TaskID     int64
+	FileName   string
+	SizeBytes  uint64
+	UploaderID int64
+}
+
+func (i AttachmentInput) Validate(maxFileSize uint64) error {
+	if i.TaskID <= 0 {
+		return fmt.Errorf("%w: task_id must be positive", ErrValidationFailed)
+	}
+
+	if i.UploaderID <= 0 {
+		return fmt.Errorf("%w: uploader_id must be positive", ErrValidationFailed)
+	}
+
+	fileName := sanitizeFileName(i.FileName)
+	if fileName == "" {
+		return fmt.Errorf("%w: file_name is required", ErrValidationFailed)
+	}
+
+	if len(fileName) > 255 {
+		return fmt.Errorf("%w: file_name too long (max 255 characters)", ErrValidationFailed)
+	}
+
+	if i.SizeBytes == 0 {
+		return fmt.Errorf("%w: size_bytes must be positive", ErrValidationFailed)
+	}
+
+	if i.SizeBytes > maxFileSize {
+		return ErrFileTooLarge
+	}
+
+	return nil
+}
+
+func sanitizeFileName(name string) string {
+	trimmed := strings.TrimSpace(name)
+	if trimmed == "" {
+		return ""
+	}
+
+	base := filepath.Base(trimmed)
+	if base == "." || base == string(filepath.Separator) {
+		return ""
+	}
+
+	return strings.ReplaceAll(base, "\\", "")
+}

internal/attachments/errors.go

@@ -0,0 +1,13 @@
+package attachments
+
+import "errors"
+
+var (
+	ErrNotFound         = errors.New("attachment not found")
+	ErrValidationFailed = errors.New("validation failed")
+	ErrTaskNotFound     = errors.New("task not found")
+	ErrUnauthorized     = errors.New("unauthorized")
+	ErrFileTooLarge     = errors.New("file exceeds maximum allowed size")
+	ErrNotUploaded      = errors.New("attachment is not yet uploaded")
+	ErrAlreadyConfirmed = errors.New("attachment already confirmed")
+)

internal/attachments/models.go

@@ -0,0 +1,54 @@
+package attachments
+
+import (
+	"time"
+
+	"github.com/uptrace/bun"
+)
+
+type attachmentModel struct {
+	bun.BaseModel `bun:"table:attachments,alias:a"`
+
+	ID           int64      `bun:"id,pk,autoincrement"`
+	TaskID       int64      `bun:"task_id,notnull"`
+	FileName     string     `bun:"file_name,notnull"`
+	StorageKey   string     `bun:"s3_key,notnull"`
+	SizeBytes    uint64     `bun:"size_bytes,notnull"`
+	Status       string     `bun:"status,notnull"`
+	UploadedBy   int64      `bun:"uploaded_by,notnull"`
+	UploadedAt   time.Time  `bun:"uploaded_at,notnull"`
+	DeletedAt    *time.Time `bun:"deleted_at,soft_delete,nullzero"`
+	TaskAuthorID int64      `bun:"task_author_id,scanonly"`
+}
+
+func newAttachmentModel(input AttachmentInput, storageKey string) *attachmentModel {
+	return &attachmentModel{
+		TaskID:     input.TaskID,
+		FileName:   sanitizeFileName(input.FileName),
+		StorageKey: storageKey,
+		SizeBytes:  input.SizeBytes,
+		Status:     string(StatusPending),
+		UploadedBy: input.UploaderID,
+		UploadedAt: time.Now().UTC(),
+		DeletedAt:  nil,
+	}
+}
+
+func (m *attachmentModel) toDomain() *Attachment {
+	if m == nil {
+		return nil
+	}
+
+	return &Attachment{
+		ID:           m.ID,
+		TaskID:       m.TaskID,
+		FileName:     m.FileName,
+		StorageKey:   m.StorageKey,
+		SizeBytes:    m.SizeBytes,
+		Status:       AttachmentStatus(m.Status),
+		UploadedBy:   m.UploadedBy,
+		UploadedAt:   m.UploadedAt,
+		DeletedAt:    m.DeletedAt,
+		TaskAuthorID: m.TaskAuthorID,
+	}
+}

internal/attachments/module.go

@@ -0,0 +1,24 @@
+package attachments
+
+import (
+	"github.com/bit-issues/backend/internal/config"
+	"github.com/go-core-fx/logger"
+	"go.uber.org/fx"
+)
+
+func Module() fx.Option {
+	return fx.Module(
+		"attachments",
+		logger.WithNamedLogger("attachments"),
+		fx.Provide(NewRepository, fx.Private),
+		fx.Provide(func(cfg config.Config) Config {
+			return Config{
+				MaxFileSizeBytes: cfg.S3.MaxFileSizeBytes,
+				UploadURLTTL:     cfg.S3.UploadURLTTL,
+				DownloadURLTTL:   cfg.S3.DownloadURLTTL,
+				BucketName:       cfg.S3.BucketName,
+			}
+		}),
+		fx.Provide(NewService),
+	)
+}