@flusys/nestjs-storage 9.1.2 → 9.2.0

package/fesm/chunks/746.js

@@ -2,7 +2,7 @@ import * as __rspack_external__azure_storage_blob_23d6f9ca from "@azure/storage-
 export const __rspack_esm_id = 746;
 export const __rspack_esm_ids = [746];
 export const __webpack_modules__ = {
-737(module) {
+4737(module) {
 
 module.exports = __rspack_external__azure_storage_blob_23d6f9ca;
 

package/fesm/chunks/798.js

@@ -2,7 +2,7 @@ import * as __rspack_external__aws_sdk_client_s3_a2e3616c from "@aws-sdk/client-
 export const __rspack_esm_id = 798;
 export const __rspack_esm_ids = [798];
 export const __webpack_modules__ = {
-965(module) {
+2965(module) {
 
 module.exports = __rspack_external__aws_sdk_client_s3_a2e3616c;
 

package/fesm/chunks/918.js

@@ -1,12 +1,12 @@
 export const __rspack_esm_id = 918;
 export const __rspack_esm_ids = [918];
 export const __webpack_modules__ = {
-5(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+1005(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 __webpack_require__.r(__webpack_exports__);
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _flusys_nestjs_shared_constants__rspack_import_1 = __webpack_require__(140);
-/* import */ var _utils_image_compressor_util_js__rspack_import_2 = __webpack_require__(872);
-/* import */ var path__rspack_import_3 = __webpack_require__(521);
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _flusys_nestjs_shared_constants__rspack_import_1 = __webpack_require__(9140);
+/* import */ var _utils_image_compressor_util_js__rspack_import_2 = __webpack_require__(1872);
+/* import */ var path__rspack_import_3 = __webpack_require__(2521);
 /* import */ var uuid__rspack_import_4 = __webpack_require__(37);
 /**
  * OPTIONAL SFTP Provider
@@ -40,7 +40,7 @@ __webpack_require__.r(__webpack_exports__);
    */ async initialize(config) {
         try {
             // Dynamic import - only loads SFTP SDK if this provider is used
-            const sftp = await __webpack_require__.e(/* import() */ 385).then(__webpack_require__.bind(__webpack_require__, 240));
+            const sftp = await __webpack_require__.e(/* import() */ 385).then(__webpack_require__.bind(__webpack_require__, 2240));
             const SftpClient = sftp.default || sftp;
             this.sftp = new SftpClient();
             this.config = {
@@ -117,13 +117,25 @@ __webpack_require__.r(__webpack_exports__);
         return Promise.all(files.map((file)=>this.uploadFile(file, options)));
     }
     async deleteFile(key) {
+        const remotePath = this.resolveWithinBasePath(key);
         await this.connect();
         try {
-            await this.sftp.delete(key);
+            await this.sftp.delete(remotePath);
         } catch  {
         // Silent failure
         }
     }
+    /** Keys are remote paths; one outside basePath could delete anything the SFTP account can reach */ resolveWithinBasePath(key) {
+        const base = path__rspack_import_3.posix.normalize(`${this.config.basePath}/`);
+        const target = typeof key === 'string' ? path__rspack_import_3.posix.normalize(key) : '';
+        if (!target || key.includes('\0') || !target.startsWith(base) || target === base) {
+            throw new _nestjs_common__rspack_import_0.BadRequestException({
+                message: 'Invalid path: Path traversal attempt detected',
+                messageKey: _flusys_nestjs_shared_constants__rspack_import_1.SYSTEM_MESSAGES.PATH_TRAVERSAL_DETECTED
+            });
+        }
+        return target;
+    }
     async deleteMultipleFiles(keys) {
         await Promise.all(keys.map((key)=>this.deleteFile(key)));
     }

package/fesm/config/index.js

@@ -1,7 +1,7 @@
 export const __rspack_esm_id = 565;
 export const __rspack_esm_ids = [565];
 export const __webpack_modules__ = {
-884(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+4884(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * Domain event actions published by the storage module, alongside the CRUD
  * lifecycle actions every ApiService emits.
@@ -25,10 +25,10 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-34(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _event_actions_js__rspack_import_0 = __webpack_require__(884);
-/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(450);
-/* import */ var _storage_constants_js__rspack_import_2 = __webpack_require__(188);
+2034(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _event_actions_js__rspack_import_0 = __webpack_require__(4884);
+/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(5450);
+/* import */ var _storage_constants_js__rspack_import_2 = __webpack_require__(9188);
 
 
 
@@ -48,7 +48,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-450(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+5450(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 // ==================== STORAGE MODULE MESSAGE KEYS ====================
 const FILE_MESSAGES = {
     GET_ALL_SUCCESS: 'file.get.all.success',
@@ -82,7 +82,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-188(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+9188(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * Storage Module Constants
  */ const STORAGE_MODULE_OPTIONS = 'STORAGE_MODULE_OPTIONS';
@@ -106,7 +106,7 @@ import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
 import * as __rspack_chunk_1 from './index.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(34);var __webpack_exports__DEFAULT_ALLOWED_FILE_TYPES = __webpack_exports__.A_;
+var __webpack_exports__ = __webpack_exec__(2034);var __webpack_exports__DEFAULT_ALLOWED_FILE_TYPES = __webpack_exports__.A_;
 var __webpack_exports__DEFAULT_MAX_FILE_SIZE = __webpack_exports__.Sj;
 var __webpack_exports__FILE_MESSAGES = __webpack_exports__.uA;
 var __webpack_exports__FOLDER_MESSAGES = __webpack_exports__.Ee;

package/fesm/controllers/index.js

@@ -9,7 +9,7 @@ import * as __rspack_chunk_2 from '../537.js';
 __webpack_require__.C(__rspack_chunk_2);
 import * as __rspack_chunk_3 from './index.js';
 __webpack_require__.C(__rspack_chunk_3);
-var __webpack_exports__ = __webpack_exec__(488);var __webpack_exports__FileManagerController = __webpack_exports__.AE;
+var __webpack_exports__ = __webpack_exec__(5488);var __webpack_exports__FileManagerController = __webpack_exports__.AE;
 var __webpack_exports__FolderController = __webpack_exports__.X$;
 var __webpack_exports__StorageConfigController = __webpack_exports__.Iz;
 var __webpack_exports__UploadController = __webpack_exports__.I7;

package/fesm/docs/index.js

@@ -46,7 +46,7 @@ All queries automatically filter by current user's company context.
 
 ### Upload a File
 
-POST /storage/upload/single-file with multipart/form-data containing file and optional folderId
+POST /storage/upload/single-file with multipart/form-data containing \`file\`, and an optional \`folderPath\` query parameter
 
 ### Get All Files
 
@@ -71,7 +71,7 @@ Complete file storage and management system${enableCompanyFeature ? ' with multi
 - Automatic compression and optimization${companyIsolation}
 
 ### 🗂️ Folder Organization
-- Create folder hierarchies
+- Create folders (flat, one level)
 - Organize files by folders${companyPermissions}
 - Automatic context filtering
 
@@ -85,6 +85,7 @@ Complete file storage and management system${enableCompanyFeature ? ' with multi
 - JWT authentication required${companyIsolation}
 - File access control
 - Presigned URL generation
+- Locally stored files are served without authentication (GET /storage/upload/file/...) so they work in <img> tags; only files inside the local storage base path are reachable
 
 ## Storage Providers
 
@@ -111,14 +112,14 @@ ${multiTenantSection}
 ## File Validation
 
 ### Size Limits
-Configure maximum file size per upload (default: 10MB)
+Configure maximum file size per upload (default: 100MB)
 
 ### File Types
-Restrict allowed file types (default: images, PDFs)
+Restrict allowed file types (default: all types). File content is checked against its declared type (magic bytes); HTML, JavaScript and SVG are refused unless listed by their exact type.
 
 ### Image Compression
 - Automatic image optimization
-- Format conversion (JPEG, PNG, WebP, AVIF)
+- Format conversion (JPEG, PNG, WebP)
 - Resize to maximum dimensions
 - Quality control
 
@@ -132,13 +133,11 @@ Errors return structured responses with success false, error message, error code
 
 ## Common Error Codes
 
-- **400 Bad Request**: Invalid input data
+- **400 Bad Request**: Invalid input data, file too large, file type not allowed, or invalid file path
 - **401 Unauthorized**: Missing or invalid authentication
-- **403 Forbidden**: Insufficient permissions
-- **404 Not Found**: Resource not found
-- **413 Payload Too Large**: File exceeds size limit
-- **415 Unsupported Media Type**: File type not allowed
-- **500 Internal Server Error**: Server error
+- **403 Forbidden**: Insufficient permissions, or the record belongs to another company
+- **404 Not Found**: Resource or storage configuration not found
+- **500 Internal Server Error**: Server error, or a storage provider whose SDK is not installed
 
 ## Getting Started
 
@@ -168,10 +167,7 @@ ${examplesSection}
 
 ## Rate Limiting
 
-All endpoints are rate-limited to prevent abuse. Default limits:
-- **Upload**: 100 requests per hour
-- **Download**: 1000 requests per hour
-- **Delete**: 50 requests per hour
+Rate limits are set by the host application, not by this module.
 `;
 }
 /**

package/fesm/dtos/index.js

@@ -6,7 +6,7 @@ import * as __rspack_external_class_validator_7b99ef4d from "class-validator";
 export const __rspack_esm_id = 685;
 export const __rspack_esm_ids = [685];
 export const __webpack_modules__ = {
-775(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+9775(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -29,11 +29,11 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@nestjs/swagger"
-var swagger_ = __webpack_require__(176);
+var swagger_ = __webpack_require__(6176);
 // EXTERNAL MODULE: external "class-transformer"
-var external_class_transformer_ = __webpack_require__(812);
+var external_class_transformer_ = __webpack_require__(5812);
 // EXTERNAL MODULE: external "class-validator"
-var external_class_validator_ = __webpack_require__(421);
+var external_class_validator_ = __webpack_require__(5421);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/dtos/folder.dto.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -66,6 +66,7 @@ _ts_decorate([
     }),
     (0,external_class_validator_.IsNotEmpty)(),
     (0,external_class_validator_.IsString)(),
+    (0,external_class_validator_.MaxLength)(255),
     _ts_metadata("design:type", String)
 ], CreateFolderDto.prototype, "name", void 0);
 class UpdateFolderDto extends (0,swagger_.PartialType)(CreateFolderDto) {
@@ -111,7 +112,7 @@ _ts_decorate([
 ], FolderResponseDto.prototype, "slug", void 0);
 
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/enums/file-location.enum.ts
-var file_location_enum = __webpack_require__(733);
+var file_location_enum = __webpack_require__(2733);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/dtos/file-manager.dto.ts
 function file_manager_dto_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -152,6 +153,7 @@ file_manager_dto_ts_decorate([
     }),
     (0,external_class_validator_.IsNotEmpty)(),
     (0,external_class_validator_.IsString)(),
+    (0,external_class_validator_.MaxLength)(255),
     file_manager_dto_ts_metadata("design:type", String)
 ], CreateFileManagerDto.prototype, "name", void 0);
 file_manager_dto_ts_decorate([
@@ -170,6 +172,7 @@ file_manager_dto_ts_decorate([
     }),
     (0,external_class_validator_.IsNotEmpty)(),
     (0,external_class_validator_.IsString)(),
+    (0,external_class_validator_.MaxLength)(255),
     file_manager_dto_ts_metadata("design:type", String)
 ], CreateFileManagerDto.prototype, "size", void 0);
 file_manager_dto_ts_decorate([
@@ -179,6 +182,7 @@ file_manager_dto_ts_decorate([
     }),
     (0,external_class_validator_.IsNotEmpty)(),
     (0,external_class_validator_.IsString)(),
+    (0,external_class_validator_.MaxLength)(255),
     file_manager_dto_ts_metadata("design:type", String)
 ], CreateFileManagerDto.prototype, "contentType", void 0);
 file_manager_dto_ts_decorate([
@@ -401,11 +405,11 @@ file_manager_dto_ts_decorate([
 ], FilesResponseDto.prototype, "providerName", void 0);
 
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/dtos/upload.dto.ts
-var upload_dto = __webpack_require__(322);
+var upload_dto = __webpack_require__(7322);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/dtos"
-var dtos_ = __webpack_require__(873);
+var dtos_ = __webpack_require__(6873);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
-var utils_ = __webpack_require__(216);
+var utils_ = __webpack_require__(9216);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/dtos/storage-config.dto.ts
 function storage_config_dto_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -561,10 +565,10 @@ storage_config_dto_ts_decorate([
 
 
 },
-322(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_swagger__rspack_import_0 = __webpack_require__(176);
-/* import */ var class_transformer__rspack_import_1 = __webpack_require__(812);
-/* import */ var class_validator__rspack_import_2 = __webpack_require__(421);
+7322(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_swagger__rspack_import_0 = __webpack_require__(6176);
+/* import */ var class_transformer__rspack_import_1 = __webpack_require__(5812);
+/* import */ var class_validator__rspack_import_2 = __webpack_require__(5421);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -737,7 +741,7 @@ _ts_decorate([
         default: true
     }),
     (0,class_validator__rspack_import_2.IsOptional)(),
-    (0,class_transformer__rspack_import_1.Type)(()=>Boolean),
+    (0,class_transformer__rspack_import_1.Transform)(({ value })=>value === 'true' ? true : value === 'false' ? false : value),
     (0,class_validator__rspack_import_2.IsBoolean)(),
     _ts_metadata("design:type", Boolean)
 ], UploadOptionsDto.prototype, "compress", void 0);
@@ -809,7 +813,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-733(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+2733(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 var FileLocationEnum = /*#__PURE__*/ function(FileLocationEnum) {
     FileLocationEnum["AWS"] = "aws";
     FileLocationEnum["AZURE"] = "azure";
@@ -824,31 +828,31 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-873(module) {
+6873(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_dtos_c4585026;
 
 
 },
-216(module) {
+9216(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_utils_9125c1f1;
 
 
 },
-176(module) {
+6176(module) {
 
 module.exports = __rspack_external__nestjs_swagger_7cd450b5;
 
 
 },
-812(module) {
+5812(module) {
 
 module.exports = __rspack_external_class_transformer_c5a479fb;
 
 
 },
-421(module) {
+5421(module) {
 
 module.exports = __rspack_external_class_validator_7b99ef4d;
 
@@ -860,7 +864,7 @@ import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
 import * as __rspack_chunk_1 from './index.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(775);var __webpack_exports__CreateFileManagerDto = __webpack_exports__.rY;
+var __webpack_exports__ = __webpack_exec__(9775);var __webpack_exports__CreateFileManagerDto = __webpack_exports__.rY;
 var __webpack_exports__CreateFolderDto = __webpack_exports__._5;
 var __webpack_exports__CreateStorageConfigDto = __webpack_exports__.rb;
 var __webpack_exports__DeleteMultipleFileDto = __webpack_exports__.$V;

package/fesm/entities/index.js

@@ -4,7 +4,7 @@ import * as __rspack_external_typeorm from "typeorm";
 export const __rspack_esm_id = 604;
 export const __rspack_esm_ids = [604];
 export const __webpack_modules__ = {
-975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+1975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -25,7 +25,7 @@ __webpack_require__.d(__webpack_exports__, {
 ;// CONCATENATED MODULE: external "@flusys/nestjs-shared/entities"
 
 // EXTERNAL MODULE: external "typeorm"
-var external_typeorm_ = __webpack_require__(158);
+var external_typeorm_ = __webpack_require__(7158);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/entities/file-manager.entity.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -196,7 +196,7 @@ Folder = folder_entity_ts_decorate([
 ], Folder);
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared"
-var nestjs_shared_ = __webpack_require__(422);
+var nestjs_shared_ = __webpack_require__(3422);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/entities/storage-config.entity.ts
 function storage_config_entity_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -445,13 +445,13 @@ function getStorageEntitiesByConfig(enableCompanyFeature) {
 
 
 },
-422(module) {
+3422(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_393d2cae;
 
 
 },
-158(module) {
+7158(module) {
 
 module.exports = __rspack_external_typeorm;
 
@@ -463,7 +463,7 @@ import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
 import * as __rspack_chunk_1 from './index.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(975);var __webpack_exports__FileManager = __webpack_exports__.FileManager;
+var __webpack_exports__ = __webpack_exec__(1975);var __webpack_exports__FileManager = __webpack_exports__.FileManager;
 var __webpack_exports__FileManagerBase = __webpack_exports__.NP;
 var __webpack_exports__FileManagerWithCompany = __webpack_exports__.FileManagerWithCompany;
 var __webpack_exports__Folder = __webpack_exports__.Folder;

package/fesm/enums/index.js

@@ -1,7 +1,7 @@
 export const __rspack_esm_id = 743;
 export const __rspack_esm_ids = [743];
 export const __webpack_modules__ = {
-733(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+2733(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 var FileLocationEnum = /*#__PURE__*/ function(FileLocationEnum) {
     FileLocationEnum["AWS"] = "aws";
     FileLocationEnum["AZURE"] = "azure";
@@ -16,8 +16,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-406(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _file_location_enum_js__rspack_import_0 = __webpack_require__(733);
+3406(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _file_location_enum_js__rspack_import_0 = __webpack_require__(2733);
 
 
 __webpack_require__.d(__webpack_exports__, {
@@ -32,5 +32,5 @@ import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
 import * as __rspack_chunk_1 from './index.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(406);var __webpack_exports__FileLocationEnum = __webpack_exports__.N;
+var __webpack_exports__ = __webpack_exec__(3406);var __webpack_exports__FileLocationEnum = __webpack_exports__.N;
 export { __webpack_exports__FileLocationEnum as FileLocationEnum };

package/fesm/index.js

@@ -1,10 +1,10 @@
 export const __rspack_esm_id = 410;
 export const __rspack_esm_ids = [410];
 export const __webpack_modules__ = {
-34(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _event_actions_js__rspack_import_0 = __webpack_require__(884);
-/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(450);
-/* import */ var _storage_constants_js__rspack_import_2 = __webpack_require__(188);
+2034(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _event_actions_js__rspack_import_0 = __webpack_require__(4884);
+/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(5450);
+/* import */ var _storage_constants_js__rspack_import_2 = __webpack_require__(9188);
 
 
 
@@ -69,7 +69,7 @@ All queries automatically filter by current user's company context.
 
 ### Upload a File
 
-POST /storage/upload/single-file with multipart/form-data containing file and optional folderId
+POST /storage/upload/single-file with multipart/form-data containing \`file\`, and an optional \`folderPath\` query parameter
 
 ### Get All Files
 
@@ -94,7 +94,7 @@ Complete file storage and management system${enableCompanyFeature ? ' with multi
 - Automatic compression and optimization${companyIsolation}
 
 ### 🗂️ Folder Organization
-- Create folder hierarchies
+- Create folders (flat, one level)
 - Organize files by folders${companyPermissions}
 - Automatic context filtering
 
@@ -108,6 +108,7 @@ Complete file storage and management system${enableCompanyFeature ? ' with multi
 - JWT authentication required${companyIsolation}
 - File access control
 - Presigned URL generation
+- Locally stored files are served without authentication (GET /storage/upload/file/...) so they work in <img> tags; only files inside the local storage base path are reachable
 
 ## Storage Providers
 
@@ -134,14 +135,14 @@ ${multiTenantSection}
 ## File Validation
 
 ### Size Limits
-Configure maximum file size per upload (default: 10MB)
+Configure maximum file size per upload (default: 100MB)
 
 ### File Types
-Restrict allowed file types (default: images, PDFs)
+Restrict allowed file types (default: all types). File content is checked against its declared type (magic bytes); HTML, JavaScript and SVG are refused unless listed by their exact type.
 
 ### Image Compression
 - Automatic image optimization
-- Format conversion (JPEG, PNG, WebP, AVIF)
+- Format conversion (JPEG, PNG, WebP)
 - Resize to maximum dimensions
 - Quality control
 
@@ -155,13 +156,11 @@ Errors return structured responses with success false, error message, error code
 
 ## Common Error Codes
 
-- **400 Bad Request**: Invalid input data
+- **400 Bad Request**: Invalid input data, file too large, file type not allowed, or invalid file path
 - **401 Unauthorized**: Missing or invalid authentication
-- **403 Forbidden**: Insufficient permissions
-- **404 Not Found**: Resource not found
-- **413 Payload Too Large**: File exceeds size limit
-- **415 Unsupported Media Type**: File type not allowed
-- **500 Internal Server Error**: Server error
+- **403 Forbidden**: Insufficient permissions, or the record belongs to another company
+- **404 Not Found**: Resource or storage configuration not found
+- **500 Internal Server Error**: Server error, or a storage provider whose SDK is not installed
 
 ## Getting Started
 
@@ -191,10 +190,7 @@ ${examplesSection}
 
 ## Rate Limiting
 
-All endpoints are rate-limited to prevent abuse. Default limits:
-- **Upload**: 100 requests per hour
-- **Download**: 1000 requests per hour
-- **Delete**: 50 requests per hour
+Rate limits are set by the host application, not by this module.
 `;
 }
 /**
@@ -219,8 +215,8 @@ All endpoints are rate-limited to prevent abuse. Default limits:
 
 
 },
-406(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _file_location_enum_js__rspack_import_0 = __webpack_require__(733);
+3406(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _file_location_enum_js__rspack_import_0 = __webpack_require__(2733);
 
 
 __webpack_require__.d(__webpack_exports__, {
@@ -229,18 +225,18 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-395(module, __webpack_exports__, __webpack_require__) {
+6395(module, __webpack_exports__, __webpack_require__) {
 __webpack_require__.a(module, async function (__rspack_load_async_deps, __rspack_async_done) { try {
-/* import */ var _controllers_index_js__rspack_import_0 = __webpack_require__(488);
-/* import */ var _services_index_js__rspack_import_1 = __webpack_require__(148);
-/* import */ var _entities_index_js__rspack_import_2 = __webpack_require__(975);
-/* import */ var _modules_index_js__rspack_import_3 = __webpack_require__(329);
-/* import */ var _config_index_js__rspack_import_4 = __webpack_require__(34);
+/* import */ var _controllers_index_js__rspack_import_0 = __webpack_require__(5488);
+/* import */ var _services_index_js__rspack_import_1 = __webpack_require__(4148);
+/* import */ var _entities_index_js__rspack_import_2 = __webpack_require__(1975);
+/* import */ var _modules_index_js__rspack_import_3 = __webpack_require__(2329);
+/* import */ var _config_index_js__rspack_import_4 = __webpack_require__(2034);
 /* import */ var _docs_index_js__rspack_import_5 = __webpack_require__(659);
-/* import */ var _dtos_index_js__rspack_import_6 = __webpack_require__(775);
-/* import */ var _enums_index_js__rspack_import_7 = __webpack_require__(406);
-/* import */ var _providers_index_js__rspack_import_8 = __webpack_require__(922);
-/* import */ var _utils_index_js__rspack_import_9 = __webpack_require__(857);
+/* import */ var _dtos_index_js__rspack_import_6 = __webpack_require__(9775);
+/* import */ var _enums_index_js__rspack_import_7 = __webpack_require__(3406);
+/* import */ var _providers_index_js__rspack_import_8 = __webpack_require__(1922);
+/* import */ var _utils_index_js__rspack_import_9 = __webpack_require__(8857);
 var __rspack_async_deps = __rspack_load_async_deps([_modules_index_js__rspack_import_3]);
 _modules_index_js__rspack_import_3 = (__rspack_async_deps.then ? (await __rspack_async_deps)() : __rspack_async_deps)[0];// Export all storage module components
 
@@ -317,8 +313,8 @@ __rspack_async_done();
 } catch(e) { __rspack_async_done(e); } });
 
 },
-857(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _image_compressor_util_js__rspack_import_0 = __webpack_require__(872);
+8857(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _image_compressor_util_js__rspack_import_0 = __webpack_require__(1872);
 
 
 __webpack_require__.d(__webpack_exports__, {
@@ -339,7 +335,7 @@ import * as __rspack_chunk_3 from './562.js';
 __webpack_require__.C(__rspack_chunk_3);
 import * as __rspack_chunk_4 from './index.js';
 __webpack_require__.C(__rspack_chunk_4);
-var __webpack_exports__ = __webpack_exec__(395);__webpack_exports__ = await __webpack_exports__;
+var __webpack_exports__ = __webpack_exec__(6395);__webpack_exports__ = await __webpack_exports__;
 var __webpack_exports__CreateFileManagerDto = __webpack_exports__.rY;
 var __webpack_exports__CreateFolderDto = __webpack_exports__._5;
 var __webpack_exports__CreateStorageConfigDto = __webpack_exports__.rb;

package/fesm/interfaces/index.js

@@ -1,7 +1,7 @@
 export const __rspack_esm_id = 471;
 export const __rspack_esm_ids = [471];
 export const __webpack_modules__ = {
-820() {
+4820() {
 
 
 
@@ -16,4 +16,4 @@ import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
 import * as __rspack_chunk_1 from './index.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(820);
+var __webpack_exports__ = __webpack_exec__(4820);

package/fesm/modules/index.js

@@ -11,6 +11,6 @@ import * as __rspack_chunk_3 from '../562.js';
 __webpack_require__.C(__rspack_chunk_3);
 import * as __rspack_chunk_4 from './index.js';
 __webpack_require__.C(__rspack_chunk_4);
-var __webpack_exports__ = __webpack_exec__(329);__webpack_exports__ = await __webpack_exports__;
+var __webpack_exports__ = __webpack_exec__(2329);__webpack_exports__ = await __webpack_exports__;
 var __webpack_exports__StorageModule = __webpack_exports__.k;
 export { __webpack_exports__StorageModule as StorageModule };